+6 -1

appview/pages/funcmap.go

··· 25 25 "github.com/dustin/go-humanize" 26 26 "github.com/go-enry/go-enry/v2" 27 27 "github.com/yuin/goldmark" 28 28 + emoji "github.com/yuin/goldmark-emoji" 28 29 "tangled.org/core/appview/filetree" 29 30 "tangled.org/core/appview/models" 30 31 "tangled.org/core/appview/pages/markup" ··· 261 262 }, 262 263 "description": func(text string) template.HTML { 263 264 p.rctx.RendererType = markup.RendererTypeDefault 264 264 - htmlString := p.rctx.RenderMarkdownWith(text, goldmark.New()) 265 265 + htmlString := p.rctx.RenderMarkdownWith(text, goldmark.New( 266 266 + goldmark.WithExtensions( 267 267 + emoji.Emoji, 268 268 + ), 269 269 + )) 265 270 sanitized := p.rctx.SanitizeDescription(htmlString) 266 271 return template.HTML(sanitized) 267 272 },

+2

appview/pages/markup/markdown.go

··· 13 13 chromahtml "github.com/alecthomas/chroma/v2/formatters/html" 14 14 "github.com/alecthomas/chroma/v2/styles" 15 15 "github.com/yuin/goldmark" 16 16 + "github.com/yuin/goldmark-emoji" 16 17 highlighting "github.com/yuin/goldmark-highlighting/v2" 17 18 "github.com/yuin/goldmark/ast" 18 19 "github.com/yuin/goldmark/extension" ··· 66 67 ), 67 68 callout.CalloutExtention, 68 69 textension.AtExt, 70 70 + emoji.Emoji, 69 71 ), 70 72 goldmark.WithParserOptions( 71 73 parser.WithAutoHeadingID(),

+1 -1

appview/pages/templates/knots/index.html

··· 105 105 {{ define "docsButton" }} 106 106 <a 107 107 class="btn flex items-center gap-2" 108 108 - href="https://tangled.org/@tangled.org/core/blob/master/docs/spindle/hosting.md"> 108 108 + href="https://tangled.org/@tangled.org/core/blob/master/docs/knot-hosting.md"> 109 109 {{ i "book" "size-4" }} 110 110 docs 111 111 </a>

