Spaces:
Sleeping
Sleeping
Commit History
-
Close four holes in the share link, from review
1. A signed-in visitor could not use a link. authenticate() only consulted the share cookie when nobody was signed in, so a session made `user` truthy and the ACL check then refused them — while REST let the same request through. The page loaded and never synced. The grant now applies whenever the visitor lacks access of their own, signed in or not, and boot says which case it is so the client shows the read-only view to a signed-in stranger too. 2. The token stopped living in the URL. /p/<token> now sets the cookie and redirects to /d/<id>: a rendered page left the credential in the address bar, in history, and — since documents carry external images and links — in the Referer header sent to whatever host those point at. Referrer-Policy: no-referrer is set for the whole app as well. 3. Revoking reaches sockets that are already open. A viewer authenticated before the token changed stayed attached and kept receiving edits, so "revoked" meant "no new vi…830cb4d -
Anyone with the link: read a project without an account
A second way to share, next to inviting people by username: one long unguessable URL that opens the project read-only, for someone who has no Hugging Face account and should not need one. The token (24 random bytes) is exchanged for a cookie the moment the visitor lands on /p/<token>, so nothing downstream has to carry it: the REST snapshot, the websocket handshake and the <img> requests are all covered by the same grant. Lookup is constant-time, and an unknown or revoked token is a 404 that does not confirm the project exists. Read-only is enforced where it counts. The connection is marked readOnly in onAuthenticate, so hocuspocus drops any update or awareness message the client sends: a visitor who types sees their own keystrokes and nothing else does. REST keeps requireUser everywhere except GET of the project and its page tree, so a link cannot suggest, comment, add a page, re-share or delete. The non-editable editor and the hidden buttons are a courtesy on top of that, not the m…3a73292 -
Make agent feedback standalone and traceable
Agent Manager26dfc7b
-
Merge pull request #18 from huggingface/agent-privacy
Leandro von WerraUnverified signatureAn agent you register is not shared with your collaboratorsb622b57
-
Add a private default agent for each user
Agent Manager314a59f -
An agent you register is not shared with your collaborators
Registering an agent stored no visibility flag, and every read treated a missing flag as shared: agentPresence() shared: info.shared !== false -> undefined means shared mention routing agents[h]?.shared !== false || ... -> undefined means shared So a handle was exposed the moment it was created: every collaborator on every doc you shared could see it in the agent list and @mention it into work. The toggle in the UI worked, but it defended a door that was already open — and the existing test set shared:false explicitly, so it never saw the default. Absent now means unshared, in both reads, and registration writes the flag down instead of leaving it to be inferred. Re-registering your own handle keeps the choice you made before. This matters because an agent is not a document permission: it runs on your machine, with your credentials, and does work in your name. Sharing it is a deliberate act — one click on the toggle that already exists. Behaviour change: existing hand…abaa17c -
Comment beside a paragraph, from a hover in the right margin
Claude +1: Claude Opus 5 (1M context)Hover the right third of the page and a small comment button appears out in the page's own right margin, level with the paragraph you are next to. Click it and you get a comment anchored to that place, with no selected span. The anchor is one Yjs relative position taken inside that paragraph — the same machinery the existing span comments use, written into both anchor fields so every path that already resolves a thread's anchors keeps working and simply sees an empty range. The card shows the paragraph's opening words as a locator instead of a quote, because there is nothing quoted; agents get anchor_kind + anchor_context so a null excerpt is not mistaken for deleted text. Deleting the paragraph never closes the thread. The zone is hover-only and invisible: no gutter, nothing while a selection or a composer owns the flow, and nothing at all on touch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>f9ca812
-
A page-scoped websocket name could silence a project's @mentions
Pages became fields of one project document, but a page-scoped document name (`<id>::<slug>`) was still accepted on the websocket. Syncing one loaded a SECOND instance of the same project, and because watchers were keyed by project id, attaching its watcher took the observer off the instance every browser was editing. From then on @mentions in that project were never detected: the comment was stored and looked posted, but no chip, no queue entry, no agent — until the process restarted. - watchers are keyed by the document instance, so no instance can unhook another's observer (releaseWatcher still scopes to one project) - the websocket refuses a page-scoped name outright: it can only ever sync an isolated replica whose edits reach nobody - state loads under the project id, so a replica can't start from the pre-migration per-page row (frozen before every page added since) - only the canonical instance may persist, so a partial replica cannot write over what the real instance ho…ab8524b
