Small Business Builder

repo: ~/Projects/small-business-builder · 18 commits · 0 in last 24h, 3 in last 7d · █

Search the build

18 commits indexed

  1. a21cd75 2026-07-22 auto-save: 2026-07-22T21:46:55 (1 files) — package-lock.json
  2. 8f61557 2026-07-22 chore: v0.1.1 (barber.aa PUBLIC_HOSTS, session close)
  3. 3e1c27e 2026-07-22 add barber.agentabrams.com to PUBLIC_HOSTS (directory renamed from livesiteaudit.aa)
  4. 669babf 2026-07-17 auto-save: 2026-07-17T19:47:29 (1 files) — data/wa-screenshots/fantaseayachts-com.png
  5. e704581 2026-07-03 chore: macstudio3 migration — reconcile from mac2 + repoint paths (stevestudio2→macstudio3, node/npm/npx→/opt/homebrew)
  6. 82a9729 2026-06-24 website-analysis: fix public-host critique page — whitelist screenshot+deep-dive, hide SHIP on public host (fantasea.agentabrams.com)
  7. 0a5f356 2026-06-24 auto-save: 2026-06-24T15:27:54 (1 files) — src/server/index.js
  8. 771aaa9 2026-05-31 fix: add rel="noopener noreferrer" to target=_blank links missing it
  9. dadcde3 2026-05-13 snapshot: 66 file(s) changed, +54 new, ~12 modified
  10. 783c9b7 2026-05-12 qa click-through: log session-minutes to cost-tracker via shared helper
  11. a3c524f 2026-05-07 tighten .gitignore: add missing standing-rule patterns (dist/ build/ .next/)
  12. 5aaf4a3 2026-05-06 fix(ops): port hawk to sf-style pm2-jlist pattern — old curl-only hawk had wrong /opt/homebrew/bin/pm2 path so it logged 'No such file' every fire and silently failed
  13. c6fa785 2026-05-04 deploy: ship smb-builder to Kamatera + capture full schema in migrations 002-008
  14. 41c8a33 2026-05-04 [morning-review] small-business-builder: gate interview admin + whitelist QA keys + UI/render hardening
  15. b789cdc 2026-05-04 [morning-review] small-business-builder: harden public profile + interview API
  16. 035afe2 2026-05-04 yolo: iter 3 trivial patches from claude-codex debate
  17. 980062b 2026-05-04 yolo: iter 2 trivial patches from claude-codex debate
  18. ff56b97 2026-05-03 yolo: baseline before overnight

Authors

Agents used

  • website-analysis1

Skills used

  • /index3
  • /interview3
  • /homebrew2
  • /server2
  • /render2
  • /biz2
  • /wa-screenshots1
  • /fantaseayachts-com1
  • /npm1
  • /npx1
  • /builds-index1
  • /pm21
  • /deploy-kamatera1
  • /live1
  • /capture1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

771aaa9 · 2026-05-31 · fix: add rel="noopener noreferrer" to target=_blank links missing it 
Three anchor elements in src/server/index.js (build URL kv-row, wa peek
drawer FULL link) and five Quick Open sidebar links in
src/render/builds-index.js were missing rel="noopener noreferrer",
exposing opener context to cross-origin pages. All fixed; syntax clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
c6fa785 · 2026-05-04 · deploy: ship smb-builder to Kamatera + capture full schema in migrations 002-008 
migrations 002-008 capture all tables that drifted into local DB ad-hoc.
All use IF NOT EXISTS so re-running on a populated DB is a no-op.
Validated end-to-end against a fresh smb_migration_test DB -> 13 tables, all clean.

scripts/deploy-kamatera.sh: idempotent 6-step rsync->createdb->migrate->.env->pm2.
ADMIN_TOKEN piped via stdin (never lands in argv / ps / shell history).

Live at http://45.61.58.125:9760 (no public domain yet).
41c8a33 · 2026-05-04 · [morning-review] small-business-builder: gate interview admin + whitelist QA keys + UI/render hardening 
Critical:
- Gate GET /biz/:slug/interview and /interview/live behind ADMIN_TOKEN
  (POST already gated); adds shared requireAdmin() helper.
- Whitelist incoming qa keys against QUESTIONS ids before persisting,
  so attackers can't balloon JSONB or inject collision keys.

High:
- Cast $2::jsonb on interview INSERT to avoid pg-driver double-encode.
- profile.js: white-space:pre-wrap on .qa .a so multi-paragraph answers
  render with linebreaks intact.
- profile.js: form maxlength now uses q.max_chars (was *2), aligning
  the soft limit with what the server keeps.

Medium:
- profile.js: format recorded_at in UTC so "Recorded January 2026"
  doesn't flicker by host TZ.
- profile.js: new safeHref() validates http(s) scheme on b.website
  before rendering as href or schema.org url (blocks javascript: XSS).
- profile.js: coerce qa_json from string when legacy rows stored JSON
  text rather than a jsonb object.
- server/index.js: /n/:slug uses slugify() rather than an inline regex,
  matching the slugs emitted in links.
- interview-questions.js: localizeQuestion substitutes [neighborhood]
  across every string field, not just q + placeholder.
b789cdc · 2026-05-04 · [morning-review] small-business-builder: harden public profile + interview API 
- Strip third-party mcp.figma.com/capture.js from public home + profile pages
- Escape JSON-LD payloads so user answers can't break out of <script> (XSS)
- Wrap new URL(b.website) so scheme-less domains don't 500 the profile route
- Gate POST /api/biz/interview behind ADMIN_TOKEN cookie + admin_token field;
  reject Array qa payloads, accept urlencoded qa_<id> for no-JS form fallback,
  redirect non-JSON callers, trim history to 5 most-recent rows per business
- Cap homepage SELECT at 200 rows; replace /n/:slug full-table scan with
  WHERE neighborhood=$1 + DISTINCT slug resolution; 409 on slug collisions
- Guard Number.isFinite on years_in_business, recorded_at date format,
  empty hoodSlug links, NaN max_chars in interview form
- Move interview-form submit button inside <form> so no-JS submit + a11y work

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

File tree

107 files tracked. Click any to browse the source at HEAD.

Other build journals

← Slack To Steve  ·  all 4 projects  ·  Social Profile Kits →

Export

commits.csv · feed.atom · project.json · commits.json

rendered in 0ms