Add SEO_REPORTS_DIR to config, STATIC_VERSION for cache-busting, seo prune/clear CLI subcommands, tools router with seo job endpoints, and boot-versioned static URLs in Dockerfile and Makefile
The fallback object for window.DEVPLACE_DOCS previously included a `base` property set to `location.origin`, which would override the actual base URL when the global config was present. This change separates the `base` assignment to always use `location.origin` regardless of whether the config object exists, ensuring the API base URL is consistently derived from the current page origin rather than being conditionally set from a potentially missing config property.
Add a new "Manual" documentation page under the Claude section that provides a hands-on, task-oriented guide for using the Claude Code setup. The page covers the mental model of commands, workflows, and subagents, the core five-beat development loop, and practical workflows for adding features, changing code, fixing bugs, and testing. Also update the existing claude.html page to link to the new manual page as the primary entry point for new users, replacing the generic reference to "next pages."
Migrate all runtime artifacts (database, uploads, VAPID keys, locks, bot state, container workspaces, zip staging) from scattered locations (`var/`, `devplacepy/static/uploads/`) into a unified `data/` directory. Update `config.py` as single source of truth with `DATA_PATHS` registry and `ensure_data_dirs()`, add `devplace migrate-data` CLI command with CRC verification and idempotent relocation, adjust `.dockerignore`, `.env.example`, `.gitignore`, `Dockerfile`, `Makefile`, `README.md`, `AGENTS.md`, `CLAUDE.md`, and all import paths in `attachments.py` to reference `config.UPLOADS_DIR`/`ATTACHMENTS_DIR` instead of computing from `STATIC_DIR`.
Delete four stale SEO and style agent report JSON/MD files from agents/reports/ that had zero findings or were superseded. Export PYTHONDONTWRITEBYTECODE=1 in the Makefile so all make targets suppress bytecode generation, and add a `tree` target that lists the repository file tree via git ls-tree. Update AGENTS.md and CLAUDE.md documentation to reflect that routers now form a directory tree mirroring URL paths and that bytecode writing is disabled project-wide.
- Reset gitea settings after bug tests to prevent cross-test contamination
- Add deleted_at and deleted_by fields to ingress proxy test instance creation
- Call refresh_snapshot after ingress proxy test setup and teardown
- Remove orphaned .bak test files (test_attachments.py.bak, test_demo.py.bak) that were left behind from a previous refactor
Split the monolithic test directory into three tiers (unit, api, e2e) with a path-mirroring directory structure. Added corresponding Makefile targets (test-unit, test-api, test-e2e) and updated all documentation references (CLAUDE.md, README.md, testing-cicd.html, testing-framework.html, testing-make.html) to reflect the new layout and naming conventions.
Introduce a new sidebar search template that renders a filter form with a hidden input loop and a text input bound to the `_placeholder` variable, supporting GET requests and a maxlength of 100 characters.
Add a reusable `text_search_clause` helper in `database.py` that builds a SQLAlchemy `or_` of `ilike` clauses over specified columns, returning `None` when search is blank or the table lacks the columns. Wire it into `get_feed_posts`, `get_gists_list`, and the projects listing so all three public index pages support free-text search via a `search` query parameter. Introduce `_sidebar_search.html` as the single search-box partial, included at the top of each listing's left filter panel with `_action`, `_placeholder`, and `_hidden` locals to preserve active category/tab filters on submit. Expose the `search` field on `FeedOut`, `GistsOut`, and `ProjectsOut` API schemas with corresponding OpenAPI documentation. Update `CLAUDE.md` to note the rate-limiter exemption for `GET`/`HEAD` and the `/openai` gateway, and refresh `README.md` route tables to mention the new search capability on `/feed`, `/gists`, and `/projects`.
