sunny:botparley · Changesets

Review and merge changesets authored against this slice.

Changeset	Status	Author	Blocked reason
submitted BotParley: /privacy notice for sign-up attribution, sessions, Turnstile and bp_attr cookie151d19204c10 files changed	submitted	sunny	None
submitted Sign-up attribution + Cloudflare Turnstile bot protection - signup_attribution (migration nifty_chameleon): first-visit referrer, landing path, utm_* (client, via x-bp-attribution from sessionStorage/bp_attr cookie) + request Referer, CF-Connecting-IP, cf.country/asn/ asOrganization, user agent; sanitized and length-capped (src/lib/attribution.ts); deleted with the account. - middleware/03-signup.ts: Turnstile siteverify before Better Auth creates the account (400 CAPTCHA_REQUIRED / 403 CAPTCHA_INVALID / 503 unavailable); sign-in asks for a check after 3 failures per email in 15 min (auth_failures). Enabled only when TURNSTILE_SITE_KEY + TURNSTILE_SECRET_KEY are set; optional TURNSTILE_SMOKE_BYPASS for @example.com smoke sign-ups. GET /v1/signup-config serves the site key. - Web: managed widget (explicit render, flexible size, app theme) on sign-up and on sign-in when asked. - Tests: test/attribution.test.ts (10), scripts/signup.mjs e2e (added to CI e2e with Turnstile test keys); scripted sign-ups send the dummy test token. DESIGN.md.656c45ad3f28 files changed	submitted	sunny	None
submitted CI: Gitslice checks for BotParley (typecheck, unit, build, local e2e) - .gitslice/checks.yaml: four checks (typecheck, unit, build, e2e) on patchsets touching app/ or .gitslice/, run by the slice CI daemon grok-bot-ci (gs agent start --ci) or `gs ci`. - app/scripts/ci.sh: Node 24, per-package-lock hard-linked node_modules cache, generates .void types on a fresh tree, unsets Cloudflare credentials; e2e boots a throwaway dev server on a free port (fresh local D1, generated dev key), warms it up, then runs MCP smoke, SSE, unread, owner links, banner, account menu, password UI. - UI scripts write screenshots to $BP_SHOTS (default unchanged) so CI never overwrites the shared shots folder. - sse.mjs: cap check tolerates not-yet-noticed closed streams; prints any Vite error overlay. - DESIGN.md / README: how CI works.34e40aa93710 files changed	submitted	sunny	None
draft CI: Gitslice checks for BotParley (typecheck, unit, build, local e2e) - .gitslice/checks.yaml: four checks (typecheck, unit, build, e2e) on patchsets touching app/ or .gitslice/, run by the slice CI daemon grok-bot-ci (gs agent start --ci) or `gs ci`. - app/scripts/ci.sh: Node 24, per-package-lock hard-linked node_modules cache, generates .void types on a fresh tree, unsets Cloudflare credentials; e2e boots a throwaway dev server on a free port (fresh local D1, generated dev key), warms it up, then runs MCP smoke, SSE, unread, owner links, banner, account menu, password UI. - UI scripts write screenshots to $BP_SHOTS (default unchanged) so CI never overwrites the shared shots folder. - sse.mjs: cap check tolerates not-yet-noticed closed streams; prints any Vite error overlay. - DESIGN.md / README: how CI works.315fc65747	draft	sunny	None
submitted Web app: live updates over Server-Sent Events instead of 5 s polling - GET /v1/events[?parley=<name>][&after=<seq>]: session-cookie SSE for signed-in humans (GET only, Origin / Sec-Fetch-Site same-origin, signed bots refused, same ACL as reads, max 6 streams per human → 429). - Served by the existing botparley-stream DO (instance h:<human>); events message (id = seq), unread, held, members, parleys, sync, closed; 25 s ping comments, retry 3000, 10 min lifetime; Last-Event-ID / ?after resume replays missed visible messages then sync. Dead streams dropped by flush probe / backpressure cap. - Emits after commit (waitUntil) from send, approve/reject, join, member decide/remove, human role/remove, invite accept, read. live_streams presence table (migration round_tusk) so idle humans' DOs aren't woken. - Client: src/ui/live.ts EventSource with jittered 1 s→60 s backoff, 45 s fallback poll only while SSE is down, closes after 30 s hidden and resyncs on return. Parley chat appends messages, unread bold/badges, banner and tabs update live; dashboard unread pills update live. 5 s poll removed. - Tests: test/sse.test.ts (13), scripts/sse.mjs e2e (npm run test:sse); DESIGN.md + llms.txt.68c14ab93927 files changed	submitted	sunny	None
submitted Unread conversations for humans: server-side conversation_reads (D1 migration with read baseline for existing members), unread counts in GET /v1/parleys/{p}/conversations and GET /v1/parleys, POST /v1/parleys/{p}/read; web app bolds unread conversations and parley cards (count badge + sr-only label), clears on open, live refresh, cross-device; unit + e2e tests (scripts/unread.mjs)6abb670fac18 files changed	submitted	sunny	None
submitted Owner deep links: claim_url/approve_url + next_step in register, join, GET /v1/me (pending_joins), GET /v1/parleys and pending 403s; web #/claim/<bot> page and ?request=<bot> highlight on parley settings (sign-in round trip, explicit click, auth unchanged); llms.txt/MCP/DESIGN docs; unit + e2e tests (scripts/owner-links.mjs)dd9de35ef420 files changed	submitted	sunny	None
submitted llms.txt: daily self-refresh instructions, Version line; ETag/Last-Modified + 304 on api host92db9e1afa2 files changed	submitted	sunny	None
submitted llms.txt: add 'Most reliable setup' summary and explicit no-retry rule for refused sendsa9f84f94131 file changed	submitted	sunny	None
submitted MCP: key-based bot auth (POST /v1/mcp/token signed with the bot's own Ed25519 key, no human/bot picker; refresh+revoke; BYOK bots supported over MCP)5e92808c3c12 files changed	submitted	sunny	None
submitted Remote MCP server at api.botparley.com/mcp with OAuth 2.1 (PKCE + DCR), consent screen, server-held bot keys, 15 tools, docs and testsb1cf725b2033 files changed	submitted	sunny	None
submitted SEO: prerendered landing HTML at / (no-JS content), title/description/canonical, Open Graph + Twitter card with 1200x630 OG image, favicon PNGs + apple-touch-icon + web manifest, JSON-LD (Organization, WebSite, WebApplication), robots.txt + sitemap.xml, api host noindex (+ own robots.txt, llms.txt canonical), workers.dev 301 to botparley.com, cache headers, inlined CSS + non-blocking fonts, underlined in-text linksa29504459220 files changed	submitted	sunny	None
submitted Top bar: avatar account menu at all widths (M3 menu: Account & password, theme, Sign out; keyboard + outside-click close); mobile top bar decluttered; /account (and #/me, #/profile, #/password, #/settings) alias to #/account; account-menu test4d42b8e6647 files changed	submitted	sunny	None
submitted Material 3 redesign (Muted Violet, seed #6D4DFF): M3 tokens light/dark, tonal surfaces, M3 shape/type, filled/tonal buttons, segmented tabs, FAB, chips, dialogs, toasts, filled inputs, success/warning harmonized roles, harmonized avatar set, solid tonal logo + favicon, no gradients; hero tint seam fix; WCAG AA contrast audit (test:contrast)f4339dcd5b9 files changed	submitted	sunny	None
submitted Add root .gitignore for workspace markers, build output, secrets and scratch files0e618489601 file changed	submitted	sunny	None
submitted Add Source on Gitslice links (landing nav + footer), Source line in llms.txt and READMEsb386fcb3215 files changed	submitted	sunny	None
submitted Remove stray nested workspace marker (sunny/botparley/.gs) committed into the slice3875a3ab7d4 files changed	submitted	sunny	None
submitted Repair slice layout: move project files from nested sunny/botparley/sunny/botparley/ back to sunny/botparley/ (normal-path copies were newest), delete nested duplicatee6b61d8252210 files changed	submitted	sunny	None
submitted Settings on mobile: stop crushed text (bot rows stack, People table becomes cards, no overflow-wrap:anywhere in flex rows); crushed-text audit with real-like seed; slim dismissible approvals banner4c682303ca6 files changed	submitted	sunny	None
submitted Account: change password (Better Auth changePassword + D1 attempt limit, sign-up rules, audit, revoke other sessions); parley page: segmented Chat/People/Settings tabs with own routes, in-place switching, per-tab scroll, sliding indicator; tab-perf + password UI tests90d2545f3929 files changed	submitted	sunny	None
draft Account: change password (Better Auth changePassword + D1 attempt limit, sign-up rules, audit, revoke other sessions); parley page: segmented Chat/People/Settings tabs with own routes, in-place switching (no refetch/remount), per-tab scroll, sliding indicator; tab-perf + password UI tests6fa8ba7c6814 files changed path base conflict, refresh or rebase the changeset	draft	sunny	path base conflict, refresh or rebase the changeset
submitted UI copy: parley name help text; stop telling people to share internal ids3c51a26a051 file changed	submitted	sunny	None
submitted Loop protection + per-bot rate limits (per-parley owner settings, 429 loop_limit/rate_limited with retry_after + Retry-After), Settings card, llms.txt/DESIGN docs, unit + smoke tests; drop deleted bots signatures from history; settings mobile wrap fix4f97e7026116 files changed	submitted	sunny	None
submitted Web: smooth conversation switching (cached SWR, kept list/scroll/focus, stale-response guard, mobile slide); switch-perf regression test; llms.txt: recipient resolution, respond automatically/platform gates delivery, judge whether to continue8ecc75e5577 files changed	submitted	sunny	None
draft Web: smooth conversation switching (cached SWR, kept list/scroll/focus, stale-response guard, mobile slide); switch-perf regression test; llms.txt: recipient resolution, respond automatically/platform gates delivery, judge whether to continue6d8d641bfe11 files changed path base conflict, refresh or rebase the changeset	draft	sunny	path base conflict, refresh or rebase the changeset
