lucasw89/STCourses
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
37 Commits 1 Branch 0 Tags
f3ce2e34bfa5658809dd3d9b9f9ceff35030bdfd
Commit Graph
37 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lucas WintherandClaude Opus 5.5 f3ce2e34bf fix(ai): lessonUrl builder in one place; authoring follows core canView 
- Learner links go through lessonUrl/courseUrl (src/web/urls.ts).
- Generation, the studio course list and file listing require an authoring
  right and core canView, so a global author needs a grant for a restricted
  course. Contract requests 8 (global author in canView) and 9
  (STC_AI_ALLOWED_BASE_URLS in AppConfig).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:49:48 +01:00
Lucas WintherandClaude Opus 5.5 ead7327bb1 fix(ai): solution and hidden-file guard runs on the canonical real path 
read_file and read_lesson URL-decode, posix-normalise, reject .. and absolute
paths, resolve through CourseRepository.resolvePath (symlinks followed), then
guard the real course-relative path and compare real paths with every
manifest browser.solution. Hidden files are refused too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:48:56 +01:00
Lucas WintherandClaude Opus 5.5 cfc41c6a63 fix(ai): stdio MCP servers get PATH, HOME, LANG and their configured env only 
STC_SECRET, database URLs and API keys are no longer inherited by MCP child
processes. Test: a fake server reports its environment.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:47:47 +01:00
Lucas WintherandClaude Opus 5.5 a13cc66ebb fix(ai): BYOK endpoints limited to official presets and admin-allowed origins (SSRF) 
- A user's own key goes only to https://api.anthropic.com, https://api.openai.com/v1
  or an origin listed in STC_AI_ALLOWED_BASE_URLS / the server config's
  allowedBaseUrls; anything else is a 400, and a stored key whose origin was
  later removed stops being used.
- User-scope provider calls never follow redirects, and their errors reach the
  user only as the HTTP status plus a fixed message; the full text is logged.
- The admin's server-scope provider may still use any base URL.
- Admin UI: allowed origins field; MCP stdio env editable, HTTP headers kept.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:47:25 +01:00
Lucas WintherandClaude Opus 5.5 0ff8e6a5de docs(ai): mark plan tasks done 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:40:02 +01:00
Lucas WintherandClaude Opus 5.5 1f111b80db docs(ai): contract requests; dev fake provider returns a draft file 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:39:58 +01:00
Lucas WintherandClaude Opus 5.5 a47e6e0971 feat(ai): my_progress tool so the assistant sees the learner's progress 
Spec 9.2 has the assistant retrieve from the learner's notes and progress;
progress was missing. Reads progressRepo(db).get for the signed-in user.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:37:25 +01:00
Lucas WintherandClaude Opus 5.5 6fb0019cd9 feat(ai): read the importer's deck and transcript cache; studio DraftWriter fits DraftSink as is 
Retrieval now reads <dataDir>/cache/decks/<courseId>/<deckId>/text.json and
<dataDir>/cache/transcripts/<courseId>/<lessonId>.json (skipped when the lesson
has a transcript file). DraftSink returns { location?, branch?, commit? }, so
the studio's createDraftWriter(ctx) needs no adapter; generateDraft computes
paths itself and reports the draft branch.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 04:36:48 +01:00
Lucas WintherandClaude Opus 5.5 08d3e3f642 feat(ai): assistant panel, AI settings and studio generator UI 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:30:22 +01:00
Lucas WintherandClaude Opus 5.5 a57222ecc3 feat(ai): HTTP routes, chat streaming and generation job 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:25:10 +01:00
Lucas WintherandClaude Opus 5.5 3cec42bba5 feat(ai): house-style generator writing drafts through a DraftSink 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:22:38 +01:00
Lucas WintherandClaude Opus 5.5 49d1df0f13 feat(ai): assistant prompt, course tools and tool loop 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:20:31 +01:00
Lucas WintherandClaude Opus 5.5 24cd6329cb feat(ai): MCP client over stdio and streamable HTTP 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:19:13 +01:00
Lucas WintherandClaude Opus 5.5 50e1e49b6d feat(ai): BM25 course retrieval over lessons, transcripts, code, deck text and notes 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:18:21 +01:00
Lucas WintherandClaude Opus 5.5 76ea0d5101 feat(ai): OpenAI-compatible provider (covers Ollama) 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:16:06 +01:00
Lucas WintherandClaude Opus 5.5 3c2220145b feat(ai): Anthropic provider over fetch with streaming tool use 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:15:33 +01:00
Lucas WintherandClaude Opus 5.5 bccbc692e9 feat(ai): settings repository for server config, BYOK keys and mentor toggles 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:14:29 +01:00
Lucas WintherandClaude Opus 5.5 e1938b5be8 feat(ai): package scaffold and AES-GCM secret box 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:13:50 +01:00
Lucas WintherandClaude Opus 5.5 c2a3464937 docs(ai): WP-D implementation plan 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:13:33 +01:00
Lucas WintherandClaude Opus 5.5 3ca05fcfbc merge: Phase 0 contract 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:07:26 +01:00
Lucas WintherandClaude Opus 5.5 05eee4cd40 feat: server entry and web shell with design tokens 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:05:49 +01:00
Lucas WintherandClaude Opus 5.5 7f33169487 feat(core): config, job queue, range media serving, feature composition 
Adds aclRepo to @stc/db for canView.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:04:46 +01:00
Lucas WintherandClaude Opus 5.5 ea18f18b4f fix(db): use DOUBLE PRECISION for position and progress columns 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:01:31 +01:00
Lucas WintherandClaude Opus 5.5 f061e36092 fix(db): jobs.update writes only patched columns; late progress cannot resurrect a finished job 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 03:01:05 +01:00
Lucas WintherandClaude Opus 5.5 4636273d55 feat(db): progress, notes, attempts, library, jobs repositories 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:59:09 +01:00
Lucas WintherandClaude Opus 5.5 738d813fb8 feat(db): Bun.SQL connection and portable migrations 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:57:34 +01:00
Lucas WintherandClaude Opus 5.5 f71a31a5f1 fix(course-format): validate anchor file via requireFile; real throw test for loadCourse catch 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:55:38 +01:00
Lucas WintherandClaude Opus 5.5 a82ab18bee fix(course-format): directories are not lesson files; a failing course never rejects loadAll 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:54:23 +01:00
Lucas WintherandClaude Opus 5.5 b8c65626f9 feat: overlay manifests for the two reference courses 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:52:24 +01:00
Lucas WintherandClaude Opus 5.5 c78c7ec8d8 feat(course-format): markdown extraction, discovery, loading, repository 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:51:26 +01:00
Lucas WintherandClaude Opus 5.5 7a68800f6f test: sample fixture course 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:50:00 +01:00
Lucas WintherandClaude Opus 5.5 7e7ce30535 feat(course-format): stcourse.yaml schema 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:49:42 +01:00
Lucas WintherandClaude Opus 5.5 3b15d87a5f feat(contracts): shared server, exercise, ai, import and web interfaces 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:48:10 +01:00
Lucas WintherandClaude Opus 5.5 9f582b99d2 chore: bun workspace scaffold 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:47:42 +01:00
Lucas WintherandClaude Opus 5.5 830a0cdd9b chore: ignore worktrees 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:46:38 +01:00
Lucas WintherandClaude Opus 5.5 29ba043de7 Add STCourses implementation plan 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:46:28 +01:00
lucasw89andClaude Opus 5.5 ab96addbab Add STCourses design, research report and approved mockup 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-30 02:37:38 +01:00