Introduce `startup_jitter_seconds` config field so each bot delays its first session by a random amount up to the configured maximum, spreading fleet activity on service start. Persist a randomly chosen user-agent and viewport per bot in `BotState` and pass them to `BotBrowser` constructor, replacing the hardcoded defaults with a varied pool defined in `config.py`. Add `HANDLE_SUFFIX_WORDS` list and remove numeric suffixes from handle generation to avoid bot-farm appearance. Implement `pick_comment_style` and `is_short_comment_style` static methods in `LLMClient`, extend `generate_comment` with a `style` parameter that produces one-liner or question variants using `MIN_SHORT_COMMENT_LEN`, and wire session comment caps (`SESSION_COMMENT_CAP_MIN/MAX`) with cooldown intervals (`COMMENT_COOLDOWN_MIN/MAX_SECONDS`) into the bot loop. Update `BotRuntimeConfig`, `BotsService` config field registration, and architecture docs to reflect the new identity and pacing logic.
The diff removes the entire PwaInstaller.js module (51 lines) along with its import and instantiation in Application.js, and deletes the associated data-pwa-install button from the base.html template. This eliminates the progressive web app installation prompt functionality from the frontend, including the beforeinstallprompt event listener, deferred prompt handling, trigger visibility toggling, and the install method that invoked the browser's native install dialog.
Implement configurable notification preferences across in-app and push channels, including a new `notification_preferences` table with soft-delete support, per-user toggle endpoints, admin defaults management, and canonical type definitions. The change introduces `NOTIFICATION_TYPES` and `NOTIFICATION_CHANNELS` constants, `NotificationPrefForm`/`NotificationDefaultForm` models, `notification_enabled` resolution logic, and UI integration via the profile notifications tab and admin panel.
Add a RATE_LIMIT_DISABLED flag read from DEVPLACE_DISABLE_RATE_LIMIT env var that short-circuits the rate_limit_middleware when set, allowing test suites to disable per-IP throttling globally in conftest while individual rate-limit tests re-enable it via monkeypatch.
Force DEVPLACE_WEB_WORKERS to 1 in test conftest so the per-worker rate-limit divisor is always 1, and replace raw table inserts with set_setting calls that upsert and bump the cache version, ensuring the test server picks up the high rate limit instead of inheriting a stale default that throttles dense request bursts.
The bug list template wraps each bug in a `<div class="bug-card card-link-host">` instead of a bare `<a>`, pulling in `_card_link.html` for proper link semantics. Two new integration tests (`test_bug_detail_renders_for_member` and `test_bug_detail_renders_for_admin`) verify that the `/bugs/{number}` endpoint returns 200 for both roles, that the "Close ticket" button is absent for members and present for admins, and that the JSON response exposes `viewer_is_admin` as a boolean. Supporting helpers `_role_user` and `_open_ticket` create users with a specific role and open a Gitea-backed ticket.
The validation error check was placed before the config save operation, causing early returns that skipped persisting valid fields. This moves the error check after saving valid values and adds a "saved" key to the response listing which fields were successfully stored. Also adds autocomplete and password manager attributes to the password input field in the service config form to prevent browser autofill interference.
Implement a new `--changed` flag for the maintenance agent fleet that limits checking and fixing to only files git reports as modified or new (untracked) under `devplacepy/` and `tests/`. The change introduces `agents/changed.py` with `changed_paths()` parsing `git status --porcelain`, adds `_WRITE_ALLOWLIST` guard logic in `agents/agent.py` (`set_write_allowlist`, `clear_write_allowlist`, `_allowlist_guard`) wired into `_mutation_guard` and `create_file`, threads the file list through `orchestrator.run_fleet` -> `agent.run` -> `_execute` -> `task_prompt` with a dedicated "CHANGED-FILES RUN" prompt branch, and exposes `make maintenance` (read-only) and `make maintenance-fix` (fix mode) targets in the Makefile. Documentation is updated in `AGENTS.md`, `CLAUDE.md`, and `README.md`.
