chore(release): v0.8.4 (#49)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/release.yml

@@ -327,6 +327,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       packages: read
+      # contents: write — the job uploads SBOM assets onto the release.
+      contents: write
     env:
       VERSION: ${{ needs.verify.outputs.version }}
     steps:

CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to Primora. Format follows [Keep a Changelog](https://keepac
 
 ## [Unreleased]
 
+## [0.8.4] - 2026-09-28
+
+### Added
+
+- **Slugs auto-derive from names** — typing an organization, project, bucket, or collection name now fills its slug (`TDvorak` → `tdvorak`); hand-editing the slug stops the derivation, and manual edits are sanitized as you type. Edit forms stay manual.
+
+### Fixed
+
+- **Installer URL prompt was invisible under `curl | bash`** — `exec 9</dev/tty 2>/dev/null` sent the whole shell's stderr to `/dev/null` permanently, so the `read` prompt rendered nowhere while the script blocked on input. The prompt now reads `/dev/tty` directly with a quiet probe; no-tty runs default silently.
+- **Installer fetches fail fast** — the compose-file and source-tarball `curl` calls now carry connect/max-time timeouts plus retries, so a stalled GitHub connection errors within seconds naming the file instead of hanging forever.
+
+## [0.8.3] - 2026-09-28
+
+### Added
+
+- **Install script asks for the public URL** — `install.sh` now prompts for where you'll open the app and accepts a full URL: `https://primora.example.com` (TLS at your proxy, hints printed at the end), `primora.example.com`, or `192.168.1.50:8085` (the port becomes `NGINX_PORT`). The answer rewrites every public URL var in `.env` and `COOKIE_DOMAIN` for real DNS names. The prompt reads the controlling terminal so it appears under `curl | bash`; no tty (CI, cron) falls back to `localhost`. Non-interactive via `PUBLIC_URL=`; legacy `DOMAIN`/`NGINX_PORT` envs still work; reruns over an existing `.env` skip the question.
+
+### Fixed
+
+- **Auth origins behind external TLS terminators** — trusted origins now accept both URL schemes on the serving host. Verified live over a Cloudflare quick tunnel: a real browser session cookie + `https://*.trycloudflare.com` origin was 403'd on v0.8.2 (nginx reports `X-Forwarded-Proto: http` inbound); the same request now signs in cleanly while cross-site origins still 403.
+
 ## [0.8.2] - 2026-09-28
 
 ### Fixed

README.md

@@ -77,7 +77,9 @@ Prerequisites: Docker with the Compose plugin.
 curl -fsSL https://raw.githubusercontent.com/Dvorinka/Primora/master/install.sh | bash
 ```
 
-Installs into `./primora`, generates secrets, and starts the stack on port 80.
+Installs into `./primora`, asks one question — the URL you'll open the app on
+(domain, IP, optional port) — generates secrets, and starts the stack.
+Non-interactive: `PUBLIC_URL=https://primora.example.com bash install.sh`.
 Or from a clone:
 
 ```bash

apps/auth/src/lib/auth.ts

@@ -63,6 +63,9 @@ export const auth = betterAuth({
     if (host) {
       const proto = request?.headers.get("x-forwarded-proto") ?? "http";
       origins.push(`${proto}://${host}`);
+      // TLS often terminates at an external proxy — nginx then reports http.
+      // Both schemes on the serving host are legitimately this instance.
+      origins.push(proto === "https" ? `http://${host}` : `https://${host}`);
     }
     return origins;
   },

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primora/desktop",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "private": true,
   "description": "Primora desktop shell — thin Tauri client for a self-hosted deployment",
   "scripts": {

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Primora",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "identifier": "dev.tdvorak.primora",
   "build": {
     "frontendDist": "../ui"

