8 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	da016e1b94	!dodaj lands in a queue; the management page approves it into the album ... A photo sent to the chat no longer enters the album by itself. pack_add strips it, checks it against the album and the queue, and writes it to pending/ with a sidecar naming the people and labels the sender proposed; the reply is "czeka na zatwierdzenie". The management page lists the queue above the tagger, with the proposal pre-ticked, and Approve moves the file in, mints the labels, records approved_at and asks the bot to rebuild its table through /_reload -- the same publish path every other data change takes, so PackHolder.reload is gone. A reload the bot refuses is reported on the page, not rolled back: the photo is in the album either way. The personal-data gate now reads pending/*.json too, so a label that is still waiting for approval is forbidden in the tree already. The e2e run boots the management page beside the bot with the same environment, proves the queue is stripped and never reaches media/, approves it through the real routes, and has !losowe answer with the photo afterwards without a restart; exiftool is found through media_strip.locate() there rather than PATH, which lacks vendor_perl on Arch. !gadaj is dropped from !odcisz: it was within a typo of !dodaj, and the nearest-command suggestion must never be a coin toss. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-09-04 22:55:39 +02:00
Krzysztof kuhy Rudnicki	a24d0d5905	feat: one page to manage the bot, and the tagger folded into it ... ./web.sh serves health, the configuration and the photo album on 127.0.0.1:8140 -- the port tool/tagger.py vacates. React 19, Vite 8, TypeScript 6.0.3, ESLint 10 with strictTypeChecked + stylisticTypeChecked + unicorn + sonarjs + perfectionist, Vitest 4 at 100% on all four metrics. No coverage exclude list, including for main.tsx. This repository treats a coverage omit as a suppression, and "the DOM bootstrap is awkward to assert" is the same sentence as "this code is untested" -- so the bootstrap is a shim thin enough to test in jsdom, and the album view holds its file list apart from the album so the update path stopped carrying a "what if it is null" branch that cannot happen. An untestable branch is an untested one. TypeScript stays at 6.0.3: typescript-eslint 8.68.0 declares typescript >=4.8.4 <6.1.0, and the fleet-wide allowlist entry says the compiler waits for the linter. The freshness gate then caught two pins the reference repo was carrying stale -- eslint-plugin-unicorn 73 -> 74 and a floating node-version: "24" in CI -- both bumped rather than allowlisted. Traps the gates found, all of them real: - .gitignore has a bare lib/, which matches at any depth, so web/src/lib/ would have been silently untracked. The source lives in src/api/. - CI's shellcheck glob was `run.sh scripts/*.sh`, so tag.sh was unlinted in CI for its whole life and web.sh would have inherited that. Now ./*.sh. - tsconfig.json is strict JSON, not JSONC: check-json is generic and tsconfig being commentable is a convention, not a requirement. - The personal-data gate refused an invented phone number in a test, which is exactly what it is for. The album's warning that names a command moved with the command, and every path that pointed at tool/tagger.py now points at ./web.sh. The historical mentions stay: they explain why the code is shaped as it is. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01416TegJ3sa8xL5qGGgrygP	2026-08-31 14:54:49 +02:00
Krzysztof kuhy Rudnicki	99aa194ad8	fix: the tagger sets up its own venv instead of failing on a missing one ... "python tool/tagger.py --untagged" died with ModuleNotFoundError: fastapi. The dependencies live in .venv and nothing said so. run.sh had the same hole and answered it by printing the two commands to type and exiting 1 -- which is the same rule broken one step further along: a script owns its dependencies, and making the user be the installer is not owning them. scripts/ensure_venv.sh creates .venv and installs the project editable if the interpreter cannot already import fastapi and signal_bot. Idempotent and cheap: the normal case is two file tests and one import check, 0.17s, so entry points call it unconditionally. tag.sh is the tagger's entry point and run.sh now uses the same helper. Verified on a clone with no .venv at all: ./tag.sh --help created the environment, installed the project and printed the usage. Editable on purpose -- a later git pull updates what the tagger runs, which is the same reason install.sh does it that way in the sibling repos. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBrE1b9HvFw3xvG9bJiDFt	2026-08-31 13:28:49 +02:00
