3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	478ef0856a	Re-vendor the shared files from sneak/prompts at dd4027b (closes #504) ... Fetches the shared files unchanged from sneak/prompts commit dd4027b and adds .prettierignore. .gitignore, .editorconfig and .dockerignore keep this repository's own entries after the shared content: its Go, database and asset entries, tabs for *.go, and its anchored host artifacts and database patterns. Linting moves into the Dockerfile's lint phase on the golangci-lint v2.14.0 image, which also runs the js-lint stage, and Dockerfile.lint is gone. Tests move into a test phase on the golang bookworm image. script/lint, test, docker and cibuild are the model scripts, every docker build in script/ passes --no-cache, and the .ci-fingerprint barrier is gone. The workflow no longer calls script/ci-mark-superseded, so it and its tests are removed. make build passes -trimpath and -s -w. Model: opus-5-5	2026-10-06 02:49:12 +00:00
clawbot	e8379272ae	Load Alpine's CSP build so the UI's directives run (closes #371) ... Every page's Content-Security-Policy forbids eval, which the standard Alpine.js build needs, so no directive ran in a browser: both add forms on the webhook page showed open, and events in the event log could not be collapsed. The UI now loads Alpine's CSP build (@alpinejs/csp 3.14.9 in 3p/); the policy is unchanged. Each directive names a property or method of a component registered in static/js/app.js (collapsible, targetForm), and each card holds its own x-data. A browser test, built only with the browser tag, loads the webhook page and the event log under the real headers; make test-browser runs it in Docker. New test-only dependency chromedp, which raises golang.org/x/sys to 0.47.0. Model: opus-5-5	2026-10-02 16:09:03 +02:00
clawbot	9d29baaa2d	Commit the Alpine.js tarball in 3p/ and extract it at build time (closes #345) ... The build no longer downloads Alpine.js. Its npm package tarball is committed as 3p/alpinejs-3.14.9.tgz, byte for byte the file script/fetch-assets downloaded, with the sha256 that script pinned. script/assets (make assets) extracts package/dist/cdn.min.js to the ignored static/js/alpine.min.js; script/test runs it, so make test, make check, the pre-commit hook and the Dockerfile get the file with no network access, and make build, run and dev run it too. Removed: script/fetch-assets, its Dockerfile step, static/vendor.sha256 and static/vendor_test.go. The README describes the new flow. Model: opus-5-5	2026-10-01 22:44:41 +02:00