newOS4 - the browser terminal that runs WebX11 user spaces https://newos.webx11.duckdns.org/newos4/atom?h=main 2026-11-05T22:49:03+00:00 2026-11-05T22:49:03+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T22:49:03+00:00 urn:sha1:d5dc2e1cb2f1463d001c3b10d1637298997f8559 GET/POST /api/auth/gitpush-token (+ /revoke) on auth-api: session-scoped, CSRF-gated, 3 mints per account per hour, bcrypt into the htpasswd, plaintext returned once and never stored, audit at /var/lib/webx11/git-push-audit.jsonl. No sudo or reload needed: nginx re-opens auth_basic_user_file per request, so a new line is live immediately — proved by a 500 whose error line was per request. Dashboard card 'Git push token' shows none/active, mints and reveals the remote once, revokes. Verified in a real browser: badge none -> mint -> active, remote shape checked, then revoked; htpasswd back to 0 bytes and the test session removed. 2026-11-05T21:32:04+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T21:32:04+00:00 urn:sha1:ab7dcab65739b2791595d80012b207542a7b5171 Done before anyone has a token or a branch, because renaming later breaks every contributor. The hook compares the middle path segment to REMOTE_USER, so a token can only write under its own namespace; deletion and cleanup become a prefix operation instead of a guess. Verified 4/4: own namespace accepted, neighbour's namespace refused naming the authenticated user, missing owner segment refused with the correct form, main refused. Test branch and token removed afterwards; queue back to 0. 2026-11-05T21:26:25+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T21:26:25+00:00 urn:sha1:28c29f2c270009a1d48857afe05993ff6322d0ff Users push to push.newos.webx11.duckdns.org with a per-user token; the read-only host is untouched. http.receivepack is unset so git only allows receive-pack when REMOTE_USER is present, which only that vhost sets. A pre-receive hook (installed by the publisher every run) allows refs/heads/contrib/* only and refuses banned paths, credential-shaped blobs, >200 files or >2MB, logging user+ref+decision. moderate-contrib.py triages every 10 min: deletes hard violations, stamps the rest ready-docs/review/stale into a queue rendered at /admin/git-contrib.html. A human still decides what merges. Verified end to end: contrib push accepted, main refused, credential file refused, accepted ref visible on the read-only host; guard extended (push host 401, hook present+executable, receivepack unset) and proven RED by removing the hook. 2026-11-05T21:16:10+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T21:16:10+00:00 urn:sha1:7d14ce41d6a24d8a20b34586a657cec498348fc7 2026-11-05T21:14:52+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T21:14:52+00:00 urn:sha1:c682d050330bef8c1cf622729b5ad5451677978e Install is npm (node>=22.19). Ollama wiring is two files under ~/.pi/agent: models.json (baseUrl http://localhost:11434/v1, api openai-completions, model list) and settings.json (defaultProvider/defaultModel). Documents the trap that a pulled model must also be declared — undeclared gives 'Model not found', which reads like a connection failure. Both paths verified on this host: declared coder:latest -> 'LOCAL OK', undeclared llama3.2:latest -> error. The two /about/ links pointed at the host root, where nothing exists; the repo page is /newos4/about/. 2026-11-05T21:00:12+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T21:00:12+00:00 urn:sha1:dfd19f68f65f67124898532f17902d5e05008472 Four recipes on the usage page: one-shot @file analysis, --mode json + jq for scripts, a read-only --tools allowlist for tree inspection, and a cron-able digest. Every flag shown was exercised on this host first; the retired-default model gotcha (HTTP 410 'was retired') is documented because it wasted a run. Adds the untrusted-input warning: pi auto-loads AGENTS.md/skills from the working directory, so a public clone must run with --no-approve and no write tools. 2026-11-05T19:55:25+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T19:55:25+00:00 urn:sha1:8dcb83802a3daae51111b3e3de114b50214827da 2026-11-05T19:54:29+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T19:54:29+00:00 urn:sha1:d818abe5c1478d6e047a0d63effee79259c87eb1 Two measured overflows, both structural: a grid item defaults to min-width:auto so one long command stretched the column to 521 px, and the troubleshooting table had no fixed layout so a column of long code strings pushed the page 75 px wide. minmax(0,1fr) + min-width:0 + table-layout:fixed + overflow-wrap:anywhere. verify-mobile: 4/4 viewports OK. 2026-11-05T19:53:08+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T19:53:08+00:00 urn:sha1:d3b9b2e0f21f69b47fbf9a474b1a1a23141ef5f7 2026-11-05T19:53:01+00:00 WebX11 SysOp darkmotox11@gmail.com 2026-11-05T19:53:01+00:00 urn:sha1:64e95106df079d07eda16ac2702724e495ce7d87 310 files / 182 commits were already wrong at publish time (184). A count that changes on every publish is a rot vector; the page now says what the tree is and lets the reader run the commands.