Spaces:
Running on CPU Upgrade
Running on CPU Upgrade
Commit History
-
feat(api): /api/moves community move catalog with semantic search Running
One entry per recorded move across the HF datasets tagged reachy_mini_community_moves, expanded from per-dataset file listings (cached on lastModified, trajectories never downloaded) and indexed in the shared multilingual embedding search under stem + collection passages, so ?q= answers "un mouvement triste" with a move, not a repo. Co-authored-by: Cursor <cursoragent@cursor.com>85955b1
-
refactor(api): simplify search to one metadata vector per entry
A live A/B showed README-enriched passages diluted cross-lingual matching (well-described entries lost their top spot to generic README prose), and the max-pool + facet-penalty machinery added to compensate was complexity without measurable gain. Back to the design validated by the experiment script: one vector per entry (name + description + tags), quality penalty, small popularity/name boosts, lexical fallback. Also exclude generic domain tokens (robot, reachy, mini...) from the exact-name boost: they appear in most queries and most Space names, so they buried genuinely relevant results behind anything named "*robot*". Co-authored-by: Cursor <cursoragent@cursor.com>041e2f2 -
feat(api): multilingual embedding search on the three catalog routes
Co-authored-by: Cursor <cursoragent@cursor.com>151da48 -
feat(api): ?q=&limit= search contract on /api/mcp-tools
Co-authored-by: Cursor <cursoragent@cursor.com>a74526d -
feat(scripts): add semantic search experiment over the three catalogs
Co-authored-by: Cursor <cursoragent@cursor.com>830ebfe
-
feat(api): fail-closed moderation for the MCP tool catalog
`/api/mcp-tools` only filtered on the shared block-list, so any Space tagged `reachy-mini-tool` reached clients unmoderated. A tool entry is a wider blast radius than an app: its description is fed to the model and the tool can be invoked through the robot, with nobody reading it first, whereas an app is opened deliberately and runs sandboxed in an iframe. Reuse the same fail-closed gate as `/api/js-apps` (`decideVisibility`, now documented as shared) and make `runModerationBatch` catalog-agnostic - it already only needed `{ id, name, description, isOfficial, lastModified }`, which tool Spaces expose. Sweep tool Spaces at startup too, after `moderationCache.load()` so a cold start does not re-moderate everything. Add an optional `config/official-tool-list.json`, unioned with the app official list, so a first-party tool Space can skip moderation without being promoted in the app catalog. A 404 keeps the previous behaviour. Also add `POST /api/mcp-tools/refresh-moderation`, twin of th…ba2090d
-
ci: revert Allure to 3.12.0
The 3.8.2 pin did not change the default tree state: Allure only auto-expands branches that contain failures, so an all-green report stays collapsed regardless of version. Stay on the latest release. Co-authored-by: Cursor <cursoragent@cursor.com>daf4d93 -
ci: pin Allure 3.8.2 so the report tree is expanded by default
Allure 3.9+ collapses the suite tree by default; 3.8.2 keeps it expanded, matching the reference report layout. Co-authored-by: Cursor <cursoragent@cursor.com>9d6b493 -
fix: sync package-lock.json with Allure 3 devDeps
The Space Docker build runs `npm ci --omit=dev`, which requires the lock file to be in sync with package.json even for dev-only dependencies. Co-authored-by: Cursor <cursoragent@cursor.com>4378ff0 -
ci: prefix Allure suite names with test_ to match pytest modules
Co-authored-by: Cursor <cursoragent@cursor.com>254daf6 -
ci: flatten Allure tree so the file is the top level
node:test derives a titlePath from the file path, nesting every test under the `test/` directory in the Allure tree. Post-process the results to drop that titlePath and emit a per-file `suite` label, matching the pytest report layout. Co-authored-by: Cursor <cursoragent@cursor.com>695e4dd -
ci: switch test report to Allure Report 3 (awesome plugin)
