Commit graph

69 commits

Author SHA1 Message Date
bf046ae280 Add AgentGit M1: agent-native git layer over a Forgejo backend
AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:

- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
  fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
  floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
  policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
  @logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)

27 vitest tests pass; full monorepo build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 15:15:06 +00:00
phucnguyen1707
14fe9d608f
Require CoinPay userinfo identity (#21) 2026-06-13 23:01:15 -07:00
RissRIce
63ccad6d2a
fix: handle invalid static path encoding (#36)
Co-authored-by: RissRIce <rissrice2105-agent@users.noreply.github.com>
2026-06-13 23:00:59 -07:00
Autowebassat-blip
3ceddaa911
Parse JSON extension case-insensitively (#29)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:59:39 -07:00
Autowebassat-blip
d9cf41e5a3
Handle malformed static paths (#31)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:59:10 -07:00
Autowebassat-blip
774d461db6
Block IPv4-compatible IPv6 feed URLs (#32)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:58:57 -07:00
Autowebassat-blip
307095d5e9
Fallback invalid CommandBoard web ports (#37)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:58:10 -07:00
Autowebassat-blip
ad3926a006
Handle empty arcade game lists (#38)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:57:56 -07:00
Autowebassat-blip
3afda8c147
Fallback invalid CommandBoard API ports (#39)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:57:43 -07:00
Autowebassat-blip
e89c10cc80
Reject malformed CoinPay webhook signatures (#41)
* Reject malformed CoinPay webhook signatures

* Fix webhook signature type guard

---------

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:56:12 -07:00
Autowebassat-blip
055cc09d14
Fallback invalid CoinPay checkout amounts (#42)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:55:53 -07:00
Autowebassat-blip
ffefd364ce
Ignore malformed feed probe candidates (#43)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:55:39 -07:00
lazyGPT07
fbf4d76372
fix(cli): validate positive numeric options (#49) 2026-06-13 22:55:18 -07:00
RissRIce
aa3fdba277
Detect podcast RSS item enclosures (#50) 2026-06-13 22:55:06 -07:00
lazyGPT07
be530ab687
fix(feeds): enforce freshness window (#52) 2026-06-13 22:54:53 -07:00
6D0N9
90fffb124e
fix(agentstack): assignTask refuses tasks in a terminal status (#47) 2026-06-13 22:54:08 -07:00
lazyGPT07
a4cc229120
fix(cli): block config prototype pollution (#54) 2026-06-13 22:52:20 -07:00
FuturMix
f8040e9736
fix(auth): remove hardcoded fallback session secret (fixes #59) (#60) 2026-06-13 22:51:24 -07:00
FuturMix
9d2c485071
fix(commandboard): add body size limit and handle JSON parse errors (fixes #61) (#62) 2026-06-13 22:51:09 -07:00
FuturMix
5cfece3b84
fix(auth): use base64url encoding in session signature verification (fixes #64) (#67) 2026-06-13 22:44:53 -07:00
FuturMix
df040f4ff0
fix(proxy): validate host against allowlist to prevent open redirect (fixes #65) (#68) 2026-06-13 22:44:26 -07:00
FuturMix
13e921c7af
fix(supabase): enable RLS on communication account tables (fixes #69) (#70) 2026-06-13 22:44:13 -07:00
lazyGPT07
7d6a033b41
Enforce trusted-agent policy conditions (#72) 2026-06-13 22:44:00 -07:00
phucnguyen1707
8f4691584c
Handle bad feed path encoding (#9) 2026-06-11 21:07:24 -07:00
6D0N9
3d4345b665
fix(validators): isSchemaKind no longer accepts inherited prototype keys (#14)
'value in schemas' walks the prototype chain, so inherited keys like
"toString" passed assertSchemaKind and then crashed ajv.compile with a
misleading 'schema must be object or boolean' error (e.g. via the CLI).
Use Object.hasOwn for an own-property check.

