diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml new file mode 100644 index 0000000..f117765 --- /dev/null +++ b/.github/workflows/deploy-pages.yml @@ -0,0 +1,47 @@ +# Build web/ Next.js static export and push to gh-pages branch. +# Triggers on pushes to main that touch web/ files, or on manual dispatch. + +name: Deploy Pages + +on: + push: + branches: [main] + paths: + - "web/**" + workflow_dispatch: + +permissions: + contents: write + +defaults: + run: + working-directory: web + +jobs: + deploy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: pnpm/action-setup@v4 + with: + version: latest + + - uses: actions/setup-node@v4 + with: + node-version: "22" + cache: pnpm + cache-dependency-path: web/pnpm-lock.yaml + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Build + run: pnpm run build + + - name: Deploy to gh-pages + uses: peaceiris/actions-gh-pages@v4 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + publish_dir: web/out + force_orphan: true diff --git a/.github/workflows/nextjs.yml b/.github/workflows/nextjs.yml new file mode 100644 index 0000000..4880548 --- /dev/null +++ b/.github/workflows/nextjs.yml @@ -0,0 +1,49 @@ +# Next.js CI — runs only when files under web/ change (add your app at ./web). +# To use the repo root instead, remove defaults.run.working-directory and adjust cache paths. + +name: Next.js + +on: + push: + branches: [main, develop] + paths: + - "web/**" + pull_request: + branches: [main, develop] + paths: + - "web/**" + +permissions: + contents: read + +defaults: + run: + working-directory: web + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: pnpm/action-setup@v4 + with: + version: latest + + - uses: actions/setup-node@v4 + with: + node-version: "24" + cache: pnpm + cache-dependency-path: web/pnpm-lock.yaml + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Lint + run: pnpm run --if-present lint + + - name: Build + run: pnpm run build + + - name: Test + run: pnpm run --if-present test diff --git a/CHANGELOG.md b/CHANGELOG.md index 883a9ad..d453a99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ All notable changes to this project will be documented in this file. +## [0.9.0] — 2026-03-22 + +### Added +- **Shared HTTP client** (`http-request`) for validation and hooks with timeouts and response size limits. +- **HTTP hook SSRF mitigation** — resolves hook URLs and blocks private/loopback targets by default; override with `Q_RING_ALLOW_PRIVATE_HOOKS=1` if needed. Denied attempts emit `policy_deny` audit events. +- **Next.js GitHub Pages site** (`web/`) — Tailwind CSS v4, Motion animations, Getting Started (`/docs`) and Changelog (`/changelog`) pages, mobile nav, copyable terminals, animated stats, interactive architecture diagram. Deploy via `deploy-pages.yml` and CI via `nextjs.yml`. + +### Changed +- **Dashboard** — pathname routing fixes, SSE backpressure, tighter CORS, inline/system fonts and assets for offline use. +- **README** — notes on SSRF protection for HTTP hooks. + ## [0.4.0] — 2026-03-22 ### Added diff --git a/README.md b/README.md index af4a6af..ee78214 100644 --- a/README.md +++ b/README.md @@ -320,6 +320,8 @@ qring hook test Hooks are fire-and-forget: a failing hook never blocks secret operations. The hook registry is stored at `~/.config/q-ring/hooks.json`. +**SSRF protection:** HTTP hook URLs targeting private/loopback IP ranges (`127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`) are blocked by default. DNS resolution is checked before the request is sent. To allow hooks targeting local services (e.g. during development), set the environment variable `Q_RING_ALLOW_PRIVATE_HOOKS=1`. + ### Configurable Rotation Set a rotation format per secret so the agent auto-rotates with the correct value shape. diff --git a/package.json b/package.json index d5fe73d..fb0ce0b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@i4ctime/q-ring", - "version": "0.4.0", + "version": "0.9.0", "mcpName": "io.github.I4cTime/q-ring", "description": "Quantum keyring for AI coding tools — Cursor, Kiro, Claude Code. Secrets, superposition, entanglement, MCP.", "type": "module", diff --git a/server.json b/server.json index 4b5abcd..a18a9e7 100644 --- a/server.json +++ b/server.json @@ -6,12 +6,12 @@ "url": "https://github.com/I4cTime/quantum_ring", "source": "github" }, - "version": "0.4.0", + "version": "0.9.0", "packages": [ { "registryType": "npm", "identifier": "@i4ctime/q-ring", - "version": "0.4.0", + "version": "0.9.0", "transport": { "type": "stdio" } diff --git a/src/core/dashboard-html.ts b/src/core/dashboard-html.ts index d7ea11a..ac5b9ec 100644 --- a/src/core/dashboard-html.ts +++ b/src/core/dashboard-html.ts @@ -13,9 +13,6 @@ export function getDashboardHtml(): string { q-ring — quantum status - - -