Ventura Claw

Bare 'claude' spawn inherited the CLI's drifting default model; pin to Opus
so this build/gen loop always runs on the intended model.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Root causes (demo widget = Show HN launch blocker):
- classifyIntent used num_predict:220 against qwen3:14b (a reasoning model); reasoning
  tokens consumed the whole budget so response came back EMPTY (done_reason=length).
  Fix: pass think:false to /api/generate (clean JSON in ~1.2s) + raise budget to 512.
- _isHealthy() gated only on the PRIMARY endpoint; when Mac1 Ollama returned HTTP 500 it
  returned null in 0ms and never reached the healthy Mac2 fallback. Fix: healthy if EITHER
  primary or fallback /api/tags answers.
- prewarm() logged success without checking r.ok, masking a dead backend (silent 0/5).
  Fix: check r.ok, warn loudly on unhealthy backend.
- Defense-in-depth: strip <think> in tryParse + /no_think suffix (for builds that ignore think:false).

Note: OLLAMA_FALLBACK_URL/MODEL added to server/.env (gitignored) — Mac1 stays primary
per project default, Mac2 (also holds qwen3:14b) is the fallback. Verified PRIMED 5/5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- maskFields: first4 + 8 asterisks + last4 (was first4…last4); pass _* provenance through
- scripts/preload-fleet.js: full ENV_KEY_TO_CONNECTOR map, 5 canonical logins
  (admin, info@vcl, steve@vcl, info@dw, steve@dw — all role=admin, bcrypt-hashed)
- Backs up existing encrypted credentials.json; writes plaintext seed
  (server boot re-encrypts under CC_SECRET via existing migration block)

Federal:
  sec         — SEC EDGAR (10-K filings, financial data, ticker lookup)
  usaspending — federal contracts + grants search by keyword/recipient/year
Local-state:
  nws         — National Weather Service (forecasts + active alerts by lat/lon)
  lacity      — LA City Open Data (Socrata) — business tax registry, permits,
                crime, code violations; SoQL query interface
  cadata      — California Open Data (CKAN) — package search + datastore query

All zero-auth — pre-connected for everyone. Health probes verified live on
Mac dev + Kamatera prod.

(USPTO was attempted but TSDR + PEDS recently auth-walled their public
endpoints; dropped from this batch.)

All 5 are pre-connected — zero credentials required, just HTTPS calls.
Useful for DW content workflows (art reference, color tooling, encyclopedic
fact-checks). Live counts on health probe:
  - MET Museum:                 43,947 PD objects
  - Cleveland Museum of Art:    68,738 CC0 artworks
  - Art Institute of Chicago:  131,990 artworks (IIIF imagery)
  - Wikipedia:                 english REST + search APIs
  - Color API:                 identify + scheme actions

Each handler follows the archive.js pattern: meta + empty fields + always-
configured + health() probing a free endpoint + 2-3 read-only actions.

Registered in REAL map with WRITE_ACTIONS: Set([]) (read-only) and
READ_ACTIONS enumerated. Catalog entries added to connectors.json (62 total).

Previous version used descriptive field keys (api_key, access_token, store).
The connector handlers (stripe.js, cloudflare.js, etc) look up creds under
the upper-case env var name (STRIPE_SECRET_KEY, CF_API_TOKEN, ...). After
import, /admin/connectors UI showed 'filled: true' but every command failed
with 'no_token' because the lookup key didn't match the storage key.

Fixed by making each entry's 'field' match the handler's lookup key. Notable
remappings beyond the obvious uppercase-rename:
- CLOUDFLARE_API_TOKEN  → CF_API_TOKEN  (CF_ prefix in handler)
- HUBSPOT_ACCESS_TOKEN  → HUBSPOT_TOKEN
- NOTION_API_KEY        → NOTION_TOKEN
- CANVA_API_KEY         → CANVA_TOKEN
- ETSY_API_KEY          → ETSY_KEYSTRING
- SHOPIFY_ACCESS_TOKEN  → SHOPIFY_ADMIN_TOKEN

Also added direct-name aliases (HUBSPOT_TOKEN, NOTION_TOKEN, CANVA_TOKEN,
ETSY_KEYSTRING, ETSY_ACCESS_TOKEN) so users can paste either variant.

After re-import: stripe + cloudflare + archive flip from rejected → ✓ ok.
Live prod /api/connectors/health-all confirms 5 connectors authenticate
where 2 did before.