Replace the Allure 2 Java CLI with the Node-based `allure` package + awesome plugin so the GitHub Pages report matches the modern Allure 3 UI. Drops the setup-java step and persists trends via history/history.jsonl. Co-authored-by: Cursor <cursoragent@cursor.com>76d366f -
ci: Allure test report published to GitHub Pages
Add a Tests workflow that runs the node:test suite through the official allure-node-test reporter, builds an Allure report and publishes it to gh-pages with history/trends. Self-contained: no external storage. Co-authored-by: Cursor <cursoragent@cursor.com>e99da7a
-
feat(api): fail-closed mobile catalog moderation
The JS-app catalog now surfaces ONLY apps with an explicit `allow` moderation verdict (plus curated official apps). A `block`, a `review` (LLM unsure), a manual block-list hit, or no verdict yet all keep the app hidden, so a new Space never appears before the regex+LLM pipeline has explicitly cleared it (App Store guideline 1.2: filter UGC before it appears, not reactively). - Extract the visibility decision into a pure, unit-tested `visibility.js` (10 new tests in test/visibility.test.mjs); `index.js` is now a thin wrapper that feeds it the cached verdict. - Run moderation before categorization at warm-up since moderation is now the visibility gate. - Update fail-open docs/comments (moderate.js, .env.example) to describe the fail-closed posture; note HF_TOKEN is required in prod or non-official apps stay hidden. Also lands the previously in-progress MCP tools catalog surface (server/mcpTools.js, /api MCP endpoints, test/mcpTools.test.mjs, README) that was already present u…21c6750
-
test(api): cover taxonomy fallback + moderation regex, gate deploy
Add node:test suites (no new deps) for the two safety-critical units this work introduced/relies on: - categories.js: closed-list slug sanitization and the loadTaxonomyFromDataset fallback (404 / malformed / empty all keep the built-in default; a valid file swaps the taxonomy in). - moderate.js: the regex prescreen killswitch blocks unambiguous abuse across all fields without over-blocking ordinary apps. Wire `npm test` into the validate job so a red test blocks the deploy to the Space. Co-authored-by: Cursor <cursoragent@cursor.com>3aa3c86 -
refactor(api): clearer config file names
Rename the curated control-plane files for clarity: config/app-list.json -> config/official-app-list.json config/block-list.json -> config/blocked-app-list.json taxonomy.json is kept (precise, and avoids colliding with the per-app cache/categories.json). Co-authored-by: Cursor <cursoragent@cursor.com>3b73f6b -
refactor(api): rename store dataset to reachy_mini_store_data
Use underscores in the dataset id (pollen-robotics/reachy_mini_store_data) to match the org's repo naming convention. Content (config/ + cache/) was copied over from the hyphenated dataset. Co-authored-by: Cursor <cursoragent@cursor.com>9cea18f -
refactor(api): point store dataset to reachy-mini-store-data
Use a fresh, cleanly-named control-plane dataset (pollen-robotics/reachy-mini-store-data) seeded with a config/-only layout. Drop the transitional root-path fallback for the official / block lists since the new dataset is born with config/ from the start. The legacy reachy-mini-official-app-store dataset is left untouched so the old site and desktop app keep working. Co-authored-by: Cursor <cursoragent@cursor.com>fd0af59 -
feat(api): data-driven taxonomy + config/cache dataset layout
Read the editable category taxonomy from the store dataset's config/taxonomy.json at boot (hardcoded list kept as fallback), so categories can change without a code deploy. Move the official/block lists to config/ (with a transitional fallback to the legacy root path) and the LLM/moderation caches to cache/, separating human-curated config from server-written, regenerable data. Co-authored-by: Cursor <cursoragent@cursor.com>66c985e -
fix: allow static.hf.space website origin in CORS allowlist
setupff5d0cb -
fix: shorten Space short_description to <=60 chars
setup10a63e8 -
ci: trigger deploy
setup803da23 -
ci: hardcode HF Space target, drop HF_USERNAME/HF_SPACE vars
setup0e1c847 -
feat: standalone Reachy Mini API service (split from website)
setup7a399ed