299 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Claude Fable 5	627f128ab8	Pond lifecycle in the UI: create shared ponds, delete from settings ... The pond switcher grows a "+ New pond" entry with an inline form (name + optional description, quota errors surfaced translated); the pond settings of shared ponds end in a danger section that moves the pond to the site-level trash after typing its name to confirm. Personal ponds keep hiding the section. .button--danger is now a solid red button (also fixes the admin restore button, which showed red text on the accent-green background). Manuals no longer call these actions API-only; covered by a members-pack e2e test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 19:15:34 +02:00
Claude Fable 5	0c9d44e9c9	Legal texts for dorfteich.online; legal template covers the newer processing ... - deploy/legal/dorfteich-online-{impressum,datenschutz}.md: ready-to- paste Markdown for the flagship instance (Admin → Legal pages after the wizard) — operator standard texts (§5 DDG, §18(2) MStV, VSBG no-participation, UGC/liability/copyright notices) plus a privacy policy grounded in what THIS instance actually does: Hetzner hosting with DPA, session cookie only (no banner), rate-limit IPs, proxy logs ≤30d, transactional + digest mail with unsubscribe, plaintext content with versions/comments and public pages, hashed API tokens with audited writes, nightly backups incl. the encrypted-tunnel mirror to the operator's private server, self-service export, deletion/pseudonymization, LfDI BaWü. - docs/self-hosting/legal-template.md: review checklist and both language templates extended for the processing added since #82 — comments/version history, notifications/digest mails, API tokens, off-host backup copies. No legal advice; texts follow the operator's standard building blocks and should get a final human read before publishing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 19:00:05 +02:00
Claude Fable 5	eeb0ef6794	Documentation set: features, manuals (user/pond-admin/site-admin), API, MCP, developer guide ... Seven audience-targeted documents (English first, German translation to follow), linked from the README and a new docs/manual/ index: - docs/features.md — public-facing feature overview: what Dorfteich can do and why that matters - docs/manual/user-guide.md — everyday use: editor, wikilinks, labels, search, comments, watches/digests, import/export, settings - docs/manual/pond-admin-guide.md — pond configuration: members/roles, access rules incl. label scoping and public pages, labels, comment policy, plugins, API/MCP opt-ins, files, export - docs/manual/site-admin-guide.md — instance administration: wizard, settings, quotas, uploads, API/MCP switches, legal pages, plugins, users, and the system panel (jobs/backups/audit/storage) - docs/manual/api-guide.md — example-driven public-API walkthrough (tokens, reading, writing through the collab-safe path, labels, comments, error semantics) - docs/manual/mcp-guide.md — connecting AI assistants: switches, token scopes, Claude Code one-liner, mcp-remote bridge, tool table, audit and safety properties - docs/developer/extending.md — plugin development (sandbox contract, SDK, block plugins, bundled apps/fullscreen, shipping) and core contributions (stack, dev environment, gates, house rules) README: documentation index, repository-layout rows for docs/manual and docs/developer, and the stale "architecture phase" status brought up to reality. All relative links verified. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 17:18:30 +02:00
Claude Fable 5	6d710caa50	Go-live checklist: prod mirror verified live after the v0.2.0 deploy ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 15:54:24 +02:00
Claude Fable 5	c8ec549fa5	UI polish: frameless plugin blocks in read mode, sticky toolbar, pinned footer, icon uninstall ... Three refinements from Stefan's review of the plugin work: - read mode integrates plugin output like normal content: no border, no name bar, no selection outline around plugin blocks — same principle as the frameless reading shell (M10) - the editor toolbar pins to the top of the scrolling content area on long articles instead of scrolling away (position: sticky within the main scroll container) - the app footer (connection status + legal links) moved out of the scroll container into a main-column wrapper — always visible at the bottom edge of the window on every view - the plugin uninstall buttons in the admin list are icon buttons now (Trash2, house pattern: aria-label keeps the accessible name) - lint hygiene: eslint/prettier ignore packages/plugins/*/vendor — the unpacked drawio webapp drove eslint out of memory Verified in the browser against a local stack (5/5 scripted checks: icon buttons, toolbar sticky at scroll bottom, footer pinned in edit and read mode, plugin block computed border/outline none in read mode) plus 8 layout-sensitive e2e packs re-run individually, all green (comments, collab, legal, content, plugin-admin, plugin-blocks, page-tools, plugins). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 15:33:32 +02:00
Claude Fable 5	97f94f247b	draw.io reference plugin: fullscreen editing, inline SVG rendering ... A new block plugin bundling the OFFICIAL draw.io editor — nothing ever loads from diagrams.net; the sandbox CSP pins every request to the plugin's own version-pinned asset path (zero-external-network verified live via a request-capture run). Plugin (packages/plugins/drawio): - block data { xml, svg }: xml is the draw.io source (document of record), svg the rendered snapshot as raw markup — render mode, office/PDF exports (the existing fallback renderer already inlines data.svg) and the public view all show the diagram without running diagram code - edit mode: snapshot + "edit in fullscreen" (an empty block opens the editor immediately); the bundled editor runs in a child iframe of the plugin's own assets and speaks draw.io's JSON embed protocol — Save & Exit exports xmlsvg, persists { xml, svg } via blockData, and drops back to the inline size - build.mjs fetches the pinned release (v30.3.6) into a gitignored vendor/ cache (fonts-build pattern; skipped in CI — plugin.js still bundles, the installable ZIP needs a dev machine) and packs a trimmed webapp subset: no dev sources, no embed.diagrams.net integrations bundle, no standalone viewers, no MathJax/templates/PWA — 27 MiB ZIP, 85 MiB unpacked, de+en editor languages Host/SDK extensions (generic, not drawio-specific): - new ui.enterFullscreen()/exitFullscreen(): the surface's frame becomes a viewport-covering overlay — same sandboxed iframe, only geometry changes; destroy removes the frame, so a vanished plugin can never leave the app covered - sandbox CSP: connect-src/frame-src now allow the plugin's OWN asset path (was 'none') — bundled apps lazy-load their resources and run in a child frame, but the api and external hosts stay unreachable; HTML assets are served with the same CSP so a packaged page cannot widen the rules, and child frames inherit the sandbox attribute - plugin size limits raised (ZIP 5→64 MiB, unpacked 20→256 MiB) for bundled-app plugins; content types for xml/txt/ico assets Verified end to end against a local stack (9/9): install via dropzone (85 MiB validation), block insert, fullscreen entry, bundled editor boots inside the double sandbox (German UI), shape drawn, Save & Exit persists, snapshot renders inline, survives reload, zero off-origin requests throughout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 14:15:30 +02:00
