{"slug":"slack-idea-board","total":27,"limit":100,"offset":0,"since":null,"commits":[{"hash":"65a7c86","date":"2026-09-16 09:31:42 -0700","author":"Steve Abrams","subject":"idea-board: harden post/open links with scheme allowlist + ship #claude-to-steve column refactor","body":"safeUrl() blocks javascript:/data: hrefs (esc() only stopped attribute breakout,\nnot the scheme) on both the c1 post link and the c3 Open link — the board is\nauth-gated and can POST /api/build, so a hostile feed URL must not be clickable script.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) "},{"hash":"b9fa503","date":"2026-09-15 18:16:40 -0700","author":"Steve","subject":"slack-idea-board: fix stale aa_fit->good_build comment + serialize launchClaude to close the double-launch window race (captures in-flight good_build enrich refactor)","body":"Co-Authored-By: Claude Opus 4.8 (1M context) \nClaude-Session: https://claude.ai/code/session_01Pnon7dut9MfPekhhm9YY4Q"},{"hash":"48fce21","date":"2026-08-25 10:49:01 -0700","author":"Steve","subject":"creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)","body":"Fleet inoculation — opening this basic-auth app with credentials in the URL\npoisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves\nnon-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) "},{"hash":"fac3b23","date":"2026-08-06 17:01:07 -0700","author":"Steve Abrams","subject":"Idea-board: localhost-only spawn guard (public tunnel previews/copies, never spawns)","body":""},{"hash":"0638b1f","date":"2026-08-06 16:58:55 -0700","author":"Steve Abrams","subject":"Idea-board: launch in a NEW iTerm2 window (not a tab); lift cap=0 kill-switch to 20 via pm2 env","body":""},{"hash":"502e681","date":"2026-08-06 16:53:31 -0700","author":"Steve Abrams","subject":"Idea-board: auto-retry throttled launches with live countdown (429 self-heals)","body":""},{"hash":"5e09083","date":"2026-08-06 16:51:25 -0700","author":"Steve Abrams","subject":"Loosen idea-board build throttle: 20/30s cap, 2s cooldown","body":""},{"hash":"c788fcd","date":"2026-07-25 10:13:47 -0700","author":"Steve Abrams","subject":"gate ideas.agentabrams.com by default (admin/DW2024!), was public since 07-23","body":"Flip BASIC_AUTH default from '' (public) to the unified admin credential so the\nSlack idea board matches every other internal DW app. Public path is Cloudflare\ntunnel -> :9820, so gating the app itself gates the public URL. Set BASIC_AUTH=''\nto make it public again."},{"hash":"1ad54c9","date":"2026-07-23 13:00:44 -0700","author":"Steve Abrams","subject":"Harden /api/build against terminal-spawn storms","body":"Root cause: a /5x verification run (click-every-control pass over 3 sweeps ×\nreal browsers) clicked every 'Build new project ▶' / 'Add new skill ▶' button,\neach of which POSTs /api/build and spawns a real iTerm2 tab — opening hundreds\nof terminals. The endpoint had zero guards.\n\nThree independent guards now stand between a click and a spawn:\n- server requires explicit confirm:true (no-confirm = preview only) so any\n automated click-through no longer spawns anything\n- per-(id|step) cooldown dedupe drops rapid repeats\n- global rolling-window cap (default 5/30s) is a hard circuit breaker\n- frontend adds a native confirm() dialog (defeats automated click-through) and\n a durable in-flight lock that survives re-render (DOM disabled did not)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) "},{"hash":"c25818f","date":"2026-07-23 12:51:31 -0700","author":"Steve Abrams","subject":"auto-save: 2026-07-23T12:51:13 (3 files) — 5x/sweep-2.md 5x/sweep-2.raw.txt 5x/sweep-3.raw.txt","body":""},{"hash":"b8cc845","date":"2026-07-23 12:44:35 -0700","author":"Steve Abrams","subject":"5x sweep 1: render non-actionable Skip as a span, not a disabled button","body":""},{"hash":"906b38a","date":"2026-07-23 12:21:09 -0700","author":"Steve Abrams","subject":"auto-save: 2026-07-23T12:20:57 (1 files) — public/index.html","body":""},{"hash":"0a99aaa","date":"2026-07-23 12:14:34 -0700","author":"Steve Abrams","subject":"idea-board: filter chips can slice by the Agent Abrams verdict (AA·Yes / AA·fit)","body":""},{"hash":"5babc6e","date":"2026-07-23 12:09:31 -0700","author":"Steve Abrams","subject":"idea-board: add 'Good for an Agent Abrams build / project?' column (local-Ollama aa_fit/aa_target/aa_reason, backfills legacy cache)","body":""},{"hash":"189d8c3","date":"2026-07-23 11:41:50 -0700","author":"Steve Abrams","subject":"Pin autonomous Claude CLI invocation to Opus (--model opus)","body":"Bare 'claude' spawn inherited the CLI's drifting default model; pin to Opus\nso this build/gen loop always runs on the intended model.\n\nCo-Authored-By: Claude Fable 5 "},{"hash":"6bf6b15","date":"2026-07-23 08:34:50 -0700","author":"Steve","subject":"ideas: make public — no auth (allow anyone in)","body":""},{"hash":"c752b58","date":"2026-07-23 08:16:08 -0700","author":"Steve","subject":"auth: accept second admin user dbrown","body":""},{"hash":"e0e5f70","date":"2026-07-22 22:00:49 -0700","author":"Steve Abrams","subject":"ideas board: slow auto-refresh from 20s to 10 minutes (Steve request)","body":""},{"hash":"0ad2604","date":"2026-07-13 14:56:42 -0700","author":"Steve","subject":"Wire real UX behind Build-new-project: /api/build launches a Claude accelerator session in iTerm2 (shift-click=copy); header accelerator button","body":""},{"hash":"4309c45","date":"2026-07-13 14:55:12 -0700","author":"Steve Abrams","subject":"idea-board: basic auth + per-card action buttons (copy claude kickoff cmd) — session close","body":""},{"hash":"433194c","date":"2026-07-13 14:51:18 -0700","author":"Steve Abrams","subject":"idea-board: per-card action buttons driven by next_step (Add new skill with repo / Build new project / Create agent)","body":"Co-Authored-By: Claude Fable 5 "},{"hash":"372781e","date":"2026-07-13 14:48:03 -0700","author":"Steve","subject":"Add basic auth gate for public exposure at ideas.agentabrams.com","body":""},{"hash":"e4dabd8","date":"2026-07-13 14:47:19 -0700","author":"Steve Abrams","subject":"5x: report — 2 clean sweeps, favicon-404 fixed (67e25ed)","body":""},{"hash":"67e25ed","date":"2026-07-13 14:44:53 -0700","author":"Steve Abrams","subject":"5x sweep 1: favicon/apple-touch → 204 (kill the 404 console error M3 caught)","body":""},{"hash":"c2393df","date":"2026-07-13 00:55:39 -0700","author":"Steve Abrams","subject":"idea-board: parallel enrichment (4 concurrent) + continuous background drainer — backlog finishes in minutes","body":""},{"hash":"8231daf","date":"2026-07-13 00:49:57 -0700","author":"Steve Abrams","subject":"idea-board: dedupe by URL + full pagination + Actionable/Yes/All filters (default Actionable); pinned under pm2","body":""},{"hash":"edba999","date":"2026-07-13 00:35:57 -0700","author":"Steve Abrams","subject":"slack-idea-board: 3-column Slack-feed idea triage (link/about · fit+why · next step), local Ollama enrichment","body":""}]}