14 Commits

Author SHA1 Message Date
rw
9d4244891e fix(ci,deps): correct action versions and patch security vulnerabilities
GitHub Actions:
- checkout@v4 → @v6 (v6 is current, v4 was wrong downgrade)
- upload-artifact@v4 → @v7 (latest), @v6 → @v7 in dbal-tests.yml
- download-artifact@v4 → @v8 (latest)
- cache@v6 → @v5 (v6 does not exist, v5 is latest)
- codeql-action@v4 confirmed correct

Security (Dependabot):
- next 16.1.5 → 16.1.7 (dockerterminal): HTTP smuggling, CSRF, DoS fixes
- PyJWT 2.10.1 → 2.12.0 (5 requirements.txt): unknown crit header bypass
- CairoSVG 2.8.2 → 2.9.0 (pcbgenerator): recursive <use> ReDoS
- postgres overrides: add hono >=4.12.4, @hono/node-server >=1.19.10,
  rollup >=4.59.0, serialize-javascript >=7.0.3 for transitive vulns

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-20 20:13:54 +00:00
0e43551195 fix(pastebin): prevent page scroll on Run, improve snippet card contrast
Terminal scrollIntoView was scrolling the entire page instead of just
the terminal panel. Replaced with container.scrollTop for scoped scroll.

Snippet cards in dark mode were invisible (surface-container-low ≈
background). Added border, background, and shadow to differentiate them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 10:02:46 +00:00
b3962d742e fix: regenerate favicon.ico files with proper rounded rect + white letter
Previous ICOs were just solid color squares. Now rendered with Pillow
using Arial Bold, rounded corners, and centered white text matching
the SVG designs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 22:27:17 +00:00
0d7c2da91b feat: add favicons (SVG + ICO) to all 10 frontends missing them
Portal (M), Pastebin (P), WorkflowUI (W), Exploded Diagrams (3D),
Email Client (E), DBAL (DB), Frontend App (A), RepoForge (RF),
CaproverForge (CF), PackageRepo (PR) — each with matching brand color.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 22:23:14 +00:00
9df6e1c64f fix: upgrade all Dockerfiles to node:24-alpine, fix portal build errors
- Update all 12 Dockerfiles from node:18/20/22 to node:24-alpine
- Fix caproverforge portal: remove event handlers from Server Component
- Fix repoforge/caproverforge portals: ensure public/ dir exists in builder
- Fix packagerepo Dockerfile: node:18 → node:24 (Next.js 16 requires >=20)
- Fix DBAL frontend port conflict: 3009 → 3015 (3009 in use by external container)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:43:28 +00:00
323086471d fix(pastebin): persist bio via Flask backend and load on settings page
Bio updates were sent directly to DBAL which returned 403 (user JWT lacks
admin privileges). Moved profile read/write through new Flask endpoints
(GET/PUT /api/profile) that use the DBAL admin token server-side.

Also fixed ProfileSettingsCard to fetch and populate the existing bio on
mount instead of always starting with an empty string.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:09:42 +00:00
196d818f1b fix(pastebin): wrap profile page with PageLayout and add breadcrumbs
The profile page was rendering without the shared PageLayout, so it was
missing the header (burger menu, logo, theme switcher, avatar) and footer.
Added PageLayout wrapper and a breadcrumb nav bar with back button.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 20:59:29 +00:00
8c454abf74 fix(pastebin): unwrap DBAL envelope in /api/auth/me so username is returned
The /api/auth/me endpoint read `username` from the top-level DBAL response,
but DBAL wraps records in {data: {...}, success: bool}. This caused the
avatar to show a blank circle and the profile menu to display "@" with no
username. Now correctly reads from `body.data.username`.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 20:39:52 +00:00
1c020824f1 fix(pastebin): replace python3 file writer with POSIX shell for all runners
The code runner used `python3 -c` to decode FILES_PAYLOAD inside every
container, but 6+ runner images (node, golang, bash, ruby, php, perl)
don't ship python3 — so JS/Go/Bash/Ruby/PHP/Perl snippets all failed.

Replaced with a pure POSIX `base64 -d | awk` pipeline that works on
every image. Also fixes:
- pids_limit 64→256 (Go compiler crashed spawning threads)
- Per-user configurable runTimeout via settings panel (5–300s)
- Default run timeout 10→30s, server-side cap at 300s
- Frontend AbortSignal raised to 310s to match max timeout

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 20:34:52 +00:00
ede777ca95 feat(pastebin): add data-testid and ARIA attributes to login page
Add 18 data-testid selectors and improved ARIA attributes across sign-in,
register, and forgot-password forms for Playwright e2e testing and accessibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 18:49:34 +00:00
33e669cb1c fix(deployment): resolve pip ResolutionImpossible in base-pip-deps build
Align PyJWT (2.8.0→2.10.1) and requests (2.32.5→2.32.4) in pastebin
backend to match all other services. Replace futile retry loop with a
merge-and-deduplicate strategy that gives pip a single consistent set
of constraints.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-16 01:28:56 +00:00
676e5a4cc6 feat: restore pyodide assets; unignore in fat repo
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-09 23:00:03 +00:00
75b67f8683 sync: align fat repo structure with metabuilder-small
Remove stale dirs/files superseded by metabuilder-small's reorganization:
- Old YAML entity/seed files (migrated to JSON)
- Root-level workflowui/ (moved to frontends/workflowui/)
- Prisma, Pyodide, old hooks, bun.lock artifacts
- Legacy scratch docs (txt/, docs/, deployment/*.md)
- Stale CI workflows consolidated in small

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-09 22:46:13 +00:00
862cc29457 various changes 2026-03-09 22:30:41 +00:00