apps/frontend/src/App.tsx

@@ -28,6 +28,7 @@ import { Show, createEffect, createMemo, createResource, createSignal, onCleanup
 import { authClient, fetchApiToken } from "./lib/auth-client";
 import { configureApiToken, errorMessage } from "./lib/api";
 import { isDemoMode, disableDemoMode, enableDemoMode, demoSession, demoService } from "./lib/demo-mode";
+import { applySlugField } from "./lib/slug";
 import {
   AgentSetupModal,
   AppShell,
@@ -1670,14 +1671,14 @@ export default function App() {
                             label="Organization name"
                             placeholder="Acme Corporation"
                             value={organizationInput().name}
-                            onInput={(e) => setOrganizationInput((c) => ({ ...c, name: e.currentTarget.value }))}
+                            onInput={(e) => setOrganizationInput((c) => applySlugField(c, "name", e.currentTarget.value))}
                             required
                           />
                           <Input
                             label="Slug"
                             placeholder="acme"
                             value={organizationInput().slug}
-                            onInput={(e) => setOrganizationInput((c) => ({ ...c, slug: e.currentTarget.value }))}
+                            onInput={(e) => setOrganizationInput((c) => applySlugField(c, "slug", e.currentTarget.value))}
                             required
                           />
                           <button type="submit" class="btn btn-primary w-full" disabled={workspacePending()}>
@@ -1723,7 +1724,7 @@ export default function App() {
               projectMessage={projectMessage()}
               projectPending={projectPending()}
               canUpdateProject={canUpdateProject()}
-              onProjectInputChange={(field, value) => setProjectInput((c) => ({ ...c, [field]: value }))}
+              onProjectInputChange={(field, value) => setProjectInput((c) => applySlugField(c, field, value))}
               onProjectEditInputChange={(field, value) => setProjectEditInput((c) => ({ ...c, [field]: value }))}
               onCreateProject={createProject}
               onUpdateProject={updateActiveProject}
@@ -1822,7 +1823,7 @@ export default function App() {
               previewLoading={objectPreview.loading}
               renameObjectKey={renameObjectKeyInput()}
               moveDestinationBucketID={moveDestinationBucketID()}
-              onBucketInputChange={(field, value) => setBucketInput((c) => ({ ...c, [field]: value }))}
+              onBucketInputChange={(field, value) => setBucketInput((c) => applySlugField(c, field, value))}
               onBucketEditInputChange={(field, value) => setBucketEditInput((c) => ({ ...c, [field]: value }))}
               onCreateBucket={createBucket}
               onUpdateBucket={updateSelectedBucket}
@@ -1859,7 +1860,7 @@ export default function App() {
               collectionPending={collectionPending()}
               documentPending={documentPending()}
               canUpdate={canUpdateProject()}
-              onCollectionInputChange={(field, value) => setCollectionInput((c) => ({ ...c, [field]: value }))}
+              onCollectionInputChange={(field, value) => setCollectionInput((c) => applySlugField(c, field, value))}
               onCreateCollection={createCollection}
               onDeleteCollection={deleteCollection}
               onSelectCollection={setSelectedCollectionID}

apps/frontend/src/lib/__tests__/slug.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+
+import { applySlugField, slugify } from "../slug";
+
+describe("slugify", () => {
+  it("derives lowercase hyphenated slugs", () => {
+    expect(slugify("TDvorak")).toBe("tdvorak");
+    expect(slugify("Acme Corporation")).toBe("acme-corporation");
+    expect(slugify("  My_App!! v2  ")).toBe("my-app-v2");
+  });
+
+  it("strips accents and non-ascii characters", () => {
+    expect(slugify("Zürich — Héllo")).toBe("zurich-hello");
+    expect(slugify("日本語")).toBe("");
+  });
+});
+
+describe("applySlugField", () => {
+  const form = { name: "", slug: "", description: "" };
+
+  it("fills the slug while it is untouched", () => {
+    const next = applySlugField(form, "name", "My Org");
+    expect(next.slug).toBe("my-org");
+    // keeps following name edits
+    expect(applySlugField(next, "name", "Renamed Org").slug).toBe("renamed-org");
+  });
+
+  it("stops deriving once the slug was hand-edited", () => {
+    const custom = applySlugField(applySlugField(form, "name", "My Org"), "slug", "custom-slug");
+    expect(applySlugField(custom, "name", "New Name").slug).toBe("custom-slug");
+  });
+
+  it("resumes deriving if the slug is cleared", () => {
+    const cleared = applySlugField(applySlugField(form, "name", "My Org"), "slug", "");
+    expect(applySlugField(cleared, "name", "Other").slug).toBe("other");
+  });
+
+  it("sanitizes manual slug edits", () => {
+    expect(applySlugField(form, "slug", "Not A Slug!").slug).toBe("not-a-slug");
+  });
+
+  it("passes through unrelated fields", () => {
+    expect(applySlugField(form, "description", "hi").description).toBe("hi");
+  });
+});

