hezo/server/ at main · burrito.space/hezo · Tangled

burrito.space / hezo

0

group conversations with models and local files

0

hezo / server /

at main 1 folder 8 files

dietrich ayala feat: add known collaborators to a project directly (skip invite-code loop) 7w ago

feat: account-level bot-following + navigable browser history Bot-following — configure a bot once and it auto-joins every project you open (current and future, including invited ones), regardless of where you added it: - New per-device recipe store (src/lib/userbots.ts) synced to the server as a wrapped blob (wrapped_user_bots column, /api/me/bots), mirroring the existing provider-key sync. Recipes carry no secrets; the @pinger still spends their own provider key. - Propagation on project open: seed each recipe into the project CRDT with bot id = recipe id so it converges across devices and re-opens; per-device seed tracking so a manual removal sticks. - Startup harvest reads every project's locally-persisted (plaintext) Automerge doc and pulls the user's own bots up into the library, so the set is complete no matter which project is opened first. Sidebar "Add bot" also registers the bot in the library. - New IDB stores + DB v5; migration v8 adds the server column. - "My bots" manager in Settings. Navigation — fix the back button: - Opening a project now pushState's a history entry (was replaceState, so back had nothing to return to). In-app "back to Projects" delegates to history.back(); popstate resolves #p=<id> via an App-held project list so forward/back into a project works while the list is unmounted. History normalized on mount so deep-link/reload into a project still has the list beneath it.

1 month ago

feat: add known collaborators to a project directly (skip invite-code loop) Owners can add people they already co-member projects with to a new project without running the full invite-code exchange. Uses each account's existing X25519 identity_pub: the owner seals the project key to the collaborator's pubkey via an ephemeral-static ECDH sealed box, so the add is fully offline — no fresh handshake, no second party online, no schema change. The collaborator unwraps from their account master on next login. - crypto: peerWrap/peerUnwrapProjectKey + unwrapMyProjectKey (PRF self-unwrap with peer-wrap fallback so all call sites handle both formats) - server: listKnownCollaborators / addMemberDirect / getIdentityPub; GET /api/me/collaborators, POST /api/projects/:id/members (owner-only, gated on actual shared membership) - client: inline collaborator picker on owner project rows - name cache: client-only IndexedDB store (nameCache, DB v6->7) harvested from per-project CRDT profiles so the picker shows friendly names instead of sliced user-ids; no server-side name store

1 month ago

Store email as a blind HMAC index instead of plaintext The server now keeps `email_hash` (HMAC-SHA256 of the lowercased typed email under a deployment-wide secret) and never persists plaintext email. Lookup flow is unchanged for the user: type your email at login, server HMACs it in-memory and queries by hash. - new server/secret.ts: deployment HMAC key from HEZO_EMAIL_HMAC_KEY env var, else generated and persisted to `<HEZO_DATA>/email_hmac.key` on first boot - new server/paths.ts: extracts DATA_DIR so secret.ts and schemas/index.ts can both reach it without cycling through db.ts - migration framework: optional `apply(db)` JS step on a Migration, plus a `useTransaction: false` opt-out for migrations that need to toggle PRAGMA foreign_keys - migration v5: rebuild users + webauthn_challenges via the standard CREATE…/INSERT…/DROP…/RENAME dance (SQLite can't DROP a UNIQUE column directly); existing emails get HMAC'd in place; runs foreign_key_check at the end - server/auth.ts: every email-shaped lookup, insert, and challenge row uses email_hash; Identity returned to the client carries only userId (no email) - server/projects.ts: members API drops email too; clients don't need it now that display names live in the CRDT - shared schema: Identity.email becomes optional (client-only, filled from localStorage); Member loses email entirely - src/lib/auth.ts: after passkey/passphrase login the typed email is stashed in localStorage and merged back onto the Identity client-side; logout clears - App.tsx: displayNameFor + ensureOwnDisplayName tolerate a missing identity.email (fall back to short userId) - README + DEPLOY: document the HMAC key and the "back this file up or orphan every account" caveat

1 month ago

feat: add known collaborators to a project directly (skip invite-code loop) Owners can add people they already co-member projects with to a new project without running the full invite-code exchange. Uses each account's existing X25519 identity_pub: the owner seals the project key to the collaborator's pubkey via an ephemeral-static ECDH sealed box, so the add is fully offline — no fresh handshake, no second party online, no schema change. The collaborator unwraps from their account master on next login. - crypto: peerWrap/peerUnwrapProjectKey + unwrapMyProjectKey (PRF self-unwrap with peer-wrap fallback so all call sites handle both formats) - server: listKnownCollaborators / addMemberDirect / getIdentityPub; GET /api/me/collaborators, POST /api/projects/:id/members (owner-only, gated on actual shared membership) - client: inline collaborator picker on owner project rows - name cache: client-only IndexedDB store (nameCache, DB v6->7) harvested from per-project CRDT profiles so the picker shows friendly names instead of sliced user-ids; no server-side name store

1 month ago

Outbox: client watermarks instead of server-side ack-delete Each device now persists a per-project watermark (highest createdAt seen) and passes it on subscribe; server returns rows past that and no longer deletes on ack. Outbox rows TTL out at 30d as before. Fixes the multi-device race where two devices for the same user shared a queue: whichever acked first deleted the row from under the other. iOS in particular kept getting an empty project after desktop's snapshot had already been ack-consumed by desktop itself. Reset-local now also wipes the cursor so the next subscribe starts from zero.

