domma-cms 1.6.34 → 1.6.36

package/plugins/blog/plugin.js

@@ -5,7 +5,7 @@ import {getPluginStates, savePluginState} from '../../server/services/plugins.js
 import {renderBlogPage} from '../../server/services/renderer.js';
 import {cleanBasePath, DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
 import {catalogue, seedBlocks} from './lib/render.js';
-import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
+import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
 import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 import {commentKey, commentNotice} from './lib/notices.js';
@@ -81,6 +81,35 @@ export function postFields(body, user) {
     return out;
 }
 
+// What a visitor may say in a comment, and how much of it. The form's
+// `maxlength` is the browser's word only; the route must cap too.
+const COMMENT_CAPS = {authorName: 80, authorEmail: 160, authorUrl: 300, body: 5000};
+const EMAIL_RE = /^[^\s@"<>]+@[^\s@"<>]+\.[^\s@"<>]+$/;
+
+/**
+ * A public comment as the route will store it, or the reason it will not.
+ * Pure, so the caps and the email check can be tested without a server.
+ *
+ * @param {object} body
+ * @returns {{error: string}|{fields: object}}
+ */
+export function commentFields(body = {}) {
+    const {postId, authorName, authorEmail, authorUrl, body: commentBody} = body;
+    if (!postId) return {error: 'postId is required'};
+    if (!authorName) return {error: 'authorName is required'};
+    if (!authorEmail) return {error: 'authorEmail is required'};
+    if (!commentBody) return {error: 'body is required'};
+    const email = String(authorEmail).trim().slice(0, COMMENT_CAPS.authorEmail);
+    if (!EMAIL_RE.test(email)) return {error: 'authorEmail must be an email address'};
+    return {fields: {
+        postId:      String(postId).slice(0, 64),
+        authorName:  String(authorName).trim().slice(0, COMMENT_CAPS.authorName),
+        authorEmail: email,
+        authorUrl:   authorUrl ? String(authorUrl).trim().slice(0, COMMENT_CAPS.authorUrl) : '',
+        body:        String(commentBody).slice(0, COMMENT_CAPS.body)
+    }};
+}
+
 /** Derive a URL slug from a title string. */
 function slugify(str) {
     return String(str)
@@ -363,7 +392,7 @@ export default async function blogPlugin(fastify, options) {
         });
         const html = await renderBlogPage(
             fileURLToPath(new URL('./templates/post.html', import.meta.url)),
-            { post: page.html, assetV: '1.6.0' },
+            { post: page.html, assetV: '1.9.6' },
             { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
               usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
         );
@@ -462,6 +491,12 @@ export default async function blogPlugin(fastify, options) {
         const derivedSlug = slug
             ? String(slug).trim()
             : slugify(title);
+        if (!derivedSlug) return reply.code(400).send({ error: 'slug is required' });
+
+        // One address, one post: a draft saved with a live post's slug sat in
+        // front of it in the newest-first list and took it offline.
+        const taken = slugHolder(await loadAll(POSTS_SLUG), derivedSlug);
+        if (taken) return reply.code(409).send({ error: `Another post already uses the slug "${derivedSlug}" - choose a different one.` });
 
         const fields = postFields(body, user);
         const entry = await createEntry(POSTS_SLUG, {
@@ -503,7 +538,13 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
 
-        const merged  = { ...entry.data, ...postFields(request.body ?? {}, user) };
+        const fields  = postFields(request.body ?? {}, user);
+        if (fields.slug !== undefined) {
+            if (!fields.slug) return reply.code(400).send({ error: 'slug is required' });
+            const taken = fields.slug !== entry.data.slug && slugHolder(await loadAll(POSTS_SLUG), fields.slug, id);
+            if (taken) return reply.code(409).send({ error: `Another post already uses the slug "${fields.slug}" - choose a different one.` });
+        }
+        const merged  = { ...entry.data, ...fields };
         // `seo` is merged too: the editor sends title and description only, and
         // must not wipe what the SEO Tool set (image, noindex, focus keyword...).
         if (merged.seo && typeof merged.seo === 'object' && entry.data.seo && typeof entry.data.seo === 'object') {
@@ -689,8 +730,12 @@ export default async function blogPlugin(fastify, options) {
         };
     });
 
