opencode discovers AGENTS.md and nothing else; claude code discovers CLAUDE.md.
this repo had neither, so an agent sent to change something here arrived with no
guidance at all under either.
it deliberately does NOT repeat README.md. that file says what the plugin is,
for someone deciding whether to install it. this one answers the other question:
i have to change something in here, what will i break.
the facts in it are read from the repository rather than recalled — the panel
keys from web/panels.ts, the tables from db/schema.ts, the permission keys, the
host binaries and the route claims from manifest.ts. presence is the declaration
everywhere in this system, so the file says what the platform will actually
conclude from these files existing.
CLAUDE.md beside it is a pointer, not a copy: two copies drift and the stale one
is the one somebody reads.
tags are how the marketplace is browsed rather than scrolled: a list of them on
the left, the plugins that carry one on the right. a closed vocabulary
(PLUGIN_TAGS in the platform) because free text becomes homelab, home-lab, Home
Lab and selfhosted inside a month, and a filter list of synonyms is worse than
no filter at all.
declared here rather than curated in the catalogue, so a plugin can say what it
is and nobody edits a table when one ships. the marketplace caches it on sync,
exactly as it already does for label and summary.
Drizzle generates names past Postgres's 63-character identifier limit. Postgres
stores the truncated form, drizzle compares against its own longer one, and every
push on every host drops and re-adds constraints that are already identical.
Deferred as harmless noise since 2026-08-19. What ended that was a deploy plan
saying "expect no changes, stop if it wants to alter something" — which this made
impossible to satisfy, so the deploy agent had to overrule its own instructions.
Verified by pushing twice against a scratch database: the fleet-wide second-push
churn went from ten statements to two, and the two that remain are a composite
primary key that cannot be fixed either way.
Naming a foreign key means removing the inline .references() or drizzle creates
both.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
three input sites lived in a div instead of a form, so pressing enter did
nothing and the button was the only way in. chain source url, rescan search
depth, and the inline wallet-rename field all get a <form onSubmit>, with
every non-submit button in each marked type="button" (the rescan card's
reset button was previously untyped, which would have submitted the form
once wrapped).
CoinsView.tsx has no text inputs (checkbox + buttons only) and
SeedPhraseInput.tsx deliberately hijacks enter to advance between word boxes
rather than submit, so both are left alone.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A bitcoin coin on edge as the hero with Officer Duck rolling it, and a
strongroom scene for the splash. The manifest's lucide 'Bitcoin' stays as the
fallback for a publish that fails; the file wins whenever it is there.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The hooks build `/${service}/_config`, so their argument is the MOUNT name.
It still said 'wallet' after the plugin was renamed to bitcoin-wallet, so every
request 404'd.
The symptom was not an error. `data` stayed undefined, the seeding effect
returns early on !data, and `url` never left '' — so `!trimmed` disabled the
button and the "http://127.0.0.1:32838" visible in the field was the
placeholder, not a value. The `(—)` in the hint was the same missing data.
Credential rows are keyed on the PROTOCOL ('esplora' / 'nbxplorer') by the
sidecar's config.ts, so nothing already saved is affected by the rename.
Tenth plugin out, and the one whose extraction turned on a permission decision
rather than a mechanical move.
The wallet permission was kind: 'admin' — owner only, not grantable, invisible
to every other account. Plugin permissions are ALWAYS kind: 'app': mount.ts
forces it and the manifest has no field for anything else, deliberately, so
that "can a plugin escalate itself" is a question which cannot be asked. So
extraction could not preserve admin, and that was raised as a blocker before
any code moved.
It was the right change anyway, and the objection inverts. Every wallet query
is scoped by user_id, and that id comes from X-Officer-User which the platform
injects from the authenticated session — a caller cannot name someone else's.
So granting this gives an account ITS OWN wallet. Not through the API and not
with root either does it hand over anyone else's, because their seed is sealed
under a passphrase the server never stores. kind: 'admin' was single-user
thinking; grantable is how a second person gets a wallet at all.
Named bitcoin-wallet rather than wallet: it is a bitcoin wallet specifically,
and the appName drives the route, the API prefix, the table prefix and the
install key together. Tables renamed to bitcoin_wallet_* accordingly — the
prefix guard normalises the hyphen. Free only because no wallet table existed
on any server, which was checked before deciding: db:push treats a rename as a
drop plus a create.
The three custody test files moved with it and still run — 72 tests over
scrypt sealing, envelope open and bolt11. bunfig.toml's test root was widened
on 2026-08-15 after music took lyrics.test.ts and the suite silently shrank by
nine, so that trap was already closed.
68 palette classes converted, five status vocabularies hoisted into shared.ts.
Two deliberate flattenings recorded in PLUGIN.md: testnet/signet/regtest all
read as warning, and the bitcoin and lightning rails no longer differ by hue.
Deferred on purpose: watch-only data (xpubs, balances, history) stays
unencrypted so a locked wallet still shows a balance. Anyone with the database
can therefore SEE any user's balances; they can never move a coin.
pastilhas