+63 -22

appview/pages/templates/layouts/fragments/topbar.html

··· 47 47 {{ end }} 48 48 49 49 {{ define "profileDropdown" }} 50 50 - <details class="relative inline-block text-left nav-dropdown"> 51 51 - <summary class="cursor-pointer list-none flex items-center gap-1"> 52 52 - {{ $user := .Did }} 53 53 - <img 54 54 - src="{{ tinyAvatar $user }}" 55 55 - alt="" 56 56 - class="rounded-full h-6 w-6 border border-gray-300 dark:border-gray-700" 57 57 - /> 58 58 - <span class="hidden md:inline">{{ $user | resolve | truncateAt30 }}</span> 59 59 - </summary> 60 60 - <div class="absolute flex flex-col right-0 mt-4 p-4 rounded w-48 bg-white dark:bg-gray-800 dark:text-white border border-gray-200 dark:border-gray-700"> 61 61 - <a href="/{{ $user }}">profile</a> 62 62 - <a href="/{{ $user }}?tab=repos">repositories</a> 63 63 - <a href="/{{ $user }}?tab=strings">strings</a> 64 64 - <a href="/settings">settings</a> 50 50 + {{ $user := .Did }} 51 51 + <button type="button" popovertarget="navigation-popover" class="site-navigation-dropdown-trigger" aria-label="Open site navigation dropdown"> 52 52 + <img 53 53 + src="{{ tinyAvatar $user }}" 54 54 + alt="" 55 55 + class="rounded-full h-6 w-6 border border-gray-300 dark:border-gray-700" 56 56 + /> 57 57 + </button> 58 58 + <div popover="auto" id="navigation-popover" class="site-navigation-popover shadow-md border border-gray-200 rounded p-2 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 59 59 + <div class="flex gap-2 py-2"> 60 60 + <img 61 61 + src="{{ tinyAvatar $user }}" 62 62 + alt="" 63 63 + class="rounded-full h-6 w-6 border border-gray-300 dark:border-gray-700" 64 64 + /> 65 65 + <p>{{ $user | resolve | truncateAt30 }}</p> 66 66 + </div> 67 67 + <hr class="h-1 w-full mb-1 mt-2 dark:border-gray-700" /> 68 68 + <ul id="navigation-menu-popover"> 69 69 + <li> 70 70 + <a href="/{{ $user }}"> 71 71 + {{ i "user" "w-4 h-4" }} 72 72 + <span>profile</span> 73 73 + </a> 74 74 + </li> 75 75 + <li> 76 76 + <a href="/{{ $user }}?tab=repos"> 77 77 + {{ i "book-marked" "w-4 h-4" }} 78 78 + <span>repositories</span> 79 79 + </a> 80 80 + </li> 81 81 + <li> 82 82 + <a href="/{{ $user }}?tab=strings"> 83 83 + {{ i "spool" "w-4 h-4" }} 84 84 + <span>strings</span> 85 85 + </a> 86 86 + </li> 87 87 + <li> 88 88 + <a href="/settings"> 89 89 + {{ i "settings" "w-4 h-4" }} 90 90 + <span>settings</span> 91 91 + </a> 92 92 + </li> 93 93 + <hr class="h-1 w-full mb-1 mt-2 dark:border-gray-700" /> 94 94 + <li> 65 95 <a href="#" 66 66 - hx-post="/logout" 67 67 - hx-swap="none" 68 68 - class="text-red-400 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300"> 69 69 - logout 70 70 - </a> 71 71 - </div> 72 72 - </details> 96 96 + hx-post="/logout" 97 97 + hx-swap="none" 98 98 + class="text-red-400 flex gap-2 items-center hover:bg-red-50 hover:text-red-700 px-2 py-2 rounded-sm dark:hover:bg-red-700 dark:hover:text-red-50"> 99 99 + {{ i "arrow-right-from-line" "w-4 h-4" }} 100 100 + <span>logout</span> 101 101 + </a> 102 102 + </li> 103 103 + </ul> 104 104 + </div> 73 105 74 106 <script> 75 107 document.addEventListener('click', function(event) { ··· 80 112 } 81 113 }); 82 114 }); 115 115 + 116 116 + const navigationPopoverLinks = document.querySelectorAll("#navigation-menu-popover li a"); 117 117 + const currentPageURL = window.location.href 118 118 + navigationPopoverLinks.forEach(link => { 119 119 + const navigationPopoverLinkURL = link.href 120 120 + if (navigationPopoverLinkURL === currentPageURL) { 121 121 + link.ariaCurrent = "page" 122 122 + } 123 123 + }) 83 124 </script> 84 125 {{ end }}

+1 -1

appview/pages/templates/repo/empty.html

··· 26 26 {{ else if (and .LoggedInUser (eq .LoggedInUser.Did .RepoInfo.OwnerDid)) }} 27 27 {{ $knot := .RepoInfo.Knot }} 28 28 {{ if eq $knot "knot1.tangled.sh" }} 29 29 - {{ $knot = "tangled.sh" }} 29 29 + {{ $knot = "tangled.org" }} 30 30 {{ end }} 31 31 <div class="w-full flex place-content-center"> 32 32 <div class="py-6 w-fit flex flex-col gap-4">

+2 -2

appview/pages/templates/user/fragments/followCard.html

··· 6 6 <img class="object-cover rounded-full p-2" src="{{ fullAvatar $userIdent }}" alt="{{ $userIdent }}" /> 7 7 </div> 8 8 9 9 - <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-2 w-full"> 9 9 + <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-2 w-full min-w-0"> 10 10 <div class="flex-1 min-h-0 justify-around flex flex-col"> 11 11 <a href="/{{ $userIdent }}"> 12 12 <span class="font-bold dark:text-white overflow-hidden text-ellipsis whitespace-nowrap max-w-full">{{ $userIdent | truncateAt30 }}</span> 13 13 </a> 14 14 {{ with .Profile }} 15 15 - <p class="text-sm pb-2 md:pb-2">{{.Description}}</p> 15 15 + <p class="text-sm pb-2 md:pb-2 break-words">{{.Description}}</p> 16 16 {{ end }} 17 17 <div class="text-sm flex items-center gap-2 my-2 overflow-hidden text-ellipsis whitespace-nowrap max-w-full"> 18 18 <span class="flex-shrink-0">{{ i "users" "size-4" }}</span>

