newos4 - newOS4 - the browser terminal that runs WebX11 user spaces

	Commit message (Collapse)	Author	Age	Files	Lines
*	feat(auth): self-service git push tokens from the dashboard	WebX11 SysOp	25 hours	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \| \|	GET/POST /api/auth/gitpush-token (+ /revoke) on auth-api: session-scoped, CSRF-gated, 3 mints per account per hour, bcrypt into the htpasswd, plaintext returned once and never stored, audit at /var/lib/webx11/git-push-audit.jsonl. No sudo or reload needed: nginx re-opens auth_basic_user_file per request, so a new line is live immediately — proved by a 500 whose error line was per request. Dashboard card 'Git push token' shows none/active, mints and reveals the remote once, revokes. Verified in a real browser: badge none -> mint -> active, remote shape checked, then revoked; htpasswd back to 0 bytes and the test session removed.
*	feat(git): namespace contrib refs per account (contrib/<user>/<topic>)	WebX11 SysOp	26 hours	1	-5/+5
\| \| \| \| \| \| \| \| \| \| \|	Done before anyone has a token or a branch, because renaming later breaks every contributor. The hook compares the middle path segment to REMOTE_USER, so a token can only write under its own namespace; deletion and cleanup become a prefix operation instead of a guess. Verified 4/4: own namespace accepted, neighbour's namespace refused naming the authenticated user, missing owner segment refused with the correct form, main refused. Test branch and token removed afterwards; queue back to 0.
*	feat(git): contrib push surface with automated moderation	WebX11 SysOp	27 hours	1	-0/+36
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Users push to push.newos.webx11.duckdns.org with a per-user token; the read-only host is untouched. http.receivepack is unset so git only allows receive-pack when REMOTE_USER is present, which only that vhost sets. A pre-receive hook (installed by the publisher every run) allows refs/heads/contrib/* only and refuses banned paths, credential-shaped blobs, >200 files or >2MB, logging user+ref+decision. moderate-contrib.py triages every 10 min: deletes hard violations, stamps the rest ready-docs/review/stale into a queue rendered at /admin/git-contrib.html. A human still decides what merges. Verified end to end: contrib push accepted, main refused, credential file refused, accepted ref visible on the read-only host; guard extended (push host 401, hook present+executable, receivepack unset) and proven RED by removing the hook.
*	docs(newos4): reconcile pi version (verified on 0.80.3, npm ships 1.5.0)	WebX11 SysOp	27 hours	1	-1/+2
\|
*	docs(newos4): install pi + point it at Ollama; fix dead /about/ link	WebX11 SysOp	27 hours	1	-2/+51
\| \| \| \| \| \| \| \| \| \| \| \|	Install is npm (node>=22.19). Ollama wiring is two files under ~/.pi/agent: models.json (baseUrl http://localhost:11434/v1, api openai-completions, model list) and settings.json (defaultProvider/defaultModel). Documents the trap that a pulled model must also be declared — undeclared gives 'Model not found', which reads like a connection failure. Both paths verified on this host: declared coder:latest -> 'LOCAL OK', undeclared llama3.2:latest -> error. The two /about/ links pointed at the host root, where nothing exists; the repo page is /newos4/about/.
*	docs(newos4): automating with the pi agent (recipes verified against pi 0.80.3)	WebX11 SysOp	27 hours	1	-0/+69
\| \| \| \| \| \| \| \| \|	Four recipes on the usage page: one-shot @file analysis, --mode json + jq for scripts, a read-only --tools allowlist for tree inspection, and a cron-able digest. Every flag shown was exercised on this host first; the retired-default model gotcha (HTTP 410 'was retired') is documented because it wasted a run. Adds the untrusted-input warning: pi auto-loads AGENTS.md/skills from the working directory, so a public clone must run with --no-approve and no write tools.
*	docs(newos4): last stale count on the usage page (181 commits)	WebX11 SysOp	28 hours	1	-1/+1
\|
*	docs(newos4): usage page fits a 390 px screen	WebX11 SysOp	28 hours	1	-2/+11
\| \| \| \| \| \| \| \|	Two measured overflows, both structural: a grid item defaults to min-width:auto so one long command stretched the column to 521 px, and the troubleshooting table had no fixed layout so a column of long code strings pushed the page 75 px wide. minmax(0,1fr) + min-width:0 + table-layout:fixed + overflow-wrap:anywhere. verify-mobile: 4/4 viewports OK.
*	docs(newos4): no byte count either — it grows with every publish	WebX11 SysOp	28 hours	1	-2/+2
\|
*	docs(newos4): drop hardcoded file/commit counts from the usage page	WebX11 SysOp	28 hours	1	-2/+3
\| \| \| \| \| \|	310 files / 182 commits were already wrong at publish time (184). A count that changes on every publish is a rot vector; the page now says what the tree is and lets the reader run the commands.
*	docs(newos4): per-OS clone guide (Linux, macOS, Windows, Termux, iOS)	WebX11 SysOp	28 hours	1	-0/+204
	Served at https://newos.webx11.duckdns.org/usage.html from docs/usage.html in this repo, so the page, the mirror and the README share one source. Covers the four failure modes that actually bite: CRLF on Windows (core.autocrlf), missing CA bundles, cloning into /sdcard from Termux (FUSE has no POSIX permissions), and the read-only 403 on push.