1 month ago

Store email as a blind HMAC index instead of plaintext The server now keeps `email_hash` (HMAC-SHA256 of the lowercased typed email under a deployment-wide secret) and never persists plaintext email. Lookup flow is unchanged for the user: type your email at login, server HMACs it in-memory and queries by hash. - new server/secret.ts: deployment HMAC key from HEZO_EMAIL_HMAC_KEY env var, else generated and persisted to `<HEZO_DATA>/email_hmac.key` on first boot - new server/paths.ts: extracts DATA_DIR so secret.ts and schemas/index.ts can both reach it without cycling through db.ts - migration framework: optional `apply(db)` JS step on a Migration, plus a `useTransaction: false` opt-out for migrations that need to toggle PRAGMA foreign_keys - migration v5: rebuild users + webauthn_challenges via the standard CREATE…/INSERT…/DROP…/RENAME dance (SQLite can't DROP a UNIQUE column directly); existing emails get HMAC'd in place; runs foreign_key_check at the end - server/auth.ts: every email-shaped lookup, insert, and challenge row uses email_hash; Identity returned to the client carries only userId (no email) - server/projects.ts: members API drops email too; clients don't need it now that display names live in the CRDT - shared schema: Identity.email becomes optional (client-only, filled from localStorage); Member loses email entirely - src/lib/auth.ts: after passkey/passphrase login the typed email is stashed in localStorage and merged back onto the Identity client-side; logout clears - App.tsx: displayNameFor + ensureOwnDisplayName tolerate a missing identity.email (fall back to short userId) - README + DEPLOY: document the HMAC key and the "back this file up or orphan every account" caveat

1 month ago

feat: add known collaborators to a project directly (skip invite-code loop) Owners can add people they already co-member projects with to a new project without running the full invite-code exchange. Uses each account's existing X25519 identity_pub: the owner seals the project key to the collaborator's pubkey via an ephemeral-static ECDH sealed box, so the add is fully offline — no fresh handshake, no second party online, no schema change. The collaborator unwraps from their account master on next login. - crypto: peerWrap/peerUnwrapProjectKey + unwrapMyProjectKey (PRF self-unwrap with peer-wrap fallback so all call sites handle both formats) - server: listKnownCollaborators / addMemberDirect / getIdentityPub; GET /api/me/collaborators, POST /api/projects/:id/members (owner-only, gated on actual shared membership) - client: inline collaborator picker on owner project rows - name cache: client-only IndexedDB store (nameCache, DB v6->7) harvested from per-project CRDT profiles so the picker shows friendly names instead of sliced user-ids; no server-side name store

1 month ago

Store email as a blind HMAC index instead of plaintext The server now keeps `email_hash` (HMAC-SHA256 of the lowercased typed email under a deployment-wide secret) and never persists plaintext email. Lookup flow is unchanged for the user: type your email at login, server HMACs it in-memory and queries by hash. - new server/secret.ts: deployment HMAC key from HEZO_EMAIL_HMAC_KEY env var, else generated and persisted to `<HEZO_DATA>/email_hmac.key` on first boot - new server/paths.ts: extracts DATA_DIR so secret.ts and schemas/index.ts can both reach it without cycling through db.ts - migration framework: optional `apply(db)` JS step on a Migration, plus a `useTransaction: false` opt-out for migrations that need to toggle PRAGMA foreign_keys - migration v5: rebuild users + webauthn_challenges via the standard CREATE…/INSERT…/DROP…/RENAME dance (SQLite can't DROP a UNIQUE column directly); existing emails get HMAC'd in place; runs foreign_key_check at the end - server/auth.ts: every email-shaped lookup, insert, and challenge row uses email_hash; Identity returned to the client carries only userId (no email) - server/projects.ts: members API drops email too; clients don't need it now that display names live in the CRDT - shared schema: Identity.email becomes optional (client-only, filled from localStorage); Member loses email entirely - src/lib/auth.ts: after passkey/passphrase login the typed email is stashed in localStorage and merged back onto the Identity client-side; logout clears - App.tsx: displayNameFor + ensureOwnDisplayName tolerate a missing identity.email (fall back to short userId) - README + DEPLOY: document the HMAC key and the "back this file up or orphan every account" caveat

1 month ago

Outbox: client watermarks instead of server-side ack-delete Each device now persists a per-project watermark (highest createdAt seen) and passes it on subscribe; server returns rows past that and no longer deletes on ack. Outbox rows TTL out at 30d as before. Fixes the multi-device race where two devices for the same user shared a queue: whichever acked first deleted the row from under the other. iOS in particular kept getting an empty project after desktop's snapshot had already been ack-consumed by desktop itself. Reset-local now also wipes the cursor so the next subscribe starts from zero.

1 month ago