117 Commits

Author	SHA1	Message	Date
Nick Sweeting	f3eabbe98b	Fix real flow fixture title assertion	2026-05-23 15:16:19 -07:00
Nick Sweeting	92339e08f0	Prepare dev demo deploy	2026-05-22 20:12:48 -07:00
Nick Sweeting	4ee690cc23	Keep runner event tests on one loop	2026-05-18 21:55:10 -07:00
Nick Sweeting	943fef37c3	Stabilize install-dependent CI tests	2026-05-18 21:44:17 -07:00
Nick Sweeting	abdede3609	Persist derived config unsets	2026-05-18 21:02:32 -07:00
Nick Sweeting	7236d4bd65	Stabilize Chrome-backed ArchiveBox tests	2026-05-18 20:41:35 -07:00
Nick Sweeting	dacf163498	Stabilize browser and runner CI tests	2026-05-18 20:27:56 -07:00
Nick Sweeting	13908547a6	Use system Chrome in browser flow tests	2026-05-18 20:15:27 -07:00
Nick Sweeting	5b6288c96a	Install managed Chrome in browser-dependent CI tests	2026-05-18 19:44:21 -07:00
Nick Sweeting	9817a27a64	Use detached background hook completion	2026-05-18 08:44:58 -07:00
Nick Sweeting	c1593fe55b	Report supervisord runner in live progress	2026-05-18 02:10:45 -07:00
Nick Sweeting	ea4ce5b641	Prepare ArchiveBox 0.9.30rc81 demo release	2026-05-18 01:51:55 -07:00
Nick Sweeting	0e2ae425ce	Start Sonic worker under supervisord	2026-05-17 21:24:02 -07:00
Nick Sweeting	0cc4251c8a	Update ArchiveBox for abx dependency releases	2026-05-16 23:50:16 -07:00
Nick Sweeting	6ff3d344ea	Fix crawl event flow and UI archiving	2026-05-15 23:01:45 -07:00
Nick Sweeting	e2f39f3054	Bump Chrome extension loader fix	2026-05-15 14:11:29 -07:00
Nick Sweeting	dcdce367d3	Use published Chrome session isolation fix	2026-05-15 13:35:02 -07:00
Nick Sweeting	ff3b675358	Allow live Chrome extractor failures within budget	2026-05-15 11:39:39 -07:00
Nick Sweeting	a52f31ed37	Align real CLI flow test with extractor failure budget	2026-05-15 11:31:50 -07:00
Nick Sweeting	6511eaa6b8	Bump preload listener fix	2026-05-15 10:34:06 -07:00
Nick Sweeting	1c0d8b44a0	Find snapshot completion events through bus history	2026-05-15 10:06:24 -07:00
Nick Sweeting	a5ccebe1c5	Fix Chrome-backed title extraction tests	2026-05-15 00:22:49 -07:00
Nick Sweeting	7fe127ac24	Fix Chrome-backed archive flows	2026-05-15 00:08:42 -07:00
Nick Sweeting	fa15e1edfa	Fix docker runtime and real crawl flows	2026-05-14 21:24:32 -07:00
Nick Sweeting	2c3146549a	Use published deps and isolate runner tasks	2026-05-14 17:24:26 -07:00
Nick Sweeting	9b9d4b275c	Stabilize event and schedule E2E tests	2026-05-14 16:30:55 -07:00
Nick Sweeting	c7b3331872	fix hook node runtime paths	2026-05-13 08:37:37 -07:00
Nick Sweeting	5f8098c632	fix recursive crawls and docker runtime	2026-05-13 08:13:33 -07:00
Nick Sweeting	5d60098618	fix: stabilize dockerized crawl runtime	2026-05-13 02:05:07 -07:00
Claude	2ea66d05d1	Move tag slug logic onto Tag.slug @property ... Replaces the tag_filename_safe() helper with a Tag.slug property that returns the slugified form via django.utils.text.slugify. Call sites now just use tag.slug directly.	2026-04-21 17:32:25 +00:00
Claude	0041a2d407	Sanitize tag export filenames via django.utils.text.slugify ... Addresses review feedback from cubic and devin: quote()'s percent- encoding isn't decoded by browsers in Content-Disposition's filename parameter (Safari saves literal %20). Switch to Django's slugify() which does NFKD normalization, ASCII transliteration, and replaces punctuation with hyphens — producing clean names like "tag-alpha-research-urls.txt". - Add tag_filename_safe(name) helper wrapping slugify - Use it in both tag export endpoints - Drop the now-unneeded JS fallback name (server always sets Content-Disposition)	2026-04-21 17:30:50 +00:00
Claude	ec9c7c89f4	Drop Tag slug column and use URL-encoded names ... Tags now support full unicode with no restrictions. URL-encode the tag name wherever it previously used the slug (export filenames, lookups). - Remove `slug` field, `_generate_unique_slug`, and slug handling in save() - Add migration 0034 to drop the slug column - `get_tag_by_ref` now resolves by URL-decoded exact name match - Tag search/autocomplete/export filenames use the name directly - Drop slug from admin search_fields/readonly_fields/fieldsets - Remove slug display from similar-tag cards and client download filename	2026-04-20 17:05:07 +00:00
