Skip to content

Settings sync on @profullstack/synconfig, release 0.96.0 - #499

Merged
ralyodio merged 1 commit into
mainfrom
feat/synconfig
Sep 13, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/synconfig

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Anthony: "modularize that feature ... synconfig ... deploy it everywhere it makes sense across ~/src".

/save and /load keep every message and rule, but the primitives (allowlist check, collect, validate, plan, apply, digest) are now @profullstack/synconfig@0.1.0, the package extracted from this module. The app's /api/settings routes are the package's handlePut / handleGet / handleRevisions over a SnapshotStore on this database; the Turso-safe GROUP BY user_id HAVING insert is kept verbatim in the store.

  • SYNC_POLICY exported beside SYNCED_FILES and the never lists.
  • Snapshots carry app: "moshcode <version>" as well as moshcode; the server reads either (versionOf).
  • Version bump to 0.96.0; the GitHub release follows the merge (that is what publishes to npm).

Tests: CLI suite 2,569 pass / 0 fail; app suite green, pinned digests unchanged on both sides.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S7yeJUHGxA4P5N74xnsRPQ

…e it became

The allowlist check, collecting, validating, planning, applying and the
digest that /save and /load are built on now come from
@profullstack/synconfig, the package this module was extracted into so
myna and the rest of the fleet sync the same way. The app's /api/settings
routes are the package's handlers over a SnapshotStore on this database,
with the GROUP BY user_id HAVING that Turso needs kept in the store.

What stays moshcode's: which files sync (SYNCED_FILES, the never lists,
now also exported as SYNC_POLICY), the marker, the transport with its
retry rule, both verbs and every message, and the /settings/sync pages.
Both suites pass unchanged, including the pinned digest on each side.

Snapshots now also carry `app: "moshcode <version>"` beside `moshcode`, the
field name the package uses; the server reads either.

Release 0.96.0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S7yeJUHGxA4P5N74xnsRPQ
@ralyodio
ralyodio merged commit 3f8e7e0 into main Sep 13, 2026
4 checks passed
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

1 finding(s) in the 6 file(s) this pull request changes.

MEDIUM: 1

Severity Rule Location
MEDIUM js-timing-unsafe-mac-compare src/settings-sync.mjs:358
91 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 73 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:202
HIGH sh-remote-script-execution install.sh:213
HIGH sh-remote-script-execution install.sh:219
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044

…and 71 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant