Primora

91 Commits 10 Branches 10 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Tomas DvorakandDevin	182b0c49c2	fix: vendor dashboard fonts + vault_exec docs cleanup - Geist/Geist Mono via @fontsource inside the Vite bundle — the Google Fonts <link> was blocked by the nginx CSP (style-src 'self'), so the dashboard silently fell back and phoned home on self-hosted instances. Fonts now serve from /assets under 'self' — CSP-clean, airgapped, no console violation. - mcp README: vault_exec described the old deny-list; rewritten for the allow-list contract. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-24 22:01:47 +02:00
Tomas DvorakandDevin	585bb04ab2	feat: encrypted secrets vault across CLI, desktop, dashboard, and backend Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-24 18:46:37 +02:00
Tomas DvorakandDevin	4f66c72121	docs: slim README, move detail into per-app and contributor docs README down to the Containr skeleton: header, three-screenshot row (rest behind <details>), features, architecture, quick start, links. Dropped tables and sections already covered by QUICK_START.md. Native dev commands and repo layout moved to CONTRIBUTING.md; CLI/MCP usage moved to new per-app READMEs. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-21 16:46:32 +02:00

Author

SHA1

Message

Date

Tomas DvorakandDevin

182b0c49c2

fix: vendor dashboard fonts + vault_exec docs cleanup

- Geist/Geist Mono via @fontsource inside the Vite bundle — the
  Google Fonts <link> was blocked by the nginx CSP (style-src 'self'),
  so the dashboard silently fell back and phoned home on self-hosted
  instances. Fonts now serve from /assets under 'self' — CSP-clean,
  airgapped, no console violation.
- mcp README: vault_exec described the old deny-list; rewritten for
  the allow-list contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-24 22:01:47 +02:00

Tomas DvorakandDevin

585bb04ab2

feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-24 18:46:37 +02:00

Tomas DvorakandDevin

4f66c72121

docs: slim README, move detail into per-app and contributor docs

README down to the Containr skeleton: header, three-screenshot row
(rest behind <details>), features, architecture, quick start, links.
Dropped tables and sections already covered by QUICK_START.md.
Native dev commands and repo layout moved to CONTRIBUTING.md;
CLI/MCP usage moved to new per-app READMEs.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-21 16:46:32 +02:00