- New strip at top of wizard shows one pill per filled connector (✓ ok / ⊘ catalog-only / ✗ rejected)
- Pulls from existing /api/connectors/health-all (30s cached, no rate hit)
- Click a pill to insert that connector into the wizard queue at current cursor
  (handy for fixing a broken one without leaving the page)
- Re-test button refreshes the strip on demand
- Connectors absent from /health-all (catalog-only filled) render as ⊘ skipped, not stuck-in-testing
- Summary line: 'N authenticate · M no test handler · K rejected'

- New 'Test' button next to 'Save & Next →' chains save → /api/connectors/:id/health
- Inline result panel shows: ok (green, auto-advances 1.2s), 'no test handler' for
  catalog-only (yellow, stays put), error reason (red, stays put for fixing)
- 'Save & Next →' still works as fast-path skip-validation
- Test-result resets each step

Replaces the wall-of-tiles connector page with a guided wizard. Walks Steve
through every unfilled connector one at a time, with paste/skip/save buttons
and a 'Search Vault' button that auto-fills from secrets-manager .env on
Mac dev (gracefully no-ops on Kamatera prod where the vault isn't present).

- New GET /admin/wizard serves the single-page wizard
- New GET /api/wizard/vault-search?connector=:id inverts ENV_KEY_TO_CONNECTOR
  and looks up matching env values from $VC_VAULT_PATH or
  ~/Projects/secrets-manager/.env. Admin-gated; never proxies arbitrary paths.
- Cmd/Ctrl-Enter to save+next; progress bar shows N/M filled.
- Wizard fetches /api/me/connections, filters to .filled==false,
  uses existing POST /api/me/connections/:id to save each.

Mirrored to Kamatera /root/public-projects/ventura-claw with backups.

The bulk-import endpoint at /api/me/connections/import maps env-var names to
connector credentials via a static table. Three keys that exist in Steve's
secrets-manager vault weren't mapped:

- ELEVENLABS_API_KEY  → elevenlabs.ELEVENLABS_API_KEY
- PURELYMAIL_API_TOKEN → purelymail.PURELYMAIL_API_TOKEN
- SHOPIFY_ADMIN_TOKEN → shopify.access_token (alias for SHOPIFY_ACCESS_TOKEN)

After this patch a fresh import of secrets-manager .env populates 7 of
Steve's available connectors instead of 5 (stripe, cloudflare, shopify,
godaddy, browserbase, elevenlabs, purelymail) — zero unmatched.

server/connectors/elevenlabs.js — full impl that was missed in the
earlier commit (file was untracked)
server/connectors/shopify.js — DW prod store connector (read shop info,
products, orders; write order.fulfill, order.refund, product.update)
server/connectors/index.js — register both with proper write/read action
sets; Shopify writes are sensitive (gated)
server/public/coming-soon.html — placeholder
server/server.js — adjacent updates

The literal value '149940c2c5b209fb' was previously the OR-fallback when BC_PASS env was missing — meaning anyone with the repo had Steve's prod password. Now fail-closed: BC_PASS env required at runtime, script exits 1 with clear message if missing. Existing launchd plist already passes the env, so no functional change for the hot path.

NOTE for daylight Steve: rotate the prod password since the old one is in git history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- server/connectors/elevenlabs.js — REAL impl, health probe returns
  subscription tier + char usage
- server/connectors/index.js — registered in REAL, READ_ACTIONS, WRITE_ACTIONS
- server/connectors.json — added catalog entry (now 57 connectors)
- scripts/sync-tokens.js — routes ELEVENLABS_API_KEY into the user vault
  (verified: 'live' on next sync, health 200 with starter tier 9.3K/90K chars)

Empty commit to verify the new global git post-commit hook at
~/.git-hooks/post-commit plays Hero.aiff (the macOS achievement-unlocked
chime) every time a commit lands. Hooks path is set globally via
core.hooksPath so this fires across every repo, with delegation to
repo-local hooks preserved.

.local is reserved for mDNS / Bonjour, not real email — using it as the
email-domain on demo accounts was visually confusing (and inherited from
the original businessclaw.local placeholder pattern that I just blindly
renamed in the rebrand).