Claude Fable 5	203f7c98a5	Tick the go-live mirror item: BASEL mirror live on Test, Prod prepared (#84) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 12:33:00 +02:00
Claude Fable 5	52192eb05f	Backup mirror to BASEL: rsync of the sets after every successful run (#84) ... The operator-level extra beside the admin-configured Nextcloud target (#103), unblocked now that the ONE→BASEL tunnel is stable again. - sidecar: optional mirror step (mirror.ts) driven purely by env — BACKUP_MIRROR_TARGET (rsync-over-ssh), BACKUP_MIRROR_SSH_KEY (private key on the secrets volume, never in image or repo), BACKUP_MIRROR_SSH_PORT. Runs after the prune of every successful run, so --delete aligns the remote retention with the local one (the newest-complete-set guarantee carries over). Only set files travel (db-*.dump, files-*.tar.gz); status files and bundles stay local. Host key pinned via accept-new into .mirror_known_hosts on the backups volume; fixed remote modes (dirs 750, files 640, symbolic --chmod — octal needs rsync ≥ 3, macOS dev machines ship 2.6.9). rsync + openssh-client added to the sidecar image. - status: additive `mirror` block in status.json (outcome, transferred count, lastSuccessAt carried across failures) — shown on the admin backup card; failures alert via a new backupMirrorFailed mail (de+en) while the local run still counts as succeeded. - deploy/backup-basel.md: complete BASEL-side walkthrough — dedicated user dorfteich-backup with a /home/ home and a bash login shell, explicitly avoiding the Debian backup-user (UID 34) pitfalls (nologin shell rejects rsync sessions, /var/backups home), key placement through the api container onto the secrets volume, .env values, on-demand verification. - tests: rsync-arg/stats-parsing units plus an integration suite against the real rsync binary (local target; skips where rsync is absent) — transfer, idempotent re-run (0 files), retention alignment, failure path carrying lastSuccessAt. Verified live against the real BASEL host from a native sidecar run: initial transfer, host-key pinning, retention alignment after a local prune, idempotency, and the failure path (surfaced in status.json while the local run stayed green). BASEL side provisioned per the doc. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 12:20:32 +02:00
Claude Fable 5	04e21a0aac	Built-in MCP endpoint (Streamable HTTP) on top of the public API (#105) ... AI clients talk to the instance directly at /api/mcp — under the /api/ path (deviation from the issue's literal /mcp) so every existing reverse proxy already routes it; no deployment changes anywhere. - Transport: official @modelcontextprotocol/sdk server, STATELESS — each POST builds a fresh server+transport pair, no session store, replicas stay trivial; GET/DELETE answer 405. Auth per PAT bearer (#104 tokens), per-token rate limit (429 + Retry-After). - Own switches, independent of REST: instance mcp.enabled (admin settings, default off; off = 404, feature invisible) + pond setting mcpEnabled (pond-settings toggle, default off) — pinned independent in both directions by tests. - Tools (thin wrappers over the #104 services, same permission gates, audit-logged writes): list_ponds, list_pages, read_page, search, create_page, update_page (replace semantics through the collab-owned restore path — open editors converge), add_comment, list_labels, set_page_labels (exact replace), export_pond (link to the REST ZIP). Tool errors carry the api error codes; results carry stable slugs/ids. MCP resources stay the documented stage-2 stretch goal. - Deliberately on the SDK's low-level Server API with a hand-written tool table (mcp-tools.ts): the typed registerTool generics drove tsc out of memory in a program this size; manual Zod validation keeps the wire behavior explicit. - PublicApiService exposure filtering parameterized ('api' | 'mcp', shared pondFeatureEnabled helper) — one implementation, two switches. - Docs: "Connect Claude Code / MCP clients" section in public-api.md (claude mcp add one-liner + mcp-remote bridge for stdio clients). Verification: 8-test e2e pack driving the real MCP SDK client over Streamable HTTP against a listening api (initialize + tools/list, switch independence in both directions, anonymous/garbage 401, opt-in 404 semantics, page roundtrip incl. restore-NOTIFY, labels/comments, read scope blocked from writes with scope_required); live check through the web proxy against the seeded stack (tools list, create, read, update, search — LIVE CHECK PASSED); full api suite 61/61 files green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 11:36:02 +02:00
Claude Fable 5	52975bad0a	Deflake the collab restore-listener DB test (poll for the PRE_RESTORE row) ... The client converges on the restored content via the broadcast INSIDE the document transact — before the listener commits the PRE_RESTORE version row. Asserting the row immediately after convergence is a race that CI lost on the #104 run; poll for it instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 11:23:18 +02:00
Claude Fable 5	0c85293830	Public REST API v1: personal access tokens, instance switch + per-pond opt-in (#104) ... Token-authenticated machine access at /api/public/v1 — the foundation for the built-in MCP endpoint (#105). Personal access tokens: - api_tokens table (SHA-256 hash, scope read|write, optional pond restriction, expiry, revocation, throttled last-used) + migration; secrets are dt_pat_<random>, shown exactly once - lifecycle endpoints under /users/me/api-tokens (session-only — a leaked token can never mint more tokens) with audit entries api.token_created/api.token_revoked - settings UI section (create with scope/expiry/pond restriction, one-time reveal with copy, list with status + revoke), de+en Activation (404 semantics per #60 on both levels): - instance setting api.enabled (default off, admin settings switch) - pond setting apiEnabled (default off, pond settings toggle; the PondsService settings-merge learned the key — the #92 lesson) Surface (/api/public/v1, excluded from the SPA's global prefix): - me, ponds, pages (list/read as Markdown+HTML, create from Markdown via the shared pipeline, PATCH title/content, DELETE to trash), search (permission-filtered + narrowed to exposed ponds, highlights as **…**), markdown ZIP export, labels (tree, create/rename/recolour/move/delete, assign/unassign), comments (threads, create, resolve/reopen) - content replacement travels the collab-owned document path: the new state lands as a MANUAL version "API update", then the established restore NOTIFY applies it — open editors converge, history stays append-only, no second lineage (VersionsService.replaceContent) - hand-maintained OpenAPI 