Adds unit tests rejecting prototype keys and asserting every real
schema kind still passes.

Fixes #13
2026-06-11 21:06:18 -07:00
Autowebassat-blip
73e2464b30
Block IPv6 unspecified feed URLs (#15) 2026-06-11 21:06:03 -07:00
Autowebassat-blip
9942ef8dc6
Ignore invalid feed discovery limits (#16) 2026-06-11 21:04:55 -07:00
Autowebassat-blip
9ed98ceaf7
Accept spaced CoinPay signature parts (#17) 2026-06-11 21:04:41 -07:00
Autowebassat-blip
d558554da3
Reject extra session token segments (#18) 2026-06-11 21:04:25 -07:00
Autowebassat-blip
aa7eb32c36
Return 400 for invalid task JSON (#19) 2026-06-11 21:04:10 -07:00
Autowebassat-blip
301b4ed535
Return 400 for invalid publish JSON (#20) 2026-06-11 21:03:19 -07:00
7cda686059
Add AgentAd ad schemas as a LogicSRC primitive (#10)
* Add AgentAd ad schemas as a LogicSRC primitive

AgentAd is a disclosed, agent-readable advertising contract for CLI tools
and AI agents. LogicSRC owns the canonical schemas; cl1s.tech is the
reference network built on them.

- packages/schemas: agentad-{ad,placement,ad-request,ad-response,
  impression,click,campaign} schemas (id under schemas.logicsrc.com) +
  ad/placement fixtures, exported from @logicsrc/schemas
- packages/validators: register the 7 agentad kinds, wire fixture
  validation, add tests (disclosure.sponsored must be true)
- docs/agentad.md: the AgentAd spec
- README: list AgentAd under v1 priorities

Validators build clean; all fixtures validate; vitest 4/4 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Prepare @logicsrc/schemas for npm publish

Add license, repository, homepage, keywords, publishConfig (public),
and a package README covering both the logicsrc-* core schemas and the
agentad-* family.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-11 21:02:43 -07:00
phucnguyen1707
ad9f3a2a29
Handle invalid JSON request bodies (#7) 2026-06-11 21:00:38 -07:00
850cf5ea44
feat(agentstack): add @logicsrc/agentstack coordination module (#5)
* feat(agentstack): add @logicsrc/agentstack coordination module

AgentStack is the LogicSRC module for portable agent, task, payment, and
reputation coordination across Profullstack apps. Reference implementation of
the `agentstack` capability in the Profullstack Shared AppKit OpenSpec.

- packages/agentstack: DID helpers (did:coinpay:user/agent), DidTask model +
  lifecycle, AgentStack in-memory coordinator (agents, tasks, delegation,
  events), and a validated LogicSRC plugin definition. 9 vitest cases.
- Wire @logicsrc/agentstack into the root build chain (after plugin-core).
- docs/agentstack.md + mention in openspec-comparison.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(agentstack): note dual-runtime support (Bun + Node.js + Workers + browser)

Matches the revised Shared AppKit PRD's Runtime Compatibility Strategy.
AgentStack is runtime-neutral (no Bun/Node-only APIs; time is injected).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-10 16:39:32 -07:00
c23ce42948 Add communication account plugin scaffolds 2026-06-09 10:02:07 +00:00
5cfeea6b57 Add feed discovery plugin 2026-06-09 09:34:31 +00:00
e47616bf9d fix(web): CI E2E — resilient blog/RSS without Supabase + update stale test
The dynamic /blog/rss.xml returned 500 in CI (no Supabase env) and the E2E
still asserted the old static feed's hand-written items.

- /blog, /blog/[slug], and /blog/rss.xml now degrade gracefully (empty feed/
  list, HTTP 200) when Supabase is unavailable, instead of throwing.
- E2E: assert the always-present channel <title>LogicSRC Blog</title> and a
  looser xml content-type, dropping the removed static post titles.

