diff --git a/.claude/commands/seed-demo.md b/.claude/commands/seed-demo.md index 18145b7..ccca3ce 100644 --- a/.claude/commands/seed-demo.md +++ b/.claude/commands/seed-demo.md @@ -8,6 +8,6 @@ Run the demo seeding script to populate today with one tagged sample artifact pe python scripts/seed_demo_artifacts.py ``` -Requires the AgentFeed dev server to be running on the project's fixed local port: `python manage.py runserver 127.0.0.1:8001`. The script defaults to `AGENTFEED_URL=http://127.0.0.1:8001` / `AGENTFEED_TOKEN=dev-token`; no overrides needed unless the user has changed these. +Requires the Daybook dev server to be running on the project's fixed local port: `python manage.py runserver 127.0.0.1:8001`. The script defaults to `DAYBOOK_URL=http://127.0.0.1:8001` / `DAYBOOK_TOKEN=dev-token`; no overrides needed unless the user has changed these. After running, report each posted artifact's kind and URL, and remind the user to reload the feed for today. diff --git a/CHANGELOG.md b/CHANGELOG.md index 8acf954..801f2a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,32 +1,13 @@ # Changelog -All notable changes to AgentFeed are recorded here. Format loosely follows +All notable changes to Daybook are recorded here. Format loosely follows [Keep a Changelog](https://keepachangelog.com/); versions are SemVer and match -the git tags (`vX.Y.Z`) and `__version__`. (Entries before 0.3.0 use the app's -former name, "Daybook".) +the git tags (`vX.Y.Z`) and `daybook_project.__version__`. ## [Unreleased] _Nothing yet._ -## [0.3.0] — 2026-09-04 - -### Changed -- **Renamed the app to AgentFeed.** The former name "Daybook" is removed - from everything user- and agent-facing: the UI brand, docs/README, the - posting skill (`agentfeed-posting` / `agentfeed_post.py`), CSS - (`agentfeed.css`), localStorage keys, and the ingest **environment - variables** — `DAYBOOK_URL/TOKEN/SOURCE/DATA_DIR/...` are now - `AGENTFEED_*`. Agents must update their env-var names (the token *values* - are unchanged). The Django package `daybook_project`, the `/opt/…` install - path, and the git repo keep their names for now (a later, separate step). -- Key-provisioning API (`POST /api/keys`) is now **disabled by default**, - independent of `DEBUG`; enable it explicitly with - `AGENTFEED_KEY_PROVISIONING_API=1` on a test install only. - -### Fixed -- Posting helper now points at Settings → API Keys (was Settings → Account). - ## [0.2.1] — 2026-09-04 ### Added @@ -117,8 +98,7 @@ First tagged release. - Dockerised (Gunicorn + whitenoise), SQLite, `git`-based deploy with a runbook (`deploy/cloud_agent_deploy.md`) and health check. -[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.3.0...HEAD -[0.3.0]: https://git.cygnus.systems/peter/daybook/compare/v0.2.1...v0.3.0 +[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.2.1...HEAD [0.2.1]: https://git.cygnus.systems/peter/daybook/compare/v0.2.0...v0.2.1 [0.2.0]: https://git.cygnus.systems/peter/daybook/compare/v0.1.1...v0.2.0 [0.1.1]: https://git.cygnus.systems/peter/daybook/compare/v0.1.0...v0.1.1 diff --git a/CLAUDE.md b/CLAUDE.md index c0fa33e..f612d1d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -2,7 +2,7 @@ ## Project -AgentFeed is a self-hosted, multi-user Django + Django REST Framework web app where AI agents, scripts, or people publish artifacts and each logged-in user browses their own time-ordered, label-filterable feed. +Daybook is a self-hosted, multi-user Django + Django REST Framework web app where AI agents, scripts, or people publish artifacts and each logged-in user browses their own time-ordered, label-filterable feed. The core product principle is: agents publish content, not files. The server owns IDs, styling, storage layout, dates, and normalization into browser-native HTML, image, or PDF outputs. @@ -44,7 +44,7 @@ The core product principle is: agents publish content, not files. The server own - Use the local Django commands for normal iteration: `python manage.py check`, `python manage.py migrate`, and `python manage.py runserver`. - Run the local development server on `127.0.0.1:8001`. Port `8000` may be reserved or blocked on this workstation. - Always use this same fixed port for the dev server. Never start a second instance on a different port; if `8001` is already serving, reuse it rather than starting another. -- All artifact-posting tools (`skills/agentfeed-posting/scripts/agentfeed_post.py`, `scripts/seed_demo_artifacts.py`, and any future posting skill) must default `AGENTFEED_URL` to `http://127.0.0.1:8001` to match. +- All artifact-posting tools (`skills/daybook-posting/scripts/daybook_post.py`, `scripts/seed_demo_artifacts.py`, and any future posting skill) must default `DAYBOOK_URL` to `http://127.0.0.1:8001` to match. - A regular (non-superuser) user `test` / password `testpwd` must always exist in the local dev database — it's the permanent account a sibling project (`AGENT_DAYBOOK__LLM_TEST`) uses for API testing. If the local `db.sqlite3` is ever reset, recreate this exact user (e.g. via Settings → Users) before assuming that project is broken. - Do not deploy to the Proxmox NUC during routine code iteration. - Treat the NUC container as the local live/staging target. Deploy there only at explicit stable checkpoints, such as an end-of-day build. diff --git a/README.md b/README.md deleted file mode 100644 index a2bacf2..0000000 --- a/README.md +++ /dev/null @@ -1,56 +0,0 @@ -# AgentFeed - -AgentFeed is a self-hosted, multi-user **artifact journal**. AI agents, scripts, -or people publish finished outputs — reports, HTML, images, PDFs, decks, JSON, -CSV — and each logged-in user browses their own time-ordered, label-filterable -feed. The core principle: **agents publish content, not files.** The server -owns IDs, styling, storage layout, dates, and normalization into browser-native -HTML / image / PDF output. - -Built with Django + Django REST Framework, SQLite, and WhiteNoise; deployed as -a single Docker container. - -## Quick start (local development) - -```bash -python -m venv .venv -.venv/Scripts/python -m pip install -r requirements.txt # Windows; use .venv/bin on POSIX -python manage.py migrate -python manage.py createsuperuser -python manage.py runserver 127.0.0.1:8001 -``` - -Then open and log in. - -- **Post as an agent:** create a key under **Settings → API Keys**, then use - it as `Authorization: Bearer `. Each user can hold several keys (one - per agent), each revocable on its own. -- **Health check / contract:** `GET /api/capabilities`. -- **Ready-to-use posting instructions for an AI:** `GET /api/skill` returns the - bundled posting skill with this instance's URL pre-filled. - -## Documentation - -| Doc | For | -|---|---| -| [`docs/agent_quickstart.md`](docs/agent_quickstart.md) | Shortest path to posting from an agent | -| [`docs/api.md`](docs/api.md) | Full REST API reference (kinds, endpoints, keys, sharing) | -| [`docs/llm_posting_helper.md`](docs/llm_posting_helper.md) | Using the bundled `agentfeed_post.py` helper | -| [`docs/deployment.md`](docs/deployment.md) | Docker deployment, reverse proxy, `/admin/`, backup | -| [`skills/agentfeed-posting/SKILL.md`](skills/agentfeed-posting/SKILL.md) | The agent-posting skill (also served at `/api/skill`) | -| [`CHANGELOG.md`](CHANGELOG.md) | Release history | - -## Admin - -- **Settings** (in-app, themed) is the everyday surface: account, API keys, - storage, and — for superusers — user management. -- **Django admin** at `/admin/` is an operator break-glass tool for raw-data - fixes. It requires `is_staff` (the `createsuperuser` account has it). See - [`docs/deployment.md`](docs/deployment.md#django-admin-admin) for the - `is_superuser` vs `is_staff` distinction and cautions. - -## Version - -The version is defined once in `daybook_project/__init__.py`, shown on -**Settings → About**, and reported by `GET /api/capabilities`. Releases are -git-tagged `vX.Y.Z`. diff --git a/artifacts/exception_handlers.py b/artifacts/exception_handlers.py index 205752b..fa09eba 100644 --- a/artifacts/exception_handlers.py +++ b/artifacts/exception_handlers.py @@ -2,7 +2,7 @@ from rest_framework.response import Response from rest_framework.views import exception_handler -def agentfeed_exception_handler(exc, context): +def daybook_exception_handler(exc, context): """DRF exception handler that additionally maps pathological-input crashes to a clean 400 instead of an unhandled 500. diff --git a/artifacts/forms.py b/artifacts/forms.py index 52f2d29..44f8e98 100644 --- a/artifacts/forms.py +++ b/artifacts/forms.py @@ -2,5 +2,5 @@ from django import forms from django.contrib.auth.forms import AuthenticationForm -class AgentFeedLoginForm(AuthenticationForm): +class DaybookLoginForm(AuthenticationForm): remember_me = forms.BooleanField(required=False, initial=True) diff --git a/artifacts/models.py b/artifacts/models.py index bbd14a8..e77f143 100644 --- a/artifacts/models.py +++ b/artifacts/models.py @@ -5,7 +5,7 @@ from django.db import models def generate_api_key(): - """`dbk_` prefix (recognizable as a AgentFeed key) + 40 hex chars.""" + """`dbk_` prefix (recognizable as a Daybook key) + 40 hex chars.""" return "dbk_" + secrets.token_hex(20) diff --git a/artifacts/templatetags/agentfeed_extras.py b/artifacts/templatetags/daybook_extras.py similarity index 100% rename from artifacts/templatetags/agentfeed_extras.py rename to artifacts/templatetags/daybook_extras.py diff --git a/artifacts/views.py b/artifacts/views.py index d1978ed..aa3bfd0 100644 --- a/artifacts/views.py +++ b/artifacts/views.py @@ -34,7 +34,7 @@ from rest_framework.response import Response from rest_framework.views import APIView from .demo_data import create_demo_artifacts -from .forms import AgentFeedLoginForm +from .forms import DaybookLoginForm from .models import ApiKey, Artifact, Asset, TagColor from .storage import ( QuotaExceeded, @@ -66,7 +66,7 @@ REMEMBER_ME_SESSION_AGE = 60 * 60 * 24 * 30 # 30 days MAX_ASSET_BYTES = 50 * 1024 * 1024 # 50 MB per uploaded image -# Matches the asset id in a AgentFeed asset URL, e.g. /assets/ab12cd34ef56 +# Matches the asset id in a Daybook asset URL, e.g. /assets/ab12cd34ef56 ASSET_URL_RE = re.compile(r"/assets/([0-9a-f]{12})") @@ -315,7 +315,7 @@ class CapabilitiesView(APIView): "/api/capabilities": ["GET"], "/api/skill": ["GET"], } - if settings.AGENTFEED_KEY_PROVISIONING_API: + if settings.DAYBOOK_KEY_PROVISIONING_API: methods["/api/keys"] = ["GET", "POST"] methods["/api/keys/{id}"] = ["DELETE"] @@ -330,30 +330,30 @@ class CapabilitiesView(APIView): "auth": "bearer_token", "methods": methods, "skill_url": request.build_absolute_uri(reverse("skill-api")), - "key_provisioning_api": settings.AGENTFEED_KEY_PROVISIONING_API, + "key_provisioning_api": settings.DAYBOOK_KEY_PROVISIONING_API, } ) -SKILL_MD_PATH = settings.BASE_DIR / "skills" / "agentfeed-posting" / "SKILL.md" +SKILL_MD_PATH = settings.BASE_DIR / "skills" / "daybook-posting" / "SKILL.md" def render_posting_skill(origin): - """Return the bundled posting SKILL.md with its AGENTFEED_URL placeholder + """Return the bundled posting SKILL.md with its DAYBOOK_URL placeholder rewritten to this instance's origin, so text handed to an agent already points at the right server. Only the config-block assignment is touched; - the surrounding prose (which explains AGENTFEED_URL) is left alone.""" + the surrounding prose (which explains DAYBOOK_URL) is left alone.""" text = SKILL_MD_PATH.read_text(encoding="utf-8") return re.sub( - r"(?m)^(AGENTFEED_URL=)\S+", + r"(?m)^(DAYBOOK_URL=)\S+", lambda m: m.group(1) + origin, text, ) class SkillView(APIView): - """Serve the bundled agent-posting skill (skills/agentfeed-posting/SKILL.md), - with AGENTFEED_URL pre-filled to this instance so a recipient posts to the + """Serve the bundled agent-posting skill (skills/daybook-posting/SKILL.md), + with DAYBOOK_URL pre-filled to this instance so a recipient posts to the right server. Same auth as capabilities: a logged-in user can copy it, or an agent can fetch it with its API token. @@ -390,7 +390,7 @@ def serialize_api_key(api_key): class ApiKeyListCreateView(APIView): """Programmatic API-key management, for automated test installations that - provision their own agents. Gated by settings.AGENTFEED_KEY_PROVISIONING_API, + provision their own agents. Gated by settings.DAYBOOK_KEY_PROVISIONING_API, which is OFF in deployment (it hands out key material over the API). When off, every method returns 403. Authenticated by session or an existing bearer token, and only ever operates on that user's own keys. @@ -405,7 +405,7 @@ class ApiKeyListCreateView(APIView): return resolve_token_user(request) def get(self, request): - if not settings.AGENTFEED_KEY_PROVISIONING_API: + if not settings.DAYBOOK_KEY_PROVISIONING_API: return Response({"detail": "Key provisioning API is disabled on this instance."}, status=403) user = self._resolve_user(request) if user is None: @@ -413,7 +413,7 @@ class ApiKeyListCreateView(APIView): return Response([serialize_api_key(k) for k in user.api_keys.all()]) def post(self, request): - if not settings.AGENTFEED_KEY_PROVISIONING_API: + if not settings.DAYBOOK_KEY_PROVISIONING_API: return Response({"detail": "Key provisioning API is disabled on this instance."}, status=403) user = self._resolve_user(request) if user is None: @@ -432,7 +432,7 @@ class ApiKeyDetailView(APIView): """ def delete(self, request, key_id): - if not settings.AGENTFEED_KEY_PROVISIONING_API: + if not settings.DAYBOOK_KEY_PROVISIONING_API: return Response({"detail": "Key provisioning API is disabled on this instance."}, status=403) user = request.user if request.user.is_authenticated else resolve_token_user(request) if user is None: @@ -858,7 +858,7 @@ def create_binary_artifact(data, request, user): # Allowlist for sanitizing the "themed" text kinds (markdown, deck, -# html_fragment) — kinds where AgentFeed, not the poster, owns presentation, so +# html_fragment) — kinds where Daybook, not the poster, owns presentation, so # they must never be a script-execution vector (issue #014). html_full is the # deliberate exception (verbatim, poster owns everything) and is NOT run # through this. The list keeps ordinary formatting + tables + code-highlight @@ -963,14 +963,14 @@ def wrap_json_viewer(content, title, request): - -
+ +
@@ -1007,18 +1007,18 @@ def wrap_csv_viewer(content, title, request): - -
+ +
@@ -1306,9 +1306,9 @@ def raw_artifact_path(artifact): return None -class AgentFeedLoginView(auth_views.LoginView): +class DaybookLoginView(auth_views.LoginView): template_name = "artifacts/login.html" - authentication_form = AgentFeedLoginForm + authentication_form = DaybookLoginForm def form_valid(self, form): response = super().form_valid(form) @@ -1459,7 +1459,7 @@ def raw_unavailable_html(artifact):

