BountyBoard

etalon/BountyBoard

Fork 0

Commit Graph

Author	SHA1	Message	Date
etalon	35168b9b83	fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir - chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML entities the browser emits (e.g.   for the space after a mention chip, or & for a typed "&") no longer render as literal " "/"&". Re-escaping keeps output XSS-safe. Adds regression tests. - Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo data dir (700-perm files); Makefile lint now gofmt's tracked files only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-13 12:26:32 +02:00
etalon	0676f53280	chore: bind-mount docker volumes under the repo (./volumes), gitignore them Replace the named volumes mongo-data and work-data with bind mounts to ./volumes/mongo and ./volumes/work so all runtime state lives under the repo tree. Existing data was migrated; the old named volumes were removed. The ${HOME}/.claude host-credential mounts are intentionally left as-is (must not live in the repo). Added /volumes/ to .gitignore. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-13 12:15:46 +02:00
etalon	976f5238f8	feat: scaffold app skeleton with config, ULID, health endpoints, compose stack (phase 1) - internal .env loader (real env wins) + strictly validated config struct - ULID package: 48-bit ms timestamp + 80-bit crypto randomness, sortable - HTTP server with recovery/request-id/trusted-proxy/access-log middleware - /healthz, /readyz (pluggable checkers), /metricsz (counter registry) - multi-stage Dockerfile (alpine, non-root) + compose with healthchecks, app bound to 127.0.0.1:8787, mongo unpublished, graceful 15s shutdown Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 18:10:30 +02:00

Author

SHA1

Message

Date

etalon

35168b9b83

fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g. &nbsp; for the space after a mention chip,
  or &amp; for a typed "&") no longer render as literal "&nbsp;"/"&amp;".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-13 12:26:32 +02:00

etalon

0676f53280

chore: bind-mount docker volumes under the repo (./volumes), gitignore them

Replace the named volumes mongo-data and work-data with bind mounts to
./volumes/mongo and ./volumes/work so all runtime state lives under the repo
tree. Existing data was migrated; the old named volumes were removed. The
${HOME}/.claude host-credential mounts are intentionally left as-is (must not
live in the repo). Added /volumes/ to .gitignore.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-13 12:15:46 +02:00

etalon

976f5238f8

feat: scaffold app skeleton with config, ULID, health endpoints, compose stack (phase 1)

- internal .env loader (real env wins) + strictly validated config struct
- ULID package: 48-bit ms timestamp + 80-bit crypto randomness, sortable
- HTTP server with recovery/request-id/trusted-proxy/access-log middleware
- /healthz, /readyz (pluggable checkers), /metricsz (counter registry)
- multi-stage Dockerfile (alpine, non-root) + compose with healthchecks,
  app bound to 127.0.0.1:8787, mongo unpublished, graceful 15s shutdown

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-12 18:10:30 +02:00

3 Commits