-    /** POST /api/plugins/blog/comments - public, no authenticate */
-    fastify.post('/comments', async (request, reply) => {
+    /**
+     * POST /api/plugins/blog/comments - public, no authenticate. Its own rate
+     * limit: under the global bucket alone (500/min/IP) a script filed hundreds
+     * of comments a minute, each one a staff notification.
+     */
+    fastify.post('/comments', {config: {rateLimit: {max: 5, timeWindow: '1 minute'}}}, async (request, reply) => {
         const body = request.body ?? {};
 
         // Read the settings as they are NOW. `settings` above is captured when
@@ -705,27 +750,24 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(201).send({ ok: true });
         }
 
-        const { postId, authorName, authorEmail, authorUrl, body: commentBody } = body;
+        const checked = commentFields(body);
+        if (checked.error) return reply.code(400).send({ error: checked.error });
+        const { fields } = checked;
 
-        if (!postId)      return reply.code(400).send({ error: 'postId is required' });
-        if (!authorName)  return reply.code(400).send({ error: 'authorName is required' });
-        if (!authorEmail) return reply.code(400).send({ error: 'authorEmail is required' });
-        if (!commentBody) return reply.code(400).send({ error: 'body is required' });
+        // Only a post readers can see takes comments - not a draft, not an id
+        // that never existed (each of those still raised a notification).
+        const post = await getEntry(POSTS_SLUG, fields.postId).catch(() => null);
+        if (!post || !isVisible(post.data)) return reply.code(404).send({ error: 'No such post' });
 
         const commentStatus = live.commentModeration !== false ? 'pending' : 'approved';
 
         const entry = await createEntry(COMMENTS_SLUG, {
-            postId:      String(postId),
-            authorName:  String(authorName).trim(),
-            authorEmail: String(authorEmail).trim(),
-            authorUrl:   authorUrl ? String(authorUrl).trim() : '',
-            body:        String(commentBody),
+            ...fields,
             status:      commentStatus,
             createdAt:   new Date().toISOString()
         }, { source: 'public' });
 
         const made = toComment(entry);
-        const post = await getEntry(POSTS_SLUG, String(postId)).catch(() => null);
         const notice = commentNotice(made, post?.data?.title, '#/plugins/blog/comments');
         if (notice) notify(notice);
         return reply.code(201).send(made);

package/plugins/blog/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
-  "date": "2026-09-27",
+  "date": "2026-10-13",
   "icon": "file-text",
   "admin": {
     "css": [

package/plugins/blog/plugin.public.js

@@ -18,13 +18,13 @@ import {renderBlogPage} from '../../server/services/renderer.js';
 import {getConfig} from '../../server/config.js';
 import {byNewest, escapeHtml, matchBlogPath, pickDisplay, safeImageUrl} from './lib/layouts.js';
 import {catalogue, renderCards} from './lib/render.js';
-import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, renderPostPage, resolveAuthorName} from './lib/page.js';
+import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, publicPost, renderPostPage, resolveAuthorName} from './lib/page.js';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, 'templates');
 
 /** Bumped with the plugin, so a release is never served a stale script. */
-const ASSET_V = '1.6.3';
+const ASSET_V = '1.9.6';
 
 /**
  * Above this many posts a listing pages on the server instead: the browser
@@ -210,8 +210,9 @@ ${items}
         /** Individual post */
         async post(request, reply, {slug}, base) {
             const allPosts = await loadEntries('blog-posts');
-            const post = allPosts.find((p) => p.slug === slug);
-            if (!post || !isVisible(post)) return reply.code(404).send('Not found');
+            // The live post with this slug, not whichever is newest (a draft may share it).
+            const post = publicPost(allPosts, slug);
+            if (!post) return reply.code(404).send('Not found');
 
             const siteUrl = (config?.site?.url || `${request.protocol}://${request.hostname}`).replace(/\/$/, '');
             const page = await renderPostPage(post, allPosts, liveSettings(settings), {base, siteUrl});