Verified with `next dev` and no Supabase env (CI conditions): rss/blog/sitemap
all return 200.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 13:00:51 +00:00
74abf8985f feat(web): og:image, /pricing + FAQ schema, llms-full.txt, GitHub nav
More AEO audit fixes (the content-independent quick wins):

- Generated 1200x630 OpenGraph/Twitter card (app/opengraph-image.tsx);
  drop the SVG fallback and use summary_large_image.
- /pricing page with question-style headings and FAQPage JSON-LD; clarifies
  the spec/tooling is free and implementation is $250/week.
- /llms-full.txt — full markdown of the curated docs concatenated for
  large-context RAG ingestion.
- GitHub link added to both navs (SPA rail + SiteShell) and Pricing nav item;
  /pricing added to the sitemap.

Verified in a running build: og image renders as PNG and is referenced in
head; /pricing serves FAQ + schema; /llms-full.txt concatenates docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:51:51 +00:00
fb20fd2e99 feat(web): real /about and /docs pages (unique crawlable content)
Addresses the top cross-engine AEO finding — every route previously served
the homepage SPA. /about and /docs are now distinct routes with their own
server-rendered content and titles.

- /about: substantive about page (what LogicSRC is, the standards surface,
  CommandBoard.run reference impl, GitHub, hire-us) — derived from public
  positioning, no fabricated team.
- /docs + /docs/[slug]: render the repo's docs/*.md (curated public set) via
  marked, statically generated at build (no runtime fs dependency).
- Drop about/docs from the catch-all; add doc URLs to the sitemap.

Verified in a running build: /about and /docs serve unique content with
distinct titles; /docs/[slug] renders each markdown doc.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:43:42 +00:00
6518dfb4a9 feat(web): AEO foundation — robots, JSON-LD, meta, llms.txt, security headers
Implements the high-signal, content-independent fixes flagged across the
multi-engine AEO audit:

- robots.txt (app/robots.ts): allow mainstream + AI crawlers (GPTBot,
  ClaudeBot, PerplexityBot, Google-Extended, …), disallow /api, link sitemap.
- Organization + WebSite JSON-LD on the root layout; BlogPosting JSON-LD on
  /blog/[slug].
- Richer metadata: descriptive default title, Open Graph + Twitter cards,
  canonical, icons, metadataBase.
- Per-route titles/descriptions for catch-all routes (docs, about, hire-us,
  agent-swarm, …) instead of the generic "LogicSRC".
- /llms.txt (llmstxt.org) and /skill.md capability manifest.
- /.well-known/security.txt (RFC 9116).
- Security headers via next.config: HSTS, X-Content-Type-Options,
  X-Frame-Options, Referrer-Policy, Permissions-Policy (CSP intentionally
  deferred to avoid breaking inline/stats/CoinPay scripts).

Verified in a running build: all routes serve correctly and headers are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:38:27 +00:00
ce79f02211 fix(web): correct blog colors for the light workspace + thumbnails
Only the .rail sidebar is dark; the .workspace content area is on the
light (#f6f7f4) page background. The previous blog styling assumed a dark
workspace, so text was light-grey on white (unreadable) and the link
green was too light.

- Darken the global link color to #0a7d59 (readable on white); content
  links only — rail nav stays inherited.
- Repaint .blog-content (post HTML) for a light surface: dark body text,
  light code/pre, light borders.
- Blog index/post: dark titles, readable grey meta, light row borders;
  light-themed footer.
- Add post thumbnails to the /blog index from featured_image.url.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:21:46 +00:00
7e11130467 feat(web): site chrome on /blog + distinct content link color
- Add SiteShell (rail nav + workspace + footer) and wrap /blog and
  /blog/[slug] in it so they share the site's dark chrome instead of
  rendering as bare standalone pages.
- Style rendered post HTML (.blog-content) for the dark workspace.
- Links were `color: inherit` everywhere, so content-area links matched
  body text and were invisible. Give links a distinct accent (#5ac8a6);
  keep the rail nav and buttons on their own colors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:12:54 +00:00
cf99e93c53 feat(web): blog-post ingestion webhook + /blog, dynamic RSS & sitemap
Add an autoblog webhook receiver and a Supabase-backed blog to logicsrc-web
(the app had no Supabase usage before).

