3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	0c5163e69e	Refuse OPTIONS * like any other API request (closes #4) ... net/http answered "OPTIONS *" itself, with 200, before the router, so it skipped the credential check and the security headers. The server now passes it to the router, which refuses it with 401 like any other request without the credential. A test sends it to a running server, since the handler alone never sees it. Model: opus-5-5	2026-09-29 02:20:58 +00:00
clawbot	b965e45454	Send Permissions-Policy on every API response (closes #4) ... docs/REPO_POLICIES.md requires a Permissions-Policy header restricting the browser features an application does not use. The API now denies the camera, microphone and location on every response, TestHeaders checks it, and the README's Design section names it. Model: opus-5-5	2026-09-29 00:59:42 +00:00
clawbot	17d6be9fe1	HTTP API: server, credential and the list of chats (closes #4) ... The bot now serves an HTTP API on PORT (default 8080) beside the chat client. Every request needs the credential read at startup from the file named by API_TOKEN_FILE, sent as a bearer token; without one, every request is refused. Responses carry the security headers, bodies are capped at 64 KiB and each request's work at 10 seconds. GET /api/v1/chats lists the bot's contacts from the chat client's /_contacts command, ordered by id, and marks the contacts who deleted their chat with the bot, which the chat client keeps listing. bot.Run starts the API after set-up and stops it within 5 seconds; a listener failure ends the bot as a chat client failure does. Model: opus-5-5	2026-09-29 00:37:57 +00:00