3.1 document at /openapi.json, pinned to the controller by a route-coverage test in both directions Enforcement: - PublicApiGuard: instance switch → bearer PAT auth (request.user is the token's user) → per-token rate limit (429 + Retry-After) → scope (403 scope_required) → pond opt-in + token restriction - the shared PermissionGuard then applies the unchanged permission model; PageParamSource gained pondSlugParam for the slug+slug routes - no cookies anywhere → no CSRF surface (pinned by a hostile-Origin test) - every write audit-logged as api.write with the token attributed Tests/verification: - 12-test e2e pack: lifecycle, switches, permission matrix (reader/editor/outsider × scopes), restriction, page roundtrip incl. restore-NOTIFY assertion, labels, comments incl. policy, search narrowing, ZIP export, rate limit; full api suite 60/60 green (quota fixture via per-user override — never the instance default) - new collab-pack test proves an open editor converges onto an API content replacement (green against a local seeded stack) - UI smoke against the built SPA: token create/reveal/revoke, pond opt-in persists, admin switch persists (10/10) - docs/self-hosting/public-api.md + README link Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 11:17:03 +02:00
Claude Fable 5	5cef359b8f	Nextcloud backup target: admin-configured, manual + scheduled uploads, in-app restore (#103) ... Off-host backups for every self-hoster, configured entirely in the admin UI — supersedes the host-specific mirror plan behind #84. shared: - webdav.ts (new package entry like token-crypto): minimal WebDAV client with basic auth — PROPFIND (tolerant multistatus parser), MKCOL, PUT (streamed), GET, DELETE; Nextcloud DAV path derived from the plain server URL, explicit DAV bases pass through - backup-status.ts: additive remote-upload status in status.json, the restore-status.json contract (running/succeeded/failed + staleness bound), the backup_command/backup_maintenance NOTIFY channels, and the one-bundle-per-set naming (dorfteich-backup-<id>.tar.gz) - backup-set.ts moved here from apps/backup (api lists local sets) backup sidecar: - reads the backup.* instance settings directly from the database (admin changes apply next run; local retention row overrides the env) and the app password from the secret store - after each successful set: bundle dump + files archive + manifest into ONE self-contained tar.gz, upload via WebDAV per schedule (off/daily/weekly; manual runs always upload), prune remote bundles — never the newest — and record the outcome in status.json; upload failures alert via a new backupUploadFailed mail (de+en) - command listener on backup_command (run / restore) with a serial queue against the nightly timer - restore orchestrator: restore-status.json → maintenance NOTIFY → grace → (remote: download + manifest-verify bundle) → terminate other DB connections → shared perform-restore path (same code as restore.sh) → final status + maintenance exit api: - MaintenanceGuard (global, registered before the setup gate): 503 maintenance_mode while restore-status says running; health endpoints and the new public GET /backup/restore-status stay exempt; a stale running state (crashed sidecar) unblocks after 30 min - MaintenanceStateService watches the file and restarts the api after a successful restore (fresh caches, migrate-on-start for older dumps); main.ts refuses to touch the database while a restore runs — a container restarting mid-restore must not race pg_restore with migrate deploy - worker sweeps (conversion, mail outbox, scheduler) catch transient database failures instead of dying on an unhandled rejection — the restore's connection termination crashed the api in verification - backup admin endpoints under /admin/system/backup: settings (live connection test before save, password write-only into the secret store), nextcloud/test, sets (local via the ro backups mount + remote via WebDAV), run + restore (type-to-confirm backstop, source validation) — commands travel as NOTIFY payloads; audit actions backup.settings_changed/run_triggered/restore_requested - readyz: new warning-level backup_remote check while a target is configured (26 h daily / 170 h weekly bound) collab: - maintenance listener: on enter, persist + close every live session and refuse new connections until exit (failsafe timeout 30 min) — no in-memory document may write pre-restore content back afterwards web: - Admin → System backup section: status card with remote facts and a "Back up now" button, the Nextcloud settings form with test button, and the restore picker (local + remote sets, type-to-confirm) - global maintenance screen: any 503 maintenance_mode flips the SPA to a status page polling the exempt endpoint, reloading when the instance returns Verified end-to-end against a live stack (fresh DB, native api + sidecar, fake WebDAV server): configure → test → manual backup → bundle upload → readyz/sets/status surfaces → remote restore with maintenance gate, marker rollback and api restart; suites: shared 21, backup 9, collab 11, api 58 files green, lint + i18n:check + typecheck clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 10:39:18 +02:00
Claude Fable 5	83fa23bbf9	Polish round 2: content footer, dismissable menus, manual versions, substring search, icon actions in settings (M10 follow-up) ... - content footer: the collab status is an icon (wifi/off/refresh, localized tooltip + visually-hidden text, class/data-status hooks kept for e2e) on the left, the legal links right-aligned; read mode drops the editor frame and its inner padding, edit mode keeps it - menus (page overflow, user, notifications bell, pond switcher) close on outside click and Escape via a shared useDismissable hook; the bell got its missing tooltip - side panels (labels, history) stack vertically in one column - edit mode gains a Save-version icon (prompt for the name, POST /pages/:id/versions); the history panel lists contributors by display name — more than three collapse to two plus an expandable ellipsis (PageVersionView.contributors resolved server-side, deleted users drop out) - search finds partial words via a LIKE fallback next to the tsquery (FTS matches still rank first; regression-pinned in the db pack), and the recent-searches list has a clear button - pond owners create labels directly in the label picker (plus a permanent link to the full manager); add/remove/delete buttons across the pond settings (members, access rules, labels, files) and the watch/unwatch toggles in pond/user settings are icon buttons now — class hooks and accessible names unchanged for the e2e packs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 07:13:34 +02:00
Claude Fable 5	33121cd73d	Move pond settings to a TopBar gear, pin the trash link to the sidebar bottom (M10 follow-up) ... - owners get a Settings icon next to the pond name while a pond route is active (same lucide set, localized aria-label/tooltip via the existing labels:link key); gone on non-pond routes and for non-owners - the trash stays a text link but pins to the sidebar's bottom (.sidebar is a flex column now; .sidebar__footer uses margin-top:auto) - trash.spec: delete flows go through the #101 overflow menu (was missed in 65f30a5 — the pack is not part of CI) - markdown.spec: replace the wait for the 'saved' status removed in #36 with polling the export endpoint (pre-existing local failure, same category as the known image.spec one) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 06:07:15 +02:00
