Tags: Xe/x
Tags
chore(release): 1.31.0 [skip ci] # [1.31.0](v1.30.0...v1.31.0) (2026-07-12) ### Bug Fixes * kube ([af5066f](af5066f)) * **kube:** add services lol ([523adfe](523adfe)) * **lint-staged:** remove unnecessary braces from go glob pattern ([29c1e32](29c1e32)) * **mi:** resolve multiple bugs in cmd/mi ([b8d7138](b8d7138)) * **within.website:** use <pre><code> for go get snippet ([1344e4b](1344e4b)) * **xess:** drop blockquote left border ([b4536b9](b4536b9)) ### Features * add design.within.website demo site for xess ([2331f46](2331f46)) * **kube/alrest:** add lurker ([57e00fe](57e00fe)) * **kube:** import base saga cluster config ([d145106](d145106)) * **license:** add non-ai licenses ([8ae3e94](8ae3e94)) * **mi/mcp:** add event management tools ([c0c0ef5](c0c0ef5)) * **mi:** add member name alias support to switch tracker ([#863](#863)) ([d3f7e04](d3f7e04)) * **mi:** add Zoe as nickname for W'zamqo ([585f90f](585f90f)) * **mimi:** remove falin image generation service ([a3a3e35](a3a3e35)) * **sigv4:** add AWS SigV4 request authentication and IAM daemon ([#957](#957)) ([d2f2e00](d2f2e00)) * **skills:** xe-go-style skill added ([c79a11b](c79a11b)) * **web:** add alpine.js package ([c0d23b4](c0d23b4)) * **xess:** adopt xe-design-system tokens and add button/card/tag components ([1c62860](1c62860)) ### BREAKING CHANGES * **sigv4:** iamsts.NewVerifier is replaced by iamsts.New(Config); iamsts.Identity now carries TokenIdentity fields (PrincipalID) instead of an iamv1.User. Signed-off-by: Xe Iaso <me@xeiaso.net> * test(iamd): cover the signing-key local-verification chain end to end Signed-off-by: Xe Iaso <me@xeiaso.net> * refactor(iam)!: delete the per-request STS verification flow Removes STSService/GetCallerIdentity (proto, generated stubs, iamd handler, and sigv4.VerifySignature) now that downstream services verify locally with cached derived signing keys. The deleted double-slash-path test guarded VerifySignature's synthetic request construction, which is removed with it; the local path reads r.URL from net/http's own parser. * **sigv4:** the STSService Twirp/gRPC/Connect APIs no longer exist; downstream verifiers must upgrade to iamsts.New + SigningKeyService. Signed-off-by: Xe Iaso <me@xeiaso.net> * docs: remove stale references to the deleted central STS verify flow Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(sigv4): record the move to derived signing key caching Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(iamsts): detach signing-key fetch from the caller's request context The singleflight leader in entry() ran the GetSigningKey RPC on the first caller's request context, so a client disconnecting mid-RPC for an uncached scope canceled the fetch and failed every request collapsed onto it with a 500 — an attacker could trigger this burst deliberately by opening a request and dropping the connection. The fetch now runs on a context detached from the caller via context.WithoutCancel (keeping trace/log values) with its own 10s timeout replacing the dropped deadline. Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(iamd): reject non-positive -signing-key-cache-ttl at startup A zero or negative TTL makes every GetSigningKey response effectively use-once, silently degrading downstream verifiers from a cached warm-path lookup to an RPC on every request. Fail startup instead of letting this misconfiguration degrade quietly under load. Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(sigv4): record signing-key distribution trust model and current iamd role Update the components table to reflect that iamd now serves the signing-key distribution server rather than a planned STS validation server, mark the superseded forwarded-material security-model section as historical, and record the trust trade-off the final review surfaced: any authenticated IAM principal can currently fetch any principal's derived signing key for the fleet scope, attributed by caller in logs/metrics, with a verifier allowlist noted as a follow-up if trust tiers diverge. Signed-off-by: Xe Iaso <me@xeiaso.net> * build(iamd): add docker bake target and Dockerfile Two-stage build matching the repo's existing service images (golang:1.25 build with cache mounts, debian:bookworm runtime). The SQLite database lives on a /data volume so state survives container