- desktop: probe-then-persist server URL — scheme-less input tries https
then http; a failed probe no longer saves a dead URL that would trap
the next launch in a redirect to a broken address
- frontend: close the create-collection modal on successful submit
(backdrop stayed mounted and intercepted navigation)
- frontend: reload once on service-worker controllerchange so returning
users don't run a stale cached shell after a deploy
- frontend: gate dashboard empty states on resource loading to stop the
"No project selected" / "Create your workspace" flash
- cli: resolve scheduled-job refs by name or id for jobs:run, jobs:runs,
and jobs:rm, matching bucket/org resolution
- cli: correct stale pk_live_/pk_test_ help text to the real prm_ format;
align README command spellings and demo seed prefixes
- setup: rewrite all public URL vars (auth, vite, backend) and cookie
domain for the entered host — https for domains, http for IPs — with
anchored full-line substitutions so stale ports/paths can't survive
- docs: VITE_* vars never reach the frontend image build; the app
resolves API/auth URLs same-origin at runtime, so host changes need no
rebuild — noted HTTPS requirement for PWA/secure-context features
Generated with [Devin](https://devin.ai)
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The .page column was max-width 72rem but left-aligned, leaving a large
empty band on the right above ~1200px. margin-inline: auto centers it;
narrow widths are unchanged since the column fills the viewport anyway.
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The org/project/bucket/collection create forms required typing a slug
by hand. While the slug field is untouched (empty or still equal to the
derived value), naming the entity fills its slug; a manual slug edit
stops the derivation and is sanitized to slug form as you type.
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
exec 9</dev/tty 2>/dev/null inside the if condition redirected the whole
shell's stderr to /dev/null permanently — the read -p prompt then wrote
into the void, leaving the installer blocked on an invisible question.
Replace with a plain </dev/tty redirect on read itself plus a quiet
true </dev/tty probe: the prompt displays, answers land, and no-tty
runs fall back to the default without error noise or the exec
redirect-failure shell-exit hazard.
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
curl without timeouts hangs silently on a stalled connection — the
install looked dead between 'Fetching compose files' and the image
pulls. --connect-timeout/--max-time/--retry-all-errors turn it into a
clear error naming the file.
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
stdin is the script pipe when run as `curl ... | bash`, so the -t 0
check silently skipped the domain question. Read from the controlling
terminal instead; no tty (CI/cron) still defaults to localhost.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
install.sh now asks one question on fresh installs — the URL the app is
opened on. Accepts https://primora.example.com (TLS at the user's proxy),
primora.example.com, or 192.168.1.50:8085; the port becomes NGINX_PORT.
The answer rewrites every public URL var and COOKIE_DOMAIN for real DNS
names. PUBLIC_URL env keeps it non-interactive; legacy DOMAIN/NGINX_PORT
still work; reruns over an existing .env skip the question and display
the URL from the file.
Also trust both URL schemes on the serving host in trustedOrigins —
external TLS termination makes nginx report http while browsers arrive
over https.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The sbom job's `permissions: packages: read` replaces the default token
set, so `gh release upload` got 403 Resource not accessible. Grant
contents:write alongside packages:read.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Self-hosted sign-up bounced back to the bootstrap screen for three
compounding reasons:
- better-auth's client resolves { data, error } on HTTP failure; the UI
ignored res.error and showed "Account created — signing you in", hiding
the real 403/429/500.
- trustedOrigins was a static localhost-only list. Browsing the instance
via LAN IP or custom port failed every auth POST once cookies existed.
Origins are now derived from the request's public host (forwarded by
nginx), so any origin serving the app works.
- hasMailTransport threw when core.settings was unreadable (fresh volume,
backend still migrating), so sign-up 500'd and the startup backfill
could crash-loop the service. Both now degrade to "no transport".
Verified live: LAN-style origin sign-up succeeds, missing core.settings
logs a warn instead of exiting, and the frontend shows real errors.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
anchore/sbom-action does not create the output directory — the v0.8.1
run scanned images fine (lowercase owner works) but ENOENT'd writing
dist-release/sbom-*.cdx.json.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
SMTP-less self-hosted instances still marked every account
emailVerified=false and attempted a verification mail that could
never arrive. Now: no transport → accounts are created verified,
the send is skipped, and existing unverified rows are backfilled
on startup. .env.example stops defaulting SMTP_HOST to the
dev-only mailpit service.