Claude Fable 5	e740ea6c01	Move live presence into the TopBar, signed-in only (#102) ... - the TopBar registers a presence slot (only rendered for signed-in users) next to the page-actions slot; PageEditor portals the PresenceStrip into it — behavior unchanged (initials avatars, max 5 + overflow, viewer badge, hidden when empty, both view and edit mode) - pinned guarantee: public.spec asserts the anonymous read path opens no /collab websocket and renders no presence data Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 04:42:59 +02:00
Claude Fable 5	65f30a5231	Move page actions into the TopBar as self-hosted icon buttons (#101) ... - lucide-react (MIT, tree-shaken, compiled into the bundle — no runtime requests; fonts.spec's off-origin assertion covers the page route) - page-actions slot: TopBar registers a DOM element via context, the active page portals its actions into it, TopBar stays page-agnostic - PageActions: mode toggle, watch (WatchToggle icon variant), comments (unread badge kept), attachments, plugin page tools, labels, history as icon buttons with localized aria-label+tooltip (de+en), plus an overflow menu for markdown copy/download, docx/odt/pdf export and the destructive delete (confirm kept) - page header keeps only the title; the editor-shell tools row is gone; panel state lives in PageEditorPage now - hamburger/search/bell adopt the same icon set - e2e: content/export open the overflow menu; class hooks (editor-page__mode-toggle, editor-shell__*-toggle, editor-page__labels-toggle, editor-page__export) kept stable Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 04:39:42 +02:00
Claude Fable 5	49e4377764	Let pages use the full width of the content area (#100) ... - drop the 48rem cap on .editor-page (view and edit mode); the public read view keeps its own narrow reading layout - min-width: 0 on .app-body — as a grid item it defaulted to a min-content minimum, which pushed the whole app wider than the viewport once the cap was gone - .editor-page__header wraps so the action buttons never force horizontal page scrolling (interim until #101 moves them to the TopBar) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 04:24:22 +02:00
Claude Fable 5	6c4f37ef91	Make the sidebar width drag-resizable and persistent (#99) ... - SidebarResizer: pointer-drag handle on the sidebar's right edge, keyboard-adjustable (arrows, Home/End), double-click resets to the 16rem default; width clamped to 12-32rem - AppLayout persists the width via usePersistentState (ui.sidebar.width) and sets --sidebar-width inline on .app-body, so collapse/force-hide keep animating from/to the chosen width - localized aria-label (de+en), handle hidden while collapsed Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 04:16:56 +02:00
Claude Fable 5	a9e901c449	Run operations QA on every release candidate before the prod gate (#90) ... New deploy/release-qa.sh, wired as the release workflow's second job: it boots the PREVIOUS release with pre-seeded fixture content in a scratch environment, swaps the api to the candidate against the same database (migrations auto-apply, readiness green, content intact — the seed_fixture/assert_fixture pair is the update-fixture contract future migrations extend), asserts the degraded-readyz semantics on the candidate (200 + warn-level checks without sidecars), and runs a full backup/restore roundtrip with the candidate's sidecar into a second, empty database. The wizard e2e already guards fresh installs in CI (issue #81). Verified green on the host for v0.1.0→v0.1.1; a simulated destructive migration made the suite fail loudly (negative test, not committed). A human pushes the prod tag only when both release jobs are green — the documented pre-approval gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 00:29:53 +02:00
Claude Fable 5	28f05e270d	Add the release pipeline with a tag-based manual gate and Prod stack (#89) ... Pushing vX.Y.Z builds the four semver images and publishes a Gitea release whose notes list the changes since the previous release with a migration call-out derived from the migrations diff (the repo is trunk-based — commit subjects stand in for PR titles). Deploying to Prod is a separate human act: pushing prod-vX.Y.Z-<suffix> — Gitea 1.22 has no environment approvals, so the tag push is the gate — verifies the release images exist, pins TAG in the Prod .env, restarts the stack, and waits for readiness; rollbacks are new suffix tags on the previous release. The Prod stage is provisioned on ONE (ports 8120-8122, secrets generated on the host, full backup profile); deploy/go-live.md carries the executed mechanics and the operator checklist that blocks the DNS switch (DNS, Caddy block, wizard/SMTP, legal texts, monitors, Prod drill, BASEL mirror). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 00:17:13 +02:00
Claude Fable 5	92c71c3f12	Format the social pack (#96) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 00:02:12 +02:00
Claude Fable 5	f28913e9ce	Fix lint errors in the social pack (#96) ... An unused type import and an empty destructuring pattern slipped through because the lint exit code was swallowed by a pipe before the push. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 00:01:23 +02:00
Claude Fable 5	6d51c0d099	Pin the comments/notifications semantics as a regression pack (#96) ... The permission-matrix pack now covers comments: reading follows page read, writing follows the pond's commentPolicy, label-restricted editors cannot see a secret page's thread, all under the 404-vs-403 policy. A new API-level social pack runs the two-user watch → notify flows: the watcher is notified, the actor never, read-all sticks server-side, a revoked watcher receives nothing new, and the digest job runs end to end through the system panel's manual trigger. The digest mail's structure is pinned by a normalized vitest snapshot (grouping, counts, actors, unsubscribe framing) — changing the mail requires an explicit snapshot update. Both packs ran flaky-free across five consecutive local rounds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 00:00:34 +02:00
Claude Fable 5	9ee9bbe4f0	Expect the notification-digest job in the system panel pack (#95) ... The digest scheduler registration added a fifth maintenance job; the system pack's hard-coded row count lagged behind. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 23:44:44 +02:00
