Both are substantial, working features, but B's URL/query normalization fix (stripping tracking params, fragments, GitHub repo canonicalization) addresses a real identity-correctness bug affecting item deduplication across the whole ontology, backed by many targeted unit tests plus a new browser test. A's invite system is a solid, self-contained feature with server/CLI/test coverage, but it introduces a second parallel event scheme (durable InviteMinted/InviteRedeemed events defined but unused, actual state kept only in RAM) which is architecturally messier and leaves dead/duplicate code paths.
constitution · epochs · watch · epoch 3
comparison
c_55f1cdf12e22 (tommy-mor) vs c_b21d271b1b82 (tommy-mor)
download prompt · raw event · cmp_b570023d77bff6
council reasoning
A delivers a complete, end-to-end invite product (mint RPC, /join auth redemption into durable GrantAdded, RoomAudit, multi-cap grants, CLI, timeline system rows, and a focused invites integration test). B’s URL identity tightening and GitHub on-demand resolver are valuable foundations, but a large fraction of its diff is formatting/churn plus one domain-specific importer, so it contributes less immediate lasting product surface than A’s access-control path.
Side A adds substantial new project capabilities: an end-to-end invite system (minting, redemption through OAuth, room audit RPCs, CLI support, state management, routing, and integration tests), plus thread timeline support with system events. Side B improves URL normalization and introduces an extensible GitHub external resolver with UI integration, but a significant portion is refactoring/formatting and incremental UI work, whereas Side A delivers a broader core access-control feature with concrete server, client, API, and test coverage.
sides
A — c_55f1cdf12e22 (tommy-mor)
message
[00be3a29] invite system
diff preview
diff --git a/bb.edn b/bb.edn
index 50be8232847e672b3f273a2fb25ddd1d12adb7e2..818f850765370d12d58f239e287764fc3649d78b 100644
--- a/bb.edn
+++ b/bb.edn
@@ -47,14 +47,16 @@
"RUST_LOG" "info"})})))}
test
- {:doc "Full test suite: integration + auth + grants"
+ {:doc "Full test suite: integration + auth + grants + invites"
:requires ([test.integration :as integration]
[test.auth :as auth]
- [test.grants :as grants])
+ [test.grants :as grants]
+ [test.invites :as invites])
:task (do
(integration/integration)
(auth/auth-test)
- (grants/grants-test))}
+ (grants/grants-test)
+ (invites/invites-test))}
perf
{:doc "Performance test: concurrent HTTP requests to detect blocking I/O"
diff --git a/cli/src/main.rs b/cli/src/main.rs
index e5833b0b93d8e667b94c574ba2b0f8cb758ff3df..8eda9f485bd1f7392f1e34be27176c21e20354eb 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -105,6 +105,23 @@ enum ScopedCmd {
#[arg(long)]
json: bool,
},
+
+ /// Mint a shareable invite link (24h TTL, in-memory until redeemed). Requires Manage on the room.
+ InviteLink {
+ /// Comma-separated: view, post, vote, add_item, manage
+ #[arg(long = "caps", value_delimiter = ',')]
+ caps: Vec<String>,
+ #[arg(long, default_value_t = 1)]
+ uses: usize,
+ #[arg(long)]
+ json: bool,
+ },
+
+ /// List principals granted access in this room (requires View or Manage)
+ Audit {
+ #[arg(long)]
+ json: bool,
+ },
}
#[derive(Subcommand, Debug)]
@@ -514,17 +531,35 @@ fn print_thread(resp: &ThreadDetailResponse) {
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_millis() as i64;
- if resp.total > resp.posts.len() {
- let end = resp.offset + resp.posts.len();
- eprintln!("# showing {}-{} of {} posts (--offset N --limit N to paginate)", resp.offset, end.saturating_sub(1), resp.total);
+ if resp.total > resp.items.len() {
+ let end = resp.offset + resp.items.len();
+ eprintln!(
+ "# showing {}-{} of {} rows (--offset N --limit N to paginate)",
+ resp.offset,
+ end.saturating_sub(1),
+ resp.total
+ );
}
- for (i, post) in resp.posts.iter().enumerate() {
- let timeago = slug_types::timeago::timeago_compact(now_ms, post.ts);
- let body = &post.body.trim();
- println!("<post index=\"{}\" timeago=\"{}\">", post.index, timeago);
- println!("{}", body);
- println!("</post>");
- if i + 1 < resp.posts.len() {
+ for (i, item) in resp.items.iter().enumerate() {
+ match item {
+ ThreadItem::Post {
+ index,
+ ts,
+ body,
+ ..