- Add explanation that each agent runs in isolation, preventing accidental cascading triggers
- Clarify that Maestro runs each agent once and caches results for follow-up questions
- Update style agent description to note context-aware application of project rules
- Wrap leaderboard test page/browser context in try/finally to ensure cleanup on failure
Introduce `mark_orchestration_tools`, `set_tool_scope`, and `reset_tool_scope` in `agents/agent.py` to allow runtime filtering of tool payloads by scope and orchestration flag. Refactor `get_tool_payloads` to respect the active scope and exclude orchestration-only tools. Update `agents/core/__init__.py` with `worker_tool_names` helper that returns read/reasoning tools plus conditional write/verify tools per mode, replacing the old `payloads_for` exclusion logic. Modify `agents/maestro.py` to call `mark_orchestration_tools` and wire per-agent result recording via `on_result` callback in `run_fleet`. Extend `agents/orchestrator.py` `run_fleet` signature to accept an optional `on_result` callable and invoke it after each agent run. Revise `agents/style.py` em-dash rule to distinguish prose from data occurrences, and add repository layout guidance to `agents/base.py` MAINT_HEADER.
- Add `agents/reports/` to `.gitignore` to prevent generated agent report files from being tracked
- Implement `_TimestampStream` class and `install_timestamps()` function in `agents/agent.py` for prefixing stdout/stderr with timestamps and elapsed time
- Export `install_timestamps`, `set_write_budget`, `clear_write_budget`, and `set_shell_restricted` from `agents/base.py`; add `_RUN_LOCK`, `AGENT_ICONS` dictionary, and `WRITE_BUDGET = 20` constant
- Add `report_codename()` function and `CODENAME_ADJECTIVES`/`CODENAME_ANIMALS` tuples to `agents/core/__init__.py` for generating random agent report codenames
- Expand `WRITE_TOOLS` tuple in `agents/core/__init__.py` to include `replace_lines`, `insert_lines`, and `delete_lines`; remove `SWARM_TOOLS` from `payloads_for` exclusion list
- Update `CLAUDE.md` and `AGENTS.md` documentation with dataset column initialization rules and new agent infrastructure details
- Reorder route table in `README.md` to list `/uploads` before `/messages` and document Swagger/ReDoc/OpenAPI schema endpoints
The diff adds the mandatory `retoor <retoor@molodetz.nl>` header comment to every `.py` file under `devplacepy/` (including `__init__.py` and `routers/__init__.py`), and updates the `StyleAgent` in `agents/style.py` to instruct agents to only add the header on created or already-edited files rather than sweeping the entire repo. The `agents/base.py` operating protocol is also revised to reorder and clarify tool discipline rules.
- Bump DEFAULT_MAX_ITER from 40 to 60 in agents/base.py for longer agent runs
- Add seed_findings parameter to MaintenanceAgent.task_prompt() enabling targeted fix mode from prior check results
- Extend write_reports() with incomplete flag to track partial completion
- Introduce _LAST_CHECK cache in maestro.py to store check findings for subsequent fix runs
- Modify _dispatch() to pass seed findings to fix mode and include seeded_from_check in response
- Add incomplete field to orchestrator.py fleet results for consistency across agent outputs
Add the `agents/` directory containing a fleet of autonomous AI maintenance agents for codebase consistency, including a shared async engine (`agent.py`), a dependency-free validator (`validator.py`), and specialized agents for security, audit, docs, style, frontend, SEO, test coverage, and more. Wire the fleet into the Makefile with `--fix`/`--check` modes, document the architecture in `AGENTS.md`, `CLAUDE.md`, and `README.md`, and enforce a hard rule that the `agents/` directory itself is off-limits to any code modification to preserve detection data.
The label attribute on the dp-upload component previously defaulted to "Attach files" and always displayed. This change makes the label optional by defaulting to an empty string, hiding the label element when no label is provided, and updating the documentation to reflect the new behavior. The feed template also removes the now-redundant explicit label attribute.
- Replace `100vh` with `100dvh` in messages-layout height and min-height to properly account for mobile browser dynamic toolbar heights, adjusting offset from 2rem to 3.5rem for consistent spacing
- Remove `autofocus` attribute from message input field to prevent automatic keyboard popup on page load
- Remove `footer` block override that was incorrectly suppressing the site footer on messages page
- Change `input.focus()` to `input.focus({ preventScroll: true })` in the scroll-to-bottom script to avoid unwanted page jumps when focusing the input after sending a message
The comment depth multiplier was reduced from 0.25rem to 0.0625rem for main layout, and from 0.1rem to 0.025rem for mobile breakpoints, with corresponding padding-left reductions in .comment-replies from 0.25rem to 0.0625rem and 0.1rem to 0.025rem respectively. This tightens the visual nesting of threaded comments to prevent excessive horizontal drift in deeply nested reply chains.