Claude Fable 5	9674c0bae2	Batch notifications into localized e-mail digests with unsubscribe (#95) ... New per-user digestFrequency (hourly default | daily | off) on the profile and in the settings UI. A scheduler job (15 min cadence) mails a user once their oldest unread, unmailed notification exceeds the cadence window: one localized mail per batch, grouped per pond then per page with actor names and change/comment counts, enqueued through the mail outbox. Sending marks the batch mailed — never read — and re-checks page read permission per entry at send time; entries the user can no longer read are dropped from the mail but still marked handled, so revoked content cannot queue forever. Every mail carries a signed, single-purpose unsubscribe link: it only flips the setting to off, renders a session-free confirmation page, and sets no cookie. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 23:37:26 +02:00
Claude Fable 5	67fb01fe2b	Notify watchers about page changes and comments, with an in-app center (#94) ... New notifications table (payload denormalized for join-free rendering; mailed_at already prepares the #95 digests). Generation fans page events out to page and pond watchers, excluding the actors, and re-checks page read permission per watcher at delivery time — a revoked watcher gets nothing. Sources: named version snapshots (api), new comments (api), and the collab server's automatic session-close snapshots — announced over a new pg NOTIFY channel (the reverse of the established api→collab bus) consumed by a dedicated LISTEN client in the api, since the collab server has no permission resolution of its own. API: paginated list (unread first via nulls-first ordering), mark read, mark all read. UI: bell with unread badge in the top bar (30 s polling, no push in v1) and a dropdown whose entries navigate and mark themselves read; comment notifications deep-link with ?comments=1, which now opens the comments panel on load. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 23:20:25 +02:00
Claude Fable 5	f4f27cbe78	Add watches: follow pages and ponds with auto-watch preferences (#93) ... New watches table (polymorphic target, unique per user+target; page purge removes its rows via the trash service, and the list endpoint drops targets the user can no longer read). Endpoints: idempotent PUT/DELETE /watches/{page|pond}/:id gated by read access (404 hides the target), GET state for the header toggles, and GET /users/me/watches resolving names and links. Auto-watch hooks: creating a page and commenting subscribe the actor, each behind a new user preference (autoWatchOwnPages / autoWatchOnComment, default on) editable via the profile PATCH and surfaced as checkboxes in the settings. UI: watch toggle on the page header and the pond settings header, watch list with unwatch in the account settings; new watches i18n namespace (de+en). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 22:59:11 +02:00
Claude Fable 5	30992a2e6d	Actually drop the quota override from the comments pack (#92) ... The previous commit's automated edit silently missed the beforeAll block; the pack still lowered the seeded additional_ponds override to 10, which CI's accumulated fixture ponds exceed. The pack now relies on the seeded headroom and reports the create-pond response on failure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 22:36:53 +02:00
Claude Fable 5	c8afe7c8d6	Do not lower the seeded pond quota in the comments pack (#92) ... The seed already grants fixture users additional_ponds headroom (100); overriding it down to 10 made pond creation fail in CI, where the earlier packs' ponds count against the limit. The pack now relies on the seeded override and reports the create-pond response on failure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 22:28:56 +02:00
Claude Fable 5	c7d3b20ca0	Isolate the comments e2e pack in its own pond (#92) ... The shared fixture pond accumulates grants from earlier packs in the same CI job, so "fixture-editor is only a reader" did not hold there and the policy test failed in CI while passing locally. A Site Admin now lifts fixture-user's additional-pond quota for the run, the pack provisions a fresh pond and page, and tears both down afterwards; the policy PATCH is also asserted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 22:17:47 +02:00
Claude Fable 5	e54aaf76f9	Add the comments panel, unread badge, and comment-policy setting (#92) ... New comments panel on the page (toggle next to attachments, unread badge counting comments newer than the last localStorage-recorded visit): threaded display with relative times and author names, a Markdown composer with hints, edit/delete for authors, resolve moving threads into a collapsed resolved <details> section with reopen, and a permission-aware composer — hidden with a hint when the pond's policy bars the viewer (readers always see the discussion). The pond settings page gains the "who may comment" select. Fixes PondsService.update silently dropping commentPolicy from the settings merge (found by the new two-user Playwright pack; the DB test now exercises the real pond PATCH). New comments i18n namespace (de+en); the pack runs as its own CI step. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 22:07:16 +02:00
Claude Fable 5	4549d6d13f	Add threaded page comments: data model, API, and comment policy (#91) ... New comments table (thread via parent_id to the root, optional document anchor on roots, resolved_at/by; page purge cascades, trash hides) with a CommentsService enforcing the permission model: reading follows page read, writing follows the new pond setting commentPolicy (readers | editors) — 404 hides unreadable pages, 403 marks a failed write policy. Endpoints: threaded list per page with an open/resolved filter (resolved threads arrive collapsed by default), create (root or reply — replies attach to roots only and carry no anchor), edit own, delete own (roots with replies are admin-only, cascade), resolve/unresolve on roots for everyone who may comment. Bodies are Markdown rendered through the shared sanitizing pipeline; smuggled markup arrives as escaped text (fixture test). The UI lands with #92. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 21:42:29 +02:00
Claude Fable 5	4b55fb92ac	Write the self-hosting guide and add the optional caddy TLS profile (#88) ... docs/self-hosting/README.md is the complete operator contract: install from the two reference files, first-run wizard walkthrough, update procedure with the one-release downgrade window, backup/restore with the sidecar, readyz-based troubleshooting (incl. the classic proxy/WebSocket and APP_BASE_URL/CSRF mistakes), and a build-from-source note; linked from the repository README; English-only by documented decision. The reference compose gains a `caddy` profile (new Caddyfile) that publishes 80/443 and terminates TLS via Let's Encrypt for $DOMAIN — localhost uses Caddy's internal CA for smoke tests. deploy/self-hosting-verify.sh scripts the clean-machine test: a fresh directory with only the published files boots to the wizard answering over TLS, then removes itself; verified green on the stage host. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 21:21:10 +02:00
Claude Fable 5	6e99cb35fc	Trigger the restore drill on demand via drill-* tags (#87) ... Gitea 1.22 cannot dispatch workflows through the API or UI (that lands in 1.23), so pushing a drill-* tag is the on-demand path next to the monthly schedule. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 21:01:00 +02:00
