pansy

174 Commits 11 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
steveandClaude Fable 5	608ef7c58e	Address #131 review: unknown link action is unknown, typed views, one share shape Build image / build-and-push (push) Successful in 13s Details - public_link checks the action before the confirmation gate, so an unknown action is told so instead of being asked to confirm nothing in particular (the 4/4 finding). - linkView is a struct like shareView; toShareView builds the five share results, and a fresh share is read back so it carries the person's name like every other path. - PublicShareURL trims a trailing slash off a hand-built base URL. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-08-23 02:21:04 -04:00
steveandClaude Fable 5	f985c264f8	Agent: sharing tools that ask first, and a hard delete for a misplaced plop Build image / build-and-push (push) Successful in 10s Details Gadfly review (reusable) / review (pull_request) Successful in 4m18s Details Adversarial Review (Gadfly) / review (pull_request) Successful in 4m18s Details list_shares, share_garden, remove_share and public_link (get / enable / rotate / disable) wrap the sharing service. They change who can see a garden beyond the screen, so they are gated twice: the prompt tells the model to say exactly what it would do and ask, and the tools refuse without confirmed=true, which their descriptions allow only after a yes in the conversation. The refusal names the action, so the question the model asks is precise. share_garden changes the role of an existing share instead of failing on it; remove_share takes the email list_shares reports; an unknown email explains that the person has to sign in once first. public_link returns the address (PANSY_BASE_URL + /g/<token>, via the new Service.PublicShareURL), never a bare token. delete_planting is the hard delete for a plop that was never really planted, as opposed to remove_planting's "it came out"; it is recorded, so undoable. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-08-23 02:12:51 -04:00
steve	9968c06243	Public read-only share link (no login / no OIDC) (#41 ) (#43 ) Build image / build-and-push (push) Successful in 8s Details Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action. Closes #41. Co-authored-by: Steve Dudenhoeffer <[email protected]>	2026-07-19 06:18:31 +00:00

Author

SHA1

Message

Date

steveandClaude Fable 5

608ef7c58e

Address #131 review: unknown link action is unknown, typed views, one share shape

Build image / build-and-push (push) Successful in 13s

Details

- public_link checks the action before the confirmation gate, so an unknown
  action is told so instead of being asked to confirm nothing in particular
  (the 4/4 finding).
- linkView is a struct like shareView; toShareView builds the five share
  results, and a fresh share is read back so it carries the person's name
  like every other path.
- PublicShareURL trims a trailing slash off a hand-built base URL.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-23 02:21:04 -04:00

steveandClaude Fable 5

f985c264f8

Agent: sharing tools that ask first, and a hard delete for a misplaced plop

Build image / build-and-push (push) Successful in 10s

Details

Gadfly review (reusable) / review (pull_request) Successful in 4m18s

Details

Adversarial Review (Gadfly) / review (pull_request) Successful in 4m18s

Details

list_shares, share_garden, remove_share and public_link (get / enable /
rotate / disable) wrap the sharing service. They change who can see a garden
beyond the screen, so they are gated twice: the prompt tells the model to say
exactly what it would do and ask, and the tools refuse without confirmed=true,
which their descriptions allow only after a yes in the conversation. The
refusal names the action, so the question the model asks is precise.

share_garden changes the role of an existing share instead of failing on it;
remove_share takes the email list_shares reports; an unknown email explains
that the person has to sign in once first. public_link returns the address
(PANSY_BASE_URL + /g/<token>, via the new Service.PublicShareURL), never a
bare token.

delete_planting is the hard delete for a plop that was never really planted,
as opposed to remove_planting's "it came out"; it is recorded, so undoable.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-23 02:12:51 -04:00

steve

9968c06243

Public read-only share link (no login / no OIDC) (#41 ) (#43 )

Build image / build-and-push (push) Successful in 8s

Details

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action.

Closes #41.

Co-authored-by: Steve Dudenhoeffer <[email protected]>

2026-07-19 06:18:31 +00:00