Adjust margin-left and padding-left values in .comment and .comment-replies
selectors to use smaller multipliers (0.25rem, 0.1rem) instead of previous
larger values (1.5rem, 0.5rem, 0.25rem) for tighter nested comment display.
Add two new chat commands (`/stop` and `/reset`) to the Devii WebSocket handler, enabling users to stop or reset a session via text input. Introduce a new "Bots internals" documentation section with six prose pages covering architecture, personas, content generation, engagement, realism, and configuration for the autonomous bot fleet. Extend the bot service with article scoring, category picking, configurable pause/break timing, and a `gist_min_lines` parameter for LLM client initialization.
Refactor proxy target resolution to connect straight to the container's bridge IP and container port, bypassing the host port-publishing layer entirely. Introduce `container_ip`/`container_gateway` fields captured from Docker inspect on each running instance, stored alongside status updates. Update the fake backend to emit realistic `NetworkSettings` with per-container IPs. Remove the now-unused `CONTAINER_PROXY_HOST` config default and the old `ports_json`-based host port lookup in the proxy router.
Add JavaScript click handler for profile dropdown toggle in MobileNav, replace anchor with button in base template, add explicit profile link to dropdown menu, and apply z-index to nav-badge for proper stacking.
Replace five separate file-extension patterns for devplacepy/static/uploads/ with a single directory-level ignore, and add a clarifying comment that uploaded/downloaded files must never be tracked in git.
- Add new `/projects/{slug}/files` endpoint group for per-project filesystem operations including directory and file CRUD, upload, and inline editing with public read and owner write access
- Extend attachment system to support video formats (webm, ogv, mov, m4v) with proper file icons and MIME types
- Implement configurable allowed file types via `allowed_file_types` site setting, replacing hardcoded `ALLOWED_UPLOAD_TYPES` with dynamic `allowed_extensions()` and `is_extension_allowed()` functions
- Add `delete_all_project_files()` call in `delete_content_item()` to clean up project files when a project is deleted
- Create database indexes on `project_files` table for `(project_uid, path)` and `(project_uid, parent_path)` to optimize file lookups
- Introduce `docs_prose.py` module with `render_prose()` function that renders Markdown content inside `data-render` divs using mistune, enabling dynamic prose rendering in documentation pages
- Enhance docs search with Markdown-aware text stripping (`_demarkdown()`) and improved HTML/script/style sanitization for better search indexing
- Update documentation API samples to reflect new attachment response fields (`is_image`, `is_video`, `mime_type`) and note video format support
- Update README to document the new project files endpoint and clarify AI gateway attribution for guest Devii sessions
This commit introduces a comprehensive set of new features including API key authentication with CLI management commands (get, reset, backfill), a Devii agentic assistant with WebSocket terminal and session bootstrap, an OpenAI-compatible LLM gateway service, and an admin service management panel. It also adds Playwright browser automation for bot support, configures internal gateway URLs, refactors content editing/deletion to support JSON API responses, and updates documentation across AGENTS.md, README.md, and the developer docs site.
Add three new feature modules (reactions, bookmarks, polls) with corresponding database tables, indexes, and router registrations. Introduce `SESSION_MAX_AGE_REMEMBER` config for extended session duration, add `get_unread_messages` template global, and include operational defaults for rate limiting and session settings in `site_settings`.
Add coverage tooling to CI workflow, Makefile, and pyproject.toml dependencies.
Introduce new test suites for push notification helpers (base64 encoding, HKDF,
authorization JWT) and utility functions (safe_next, strip_html, mention extraction,
badge/xp awarding, milestone checks) with a session-scoped local_db fixture.
Implement canonical_redirect helper in content.py to enforce slug-based 301 redirects for gist, news, post, and project detail pages. Add first_image_url helper to extract primary image from item or attachments for Open Graph meta tags. Inject next_page_url into feed, gists, news, and projects list page SEO contexts for pagination link rel. Extend seo.py with SITEMAP_URL_LIMIT, SITEMAP_TTL constants and _sitemap cache variable for future sitemap generation optimization. Update profile page to raise 404 via not_found instead of 302 redirect, and include og_image from avatar_url.
