5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	c378690977	Fetch and verify Alpine at build time instead of committing it (closes #145) ... static/js/alpine.min.js was a committed minified bundle, which REPO_POLICIES forbids, referenced by no content hash at all. A minified blob is unreviewable, which is the shape a supply-chain compromise takes. script/fetch-assets now downloads Alpine 3.14.9 from the npm registry and verifies sha256 on both the tarball and the extracted file, and static/vendor_test.go re-hashes the bytes go:embed actually placed in the binary. The shipped bytes are byte-identical to the blob that was committed, so the served asset does not change. Independently reviewed. Five negative controls reproduced by the reviewer: flipped expected hash, repointed URL, post-fetch tampering, asset absent, and manifest inconsistencies — each fails closed with static/js/ left clean. Registry hashes confirmed against the pins, and the runtime image was built, run and curled to confirm the asset is still served and the login page still loads it. Known gap, filed separately: static/static.go embeds the js directory rather than named files, so a missing fetched asset is not a compile error on ungated local build paths. Every gated path fails loudly, so the release artifact is unaffected.	2026-08-17 23:12:17 +02:00
clawbot	0e397b3174	Correct release-blocking documentation inaccuracies (closes #141) ... The README env table was missing RETENTION_SWEEP_INTERVAL, TODO.md omitted five landed units, and three passages sold manual redelivery in the present tense when nothing implements it. The same false claim was corrected in the doc comment on failUnretryableRetry, which was its source text. Also removes a console.log from the shipped static asset.	2026-08-12 13:15:04 +02:00
clawbot	aab448b076	Clarify web UI terminology, copy, and the entrypoint URL (closes #57) ... Unifies user-visible copy on "Webhook" (routes and URLs unchanged), drops the placeholder Profile settings section, and adds a copy-to-clipboard affordance for the entrypoint URL as progressive enhancement — the button stays hidden unless both the target element and the Clipboard API resolve, so no dead control appears without JavaScript and the URL stays selectable. Retention copy now matches what the code does: deletion is permanent, 0 retains forever, and a blank field means the default on create or the current value on edit. The permanent-deletion sentence is suppressed for a retain-forever webhook, which the reaper exempts before computing a cutoff. Template tests gained a render-completed assertion. Without it, a page that aborted mid-render still satisfied assertions matching the already-flushed prefix, because renderTemplate streams to the ResponseWriter (#123).	2026-08-11 15:42:08 +02:00
clawbotanduser	011ec270c2	Replace Bootstrap with Tailwind CSS + Alpine.js (#14) ... ## Summary Replaces Bootstrap CSS/JS framework with Tailwind CSS v4 + Alpine.js, matching the µPaaS UI pattern. ## Changes - **Removed Bootstrap** — all Bootstrap CSS/JS references removed from templates - **Added Tailwind CSS v4** — `static/css/input.css` with Material Design inspired theme, compiled to `static/css/tailwind.css` - **Added Alpine.js 3.14.9** — vendored as `static/js/alpine.min.js` for reactive UI components - **Rewrote all templates** to use Tailwind utility classes: - `base.html` — new layout structure with footer, matches µPaaS pattern - `htmlheader.html` — Tailwind CSS link, `[x-cloak]` style - `navbar.html` — Alpine.js mobile menu toggle, responsive design - `index.html` — card-based dashboard with Tailwind classes - `login.html` — centered login form with Material Design styling - `profile.html` — clean profile layout - **Added `make css` target** — compiles Tailwind CSS using standalone CLI - **Component classes** in `input.css` — reusable `.btn-primary`, `.card`, `.input`, `.alert-error` etc. ## Testing - `make fmt` ✅ - `make check` (fmt-check, lint, test, build) ✅ - `docker build .` ✅ closes #4 Co-authored-by: user <user@Mac.lan guest wan> Reviewed-on: #14 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-02 00:42:29 +01:00
sneak	1244f3e2d5	initial	2026-03-01 22:52:08 +07:00