Krzysztof kuhy Rudnicki	9d546fef9a	feat: import a folder of photos without importing it twice ... tool/tagger.py did not run at all: 48957a1 renamed pack.default_dir to default_dirs and missed the caller, so the tagger raised ImportError at module scope through two releases. Nothing could have caught it -- tool/ is outside --cov and mypy ran with [signal_bot, fake_signal]. Both are widened here, and tests/test_tool_imports.py imports every script under tool/. --import was a filename check and shutil.copy2. Pointed at a phone export that overlaps the album it re-imported the same photo under whatever name the exporter used that time. It now identifies files by magic bytes, strips them through the same media_strip path !add_photo uses, and dedups on exact bytes twice: the source hash, then -- only for what survives -- the hash after stripping. sources.json records both, so a second run on the same folder is a no-op. What the album refuses is moved to _skipped/<reason>/ beside the source, never deleted. Two things that made "strip on import" impossible until now: media_tags claims -all= zeroes the QuickTime date tags and allows them by value. It does not; measured, it leaves CreateDate at its real value, and every mp4 was being refused. -time:all= is what zeroes them. And a tag allowlist cannot see the worst class at all. IMG_6924.mp4 carries mebx timed-metadata holding per-frame face bounding boxes and a face id, and those survive a complete tag strip because they live in mdat as opaque samples. media_tracks.py drops the track with ffmpeg and verifies with ffprobe that only video and audio survived. This is not the ffmpeg mistake media_strip warns about: that was ffmpeg replacing exiftool for tags, this is track removal with exiftool still doing every tag, and the gate is a positive read-back rather than an exit code. The roster was write-once. The setup form only appeared on an empty album, Album.setup overwrote the file whole, and keys were positional (p{len+1}), so inserting somebody renumbered everyone after them and repointed every tags.json entry at the wrong person. Keys now come from the highest number in use, the form merges, and a person can be added mid-session. --untagged filters the page and never the server's list. /media/{index} and /api/tag both index the full album, so a shorter list server-side would show item i of the album while tagging item i of the filtered set. Measured on the live album: 174 source files -> 1 not media, 82 already in pack, 24 duplicate in batch, 67 imported, and re-running imports nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBrE1b9HvFw3xvG9bJiDFt	2026-08-31 13:22:57 +02:00
Krzysztof kuhy Rudnicki	48957a105d	feat: serve several photo albums at once, each scoped to its own groups ... You asked for !add_photo in testbot without the real album being reachable there. One album cannot do that: its people.json "groups" list *is* the privacy guarantee, so making the commands exist in a second group necessarily makes the real photos postable there. So the bot now loads several albums. PHOTO_PACK_DIR takes a comma-separated list, the spelling GROUP_IDS and TRUSTED_INVITERS already use. Each album carries its own group scope, its own people, its own tags and its own custom labels; they share nothing but the process they run in. That makes trigger collisions between albums legal for the first time, and the registry had to learn it. Two albums are two different sets of people and both may reasonably call somebody "!alfa" -- no message can ever mean both, because a command a group is not scoped to is not a command there at all. So a trigger may be claimed more than once, and DuplicateTriggerError now fires only where the group sets *overlap*. Overlapping albums are refused at startup rather than resolved by registration order: a coin toss about which private album receives a photo is the outcome this whole design exists to prevent. Two consequences worth naming: - registry.resolve() takes an optional group. Without one it still answers "does anything claim this word", which is what pack_add's mint check wants; with one it answers "what runs here", which is what the dispatcher wants. resolve_with_args no longer resolves-then-checks, because with two claimants the first one found may be the wrong group's. - CommandContext moved to signal_bot/context.py to keep registry.py under the 250-line cap. A filing change: that file is "which word runs what", this one is "what the thing that runs may do". DOCS-add-photo.md is likewise a split, not new prose -- DOCS-photo-pack.md had grown past the cap and the ingest path is its own subject now. Verified live: the unit serves both albums, the real group resolves its 13 album commands and testbot its 7, and !losowe / !alfa / !dodaj all fire in testbot through the live dispatcher. 997 tests, 100% branch coverage, 28 e2e scenarios. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JqqE22jp94B1ypwxppdr1o	2026-08-31 11:58:50 +02:00
Krzysztof kuhy Rudnicki	aefffb2fd9	feat: add a photo to the album from the chat, tagged, stripped and verified ... Send a photo captioned "!add_photo alfa wakacje" in one of the album's own groups and it lands in the pack tagged with both, retrievable through !alfa and the new !losowe immediately -- no restart, and no tagger session on the PC. A label matching nobody becomes a custom tag, and !losowe is the only door to one, which is what keeps a live swap a *data* swap: it can never register a trigger or widen a command's groups. No typed label travels. Labels become pseudonym keys in a new registry arg_resolver, at the dispatcher, before the line that logs the command name -- so no handler, journal entry, command_uses row or reply body ever holds a word somebody typed. The reply is counts and pseudonyms: "dodano · p1: 4 · t1: 1". Stripping is exiftool with a *positive* check on the output, never an exit code. ffmpeg was tried first and fails silently on photos: given a JPEG with a real