build_and_publish copied the entire tag archive (minus top dir + .git) into
the release zip, leaking dev/docs files to clients: ARCHITECTURE.md, README.md,
CHANGELOG.md, build.sh, .env.example, .taskmaster/, .claude/, the repo's own
composer.json. This raced n8n IcF30's clean upload under the same asset name,
producing two same-named assets per release (one clean, one junk).
Filter the copy loop to manifest.json + files/ + scripts/ only (composer.json
is generated), matching n8n IcF30 and build.sh. The /publish output is now the
clean installable package.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Removed hardcoded fallback secrets in app_server.py. Both env vars
are now required at startup — fail fast instead of silently using
production credentials baked into the source.
Why: discovered while mapping the leak radius of a separate Gitea
token during the LegalCrm 2026-04-25 security audit. Per the
Infisical-only secrets policy, hardcoded credentials in any source
file are Critical regardless of intent.
Note: deployment must set both env vars before restarting the
service; missing either now produces KeyError on startup.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
manifest.description is for composer / dev consumption (often a long
English text). The admin catalog needs short Hebrew labels. Introduces
optional manifest.displayLabel field — only that field is synced into
extensions.description (the column the admin UI reads). When
displayLabel is missing the DB row is left untouched, so curated
labels never get clobbered by long English manifest descriptions.
Adds POST /admin/set-labels for bulk backfilling labels in one call.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
After /release-deleted deactivates an extension (when the last release
is removed from Gitea), running /sync-registry would reactivate it
because the repo still exists. Now sync-registry skips reactivation
when an extension has zero rows in extension_versions — those were
intentionally retired and must stay deactivated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Manifest is now the source of truth for the catalog label shown in the
admin UI. build_and_publish updates description on every release; the
new _sync_description_from_manifest helper is also called from
sync_extension_registry for backfill / drift correction (runs every 6h
via the auto-add-webhook workflow, or on manual /sync-registry).
This replaces the hardcoded HEBREW_LABELS map in KlearBranding's
admin/index.js — new extensions inherit their label from their manifest
without code changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When a release is deleted in Gitea (e.g., to retire an extension), the
platform DB still showed the extension as installable. This endpoint
removes the version row, recomputes latest_version, and deactivates
the extension if no versions remain — making it disappear from the
install catalog without touching the repo.
Called by n8n workflow NwrRbHNAXFVOLHCQ on Gitea release.deleted event.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Previously the system used simple string inequality to detect available
updates, causing downgrades to appear as upgrades (e.g. 2.5.1 → 2.5.0).
Now both backend (SQL) and frontend (JS) compare version tuples properly.
Also fixes latest_version in DB on registry sync startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Commit fed6ca3 replaced the entire server.py (1017 lines) with a single
${FILE:/tmp/ext-platform-server.py} placeholder via Gitea API, breaking
the application. This restores the correct code and adds /api/health.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
A Coolify persistent storage entry was overriding /app/server.py with an
unresolved ${FILE:} placeholder, causing SyntaxError on startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
chaim