okf 1.2.0 → 1.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.okf/design/server-trust-boundary.md +6 -6
- data/CHANGELOG.md +8 -0
- data/README.md +15 -10
- data/lib/okf/server/{templates/graph.html.erb → graph/template.html.erb} +16 -2
- data/lib/okf/server/graph.rb +3 -3
- data/lib/okf/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3ba14268a02a3bc64e391bd522723c79b1dd9b8c146f341bb57b74397abbd0ea
|
|
4
|
+
data.tar.gz: 85b2f13ab45e83bb894cd681c36b0cbf4db161484b9c7de28fd186572e4c633e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9f549361de5213dc0ef48506ffc62e3e668631a38c4666f82e005fd6f6be4f9e5e667e6daa995c0db86785d6f17d9f2c557d97e04ee75e7c1b9d8ad3cab69f47
|
|
7
|
+
data.tar.gz: 2c39cd025790fea098fab4e30a9ebcaf3bc48dc797b4336253f967142f47edab339985b034769259380e366d10882d15fef611a8796bb057d43f87b96fc0b7ff
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
type: Constraint
|
|
3
3
|
title: The server trust boundary
|
|
4
4
|
description: The served page sanitizes each concept body before rendering and escapes inlined data, so both XSS paths into the page are closed.
|
|
5
|
-
resource: lib/okf/server/
|
|
5
|
+
resource: lib/okf/server/graph/template.html.erb
|
|
6
6
|
tags: [security, server, xss]
|
|
7
7
|
timestamp: 2026-07-12T12:00:00Z
|
|
8
8
|
---
|
|
@@ -17,9 +17,9 @@ carry active content. Two defenses handle that — one for each path into the pa
|
|
|
17
17
|
|
|
18
18
|
There are two data paths into the page, and each carries its own guard:
|
|
19
19
|
|
|
20
|
-
| Path
|
|
21
|
-
|
|
22
|
-
| Graph data **inlined** into the page
|
|
20
|
+
| Path | Handling | Safe? |
|
|
21
|
+
| -------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
|
|
22
|
+
| Graph data **inlined** into the page | through `json_for_script`, which escapes `<` | yes — it cannot break out of its `<script>` |
|
|
23
23
|
| Concept bodies **fetched** on demand (`/node?id=`) | `marked` renders the Markdown, then `DOMPurify.sanitize` scrubs it before it reaches the DOM | yes — scripts, handlers, and `javascript:` URLs are stripped |
|
|
24
24
|
|
|
25
25
|
The [description](../format/cross-links.md) shown in the inspector takes a third
|
|
@@ -31,10 +31,10 @@ path and never needs the client's help: the server escapes it
|
|
|
31
31
|
DOMPurify removes the code, not the content. The page still fetches and shows the
|
|
32
32
|
links, images, and Mermaid diagrams a body names (Mermaid runs in its `strict`
|
|
33
33
|
mode), and it pulls Cytoscape, marked, and DOMPurify from a CDN. So the rule is no
|
|
34
|
-
longer
|
|
34
|
+
longer _only serve bundles you trust_ — it is the ordinary care you would give any
|
|
35
35
|
document from a source you do not know.
|
|
36
36
|
|
|
37
37
|
# Citations
|
|
38
38
|
|
|
39
39
|
[1] [README.md — Server trust boundary](https://github.com/serradura/okf-gem/blob/main/README.md) — the two-defense summary.
|
|
40
|
-
[2] [lib/okf/server/
|
|
40
|
+
[2] [lib/okf/server/graph/template.html.erb](https://github.com/serradura/okf-gem/blob/main/lib/okf/server/graph/template.html.erb) — `json_for_script` and the `DOMPurify.sanitize(marked.parse(...))` render.
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.3.0] - 2026-07-12
|
|
4
|
+
|
|
5
|
+
- The graph server page now emits link-preview metadata: Open Graph and Twitter
|
|
6
|
+
Card tags with a social image, plus `theme-color` and `color-scheme`, so a
|
|
7
|
+
shared `okf server` URL unfurls as a proper card in chat and social apps.
|
|
8
|
+
- Docs: a themed README hero (light and dark), a GitHub social preview image,
|
|
9
|
+
and Website / Live demo / Claude Code plugin links.