Claude Fable 5	d95c18e9e8	Automate the monthly restore drill with a scratch-stack workflow (#87) ... New scheduled workflow (monthly + on demand) runs deploy/backup/drill.sh: it reads the drilled stage's backups volume strictly read-only, restores the latest successful set into a throwaway Postgres and volumes under a unique drill prefix via the backup image's restore path, boots the api against the result, and verifies readyz (database + migrations), row counts, rendered content in the page cache, a public API request, and a media byte-check against the attachments table — then tears everything down, also on failure. Each run reports its outcome as a comment on the pinned "Restore drills" issue (#98). docs/operations/restore-runbook.md carries the manual procedure, which doubles as the Prod relocation path; pre-go-live the drill restores the Test set (switch the source volume at go-live, #89 — off-host fetch from the BASEL mirror stays with #84). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 20:58:06 +02:00
Claude Fable 5	c8aac13dfb	Add Site-Admin system panel with persistent audit trail (#86) ... New /admin/system panel (operations.md §Maintenance jobs): the maintenance job list shows every registered job with truthful last-run data (new Job.lastDurationMs recorded by the scheduler) and a manual trigger that respects the run-mutex and is itself audit-logged; a backup card mirrors the sidecar's status.json including the freshness verdict; an audit-log viewer filters by actor, action, and time range with pagination; and a storage overview lists the largest ponds. Auth events and admin actions (grants, members, user/quota admin, plugins, settings, setup) now land in a new audit_log table through a central AuditService — which keeps emitting the established stdout log line — while content activity stays log-only by design. All endpoints are Site-Admin-only; covered by API DB tests and a Playwright pack in CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 20:03:05 +02:00
Claude Fable 5	0ef96147e0	Extend readyz with backup freshness and a degraded status level (#85) ... readyz now enumerates database/migrations (hard failures, HTTP 503), converter/renderer, and a new backup check that reads the sidecar's status.json from the read-only backups mount and warns when the last successful backup is older than 26 h. Warning-level checks surface as overall status "degraded" while staying HTTP 200 — monitors alert on the body keyword, Docker healthchecks keep using the liveness endpoints so a degraded instance is never restart-looped. The status.json shape moved to @dorfteich/shared as the contract between the sidecar and its readers (#85/#86); deploy/monitoring.md defines the Uptime-Kuma monitor set per stage. The api image also pre-creates /data/backups node-owned so the shared backups volume stays writable for the sidecar regardless of which container initializes it, and the sidecar's scheduler survives runs that cannot even record their status. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 19:02:59 +02:00
Claude Fable 5	8dbff86537	Add backup sidecar: nightly dump, volume archive, prune, status, restore (#83) ... New apps/backup service (ADR 0015): nightly pg_dump -Fc plus one tar of the uploads/plugins volumes as a consistent restore set on a new backups volume, retention prune that never removes the newest complete set, atomic status.json for the readiness/admin consumers (#85/#86), and a failure mail sent directly via nodemailer (the api may be the broken part) with de/en texts in the shared mails catalog. BACKUP_RUN_ONCE=1 gives the on-demand path; deploy/backup/restore.sh automates the documented restore runbook. The pure secret-store helpers moved to @dorfteich/shared so the sidecar resolves the wizard-written SMTP relay exactly like the api. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 17:29:15 +02:00
Claude Fable 5	fd2bdb3fb8	Add instance legal pages with public rendering and footer links (#82) ... Imprint and privacy policy are two new Markdown instance settings (legal.imprint, legal.privacyPolicy), edited by Site Admins in a new "Legal pages" admin section with a toggleable rendered preview. The preview uses the same shared pipeline the server renders with (markdown → schema doc → escaped HTML), so stored markup can never smuggle script to visitors. The pages render publicly at /legal/imprint and /legal/privacy — as an SPA route plus, like #56, a self-contained server-rendered HTML document under /api/v1/legal/:kind. The endpoints are setup-exempt: legal information stays reachable even while the first-run wizard is pending. Unconfigured pages show a localized notice instead of 404ing, and Site Admins additionally get a warning banner linking to the settings. A new footer with both links appears on every SPA view (editor, auth screens, public pages) and in the server-rendered documents, whose shared shell moved to public/html-shell.ts and now renders its chrome in the instance default locale (ADR 0012). docs/self-hosting/legal-template.md ships imprint and privacy-policy templates in English and German whose sections mirror Dorfteich's actual processing activities (accounts, sessions, rate-limit IPs, proxy logs, transactional mail, content, export, deletion, no third-party requests), with a review checklist tied to security.md §Privacy. New `legal` i18n namespace (de+en); api and web e2e coverage including a new CI legal pack (footer navigation, notice vs. admin banner, and the admin form publishing a text end to end). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 16:40:04 +02:00
Claude Fable 5	28aa04d5e4	Add the first-run setup wizard UI (#81) ... The SPA now probes GET /setup on boot: while setup is pending it renders only the wizard at /setup, the login page (to resume a started wizard as the Site Admin), and a "setup pending" notice on every other route — without the regular chrome, whose pond/search queries would all 503. If the probe itself fails (offline reload), the app falls through to the normal routes. Once completed, /setup just goes home. The wizard walks six steps against the #80 api: welcome with language choice (drives i18n immediately and pre-fills the admin/instance locales), Site Admin account (signs in via the step-1 session cookie), instance basics, SMTP with live-test-before-save plus an explicit skip, registration mode, and a summary whose finish unlocks the app logged-in-ready. Every step validates through the shared Zod schemas before advancing; entered values live in the parent component, so Back preserves them, and re-submitting a step on a second forward pass just overwrites the same settings. A wizard someone else started shows a sign-in hand-off instead of dead admin-gated steps. New `setup` i18n namespace in de and en. Two #80 touch-ups fell out of verifying this end to end: the SMTP port's NaN case now maps to the translated required-message, and GET /setup's smtpConfigured uses `||` instead of `??` so the empty strings compose passes for unset vars fall through to the secret store. The e2e pack (setup.spec.ts) needs an instance where setup is still pending, so the CI job provisions a second api + static web against a virgin database on their own ports and runs the full wizard journey there, including the failing-relay path and both languages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 16:05:01 +02:00