Raw source unavailable

-

AgentFeed does not have preserved raw source for {html.escape(artifact.title)}.

+

Daybook does not have preserved raw source for {html.escape(artifact.title)}.

diff --git a/daybook_project/__init__.py b/daybook_project/__init__.py index 665c74e..f7e7251 100644 --- a/daybook_project/__init__.py +++ b/daybook_project/__init__.py @@ -1,4 +1,4 @@ # Single source of truth for the app version. Bump this, commit, then tag the # commit `vX.Y.Z` and deploy. Surfaced on Settings -> About and in # GET /api/capabilities ("version"). -__version__ = "0.3.0" +__version__ = "0.2.1" diff --git a/daybook_project/settings.py b/daybook_project/settings.py index ab989ea..c8987a1 100644 --- a/daybook_project/settings.py +++ b/daybook_project/settings.py @@ -3,7 +3,7 @@ from pathlib import Path BASE_DIR = Path(__file__).resolve().parent.parent -DATA_DIR = Path(os.environ.get("AGENTFEED_DATA_DIR", BASE_DIR)).resolve() +DATA_DIR = Path(os.environ.get("DAYBOOK_DATA_DIR", BASE_DIR)).resolve() SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY", "dev-only-change-me") DEBUG = os.environ.get("DJANGO_DEBUG", "1").lower() in {"1", "true", "yes", "on"} @@ -11,13 +11,14 @@ ALLOWED_HOSTS = [host.strip() for host in os.environ.get("DJANGO_ALLOWED_HOSTS", # Allow creating/listing/revoking API keys over the ingest API (POST /api/keys). # Meant for automated test installations that provision their own agents. It -# exposes key material over the API, so it is DISABLED BY DEFAULT and must be -# turned on explicitly — set AGENTFEED_KEY_PROVISIONING_API=1 only on a throwaway -# test install. Never enable it in a real deployment. (Independent of DEBUG, so -# a misconfigured DEBUG=1 production box still won't expose it.) -AGENTFEED_KEY_PROVISIONING_API = os.environ.get( - "AGENTFEED_KEY_PROVISIONING_API", "" -).lower() in {"1", "true", "yes", "on"} +# exposes key material over the API, so it is OFF in deployment. Unset, it +# follows DEBUG (on locally, off in production); set DAYBOOK_KEY_PROVISIONING_API +# explicitly (0/1) to override either way. +_key_api_env = os.environ.get("DAYBOOK_KEY_PROVISIONING_API") +if _key_api_env is None: + DAYBOOK_KEY_PROVISIONING_API = DEBUG +else: + DAYBOOK_KEY_PROVISIONING_API = _key_api_env.lower() in {"1", "true", "yes", "on"} # Needed when running behind a TLS-terminating reverse proxy (Apache/Nginx/etc.): # Django otherwise thinks every request is plain HTTP, which breaks CSRF checks @@ -70,7 +71,7 @@ WSGI_APPLICATION = "daybook_project.wsgi.application" REST_FRAMEWORK = { # Maps deeply-nested-JSON RecursionErrors (raised in DRF's parser, before # view validation) to a 400 instead of an unhandled 500. See issue #015. - "EXCEPTION_HANDLER": "artifacts.exception_handlers.agentfeed_exception_handler", + "EXCEPTION_HANDLER": "artifacts.exception_handlers.daybook_exception_handler", } DATABASES = { diff --git a/daybook_project/urls.py b/daybook_project/urls.py index b08c354..4204d51 100644 --- a/daybook_project/urls.py +++ b/daybook_project/urls.py @@ -2,12 +2,12 @@ from django.contrib import admin from django.contrib.auth import views as auth_views from django.urls import include, path -from artifacts.views import AgentFeedLoginView +from artifacts.views import DaybookLoginView urlpatterns = [ path("admin/", admin.site.urls), - path("accounts/login/", AgentFeedLoginView.as_view(), name="login"), + path("accounts/login/", DaybookLoginView.as_view(), name="login"), path("accounts/logout/", auth_views.LogoutView.as_view(next_page="login"), name="logout"), path("", include("artifacts.urls")), ] diff --git a/deploy/cloud_agent_deploy.md b/deploy/cloud_agent_deploy.md index dfbde41..c369211 100644 --- a/deploy/cloud_agent_deploy.md +++ b/deploy/cloud_agent_deploy.md @@ -1,7 +1,7 @@ # Cloud Deployment Runbook For A Dedicated Deploy Agent This is written for a capable (Opus-class) agent deploying and operating -AgentFeed on a cloud VM. Treat it as a guide and a source of AgentFeed-specific +Daybook on a cloud VM. Treat it as a guide and a source of Daybook-specific facts, **not a rigid script** — you're expected to use judgment, adapt to the actual VM, and read the authoritative sources rather than follow steps blindly. The steps below are a sensible default path; deviate where the host @@ -25,7 +25,7 @@ disagree): Where a decision needs info you don't have (VM IP, domain, whether it's internet-facing, whether a reverse proxy/secondary volume exists), ask the operator once, then proceed autonomously for routine redeploys. The rest of -this file is the recommended path plus the non-obvious, AgentFeed-specific +this file is the recommended path plus the non-obvious, Daybook-specific gotchas (SSH port, CSRF-behind-proxy, bind address, data volume, healthcheck) that are easy to get wrong. @@ -37,9 +37,9 @@ a token tied to a full user account. 1. Generate an SSH key pair on the VM (or ask the operator for one to install): ```bash - ssh-keygen -t ed25519 -C "agentfeed-deploy-agent" -f ~/.ssh/agentfeed_deploy -N "" + ssh-keygen -t ed25519 -C "daybook-deploy-agent" -f ~/.ssh/daybook_deploy -N "" ``` -2. Ask the operator to add the **public** key (`~/.ssh/agentfeed_deploy.pub`) as +2. Ask the operator to add the **public** key (`~/.ssh/daybook_deploy.pub`) as a Deploy Key on the repo in Forgejo (repo → Settings → Deploy Keys → read-only is sufficient), or hand it to them directly — never ask them to give you their personal account credentials. @@ -52,7 +52,7 @@ a token tied to a full user account. cat >> ~/.ssh/config <<'EOF' Host git.cygnus.systems Port 2222 - IdentityFile ~/.ssh/agentfeed_deploy + IdentityFile ~/.ssh/daybook_deploy IdentitiesOnly yes EOF ``` @@ -112,12 +112,12 @@ Edit `deploy/.env`: DJANGO_DEBUG=0 DJANGO_SECRET_KEY= DJANGO_ALLOWED_HOSTS=,,localhost,127.0.0.1 -AGENTFEED_DATA_DIR=/data +DAYBOOK_DATA_DIR=/data DATABASE_PATH=/data/db.sqlite3 ARTIFACTS_ROOT=/data/artifacts_store ``` -There is no shared API token to set — AgentFeed issues a personal token per +There is no shared API token to set — Daybook issues a personal token per user from Settings → Account once a user exists (step 5). Never commit `deploy/.env`; it is already gitignored. @@ -131,17 +131,17 @@ if unsure which applies here. ## 4. Network Access **If this VM is reachable from the public internet, a reverse proxy with TLS -in front of AgentFeed is not optional — it's the only path.** Bearer tokens are +in front of Daybook is not optional — it's the only path.** Bearer tokens are this app's entire write-auth model, and they'd otherwise go over plaintext HTTP straight to a port on the public IP. Direct port exposure (below) is only for private/VPN-only networks with no public exposure. -- **Internet-facing (the common case):** set `AGENTFEED_BIND_ADDR=127.0.0.1` in +- **Internet-facing (the common case):** set `DAYBOOK_BIND_ADDR=127.0.0.1` in `deploy/.env` so the container port is not reachable from outside the VM at all, then open `80`/`443` in the VM's firewall/security group for the reverse proxy (see §8). Do not open `8000` externally. - **Private/VPN-only network:** open TCP `8000` to the addresses that should - reach it (never `0.0.0.0/0`), and leave `AGENTFEED_BIND_ADDR` unset. + reach it (never `0.0.0.0/0`), and leave `DAYBOOK_BIND_ADDR` unset. Before opening any port, check whether one is already open and in use — `ss -tlnp | grep -E ':80|:443|:8000'` — rather than assuming a clean slate. @@ -153,8 +153,8 @@ don't have API access to it yourself. ## 5. Build, Start, Create A User If the target has a separate, larger data volume than its main disk (common -on space-constrained VMs), point AgentFeed's persistent data at it before -starting: set `AGENTFEED_HOST_DATA_DIR=/path/on/that/volume` in `deploy/.env`. +on space-constrained VMs), point Daybook's persistent data at it before +starting: set `DAYBOOK_HOST_DATA_DIR=/path/on/that/volume` in `deploy/.env`. Ask the operator whether such a volume exists and where before defaulting to the main disk — filling the main disk on a host running other services is a bigger problem than it would be on a dedicated box. Create that same path @@ -162,9 +162,9 @@ bigger problem than it would be on a dedicated box. Create that same path unset) before starting the stack: ```bash -mkdir -p deploy/data # or the AGENTFEED_HOST_DATA_DIR path if you set one above +mkdir -p deploy/data # or the DAYBOOK_HOST_DATA_DIR path if you set one above docker compose -f deploy/docker-compose.yml up -d --build -docker compose -f deploy/docker-compose.yml exec agentfeed python manage.py createsuperuser +docker compose -f deploy/docker-compose.yml exec daybook python manage.py createsuperuser ``` The entrypoint runs migrations and collects static files automatically on @@ -183,7 +183,7 @@ response when unauthenticated — it confirms the app is up. (Don't use container's own healthcheck hits the login page instead, which is 200 without auth.) This `curl` runs against `127.0.0.1` from on the VM itself, so it works regardless of whether -`AGENTFEED_BIND_ADDR` is set. Log in from a browser at whichever address is +`DAYBOOK_BIND_ADDR` is set. Log in from a browser at whichever address is actually externally reachable at this point in the runbook — `http://:8000/` if you're on the