Lucas WintherandClaude Opus 5.5
f2169a1235
Review fix round 1. - Secret box v2 tokens: one HKDF key per purpose (byok, server-api-key, mcp) and AES-GCM AAD bound to the row (user id + provider; server id + field). MCP env and headers are sealed per field. open() refuses v1 tokens; the data upgrade re-seals v1 keys, v1 plaintext MCP values and the draft secretCipher, and marks ai_secrets_v2 only when nothing legacy is left (retried until the previous secret is back). - Unreadable secrets are reported (admin: unreadableSecrets with server and field; user: byok.keyUnreadable), logged at startup, and kept on save unless replaced or cleared (clearApiKey, clearSecrets). The admin and account pages show the warnings. - allowedOrigins and provider resolution no longer open MCP secrets. Co-Authored-By: Claude Opus 5.5 <[email protected]>
STCourses
STCourses is a self-hosted course platform. Homelabbers, universities and companies host their own courses, plus material they already own such as Packt video packages or Pluralsight slide PDFs, in one place that tracks progress. Authors write in Markdown in a git repo or in a browser studio; both edit the same files. Each install has one owner and is not multi-tenant.
Development
bun install # install workspace dependencies
bun test # run all tests
bun run typecheck # tsc --noEmit
bun run dev # start the server with hot reload
Running it
STC_SECRET=... docker compose up -d (add --profile postgres and STC_DATABASE_URL for Postgres). Mounts,
configuration and the measured memory budget are in docs/operations.md.
License: AGPL-3.0-only.