+ } => {
+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);
+ let body = body.trim();
+ println!("<post index=\"{}\" timeago=\"{}\">", index, timeago);
+ println!("{}", body);
+ println!("</post>");
+ }
+ ThreadItem::System { ts, text } => {
+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);
+ println!("<system timeago=\"{}\">{}</system>", timeago, text.trim());
+ }
+ }
+ if i + 1 < resp.items.len() {
println!();
println!();
}
@@ -1036,6 +1071,95 @@ async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {
}
}
},
+ ScopedCmd::InviteLink { caps, uses, json } => {
+ let caps: Vec<String> = caps
+ .into_iter()
+ .flat_map(|s| {
+ s.split(',')
+ .map(|p| p.trim().to_lowercase())
+ .filter(|p| !p.is_empty())
+ .collect::<Vec<_>>()
+ })
+ .collect();
+ if caps.is_empty() {
+ return Err(anyhow!("--caps is required (e.g. --caps view,post,vote)"));
+ }
+ let bearer = effective_bearer().ok_or_else(|| {
+ anyhow!(
+ "no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \
+ then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token"
+ )
+ })?;
+ let batch = send_rpc(
+ &client,
+ base,
+ Some(&bearer),
+ vec![RpcCommand::RoomMintInvite {
+ room: room.to_string(),
+ capabilities: caps,
+ max_uses: uses,
+ }],
+ )
+ .await?;
+ match rpc_line_ok(&batch.results[0])? {
+ RpcResult::RoomInviteMinted {
+ invite_url,
+ expires_at_ms,
+ max_uses,
+ } => {
+ if json {
+ println!(
+ "{}",
+ serde_json::to_string_pretty(&serde_json::json!({
+ "invite_url": invite_url,
+ "expires_at_ms": expires_at_ms,
+ "max_uses": max_uses,
+ }))?
+ );
+ } else {
+ println!("{invite_url}");
+ println!("(Expires in 24 hours. Max uses: {max_uses})");
+ }
+ }
+ _ => return Err(anyhow!("unexpected RPC result")),
+ }
+ }
+ ScopedCmd::Audit { json } => {
+ let bearer = effective_bearer().ok_or_else(|| {
+ anyhow!(
+ "no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \
+ then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token"
+ )
+ })?;
+ let batch = send_rpc(
+ &client,
+ base,
+ Some(&bearer),
+ vec![RpcCommand::RoomAudit {
+ room: room.to_string(),
+ }],
+ )
+ .await?;
+ match rpc_line_ok(&batch.results[0])? {
+ RpcResult::RoomAudit(resp) => {
+ if json {
+ println!("{}", serde_json::to_string_pretty(&resp)?);
+ } else {
+ println!("room {}", resp.room);
+ if resp.grants.is_empty() {
+ println!("(no grants recorded)");
+ } else {
+ let w_user = resp.grants.iter().map(|g| g.username.len()).max().unwrap_or(0);
+ for g in &resp.grants {
+ let caps = g.capabilities.join(", ");
+ println!("{:<width$} {}", g.username, caps, width = w_user.max(8));
+ }
+ }
+ }
+ }
+ _ => return Err(anyhow!("unexpected RPC result")),
+ }
+ }
ScopedCmd::Check { file, json } => {
let mut text = String::new();
match file {
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index 995ce4a61d29b024c399c656134f541ecfd880cf..b45ba39419c84af8bf2333fc9b7d47e98525c45f 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -12,12 +12,61 @@ use tokio::sync::RwLock;
use crate::{
api::helpers::{api_error, now_ms, sha256_hex},
- events::{Event, TokenIssued, UserRegistered},
+ events::{Event, GrantAdded, TokenIssued, UserRegistered},
identity::{parse_agent, parse_username},
html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
state::{AppState, PendingSession},
};
+/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
+const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
+
+async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {
+ let now = now_ms();
+ let ga = {
+ let mut invites = state.invites.write().await;
+ let Some(inv) = invites.get_mut(invite_token) else {
+ return Err("invite not found".into());
+ };
+ if now > inv.expires_at_ms {
+ invites.remove(invite_token);
+ return Err("invite expired".into());
+ }
+ if inv.current_uses >= inv.max_uses {
+ return Err("invite exhausted".into());
+ }
+ inv.current_uses += 1;
+ Event::GrantAdded(GrantAdded {
+ ts: now,
+ room_id: inv.room_id.clone(),
+ username: grantee_username.to_string(),
+ capabilities: inv.capabilities.clone(),
+ granted_by: inv.inviter.clone(),
+ })
+ };
+
+ match state.event_log.append(&ga).await {
+ Ok(()) => {
+ let mut reduced = state.reduced.write().await;
+ reduced.apply_event(ga);