Verified live: fresh signup returns emailVerified=true, legacy
unverified users flip on restart, sign-in unaffected.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
ghcr.io rejects mixed-case repo paths — syft failed to parse
ghcr.io/Dvorinka/primora-* so the v0.8.0 SBOM job errored.
Apply the same lowercase-owner normalization the image jobs use.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
arm64 npm ci under QEMU SIGILLs on current node:20-alpine layers
(uncaught target signal 4) and wedges the build step — the v0.8.0
release stalled there twice. Build each platform natively and join
the arch tags with a manifests job.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
A "Set up with an AI agent" dialog that mints a write-scoped API key and
renders a copyable prompt handing a coding agent everything needed to wire
a repository into a Primora project: telemetry ingest for any language,
db-connections for tracked databases, MCP/CLI agent access, and
verification steps. Opens at the end of new-project onboarding; also
reachable from the project dashboard and Projects page settings.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- handlers: pgx.ErrNoRows→404, InputError→400 with message preserved,
pgconn 23505→409 without constraint/SQLSTATE leak, unknown→500
- services: export NewInputError so error construction is testable
- frontend: vitest for errorMessage helper — server reason preferred,
status text and fallbacks verified
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- api-client: getResponseBody returns Blob for non-JSON (fixes storage
preview/download TypeError); postgen.mjs reapplies the patch on regen
- Modal: error prop renders inside the dialog so request failures are
visible instead of hidden behind the overlay (6 pages wired)
- lib/api: extract server-provided error message from error.body
- Modal: unique id per instance (duplicate modal-title broke aria-label)
- nginx: index.html no-cache + immutable /assets (stale shell pointed at
deleted hashed assets after redeploy → white screen)
- vite: drop dead Google Fonts runtime caching (fonts are vendored)
- functions: audit function.created/updated/deleted/invoked
- AuditPage: expand action filter to all recorded actions
- MCP: whoami uses /context for API keys; projectId/orgId resolve via
/context with auth-aware precedence (stale `primora use` selection can
never authorize a differently-scoped key)
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Geist/Geist Mono via @fontsource inside the Vite bundle — the
Google Fonts <link> was blocked by the nginx CSP (style-src 'self'),
so the dashboard silently fell back and phoned home on self-hosted
instances. Fonts now serve from /assets under 'self' — CSP-clean,
airgapped, no console violation.
- mcp README: vault_exec described the old deny-list; rewritten for
the allow-list contract.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- POST /projects/:id/events accepts client-authored events restricted to
the custom.* namespace — system types can't be spoofed. They flow
through the same publishEvent fan-out: realtime, webhooks, and
event_pattern functions all fire.
- Presence: subscribe/unsubscribe bumps a per-project count and
broadcasts presence.update {online} to the realtime stream only —
deliberately not through publishEvent so webhooks and "*" functions
don't fire on connect noise. GET …/realtime/presence reads the count.
- @primora/client gains publish() and presence(); CLI gains events:send.
Verified live: presence 0->1 on subscribe, presence.update frame
delivered, custom event delivered to SSE + fired a custom.* function,
spoofed document.created rejected 400.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Each invoke runs in an ephemeral locked-down container — no network,
read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL.
Source travels as base64 in the container env and materializes in the
tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work).
Timeout force-removes the named container.
exec driver stays the default; the trust-model docs now describe both.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- tauri-plugin-updater + process: pubkey embedded in tauri.conf.json,
createUpdaterArtifacts, endpoint = GitHub latest.json manifest.
- Connect screen checks before auto-connect (bounded 5s) — a saved
URL would otherwise navigate away before the check resolves.
"Update & restart" downloads, verifies minisign, installs, relaunches.
- Release workflow signs updater artifacts with
TAURI_SIGNING_PRIVATE_KEY secrets, ships the .sig files, and assembles
latest.json from them. No key → no manifest → no update, never a
silent unsigned install.
- anchore/sbom-action emits CycloneDX SBOMs per GHCR image plus the
source tree, attached to every release.
Note: the signing keypair was generated locally
(~/.tauri/primora-updater.key); the private half must be added to repo
secrets before the next release for updates to activate.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Tomáš Dvořák