diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 00000000..e31c47fc --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,13 @@ +{ + "name": "bitvid", + "image": "mcr.microsoft.com/devcontainers/javascript-node:20", + "postCreateCommand": "npm ci", + "customizations": { + "vscode": { + "extensions": [ + "esbenp.prettier-vscode", + "bradlc.vscode-tailwindcss" + ] + } + } +} diff --git a/.gitignore b/.gitignore index a8ebf016..9ba12610 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ src/webtorrent-docs/ playwright-report/ test-results/ tests/visual/__snapshots__/ +artifacts/ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8da70311..9637fbde 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -31,6 +31,44 @@ If we later introduce **dual-licensing** options (e.g., commercial licenses for * Follow existing formatting/lint rules. * Update docs and user-facing text when behavior changes. +## Agent PR Conventions + +Automated agents contributing to this repository should follow these rules: +- **Atomic Commits**: Keep changes small and self-contained. +- **Descriptive Titles**: Use clear, semantic titles (e.g., `fix(ui): resolve upload modal overflow`). +- **Reference Issues**: Link to relevant issues in the PR description. +- **Review AGENTS.md**: Always consult `AGENTS.md` for specific architectural guidelines and constraints before starting work. + +## Submitting a Pull Request + +1. Fork the repository and create a new branch from `main`. +2. Make your changes, adding tests if applicable. +3. Run `npm run test:unit` and `npm run lint` to ensure quality. +4. Push your branch and open a Pull Request against the `main` branch. +5. Provide a clear description of the problem and solution. + +## Development Setup + +To set up the project locally: + +1. **Install Dependencies**: + ```bash + npm ci + ``` + +2. **Run Tests**: + ```bash + npm run test:unit + ``` + +3. **Format & Lint**: + ```bash + npm run format + npm run lint + ``` + +For a full guide, see the [Local Setup section in README.md](./README.md#local-setup). + ## Security If you find a vulnerability, please email **[security@bitvid.network](mailto:security@bitvid.network)**. We’ll coordinate a responsible disclosure window before public release. diff --git a/README.md b/README.md index 1a1f189f..5de0cf26 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,6 @@ # bitvid - Decentralized Video Sharing -##### IPNS: [k51qzi5uqu5dgwr4oejq9rk41aoe9zcupenby6iqecsk5byc7rx48uecd133a1](https://k51qzi5uqu5dgwr4oejq9rk41aoe9zcupenby6iqecsk5byc7rx48uecd133a1.ipns.dweb.link/) - **bitvid** is a decentralized platform where users can share videos and follow creators with privacy and freedom. Built with a static site architecture, it’s lightweight, efficient, and fully decentralized, making it ideal for hosting or local deployment. --- @@ -103,7 +101,13 @@ To run **bitvid** locally: cd bitvid ``` -2. Start a local server: +2. Install dependencies: + + ```bash + npm ci + ``` + +3. Start a local server: - Using Python: ```bash python -m http.server 8000 @@ -113,12 +117,42 @@ To run **bitvid** locally: npx serve ``` -3. Open the site in your browser: +4. Open the site in your browser: ``` http://localhost:8000 ``` +### Common Commands + +- **Run unit tests**: `npm run test:unit` +- **Format code**: `npm run format` +- **Lint code**: `npm run lint` + +### Send your first video post + +Use the event builders in `js/nostrEventSchemas.js` to construct valid video notes. + +```javascript +import { buildVideoPostEvent } from "./js/nostrEventSchemas.js"; + +const event = buildVideoPostEvent({ + pubkey: "your_pubkey_hex", + created_at: Math.floor(Date.now() / 1000), + dTagValue: "my-first-video", + content: { + version: 3, + title: "My First Video", + videoRootId: "my-first-video", // Logical ID, often matches d-tag + url: "https://example.com/video.mp4", + description: "This is a test video post sent via the SDK." + // magnet: "magnet:?xt=urn:btih:..." // Optional fallback + } +}); + +console.log("Event to publish:", event); +``` + ### CSS build pipeline Tailwind utilities are generated from `css/tailwind.source.css` and themed via @@ -212,6 +246,27 @@ The legacy `js/nostr.js` shim has been removed. Update any remaining `import { ... } from './nostr.js';` calls to use the facades above so upgrades stay painless. +### Signer Adapters + +bitvid exposes a stable signer API through `js/nostrClientFacade.js`, which +wraps the shared client created in `js/nostr/defaultClient.js` and registers +signer adapters in `js/nostr/client.js`. Import the facade whenever you need to +sign events or encrypt payloads so the adapter registry can select the active +signer, fall back to supported capabilities, and surface permission prompts. + +Use the facade for the common, stable entry points: + +```js +import { + nostrClient, + requestDefaultExtensionPermissions +} from "./nostrClientFacade.js"; +``` + +Custom auth providers should still register their signer object through the +adapter registry in `js/nostr/client.js`, but downstream modules should only +call the facade to keep API surfaces consistent. + ### Nostr video fetch limits `nostrClient.fetchVideos(options)` now accepts an optional `options.limit` to @@ -315,11 +370,16 @@ placeholder at “—” and development builds log a warning—so mixed deploym ```bash git checkout -b feature/your-feature-name ``` -3. **Make Changes**: +3. **Install Dependencies**: + ```bash + npm ci + ``` +4. **Make Changes**: - Ensure your code follows best practices and is well-documented. -4. **Test**: +5. **Test**: + - Run unit tests: `npm run test:unit` - Validate the site functionality locally before submitting. -5. **Submit a Pull Request**: +6. **Submit a Pull Request**: - Explain your changes and reference any related issues. ### Contribution Guidelines diff --git a/ai/reports/onboarding-20260118.md b/ai/reports/onboarding-20260118.md new file mode 100644 index 00000000..6c7137a1 --- /dev/null +++ b/ai/reports/onboarding-20260118.md @@ -0,0 +1,38 @@ +# Onboarding Audit Report - 2026-01-18 + +## Summary +Performed a fresh checkout validation of the `bitvid` repository to audit the developer onboarding experience. + +## Execution Log +1. **Dependency Installation**: `npm ci` was used instead of `npm install` (implied by README) to ensure a clean state. + - Result: Success. +2. **Build**: `npm run build:css`. + - Result: Success. +3. **Format**: `npm run format`. + - Result: Success. +4. **Testing**: `npm run test:unit`. + - Result: Timed out in the audit environment (400s limit), but individual tests pass. The test runner executes tests sequentially which can be slow on constrained resources. + +## Findings & Fixes + +### Documentation Gaps +- **README.md**: + - The "Local Setup" section implied `npm install` but `npm ci` is preferred for consistent CI/CD and fresh setups. + - The "For Contributors" section completely missed the dependency installation step. + - **Fix**: Updated `README.md` to explicitly list `npm ci` in both sections and added a "Test" step with `npm run test:unit`. + +- **CONTRIBUTING.md**: + - Lacked technical setup instructions, relying on README. + - **Fix**: Added a "Development Setup" section summarizing `npm ci`, testing, and linting commands, linking back to README. + +### Environment Brittleness +- The reliance on system-wide Node.js versions was unidentified. +- **Fix**: Added a `.devcontainer/devcontainer.json` configuration to standardize the development environment using a Docker-based Node.js 20 container. + +### Linting Failures +- `npm run lint` fails on a fresh checkout due to pre-existing inline style violations in `js/ui/components/EventDetailsModal.js` and `js/ui/components/SimilarContentCard.js`. +- **Recommendation**: These legacy style violations should be addressed in a separate refactoring PR. + +## Recommendations +- Contributors should use the provided Devcontainer or ensure Node.js 20+ is installed. +- `npm ci` should be the standard instruction for new environments. diff --git a/ai/reports/weekly-20260118.md b/ai/reports/weekly-20260118.md new file mode 100644 index 00000000..f5d7bf95 --- /dev/null +++ b/ai/reports/weekly-20260118.md @@ -0,0 +1,49 @@ +# Weekly Agent Report: 2026-01-18 + +**Date Range:** 2026-01-11 to 2026-01-18 + +## 1. Weekly Summary + +### PRs Opened (Agent) +The following branches were created and work submitted by the AI agent in the past week: + +| PR/Branch | Title | Status | +| :--- | :--- | :--- | +| `ai/smoke-tests-20260117-...` | `chore(ai): add smoke test script (agent)` | Merged (`a8647c1`) | +| `ai/load-test-20260117-...