+9 -9

flake.lock

··· 35 35 "systems": "systems" 36 36 }, 37 37 "locked": { 38 38 - "lastModified": 1694529238, 39 39 - "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", 38 38 + "lastModified": 1731533236, 39 39 + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", 40 40 "owner": "numtide", 41 41 "repo": "flake-utils", 42 42 - "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", 42 42 + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", 43 43 "type": "github" 44 44 }, 45 45 "original": { ··· 56 56 ] 57 57 }, 58 58 "locked": { 59 59 - "lastModified": 1754078208, 60 60 - "narHash": "sha256-YVoIFDCDpYuU3riaDEJ3xiGdPOtsx4sR5eTzHTytPV8=", 59 59 + "lastModified": 1763982521, 60 60 + "narHash": "sha256-ur4QIAHwgFc0vXiaxn5No/FuZicxBr2p0gmT54xZkUQ=", 61 61 "owner": "nix-community", 62 62 "repo": "gomod2nix", 63 63 - "rev": "7f963246a71626c7fc70b431a315c4388a0c95cf", 63 63 + "rev": "02e63a239d6eabd595db56852535992c898eba72", 64 64 "type": "github" 65 65 }, 66 66 "original": { ··· 150 150 }, 151 151 "nixpkgs": { 152 152 "locked": { 153 153 - "lastModified": 1765186076, 154 154 - "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=", 153 153 + "lastModified": 1766070988, 154 154 + "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=", 155 155 "owner": "nixos", 156 156 "repo": "nixpkgs", 157 157 - "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8", 157 157 + "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8", 158 158 "type": "github" 159 159 }, 160 160 "original": {

+2 -1

go.mod

··· 45 45 github.com/urfave/cli/v3 v3.3.3 46 46 github.com/whyrusleeping/cbor-gen v0.3.1 47 47 github.com/yuin/goldmark v1.7.13 48 48 + github.com/yuin/goldmark-emoji v1.0.6 48 49 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc 49 50 gitlab.com/staticnoise/goldmark-callout v0.0.0-20240609120641-6366b799e4ab 50 51 golang.org/x/crypto v0.40.0 51 52 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b 52 53 golang.org/x/image v0.31.0 53 54 golang.org/x/net v0.42.0 54 54 - golang.org/x/sync v0.17.0 55 55 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da 56 56 gopkg.in/yaml.v3 v3.0.1 57 57 ) ··· 203 203 go.uber.org/atomic v1.11.0 // indirect 204 204 go.uber.org/multierr v1.11.0 // indirect 205 205 go.uber.org/zap v1.27.0 // indirect 206 206 + golang.org/x/sync v0.17.0 // indirect 206 207 golang.org/x/sys v0.34.0 // indirect 207 208 golang.org/x/text v0.29.0 // indirect 208 209 golang.org/x/time v0.12.0 // indirect

+2

go.sum

··· 505 505 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= 506 506 github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA= 507 507 github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg= 508 508 + github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs= 509 509 + github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA= 508 510 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ= 509 511 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I= 510 512 gitlab.com/staticnoise/goldmark-callout v0.0.0-20240609120641-6366b799e4ab h1:gK9tS6QJw5F0SIhYJnGG2P83kuabOdmWBbSmZhJkz2A=

+19

input.css

··· 89 89 @apply no-underline text-black hover:underline hover:text-gray-800 dark:text-white dark:hover:text-gray-300; 90 90 } 91 91 92 92 + #navigation-menu-popover li:not(:last-of-type) a { 93 93 + @apply flex gap-2 items-center px-2 pb-2 pt-1.5 rounded-sm hover:bg-green-50 hover:text-green-700 no-underline dark:hover:text-green-50 dark:hover:bg-green-700; 94 94 + } 95 95 + 96 96 + a[hx-post="/logout"] { 97 97 + @apply no-underline; 98 98 + } 99 99 + 92 100 label { 93 101 @apply block text-gray-900 text-sm font-bold py-2 uppercase dark:text-gray-100; 94 102 } ··· 962 970 color: #f9fafb; 963 971 } 964 972 } 973 973 + 974 974 + .site-navigation-dropdown-trigger { 975 975 + anchor-name: --dropdown-trigger; 976 976 + } 977 977 + 978 978 + .site-navigation-popover { 979 979 + margin: 0; 980 980 + inset: auto; 981 981 + position-anchor: --dropdown-trigger; 982 982 + position-area: bottom left; 983 983 + }

+3

nix/gomod2nix.toml

··· 530 530 [mod."github.com/yuin/goldmark"] 531 531 version = "v1.7.13" 532 532 hash = "sha256-vBCxZrPYPc8x/nvAAv3Au59dCCyfS80Vw3/a9EXK7TE=" 533 533 + [mod."github.com/yuin/goldmark-emoji"] 534 534 + version = "v1.0.6" 535 535 + hash = "sha256-+d6bZzOPE+JSFsZbQNZMCWE+n3jgcQnkPETVk47mxSY=" 533 536 [mod."github.com/yuin/goldmark-highlighting/v2"] 534 537 version = "v2.0.0-20230729083705-37449abec8cc" 535 538 hash = "sha256-HpiwU7jIeDUAg2zOpTIiviQir8dpRPuXYh2nqFFccpg="