- Fix test_bug_comment_reply and test_project_comment_reply to scope fill/click to .comment-reply-form instead of using generic textarea/button selectors
- Add test_login_next_redirects_to_target verifying ?next=/gists redirects after login
- Add test_login_next_rejects_external ensuring external ?next= URL falls back to /feed
- Add test_comment_reply_inline_form, test_comment_reply_toggle_and_cancel, test_comment_create_scrolls_to_anchor for post comment reply UX
- Add _seed_post_with_comments and _create_post_ui helpers in test_feed.py
- Fix test_news_comment URL assertion to use wildcard pattern for slug matching
- Add `next` field to LoginForm model for preserving post-login redirect target
- Implement `safe_next` utility to validate redirect URLs and prevent open redirect vulnerabilities
- Update login page handler to accept and pass `next` query parameter
- Add hidden `next` input to login form template for POST submission
- Modify `require_user` to redirect to `/auth/login` instead of root
- Add `Http.toLogin()` static method in JS for client-side redirect with current URL encoded
- Update CommentManager to redirect unauthenticated reply attempts to login
- Fix comment creation redirect to use `comment_url` instead of generic `redirect_url`
Extract comment item building into `_build_comment_items` helper in database.py, import `get_recent_comments_by_post_uids` in feed router to attach up to 3 recent comments per post, add `post-card-comments` CSS class and `.comment-reply-form` margin rule, refactor `CommentManager` to use event delegation and toggle reply forms via a hidden template, move comment rendering into a reusable `_comment.html` macro, and include recent comments in `_post_card.html` with inline reply capability.
Add `fuser -k` to kill stale processes on the locust port before starting the uvicorn server, and improve the server readiness loop to detect startup failures early. In the locustfile seed function, cap user creation attempts at 25 and log a clear error if fewer than 5 seed users are created, preventing silent hangs or partial test data.
Extract shared PAGE_SIZE constant and paginate() function into database.py, replacing inline cursor logic in feed, gists, news, and projects routers. Introduce `_load_more.html` partial template to unify "Load More" button rendering. Update all affected route handlers to accept `before` query parameter and return `next_cursor` for seamless infinite scroll. Adjust projects count display to use filtered length instead of total. Add test helper `_seed_posts` for pagination coverage.
Introduce a new `/leaderboard` endpoint ranking top 50 members by total stars, wire it into the app router and documentation. Implement `_backfill_gamification()` in `database.py` to compute XP/levels for existing accounts from prior posts, comments, votes, and follows. Extract `is_owner()`, `create_content_item()`, and `detail_context()` into `content.py` to centralize content creation, reward awarding, mention notifications, and attachment linking. Update comment creation/deletion in `comments.py` to use `award_rewards()` with `XP_COMMENT` and the new `is_owner()` helper. Add shared template partials documentation for vote bars, star buttons, post headers, and topic selectors to `AGENTS.md`.
- Remove `make demo` target from Makefile, AGENTS.md, and README.md
- Improve `_row_to_attachment` to glob for thumbnail files with any extension instead of hardcoding `.jpg`
- Rewrite `cmd_attachments_prune` to use time-based cutoff and `delete_attachment` helper instead of orphan detection
- Add cursor-based pagination to feed and notifications endpoints with `before` parameter
- Track `did_upvote` flag in vote handler to only notify on new upvotes, not vote changes
- Add `PAGE_SIZE` constant and `next_cursor` template variable to notifications page
- Implement Playwright tests for notification pagination with 30 seeded notifications
- Vendored DOMPurify at static/vendor/purify.min.js, loaded with defer in base.html
- ContentRenderer.js now sanitizes marked output via DOMPurify.sanitize before processMedia
- Fail-closed: render() throws if DOMPurify is undefined instead of emitting unsanitized HTML
- Added _json_ld_dumps helper in seo.py to escape <>&\u2028\u2029 in JSON-LD output
- Updated combine() to use the new safe dumper for all schema.org payloads
retoor