APP1 Exif segment it returned a byte-identical file, GPS intact, exit 0. The surviving-tag allowlist is per tag *name* rather than per group, because measurement showed a group-level "must be empty" rule rejects every format except JPEG -- a valid PNG always reports its IHDR, an MP4 some fifty QuickTime tags that are the container itself. Codec configuration (CompressorName, VendorID, the HEVC parameter set) is on the list by decision: CompressorName lives in the avc1 sample description and exiftool cannot write it at all, so the alternative was refusing every video and every iPhone HEIC. Location and identity tags are still refused, and the e2e run re-reads the stored files to prove a QuickTime geotag did not survive. .webm and .svg stay on the format allowlist and are stored *unstripped*: exiftool 13.55 can write neither, and its SVG reader does not even surface <metadata>. That is a deliberate, documented hole, not an oversight. Two things this had to defuse along the way: - personal_data_sources now reads custom.json, so "!add_photo kot <photo>" would have outlawed the word "kot" and refused every future commit, fixable only by hand-editing an album the committer cannot see. Minting now refuses a word that is already a command, and the gate subtracts the repo's own alias vocabulary from custom labels only -- curated people.json names are never excused. - signal_bot/external.py is now the single subprocess site in the repository, so ruff's S603 needs exactly one scoped per-file-ignore instead of one per module that shells out. A test asserts nothing else imports subprocess. A failed add changes nothing: media and the three manifests are written, the album is reloaded, and only a load that succeeds is published; a load that fails rolls all four back and keeps serving the pack that was already working, without raising -- Restart=always would turn a ConfigError into a loop. 977 tests, 100% branch coverage, no omits and no suppressions. scripts/e2e.sh gains 8 scenarios driven against the real exiftool on media generated at run time, and asserts the invariants a reply cannot: that a refused upload is not stored, that a message with no attachment leaves custom.json byte-identical, and that signal-cli's own copy of every ingested attachment is gone. Closes TODO-add-photo.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JqqE22jp94B1ypwxppdr1o	2026-08-31 11:20:00 +02:00
Krzysztof kuhy Rudnicki	80c0fa8e45	fix: take real people, numbers and a member's uuid out of a public repository ... This repository is public, and five things in it were not invented. The worst was mine, today: the tagger's help text used the group's actual first names and nicknames as its worked example, in a file that is on GitHub. It uses ala/basia/celina now, like every other example here. The rest predate this work. DOCS-signal-envelopes.md carried the operator's own phone number and the bot's, captured from a live envelope; conftest.py had the same number as its trusted inviter; and test_trust.py pinned a group member's full Signal uuid as a fixture. Numbers keep their shape so the documents still show what a real envelope looks like, but no digit of them belongs to anybody. Comments that reached for a real first name to illustrate the diacritic case now use an invented one. None of this removes them from the history, which is a separate decision. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017w1HZ3cZ7neL3rFdQ6VMBA	2026-08-30 23:01:26 +02:00
Krzysztof kuhy Rudnicki	35102be863	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it ... Per-person photo commands, where the mechanism is public and the album is not. Nothing identifying is in this repository: who the people are, what fires their photos and which file shows whom all live in one directory outside it, and the tests, the docs and the offline e2e run use three invented people instead. Several names in one message intersect -- "!alfa beta" is a photo with both -- and where an entry offers a choice the bot picks among the readings that actually have a photo, so a question the album could answer is not refused. A combination nobody photographed gets one line rather than silence, which from the group's side is indistinguishable from a broken bot. Scoping is enforced in the dispatcher, not in the handler: a command the group is not allowed resolves to nothing, so it is not answered, not counted as a command, and never named in a log line outside its own groups. A handler that quietly returned would leak all three. Commands are named by pseudonym (pack:p1), so the journal and command_uses say somebody asked for a photo and nothing about whose. Video works: the attachment goes out as data:video/mp4;filename=...;base64, which is the container's own spelling, read off its /swagger/doc.json. Told it is a photo, Signal renders a clip as an unplayable file. tool/tagger.py serves one page on loopback to fill the album in -- names are typed into the page, never as arguments, and it prints how many photos each command would have when it stops, because a command with zero is dead on arrival. Also renames the real people who were still sitting in the stats test fixtures. They remain in the history; the point is that nothing new is added to it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017w1HZ3cZ7neL3rFdQ6VMBA	2026-08-30 22:35:41 +02:00