Claude Fable 5	224ae3e6db	Fix boot crash on compose-passed empty setup variables ... main.ts parsed process.env raw, so the compose passthroughs (SETUP_DEFAULT_LOCALE: "") failed the enum parse and crash-looped the Test api. Route main.ts through the same loadApiEnv as AppConfig, which overlays the secret store and drops empty strings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 15:20:24 +02:00
Claude Fable 5	f0a82bad20	Add the first-run setup wizard API with env-backed secret store (#80) ... When the api runs against a database without the setup.completedAt marker, a global SetupGuard answers every non-exempt route with 503 setup_required; only /setup/*, health probes, and the session routes stay reachable. The wizard steps (POST /setup/admin|instance|smtp| registration|complete) write straight to their production homes; the Site Admin step signs its creator in, later steps require that session. Completing sets the marker and locks every step permanently (410, also across restarts, and not reopenable via PATCH /admin/settings). SMTP entered in the wizard is verified with a live delivery test first (failure blocks the step with the transport error as detail) and then persisted to the new env-backed secret store: a mode-600 dotenv file on the new `secrets` volume (SECRETS_FILE). Explicit container env always wins over the store; empty compose-passed strings count as unset. The mail transport now resolves lazily through SmtpConfigService so wizard changes apply without a restart. SETUP_ADMIN_* env pre-seeds the whole wizard at boot for automated deploys; a backfill migration marks instances that already have a Site Admin as completed, and seed/vitest global-setup do the same for fixture databases. The setup e2e suite provisions its own fresh database (CREATE DATABASE + migrate deploy) per run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 15:10:28 +02:00
Claude Fable 5	9e8ebfe49c	Degrade plugin content gracefully in HTML, PDF, and office exports (#79) ... Completes M7: exports and the public read view no longer show raw plugin placeholders (ADR 0008/0009). - PluginFallbackRenderer (api): replaces each plugin-block placeholder in content-cache HTML with its best static form — the block's stored SVG snapshot (block data is author-controlled, so it passes the same DOMPurify sanitizer as uploaded SVG files before entering host HTML), else the manifest fallback from the stored snapshot (text, or an image inlined as a data URI so network-isolated renderers work; tombstone-safe for uninstalled plugins), else the literal '[plugin content]' marker. - Office exports (docx/odt): the export markdown is degraded before pandoc — GFM knows neither the dorfteich-plugin fence nor the section fenced div, so blocks become their fallback text and sections plain quoted blocks (shared replacePluginNodesForExport, AST-level so nesting and embedded blocks inside sections survive). - PDF export applies the HTML fallback pass before building the Gotenberg document — resolving the TODO left in #67. - Public read view: the same fallback pass plus the pond's active section-style CSS inlined as a <style> block, so public pages show styled sections and static plugin content without any plugin runtime. - Covered in export.service.db.test (snapshot SVG sanitized — hostile <script> stripped; manifest text; tombstone text; quoted sections and no fence artifacts in the pandoc input) and shared export-fallbacks tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 14:13:09 +02:00
Claude Fable 5	ef1c31dd2c	Add the Mermaid reference plugin (#78) ... The end-to-end proof of the code-block path: packages/plugins/mermaid bundles the mermaid library (esbuild, ~3.4 MB unpacked — well under the 20 MiB install gate) so diagrams render entirely inside the sandbox; the frame CSP forbids any network request (pinned by the e2e's off-origin request assertion). - Block data is `{ source, svg }`: the source text is the document of record, `svg` the last successfully rendered snapshot — persisted together on every good preview, so office/PDF exports can show the diagram without executing anything (#79). - Edit mode: source textarea with a debounced live preview and inline error display; a failing source still persists (typed text never lost), paired with the last good snapshot. - Render mode: renders the stored source; if that stops rendering, it falls back to the stored snapshot with a "stale" note — a bad edit never breaks render mode. - mermaid leaves its scratch element (and, on parse errors, an error SVG) on document.body — the render helper removes both, so the surface only shows what the plugin inserts. - e2e mermaid.spec.ts: flowchart renders + survives reload with zero off-origin requests, inline syntax errors with intact render mode, and a collaborator sees the diagram appear live. Wired into CI. - seed.ts now heals a missing owner-admin grant on existing personal ponds: a dev database shared with the test suites can lose it to a cleanup, and the seed's contract is "idempotent", not "first run only". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 13:51:15 +02:00
Claude Fable 5	0003063c39	Add pageTool plugins with toc and page-index references (#77) ... The read-only widget surface over page/pond data (ADR 0008 extension point `pageTool`): - Host: PageToolsPanel lists the pond's active pageTool surfaces behind disclosures — each sandbox iframe mounts lazily on first open and tears down on close. The same surfaces are insertable as plugin_block embeds (#76's insert picker now offers pageTool points too; the sandbox drives both through the same render lifecycle). - New `ui.scrollToHeading(headingId)` capability: outline ids are derived from the doc and never stamped into the DOM, so the host resolves the id to its heading position via the shared extractOutline and scrolls the matching rendered heading. - `readPond.listPages` now carries label *names* per summary (PagesService.pluginPageSummaries) — the page-index filter chips work on data the viewer could resolve anyway; per-page permission filtering stays in the service as before. - Reference plugins packages/plugins/toc and packages/plugins/page-index: real SDK consumers (createPlugin + windowTransport), bundled with esbuild into the package ZIP; i18n de/en is inlined at build time — the sandbox CSP forbids runtime fetches, the i18n/ files stay the single source. The toc re-fetches its outline on a slow poll, so live heading edits appear once the collab server has re-derived the content cache. - e2e page-tools.spec.ts covers the acceptance criteria: live outline updates after the persistence debounce, heading click scrolls, embedded page-index navigates via ui.openPage, and a label-restricted reader never sees the denied page in the index. - CI: the auth-e2e job now runs the section-styles (missed in #75), plugin-blocks, and page-tools packs, with login-rate-limit resets. - plugins.e2e.db.test clears the plugin registry up front: a local dev DB is shared with the e2e stack, whose installed real `toc` would otherwise collide with the fixture of the same id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 13:27:30 +02:00
