Clears GHSA-337j-9hxr-rhxg and GHSA-wrjc-x8rr-h8h6 (no 6.x backport) plus
GHSA-jjmj-jmhj-qwj2, which has no patch at all on the react-router-dom 6.30.x
line. Drops the now-unused @remix-run/router resolution.
Also pins postcss 8.5.23 (GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q) and adds
the brace-expansion ^5.0.5 descriptor, which was still resolving to 5.0.6.
Drop the pinned `model: sonnet` from the reasoning-heavy subagents so they
follow the session model instead of being forced down to Sonnet. Running an
Opus session now gets Opus subagents; deliberately dropping to a cheaper
session model is respected too.
Mechanical agents (browser-check, profiler, translator) keep their haiku pin
— that pin is a capability statement, not a stale default, and should hold
regardless of session model.
Keep the PR review/merge workflow independent of GitHub issues and
Projects, matching bitsocial-react-hooks. Update all three toolchain
mirrors, record the surprise in known-surprises.md, and regenerate
llms files.
Resolves five open advisories (GHSA proxy inheritance, form serializer
maxDepth bypass, HTTP/2 maxBodyLength bypass, NO_PROXY bypass, and
auth prototype pollution) by pinning axios to 1.18.1.
* Replace directories with address-owned defaults
* Translate default community updates
* Document default community behavior
* Use comments in CID routes
* Polish default community review flow
* fix(starter-subscriptions): harden list updates
* refactor(home): derive subscription state during render
* fix(routing): harden comments link handling
* fix(electron): load tar namespace export
* fix(subscriptions): leave after provenance races
* fix(routing): autolink default TLD shorthand
* fix(starter-subscriptions): show accurate fallback warning
* fix(home): wait for default community list
* fix(onboarding): recover from storage access errors
* fix(subscriptions): surface persistence failures
Bump vulnerable transitive dependencies via Yarn resolutions and replace
the unpatched decompress package with tar and extract-zip for Kubo archive
extraction in the Electron build pipeline.
* feat: pure p2p by default with p2p stats tab and 5chan-style advanced settings
Seedit now configures a browser libp2p node via window.defaultPkcOptions before
render (with a localStorage opt-out), like 5chan. Adds a "p2p stats" preferences
tab ported from 5chan (peers, transfer, world map), renames "plebbit options" to
"advanced" and revamps it to match 5chan (pure p2p toggle, gateway fields hidden
in pure p2p mode, RPC placeholder instead of the ? help box). Existing browser
accounts auto-upgrade to pure p2p options on load. Also fixes an aborted-lookup
race that could cache a wrong "Your IP" country flag for 60s, and reads
chainProviders from the account top-level per bitsocial-react-hooks 0.1.27.
Upgrades bitsocial-react-hooks to 0.1.27 and pkc-js to 0.0.65 to match 5chan.
* fix(settings): show first full node RPC URL instead of array in advanced settings input
Remove the topbar Tags dropdown and the four per-tag hide settings
(adult/gore/anti/vulgar) inherited from the retired json lists. NSFW
status now comes from a per-directory nsfw boolean in the seedit
directories metadata, controlled by a single 'Hide communities tagged
as NSFW/18+' setting (persisted state migrates automatically).
TypeScript 7's tsc is the Go-native compiler, so the separate tsgo
binary is redundant. Switch the type-check script to `tsc --noEmit`,
remove the devDependency, and update AGENTS.md + generated llms files.
