peter fb69261218 Add GET /api/skill endpoint serving the posting skill

Serves skills/daybook-posting/SKILL.md so users/agents can fetch the
posting instructions from the running instance instead of hunting for the
file. The server rewrites the DAYBOOK_URL config line to the request's own
origin, so the text handed to an agent already points at the right server;
the recipient only supplies their token.

- Same auth as /api/capabilities (session or bearer token); no user data.
- Raw text/markdown by default, ?format=json returns {version, url, skill}.
- Advertised via skill_url + a /api/skill methods entry in capabilities.
- Ships in the Docker image (COPY . /app, skills/ not dockerignored).
- Tests for auth, origin rewrite, JSON mode, session auth, capabilities ad.
- docs/api.md + CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-03 15:50:04 +01:00

2.4 KiB

Raw Blame History

Changelog

All notable changes to Daybook are recorded here. Format loosely follows Keep a Changelog; versions are SemVer and match the git tags (vX.Y.Z) and daybook_project.__version__.

Unreleased

Added

GET /api/skill serves the bundled agent-posting skill as Markdown (or ?format=json), with DAYBOOK_URL pre-filled to the instance's own origin so the instructions are ready to hand to an AI. Advertised as skill_url in /api/capabilities.

Changed

Rewrote the posting skill (skills/daybook-posting/SKILL.md) to be location-agnostic: no longer assumes a local source checkout, reframes DAYBOOK_URL as set-your-instance, and adds a raw curl fallback.

0.1.0 — 2026-09-03

First tagged release.

Artifacts & rendering

Artifact kinds: markdown, html_fragment, html_full, deck, json, csv, image, pdf, binary.
.xlsx uploads convert server-side to a csv artifact (active sheet, saved formula results).
Markdown code blocks get syntax highlighting; tables (markdown & html_fragment) render styled — monospace cells, sans-serif headers.
json/csv render as an interactive collapsible tree / sortable table (Grid.js + renderjson, vendored locally).
Unified off-white document background; system sans-serif body text.

API

POST/GET/PATCH/DELETE /api/artifacts, list filters (source/label/day/ kind/q), /api/assets image upload, /api/capabilities (reports version). Per-user bearer-token ingest; session-authed reads.
Server-side validation: per-kind content shape, field length limits, string-typed source fields, valid-JSON for json.

Per-artifact public share links (/s/{token}), owner-toggled, revocable.
Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
Allowlist HTML sanitization (nh3) + script-src 'none' CSP for the themed kinds; deep-JSON parse errors return 400 (not 500).

UI

Multi-user auth; feed with source sidebar + label filtering; settings area (Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.

Deployment

Dockerised (Gunicorn + whitenoise), SQLite, git-based deploy with a runbook (deploy/cloud_agent_deploy.md) and health check.

2.4 KiB Raw Blame History