Claude Fable 5	923532f5f7	Add block plugins: plugin_block node with sandboxed rendering and editing (#76) ... The powerful end of the plugin spectrum (ADR 0008 extension point `block`): - Shared schema: the reserved `plugin_block` node — a block atom carrying pluginId, blockType, and the block data as a JSON object. Its DOM shape round-trips the full state in data attributes (clipboard-safe), markdown maps to a reserved fence (```dorfteich-plugin <plugin>/<type> + data JSON body, fence-escalated when the payload contains backticks), and the content-cache HTML renders a data-carrying neutral placeholder until the export fallbacks land (#79). - Editor: a React NodeView hosts the #73 sandbox — render lifecycle on mount, an edit affordance switching the frame to the plugin's edit mode, and the blockData capability persisting through node attrs (a normal editor transaction, so Yjs replicates it; writes are refused on read-only editors, and the plugin's own attr echo is suppressed so its edit UI never resets mid-typing). Collaborator changes re-invoke the current lifecycle, keeping frames live. The page surface (ids, openPage) flows through a React context like the wikilink pattern; the toolbar gets an insert picker fed from the active code plugins' block extension points. - Fallback: GET /plugins/:id/fallback resolves the manifest fallback from the stored snapshot — it survives uninstall as a tombstone, image fallbacks degrade to neutral once assets are gone. Signed-in only. - e2e plugin-blocks.spec.ts covers all four acceptance criteria: insert → edit → reload round-trip, live two-user collab, disable → fallback → re-enable without document mutation, and copy/paste within and across pages (the markdown clipboard carries the reserved fence). getBlock (cross-page block embedding) stays deferred as in #74: the schema has no per-block ids yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 12:45:14 +02:00
Claude Fable 5	e32f961047	Complete section-style plugins: CSS gate, injection, picker, export (#75) ... Second half of #75 on top of the section node (2e96173/784f21d): - Install gate for section_style CSS (plugin-css.ts): every rule must be scoped under one of the plugin's own .dt-style-<pluginId>-<styleId> classes (enforced, not rewritten — grouping at-rules checked inside, @font-face/@keyframes exempt, statement at-rules rejected); positioning out of the content flow (anything but static/relative) is rejected as an overlay vector; "</style" is rejected as a breakout vector for inlined embedding. Hostile fixtures from the acceptance list are pinned in plugin-css.test.ts. - Web: usePondPlugins loads the pond's active plugins once per visit; SectionStyleSheets links each active style plugin's immutable styles.css; SectionStyleMenu (toolbar) wraps/restyles/unwraps with a picker fed from the plugins' i18n titles. Sections show a faint dashed hint while editing so unstyled (plugin-disabled) sections stay findable. - PDF export: PluginsService.sectionStyleCssForPond inlines the pond's active section-style CSS into the Gotenberg HTML, so styled sections survive the network-isolated render; covered in export.service.db.test. - Reference plugin packages/plugins/section-styles-basic (callout, info, warning, colored-box; theme-neutral semi-transparent backgrounds), a workspace package whose tests validate it against the SDK schema and whose real files run through the api install gate. - e2e section-styles.spec.ts: install → wrap → computed background in edit and read mode → unwrap → neutral fallback after disabling the plugin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 11:43:36 +02:00
Claude Fable 5	784f21d805	Add editor section node; serialize pnpm CI jobs to fix runner flake ... Two corrective changes: - Register the `section` node in the web TipTap editor (with wrapInSection/unwrapSection commands) so the editor schema matches the shared editorSchema again. The schema-drift guard (document-extensions.test) rightly failed after 2e96173 added `section` to the shared schema without the editor side — this restores it. - Replace the ineffective warm-up gate with a serial chain of the pnpm CI jobs (checks -> auth-e2e -> fidelity). Warming the shared action cache did not help: the dependent jobs still started together and corrupted the cache during concurrent extraction. Serializing them is what actually prevents it; CD image builds still run in parallel. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 10:08:41 +02:00
Claude Fable 5	2e96173d44	Add the section container node to the document model (#75, part 1) ... Document-model foundation for section-style plugins (ADR 0008 kind section_style): a `section` block node carrying `pluginId` + `styleId`, rendered as `<div class="dt-section dt-style-<pluginId>-<styleId>">` so a plugin's sanitized, scoped CSS applies and — when the plugin is gone — the class matches nothing and the content stays intact with neutral styling. Round-trips to a Pandoc-style fenced div (`::: {data-section-style="<pluginId>/<styleId>"}`), with a markdown-it block rule that supports nesting. This is the schema/markdown/HTML half of #75; the editor UI (wrap/style picker/unwrap), the `section-styles-basic` reference plugin, per-pond CSS injection, and PDF/office export styling follow in part 2. The node is additive and backward-compatible (existing documents have none). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 10:00:39 +02:00
Claude Fable 5	48798d4247	Add capability-scoped plugin API endpoints (#74, read surface) ... Viewer-scoped data API behind /api/v1/plugin/, backing the SDK's readCurrentPage and readPond capabilities: - api: PluginApiController with GET plugin/ponds/:id/pages (listPages), plugin/pages/:id/{outline,content,meta}. Each reuses the existing @RequiresPondRole/@RequiresPagePermission guards and PagesService — no parallel permission logic — so a plugin sees exactly what its viewer could. New PagesService.outline/meta read the content cache. - web: host-capabilities builds the host implementations from a per- surface context (the host holds the current page/pond ids; a plugin can only ask about "the current page" or "this pond"). Wired into the sandbox host and PluginFrame; ui.openPage/toast route to host callbacks. - shared: PluginPageSummary/Meta/Content response types. - tests: api db test proves a label-restricted reader gets a filtered listPages and 404s on the hidden page, non-members are hidden (404), anonymous is rejected (401); web unit test pins the endpoint mapping, id-encoding, and missing-context rejection. readBlock/blockData land with the plugin_block node in #76 (block addressing does not exist in the schema yet). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-11 09:52:11 +02:00