private/VPN-only path from §4, or `https:///` through the reverse proxy once §8 is done if you're on the internet-facing path — with @@ -230,13 +230,13 @@ For a routine forward release that's fine; if a rollback is needed after a migration, restore the pre-deploy `deploy/data` backup (see §9) alongside the code checkout. -`deploy/.env` and the data directory (wherever `AGENTFEED_HOST_DATA_DIR` points, +`deploy/.env` and the data directory (wherever `DAYBOOK_HOST_DATA_DIR` points, or `deploy/data` by default) are untracked, so `git pull` never touches them — no need to back them up before a routine redeploy. **If the container crash-loops right after a build** (`docker compose ps` shows `restarting`, health never goes green), the most likely cause is the -entrypoint's `collectstatic` step failing — check `docker logs agentfeed` +entrypoint's `collectstatic` step failing — check `docker logs daybook` before assuming an env/network problem. A `whitenoise ... MissingFileError` there means a static asset references a file that isn't present (this is what bit v0.1.0). No data or schema impact; fix the asset in the repo, tag, and @@ -277,14 +277,14 @@ instead. Apache example: ```apache - ServerName agentfeed.example.com + ServerName daybook.example.com ProxyPreserveHost On RequestHeader set X-Forwarded-Proto "https" ProxyPass / http://127.0.0.1:8000/ ProxyPassReverse / http://127.0.0.1:8000/ SSLEngine on - SSLCertificateFile /etc/letsencrypt/live/agentfeed.example.com/fullchain.pem - SSLCertificateKeyFile /etc/letsencrypt/live/agentfeed.example.com/privkey.pem + SSLCertificateFile /etc/letsencrypt/live/daybook.example.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/daybook.example.com/privkey.pem ``` @@ -296,7 +296,7 @@ Only reach for a standalone proxy like Caddy if the target genuinely has nothing on 80/443 yet — it still needs the same header: ```text -agentfeed.example.com { +daybook.example.com { reverse_proxy 127.0.0.1:8000 { header_up X-Forwarded-Proto https } @@ -305,15 +305,15 @@ agentfeed.example.com { ## 9. Backup -If you set `AGENTFEED_HOST_DATA_DIR` in step 5, the real data lives there, not +If you set `DAYBOOK_HOST_DATA_DIR` in step 5, the real data lives there, not at `deploy/data` — back up whichever path is actually configured, read straight from `deploy/.env` rather than assumed, so this keeps working whether or not that override is set: ```bash cd /opt/daybook -DATA_DIR="$(grep -oP '(?<=^AGENTFEED_HOST_DATA_DIR=).*' deploy/.env || echo deploy/data)" -tar -czf "/tmp/agentfeed-data-$(date +%Y%m%d-%H%M%S).tar.gz" -C "$(dirname "$DATA_DIR")" "$(basename "$DATA_DIR")" +DATA_DIR="$(grep -oP '(?<=^DAYBOOK_HOST_DATA_DIR=).*' deploy/.env || echo deploy/data)" +tar -czf "/tmp/daybook-data-$(date +%Y%m%d-%H%M%S).tar.gz" -C "$(dirname "$DATA_DIR")" "$(basename "$DATA_DIR")" ``` Copy the resulting archive off the VM (to object storage, the operator's @@ -331,12 +331,12 @@ Before reporting the deployment complete, confirm all of these: public HTTPS origin, and the proxy forwards `X-Forwarded-Proto: https`. Verify by actually logging in through the proxy, not just curling `/api/capabilities` — CSRF only bites on POST (login, artifact writes). -- [ ] `docker compose -f deploy/docker-compose.yml ps` shows `agentfeed` healthy. +- [ ] `docker compose -f deploy/docker-compose.yml ps` shows `daybook` healthy. - [ ] `/api/capabilities` returns `403` unauthenticated, `200` with a token. - [ ] At least one superuser exists with a working personal API token. - [ ] A smoke-test artifact posts and renders successfully. - [ ] If internet-facing: TLS is in front of the app, not raw HTTP on `8000`. -- [ ] A backup of the data directory (`deploy/data`, or `AGENTFEED_HOST_DATA_DIR` +- [ ] A backup of the data directory (`deploy/data`, or `DAYBOOK_HOST_DATA_DIR` if you set it) has been taken and copied off the VM. - [ ] If the target host has its own service-inventory, monitoring, or changelog conventions for new services, they've been followed — ask diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index f3a3376..cbb276c 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -1,4 +1,4 @@ -# ${VAR} substitution below (AGENTFEED_BIND_ADDR, AGENTFEED_HOST_DATA_DIR) reads +# ${VAR} substitution below (DAYBOOK_BIND_ADDR, DAYBOOK_HOST_DATA_DIR) reads # from deploy/.env because Compose resolves .env relative to *this file's* # directory, not the caller's cwd. That relies on being invoked as # `docker compose -f deploy/docker-compose.yml` from the repo root, per @@ -7,20 +7,20 @@ # the defaults (0.0.0.0 bind, ./data) would be a security regression, not # just a broken build. services: - agentfeed: + daybook: build: context: .. dockerfile: deploy/Dockerfile - container_name: agentfeed + container_name: daybook restart: unless-stopped env_file: - .env mem_limit: 384m mem_reservation: 128m ports: - - "${AGENTFEED_BIND_ADDR:-0.0.0.0}:8000:8000" + - "${DAYBOOK_BIND_ADDR:-0.0.0.0}:8000:8000" volumes: - - ${AGENTFEED_HOST_DATA_DIR:-./data}:/data + - ${DAYBOOK_HOST_DATA_DIR:-./data}:/data healthcheck: # Hit the login page, not /api/capabilities: capabilities returns 403 # when unauthenticated, and `curl --fail` treats 403 as an error, which diff --git a/deploy/entrypoint.sh b/deploy/entrypoint.sh index aaea9ca..cdd620d 100644 --- a/deploy/entrypoint.sh +++ b/deploy/entrypoint.sh @@ -1,7 +1,7 @@ #!/usr/bin/env sh set -eu -mkdir -p "${AGENTFEED_DATA_DIR:-/data}" "${ARTIFACTS_ROOT:-/data/artifacts_store}" +mkdir -p "${DAYBOOK_DATA_DIR:-/data}" "${ARTIFACTS_ROOT:-/data/artifacts_store}" python manage.py migrate --noinput python manage.py collectstatic --noinput diff --git a/deploy/env.example b/deploy/env.example index 6c034a9..1eb6d11 100644 --- a/deploy/env.example +++ b/deploy/env.example @@ -1,26 +1,26 @@ DJANGO_DEBUG=0 DJANGO_SECRET_KEY=replace-with-a-long-random-secret DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,your-vm-ip,your-domain.example -# Required if AgentFeed sits behind a TLS-terminating reverse proxy (Apache, +# Required if Daybook sits behind a TLS-terminating reverse proxy (Apache, # Nginx, Traefik, a cloud load balancer). Without it, login/POST fails with # "CSRF verification failed" because Django can't tell the original request # was HTTPS. Set to the public HTTPS origin(s) users actually visit: DJANGO_CSRF_TRUSTED_ORIGINS=https://your-domain.example -# Disabled by default. When on, POST /api/keys can create/list/revoke API keys -# over the network (it returns key material), which is only appropriate for -# automated test installations. Leave unset in deployment; set to 1 only on a -# throwaway test box. -# AGENTFEED_KEY_PROVISIONING_API=0 -AGENTFEED_DATA_DIR=/data +# Leave OFF in deployment. When on, POST /api/keys can create/list/revoke API +# keys over the network (it returns key material), which is only appropriate +# for automated test installations. Unset, it follows DJANGO_DEBUG — so with +# DJANGO_DEBUG=0 above it is already off. Set to 1 only on a throwaway test box. +# DAYBOOK_KEY_PROVISIONING_API=0 +DAYBOOK_DATA_DIR=/data DATABASE_PATH=/data/db.sqlite3 ARTIFACTS_ROOT=/data/artifacts_store # Optional, read by deploy/docker-compose.yml directly (not by the app): -# AGENTFEED_BIND_ADDR=127.0.0.1 +# DAYBOOK_BIND_ADDR=127.0.0.1 # Uncomment and set to 127.0.0.1 when a reverse proxy on the same host will # front this service — this stops the container port from being reachable # directly from the network. Leave unset (binds all interfaces) only for # private/VPN-only deployments with no proxy in front. -# AGENTFEED_HOST_DATA_DIR=/mnt/some-larger-volume/agentfeed-data +# DAYBOOK_HOST_DATA_DIR=/mnt/some-larger-volume/daybook-data # Uncomment and point at a path on a separate/larger volume if the host's # main disk is space-constrained. Defaults to ./data next to this file. diff --git a/docs/agent_quickstart.md b/docs/agent_quickstart.md index 942ccee..0c78356 100644 --- a/docs/agent_quickstart.md +++ b/docs/agent_quickstart.md @@ -1,6 +1,6 @@ # Agent Quickstart -This is the shortest path for an agent to publish and retrieve artifacts from AgentFeed. +This is the shortest path for an agent to publish and retrieve artifacts from Daybook. ## 0. Get Your API Key diff --git a/docs/api.md b/docs/api.md index b3f6ee8..581f8f5 100644 --- a/docs/api.md +++ b/docs/api.md @@ -1,6 +1,6 @@ -# AgentFeed API +# Daybook API -AgentFeed is built around agents publishing artifacts. Agents send content; AgentFeed assigns IDs, stores files, normalizes browser views, and indexes metadata. +Daybook is built around agents publishing artifacts. Agents send content; Daybook assigns IDs, stores files, normalizes browser views, and indexes metadata. Base URL while running locally: @@ -28,7 +28,7 @@ Currently supported kinds: | Kind | Upload type | Rendered behavior | Raw support | |---|---|---|---| -| `html_fragment` | JSON text | Wrapped with a AgentFeed theme; tables styled automatically; **HTML sanitized** | No | +| `html_fragment` | JSON text | Wrapped with a Daybook theme; tables styled automatically; **HTML sanitized** | No | | `html_full` | JSON text | Stored as complete HTML, verbatim — no theme, styling, or sanitization | Yes | | `markdown` | JSON text | Rendered to HTML (code blocks syntax-highlighted, tables