replacement; built for amd64 and arm64 since the ncruces SQLite driver is CGO-free. Added to the default bake group. Assisted-by: Fable 5 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(iamsts): add twirp integration guide Shows how to wire the caching verifier into a Twirp API mux: signed transport for the key fetches, one shared verifier per process, per-route middleware wrapping, reading the caller identity, and the operational behaviors (error mapping, outage semantics, revocation latency, midnight rollover). Assisted-by: Fable 5 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: commit stuff Signed-off-by: Xe Iaso <me@xeiaso.net> * refactor(sigv4): extract shared signing internals into awssig Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(sigv4a): add ecdsa p-256 key derivation with aws test vectors Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(sigv4a): add x-amz-region-set matching Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(awssig): match aws canonicalization for quoted spaces and raw utf-8 paths collapseSpaces preserved runs of spaces inside double-quoted header values, but neither aws-sdk-go-v2's v4 signer nor the aws-c-auth v4a test vectors special-case quotes; both collapse whitespace runs unconditionally. CanonicalURI re-percent-encoded r.URL.EscapedPath(), which reproduces AWS's double-encoding correctly when the wire path is already percent-encoded ASCII, but fabricates a fresh single-encoded path for raw, unescaped UTF-8 wire bytes -- encoding that a second time double-encodes it. Canonicalize the literal wire path (r.RequestURI) instead, falling back to EscapedPath() for client-constructed requests that never went through the wire. Caught by the sigv4a vector suite (get-header-value-trim, get-utf8); sigv4's SDK round-trip tests and iamd's integration tests pass unchanged, confirming classic SigV4 compatibility holds. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(sigv4a): add request verifier middleware Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(sigv4a): treat nil public key from lookup as unknown key A PublicKeyLookuper returning (nil, nil) left pub == nil, err == nil, reaching ecdsa.VerifyASN1(nil, ...), which panics because it dereferences pub.Curve unconditionally -- a DoS of this auth middleware once a real KeyLookup is wired in. Treat a nil key as ErrUnknownKey instead. Adds coverage for the KeyLookup branch (previously untested) and for a malformed-hex Signature= value. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(sigv4a): add request signer and sigv4aclient transport Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(iamd): serve sigv4a public verification keys via GetPublicKey Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: exempt sigv4a test vectors from prettier npm run format was reformatting the aws-c-auth vector fixtures, which must stay byte-identical to upstream. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(sigv4a): add iamsts public-key caching verifier Signed-off-by: Xe Iaso <me@xeiaso.net> * test(sigv4a/iamsts): make TTL-sweep test table-driven Restructure the fresh (non-ported) TTL-expiry sweep test into a table of ordered steps per the repo's go-table-driven-tests conventions, since it wasn't inherited from the classic package. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(iamd)!: authenticate callers with sigv4a * **sigv4:** iamd's middleware now accepts only AWS4-ECDSA-P256-SHA256 signatures; clients must sign with sigv4aclient (or sigv4a.Signer) instead of sigv4client. Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(sigv4a): record public-key trust model and add iamsts guide Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(twirpslog): restore caller attribution for sigv4a-authenticated services iamd's UserMiddleware now stores the verified caller via sigv4a.WithUser, a different context key than the classic sigv4.WithUser the interceptor checked. Twirp logs and the per-user billing counter silently lost attribution for every sigv4a-verified call. Check the sigv4a sources first, falling back to the classic sigv4/sigv4a.iamsts pair kept for the retained classic chain. Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(sigv4a): note twirpslog attribution works for sigv4a callers Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(sigv4aclient): set GetBody so redirects and retries can rewind the body Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(iamd): read the caller from the sigv4a context in KeyService The SigV4A cutover left KeyService reading the caller from the classic sigv4 context key that UserMiddleware no longer populates, so every KeyService RPC failed closed with an unauthenticated caller. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(iamd): accept both sigv4 and sigv4a signatures Dispatch on the Authorization header's algorithm token so classic SigV4 and SigV4A callers both authenticate through the same DAO-backed credentials; classic traffic stays observable via iamd_auth_requests_total while it drains. Signed-off-by: Xe Iaso <me@xeiaso.net> * refactor(middleware): unify caller identity context in authctx Two real bugs (a KeyService handler failing closed on the wrong family's key, and a twirpslog attribution regression) came from sigv4 and sigv4a each keeping their own unexported context keys for the same caller identity; this introduces web/middleware/authctx as the single canonical storage that all four packages delegate to, with no exported API changes. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(sigv4any): add dual-algorithm dispatch middleware Lift the Authorization-header dispatch pattern (classic SigV4 vs SigV4A) into a reusable middleware so any service can accept either algorithm without hand-rolling the switch, while keeping metric wiring pluggable via an Observe hook instead of a hard prometheus dependency. Signed-off-by: Xe Iaso <me@xeiaso.net> * refactor(iamd): use sigv4any for dual-algorithm auth Replace iamd's hand-rolled Authorization-header dispatch with the new sigv4any.Verifier, keeping the iamd_auth_requests_total counter wired through Observe. cmd/iamd/integration_test.go is the equivalence proof and passes unchanged. Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(iam): wrap errors from DisableKey and ListKeys The disable command returned the raw DisableKey error and had a duplicated dead err check left over from a copy-paste; the list command never checked the ListKeys error at all. Wrap both so failures surface a descriptive message. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(iam): wrap error from ListUsers The user list command ignored the ListUsers error and proceeded to render an empty result. Check and wrap it so failures surface a descriptive message, matching the keys command. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(saga): add iamd and route53 dyndns manifests plus sigv4a plan Deploy iamd to the saga cluster with sigv4a signing-key cache config, add a route53 dynamic DNS deployment, and check in the sigv4a migration plan doc. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(saga): remove invalid value on AWS_SECRET_ACCESS_KEY env var The env var set both valueFrom.secretKeyRef and a literal value, which Kubernetes rejects. Drop the leftover placeholder value so the manifest applies. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: nuke sins Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Mimi Yasomi <mimi@techaro.lol>
chore(release): 1.30.0 [skip ci] # [1.30.0](v1.29.0...v1.30.0) (2026-02-16) ### Bug Fixes * **falin:** resolve npm ci dependency conflict ([#835](#835)) ([683bff8](683bff8)) * **mi:** use blog post summary in Bluesky embed description ([#848](#848)) ([7491810](7491810)) * **nguh:** return error for unsupported tokens ([d1a50e7](d1a50e7)) * **skills/xe-writing-style:** update details about successive paragraph starting letter rule ([5808b2b](5808b2b)) * **skills/xe-writing-style:** wumbofy this with Opus ([cea6609](cea6609)) * **useragent:** use filepath.Base for os.Args[0] in GenUserAgent ([#830](#830)) ([3ef21d9](3ef21d9)) * **web:** replace deprecated io/ioutil with io ([#829](#829)) ([fee5e4f](fee5e4f)) ### Features * **cmd/x:** add ai-add-provider and ai-list-models subcommands ([#850](#850)) ([bba7f41](bba7f41)) * **python:** accept io/fs.FS as root filesystem parameter ([#813](#813)) ([87b97e8](87b97e8)) * **reviewbot:** add Python interpreter with repo filesystem ([#814](#814)) ([b40ff1c](b40ff1c)) * **sakurajima:** add HTTP request timeouts to prevent hanging connections ([#837](#837)) ([d50a792](d50a792)) * **sakurajima:** add request size limits to