| Files | Last commit | Last update |
|---|---|---|
Harden runtime authority and security boundaries for 0.9.13 - Exact-byte project-hook approval tied to workspace trust; hook event registry gains session_idle/session_error/waiting_for_user (wired in the follow-up session-lifecycle commit). - Complete read-only shell argument and pipeline validation, including sed scripts and write/execute flags; safe Git revision resolution for verify/review; LSP workspace containment. - Unauthenticated Runtime operation is loopback-only; outbound web requests require review and the Auto-Review benign-query bypass is closed; fresh model-backed security reviews bypass the response cache instead of reusing cached allow decisions. - Immutable MCP denial ceilings across child, resume, pool, meta, resource, and runtime-added paths; guarded HTTP/SSE/OAuth networking with DNS validation/pinning, redirect restrictions, policy propagation, and explicit private-network authority; MCP login background machinery keeps proxy use explicit (operator-only) with ambient-proxy regressions pinned. - Admin login throttling on the web surface, with tests. - Goal complete/block HTTP transitions are revision-checked transactions so a stale load-then-save cannot clobber a concurrent PUT replacement (409). - /hooks events lists every runtime event; event_label reuses the one HookEvent::as_str authority. Evidence (this tree): full workspace Clippy green (all targets, all features); codewhale-tui lib suite 11974 passed / 0 failed; focused suites from builds 7-9 (guarded HTTP 9, guarded OAuth 4, broad MCP 218 + 1 ignored, reviewer 5, Auto-Review 54, response-cache 4, preview-filter 178); web package 411 tests + typecheck + extension 42 tests green. Hosted CI and release artifacts are separate lanes and are not claimed here. | 2 months ago | |
feat(web): community site for deepseek-tui.com (mobile + color refresh) (#1108) First commit of the Next.js community site that powers deepseek-tui.com, deployed via Cloudflare Workers / OpenNext. This commit lands the scaffold and applies the visual + correctness pass requested by community feedback: - Palette: drop the cream/Anthropic-feel paper (#F4F1E8) for a DeepSeek-aligned cool white + soft gray (#FFFFFF / #F4F6FB), with indigo accents kept. Soften default hairlines so a pure-white background reads clean instead of harsh. - Mobile: add a hamburger menu (mobile-menu.tsx) so phones can reach Install / Docs / Activity / Roadmap / Contribute — previously the link list was hidden on phones with no replacement. Tighter hero, flexible button row, viewport-safe code blocks, columnar grids collapse cleanly under 768px, and the printed-almanac center rule is desktop-only now (it sliced through narrow viewports). - "How it works" diagram: replace the hand-rolled ASCII art (which misaligned under CJK monospace because Han characters take 2 columns vs Latin's 1, per dhh's note in WeChat) with a real mermaid diagram rendered client-side via dynamic import. Uses the mermaid.live standard syntax 庄表伟 recommended. - Issue #1104: the docs listed a deepseek-cn provider that the v0.8.16 binary doesn't accept (ProviderArg in crates/cli only has 9 variants; the 10th lives only in the legacy tui/config.rs). derive-facts.mjs now omits deepseek-cn until that variant is wired through the shared ProviderKind, and the install page's China-network recipe uses base_url / DEEPSEEK_BASE_URL (which actually works on v0.8.16) instead of the unsupported provider. Auto-deploys via .github/workflows/deploy-web.yml on push to main. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> | 5 months ago | |
Add mixed-material merch collection and private interest signup Visitors can choose cotton tees, stretch ombre/polo/hoodie styles, desk gear and the planned doll, then optionally give CNY/USD item-price feedback. Eight apparel styles retain the Ocean Wave mascot and a separate contributor at-cost flow; all purchase/supplier gates remain disabled. Signup awaits durable CURATED_KV, validates bounded same-origin requests, records explicit unverified opt-ins for 180 days, and applies native 5/min limits. Owner-session admin read/delete has no public contact/count path. No campaign service, live payment, supplier order or deployment is enabled. Validation on wave/0.10.1-next: - npm test: 1266 passed, 7 existing skips (101+19+384+762). - npm run check:web:PASS (facts/docs/tokens/ESLint/TypeScript/production build). - Source interest suite: 38/38 passed; source/assets match reviewed slice. - Native Workerd persisted local KV through restart; sixth request 429. - Full OpenNext local preview:EN/ZH 200, availability true, synthetic save 200, stored server-derived budgets; unauthorized admin 401. - Browser administration-policy verification unavailable; no new rendered interaction or screenshot proof. Existing DraftClaimLock, model settings, dependencies and auth safeguards are preserved. Contributor-language and delivery/artwork routes still need quotes and physical samples; survey prices exclude shipping/tax. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 1 month ago | |
fix(web): serialize draft generation with maintainer review [skip ci] CW-6945 / #6556 W02-05. A pending generator could put a discarded draft back on the review list. Save under the per-identity claim and retain the old decision until replacement writes succeed. Stage both weekly digest records together under that claim. Check the exact reviewed revision under the same claim before acting, including when a worker reads stale KV. Legacy records without a stored revision keep their reviewed-text check. 82 focused web checks and TypeScript passed. Replayed overlapping discard and failed reopen, then stale copies at both admin actions. Both stale actions returned 409 with zero outbound calls. Local workerd granted 1 of 8 concurrent claims and retained the revision after restart. Rechecked all 51 review-state cases after reusing the existing digest TTL. No hosted release validation or deployment. | 7 days ago |