-
Proposed pages live in the tree, where they would land
Three things, all about the page tree. AGENTS COULD NOT PROPOSE A PLACE. page-suggestions took a title and a body and nothing else, so an accepted page was appended at the top level wherever the agent meant it to go — and there was no way to say otherwise. Proposals now take the same {parent, index} refs /structure/move already uses: a page parent is its slug, a group parent is its path array, no parent means top level. The placement rides on the proposal, so accepting files the page there via moveNodesInYaml. An unknown parent is a 400 (it used to be accepted and quietly flattened), and the agent instructions in api.js document the field with examples. PROPOSALS SAT IN A LIST UNDERNEATH EVERYTHING. They were rendered after the tree and the unfiled section, under a "proposed" heading, which hid the one thing a reviewer wants to know: where is this page going? They are now grafted into the tree at their proposed position and rendered as ordinary rows — dashed, badged, still opening th…aeb6b2b
-
Left carets, home star, project subtitles, empty-group rename fix
Fold carets move to the left of the label (aligned spacer for leaf rows); the hover trash overlays the row end so long titles run to the edge. A muted star marks the home page. Renaming a group with no children no longer loses its input — every group-label single-click consequence now defers behind the same 280ms timer the double-click cancels. The home page's first paragraph becomes the project's subtitle (derived on store, persisted on the registry) and previews under each title in the project dropdown. Co-Authored-By: Codex <noreply@openai.com> Co-Authored-By: Claude Opus <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>3f3e761 -
Multi-node structure moves, H1 page rename, untitled pages
structure/move accepts nodes: [refs] — a multi-selected block lands as consecutive siblings in document order, nested selections collapse into their selected ancestor. New pages/:slug/rename rewrites the page's first heading (the H1 is the title everywhere); renaming home renames the project. POST /pages with an empty title creates an untitled page with an empty H1 for the sidebar's no-modal create flow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>86725f7 -
Add sidebar group headers and structure move endpoints
Structure YAML gains quoted group lines (- "Label":) — purely visual sidebar separators. New human-only endpoints implement drag-and-drop as minimal line edits to the same YAML: structure/move, structure/groups (create/rename/dissolve). Unit tests for the pure mutators, smoke test for the endpoints. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>e5167b8 -
Unify project pages in one Yjs document
9b49194 -
Prevent duplicate and stale suggestions
a5757a3
-
LaTeX math via lazily-loaded KaTeX ($x$ inline, $$...$$ display), agent-proposable; Enter sends a comment, Shift+Enter adds a line
Verified signature735a30f
-
Upload folder using huggingface_hub
Verified signatureed7ee81 -
Upload folder using huggingface_hub
Verified signature93ef16f
-
Upload folder using huggingface_hub
Verified signature80e566e
-
Upload server/collab.js with huggingface_hub
Verified signature939d27c -
Upload folder using huggingface_hub
Verified signature7efcba7 -
Upload folder using huggingface_hub
Verified signature9d479ea -
Upload folder using huggingface_hub
Verified signature2ad2aff
-
Upload folder using huggingface_hub
Verified signaturee8f61c8 -
Upload folder using huggingface_hub
Verified signature1f1507e -
Upload folder using huggingface_hub
Verified signature704a62b -
Upload folder using huggingface_hub
Verified signatureb04fa88 -
Upload folder using huggingface_hub
Verified signature8a3f5f2 -
Upload folder using huggingface_hub
Verified signaturee5e233a
-
Upload folder using huggingface_hub
Verified signature21092d1 -
Upload folder using huggingface_hub
Verified signature2268143 -
Upload folder using huggingface_hub
Verified signature1c42947 -
Upload folder using huggingface_hub
Verified signaturefcffddc -
Upload folder using huggingface_hub
Verified signature0ac04b5 -
Upload folder using huggingface_hub
Verified signatureb1c90fd -
Upload folder using huggingface_hub
Verified signature5a65b82 -
Upload folder using huggingface_hub
Verified signature93abf36 -
Upload folder using huggingface_hub
Verified signaturebcab00d -
Upload folder using huggingface_hub
Verified signature53148eb -
Upload folder using huggingface_hub
Verified signature2679e4e -
Upload folder using huggingface_hub
Verified signature45ebf29 -
Upload folder using huggingface_hub
Verified signatureb60973d -
Upload folder using huggingface_hub
Verified signature6912fd3
-
Upload folder using huggingface_hub
Verified signature268f658 -
Upload folder using huggingface_hub
Verified signature99a44ac