+ let mut invites = state.invites.write().await;
+ if let Some(inv) = invites.get(invite_token) {
+ if inv.current_uses >= inv.max_uses {
+ invites.remove(invite_token);
+ }
+ }
+ Ok(())
+ }
+ Err(e) => {
+ let mut invites = state.invites.write().await;
+ if let Some(inv) = invites.get_mut(invite_token) {
+ inv.current_uses = inv.current_uses.saturating_sub(1);
+ }
+ Err(format!("{e}"))
+ }
+ }
+}
+
fn pending_sessions(state: &AppState) -> Arc<RwLock<HashMap<String, PendingSession>>> {
state.pending_sessions.clone()
}
@@ -115,6 +164,42 @@ pub struct AuthLoginQuery {
pub session: String,
}
+pub async fn get_join_invite(Path(token): Path<String>, State(state): State<AppState>) -> impl IntoResponse {
+ let token = token.trim().to_string();
+ if token.is_empty() {
+ return api_error(StatusCode::NOT_FOUND, "invite invalid or expired", None).into_response();
+ }
+ let now = now_ms();
+ let valid = {
+ let invites = state.invites.read().await;
+ match invites.get(&token) {
+ None => false,
+ Some(inv) => now <= inv.expires_at_ms && inv.current_uses < inv.max_uses,
+ }
+ };
+ if !valid {
+ return api_error(StatusCode::NOT_FOUND, "invite invalid or expired", None).into_response();
+ }
+
+ let session = format!("p_{}", uuid::Uuid::new_v4().simple());
+ let s = PendingSession {
+ agent: INVITE_BROWSER_AGENT.to_string(),
+ created_ts: now_ms(),
+ provider: None,
+ provider_id: None,
+ redeem_invite: Some(token),
+ complete: None,
+ };
+ state.pending_sessions.write().await.insert(session.clone(), s);
+
+ let public_url = std::env::var("SLUG_PUBLIC_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
+ Redirect::temporary(&format!(
+ "{public_url}/auth/login?session={}",
+ urlencoding::encode(&session)
+ ))
+ .into_response()
+}
+
pub async fn get_auth_login(Query(q): Query<AuthLoginQuery>, State(state): State<AppState>) -> impl IntoResponse {
// Redirect to Google auth endpoint.
let sessions = pending_sessions(&state);
@@ -205,6 +290,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
s.provider = Som
… preview truncated; 45,403 characters omittedB — c_b21d271b1b82 (tommy-mor)
message
[06b48801] Implement extensible URL foundation (#145) * Implement extensible URL foundation Co-authored-by: tommy <thmorriss@gmail.com> * Make query params non-identity by default Co-authored-by: tommy <thmorriss@gmail.com> * Fix external href helper test scope Co-authored-by: tommy <thmorriss@gmail.com> * Avoid broken external previews for blocked hosts Co-authored-by: tommy <thmorriss@gmail.com> * Clarify external empty state copy Co-authored-by: tommy <thmorriss@gmail.com> * Add on-demand GitHub external resolver Co-authored-by: tommy <thmorriss@gmail.com> * Add fenced JSON bodies for GitHub resolver Co-authored-by: tommy <thmorriss@gmail.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
diff preview
diff --git a/agents.md b/agents.md
index 59bd2174f4d2f972a45123fe10d408aa5881ee93..c66f33789441eea193b4354fce4c03b7fffdd639 100644
--- a/agents.md
+++ b/agents.md
@@ -55,6 +55,7 @@ Strict **CSP** that blocks `eval` would break the current app. Other projects ma
| Ingests, grants, rooms, identity tokens, agent binds, redactions, etc. | **JSONL** | Appended in `server/src/api/rpc.rs`, `server/src/api/auth.rs` (and related paths) before updating `ReducerState` |
| **`RoomMintInvite` links** | **RAM only** | `AppState.invites` — not appended as `InviteMinted` today; **lost on restart** (`server/src/state.rs`, `server/src/api/rpc.rs`). Event types `InviteMinted` / `InviteRedeemed` exist for replay and a possible future persisted mint (`server/src/reducer.rs`). |
| **OAuth / pending sessions** | **RAM only** | `AppState.pending_sessions` (`server/src/state.rs`, `server/src/api/auth.rs`) |
+| **External resolver cooldowns** | **RAM only** | `AppState.resolver_runs` — debounce/rate-limit guard for on-demand resolver buttons. Resolver results themselves are durable synthetic `Ingest` events in `events.jsonl`. |
| **Reducer projection** | **Derived** | Rebuilt from log on startup; not separately persisted |
If you add a new ephemeral map or start persisting something that was RAM-only, **update this table and the code comments** (`server/src/state.rs` is a good anchor).