submitted Mobile: no horizontal overflow on any view (grid/flex min-width:0, wrapping for long names/URLs/code, responsive modals/tables, compact top bar, toasts moved above content); conversation-first chat (list default, All messages kept), composer removed, New message FAB/button with mandatory-recipient compose sheet (search, multi-select, reply prefill); scripts/overflow.mjs audit (npm run test:ui), richer seed data55f6cef1e07 files changed	submitted	sunny	None
submitted Deletion: human accounts (Account page danger zone, type-to-confirm, preview, sole-owner 409/delete_parleys, owned bots deleted, sessions revoked, handle tombstone), bots (owner UI + signed DELETE /v1/bots/{name} or /v1/me; key revoked, stream closed, webhook/memberships removed, name tombstone), parleys (owner, confirm name); deleted-bot/@deleted-user rendering; system message_rejected notice to sender bot; examples/poll-once.mjs; web URLs use parley names (id URLs rewritten); docs, tests, smoke0f3556a83a29 files changed	submitted	sunny	None
submitted Owner-controlled reply_mode (auto/approve/off) with held-message approval queue + members UI control; webhook static auth header (masked, reserved-name guard) + any_2xx verify; WebSocket stream /v1/stream (per-bot Durable Object botparley-stream, signed upgrade, replay/ack/ping) + examples/stream.mjs; llms.txt wake-up + local environment recipes; DESIGN/README; unit tests + smokee9b189351e34 files changed	submitted	sunny	None
submitted Names instead of ids: unique bot names (slug, 400/409 + suggestion), human @handles (human_handles table), keyid = bot name (legacy bot_ keyids still accepted), to/participants/policy/{bot}/{hum} accept names, responses+webhooks rewrite ids to names; UI shows/copies names only; migration lowercases bot names (Sunny->sunny); llms.txt/DESIGN/examples/tests02cb88c46d27 files changed	submitted	sunny	None
submitted llms.txt: explicit List members (full example response, 'you') and Send a message (ids only, workflow, request/response, reply via from, multi-recipient, common errors); clearer unknown-recipient API errors (to[i], name→id hint, pending state) + unit testsccb225ca5f4 files changed	submitted	sunny	None
submitted Parley names are unique slugs (3-40, a-z0-9-) with unique index migration; every /v1/parleys/{p} route accepts id (pr_) or name; join returns id+name; UI create validation; llms.txt/DESIGN; slug + resolution unit tests; smoke covers join-by-namedfd333465e25 files changed	submitted	sunny	None
submitted Add api.botparley.com as canonical bot API host (same Worker, custom domain); botparley.com/v1/* kept as alias; non-API paths on api host 301 to botparley.com; docs/llms.txt/landing/examples use api host; smoke supports separate API base244a6e7b8a10 files changed	submitted	sunny	None
submitted Fix API base to https://botparley.com (single origin) in llms.txt/DESIGN/README; clearer llms.txt (full URLs, signature base example, how to get a parley id); copy-parley-ID buttons with toast on dashboard cards and parley header8c43f8838e7 files changed	submitted	sunny	None
submitted BotParley UI polish: design system, landing, sign-in, dashboard, parley chat/members/settings, dark mode, responsive; demo seed + Playwright screenshotsf325f5626516 files changed	submitted	sunny	None
submitted Prefix Cloudflare queue: webhooks -> botparley-webhooks (queues/botparley/webhooks.ts); README resource names8316d0e1e94 files changed	submitted	sunny	None
submitted Deploy BotParley to Cloudflare: worker config (name/account, workers.dev), botparley.com custom domain (void.lock.json), Better Auth trusted origins, smoke SKIP_WEBHOOKS mode, README production notes6345c781905 files changed	submitted	sunny	None
submitted READMEs: app run/test instructions, MVP deviations; top-level links to app/ed923697f02 files changed	submitted	sunny	None
submitted BotParley MVP app (Void): bot registration + RFC 9421 Ed25519 auth, parley ACLs/invites, join/approve, messages with to:[ids] + conv_key, allow/block lists, inbox/ack, signed webhooks via Queues w/ SSRF guard, owner UI, example bot, vitest + E2E smoke90f4c31e0c62 files changed	submitted	sunny	None
submitted DESIGN v0.8: add Delivery / waking bots (signed webhooks w/ challenge + retries, WebSocket, polling; inbox as source of truth, at-least-once + ack), SSRF/spoofing/replay threats, limits7220ee1f2a1 file changed	submitted	sunny	None
submitted README: absolute link to DESIGN.md for the web viewer292a7cb5721 file changed	submitted	sunny	None
submitted DESIGN v0.7: derived conversations (grouped by participant-set conv_key); single POST /parleys/{p}/messages; drop conversation lifecycle APIs/tables; per-message bot list checks2a920e09f01 file changed	submitted	sunny	None
submitted DESIGN v0.6: rename channel to parley; add conversations (participant subsets) with API, data model, rules and threats; ACLs/bot lists stay parley-level3486c9ba952 files changed	submitted	sunny	None