package/plugins/blog/tests/public.test.js

@@ -16,7 +16,8 @@ import zlib from 'zlib';
 import Fastify from 'fastify';
 import compress from '@fastify/compress';
 import blogPublicPlugin from '../plugin.public.js';
-import {postFields, usePermissionLookup} from '../plugin.js';
+import {commentFields, postFields, usePermissionLookup} from '../plugin.js';
+import {publicPost, slugHolder} from '../lib/page.js';
 
 async function buildPublic() {
     const app = Fastify();
@@ -92,3 +93,31 @@ test('the pages live at the base path in the settings, not a fixed /blog', async
     assert.equal(other.body, 'site page', 'the old path is the site\'s again');
     assert.equal((await app.inject({method: 'POST', url: '/news'})).statusCode, 404, 'GET only');
 });
+
+test('a draft that shares a live post\'s slug neither takes it offline nor gets saved', () => {
+    // Newest first, as loadEntries sorts: the draft sits in front of the live post.
+    const posts = [
+        {id: 'd', slug: 'hello', status: 'draft'},
+        {id: 'p', slug: 'hello', status: 'published'},
+        {id: 'o', slug: 'other', status: 'published', blogId: 'second'}
+    ];
+    assert.equal(publicPost(posts, 'hello')?.id, 'p', 'readers get the live post, not the newest');
+    assert.equal(publicPost(posts, 'missing'), null);
+    assert.equal(publicPost(posts, 'other'), null, 'a Pro-era post in another blog is not this blog\'s');
+    assert.equal(slugHolder(posts, 'hello')?.id, 'd', 'a new post may not take a slug in use, draft or not');
+    assert.equal(slugHolder(posts, 'hello', 'd')?.id, 'p', 'saving the draft itself still meets the live post');
+    assert.equal(slugHolder(posts, 'fresh'), null);
+    assert.equal(slugHolder(posts, 'other'), null, 'another blog\'s post is at another base');
+});
+
+test('a public comment is capped, needs an email, and names its post', () => {
+    const ok = commentFields({postId: 'p1', authorName: ' Jo ', authorEmail: ' jo@example.com ', body: 'x'.repeat(6000), authorUrl: 'https://jo.example'});
+    assert.equal(ok.fields.authorName, 'Jo');
+    assert.equal(ok.fields.authorEmail, 'jo@example.com');
+    assert.equal(ok.fields.body.length, 5000, 'the form\'s maxlength is the browser\'s word only');
+    assert.equal(commentFields({postId: 'p1', authorName: 'x'.repeat(200), authorEmail: 'a@b.co', body: 'hi'}).fields.authorName.length, 80);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'not-an-email', body: 'hi'}).error, /email/);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'a@b.co"<x>', body: 'hi'}).error, /email/);
+    assert.match(commentFields({authorName: 'Jo', authorEmail: 'a@b.co', body: 'hi'}).error, /postId/);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'a@b.co'}).error, /body/);
+});

package/plugins/booking/CLAUDE.md

@@ -162,6 +162,9 @@ only to roles that hold it.
 ## Gotchas
 
 - Add `return reply.send(...)` / return a value in every async route (compressed responses come back empty).
-- `siteBase()` uses `site.baseUrl` when set, else the last request's origin (emails from reminders have no request).
+- `siteBase()` is `site.baseUrl` or '' - NEVER a request's Host (1.6.3): without a Site URL emails go out with no
+  links and the log warns once. Before, a booker with a chosen Host header got the owner an email whose "Start the
+  call" button went to their domain carrying the host key. tests/api.test.js sets `baseUrl` in config/site.json for
+  the run (restored after) and forges a Host to prove it.
 - The API tests create contacts in domma-cms's `content/collections/contacts-contacts/data.json` (tracked) - they
   snapshot and restore it; a crashed run can leave it changed: `git checkout` it in domma-cms.

package/plugins/booking/docs/guide.md

@@ -22,7 +22,7 @@ Let people book time with you, your team, or a room or piece of equipment, strai
 4. Open the settings (the cog in the Booking banner) and check the booking page's address, your time zone and the emails.
 5. Share the booking page link, or put the booking form on any page with the `[booking /]` shortcode.
 
-Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you.
+Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you. The links in those emails (change or cancel, join the call) use the **Site URL** in **Settings > Site**; until it is set, emails go out without links.
 