|
|
10
|
+
|
|
3
11
|
## [1.2.0] - 2026-07-12
|
|
4
12
|
|
|
5
13
|
- Claude Code plugin. The repository now doubles as a plugin marketplace:
|
data/README.md
CHANGED
|
@@ -1,12 +1,10 @@
|
|
|
1
1
|
<p align="center">
|
|
2
|
-
<
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
</
|
|
7
|
-
|
|
8
|
-
<p align="center">
|
|
9
|
-
<i>A lightweight Ruby gem for OKF: author, curate, and serve bundles as an interactive graph.</i>
|
|
2
|
+
<a href="https://okfgem.com">
|
|
3
|
+
<picture>
|
|
4
|
+
<source media="(prefers-color-scheme: dark)" srcset=".github/hero-dark.png">
|
|
5
|
+
<img src=".github/hero-light.png" width="100%" alt="okf-gem: your project's knowledge as a living graph. A lightweight Ruby gem for the Open Knowledge Format that authors, curates, and serves bundles of Markdown + YAML as an interactive graph.">
|
|
6
|
+
</picture>
|
|
7
|
+
</a>
|
|
10
8
|
</p>
|
|
11
9
|
|
|
12
10
|
<p align="center">
|
|
@@ -19,6 +17,12 @@
|
|
|
19
17
|
<a href="#claude-code-plugin"><img src="https://img.shields.io/badge/Claude%20Code-plugin-D97757" alt="Claude Code plugin"></a>
|
|
20
18
|
</p>
|
|
21
19
|
|
|
20
|
+
<p align="center">
|
|
21
|
+
<b><a href="https://okfgem.com">Website</a></b> ·
|
|
22
|
+
<b><a href="https://demo.okfgem.com">Live demo</a></b> ·
|
|
23
|
+
<b><a href="https://claude.okfgem.com">Claude Code plugin</a></b>
|
|
24
|
+
</p>
|
|
25
|
+
|
|
22
26
|
**okf-gem** — `okf` on RubyGems — reads, validates, lints, and serves
|
|
23
27
|
**Open Knowledge Format (OKF)** v0.1 bundles: directories of Markdown files with YAML frontmatter that humans and agents read from one source. It does not define a new place to keep knowledge; it gives you leverage over knowledge that already lives as Markdown. Each file is a _concept_; a directory of them is a _bundle_.
|
|
24
28
|
|
|
@@ -33,7 +37,7 @@ Here is what it is able to do:
|
|
|
33
37
|
<p align="center">
|
|
34
38
|
<picture>
|
|
35
39
|
<source media="(prefers-color-scheme: dark)" srcset=".github/overview-dark.png">
|
|
36
|
-
<img src=".github/overview.png" width="100%" alt="The companion agent skill authors and curates an OKF v0.1 bundle (Markdown + YAML). A pure model (Concept, Bundle, Graph) reads that bundle and feeds both the okf CLI (validate — legal per §9; lint — well-curated; server — explore) and a library API you embed in Ruby.">
|
|
40
|
+
<img src=".github/overview-light.png" width="100%" alt="The companion agent skill authors and curates an OKF v0.1 bundle (Markdown + YAML). A pure model (Concept, Bundle, Graph) reads that bundle and feeds both the okf CLI (validate — legal per §9; lint — well-curated; server — explore) and a library API you embed in Ruby.">
|
|
37
41
|
</picture>
|
|
38
42
|
</p>
|
|
39
43
|
|
|
@@ -194,7 +198,8 @@ serving 37 concepts at http://127.0.0.1:8808 (Ctrl-C to stop)
|
|
|
194
198
|
</picture>
|
|
195
199
|
|
|
196
200
|
_The graph server on this repo's own [`.okf`](.okf) bundle, with the
|
|
197
|
-
`capabilities/graph-server` concept selected.
|
|
201
|
+
`capabilities/graph-server` concept selected. Try it live at
|
|
202
|
+
**[demo.okfgem.com](https://demo.okfgem.com)**._
|
|
198
203
|
|
|
199
204
|
`graph` and `server` are best-effort (§9): a file with invalid frontmatter is
|
|
200
205
|
skipped (and noted on stderr), not fatal, so one bad file never breaks the rest.
