apps/server/src · scn-chat · Tangled

ATProto-based AI Assistant Chat interface.

scn-chat apps server src

11 folders · 21 files

pouriade.com · Layer colors into scales, roles, and components · 5d ago

Add support for per-provider model capability defaults.

Upgrade spaces alpha to 20261022. Verify commit and record MACs against #atproto_kem, falling back for accounts without one. New credential exchange and scheme.

A file in a sent message shows as the chip it was in the composer, with its icon, name, and kind and size, as "PDF · 1.2 MB", rather than a bare link holding its name. The chip moves to src/shared/ui as FileChip, which the composer and the message share. The whole chip is a link: a PDF opens in a new tab in the browser's own viewer, ending in an arrow out, and any other file downloads under its name, ending in a download arrow. Files side by side share a row that wraps toward the message's edge. The blob routes, the owner's and the shared one, serve a PDF inline and take application/pdf as a type, so a spaces user's PDF reaches the browser as one. The attachments, web UI, and styling specs say so.

Add API key interface and a cron route. Improve the role membership hooks.

Add support for per-provider model capability defaults.

Add support for per-provider model capability defaults.

Bump the chat index only after replying. Wait before claiming a synced turn.

Upgrade spaces alpha to 20261022. Verify commit and record MACs against #atproto_kem, falling back for accounts without one. New credential exchange and scheme.

Upgrade spaces alpha to 20261022. Verify commit and record MACs against #atproto_kem, falling back for accounts without one. New credential exchange and scheme.

Upgrade spaces alpha to 20261022. Verify commit and record MACs against #atproto_kem, falling back for accounts without one. New credential exchange and scheme.

Bump the chat index only after replying. Wait before claiming a synced turn.

Read reply events through a ReadableStream, and derive their type from the server's HubEvent. An event that isn't JSON now fails the stream instead of being lost in its listener, a dropped connection still keeps the events not yet read, and the abort listener is removed when the stream ends.

Compress API answers

Add the admin area for settings to replace config.yml.

pnpm preview builds the web app and runs the production build on this machine, at http://127.0.0.1:3000, where before production refused any PUBLIC_URL that wasn't HTTPS. A loopback PUBLIC_URL now passes in production, and needs no OAUTH_PRIVATE_KEYS, since sign-in there uses the loopback client, as in development. Any other plain-HTTP URL is still refused. pnpm start stays the command a deployment runs, serving the build it was given. The README, the foundation spec's scripts, and the auth and admin settings specs describe it, with a test.

Add API key interface and a cron route. Improve the role membership hooks.

Add site-config export / import via CLI.

When the app runs on this machine and its port is taken, the server moves to the next free one, trying up to twenty, and PUBLIC_URL with it, since the OAuth redirect and the app's links name that address, and logs a warning saying so. It moves only when PUBLIC_URL is loopback on that same port, so a deployment, or a loopback URL that names another port, keeps its port and fails to start as before, since a reverse proxy points at it. A port counts as taken when it is at every address or at 127.0.0.1 or ::1 alone, since macOS lets a listener on every address share a port with one on 127.0.0.1, which then still gets the requests for http://127.0.0.1:3000. The tunnel picks the free port itself and points both ssh and the server at it. The foundation spec and .env.example describe it, and the tests cover the probe and when the environment moves.

pnpm setup-env creates .env from .env.example and fills in fresh OAUTH_PRIVATE_KEYS and SECRET_KEY, so local setup is one step instead of copying secrets by hand. It is pnpm keys --write, which never replaces a secret already set, since a new SECRET_KEY can't decrypt stored API keys; plain pnpm keys still prints a pair.

Improve PDS error handling and messaging.

Crash and privacy fixes, request validation, login CSRF, SSRF guard, handover race, and cleanup.

Crash and privacy fixes, request validation, login CSRF, SSRF guard, handover race, and cleanup.

Implement initial buildout of core features.

When the app runs on this machine and its port is taken, the server moves to the next free one, trying up to twenty, and PUBLIC_URL with it, since the OAuth redirect and the app's links name that address, and logs a warning saying so. It moves only when PUBLIC_URL is loopback on that same port, so a deployment, or a loopback URL that names another port, keeps its port and fails to start as before, since a reverse proxy points at it. A port counts as taken when it is at every address or at 127.0.0.1 or ::1 alone, since macOS lets a listener on every address share a port with one on 127.0.0.1, which then still gets the requests for http://127.0.0.1:3000. The tunnel picks the free port itself and points both ssh and the server at it. The foundation spec and .env.example describe it, and the tests cover the probe and when the environment moves.

Crash and privacy fixes, request validation, login CSRF, SSRF guard, handover race, and cleanup.

Crash and privacy fixes, request validation, login CSRF, SSRF guard, handover race, and cleanup.

A secret the server can no longer decrypt, as after a lost SECRET_KEY, reads as unset and is flagged, rather than failing the page that reads it or, for an admin plugin's options, the server's startup. The settings page's web search, the admin plugin forms, and every other schema form say on each secret field that its saved value can't be read and to enter it again, and an admin can tick Clear to discard it. A BYO key that can't be read says so on the API keys page in place of its last four characters, found from its key ID without decrypting it, and a turn that uses it ends with an error asking for the key again. The unreadable value is kept until a new secret is entered, cleared, or reset, so restoring the old key in SECRET_KEYS_OLD brings it back. SecretBox gains tryDecrypt and hasKeyFor, and a value that fails authentication now throws SecretDecryptError too.

Upgrade spaces alpha to 20261022. Verify commit and record MACs against #atproto_kem, falling back for accounts without one. New credential exchange and scheme.

site-config-cli.ts

Add site-config export / import via CLI.

When the app runs on this machine and its port is taken, the server moves to the next free one, trying up to twenty, and PUBLIC_URL with it, since the OAuth redirect and the app's links name that address, and logs a warning saying so. It moves only when PUBLIC_URL is loopback on that same port, so a deployment, or a loopback URL that names another port, keeps its port and fails to start as before, since a reverse proxy points at it. A port counts as taken when it is at every address or at 127.0.0.1 or ::1 alone, since macOS lets a listener on every address share a port with one on 127.0.0.1, which then still gets the requests for http://127.0.0.1:3000. The tunnel picks the free port itself and points both ssh and the server at it. The foundation spec and .env.example describe it, and the tests cover the probe and when the environment moves.

web-manifest.ts

Layer colors into scales, roles, and components

React Scan loads only with pnpm dev --scan, rather than on every development page. The server passes the flag to Vite as import.meta.env.REACT_SCAN, which the root route's head reads, and the README and CLAUDE.md mention it.