+5 -1

spindle/engine/engine.go

··· 70 70 } 71 71 defer eng.DestroyWorkflow(ctx, wid) 72 72 73 73 - wfLogger, err := models.NewWorkflowLogger(cfg.Server.LogDir, wid) 73 73 + secretValues := make([]string, len(allSecrets)) 74 74 + for i, s := range allSecrets { 75 75 + secretValues[i] = s.Value 76 76 + } 77 77 + wfLogger, err := models.NewWorkflowLogger(cfg.Server.LogDir, wid, secretValues) 74 78 if err != nil { 75 79 l.Warn("failed to setup step logger; logs will not be persisted", "error", err) 76 80 wfLogger = nil

+6 -1

spindle/models/logger.go

··· 12 12 type WorkflowLogger struct { 13 13 file *os.File 14 14 encoder *json.Encoder 15 15 + mask *SecretMask 15 16 } 16 17 17 17 - func NewWorkflowLogger(baseDir string, wid WorkflowId) (*WorkflowLogger, error) { 18 18 + func NewWorkflowLogger(baseDir string, wid WorkflowId, secretValues []string) (*WorkflowLogger, error) { 18 19 path := LogFilePath(baseDir, wid) 19 20 20 21 file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644) ··· 25 26 return &WorkflowLogger{ 26 27 file: file, 27 28 encoder: json.NewEncoder(file), 29 29 + mask: NewSecretMask(secretValues), 28 30 }, nil 29 31 } 30 32 ··· 62 64 63 65 func (w *dataWriter) Write(p []byte) (int, error) { 64 66 line := strings.TrimRight(string(p), "\r\n") 67 67 + if w.logger.mask != nil { 68 68 + line = w.logger.mask.Mask(line) 69 69 + } 65 70 entry := NewDataLogLine(w.idx, line, w.stream) 66 71 if err := w.logger.encoder.Encode(entry); err != nil { 67 72 return 0, err

+51

spindle/models/secret_mask.go

··· 1 1 + package models 2 2 + 3 3 + import ( 4 4 + "encoding/base64" 5 5 + "strings" 6 6 + ) 7 7 + 8 8 + // SecretMask replaces secret values in strings with "***". 9 9 + type SecretMask struct { 10 10 + replacer *strings.Replacer 11 11 + } 12 12 + 13 13 + // NewSecretMask creates a mask for the given secret values. 14 14 + // Also registers base64-encoded variants of each secret. 15 15 + func NewSecretMask(values []string) *SecretMask { 16 16 + var pairs []string 17 17 + 18 18 + for _, value := range values { 19 19 + if value == "" { 20 20 + continue 21 21 + } 22 22 + 23 23 + pairs = append(pairs, value, "***") 24 24 + 25 25 + b64 := base64.StdEncoding.EncodeToString([]byte(value)) 26 26 + if b64 != value { 27 27 + pairs = append(pairs, b64, "***") 28 28 + } 29 29 + 30 30 + b64NoPad := strings.TrimRight(b64, "=") 31 31 + if b64NoPad != b64 && b64NoPad != value { 32 32 + pairs = append(pairs, b64NoPad, "***") 33 33 + } 34 34 + } 35 35 + 36 36 + if len(pairs) == 0 { 37 37 + return nil 38 38 + } 39 39 + 40 40 + return &SecretMask{ 41 41 + replacer: strings.NewReplacer(pairs...), 42 42 + } 43 43 + } 44 44 + 45 45 + // Mask replaces all registered secret values with "***". 46 46 + func (m *SecretMask) Mask(input string) string { 47 47 + if m == nil || m.replacer == nil { 48 48 + return input 49 49 + } 50 50 + return m.replacer.Replace(input) 51 51 + }

