push a directory of html from the terminal and get a four-character url back. a deno cli on cloudflare https://src.rest/cat/nzip/ 2026-10-17T16:55:37-06:00 27878f44b6ff9ab6a40138c0acbdd00a5e8ed42a cat 2026-10-17T16:55:37-06:00 forge attest runs .forge/ci in a clean worktree of each commit and signs the result into refs/notes/ci. It runs the checks CONTRIBUTING.md lists: the Deno workspace tasks, a publish dry run, and the Worker's typecheck, tests and Wrangler dry run. 6ddd211407be97bc6f182d88b9d7b3f456da723f FelineStateMachine 2026-10-13T15:00:18-06:00 feat: collect visitor feedback on protected sites (v0.12.0) 81532bb49a0b689eac64d679852247daf3e16005 Dami 2026-10-13T14:58:05-06:00 A feedback request can arm a one-shot HTTPS callbackUrl. The submit that claims it (in the same transaction) POSTs the site, timestamps, and note count, never note text, with one retry, then clears it. The URL is never returned or logged, and a password change disarms it. CLI: site feedback --request --callback URL. MCP: callbackUrl on nzip_request_feedback. The nzip skill documents a T3 webhook recipe. f32cca8e2663e3a5744f5c2d09a56dfa11b2bbc1 Dami 2026-10-13T14:41:19-06:00 parseArgs coerced positionals such as 3e21 or 0123 into numbers, so targeting those addresses failed or hit the wrong site. ef5adede43b47c13771880d255fd49014ca1aab3 Dami 2026-10-13T14:36:15-06:00 Pages on password-protected sites can save per-item notes to their own origin through /__feedback and the /__feedback.js helper. Owners read notes and open review rounds (with a link-only phone notification) from the CLI (site feedback) and MCP (nzip_get_feedback, nzip_request_feedback). Feedback is opt-in, refused without a password, same-origin JSON only, rate limited, capped per site, reset when the password changes, and deleted with its site. Migration 0009 adds the columns, table, and guard triggers. Also documents MCP harness setup in the nzip skill. e98fe1c87a98f39bfa70b2ecc20675b41dc14aa7 Dami 2026-09-20T18:06:54-06:00 D1's server-side statement splitter ends a trigger body at the first END it encounters, so CASE ... END inside a trigger fails wrangler d1 migrations apply --remote with "incomplete input". Use SELECT RAISE(...) WHERE ... instead; behavior and messages are unchanged. b54c48b6f90e439f4eae0e25698c285b05bb3585 Dami 2026-09-20T17:45:12-06:00 ed6416d2ed72bdd997721f0e9b7d223cb269e766 FelineStateMachine 2026-09-20T17:45:10-06:00 feat: add stateless MCP mode and purpose-driven vault policies 65ee474d32d4e0bb81d287878aaf7ce4a908f189 Slate (OpenClaw) 2026-09-20T17:35:49-06:00 2767ca77a9d7eab8a2ec52e33e89b97054075a49 Dami 2026-08-19T22:32:32-06:00 Claim security outbox rows with expiring D1 leases before delivery. Add the schema migration and concurrent-drain regression coverage. 701fedd83b0fef008054b3dc694daad8305e6a4d Dami 2026-08-19T22:24:57-06:00 Reuse unique source breadcrumbs for untargeted pushes, validate raw addresses against authenticated vault metadata, split content pushes from site policy changes, and release the CLI/shared packages as v0.10.0. e4af3d79ae92d3b4c06eac942b78c2c00377e07f FelineStateMachine 2026-07-19T17:17:57-06:00 90f7f29da832b3a9424ebe4a4ab3fcf22a536898 Dami 2026-07-15T16:58:37-06:00 - replace the obsolete document-domain policy with Origin-Agent-Cluster - document the Free-plan RUM exclusion and add regression coverage 7c17e9de82229b4ec236204c37a4f7ce326e93fe Dami 2026-07-15T14:14:50-06:00 75f5ba02495ce75a6322a568feff8393f04ba2fb Dami 2026-07-15T14:14:16-06:00 7e83e210ae270e106740f9368a24616b8a5c3039 Dami 2026-07-15T14:02:51-06:00 3edf2f937f320b726efd71826491911a7be3b55e Dami 2026-07-15T13:52:30-06:00 Describe the wildcard DNS and Worker route workflow, Free-plan WAF rule, root build base, legacy compatibility, browser storage boundaries, and exact-host passkey guidance. Call out the remaining Public Suffix List and HSTS hardening required before claiming hostile-tenant identity isolation. be8f7ee4301de6f773250dcbf9d5ef8cbaf220e2 Dami 2026-07-15T13:52:20-06:00 Route legacy address paths to per-site hostnames, confine control APIs to the apex, issue host-only unlock cookies, and preserve old address-prefixed builds during migration. Add wildcard deployment configuration plus unit and workerd coverage for hostname validation, redirects, cookie isolation, telemetry, and canonical URLs. f0a472666fb42b7086dcd07fef5c30b16f3bc568 Dami 2026-07-15T12:54:37-06:00 Keep Playwright CLI snapshots and logs local, alongside ignored nzip publish workspaces. 84f958a8a9fdc85c1da5e723169e1f505110a294 Dami 2026-07-15T12:54:30-06:00 Warn that path-hosted sites share browser storage and credentials and are suitable only for mutually trusted content until per-site origins exist. 76f1c02f8db5532398510674cdaa46abbfe98b3d Dami 2026-07-15T12:54:24-06:00 Construct all public site redirects from PUBLIC_BASE and cover internal HTTP requests for bare, index, and directory canonicalization. 930bc04a0db9b6e1cfc986bb0509da1d55a654f5 Dami 2026-07-15T12:54:17-06:00 Keep existing TTL and password settings when push flags are omitted, and report the resulting policy in commit responses and CLI output. b73fe3a8f8f4214a0d0411af6d15184e21407744 Dami 2026-07-12T18:54:19-06:00 85ec3e30b38a6602b1fa7e6bc4476b6f7c1e72c5 Dami 2026-07-12T18:30:42-06:00 Ship CLI and runtime version reporting, preserve locked-site return targets, and refresh the repository documentation structure. 4dcf769b6a96058ad6f194eaadf47e429b348f54 Dami 2026-07-12T16:13:50-06:00 3385035e70c38f1b07758fa6fea57c8e9913c7a7 Dami 2026-07-12T13:29:30-06:00 88745def3687e7dc48236e4ec3fe5a91b33b0274 Dami 2026-07-12T13:29:20-06:00 54d857fd619d929fc4761fafc0fdd9eb6fecc2f8 Dami 2026-07-12T13:26:10-06:00 12e659b8eabbd9eac87afaf397636b0f223668f7 Dami 2026-07-12T13:16:58-06:00 Use vertical, acyclic flows with shorter labels and split notification pairing from delivery so diagrams render with larger text. 8dfdb697e7f8eb3afbcef44b415602547e52d0f3 Dami 2026-07-12T13:14:05-06:00 Restore component, observability, and security diagrams and add a dedicated notification pairing and delivery flow.