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
index 7cbda3876451687aa7a55547fc06bbe86ac9d260..cd501ba6d4d656eabad03afed4583efdf885695d 100644
--- a/server/src/api/ui_html.rs
+++ b/server/src/api/ui_html.rs
@@ -18,14 +18,15 @@ use crate::{
rpc::{rpc_post_redact, rpc_post_with_bearer, rpc_room_delete},
},
canonical_path::canonicalize_tag,
+ external_resolver::resolve_github_children,
+ html::vote_compare_post_success_js,
html::{
- fragment_new_thread_slot, login_to_post_hint_markup,
- parse_html_ui_from_form, room_members_section_markup, thread_feed_html,
- thread_feed_html_for_room, thread_feed_region_markup, thread_ui_collapse_redacted_post,
- thread_ui_expand_post_full, thread_ui_expand_redacted_post, ui_js_warn, user_can_post_room,
- user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav,
+ fragment_new_thread_slot, login_to_post_hint_markup, parse_html_ui_from_form,
+ room_members_section_markup, thread_feed_html, thread_feed_html_for_room,
+ thread_feed_region_markup, thread_ui_collapse_redacted_post, thread_ui_expand_post_full,
+ thread_ui_expand_redacted_post, ui_js_warn, user_can_post_room, user_can_view_room,
+ HtmlUiAction, JsBuilder, ThreadNav,
},
- html::vote_compare_post_success_js,
reducer::{scope_from_room_wire, ScopeId},
state::AppState,
};
@@ -104,26 +105,35 @@ async fn dispatch_ui_action(
)
.into_response();
}
- match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await {
- Ok(RpcResult::PostOk { .. }) => {
- post_success_response(
- state,
- &room,
- &thread_tag,
- error_target.as_ref(),
- form_id.as_ref(),
- Some(session.username.as_str()),
- )
- .await
- .into_response()
- }
+ match rpc_post_with_bearer(
+ state,
+ &session.bearer,
+ room.clone(),
+ thread_tag.clone(),
+ text,
+ )
+ .await
+ {
+ Ok(RpcResult::PostOk { .. }) => post_success_response(
+ state,
+ &room,
+ &thread_tag,
+ error_target.as_ref(),
+ form_id.as_ref(),
+ Some(session.username.as_str()),
+ )
+ .await
+ .into_response(),
Ok(_) => form_js_error(
error_target.as_ref(),
"unexpected response",
"Post did not return PostOk.",
)
.into_response(),
- Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(),
+ Err((msg, hint)) => {
+ form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or(""))
+ .into_response()
+ }
}
}
HtmlUiAction::CheckIngest {
@@ -150,9 +160,19 @@ async fn dispatch_ui_action(
return js_clear_errors(&form_error_target(error_target.as_ref())).into_response();
}
match rpc_check_with_bearer(state, &session.bearer, room, text.clone()).await {
- Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(error_target.as_ref())).into_response(),
- Ok(_) => form_js_error(error_target.as_ref(), "unexpected response", "Check did not return CheckOk.").into_response(),
- Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(),
+ Ok(RpcResult::CheckOk { .. }) => {
+ js_clear_errors(&form_error_target(error_target.as_ref())).into_response()
+ }
+ Ok(_) => form_js_error(
+ error_target.as_ref(),
+ "unexpected response",
+ "Check did not return CheckOk.",
+ )
+ .into_response(),
+ Err((msg, hint)) => {
+ form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or(""))
+ .into_response()
+ }
}
}
HtmlUiAction::VoteComparePost {
@@ -167,7 +187,11 @@ async fn dispatch_ui_action(
form_action,
} => {
if form_action != "/ui" {
- return (StatusCode::BAD_REQUEST, "invalid vote_compare_post form_action").into_response();
+ return (
+ StatusCode::BAD_REQUEST,
+ "invalid vote_compare_post form_action",
+ )
+ .into_response();
}
let Some(session) = session else {
return js_redirect("/login").into_response();
@@ -195,23 +219,15 @@ async fn dispatch_ui_action(
let left_id = match crate::path_types::ItemId::parse(left_item.trim()) {
Some(i) => i.normalized_storage(),
None => {
- return form_js_error(
- err_tgt.as_ref(),
- "bad item",
- "Invalid left item path.",
- )
- .into_response();
+ return form_js_error(err_tgt.as_ref(), "bad item", "Invalid left item path.")