+135

spindle/models/secret_mask_test.go

··· 1 1 + package models 2 2 + 3 3 + import ( 4 4 + "encoding/base64" 5 5 + "testing" 6 6 + ) 7 7 + 8 8 + func TestSecretMask_BasicMasking(t *testing.T) { 9 9 + mask := NewSecretMask([]string{"mysecret123"}) 10 10 + 11 11 + input := "The password is mysecret123 in this log" 12 12 + expected := "The password is *** in this log" 13 13 + 14 14 + result := mask.Mask(input) 15 15 + if result != expected { 16 16 + t.Errorf("expected %q, got %q", expected, result) 17 17 + } 18 18 + } 19 19 + 20 20 + func TestSecretMask_Base64Encoded(t *testing.T) { 21 21 + secret := "mysecret123" 22 22 + mask := NewSecretMask([]string{secret}) 23 23 + 24 24 + b64 := base64.StdEncoding.EncodeToString([]byte(secret)) 25 25 + input := "Encoded: " + b64 26 26 + expected := "Encoded: ***" 27 27 + 28 28 + result := mask.Mask(input) 29 29 + if result != expected { 30 30 + t.Errorf("expected %q, got %q", expected, result) 31 31 + } 32 32 + } 33 33 + 34 34 + func TestSecretMask_Base64NoPadding(t *testing.T) { 35 35 + // "test" encodes to "dGVzdA==" with padding 36 36 + secret := "test" 37 37 + mask := NewSecretMask([]string{secret}) 38 38 + 39 39 + b64NoPad := "dGVzdA" // base64 without padding 40 40 + input := "Token: " + b64NoPad 41 41 + expected := "Token: ***" 42 42 + 43 43 + result := mask.Mask(input) 44 44 + if result != expected { 45 45 + t.Errorf("expected %q, got %q", expected, result) 46 46 + } 47 47 + } 48 48 + 49 49 + func TestSecretMask_MultipleSecrets(t *testing.T) { 50 50 + mask := NewSecretMask([]string{"password1", "apikey123"}) 51 51 + 52 52 + input := "Using password1 and apikey123 for auth" 53 53 + expected := "Using *** and *** for auth" 54 54 + 55 55 + result := mask.Mask(input) 56 56 + if result != expected { 57 57 + t.Errorf("expected %q, got %q", expected, result) 58 58 + } 59 59 + } 60 60 + 61 61 + func TestSecretMask_MultipleOccurrences(t *testing.T) { 62 62 + mask := NewSecretMask([]string{"secret"}) 63 63 + 64 64 + input := "secret appears twice: secret" 65 65 + expected := "*** appears twice: ***" 66 66 + 67 67 + result := mask.Mask(input) 68 68 + if result != expected { 69 69 + t.Errorf("expected %q, got %q", expected, result) 70 70 + } 71 71 + } 72 72 + 73 73 + func TestSecretMask_ShortValues(t *testing.T) { 74 74 + mask := NewSecretMask([]string{"abc", "xy", ""}) 75 75 + 76 76 + if mask == nil { 77 77 + t.Fatal("expected non-nil mask") 78 78 + } 79 79 + 80 80 + input := "abc xy test" 81 81 + expected := "*** *** test" 82 82 + result := mask.Mask(input) 83 83 + if result != expected { 84 84 + t.Errorf("expected %q, got %q", expected, result) 85 85 + } 86 86 + } 87 87 + 88 88 + func TestSecretMask_NilMask(t *testing.T) { 89 89 + var mask *SecretMask 90 90 + 91 91 + input := "some input text" 92 92 + result := mask.Mask(input) 93 93 + if result != input { 94 94 + t.Errorf("expected %q, got %q", input, result) 95 95 + } 96 96 + } 97 97 + 98 98 + func TestSecretMask_EmptyInput(t *testing.T) { 99 99 + mask := NewSecretMask([]string{"secret"}) 100 100 + 101 101 + result := mask.Mask("") 102 102 + if result != "" { 103 103 + t.Errorf("expected empty string, got %q", result) 104 104 + } 105 105 + } 106 106 + 107 107 + func TestSecretMask_NoMatch(t *testing.T) { 108 108 + mask := NewSecretMask([]string{"secretvalue"}) 109 109 + 110 110 + input := "nothing to mask here" 111 111 + result := mask.Mask(input) 112 112 + if result != input { 113 113 + t.Errorf("expected %q, got %q", input, result) 114 114 + } 115 115 + } 116 116 + 117 117 + func TestSecretMask_EmptySecretsList(t *testing.T) { 118 118 + mask := NewSecretMask([]string{}) 119 119 + 120 120 + if mask != nil { 121 121 + t.Error("expected nil mask for empty secrets list") 122 122 + } 123 123 + } 124 124 + 125 125 + func TestSecretMask_EmptySecretsFiltered(t *testing.T) { 126 126 + mask := NewSecretMask([]string{"ab", "validpassword", "", "xyz"}) 127 127 + 128 128 + input := "Using validpassword here" 129 129 + expected := "Using *** here" 130 130 + 131 131 + result := mask.Mask(input) 132 132 + if result != expected { 133 133 + t.Errorf("expected %q, got %q", expected, result) 134 134 + } 135 135 + }