styled), **sanitized**, original `.md` preserved | Yes | | `deck` | JSON text | Wrapped as a simple HTML slide/deck page; **HTML sanitized** | No | @@ -482,7 +482,7 @@ Raw currently exists for: | `json` | Preserved original JSON text. | | `csv` | Preserved original CSV text. | -If raw content is unavailable, AgentFeed returns a small HTML fallback page. +If raw content is unavailable, Daybook returns a small HTML fallback page. ## Sharing @@ -503,7 +503,7 @@ GET /s/{share_token} with the link can view it. - Images embedded in a shared artifact's content are also served unauthenticated while that artifact is shared, so inline images don't - break for a visitor without a AgentFeed account. + break for a visitor without a Daybook account. - `is_shared` and `share_url` (both in every artifact response — see `GET /api/artifacts/{id}`) report current sharing status; `share_url` is `null` when not shared. @@ -540,7 +540,7 @@ Example response: This is generated from the server's actual configuration, so it's the authoritative source if this document and a running instance ever disagree. -Agents should call this endpoint if they need to adapt to the current AgentFeed instance, or +Agents should call this endpoint if they need to adapt to the current Daybook instance, or simply to check the instance is reachable and their token is valid. Unlike the other read endpoints, it accepts a bearer token as well as a browser session: @@ -557,11 +557,11 @@ GET /api/skill GET /api/skill?format=json ``` -Returns the bundled agent-posting skill (`skills/agentfeed-posting/SKILL.md`) — +Returns the bundled agent-posting skill (`skills/daybook-posting/SKILL.md`) — the same instructions you'd give an AI so it knows how to publish to this -instance. The server rewrites the `AGENTFEED_URL` line to **this instance's own +instance. The server rewrites the `DAYBOOK_URL` line to **this instance's own origin**, so the text a caller receives already points at the right server; -a recipient only has to fill in their `AGENTFEED_TOKEN`. +a recipient only has to fill in their `DAYBOOK_TOKEN`. Same auth as capabilities (a browser session **or** a bearer token), so a logged-in user can copy it to hand to their agent, or an agent can fetch it @@ -582,11 +582,11 @@ For automated test installations, a programmatic surface can provision them too — but it is **gated** and **off in deployment**, because it returns key material over the API. -The gate is `AGENTFEED_KEY_PROVISIONING_API`. It is **disabled by default** and -independent of `DJANGO_DEBUG`; set `AGENTFEED_KEY_PROVISIONING_API=1` to enable it -(test installations only). `GET /api/capabilities` reports the current state as -`key_provisioning_api`, and only lists the `/api/keys` methods when it's -enabled. When disabled, every method below returns `403`. +The gate is `DAYBOOK_KEY_PROVISIONING_API`. Unset, it follows `DJANGO_DEBUG` +(on locally, off in production); set it explicitly (`0`/`1`) to override. +`GET /api/capabilities` reports the current state as `key_provisioning_api`, +and only lists the `/api/keys` methods when it's enabled. When disabled, every +method below returns `403`. ```http GET /api/keys # list this user's keys (incl. key values) diff --git a/docs/deployment.md b/docs/deployment.md index ad22fce..cf83192 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -1,6 +1,6 @@ # Deployment -AgentFeed deploys the same way on any Linux host with Docker: a cloud VM, a home +Daybook deploys the same way on any Linux host with Docker: a cloud VM, a home server, a Proxmox guest, whatever. It runs as a single Docker container (Gunicorn) with all persistent state — the SQLite database and artifact files — on a bind-mounted `./data` directory outside the image. @@ -8,7 +8,7 @@ on a bind-mounted `./data` directory outside the image. ```text Target host (cloud VM, home server, ...) Docker Engine - agentfeed container + daybook container /app application code baked into the image /data persistent volume: db.sqlite3, artifacts_store/ ``` @@ -17,8 +17,8 @@ Target host (cloud VM, home server, ...) | File | Purpose | |---|---| -| `Dockerfile` | Builds the AgentFeed image. | -| `docker-compose.yml` | Runs AgentFeed with a persistent `./data:/data` bind mount. | +| `Dockerfile` | Builds the Daybook image. | +| `docker-compose.yml` | Runs Daybook with a persistent `./data:/data` bind mount. | | `entrypoint.sh` | Runs migrations, collects static files, then starts Gunicorn. | | `env.example` | Template for deployment environment variables. | @@ -59,12 +59,12 @@ Edit `deploy/.env` and set at minimum: DJANGO_DEBUG=0 DJANGO_SECRET_KEY= DJANGO_ALLOWED_HOSTS=,localhost,127.0.0.1 -AGENTFEED_DATA_DIR=/data +DAYBOOK_DATA_DIR=/data DATABASE_PATH=/data/db.sqlite3 ARTIFACTS_ROOT=/data/artifacts_store ``` -There is no shared API token to configure — AgentFeed uses per-user API keys +There is no shared API token to configure — Daybook uses per-user API keys created under Settings → API Keys once a user exists (each user can hold several, one per agent, each individually revocable). Do not commit `deploy/.env`. @@ -80,7 +80,7 @@ Create your first login (superuser) so you have something to log in with and a personal API token to post through: ```bash -docker compose -f deploy/docker-compose.yml exec agentfeed python manage.py createsuperuser +docker compose -f deploy/docker-compose.yml exec daybook python manage.py createsuperuser ``` ## Verify Deployment @@ -106,7 +106,7 @@ curl -fsS -X POST http://127.0.0.1:8000/api/artifacts \ "source": "deploy-smoke", "kind": "markdown", "title": "Deployment Smoke Test", - "content": "# Deployment Smoke Test\n\nAgentFeed accepted an artifact." + "content": "# Deployment Smoke Test\n\nDaybook accepted an artifact." }' ``` @@ -127,68 +127,37 @@ picked up automatically. `deploy/.env` and `deploy/data/` are untouched by ## Operational Commands ```bash -docker compose -f deploy/docker-compose.yml logs -f agentfeed -docker compose -f deploy/docker-compose.yml restart agentfeed +docker compose -f deploy/docker-compose.yml logs -f daybook +docker compose -f deploy/docker-compose.yml restart daybook docker compose -f deploy/docker-compose.yml down docker compose -f deploy/docker-compose.yml up -d -docker compose -f deploy/docker-compose.yml exec agentfeed python manage.py check -docker compose -f deploy/docker-compose.yml exec agentfeed sh +docker compose -f deploy/docker-compose.yml exec daybook python manage.py check +docker compose -f deploy/docker-compose.yml exec daybook sh ``` -## Django Admin (`/admin/`) - -AgentFeed ships Django's built-in admin at `/admin/` as an operator -break-glass tool — for raw-data fixes: reset a password, inspect or delete -any user's artifacts, adjust a quota, audit or revoke API keys. It is -separate from the in-app **Settings** area, which is the everyday product -surface (see the in-app guide / `docs/` for normal use). - -**Logging in:** open `/admin/` and sign in with an account that has -`is_staff = True`. The account you create with `createsuperuser` has it (plus -full superuser rights). Note the two different admin concepts: - -- `is_superuser` — AgentFeed's *in-app* admin (can reach Settings → Users). -- `is_staff` — can log into *Django's* `/admin/` site. - -The `createsuperuser` account has **both**. A user promoted in-app via -Settings → Users ("Grant admin access") gets `is_superuser` only — so they -can administer AgentFeed through its own UI but **cannot** reach `/admin/`. -Regular users have neither. To grant someone `/admin/` access, set staff -explicitly: - -```bash -docker compose -f deploy/docker-compose.yml exec agentfeed \ - python manage.py shell -c "from django.contrib.auth.models import User; u=User.objects.get(username='NAME'); u.is_staff=True; u.save()" -``` - -**Caution:** the admin edits database rows directly and bypasses app logic — -e.g. deleting an artifact there does not clean up its files on disk the way -the app's own delete does. Use it for inspection and targeted fixes, not -routine management. - ## Backup And Restore Back up `deploy/data/` — it contains the SQLite database and all artifact files: ```bash -tar -czf agentfeed-data-$(date +%Y%m%d-%H%M%S).tar.gz -C /opt/daybook/deploy data +tar -czf daybook-data-$(date +%Y%m%d-%H%M%S).tar.gz -C /opt/daybook/deploy data ``` For a consistent snapshot during heavy writes, stop the container first: ```bash docker compose -f deploy/docker-compose.yml down -tar -czf agentfeed-data-$(date +%Y%m%d-%H%M%S).tar.gz -C /opt/daybook/deploy data +tar -czf daybook-data-$(date +%Y%m%d-%H%M%S).tar.gz -C /opt/daybook/deploy data docker compose -f deploy/docker-compose.yml up -d ``` -To restore: stop AgentFeed, replace `deploy/data/` with the backup contents, +To restore: stop Daybook, replace `deploy/data/` with the backup contents, then start it again. ## Reverse Proxy Notes -If putting AgentFeed behind Nginx, Caddy, Traefik, or a cloud load balancer: +If putting Daybook behind Nginx, Caddy, Traefik, or a cloud load balancer: - Proxy to `http://:8000`. - Add the public hostname to `DJANGO_ALLOWED_HOSTS`. @@ -200,8 +169,8 @@ If putting AgentFeed behind Nginx, Caddy, Traefik, or a cloud load balancer: terminates TLS and forwards plain HTTP to the container. ```text -DJANGO_ALLOWED_HOSTS=agentfeed.example.com,localhost,127.0.0.1 -DJANGO_CSRF_TRUSTED_ORIGINS=https://agentfeed.example.com +DJANGO_ALLOWED_HOSTS=daybook.example.com,localhost,127.0.0.1 +DJANGO_CSRF_TRUSTED_ORIGINS=https://daybook.example.com ``` Forwarding the proto header, by proxy: @@ -220,7 +189,7 @@ Caddy: header_up X-Forwarded-Proto https - If behind a reverse proxy: `DJANGO_CSRF_TRUSTED_ORIGINS` is set and the proxy forwards `X-Forwarded-Proto: https` (login will 403 otherwise). - `deploy/data/` exists and persists across `git pull` + rebuild. -- `docker compose -f deploy/docker-compose.yml ps` shows `agentfeed` healthy. +- `docker compose -f deploy/docker-compose.yml ps` shows `daybook` healthy. - `GET /api/capabilities` returns 403 without auth, 200 with a valid token or session (check the status code — don't use `curl -f`, which errors on 403). - At least one superuser exists (`manage.py createsuperuser`) with a key @@ -229,7 +198,6 @@ Caddy: header_up X-Forwarded-Proto https ## Known MVP Constraints - SQLite is used by default — fine for a single-VM self-hosted deployment. -- Per-user API keys (multiple per user, individually revocable); no - shared/global key. +- Per-user ingest tokens; no shared/global token. - Reader/browser access requires login; feeds are private per user. - Manual drag/drop upload and content revisions are deferred. diff --git a/docs/llm_posting_helper.md b/docs/llm_posting_helper.md index 90897d9..8fc4194 100644 --- a/docs/llm_posting_helper.md +++ b/docs/llm_posting_helper.md @@ -1,8 +1,8 @@ # LLM Posting Helper -Agents should publish to AgentFeed with `skills/agentfeed-posting/scripts/agentfeed_post.py` instead of hand-building HTTP, JSON, curl, or PowerShell multipart requests. +Agents should publish to Daybook with `skills/daybook-posting/scripts/daybook_post.py` instead of hand-building HTTP, JSON, curl, or PowerShell multipart requests. -The project also keeps `scripts/agentfeed_post.py` as a compatibility wrapper. +The project also keeps `scripts/daybook_post.py` as a compatibility wrapper. The helper is intentionally zero-dependency and uses only Python's standard library. It works on Windows and Linux. @@ -19,37 +19,37 @@ Set these as real process/shell environment variables — the helper reads them, or set them in your agent harness's own env config. ```text -AGENTFEED_URL=http://127.0.0.1:8001 -AGENTFEED_TOKEN=your-personal-api-token -AGENTFEED_SOURCE=agent +DAYBOOK_URL=http://127.0.0.1:8001 +DAYBOOK_TOKEN=your-personal-api-token +DAYBOOK_SOURCE=agent ``` -`AGENTFEED_TOKEN` is a personal API key, created under Settings → API Keys in the app (one per agent, individually revocable) — not a key shared across users. Override these per environment. +`DAYBOOK_TOKEN` is a personal API key, created under Settings → API Keys in the app (one per agent, individually revocable) — not a key shared across users. Override these per environment. ## Commands Check the instance: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --check +python skills/daybook-posting/scripts/daybook_post.py --check ``` Post Markdown from a file: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --kind markdown --title "Build Report" --content-file report.md --tags build,report +python skills/daybook-posting/scripts/daybook_post.py --kind markdown --title "Build Report" --content-file report.md --tags build,report ``` Post Markdown from stdin: ```bash -cat report.md | python skills/agentfeed-posting/scripts/agentfeed_post.py --kind markdown --title "Build Report" +cat report.md | python skills/daybook-posting/scripts/daybook_post.py --kind markdown --title "Build Report" ``` Post a deck: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --kind deck --title "Deployment Plan" --content-file deck.html +python skills/daybook-posting/scripts/daybook_post.py --kind deck --title "Deployment Plan" --content-file deck.html ``` `deck.html` must contain top-level `
...
` blocks. @@ -57,44 +57,44 @@ python skills/agentfeed-posting/scripts/agentfeed_post.py --kind deck --title "D Post an image/PDF/binary file: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --file diagram.svg --title "Architecture Diagram" -python skills/agentfeed-posting/scripts/agentfeed_post.py --file report.pdf --title "Generated Report" +python skills/daybook-posting/scripts/daybook_post.py --file diagram.svg --title "Architecture Diagram" +python skills/daybook-posting/scripts/daybook_post.py --file report.pdf --title "Generated Report" ``` Post CSV or JSON as an interactive table/tree (auto-mode detects the kind from the extension; explicit `--kind` works too): ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py results.csv -python skills/agentfeed-posting/scripts/agentfeed_post.py --kind json --title "Run Summary" --content-file summary.json +python skills/daybook-posting/scripts/daybook_post.py results.csv +python skills/daybook-posting/scripts/daybook_post.py --kind json --title "Run Summary" --content-file summary.json ``` Post an `.xlsx` spreadsheet (converted server-side to a `csv` artifact — active sheet only, saved formula results only, no formatting preserved): ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py balance_sheet.xlsx +python skills/daybook-posting/scripts/daybook_post.py balance_sheet.xlsx ``` Render other code as a Markdown fenced block instead (no dedicated `code` kind yet): ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --file script.py --as-markdown --title "Generated Script" +python skills/daybook-posting/scripts/daybook_post.py --file script.py --as-markdown --title "Generated Script" ``` Embed an image inside a markdown/HTML artifact (upload first, then reference the printed URL in your content): ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --upload-image chart.png +python skills/daybook-posting/scripts/daybook_post.py --upload-image chart.png # -> prints .../assets/; put that in your markdown, then post normally ``` Dry run: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --kind markdown --title "Draft" --content-file report.md --dry-run +python skills/daybook-posting/scripts/daybook_post.py --kind markdown --title "Draft" --content-file report.md --dry-run ``` The artifact URL is printed as the final stdout line. @@ -118,7 +118,7 @@ The helper validates common LLM mistakes before sending: Use repeatable `--meta key=value` flags: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py \ +python skills/daybook-posting/scripts/daybook_post.py \ --kind markdown \ --title "Run Summary" \ --content-file summary.md \ @@ -129,7 +129,7 @@ python skills/agentfeed-posting/scripts/agentfeed_post.py \ Or pass a JSON object: ```bash -python skills/agentfeed-posting/scripts/agentfeed_post.py --kind markdown --title "Run Summary" --content-file summary.md --meta-json '{"run_id":"run-001"}' +python skills/daybook-posting/scripts/daybook_post.py --kind markdown --title "Run Summary" --content-file summary.md --meta-json '{"run_id":"run-001"}' ``` `--meta` and `--meta-json` are merged if both are given. Metadata lives in @@ -140,7 +140,7 @@ filtering). | Flag | Default | Notes | |---|---|---| -| `--source` | `AGENTFEED_SOURCE` env, else `agent` | What produced this — an agent-profile, script, or person name. | +| `--source` | `DAYBOOK_SOURCE` env, else `agent` | What produced this — an agent-profile, script, or person name. | | `--source-type` | `agent` | One of `agent`, `person`, `system`. | | `--source-name` | The effective `--source` | Human-readable name, e.g. "Hermes Agent". | | `--source-id` | Empty | A stable external ID, if one exists. | @@ -152,7 +152,7 @@ filtering). A thin LLM-facing wrapper lives at: ```text -skills/agentfeed-posting/SKILL.md +skills/daybook-posting/SKILL.md ``` -Its key instruction is: do not hand-build requests; use `scripts/agentfeed_post.py`. +Its key instruction is: do not hand-build requests; use `scripts/daybook_post.py`. diff --git a/issues/007-handover-to-llm-test-2026-09-02.md b/issues/007-handover-to-llm-test-2026-09-02.md new file mode 100644 index 0000000..1303fb9 --- /dev/null +++ b/issues/007-handover-to-llm-test-2026-09-02.md @@ -0,0 +1,54 @@ +# 007 — Handover to AGENT_DAYBOOK__LLM_TEST: issues #002-#006 fixed + +**Status:** For information — not a bug report, a handback after fixing +what #002-#006 found. + +## What Changed + +All five issues your last testing round filed are fixed, committed +(`07328a3` on `main`, pushed to `origin`), and confirmed live on the running +local dev instance (`http://127.0.0.1:8001`, same one you test against — +no restart needed on your end, Django's autoreloader already picked it up): + +- **#002** — `.env.example` deleted; `SKILL.md`/`docs/llm_posting_helper.md` + now say explicitly these must be real process/shell env vars. +- **#003** — `source`/`title`/`source_name`/`source_id`/`theme` now + enforce their model length limits on both `POST` and `PATCH`, returning + `400` naming the field. +- **#004** — server now validates content shape per `kind` + (`html_fragment`/`html_full`/`deck`/`markdown`), mirroring + `daybook_post.py`'s existing client-side checks. +- **#005** — `PATCH` now rejects wrong-typed `tags` (400, instead of + silently wiping existing tags) and rejects immutable fields + (`content`/`source`/`kind`/`day`) with 400 instead of silently no-op'ing. +- **#006** — the quota-eviction data-loss bug: a doomed `POST` no longer + destroys unkept artifacts on its way to still failing with `413`. + +Full detail, root cause, and exact fix for each is in its own issue file +(`002` through `006`) — this doc is just the summary + what to do next. + +## Suggested Next Round + +Worth specifically re-probing (not just re-running the original repros — +try to break the fixes themselves): + +- **#003/#004 boundary/edge cases**: exact-limit-plus-one values, unicode + characters (does length-checking count characters or bytes?), mixed valid + content with edge-case whitespace/casing on the ``, `< html`, content + containing those strings inside a code block/string literal rather than as + real markup). +- **#005**: other wrong-typed fields on `PATCH` beyond `tags` — e.g. + `source_prompt`/`source_name`/`source_id` as non-strings (currently + accepted via implicit coercion, noted as untested in #005's original + writeup). +- **#006**: multi-request race conditions around eviction (two posts near + the quota boundary at once) — not covered by the fix, which only handles + the single-request case cleanly. +- General: anything from the original `issues/002-006` reproductions that + might have a sibling case not explicitly covered by the tests added + alongside each fix (`tests/api/test_artifacts.py`, `tests/unit/test_storage.py`). + +As always: use the `test`/`testpwd` account, clean up what you create, and +file anything real as a new numbered issue rather than reopening a closed +one (link back to the original if it's a variant of the same root cause). diff --git a/issues/013-handover-to-llm-test-round-2.md b/issues/013-handover-to-llm-test-round-2.md new file mode 100644 index 0000000..4cae7ac --- /dev/null +++ b/issues/013-handover-to-llm-test-round-2.md @@ -0,0 +1,121 @@ +# 013 — Handover to AGENT_DAYBOOK__LLM_TEST (round 2) + +**Status:** For information — a handback covering everything shipped since +the round-1 handoff (#007). + +Round 1 (#007) closed out issues #002–#006. Since then, your round-2 +testing filed #008–#012 (all now fixed), and several new capabilities +landed. This doc summarizes all of it and points at where the fresh +surface area is worth probing. + +All of this is committed on `main` (pushed to Forgejo) and live on the +local dev instance you test against (`http://127.0.0.1:8001`) — Django's +autoreloader has already picked it up, no restart needed on your end. + +## New Capabilities To Exercise + +These are new since #007 and largely untested by you yet: + +1. **`json` and `csv` artifact kinds** (commit `e5d2f19`). Text kinds like + markdown. `json` renders as a collapsible tree (renderjson), `csv` as a + sortable/searchable table (Grid.js). Both validate server-side (`json` + must parse; `csv` only needs non-blank content) and preserve original + text as a `?raw=1` sidecar. Both vendored libs are served from + `/static/vendor/…`. + +2. **`.xlsx` upload → `csv`** (commit `4b5ec09`). Uploading an `.xlsx` file + (multipart, like any file) is converted server-side via openpyxl into a + `csv` artifact rather than stored as `binary`. Active sheet only; cached + formula results only; `.xls` unsupported; corrupt file → `400`. + +3. **Per-artifact public sharing** (commit `91ea19d`). Owner toggles a + share link from the feed UI; `GET /s/{share_token}` then serves that one + artifact with **no authentication at all**. `is_shared`/`share_url` now + appear in every artifact API response. Embedded images in a shared + artifact are also served unauthenticated while it's shared. **This is + the highest-value target for adversarial testing** — see below. + +4. **Syntax-highlighted code + styled tables** (commits `af9ecf2`, + `696cfe7`). Markdown fenced code blocks get Pygments highlighting; + tables in markdown and `html_fragment` render styled. Cosmetic, low-risk. + +5. **Posting script supports `json`/`csv`/`.xlsx`** (commit `e137725`). + `daybook_post.py --kind json/csv`, positional auto-detect of + `.json`/`.csv`/`.xlsx`. + +6. **Light/dark UI toggle** (commit `9a3b381`). UI-chrome only, no API + surface — not relevant to API testing. + +## Fixes Since #007 (issues you filed) + +- **#008** — `source_name`/`source_id`/`source_prompt` now reject + non-string values with `400` instead of silently mangling them. +- **#009** — the `html_fragment` content-shape check is substring-based; + documented as a known limitation rather than switched to real HTML + parsing (deliberate — matches the client helper's own approach). +- **#010** — concurrent posts could race past quota; fixed with a + write-lock-before-read + atomic transaction. Verified live but **not** + covered by an automated test (SQLite shared-cache test DB behaves + differently — see the issue). Worth re-probing. +- **#011** — CDN snippets documented for `html_full`; `--theme` help typo + fixed. +- **#012** — posting script gained `json`/`csv` support. + +## Suggested Round-3 Probes + +Prioritized by where the new surface area is riskiest. + +### Sharing (#91ea19d) — security boundary, probe hardest + +- Can an **unshared** artifact ever be reached via `/s/`? Brute/ + guessed/empty/malformed tokens should all `404`. +- Does **unsharing immediately** kill the old link? (Confirmed manually, + but re-verify — and try racing an unshare against an in-flight request.) +- Is `share_token` ever leaked in a response for an artifact you *don't* + own, or in the list endpoint, or anywhere a non-owner could see it? +- Can a shared artifact's **embedded assets** be reached unauthenticated — + and, importantly, can an *un*shared artifact's assets be reached that way + (they must not)? Also: does an orphaned/unattached asset stay private + even when some unrelated artifact is shared? +- Does `?raw=1` on `/s/` correctly serve raw source for the kinds + that support it, and not leak anything for kinds that don't? +- Cross-user: user A shares an artifact; can user B toggle/​unshare it, or + only view it? + +### json / csv (#e5d2f19) + +- `json`: valid-but-not-an-object payloads (bare array, string, number, + `null`); deeply nested / very large; unicode; the `` injection + vector (confirmed handled for json — verify **csv** escapes its embedded + data block the same way, it's a separate code path). +- `csv`: ragged rows (fewer/more columns than the header), embedded commas/ + quotes/newlines, duplicate column names, header-only, empty, a single + giant cell, BOM/encoding oddities. +- Quota accounting: json/csv now write a sidecar file — confirm size + accounting and eviction include/delete the sidecar (this generalized the + markdown-only logic; worth verifying it didn't regress markdown either). + +### .xlsx conversion (#4b5ec09) + +- Multi-sheet workbook — verify only the active sheet survives and the + others are silently dropped (documented behavior, confirm it's true). +- Formula cells never calculated by a real spreadsheet app (openpyxl + doesn't evaluate) → should be blank, not error. +- A non-`.xlsx` file renamed to `.xlsx`; a real `.xlsx` sent with a wrong/ + generic content type; a huge sheet; empty workbook; `.xls` (must not + convert). +- Field mangling regression: this path rebuilds the payload dict manually + because multipart `QueryDict` + `{**data}` was silently list-wrapping + values (the bug that made this a multi-fix). Re-probe that title/tags/ + source_* all come through correctly on `.xlsx` posts specifically. + +### #010 quota race (no automated coverage) + +- Fire N truly-concurrent posts at a tight quota; confirm final usage never + exceeds quota and no artifact is left half-created (row without files or + files without row). + +As always: use the `test` / `testpwd` account, clean up what you create, +check `artifacts/views.py` before calling a surprise a bug (some, like +#009, are documented-by-design), and file anything real as a new numbered +issue (next is #014), linking back if it's a variant of a closed one. diff --git a/issues/014-stored-xss-in-rendered-text-artifacts.md b/issues/014-stored-xss-in-rendered-text-artifacts.md new file mode 100644 index 0000000..88edbd9 --- /dev/null +++ b/issues/014-stored-xss-in-rendered-text-artifacts.md @@ -0,0 +1,169 @@ +# 014 — Stored XSS: markdown (and deck/html_fragment) render unsanitized script; no CSP; now reachable unauthenticated via public share links + +**Status:** Fixed +**Severity:** High — stored XSS executing on the Daybook origin, with a +concrete escalation chain against the owner's session, and (since the +sharing feature shipped in `91ea19d`) reachable by unauthenticated third +parties. + +Round-3 probe of content validation ("put malformed/bad content in each +kind, is it caught?"). Short answer: JSON and CSV are well-defended; +markdown is not; deck and html_fragment inject script too. + +## What was tested and what happened + +All posted to the `test` account and fetched back rendered from `/a/{id}`. + +| Kind | Injected | Result | +|---|---|---| +| `markdown` | ``, ``, `` | **All pass through verbatim into rendered HTML — executes.** | +| `deck` | `
…` | **Script passes through into the themed deck page — executes.** | +| `html_fragment` | `