apps/frontend/src/lib/slug.ts

@@ -0,0 +1,27 @@
+export function slugify(value: string): string {
+  return value
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 63);
+}
+
+/**
+ * Applies a field edit to a {name, slug, ...} form. While the slug is
+ * untouched — empty or still equal to the derived value — renaming the
+ * entity re-derives its slug. Explicit slug edits are sanitized in place.
+ */
+export function applySlugField<T extends { name: string; slug: string }>(
+  current: T,
+  field: string,
+  value: string,
+): T {
+  if (field === "slug") return { ...current, slug: slugify(value) };
+  if (field === "name" && (current.slug === "" || current.slug === slugify(current.name))) {
+    return { ...current, name: value, slug: slugify(value) };
+  }
+  return { ...current, [field]: value };
+}

install.sh

@@ -3,8 +3,14 @@
 #
 #   curl -fsSL https://raw.githubusercontent.com/Dvorinka/Primora/master/install.sh | bash
 #
-# Installs into ./primora (override with PRIMORA_DIR). Non-interactive:
+# Installs into ./primora (override with PRIMORA_DIR). On a fresh install,
-#   DOMAIN=example.com NGINX_PORT=8080 bash install.sh
+# interactive shells get one question — the URL the app will be opened on
+# (domain or IP, optional port). Non-interactive:
+#   PUBLIC_URL=https://primora.example.com bash install.sh
+#   DOMAIN=192.168.1.50 NGINX_PORT=8085 bash install.sh   (legacy form)
+#
+# https URLs mean TLS terminates at your own proxy in front of Primora's
+# bundled nginx (which always speaks http on NGINX_PORT).
 #
 # Pulls prebuilt GHCR images when available; otherwise downloads the source
 # tarball and builds locally. Either way the result is the same compose stack.
@@ -14,8 +20,8 @@ set -euo pipefail
 REPO="Dvorinka/Primora"
 REF="${PRIMORA_REF:-master}"
 DIR="${PRIMORA_DIR:-primora}"
-DOMAIN="${DOMAIN:-localhost}"
 NGINX_PORT="${NGINX_PORT:-80}"
+PUBLIC_URL="${PUBLIC_URL:-}"
 
 info() { echo "==> $*"; }
 die()  { echo "ERROR: $*" >&2; exit 1; }
@@ -32,12 +38,62 @@ mkdir -p "$DIR/infra/nginx"
 cd "$DIR"
 
 # The compose stack needs exactly these three files from the repo.
+# Timeouts + retries: a stalled connection must fail loudly, not hang.
 info "Fetching compose files ($REF)"
 for f in docker-compose.yml .env.example infra/nginx/default.conf; do
-  curl -fsSL "https://raw.githubusercontent.com/$REPO/$REF/$f" -o "$f"
+  curl -fsSL --connect-timeout 10 --max-time 60 --retry 3 --retry-delay 1 --retry-all-errors \
+    "https://raw.githubusercontent.com/$REPO/$REF/$f" -o "$f" \
+    || die "could not fetch $f — check connectivity to raw.githubusercontent.com"
 done
 
-if [ ! -f .env ]; then
+if [ -f .env ]; then
+  info "Existing .env kept"
+  # Display URL comes from the file — answers here would change nothing.
+  PUBLIC_URL="$(grep -E '^VITE_APP_URL=' .env | tail -1 | cut -d= -f2- || true)"
+  [ -z "$PUBLIC_URL" ] && PUBLIC_URL="http://localhost"
+else
+  # Public URL — the single question. Env wins, then prompt, then default.
+  if [ -z "$PUBLIC_URL" ] && [ -n "${DOMAIN:-}" ]; then
+    PUBLIC_URL="http://${DOMAIN}"
+    [ "$NGINX_PORT" != "80" ] && PUBLIC_URL="$PUBLIC_URL:$NGINX_PORT"
+  fi
+  if [ -z "$PUBLIC_URL" ]; then
+    DEFAULT_URL="http://localhost"
+    [ "$NGINX_PORT" != "80" ] && DEFAULT_URL="http://localhost:$NGINX_PORT"
+    # Under `curl | bash` stdin is the script pipe — ask on the controlling
+    # terminal instead. `true </dev/tty` probes the open quietly; read's own
+    # redirect fails non-fatally (default applies) where there is no tty.
+    # Never `exec ... 2>/dev/null` here — exec redirections persist and would
+    # silence stderr, including the read prompt below, for the whole script.
+    if true 2>/dev/null </dev/tty; then
+      read -rp "URL where you'll open Primora (domain or IP, e.g. https://primora.example.com) [$DEFAULT_URL]: " PUBLIC_URL </dev/tty || true
+    fi
+    PUBLIC_URL="${PUBLIC_URL:-$DEFAULT_URL}"
+  fi
+
+  # Normalize: default scheme http, strip trailing slash.
+  case "$PUBLIC_URL" in
+    http://*|https://*) ;;
+    *) PUBLIC_URL="http://$PUBLIC_URL" ;;
+  esac
+  PUBLIC_URL="${PUBLIC_URL%/}"
+
+  # Split host[:port]; URL paths aren't supported — nginx mounts auth at /auth.
+  REST="${PUBLIC_URL#*://}"
+  HOSTPORT="${REST%%/*}"
+  [ "$REST" != "$HOSTPORT" ] && die "URL paths are not supported — use a domain or port instead: $PUBLIC_URL"
+  if [[ "$HOSTPORT" == *:* ]]; then
+    HOST="${HOSTPORT%%:*}"
+    PORT="${HOSTPORT##*:}"
+  else
+    HOST="$HOSTPORT"; PORT=""
+  fi
+  [ -z "$HOST" ] && die "could not parse a host from: $PUBLIC_URL"
+  if [ -n "$PORT" ]; then
+    [[ "$PORT" =~ ^[0-9]+$ ]] || die "invalid port in: $PUBLIC_URL"
+    NGINX_PORT="$PORT"
+  fi
+
   info "Generating .env with random secrets"
   cp .env.example .env
 