prevent DoS attacks ([#838](#838)) ([f207855](f207855)) * **sakurajima:** add request size limits to prevent DoS attacks ([#839](#839)) ([80dd84a](80dd84a)) * **sakurajima:** production readiness fixes and enhancements ([#834](#834)) ([4368e6f](4368e6f)) * **sapientwindex:** add state to prevent double-posts ([#825](#825)) ([6ba9223](6ba9223)) * **skills:** add experimental Xe writing style skill ([baed3bd](baed3bd)) * **skills:** add Go table-driven tests skill ([#817](#817)) ([a2e35ea](a2e35ea)) * **store:** add filesystem backends (DirectFile, JSONMutexDB, CAS) ([#824](#824)) ([4f694cf](4f694cf)) * **totpgen:** add TOTP code generator command ([#833](#833)) ([d0a556d](d0a556d)) ### BREAKING CHANGES * **python:** llm/codeinterpreter/python.Run() now takes fs.FS as first parameter Assisted-by: GLM 4.6 via Claude Code Reviewbot-request: yes Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Mimi Yasomi <mimi@techaro.lol>
chore(release): 1.28.0 [skip ci] # [1.28.0](v1.27.0...v1.28.0) (2026-01-10) ### Bug Fixes * **reviewbot:** add desired output format to the system prompt ([7cb3f98](7cb3f98)) ### Features * add reviewbot prototype ([1ea29dd](1ea29dd)) * **reviewbot:** add auto-trigger via commit footer ([91726b2](91726b2)) * **reviewbot:** if no tool call, default to leaving a PR comment ([#809](#809)) ([c530dd7](c530dd7)) * **skills:** add templ-htmx skill using local htmx package ([ad16a19](ad16a19)) Signed-off-by: Mimi Yasomi <mimi@techaro.lol>
chore(release): 1.27.0 [skip ci] # [1.27.0](v1.26.1...v1.27.0) (2026-01-08) ### Bug Fixes * **package.json:** use Signed-off-by instead of Signed-Off-By ([c2406e3](c2406e3)) * **yeetfile:** build sysexts ([c9b3ab7](c9b3ab7)) ### Features * add 7-day cooldown to dependabot updates ([#791](#791)) ([1a5d9d3](1a5d9d3)) * add attention attenuator package ([6ca9c01](6ca9c01)) * add claude-code-cfg package ([73798a3](73798a3)) * **kube/alrest:** add mcp-auth sidecar ([e56238b](e56238b)) * **mi:** add birthday field to Member model ([#784](#784)) ([69bff8e](69bff8e)) * require Signed-off-by in commit messages ([#785](#785)) ([7e1c910](7e1c910)) Signed-off-by: Mimi Yasomi <mimi@techaro.lol>
chore(release): 1.25.0 [skip ci] # [1.25.0](v1.24.0...v1.25.0) (2025-10-30) ### Bug Fixes * a bunch of things ([113cde3](113cde3)) * bump versions of things in kube ([94ef124](94ef124)) * **httpdebug:** log request info ([b7c3bcb](b7c3bcb)) * oops ([1796967](1796967)) * **sakurajima:** fix tests ([5549686](5549686)) ### Features * add httpdebug Docker target and Dockerfile ([b428337](b428337)) * add shiroko k8s ([0172f70](0172f70)) * add W'zamqo as valid member name and update suggestions ([d0fff60](d0fff60)) * **cmd/httpdebug:** enhance security and functionality ([0c0f8ea](0c0f8ea)) * **cmd/mi:** add MCP server for completely bad ideas ([673dbbd](673dbbd)) * cmd/sakurajima ([86de439](86de439)) * **cmd/sakurajima:** add autocert config settings ([0017dc0](0017dc0)) * **cmd/x:** fix switch command ([616d8b4](616d8b4)) * **cmd/x:** port list-switches command over ([edd2e48](edd2e48)) * **cmd:** add x-browser-validation test program ([8c0154e](8c0154e)) * **sakurajima:** add the rigging for log filtering logic ([0274cf3](0274cf3)) * **sakurajima:** implement access logs / logrotate logic ([8b68476](8b68476)) * **sakurajima:** log filters ([b4a5f77](b4a5f77)) * **stickers:** use branded presigned URLs ([5223d77](5223d77)) Signed-Off-By: Mimi Yasomi <mimi@techaro.lol>
chore(release): 1.24.0 [skip ci] # [1.24.0](v1.23.0...v1.24.0) (2025-07-15) ### Features * **cmd/httpdebug:** add HTTP method and URI to output ([158fb5b](158fb5b)) * **cmd/relayd:** ja4t / ja4h fingerprinting ([e810bdb](e810bdb)) * **fish-config:** build a deb too I guess ([063d5c0](063d5c0)) * **fish-config:** dotenv.fish ([7c8b929](7c8b929)) * **pb/relayd:** add fingerprints object ([2fc470c](2fc470c)) Signed-Off-By: Mimi Yasomi <mimi@techaro.lol>
chore(release): 1.23.0 [skip ci] # [1.23.0](v1.22.0...v1.23.0) (2025-06-28) ### Bug Fixes * **fish-config:** make fish prompt compatible with vs code ([484b614](484b614)) * **fish-prompt:** clean up theme ([d00dabd](d00dabd)) * **mi:** enable reflection ([b264671](b264671)) ### Features * **pkgs/fish-config:** add autols, autopair, fisher, and nvm ([2a8ccb5](2a8ccb5)) Signed-Off-By: Mimi Yasomi <mimi@techaro.lol>
PreviousNext