 ## Booking from Contacts and Email
 

package/plugins/booking/plugin.js

@@ -48,21 +48,23 @@ import {
 } from './lib/store.js';
 
 /**
- * The origin staff last used the admin on - for emails sent with no request
- * (reminders) when `site.baseUrl` is not set. Only signed-in requests set it:
- * a customer's Host header is theirs to choose, and must not decide where
- * everyone else's reminder links point.
+ * The site's address for links in emails and the admin: `site.baseUrl` (Settings > Site), else '' - a link is then
+ * left out and the log says so once. Until 1.6.3 a request's Host header stood in when the setting was empty, so a
+ * booker who could reach the server with a Host of their choosing (default vhost, direct IP, misconfigured proxy)
+ * got the owner an email whose "Start the call" button went to their domain carrying the host key. A Host header
+ * is the caller's to choose; it never decides where anyone's link points. `request` is accepted for the registry's
+ * callers (Pro) and ignored.
  */
-let lastOrigin = '';
-
-function siteBase(request) {
+let warnedNoBase = false;
+function siteBase(request = null, log = null) {
     let base = '';
     try { base = String(getConfig('site')?.baseUrl || ''); } catch { /* no site config */ }
     if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
-    if (!request) return lastOrigin;
-    const origin = `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
-    if (request.user) lastOrigin = origin;
-    return origin;
+    if (log && !warnedNoBase) {
+        warnedNoBase = true;
+        log.warn?.('[booking] Site URL is not set (Settings > Site): booking emails go out without links until it is.');
+    }
+    return '';
 }
 
 const manageUrl = (s, b, base) => `${base}${s.bookingPath}/manage/${b.id}?t=${b.token}`;
@@ -209,7 +211,7 @@ export default async function booking(fastify, options) {
     async function tell(b, what, {request = null, toCustomer = true, toOwner = true} = {}) {
         try {
             const s = await liveSettings();
-            const base = siteBase(request);
+            const base = siteBase(request, log);
             const title = siteTitle();
             const link = base && b.token ? manageUrl(s, b, base) : '';
             const may = customerMayChange(b, s) && (s.allowCancel || s.allowMove);
@@ -282,7 +284,7 @@ export default async function booking(fastify, options) {
     registry.services = {
         name: NAME, liveSettings, allBookings, allServices, allBookables, getBooking, getService, getBookable,
         changeBooking, sendReminders,
-        /** The site's address: `site.baseUrl`, else the request's origin (a signed-in one), else the last admin's. */
+        /** The site's address: `site.baseUrl`, else '' (never a request's Host). */
         siteBase: (request = null) => siteBase(request),
         /** A booking as the admin may see it (no customer token; an online one's host key as `hostUrl`). */
         adminBooking,
@@ -352,7 +354,6 @@ export default async function booking(fastify, options) {
             const id = await linkContact(customer, bk?.userId || s.contactsOwnerId, contactsOn()).catch(() => '');
             if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
         }
-        if (request) siteBase(request);
         if (notify) tell(b, 'made', {request, toOwner: source !== 'admin'});
         registry.emit('made', b);
         return b;
@@ -411,7 +412,7 @@ export default async function booking(fastify, options) {
         };
     }
 
-    fastify.get('/bootstrap', can('read'), async (request) => { siteBase(request); return bootstrap(); });
+    fastify.get('/bootstrap', can('read'), async () => bootstrap());
 
