04edde5Embed secure-composition library in src/ for Temper compatibility
Temper doesn't support cross-library imports yet, so secure-composition
must be embedded as a subdirectory within src/ (same-library submodule).
Changes:
- Move secure-composition/ to src/secure-composition/
- Update imports to ./secure-composition/sql and ./secure-composition/html
- Remove dependencies config (not needed for embedded modules)
Build output now includes both ormery/ and secure-composition/ directories,
ensuring all target language repos (JS, Python, C#, Rust, Java, Lua) get
the full secure-composition library when the CI pipeline publishes.
All 87 tests passing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
7550780Fix secure-composition imports to target specific files
Temper requires imports to target specific .temper.md files within
subdirectories rather than directory-level imports. Updated:
- ormery.temper.md: Import sql/SqlBuilder from sql/builder.temper.md
and SqlFragment from sql/model.temper.md
- syntax-highlighter.temper.md: Import html/SafeHtml from
html/safe-html.temper.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
5087716Replace duplicate implementations with secure-composition library
- Remove local src/sql/, src/html/, src/core/, src/url/ directories
- Update imports in src/ormery.temper.md and src/syntax-highlighter.temper.md
- Point to ../secure-composition/src/sql and ../secure-composition/src/html
- Fixes CI build failures ("No member appendSafe in SqlBuilder")
- All 87 tests passing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
931d04dRemove appendSafe from public API to eliminate SQL injection vector
SECURITY FIX: Removed public appendSafe() method from all builder classes
(SqlBuilder, Collector, ContextualAutoescapingAccumulator) to prevent
SQL injection and XSS attacks.
Changes:
- SqlBuilder.appendSafe() removed - forces use of typed methods
- Refactored safeSql() to create SqlFragments directly
- Updated internal appendList to use buffer.add() directly
- Made collector appendSafe private (appendFixed/appendKnownSafe)
- Updated README and added SECURITY-IMPROVEMENTS.md documentation
Before: External code could bypass escaping via appendSafe(userInput)
After: All external code must use typed, escaped methods (appendString, appendInt32, etc.)
This eliminates the primary SQL injection attack vector identified in
semgrep rules CWE-89. All generated target languages (JS, Python, Java,
C#, Rust, Lua) will be updated when published to child repos.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
d695f7dcontinuous error log: no paper cut, no header for text prints
Text endpoint now prints as one long continuous log — no header/dividers,
no paper cut. Just the content followed by 3 blank lines of spacing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
c4b28efadd text printing endpoint with Elixir error filtering
New POST /print/text?source= endpoint accepts plain text for receipt
printing. Elixir/Phoenix sources are filtered to only print [error]
blocks. Text is wrapped in receipt-style formatting with headers and
dividers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0d5f530improve: refactor MarkdownEditorLive with tests, extract pure functions, remove inline CSS
- Extract BlogWeb.MarkdownEditor.Formatter with pure functions for all
markdown formatting operations (split_text, apply_format, to_html)
- Remove ~420 lines of duplicated handle_format/7 from both LiveView
and Component, replaced with shared Formatter module
- Fix bug: LiveView used EarmarkParser (not a dependency) instead of MDEx
- Replace rescue blocks with proper {:ok, _}/{:error, _} pattern matching
- Remove inline CSS styles, add .markdown-editor-window/.markdown-editor-content classes
- Add @moduledoc to both LiveView and Component (Credo strict compliance)
- Extract toolbar/cheatsheet into function components in the Component
- Initialize all assigns in mount/3 to avoid potential KeyError
- Add 35 unit tests for Formatter (split, format with/without selection, composition)
- Add 8 integration tests for MarkdownEditorLive (mount, events, handle_info)
- Zero Credo issues in strict mode across all 3 files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
71dc1a3Separate commit messages clearly with dividers
Each commit now shows SHA and message on separate indented lines with
blank line spacing between commits. Dashed divider line between push
event entries for clear visual separation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
62be7c1Condensed layout: one line per push, full commit messages below
Push header on single line: SHA +N/-N repo/branch date.
Commit messages rendered with pre-wrap for full multi-line display.
Added debug logging to diagnose missing commit messages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0cbdbe1Fix missing commit messages, filter empty diffs
The GitHub Events API returns commits: null, so commit messages were
always empty. Now fetches commits from the Compare API instead, which
has full commit data including messages. Also filters out push events
with +0/-0 diffs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
a869954Make poller and mount crash-resistant
Poller rescues errors during poll to avoid GenServer crash.
LiveView mount catches :exit if poller isn't running yet.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ae794fbStore work log commits in Postgres, add window to terminal desktop
- Migration creates work_log_commits table with unique SHA index
- WorkLogCommit schema + WorkLog context for DB reads/writes
- Poller writes to DB via compare API, reads from DB
- Work Log window on terminal_live desktop (centered, draggable)
- Desktop icon for Work Log, Leica icon moved to bottom
- Standalone /work-log page reads from same DB
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
"Debut. Features Billy Strings on guitar and added vocals (and a nice jam, too)."