- Migration: blog_posts table (RLS: public reads published, service-role
  writes). Applied to the linked project.
- POST /api/webhooks/blog: verifies the Standard Webhooks signature against
  BLOG_WEBHOOK_SECRET via @profullstack/autoblog verifyAndParse (no admin
  user — shared secret only) and upserts the post by slug.
- /blog index + /blog/[slug] render published posts from the table.
- /blog/rss.xml and /sitemap.xml are now dynamic, generated from the table;
  removed the static public/sitemap.xml and public/blog/rss.xml.
- BLOG_WEBHOOK_SECRET added to .env.example.

Verified end-to-end: a signed sample post delivered 200 and appeared in the
index, post page, RSS, and sitemap; build + typecheck pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 11:53:43 +00:00
crawlproof[bot]
ade606c157
Add CrawlProof stats tracker (#4)
Co-authored-by: crawlproof[bot] <286981042+crawlproof[bot]@users.noreply.github.com>
2026-06-08 04:35:33 -07:00
d0c6752194 ci: build workspaces before running tests; set PUBLIC_URL=https://logicsrc.com
The 'test' workflow ran 'npm test' without building, so dependents could not
resolve @logicsrc/plugin-core / @logicsrc/validators (they publish from dist/).
Build first. Also document PUBLIC_URL (canonical site URL) in .env.example.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-07 03:51:00 +00:00
7e51cf7311 Merge: migrate logicsrc-web to Next.js 16 App Router 2026-06-07 03:50:27 +00:00
f0a9f3890e Migrate logicsrc-web from Vite SPA to Next.js 16 App Router
Replaces the Vite single-page app + custom Node server.js with a Next.js
16.2.6 App Router app.

- proxy.ts (src/proxy.ts): www.logicsrc.com -> logicsrc.com 301 over https,
  preserving path + query (the original request, now via Next 16 Proxy).
- One SSR page via an optional catch-all ([[...slug]]) that renders the same
  marketing/spec page for each known top-level route (/docs, /blog, /openspec,
  ...) and 404s unknown paths, preserving existing canonical URLs. Markup is a
  faithful server-rendered port of the old main.ts (SEO upgrade over the prior
  client render); interactivity (hire-us form, CoinPay button, section scroll)
  moves to a client component.
- API routes ported to app/api/**: hire-us coinpay-checkout + project-request,
  oauth/coinpay start/callback/session, webhooks/coinpay. Shared logic in
  src/lib/coinpay.ts (eligibility, payment-rail selection, webhook verify,
  HMAC session sign/verify, cookies).
- commandboard-api (/health + /api/boards|tasks|plugins/*) is no longer mounted
  in-process; next.config.ts proxies those paths to COMMANDBOARD_API_URL via
  afterFiles rewrites (our own /api routes match first).
- Build/start switch to next build / next start. Contract tests rewritten to
  exercise proxy.ts, the route handlers, and pure helpers directly (21 passing);
  Playwright webServer updated.

Deployment (Railway): set COMMANDBOARD_API_URL to the commandboard-api service
URL and run it as its own service; root start now runs next start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-07 03:41:48 +00:00
cf5d526176 Show CoinPay connection status on homepage
Checks /api/oauth/coinpay/session on load and updates the Connect button
to reflect the authenticated user's email when already connected.
Also cleans the coinpay_oauth query param from the URL after OAuth callback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-07 03:23:17 +00:00
4682b261c0 Add waiting arcade MVP 2026-06-06 22:09:22 +00:00
b1d8fe475a feat: add c0mpute plugin and hire-us request flow 2026-06-06 19:42:00 +00:00