@@ -53,12 +109,15 @@ if [ ! -f .env ]; then
   "${SED[@]}" "s|^PRIMORA_ENCRYPTION_KEY=.*|PRIMORA_ENCRYPTION_KEY=$ENCRYPTION_KEY|" .env
   "${SED[@]}" "s|^NGINX_PORT=.*|NGINX_PORT=$NGINX_PORT|" .env
 
-  if [ "$DOMAIN" != "localhost" ]; then
+  # Every public URL var (VITE_APP_URL, BETTER_AUTH_URL, AUTH_BASE_URL,
-    "${SED[@]}" "s|http://localhost|http://$DOMAIN|g" .env
+  # VITE_AUTH_BASE_URL, VITE_API_BASE_URL, BACKEND_PUBLIC_URL) is built on the
-    "${SED[@]}" "s|^COOKIE_DOMAIN=.*|COOKIE_DOMAIN=$DOMAIN|" .env
+  # http://localhost prefix in .env.example — one rewrite covers them all.
+  "${SED[@]}" "s|http://localhost|$PUBLIC_URL|g" .env
+
+  # Cookie domains only apply to real DNS names — never IPs or localhost.
+  if [ "$HOST" != "localhost" ] && ! [[ "$HOST" =~ ^[0-9.]+$ ]]; then
+    "${SED[@]}" "s|^COOKIE_DOMAIN=.*|COOKIE_DOMAIN=$HOST|" .env
   fi
-else
-  info "Existing .env kept"
 fi
 
 # Compose v5 skips `pull` for services that declare build:, so fetch the
@@ -75,15 +134,17 @@ if docker pull "ghcr.io/$GHCR_OWNER/primora-backend:latest" \
 else
   # GHCR packages are private until first published release — build from source.
   info "Prebuilt images unavailable; building from source"
-  curl -fsSL "https://codeload.github.com/$REPO/tar.gz/refs/heads/$REF" | tar xz --strip-components=1
+  curl -fsSL --connect-timeout 10 --max-time 120 --retry 3 --retry-delay 1 --retry-all-errors \
+    "https://codeload.github.com/$REPO/tar.gz/refs/heads/$REF" | tar xz --strip-components=1
   docker compose up -d --build
 fi
 
-DISPLAY_URL="http://$DOMAIN"
-[ "$NGINX_PORT" != "80" ] && DISPLAY_URL="$DISPLAY_URL:$NGINX_PORT"
-
 info "Primora is starting"
-echo "  Dashboard:  $DISPLAY_URL"
+echo "  Dashboard:  $PUBLIC_URL"
-echo "  Health:     $DISPLAY_URL/api/v1/health/liveness"
+echo "  Health:     $PUBLIC_URL/api/v1/health/liveness"
 echo "  Logs:       cd $DIR && docker compose logs -f"
 echo "  Stop:       cd $DIR && docker compose down"
+if [[ "$PUBLIC_URL" == https://* ]]; then
+  echo
+  echo "  Primora listens on http port $NGINX_PORT — point your TLS proxy there."
+fi

package.json

@@ -1,6 +1,6 @@
 {
   "name": "primora",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "private": true,
   "packageManager": "[email protected]",
   "workspaces": [