TAP TO SEE AND PLAY JAMS
What's Going Through Your Mind
.500
TAP TO FLIP BACK
8 jams
★
2024-08-07
10:29
Van Andel Arena · Grand Rapids, MI
Debut. Features Billy Strings on guitar and added vocals (and a nice jam, too).
★
2024-08-15
23:05
The Woodlands · Dover, DE
Nothing green here. With Trey back on lead vocals, a great version of the song breaks from what already seems like a signature lick to spark a huge jam. About seven minutes in, sound swells to inform that patterned bounce, and then the effects kick in, with Page laying heavy on his synths. Play coasts before, as one, the four become more active, propelling the play. Trey shears blocks of sound, an impossibly cool pattern, one that, on Fish's back beat, builds to a thrilling conclusion.
★
2024-08-31
16:34
Dick's Sporting Goods Park · Commerce City, CO
Question isn't when, but if "WGTYM?" won't jam. Seems improbable, given Trey's line from the vocal section is, like a drug, seemingly designed to bring the band back for more. Impressive, extended, synth-heavy improv runs to break for a very notable -> into "Crosseyed."
★
2024-12-31
17:14
Madison Square Garden · New York, NY
The centerpiece of the NYE '24 extravaganza with additional backing vocals, the jam takes a drastic turn into EDM, a genre heretofore unexplored on the Phish stage, and is interspersed with vocal quotes from several other Phish tunes (see setlist notes) before finally crashing -> into "CDT".
★
2025-02-01
?
Moon Palace · Quintana Roo, Cancun, Mexico
The first post-EDM version of "WGTYM" is a distinctly slower version of the song. However, the jamming out of the song remains top-notch. Fish takes the reins initially leading a driving, percussive jam. This later gives way to a feel-good explosion of jubilant play that evokes Phish on a beach. The band eventually winds its way back to the "Mind, mind, mind," refrain.
★
2025-06-24
42:40
Petersen Events Center · Pittsburgh, PA
-> from a fun "YEM". Given how strong its jamming was from the first few versions played, it may have seemed inevitable a HUGE version would appear. This 40 minute masterpiece is just that. Moving from section to section with deftness and poise. Clearly, the band feels comfortable jamming this song, and this may be the cream of the "WGTYM" crop. Must-hear.
★
2025-07-18
28:07
United Center · Chicago, IL
Though Trey hints early on that the answer to the question may be that there is "nobody home", there's actually plenty to discover in this wide ranging version that finds the band locking on to a handful of memorable progressions, moving seamlessly between sections, and soaring over peaks before accelerating through groove laden depths to deliver a sustained and fiercely rocking finale that eventually finds itself becoming suddenly "Crosseyed".
★
2025-09-14
17:34
Coca-Cola Amphitheater · Birmingham, AL
> from a AWOH. Patient, rhythmic, and hypnotic; the band takes an approach here that, while it feels familiar, is interpreted through the fresh lens of the past handful of years' inventive play and that occupies a space halfway between aggression and ambience. Fans of peak free exploration will want to seek out this version.
Disappointed that War does not lead to actual combined-arms conflict.
jeff
04:01 AM
that would be hard to conjure
jeff
04:02 AM
I am so excited that this works and is a successful combination of windows and old apple lol
Uechi Nerd
04:02 AM
Probably for the best, actually. That shit is very very messy.
Uechi Nerd
04:02 AM
I am intrigued and happy it works!
Uechi Nerd
04:03 AM
I respect the wizardry.
Visitor7804
04:05 AM
this is delightful.
jeff
04:06 AM
hell yeah visitor 7804, this is livin' brother
guy4get
04:07 AM
i've never felt so alive
EarlofVincent
04:09 AM
Commencing experiment in 3....2....
jeff
04:14 AM
1
leah
04:16 AM
hi!
leah
04:16 AM
this is lovely
jeff
04:21 AM
hi! lol I was just like what if I combined Mac and windows and added a flower tree of life and called it my homepage and then smoked some weed and made it happen in an empty mall in Connecticut
B. Droptables
10:51 AM
Always cool to play with your toys.
Visitor1128
08:47 AM
yo!
Visitor1128
08:48 AM
i can barely work my phone. what am i doing here?
jeff
09:04 AM
the phone is not optimized yet but it "kind of works" I am sorry lol
jeff
09:04 AM
you have to pick a username, then it goes to the chat, then if you hit the bottom tabs it'll let you go to the app sections.
Bobdawg
04:43 AM
Hi everybody this is my blog I hope you enjoy it I did some more changes and anyone can write a post here now for me.
dinkleberg
01:45 AM
ALL HAIL TREE OF LIFE
jeff
08:55 PM
hi Hacker News
jeff
04:28 PM
hey there I am not really Jeff
Mal Function
05:34 PM
Hey! Please reveal... how exactly do I actually use losselot on my Mac? I've run the git clone commend in Terminal.app and seem successfully to have installed into a new <losselot> sub-folder in my home folder but now???