Switched to venturaclaw.com everywhere, which is real and has a working
mailbox now:
- admin@venturaclaw.local       -> admin@venturaclaw.com (+ pw reset to 'admin'
                                     so the displayed demo creds actually work)
- steve@venturaclaw.local       -> steve@venturaclaw.com (pw preserved)
- demo@venturaclaw.local        -> demo@venturaclaw.com (display only)
- BC_USER default in sync-tokens.js → steve@venturaclaw.com (verified working
                                       against the canonical hostname)

Server reads users from JSON in memory, so this required a pm2 restart
after editing users.json. Login at admin/admin verified 200; steve@ login
verified to still reject wrong password (401 not 404, so the rename took).

Steve registered venturaclaw.com today and asked to put all builds on it.
Same Express server, new front door:

- Apex A + www CNAME at GoDaddy → 45.61.58.125
- nginx server block + Let's Encrypt SSL on apex + www
- MX/SPF/DKIM/DMARC for venturaclaw.com (mirrors agentabrams.com pattern)
- Domain added to Purelymail; info@venturaclaw.com mailbox provisioned;
  password in secrets-manager as INFO_VENTURACLAW_COM_PASSWORD.
- All venturaclaw.agentabrams.com refs across docs + code swapped to
  venturaclaw.com.
- venturaclaw.agentabrams.com + businessclaw.agentabrams.com both 301
  to venturaclaw.com, except /oauth/* + /healthz which still proxy to
  the app so existing OAuth callback URLs in provider consoles keep
  working.

CC_SECRET note: rotated during this migration after rsync --delete
wiped the .env on Kamatera. Old encrypted credentials.json preserved
as data/credentials.json.pre-rotate-2026-05-06.bak; vault refilled
from secrets-manager via sync-tokens.js (5/14 connectors back, same
as pre-rotation).

Steve flagged that login.html, DEPLOY.md, API.md, MARKETING.md, sync-tokens
defaults, package.json names, viewer/server.js, integration tests, and
relay/server.js still carried the old brand. Mass-rename:

- businessclaw.agentabrams.com -> venturaclaw.agentabrams.com
- *.businessclaw.local         -> *.venturaclaw.local (admin/demo accounts)
- steve@businessclaw.com       -> steve@venturaclaw.local
- info@businessclaw.com        -> info@venturaclaw.agentabrams.com
- commerce-claw                -> ventura-claw
- commerceclaw / businessclaw  -> venturaclaw

Also renamed the email fields in production users.json on Kamatera
(admin@businessclaw.local -> admin@venturaclaw.local; steve@businessclaw.com
-> steve@venturaclaw.local). Hashed passwords preserved in place.

Login on the canonical hostname now works with steve@venturaclaw.local +
the existing password (verified 200 OK).

Rename the product and live hostname end-to-end:
- 96 user-visible refs swapped across public HTML, server.js, marketing
  pages, login, oauth-setup, JSON-LD/OG tags. Brand-name keeps the
  italic-gold treatment by splitting Ventura<em>Claw</em>.
- Subtitle 'Connected Commerce' → 'Connected Operations'.
- Footer email info@businessclaw.com → info@venturaclaw.agentabrams.com
  (mailbox provisioned on Purelymail with full MX/SPF/DKIM/DMARC).
- Bulk-select-and-connect on /connections: per-tile checkboxes plus a
  Select-all / Connect-selected control bar that walks selected
  providers through their OAuth popups in a sessionStorage-backed
  queue, with a Continue button between each so each popup gets a
  fresh user gesture and avoids browser pop-up blocks.
- Hardcoded log tag [commerce-claw] → [ventura-claw].
- launchd job com.steve.businessclaw-sync → com.steve.venturaclaw-sync;
  sync-tokens.js paths + default BC_URL repointed to venturaclaw.

Live at https://venturaclaw.agentabrams.com (Let's Encrypt SSL,
nginx → 127.0.0.1:9788). businessclaw.agentabrams.com 301-redirects
all paths except /oauth/* + /healthz so existing OAuth callback URLs
registered in each provider's developer console keep working.

