Server-minted team secrets, tenant-isolation tests, extension via service worker (Chrome LNA), rate limits and hardening - #20

Merged

Bogzx merged 34 commits into

mainfrom

improve/2026-09-30

Sep 30, 2026

Commits on Sep 30, 2026

api: don't persist a Gemini parse failure as five 0/10 observations

Bogdan Truta
and
claude
committed
d52b918
api: stop 500ing on non-numeric limits and malformed job ids

Bogdan Truta
and
claude
committed
8d2d7e6
api: reject oversize wiki insights with a 400 instead of a raw 500

Bogdan Truta
and
claude
committed
789e0b0
api: cap prompt text sent to Gemini at 64K characters

Bogdan Truta
and
claude
committed
3377e63
api: stop sending the raw team token to Langfuse

Bogdan Truta
and
claude
committed
b3546d2
deps: npm audit fix (non-breaking) — next, hono, ws, protobufjs, sharp, …

Bogdan Truta
and
claude
committed
0e3e0f9
docs: fix the MCP install steps, document the token trust model

Bogdan Truta
and
claude
committed
22c3503
docs: drop stale Railway/Claude-model references in sub-READMEs

Bogdan Truta
and
claude
committed
c12fc13
api: server-minted team secrets; team id is no longer the credential

Bogdan Truta
and
claude
committed
bdcb986
mcp: init registers or joins a team; normalised team ids; secret out of configs

Bogdan Truta
and
claude
committed
fa1a9da
clients: treat the team token as a secret; dashboard stops exposing it

Bogdan Truta
and
claude
committed
f04b712
docs+compose: document team secrets, the join flow and legacy upgrade

Bogdan Truta
and
claude
committed
a13c102
api: Postgres integration tests — every route, two tenants, in CI

Bogdan Truta
and
claude
committed
702cfe7
clients: per-install anonymous user id instead of a shared 'demo' (opt-out)

Bogdan Truta
and
claude
committed
242a51f
fence team-authored content wherever it reaches an LLM

Bogdan Truta
and
claude
committed
3cf5baa
api: stricter library promotion — unrounded mean, dimension floor, second signal

Bogdan Truta
and
claude
committed
a844abb
chore: normalise package.json line endings (CR-CR-LF → LF)

Bogdan Truta
and
claude
committed
23d5c51
tooling: ESLint flat config + lint/audit/docker CI jobs; Next 16; 0 audit findings

Bogdan Truta
and
claude
committed
5b8a84c
api: scoring eval harness — golden prompts, N runs, spread report

Bogdan Truta
and
claude
committed
5326098
mcp: rich bootstrap no longer uploads gitignored files

Bogdan Truta
and
claude
committed
6dc8879
api: 500s return a request id, not the raw error

Bogdan Truta
and
claude
committed
66ea7e3
browser-ext: flag the public demo team in the popup; never paint a secret

Bogdan Truta
and
claude
committed
ef9c0f3
api: in-process rate limits (429 + Retry-After) and request body caps

Bogdan Truta
and
claude
committed
8a144fa
api: survive idle-connection drops, recover orphaned jobs, drain on SIGTERM

Bogdan Truta
and
claude
committed
288272c
clients: handle 429 — coaching fails open and says why

Bogdan Truta
and
claude
committed
4d35274
test(api): integration suite must never reach the real Gemini API

Bogdan Truta
and
claude
committed
9e6d8eb
api: drop cached team context on wiki writes; remove raw NUL bytes

Bogdan Truta
and
claude
committed
ff5903f
review: fence also neutralises lookalike team_content tags

Bogdan Truta
and
claude
committed
80aa5fa
review: rate limiter keys on the proxy-appended XFF entry, IPv6 per /64, hard memory cap

Bogdan Truta
and
claude
committed
3d59d58
review: a teammate's init after a legacy upgrade joins, not forks; surface legacy teams at startup

Bogdan Truta
and
claude
committed
723ac3d
review: no literal invisible characters in the fence source and tests

Bogdan Truta
and
claude
committed
825cf7d
review: browser extension makes every API call from its service worker (Chrome LNA)

Bogdan Truta
and
claude
committed
5e6c4d0
review: coach output fences a teammate's library example as untrusted team content

Bogdan Truta
and
claude
committed
91c0cbb
review: rate limits are all-or-none per request, and env limits are parsed once

Bogdan Truta
and
claude
committed
587513c

Navigation Menu

Server-minted team secrets, tenant-isolation tests, extension via service worker (Chrome LNA), rate limits and hardening - #20

Server-minted team secrets, tenant-isolation tests, extension via service worker (Chrome LNA), rate limits and hardening#20
Bogzx merged 34 commits into
mainfrom
improve/2026-09-30

Commits on Sep 30, 2026

api: don't persist a Gemini parse failure as five 0/10 observations

api: stop 500ing on non-numeric limits and malformed job ids

api: reject oversize wiki insights with a 400 instead of a raw 500

api: cap prompt text sent to Gemini at 64K characters

api: stop sending the raw team token to Langfuse

deps: npm audit fix (non-breaking) — next, hono, ws, protobufjs, sharp, …

docs: fix the MCP install steps, document the token trust model

docs: drop stale Railway/Claude-model references in sub-READMEs

api: server-minted team secrets; team id is no longer the credential

mcp: init registers or joins a team; normalised team ids; secret out of configs

clients: treat the team token as a secret; dashboard stops exposing it

docs+compose: document team secrets, the join flow and legacy upgrade

api: Postgres integration tests — every route, two tenants, in CI

clients: per-install anonymous user id instead of a shared 'demo' (opt-out)

fence team-authored content wherever it reaches an LLM

api: stricter library promotion — unrounded mean, dimension floor, second signal

chore: normalise package.json line endings (CR-CR-LF → LF)

tooling: ESLint flat config + lint/audit/docker CI jobs; Next 16; 0 audit findings

api: scoring eval harness — golden prompts, N runs, spread report

mcp: rich bootstrap no longer uploads gitignored files

api: 500s return a request id, not the raw error

browser-ext: flag the public demo team in the popup; never paint a secret

api: in-process rate limits (429 + Retry-After) and request body caps

api: survive idle-connection drops, recover orphaned jobs, drain on SIGTERM

clients: handle 429 — coaching fails open and says why

test(api): integration suite must never reach the real Gemini API

api: drop cached team context on wiki writes; remove raw NUL bytes

review: fence also neutralises lookalike team_content tags

review: rate limiter keys on the proxy-appended XFF entry, IPv6 per /64, hard memory cap

review: a teammate's init after a legacy upgrade joins, not forks; surface legacy teams at startup

review: no literal invisible characters in the fence source and tests

review: browser extension makes every API call from its service worker (Chrome LNA)

review: coach output fences a teammate's library example as untrusted team content

review: rate limits are all-or-none per request, and env limits are parsed once