     fastify.get('/count', can('read'), async () => {
         const s = await liveSettings();
@@ -513,7 +514,6 @@ export default async function booking(fastify, options) {
                 const id = await linkContact(customer, owner, contactsOn()).catch(() => '');
                 if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
             }
-            siteBase(request);
             if (body.notify !== false) tell(b, 'made', {request, toOwner: false});
             registry.emit('made', b);
             return reply.code(201).send(adminBooking(b));
@@ -536,7 +536,6 @@ export default async function booking(fastify, options) {
         try {
             const b = await placeBooking({service, candidates, rules, startAt: startAt.toISOString(), tz: s.timeZone, moveId: current.id,
                 force: body.force === true, fields: {by: request.user?.name || ''}});
-            siteBase(request);
             if (body.notify !== false) tell(b, 'moved', {request, toOwner: false});
             registry.emit('moved', b, current);
             endCall(current).catch(() => {});
@@ -564,7 +563,6 @@ export default async function booking(fastify, options) {
         if (!res) return fail(reply, 404, 'No such booking.');
         const {booking: b, from} = res;
         if (b.status !== from) {
-            siteBase(request);
             if (b.status === 'cancelled' && body.notify !== false) tell(b, 'cancelled', {request, toOwner: false});
             registry.emit(b.status === 'cancelled' ? 'cancelled' : 'status', b, from);
             if (b.status === 'cancelled') endCall(b).catch(() => {});
@@ -754,7 +752,6 @@ export default async function booking(fastify, options) {
                 const id = await linkContact(customer, bk?.userId || s.contactsOwnerId, contactsOn()).catch(() => '');
                 if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
             }
-            siteBase(request);
             tell(b, 'made', {request});
             notice(b, 'made');
             registry.emit('made', b);
@@ -793,7 +790,6 @@ export default async function booking(fastify, options) {
             ? `Bookings can be cancelled here up to ${s.changeNoticeHours} hours before. Please contact us instead.`
             : 'This booking cannot be cancelled here. Please contact us instead.');
         const {booking: done} = await changeBooking(b.id, {status: 'cancelled', reason: String(request.body?.reason || '').slice(0, 300)}, b.name);
-        siteBase(request);
         tell(done, 'cancelled', {request});
         notice(done, 'cancelled');
         registry.emit('cancelled', done, 'confirmed');
@@ -817,7 +813,6 @@ export default async function booking(fastify, options) {
         const {service, candidates, rules} = await candidatesFor(b.serviceId, b.bookableId);
         try {
             const moved = await placeBooking({service, candidates, rules, startAt: offered.start, tz: s.timeZone, moveId: b.id, fields: {by: b.name}});
-            siteBase(request);
             tell(moved, 'moved', {request});
             notice(moved, 'moved');
             registry.emit('moved', moved, b);

package/plugins/booking/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "booking",
   "displayName": "Booking",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "tier": "free",
   "description": "Let people book appointments with you or your team, and rooms or equipment, from a booking page on your site. Opening hours, days off and buffers; confirmation and reminder emails with a link to change or cancel; a diary in the admin. Book straight from a contact or an email.",
   "author": "Domma CMS",
-  "date": "2026-10-03",
+  "date": "2026-10-13",
   "icon": "clipboard-check",
   "uses": {
     "contacts": "Customers become contacts; Book… on a contact and a Bookings panel on the contact card",

package/plugins/booking/tests/api.test.js

@@ -15,8 +15,10 @@ import {bookingRegistry} from '../lib/extensions.js';
 import {addDays, atWallClock, wallClock} from '../public/lib/time.js';
 
 const PLUGINS = path.resolve('config/plugins.json');
+const SITE = path.resolve('config/site.json');
 const CONTACTS = path.resolve('content/collections/contacts-contacts/data.json');
 let savedContacts;
+let savedSite;
 const DIRS = ['booking-bookables', 'booking-services', 'booking-bookings'].map(c => path.resolve('content/collections', c));
 const TZ = 'Europe/London';
 let savedPlugins;
@@ -29,6 +31,9 @@ const related = {};
 before(async () => {
     savedPlugins = await fs.readFile(PLUGINS, 'utf8').catch(() => null);
     savedContacts = await fs.readFile(CONTACTS, 'utf8').catch(() => null);
+    // Links in emails come from the Site URL alone (1.6.3) - the checkout's site.json has none.
+    savedSite = await fs.readFile(SITE, 'utf8');
+    await fs.writeFile(SITE, JSON.stringify({...JSON.parse(savedSite), baseUrl: 'https://site.test'}, null, 2) + '\n');
     for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
     setMailer(async (msg) => { sent.push(msg); });
     app = Fastify();
@@ -54,6 +59,7 @@ after(async () => {
     if (savedPlugins === null) await fs.rm(PLUGINS, {force: true});
     else await fs.writeFile(PLUGINS, savedPlugins);
     if (savedContacts !== null) await fs.writeFile(CONTACTS, savedContacts);
+    if (savedSite) await fs.writeFile(SITE, savedSite);
     if (dataDir) await fs.rm(dataDir, {recursive: true, force: true});
 });
 
