Slack Idea Board

repo: ~/Projects/slack-idea-board · 27 commits · 0 in last 24h, 0 in last 7d ·

Search the build

27 commits indexed

  1. 65a7c86 2026-09-16 idea-board: harden post/open links with scheme allowlist + ship #claude-to-steve column refactor
  2. b9fa503 2026-09-15 slack-idea-board: fix stale aa_fit->good_build comment + serialize launchClaude to close the double-launch window race (captures in-flight good_build enrich refactor)
  3. 48fce21 2026-08-25 creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)
  4. fac3b23 2026-08-06 Idea-board: localhost-only spawn guard (public tunnel previews/copies, never spawns)
  5. 0638b1f 2026-08-06 Idea-board: launch in a NEW iTerm2 window (not a tab); lift cap=0 kill-switch to 20 via pm2 env
  6. 502e681 2026-08-06 Idea-board: auto-retry throttled launches with live countdown (429 self-heals)
  7. 5e09083 2026-08-06 Loosen idea-board build throttle: 20/30s cap, 2s cooldown
  8. c788fcd 2026-07-25 gate ideas.agentabrams.com by default (admin/DW2024!), was public since 07-23
  9. 1ad54c9 2026-07-23 Harden /api/build against terminal-spawn storms
  10. c25818f 2026-07-23 auto-save: 2026-07-23T12:51:13 (3 files) — 5x/sweep-2.md 5x/sweep-2.raw.txt 5x/sweep-3.raw.txt
  11. b8cc845 2026-07-23 5x sweep 1: render non-actionable Skip as a span, not a disabled button
  12. 906b38a 2026-07-23 auto-save: 2026-07-23T12:20:57 (1 files) — public/index.html
  13. 0a99aaa 2026-07-23 idea-board: filter chips can slice by the Agent Abrams verdict (AA·Yes / AA·fit)
  14. 5babc6e 2026-07-23 idea-board: add 'Good for an Agent Abrams build / project?' column (local-Ollama aa_fit/aa_target/aa_reason, backfills legacy cache)
  15. 189d8c3 2026-07-23 Pin autonomous Claude CLI invocation to Opus (--model opus)
  16. 6bf6b15 2026-07-23 ideas: make public — no auth (allow anyone in)
  17. c752b58 2026-07-23 auth: accept second admin user dbrown
  18. e0e5f70 2026-07-22 ideas board: slow auto-refresh from 20s to 10 minutes (Steve request)
  19. 0ad2604 2026-07-13 Wire real UX behind Build-new-project: /api/build launches a Claude accelerator session in iTerm2 (shift-click=copy); header accelerator button
  20. 4309c45 2026-07-13 idea-board: basic auth + per-card action buttons (copy claude kickoff cmd) — session close
  21. 433194c 2026-07-13 idea-board: per-card action buttons driven by next_step (Add new skill with repo / Build new project / Create agent)
  22. 372781e 2026-07-13 Add basic auth gate for public exposure at ideas.agentabrams.com
  23. e4dabd8 2026-07-13 5x: report — 2 clean sweeps, favicon-404 fixed (67e25ed)
  24. 67e25ed 2026-07-13 5x sweep 1: favicon/apple-touch → 204 (kill the 404 console error M3 caught)
  25. c2393df 2026-07-13 idea-board: parallel enrichment (4 concurrent) + continuous background drainer — backlog finishes in minutes
  26. 8231daf 2026-07-13 idea-board: dedupe by URL + full pagination + Actionable/Yes/All filters (default Actionable); pinned under pm2
  27. edba999 2026-07-13 slack-idea-board: 3-column Slack-feed idea triage (link/about · fit+why · next step), local Ollama enrichment

Authors

Agents used

  • none detected

Skills used

  • /sweep-22
  • /open1
  • /data1
  • /claude1
  • /code1
  • /copies1
  • /sweep-31
  • /index1
  • /gen1
  • /apple-touch1
  • /about1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

65a7c86 · 2026-09-16 · idea-board: harden post/open links with scheme allowlist + ship #claude-to-steve column refactor 
safeUrl() blocks javascript:/data: hrefs (esc() only stopped attribute breakout,
not the scheme) on both the c1 post link and the c3 Open link — the board is
auth-gated and can POST /api/build, so a hostile feed URL must not be clickable script.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
b9fa503 · 2026-09-15 · slack-idea-board: fix stale aa_fit->good_build comment + serialize launchClaude to close the double-launch window race (captures in-flight good_build enrich refactor) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pnon7dut9MfPekhhm9YY4Q
48fce21 · 2026-08-25 · creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap) 
Fleet inoculation — opening this basic-auth app with credentials in the URL
poisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves
non-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
c788fcd · 2026-07-25 · gate ideas.agentabrams.com by default (admin/DW2024!), was public since 07-23 
Flip BASIC_AUTH default from '' (public) to the unified admin credential so the
Slack idea board matches every other internal DW app. Public path is Cloudflare
tunnel -> :9820, so gating the app itself gates the public URL. Set BASIC_AUTH=''
to make it public again.
1ad54c9 · 2026-07-23 · Harden /api/build against terminal-spawn storms 
Root cause: a /5x verification run (click-every-control pass over 3 sweeps ×
real browsers) clicked every 'Build new project ▶' / 'Add new skill ▶' button,
each of which POSTs /api/build and spawns a real iTerm2 tab — opening hundreds
of terminals. The endpoint had zero guards.

Three independent guards now stand between a click and a spawn:
- server requires explicit confirm:true (no-confirm = preview only) so any
  automated click-through no longer spawns anything
- per-(id|step) cooldown dedupe drops rapid repeats
- global rolling-window cap (default 5/30s) is a hard circuit breaker
- frontend adds a native confirm() dialog (defeats automated click-through) and
  a durable in-flight lock that survives re-render (DOM disabled did not)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
189d8c3 · 2026-07-23 · Pin autonomous Claude CLI invocation to Opus (--model opus) 
Bare 'claude' spawn inherited the CLI's drifting default model; pin to Opus
so this build/gen loop always runs on the intended model.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

File tree

8 files tracked. Click any to browse the source at HEAD.

Other build journals

← Slack Dm Viewer  ·  all 4 projects  ·  Slack To Steve →

Export

commits.csv · feed.atom · project.json · commits.json

rendered in 2ms