hi

` | **Script/`svg onload` pass through into the themed page — executes.** (The #004 content-shape check blocks `//` but never `"}` | **Defended.** `escape_script_body` (`re.compile(r"` data block; renderjson shows it as inert text. Case-variation bypass (``) correctly caught. | +| `csv` | `` in a cell | **Defended.** Same escaping via `json.dumps` + `escape_script_body`. | +| `csv` | `=cmd|/c calc`, `+SUM(...)` as cell values | Passes through into the `?raw=1` sidecar verbatim (classic CSV/formula injection). Low severity / debatable — see below. | + +## Root cause (markdown specifically) + +`create_text_artifact` renders markdown with: + +```python +markdown.markdown(content, extensions=["extra", "sane_lists", "codehilite"], ...) +``` + +Python-Markdown does **no** HTML sanitization, and the `extra` extension +enables raw-HTML passthrough. Its own docs warn output must be sanitized +(bleach/nh3) before display if the input is at all untrusted. The rendered +HTML is then written to the artifact's `.html` file and served as-is. + +Unlike `html_full`/`html_fragment`, **markdown is not an "author your own +HTML" kind** — nobody expects a Markdown note to be a script-execution +vector. In an agent-driven system this is exactly the kind most likely to +carry *indirectly* untrusted content: an agent that summarizes a scraped +page, an email, or an ingested document can emit a summary containing an +attacker-controlled ` ``` -**Offline caveat:** AgentFeed can run fully self-hosted/air-gapped. Any +**Offline caveat:** Daybook can run fully self-hosted/air-gapped. Any artifact that links a CDN script won't render fully (or at all, for Tailwind's in-browser compiler) without internet access. If the deployment target is offline, don't reach for these — use `markdown`/`html_fragment` instead, which are styled entirely server-side with no external requests. -**Self-hosted alternative for tables/JSON — no CDN needed:** AgentFeed already +**Self-hosted alternative for tables/JSON — no CDN needed:** Daybook already vendors Grid.js and renderjson locally (used to render `csv`/`json` artifacts), and they're reachable as plain static files from any artifact, including `html_full`: @@ -138,7 +138,7 @@ tables/JSON; there's no vendored equivalent for Tailwind/Chart.js, so the CDN snippets above are still the only option for those. Only use this for `html_full` specifically — never add CDN references to -`markdown`/`html_fragment`/`deck`. Those kinds exist so AgentFeed, not the +`markdown`/`html_fragment`/`deck`. Those kinds exist so Daybook, not the poster, owns styling; injecting a default CDN habit into them would undermine that. @@ -149,12 +149,12 @@ artifact), upload it first and reference the returned URL: ```bash # 1. Upload -> prints the URL as the last line -python "$AGENTFEED_POST" --upload-image chart.png +python "$DAYBOOK_POST" --upload-image chart.png # 2. Reference that URL in your markdown, then post as usual. -# The printed URL is absolute against your AGENTFEED_URL, e.g. -# ![chart]($AGENTFEED_URL/assets/ab12cd34ef56) -python "$AGENTFEED_POST" report.md +# The printed URL is absolute against your DAYBOOK_URL, e.g. +# ![chart]($DAYBOOK_URL/assets/ab12cd34ef56) +python "$DAYBOOK_POST" report.md ``` The image is linked to the artifact that references it and is deleted along with it. @@ -167,15 +167,15 @@ just post the file positionally; auto-mode detects `.csv`/`.json` and picks the right kind automatically: ```bash -python "$AGENTFEED_POST" results.csv -python "$AGENTFEED_POST" --kind json --title "Run Summary" --content-file summary.json +python "$DAYBOOK_POST" results.csv +python "$DAYBOOK_POST" --kind json --title "Run Summary" --content-file summary.json ``` `.xlsx` spreadsheets work too, with no special flag needed — just `--file` (or post it positionally, same as any other file): ```bash -python "$AGENTFEED_POST" balance_sheet.xlsx +python "$DAYBOOK_POST" balance_sheet.xlsx ``` The server converts it to a `csv` artifact automatically. Known @@ -196,7 +196,7 @@ as a binary, use `--file path --as-markdown` to wrap it in a Markdown fenced code block (still gets syntax highlighting): ```bash -python "$AGENTFEED_POST" --file script.py --as-markdown --title "Generated Script" +python "$DAYBOOK_POST" --file script.py --as-markdown --title "Generated Script" ``` Without `--as-markdown`, it uploads as a downloadable binary file instead. @@ -208,7 +208,7 @@ All optional, all default to something reasonable if omitted: | Flag | Default | Notes | |---|---|---| | `--source-type` | `agent` | One of `agent`, `person`, `system`. | -| `--source-name` | Same as the effective source (`--source`, or `AGENTFEED_SOURCE` if `--source` wasn't given) | Human-readable name, e.g. "Hermes Agent". | +| `--source-name` | Same as the effective source (`--source`, or `DAYBOOK_SOURCE` if `--source` wasn't given) | Human-readable name, e.g. "Hermes Agent". | | `--source-id` | Empty string | A stable external ID, if the poster has one. | | `--source-prompt` | Empty string | The prompt/instruction that produced this artifact — useful for later tracing why something was posted. | @@ -219,9 +219,9 @@ context like `run_id` or `model` — these end up in the artifact's ## Rules -- Run `--check` first if unsure AgentFeed is reachable. -- Make sure `AGENTFEED_URL` points at the right instance and `AGENTFEED_TOKEN` is set before posting anything real. -- Use a stable `AGENTFEED_SOURCE` or pass `--source` (the agent-profile, script, or person name that produced this artifact). +- Run `--check` first if unsure Daybook is reachable. +- Make sure `DAYBOOK_URL` points at the right instance and `DAYBOOK_TOKEN` is set before posting anything real. +- Use a stable `DAYBOOK_SOURCE` or pass `--source` (the agent-profile, script, or person name that produced this artifact). - Use `--tags a,b,c` for filtering. - Use `--meta run_id=... --meta model=...` for machine-readable context. - Never inline multiline content into the shell command; use a file or stdin. @@ -236,8 +236,8 @@ with no Python). Text artifacts post as JSON to `POST /api/artifacts` with bearer-token auth: ```bash -curl -sS -X POST "$AGENTFEED_URL/api/artifacts" \ - -H "Authorization: Bearer $AGENTFEED_TOKEN" \ +curl -sS -X POST "$DAYBOOK_URL/api/artifacts" \ + -H "Authorization: Bearer $DAYBOOK_TOKEN" \ -H "Content-Type: application/json" \ -d '{"kind":"markdown","title":"Build Report","source":"agent","content":"# Hello\n\nBody text."}' ``` @@ -245,12 +245,12 @@ curl -sS -X POST "$AGENTFEED_URL/api/artifacts" \ File/image artifacts use multipart instead: ```bash -curl -sS -X POST "$AGENTFEED_URL/api/artifacts" \ - -H "Authorization: Bearer $AGENTFEED_TOKEN" \ +curl -sS -X POST "$DAYBOOK_URL/api/artifacts" \ + -H "Authorization: Bearer $DAYBOOK_TOKEN" \ -F "kind=image" -F "title=Architecture Diagram" -F "source=agent" \ -F "file=@diagram.png" ``` -`GET $AGENTFEED_URL/api/capabilities` (no auth needed beyond a login/token per +`GET $DAYBOOK_URL/api/capabilities` (no auth needed beyond a login/token per that instance's config) lists supported kinds, methods, and the server version if you need to confirm the contract before posting. diff --git a/skills/agentfeed-posting/scripts/agentfeed_post.py b/skills/daybook-posting/scripts/daybook_post.py similarity index 95% rename from skills/agentfeed-posting/scripts/agentfeed_post.py rename to skills/daybook-posting/scripts/daybook_post.py index 4d676de..659fbd4 100644 --- a/skills/agentfeed-posting/scripts/agentfeed_post.py +++ b/skills/daybook-posting/scripts/daybook_post.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""Post artifacts to AgentFeed without shell-specific JSON or multipart quoting. +"""Post artifacts to Daybook without shell-specific JSON or multipart quoting. Zero third-party dependencies. Content comes from a file or stdin so agents do not need to inline multiline JSON/HTML/Markdown in shell commands. @@ -26,11 +26,11 @@ DEFAULT_SOURCE = "agent" def main(): args = parse_args() - base_url = os.environ.get("AGENTFEED_URL", DEFAULT_URL).rstrip("/") - # AGENTFEED_TOKEN is your personal per-user token (Settings -> API Keys in the app); + base_url = os.environ.get("DAYBOOK_URL", DEFAULT_URL).rstrip("/") + # DAYBOOK_TOKEN is your personal per-user token (Settings -> Account in the app); # there is no shared fallback token, so posting without it cannot work. - token = os.environ.get("AGENTFEED_TOKEN", "") - source = args.source or os.environ.get("AGENTFEED_SOURCE", DEFAULT_SOURCE) + token = os.environ.get("DAYBOOK_TOKEN", "") + source = args.source or os.environ.get("DAYBOOK_SOURCE", DEFAULT_SOURCE) if args.check: try: @@ -43,8 +43,8 @@ def main(): if not token: print( - "error: AGENTFEED_TOKEN is not set. Get your personal API token from " - f"{base_url}/settings/api-keys/ and set AGENTFEED_TOKEN.", + "error: DAYBOOK_TOKEN is not set. Get your personal API token from " + f"{base_url}/settings/account/ and set DAYBOOK_TOKEN.", file=sys.stderr, ) return 2 @@ -84,11 +84,11 @@ def main(): def parse_args(): - parser = argparse.ArgumentParser(description="Publish an artifact to AgentFeed.") + parser = argparse.ArgumentParser(description="Publish an artifact to Daybook.") parser.add_argument("path", nargs="?", help="Auto mode: one file path. Kind, content-type, and title are inferred. The simplest way to post.") parser.add_argument("--kind", choices=sorted(TEXT_KINDS), help="Text artifact kind. Omit when using --file or a positional path.") parser.add_argument("--title", help="Artifact title. Required unless --check is used.") - parser.add_argument("--source", help="Artifact source (agent-profile, script, or person name). Defaults to AGENTFEED_SOURCE or 'agent'.") + parser.add_argument("--source", help="Artifact source (agent-profile, script, or person name). Defaults to DAYBOOK_SOURCE or 'agent'.") parser.add_argument("--content-file", help="Read text artifact content from this file.") parser.add_argument("--file", help="Upload this file as image/pdf/binary, or render as markdown with --as-markdown.") parser.add_argument("--tags", help="Comma-separated tags.") @@ -352,7 +352,7 @@ def post_payload(base_url, token, payload, args): def multipart_body(payload): - boundary = f"----agentfeed-{uuid.uuid4().hex}" + boundary = f"----daybook-{uuid.uuid4().hex}" chunks = [] upload_path = payload["upload_path"] for key, value in payload.items(): @@ -394,11 +394,11 @@ def content_type_for(path): def upload_asset(base_url, token, path): - """Upload an image and return its AgentFeed URL for embedding in content.""" + """Upload an image and return its Daybook URL for embedding in content.""" if not path.is_file(): raise ValueError(f"image file does not exist: {path}") - boundary = f"----agentfeed-{uuid.uuid4().hex}" + boundary = f"----daybook-{uuid.uuid4().hex}" chunks = [ f"--{boundary}\r\n".encode("utf-8"), f'Content-Disposition: form-data; name="file"; filename="{path.name}"\r\n'.encode("utf-8"), diff --git a/static/agentfeed.css b/static/daybook.css similarity index 100% rename from static/agentfeed.css rename to static/daybook.css diff --git a/templates/artifacts/_topbar.html b/templates/artifacts/_topbar.html index cda9526..c63dfe7 100644 --- a/templates/artifacts/_topbar.html +++ b/templates/artifacts/_topbar.html @@ -1,4 +1,4 @@ -{% load agentfeed_extras %} +{% load daybook_extras %}