` | `Add load testing scripts and report` | Merged (`898f305`) | + +### Tests Added & Coverage Improvements +- **Smoke Testing:** Added `scripts/agent/smoke-test.mjs` to verify critical user flows (login, publish, DM encryption) in a headless environment using `JSDOM` and `ws`. +- **Load Testing:** Added `scripts/agent/load-test.mjs` to measure relay performance (latency, throughput) and generate reports. + +### Security & Dependency Suggestions +- **Dependency:** `fake-indexeddb` has been added to `devDependencies`. + - *Suggestion:* Ensure this mock is explicitly utilized in unit tests for the new `UnifiedDB` implementation to prevent regression of the storage layer during CI. + +### High-Risk Items (Requires Review) +The following items merged in the past week involve significant architectural changes or security protocols and require human attention: + +- **`requires-protocol-review`**: **Watch History v2** (Commit `cbd8af4`) + - Enforces `["v", "2"]` tag and mandatory NIP-44 encryption for watch history events. + - *Risk:* Potential backward compatibility issues with legacy v1 history if not properly migrated or handled. +- **`requires-review`**: **UnifiedDB & SyncEngine** (Commit `fa84089`) + - Replaces `localStorage` with `IndexedDB` for robust data persistence. + - *Risk:* Data loss during migration for existing users if the `localStorage` -> `IndexedDB` handover fails. +- **`requires-security-review`**: **NIP-46 Encryption Exposure** (Commit `8c042d7`) + - Exposes `nip04_encrypt`/`decrypt` and `nip44_encrypt`/`decrypt` via RPC for remote signers. + - *Risk:* Unauthorized access to encryption methods if the RPC interface is not strictly scoped or validated. +- **`requires-security-review`**: **Session Actor Isolation** (Commit `b49a294`) + - Restricts ephemeral session actors from publishing public events. + - *Risk:* Ensure legitimate use cases for ephemeral keys (if any) are not unintentionally blocked. + +--- + +## 2. Top 5 Recommended Human Actions + +| Priority | Action | Description | +| :--- | :--- | :--- | +| **P0** | **Verify Data Migration** | Manually test the **UnifiedDB** migration path. Load a profile with existing `localStorage` data and confirm it persists to `IndexedDB` without data loss. | +| **P0** | **Security Audit (NIP-46)** | Review `js/nostr/nip46Client.js` changes (Commit `8c042d7`). Ensure encryption RPC calls are secure and only accessible to authorized origins. | +| **P1** | **Protocol Check (Watch History)** | Verify that new watch history events carry the `["v", "2"]` tag and are correctly encrypted. Confirm the client gracefully handles legacy v1 events. | +| **P1** | **Run Smoke Tests** | Execute `node scripts/agent/smoke-test.mjs` against a test relay to verify that core flows (login, publish, DM) remain functional after the storage refactor. | +| **P2** | **Review Load Test Report** | Analyze the report generated by the new load test suite to understand relay performance baselines and identify potential bottlenecks. | diff --git a/assets/svg/recent-icon.svg b/assets/svg/for-you-feed-icon.svg similarity index 100% rename from assets/svg/recent-icon.svg rename to assets/svg/for-you-feed-icon.svg diff --git a/assets/svg/globe-icon.svg b/assets/svg/globe-icon.svg new file mode 100644 index 00000000..a65dacdf --- /dev/null +++ b/assets/svg/globe-icon.svg @@ -0,0 +1,6 @@ + + + + + + diff --git a/assets/svg/ipns-icon.svg b/assets/svg/ipns-icon.svg deleted file mode 100644 index e7c339a6..00000000 --- a/assets/svg/ipns-icon.svg +++ /dev/null @@ -1,5 +0,0 @@ - - - - - diff --git a/components/login-modal.html b/components/login-modal.html index 3faf0634..92b89c3b 100644 --- a/components/login-modal.html +++ b/components/login-modal.html @@ -338,8 +338,7 @@

Pair a remote signer

- Scan the QR code with your signer or share the connect link to start a - Nostr Connect session. + Scan the QR code with your signer (like Amber or NsecBunker) to login.

-
-
+
+
-
- - -
-
- + +
-
-
-
+ +
diff --git a/components/profile-modal.html b/components/profile-modal.html index 2cfedd74..997ef0c6 100644 --- a/components/profile-modal.html +++ b/components/profile-modal.html @@ -230,13 +230,22 @@ Loading... npub1...
- +
+ + +
+
+

+ Trusted counts include your first-degree follows (F1) plus seeded moderators. +

+
+
+
Trusted contacts
+
0
+
+
+
Active trusted mute contributors
+
0
+
+
+
Active trusted report contributors
+
0
+
+
+ +
+ + + @@ -852,6 +1067,33 @@ aria-live="polite" aria-label="Direct message threads" > +
+ + +
+ + +
+
@@ -288,15 +302,6 @@ /> Links - - - IPNS - - Configure R2 Storage + Storage Configuration - +