* chore(deps): upgrade bitsocial-react-hooks to 0.1.26 and core deps
- @bitsocial/bitsocial-react-hooks 0.1.2 -> 0.1.26
- add @pkcprotocol/pkc-js 0.0.62 and @bitsocial/bso-resolver 0.0.8 (electron RPC)
- react/react-dom 19.1.2 -> 19.2.7, @types/react 19.2.16, @types/react-dom 19.2.3
- vite 8.0.5 -> 8.0.16 (dep + resolution)
- node-fetch 2 -> 3.3.2, drop @types/node-fetch (v3 ships its own types)
- @types/node 20.8.2 -> 20.19.37, fs-extra 11.2.0 -> 11.3.0
- add @electron/rebuild 3.7.2 + electron:rebuild-native script (better-sqlite3
now ships via pkc-js)
* refactor(electron): port RPC from plebbit-js to pkc-js
- replace start-plebbit-rpc.js with start-pkc-rpc.js + start-pkc-rpc-core.js
(5chan template, same 9138 port and auth-key handling)
- add pkc-rpc-options.js with BSO name resolvers via @bitsocial/bso-resolver
- add pkc-paths.js: data dir moves from EnvPaths('plebbit') / .plebbit to
EnvPaths('pkc') / .pkc, with a one-time rename of the legacy plebbit data
dir so existing users keep their communities and accounts
- main.js, start-ipfs.js, log.js now resolve data/log paths through pkc-paths
- preload.mjs exposes window.defaultPkcOptions (pkcRpcClientsOptions) and
window.pkcRpcAuthKey via pkc-named IPC channels
* chore: rename local data dir references from .plebbit to .pkc
- electron:before:delete-data clears both .pkc and legacy .plebbit
- android icons temp dir renamed to /tmp/seedit-android-icons
- forge.config.js excludes both .pkc and .plebbit from packages
- knip.jsonc drops @plebbit/plebbit-js entries now that the electron RPC
imports @pkcprotocol/pkc-js directly
* fix: align renderer with pkc-named account options from hooks 0.1.26
- window.defaultPlebbitOptions -> window.defaultPkcOptions (p2p. subdomain)
- account.plebbitOptions/plebbitRpcClientsOptions -> pkcOptions/
pkcRpcClientsOptions in settings views and account import utils
- account.plebbit -> account.pkc when stripping the client instance from
account export/editor JSON
- rpc settings data path now read from pkcRpcSettings.pkcOptions.dataPath
- account import keeps a shim that upgrades legacy plebbitOptions exports
- drop unused catch binding in start-pkc-rpc.js (oxlint)
* chore(ai): move Claude Code hooks to .claude/settings.json entry point
Adopt the reworked hook entry points: Claude Code hooks now live in
.claude/settings.json (settings-format with $CLAUDE_PROJECT_DIR paths),
the obsolete .claude/hooks.json is removed, and .cursor/hooks.json is
updated to the compact format. Hook scripts are unchanged.
* chore(ai): sync agent descriptors with 5chan rework, adapted for seedit
Port the reworked agent descriptors across .claude, .cursor, and .codex:
tools: frontmatter for read-only agents, browser-session guidance,
untrusted page-content rules, machine-path removal, and yarn doctor/knip
verification guidance.
seedit adaptations: correct the Android appId to seedit.android (the old
copies wrongly said fivechan.android), use a seedit-test-api35 AVD name,
rewrite test-apk around the direct catbox.moe FileUploaderPlugin (seedit
has no WebView upload automation or instrumentation test suite), replace
5chan board/catalog route examples with /s/<community-address> routes,
and point react-scan wiring at vite.config.js instead of the 5chan-only
src/lib/react-scan.ts.
* fix(agent hooks): port harness payload parsing and stop-gate fixes from 5chan
The shared hook implementations now parse both Cursor ({file_path}) and
Claude/Codex ({tool_input: {file_path}}) stdin shapes, normalize absolute
paths to repo-relative, emit hookSpecificOutput additionalContext on
PostToolUse so reminders reach the model, honor stop_hook_active to avoid
stop loops, skip verification on a clean tree, and exit 2 (blocking) on
verify failure. sync-git-branches keeps bitsocialnet/seedit and gains the
unmerged-PR output check.
* docs(ai): merge 5chan AGENTS.md and playbook improvements, adapted for seedit
AGENTS.md: document the harness-specific hook entry points (.claude/
settings.json, .cursor/hooks.json, .codex/hooks.json), add the
ai-workflow:check router row and command, browser-session confirmation
rules for playwright verification, the translate-skill router row, and
reworked AI Tooling Rules ordering. seedit keeps its own project
overview, changelog-based maintenance rules, and stays without
DESIGN.md/blotter/low-spec/android-usb content.
Playbooks: rewrite hooks-setup.md around the new entry points and
shared script behavior, add the committed skills/subagents index to
skills-and-tools.md, and note the canonical commit/issue-format skills
in commit-issue-format.md (without 5chan's required-scope rule, which
seedit does not use).