- MARKETING.md: Show HN post · 3 seed comments · Twitter · IndieHackers · Search Console + IndexNow steps
- /static/og-cover.png (1200x630 raster from og-cover.svg via headless Chrome) — needed because some social platforms reject SVG OG
- Linter polish: contact email shifted info@agentabrams.com → info@businessclaw.com
- brand.html: sticky section heads, identity card, team grid; admin-connectors: Prime cache button (already shipped earlier, this picks up linter formatting)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Belongs with d9e7a6c — without this file the previous commit ships a broken homepage. fill.html and app/icon.svg left uncommitted (not from this loop).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Saves ~7KB on every homepage HTML response (37.7KB → 30.8KB).
Repeat visitors hit the CSS from cache (express.static maxAge:7d).
Pure refactor — zero visual or behavioral change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- /changelog top entry now reflects what actually shipped overnight (admin endpoint, sequential prime fix, /feed, /faq, /docs, etc.)
- /admin/connectors filter bar gets a ● Prime cache button that calls /api/admin/cache/prime, shows primed N/5 + cache size

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Re-fires the 5 preset cache primes on demand — useful when Mac1 evicts qwen3:14b
(concurrent codex 8-way runs etc.) and visitors are eating cold-loads. Admin-gated.
Audit-logged as admin_cache_prime. Returns {ok, primed, total, cache_size}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Public pages added:
- /faq dedicated page (FAQPage JSON-LD for Google rich-result eligibility)
- /docs page · 5 curl examples for public + auth API surface
- /changelog page · 4 dated entries · gold-rail timeline
- /feed RSS · IndieWeb / reader auto-discovery
- /about /privacy /terms (required SaaS pages)
- Branded 404 (HTML for browsers, JSON for /api/*)

Homepage improvements:
- "How it works" 3-step strip (Type → Route → Approve, code-on-card)
- 8-question FAQ section with details/summary expand
- Live route trail widget · rotating eyebrow taglines (4× cycle)
- Tile float animation · animated thinking state on demo
- ?demo=<query> deep-link auto-fires from connector pages
- noscript fallback (graceful degrade for JS-off visitors)
- <link rel="prefetch" href="/connectors"> · theme-color · RSS link

Perf + ops:
- /healthz JSON variant (uptime, mem, demo cache size, LLM endpoints)
- Sequential preset cache prime on boot (4/5 fills, 20ms cached responses)
- Allowlist env loader extended for OLLAMA_FALLBACK_URL + CC_KEY_ID
- robots.txt cleanup (removed dead duplicate handler)
- Footer cross-links every shell page (/connectors /about /faq /docs /privacy /terms /sitemap.xml)
- Sitemap grew 3 → 65 URLs · ItemList JSON-LD on /connectors
- Favicon (gold connector-graph SVG) at .ico/.svg/apple-touch paths

Security:
- esc() XSS sweep on chat.html + brand.html (completes all 5 HTML pages)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Public surface (anon-accessible):
- / homepage with live-demo widget · 56-connector grid · "How it works" 3-step · 8-Q FAQ · live route trail · rotating taglines · branded 404
- /connectors directory + 56 per-connector pages w/ ItemList JSON-LD
- /privacy /terms /about /faq (FAQPage JSON-LD) /docs (5 curl examples)
- /sitemap.xml (64 URLs) · /robots.txt · /healthz JSON variant · favicon (gold connector-graph SVG)
- POST /api/demo-classify (rate-limited 8/min/IP, no execute, intent-only)
- GET /api/public/connectors

Auth surface:
- POST /api/auth/login + bcrypt password hashing + signed session cookies
- POST /api/me/connections/:id (per-user encrypted token vault)
- POST /api/me/connections/import (paste-claude-json + paste-env auto-detect)
- POST /api/chat (regex planner → qwen3:14b LLM escalation → tool-call queue)

Admin surface:
- /admin/connectors /admin/users /admin/approvals /admin/audit /admin/oauth-setup
- POST /api/admin/oauth/:vendor/credentials + /sandbox (Browserbase)
- GET /admin/audit (event ledger)

Security:
- AES-256-GCM at-rest encryption with versioned key_id envelope (rotation supported)
- Atomic write + fsync(2) in save() · loud-fail load() (corrupt → exit, never silent default)
- chmod 0700 data/ + 0600 *.json
- CSP · HSTS preload · X-Frame DENY · X-Content-Type-Options nosniff
- Sensitive-action approval queue · audit trail
- esc() XSS sweep across all 5 user-facing HTML pages

LLM:
- Local Ollama (Mac1 qwen3:14b via tailnet 100.94.103.98:11434) — zero third-party API
- Pre-warm on boot · parallel preset-cache prime · 25min keep-alive ping
- 10min LRU response cache (200 entries) · Mac2 fallback chain (gemma3:12b, dead until OLLAMA_HOST=0.0.0.0)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>