+ .into_response();
}
};
let right_id = match crate::path_types::ItemId::parse(right_item.trim()) {
Some(i) => i.normalized_storage(),
None => {
- return form_js_error(
- err_tgt.as_ref(),
- "bad item",
- "Invalid right item path.",
- )
- .into_response();
+ return form_js_error(err_tgt.as_ref(), "bad item", "Invalid right item path.")
+ .into_response();
}
};
let mut rl = ratio_left.trim().parse::<i32>().unwrap_or(0).max(0);
@@ -231,7 +247,15 @@ async fn dispatch_ui_action(
right_id.as_str()
);
- match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await {
+ match rpc_post_with_bearer(
+ state,
+ &session.bearer,
+ room.clone(),
+ thread_tag.clone(),
+ text,
+ )
+ .await
+ {
Ok(RpcResult::PostOk {
post_id,
post_index,
@@ -277,7 +301,10 @@ async fn dispatch_ui_action(
"Post did not return PostOk.",
)
.into_response(),
- Err((msg, hint)) => form_js_error(err_tgt.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(),
+ Err((msg, hint)) => {
+ form_js_error(err_tgt.as_ref(), &msg, hint.as_deref().unwrap_or(""))
+ .into_response()
+ }
}
}
HtmlUiAction::SetGardenPin {
@@ -288,7 +315,11 @@ async fn dispatch_ui_action(
form_action,
} => {
if form_action != "/ui" {
- return (StatusCode::BAD_REQUEST, "invalid set_garden_pin form_action").into_response();
+ return (
+ StatusCode::BAD_REQUEST,
+ "invalid set_garden_pin form_action",
+ )
+ .into_response();
}
let next_path = sanitize_garden_pin_next(&next);
use crate::html::{encode_pin_cookie_value, GARDEN_PIN_COOKIE};
@@ -301,7 +332,11 @@ async fn dispatch_ui_action(
if room.is_empty() {
return (StatusCode::BAD_REQUEST, "missing room").into_response();
}
- let Some(raw) = item_storage.as_ref().map(|s| s.trim().to_string()).filter(|s| !s.is_empty()) else {
+ let Some(raw) = item_storage
+ .as_ref()
+ .map(|s| s.trim().to_string())
+ .filter(|s| !s.is_empty())
+ else {
return (StatusCode::BAD_REQUEST, "missing item").into_response();
};
let Some(item) = ItemId::parse(&raw) else {
@@ -309,16 +344,65 @@ async fn dispatch_ui_action(
};
let item = item.normalized_storage();
let val = encode_pin_cookie_value(&room, item.as_str());
- let cookie = format!("{GARDEN_PIN_COOKIE}={val}; Path=/; SameSite=Lax; Max-Age=7776000");
+ let cookie =
+ format!("{GARDEN_PIN_COOKIE}={val}; Path=/; SameSite=Lax; Max-Age=7776000");
redirect_with_pin_cookie(&cookie, &next_path)
}
+ HtmlUiAction::ResolveExternal {
+ room_wire,
+ item_storage,
+ mode,
+ next,
+ form_action,
+ } => {
+ if form_action != "/ui" {
+ return (
+ StatusCode::BAD_REQUEST,
+ "invalid resolve_external form_action",
+ )
+ .into_response();
+ }
+ let Some(session) = session else {
+ return js_redirect("/login").into_response();
+ };
+ let room = room_wire.trim();
+ if room.is_empty() {
+ return ui_js_warn("missing room").into_response();
+ }
+ let reduced = state.reduced.read().await;
+ if matches!(scope_from_room_wire(room), ScopeId::Room(_)) {
+ if !user_can_post_room(&reduced, room, &session.username) {
+ drop(reduced);
+ return ui_js_warn("forbidden").into_response();
+ }
+ }
+ drop(reduced);
+
+ let Some(item) = crate::path_types::ItemId::parse(item_storage.trim()) else {
+ return ui_js_warn("bad item").into_response();
+ };
+ let target = if mode.trim() == "siblings" {
+ m
… preview truncated; 74,788 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.