* chore(ai): add toolchain drift validator from 5chan
Add scripts/validate-ai-workflow.mjs and the ai-workflow:check script.
Fix the one drift it found: seedit's .claude and .cursor copies of the
profile-browsing skill disagreed on the dev-server probe URL and the
Portless note.
* chore(ai skills): port generic 5chan skill fixes and correct seedit misadaptations
Port generic improvements: stale main->master branch names in deslop and
you-might-not-need-an-effect, invalid rg --type tsx flag in
fix-merge-conflicts, the reworked verified/update-in-place readme skill,
the Chesterton's Fence rule in refactor-pass, the independent-subagent-
verification rule in review-and-merge-pr, harness-neutral wording in
inspect-elements/implement-plan/translate.
Correct seedit misadaptations left over from the original copy: test-apk
now uses appId seedit.android, a seedit AVD, and the direct catbox.moe
FileUploaderPlugin flow instead of 5chan's WebView upload automation and
instrumentation suite; profile-browsing drops 5chan board-code routes for
/s/<community-address>.
Kept seedit-flavored: commit-format (no required scope), release and
release-description (no blotter), doctor-vs-repo-standard verification
wording in implement-plan and review-and-merge-pr.
* docs(llms): regenerate llms indexes after AGENTS.md and playbook updates
* feat(directories): add directory list utils, vendored data and sync script
Port 5chan's directory machinery adapted to seedit terminology: per-code
candidate community lists, ranking/winner selection, directory codes as
subscription entries, legacy default migration transform, and a vendored
mirror of bitsocialnet/lists/seedit-directories with a sync:directories
script.
* feat(directories): resolve subscriptions and defaults from directory lists
Add hooks that fetch per-code candidate lists from the lists repo (1h
localStorage cache, in-flight dedup, vendored fallback), pick the
highest-ranked online winner with offline rotation, expand
account.subscriptions directory codes at read time, and derive the
default communities for /s/all from the union of all directory winners.
Rework the one-time auto-subscribe into the directory migration: drop
the dead legacy default communities and subscribe the 10 directory
codes under a new per-account localStorage guard.
* feat(directories): directory routes, feeds and subscribe UI
/s/<code> resolves like a community page via the directory winner while
/s/<address> keeps working; the home feed expands directory-code
subscriptions into winner addresses without flashing the empty state;
the subscribe button targets the code on directory routes with a
'subscribe to this community only' pin action; subscription lists render
directory entries as s/<code> with a (directory) marker and the resolved
community as subtitle.
* test(directories): cover directory codes, winner ranking and migration
Vitest coverage for isDirectoryCode (reserved words, dots, unknown
codes), candidate ranking and offline rotation, subscription expansion
dedupe, list normalization with defaults, and the legacy migration
transform including idempotence.
* style(directories): apply oxfmt formatting
* chore(directories): vendor real community addresses for the 10 default directories
* chore(profiling): port 5chan dev-only react-scan setup for report API and __PROFILING__ flag
Replace the @react-scan/vite-plugin-react-scan wiring with 5chan's manual
dev-only src/lib/react-scan.ts, imported in the entry file. It exposes
window.__getReactScanReport() and window.__ELEMENT_SOURCE__ (element-source
helpers the inspect-elements skill already referenced) and honors
window.__PROFILING__ to hide the toolbar during automated profiling.
Update profile-browsing SKILL.md and profiler agent copies to match.
* chore(directories): vendor .bso names for default directory communities
* fix(subscriptions): retry directory migration in-session after transient setAccount failure
* fix(electron): migrate legacy project-root .plebbit dev data dir to .pkc
* fix(directories): seed useDirectoryLists synchronously from cache/vendored data
* test(directories): guard directory codes against defaults drift
* chore(scripts): reject path-traversal file names in sync-directories
* fix(profiling): handle react-scan chunk-load failure and dedupe not-ready stubs
* style(directories): replace deprecated word-wrap with overflow-wrap
* docs(agents): align test-apk logcat reference, broaden conflict-marker scan, dedupe committed skills guidance
* chore(directories): vendor pics-posting.bso name
* fix(review): address PR feedback
* fix(review): address migration race feedback