Nick Sweeting	4d66996569	small fixes	2026-04-06 23:47:38 -07:00
Nick Sweeting	3e7b83ac91	bump versions	2026-04-04 23:10:12 -07:00
Nick Sweeting	f3622d8cd3	update working changes	2026-03-25 05:36:07 -07:00
Nick Sweeting	80243accfd	Fix archivebox CI regressions	2026-03-24 15:36:23 -07:00
Nick Sweeting	68d9e30c5f	Fix pytest basetemp handling in test harness	2026-03-24 14:46:05 -07:00
Nick Sweeting	ed1ddbc95e	Fix CI workflows and migration tests	2026-03-24 13:37:02 -07:00
Nick Sweeting	50286d3c38	Reuse cached binaries in archivebox runtime	2026-03-24 11:03:43 -07:00
Nick Sweeting	e1eb5693c9	split CrawlSetup into Install phase with new Binary + BinaryRequest events	2026-03-23 13:16:47 -07:00
Nick Sweeting	25f935b9d1	split CrawlSetup into Install phase with new Binary + BinaryRequest events	2026-03-23 13:15:41 -07:00
Nick Sweeting	8a25704aac	add harness tests	2026-03-23 04:12:46 -07:00
Nick Sweeting	1d94645abd	test fixes	2026-03-23 04:12:31 -07:00
Nick Sweeting	b749b26c5d	wip	2026-03-23 03:58:32 -07:00
Nick Sweeting	f400a2cd67	WIP: checkpoint working tree before rebasing onto dev	2026-03-22 20:25:18 -07:00
Nick Sweeting	a6548df8d0	Add configurable server security modes (#1773) ... Fixes https://github.com/ArchiveBox/ArchiveBox/issues/239 ## Summary - add `SERVER_SECURITY_MODE` presets for safe subdomain replay, safe one-domain no-JS replay, unsafe one-domain no-admin, and dangerous one-domain full replay - make host routing, replay URLs, static serving, and control-plane access mode-aware - add strict routing/header coverage plus a browser-backed Chrome/Puppeteer test that verifies real same-origin behavior in all four modes ## Testing - `uv run pytest archivebox/tests/test_urls.py -v` - `uv run pytest archivebox/tests/test_admin_views.py -v` - `uv run pytest archivebox/tests/test_server_security_browser.py -v` <!-- devin-review-badge-begin --> --- <a href="https://app.devin.ai/review/archivebox/archivebox/pull/1773" target="_blank"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1"> <img src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1" alt="Open with Devin"> </picture> </a> <!-- devin-review-badge-end --> <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds configurable server security modes to isolate admin/API from archived content, with a safe subdomain default and single-domain fallbacks. Routing, replay endpoints, headers, and middleware are mode-aware, with browser tests validating same-origin behavior. - New Features - Introduced SERVER_SECURITY_MODE with presets: safe-subdomains-fullreplay (default), safe-onedomain-nojsreplay, unsafe-onedomain-noadmin, danger-onedomain-fullreplay. - Mode-aware routing and base URLs; one-domain modes use path-based replay: /snapshot/<id>/... and /original/<domain>/.... - Control plane gate: block admin/API and non-GET methods in unsafe-onedomain-noadmin; allow full access in danger-onedomain-fullreplay. - Safer replay: detect risky HTML/SVG and apply CSP sandbox (no scripts) in safe-onedomain-nojsreplay; add X-ArchiveBox-Security-Mode and X-Content-Type-Options: nosniff on replay responses. - Middleware and serving: added ServerSecurityModeMiddleware, improved HostRouting, and static server byte-range/CSP handling. - Tests: added Chrome/Puppeteer browser tests and stricter URL routing tests covering all modes. - Migration - Default requires wildcard subdomains for full isolation (admin., web., api., and snapshot-id.<base>). - To run on one domain, set SERVER_SECURITY_MODE to a one-domain preset; URLs switch to /snapshot/<id>/ and /original/<domain>/ paths. - For production, prefer safe-subdomains-fullreplay; lower-security modes print a startup warning. <sup>Written for commit ad41b15581. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. -->	2026-03-22 20:17:21 -07:00
Nick Sweeting	c87079aa0a	Refactor ArchiveBox onto abx-dl bus runner	2026-03-21 11:47:57 -07:00
Nick Sweeting	ad41b15581	Add configurable server security modes	2026-03-15 23:34:40 -07:00
Nick Sweeting	57e11879ec	cleanup archivebox tests	2026-03-15 22:09:56 -07:00
Nick Sweeting	bc21d4bfdb	type and test fixes	2026-03-15 20:12:27 -07:00