|
|
@@ -1,9 +1,23 @@
|
|
|
1
1
|
<!doctype html><html lang="en"><head><meta charset="utf-8">
|
|
2
2
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
3
|
-
<title>OKF
|
|
3
|
+
<title>OKF · <%= escaped_name %></title>
|
|
4
|
+
<meta name="color-scheme" content="dark light">
|
|
5
|
+
<meta name="theme-color" media="(prefers-color-scheme: dark)" content="#0f1115">
|
|
6
|
+
<meta name="theme-color" media="(prefers-color-scheme: light)" content="#ffffff">
|
|
7
|
+
<meta property="og:type" content="website">
|
|
8
|
+
<meta property="og:site_name" content="OKF">
|
|
4
9
|
<meta property="og:title" content="<%= og_title %>">
|
|
5
10
|
<meta property="og:description" content="<%= og_desc %>">
|
|
6
|
-
<meta property="og:
|
|
11
|
+
<meta property="og:image" content="https://okfgem.com/og-demo.png">
|
|
12
|
+
<meta property="og:image:type" content="image/png">
|
|
13
|
+
<meta property="og:image:width" content="1200">
|
|
14
|
+
<meta property="og:image:height" content="630">
|
|
15
|
+
<meta property="og:image:alt" content="An interactive Open Knowledge Format knowledge graph.">
|
|
16
|
+
<meta name="twitter:card" content="summary_large_image">
|
|
17
|
+
<meta name="twitter:title" content="<%= og_title %>">
|
|
18
|
+
<meta name="twitter:description" content="<%= og_desc %>">
|
|
19
|
+
<meta name="twitter:image" content="https://okfgem.com/og-demo.png">
|
|
20
|
+
<meta name="twitter:image:alt" content="An interactive Open Knowledge Format knowledge graph.">
|
|
7
21
|
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><rect width='100' height='100' rx='24' fill='%231a1a1a'/><polygon points='38,44 62,44 50,82' fill='%237a0a1e'/><polygon points='18,44 38,44 50,82' fill='%23a8112c'/><polygon points='62,44 82,44 50,82' fill='%23a8112c'/><polygon points='35,28 18,44 38,44' fill='%23dc1e3c'/><polygon points='65,28 82,44 62,44' fill='%23dc1e3c'/><polygon points='35,28 65,28 62,44 38,44' fill='%23f43f5e'/><polygon points='36,29 49,29 42,42' fill='%23fff' opacity='.38'/><polygon points='35,28 65,28 82,44 50,82 18,44' fill='none' stroke='%23ff6b7f' stroke-width='2' stroke-linejoin='round'/></svg>">
|
|
8
22
|
<script>/* Resolve theme before first paint so there is no flash. */
|
|
9
23
|
(function(){try{var t=localStorage.getItem('okf-theme')||(matchMedia('(prefers-color-scheme:dark)').matches?'dark':'light');document.documentElement.setAttribute('data-theme',t);}catch(e){}})();</script>
|
data/lib/okf/server/graph.rb
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
module OKF
|
|
4
4
|
module Server
|
|
5
5
|
# Renders an OKF::Bundle::Graph as the interactive graph page served by
|
|
6
|
-
# OKF::Server::App. The markup lives in
|
|
6
|
+
# OKF::Server::App. The markup lives in graph/template.html.erb; #render
|
|
7
7
|
# returns the HTML string.
|
|
8
8
|
#
|
|
9
9
|
# The page boots from a *minimal* payload — nodes carry only id + title, plus
|
|
@@ -17,7 +17,7 @@ module OKF
|
|
|
17
17
|
# trust. The inline-<script> data is </script>-escaped by #json_for_script
|
|
18
18
|
# (stdlib ERB does not auto-escape).
|
|
19
19
|
class Graph
|
|
20
|
-
TEMPLATE = File.expand_path("
|
|
20
|
+
TEMPLATE = File.expand_path("graph/template.html.erb", __dir__)
|
|
21
21
|
LAYOUTS = %w[cose concentric breadthfirst circle grid].freeze
|
|
22
22
|
|
|
23
23
|
# Node-diameter range in px; the template scales within it by node degree.
|
|
@@ -55,7 +55,7 @@ module OKF
|
|
|
55
55
|
end
|
|
56
56
|
|
|
57
57
|
def og_title
|
|
58
|
-
html_escape("OKF
|
|
58
|
+
html_escape("OKF · #{graph_name}")
|
|
59
59
|
end
|
|
60
60
|
|
|
61
61
|
def og_desc
|
data/lib/okf/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: okf
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.
|
|
4
|
+
version: 1.3.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Rodrigo Serradura
|
|
@@ -102,8 +102,8 @@ files:
|
|
|
102
102
|
- lib/okf/path.rb
|
|
103
103
|
- lib/okf/server/app.rb
|
|
104
104
|
- lib/okf/server/graph.rb
|
|
105
|
+
- lib/okf/server/graph/template.html.erb
|
|
105
106
|
- lib/okf/server/runner.rb
|
|
106
|
-
- lib/okf/server/templates/graph.html.erb
|
|
107
107
|
- lib/okf/skill.rb
|
|
108
108
|
- lib/okf/skill/SKILL.md
|
|
109
109
|
- lib/okf/skill/playbooks/consume.md
|