AgentFeed

 @@ -48,10 +48,10 @@ const isDark = document.documentElement.getAttribute("data-theme") === "dark"; if (isDark) { document.documentElement.removeAttribute("data-theme"); - try { localStorage.setItem("agentfeed.theme", "light"); } catch (e) {} + try { localStorage.setItem("daybook.theme", "light"); } catch (e) {} } else { document.documentElement.setAttribute("data-theme", "dark"); - try { localStorage.setItem("agentfeed.theme", "dark"); } catch (e) {} + try { localStorage.setItem("daybook.theme", "dark"); } catch (e) {} } syncLabel(); }); diff --git a/templates/artifacts/feed.html b/templates/artifacts/feed.html index 55bfdb7..c482a60 100644 --- a/templates/artifacts/feed.html +++ b/templates/artifacts/feed.html @@ -6,12 +6,12 @@ AgentFeed - + "), 3) # The escaped content must still round-trip to the exact original value. - start = stored_html.index('id="agentfeed-data">') + len('id="agentfeed-data">') + start = stored_html.index('id="daybook-data">') + len('id="daybook-data">') end = stored_html.index("", start) embedded = stored_html[start:end] self.assertEqual(json.loads(embedded)["value"], "") diff --git a/tests/scripts/test_agentfeed_post.py b/tests/scripts/test_daybook_post.py similarity index 60% rename from tests/scripts/test_agentfeed_post.py rename to tests/scripts/test_daybook_post.py index b84551b..b6d0aa0 100644 --- a/tests/scripts/test_agentfeed_post.py +++ b/tests/scripts/test_daybook_post.py @@ -6,76 +6,76 @@ from pathlib import Path SCRIPT_PATH = ( Path(__file__).resolve().parents[2] / "skills" - / "agentfeed-posting" + / "daybook-posting" / "scripts" - / "agentfeed_post.py" + / "daybook_post.py" ) def _load_module(): - spec = importlib.util.spec_from_file_location("agentfeed_post", SCRIPT_PATH) + spec = importlib.util.spec_from_file_location("daybook_post", SCRIPT_PATH) module = importlib.util.module_from_spec(spec) spec.loader.exec_module(module) return module -agentfeed_post = _load_module() +daybook_post = _load_module() class SniffTextKindTestCase(unittest.TestCase): def test_markdown_suffixes(self): for suffix in (".md", ".markdown", ".txt"): - self.assertEqual(agentfeed_post.sniff_text_kind(suffix, "anything"), "markdown") + self.assertEqual(daybook_post.sniff_text_kind(suffix, "anything"), "markdown") def test_json_suffix(self): - self.assertEqual(agentfeed_post.sniff_text_kind(".json", '{"a": 1}'), "json") + self.assertEqual(daybook_post.sniff_text_kind(".json", '{"a": 1}'), "json") def test_csv_suffix(self): - self.assertEqual(agentfeed_post.sniff_text_kind(".csv", "a,b\n1,2"), "csv") + self.assertEqual(daybook_post.sniff_text_kind(".csv", "a,b\n1,2"), "csv") def test_html_full_sniffed_from_content(self): self.assertEqual( - agentfeed_post.sniff_text_kind(".html", ""), "html_full" + daybook_post.sniff_text_kind(".html", ""), "html_full" ) def test_deck_sniffed_from_content(self): - self.assertEqual(agentfeed_post.sniff_text_kind(".html", "
slide
"), "deck") + self.assertEqual(daybook_post.sniff_text_kind(".html", "
slide
"), "deck") def test_html_fragment_is_the_fallback(self): - self.assertEqual(agentfeed_post.sniff_text_kind(".html", "

hi

"), "html_fragment") + self.assertEqual(daybook_post.sniff_text_kind(".html", "

hi

"), "html_fragment") class ValidatePayloadTestCase(unittest.TestCase): def test_valid_json_passes(self): - agentfeed_post.validate_payload({"kind": "json", "content": '{"a": 1}'}, None) # no raise + daybook_post.validate_payload({"kind": "json", "content": '{"a": 1}'}, None) # no raise def test_invalid_json_raises(self): with self.assertRaises(ValueError): - agentfeed_post.validate_payload({"kind": "json", "content": "{not json"}, None) + daybook_post.validate_payload({"kind": "json", "content": "{not json"}, None) def test_deck_without_section_raises(self): with self.assertRaises(ValueError): - agentfeed_post.validate_payload({"kind": "deck", "content": "

no slides

"}, None) + daybook_post.validate_payload({"kind": "deck", "content": "

no slides

"}, None) def test_html_fragment_with_nested_html_raises(self): with self.assertRaises(ValueError): - agentfeed_post.validate_payload( + daybook_post.validate_payload( {"kind": "html_fragment", "content": "x"}, None ) def test_html_full_without_html_tag_raises(self): with self.assertRaises(ValueError): - agentfeed_post.validate_payload({"kind": "html_full", "content": "

x

"}, None) + daybook_post.validate_payload({"kind": "html_full", "content": "

x

"}, None) def test_blank_markdown_raises(self): with self.assertRaises(ValueError): - agentfeed_post.validate_payload({"kind": "markdown", "content": " "}, None) + daybook_post.validate_payload({"kind": "markdown", "content": " "}, None) def test_csv_has_no_shape_check(self): - agentfeed_post.validate_payload({"kind": "csv", "content": "anything at all"}, None) # no raise + daybook_post.validate_payload({"kind": "csv", "content": "anything at all"}, None) # no raise def test_upload_path_skips_all_checks(self): - agentfeed_post.validate_payload({"upload_path": Path("whatever.png")}, None) # no raise + daybook_post.validate_payload({"upload_path": Path("whatever.png")}, None) # no raise class ResolveAutoPathTestCase(unittest.TestCase): @@ -93,7 +93,7 @@ class ResolveAutoPathTestCase(unittest.TestCase): with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / "data.json" path.write_text('{"a": 1}', encoding="utf-8") - args = agentfeed_post.resolve_auto_path(self._args(path)) + args = daybook_post.resolve_auto_path(self._args(path)) self.assertEqual(args.kind, "json") self.assertEqual(args.content_file, str(path)) @@ -101,14 +101,14 @@ class ResolveAutoPathTestCase(unittest.TestCase): with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / "data.csv" path.write_text("a,b\n1,2", encoding="utf-8") - args = agentfeed_post.resolve_auto_path(self._args(path)) + args = daybook_post.resolve_auto_path(self._args(path)) self.assertEqual(args.kind, "csv") def test_image_file_becomes_multipart_upload(self): with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / "chart.png" path.write_bytes(b"\x89PNG\r\n") - args = agentfeed_post.resolve_auto_path(self._args(path)) + args = daybook_post.resolve_auto_path(self._args(path)) self.assertIsNone(args.kind) self.assertEqual(args.file, str(path)) diff --git a/tests/unit/test_storage.py b/tests/unit/test_storage.py index df49e5f..ddc075d 100644 --- a/tests/unit/test_storage.py +++ b/tests/unit/test_storage.py @@ -16,7 +16,7 @@ class MakeRoomForTestCase(TestCase): @classmethod def setUpClass(cls): super().setUpClass() - cls.artifacts_root = Path(tempfile.mkdtemp(prefix="agentfeed-test-storage-")) + cls.artifacts_root = Path(tempfile.mkdtemp(prefix="daybook-test-storage-")) cls.settings_override = override_settings(ARTIFACTS_ROOT=cls.artifacts_root) cls.settings_override.enable() diff --git a/tests/views/test_sharing.py b/tests/views/test_sharing.py index d25e0de..ab2c893 100644 --- a/tests/views/test_sharing.py +++ b/tests/views/test_sharing.py @@ -16,7 +16,7 @@ class SharingTestCase(TestCase): @classmethod def setUpClass(cls): super().setUpClass() - cls.artifacts_root = Path(tempfile.mkdtemp(prefix="agentfeed-test-sharing-")) + cls.artifacts_root = Path(tempfile.mkdtemp(prefix="daybook-test-sharing-")) cls.settings_override = override_settings(ARTIFACTS_ROOT=cls.artifacts_root) cls.settings_override.enable()