@@ -353,8 +359,27 @@ test('online: a service an extension makes online gives a call - the customer an
         assert.match(r.body.booking.callUrl, /\/booking\/call\//);
         await new Promise(res => setTimeout(res, 50));
         const toHost = sent.find(m => m.to === 'vic@example.com');
-        assert.match(toHost?.text || '', /Start the call: \S+&h=/, 'the person booked gets the host link');
+        assert.match(toHost?.text || '', /Start the call: https:\/\/site\.test\/\S+&h=/, 'the person booked gets the host link, on the Site URL');
         assert.doesNotMatch(sent.find(m => m.to === 'web@example.com').text, /&h=/);
+
+        // 1.6.3: a booker's Host header never decides where the owner's link points - with no Site URL there is no link at all.
+        sent.length = 0;
+        await fs.writeFile(SITE, savedSite);
+        try {
+            const slot2 = (await call('GET', `/public/slots?service=${svc.id}&from=${day}&to=${day}`)).body.days[0].slots[5];
+            const forged = await app.inject({method: 'POST', url: '/public/book', headers: {host: 'evil.example'},
+                payload: {serviceId: svc.id, startAt: slot2.start, customer: {name: 'Forger', email: 'forger@example.com'}}});
+            assert.equal(forged.statusCode, 201, forged.body);
+            await new Promise(res => setTimeout(res, 50));
+            const owner = sent.find(m => m.to === 'vic@example.com');
+            assert.ok(owner, 'the owner is still told');
+            assert.doesNotMatch(owner.text, /evil\.example/);
+            assert.doesNotMatch(owner.text, /&h=/, 'the host key goes in no link whose base is not the configured one');
+            assert.doesNotMatch(sent.find(m => m.to === 'forger@example.com').text, /evil\.example/);
+            await call('DELETE', `/bookings/${forged.json().booking.id}`);
+        } finally {
+            await fs.writeFile(SITE, JSON.stringify({...JSON.parse(savedSite), baseUrl: 'https://site.test'}, null, 2) + '\n');
+        }
         const early = await call('POST', `/call/${r.body.booking.callUrl.split('/call/')[1].split('?')[0]}/join`,
             {b: r.body.booking.id, t: new URL(`http://x${r.body.booking.callUrl}`).searchParams.get('t')});
         assert.equal(early.status, 425, 'not open days ahead');

package/plugins/feedback/CLAUDE.md

@@ -98,8 +98,8 @@ Replying in the inbox to a `_manager` report you filed yourself marks it seen fo
 - **Who sent it is never the browser's word.** The sender builds the payload from `request.user`; the
   manager attributes a report to the slug the fleet TOKEN resolves to and ignores any `site` in the body.
   A site can still vouch for any of its own admins - it cannot speak for another site.
-- **Tokens rotate whenever either end restarts** (fleetTokens.js is memory-only), so a send can meet a
-  401 or ECONNREFUSED for a few seconds. That is why the outbox exists: a report is "sent or waiting",
+- **Tokens survive a manager restart** (since 2026-10-04 fleetTokens.js keeps them in `site-manager/data/fleet-tokens.json`,
+  mode 0600) but a site being restarted still meets a 401 or ECONNREFUSED for a few seconds. That is why the outbox exists: a report is "sent or waiting",
   never lost. Waiting ones go on the next `/sent` and on the timer (`syncMinutes`, default 60, which also
   notices new replies and raises a `feedback:reply` notification). A retry carries the same `ref`, and the
   manager answers the existing report (200) instead of making a second.
@@ -113,3 +113,8 @@ Replying in the inbox to a `_manager` report you filed yourself marks it seen fo
   (`.fb-note` is flex) beats the browser's. `index.css` carries `.fb [hidden] {display: none !important}`.
 - Only this machine's sites can reach dcm (the fleet token lives in this manager's memory). Sites on other
   machines would need their own manager to relay with an installation key; not built.
+
+## 1.1.4 (2026-10-13 Tool sweep hygiene)
+
+- Cache-busters follow the manifest: `feedback.js?v=1.1.4` in plugin.json and `V = '1.1.4'` for the sub-views - bump
+  both with the version. Fleet-token note above corrected (tokens are on disk since 2026-10-04).

package/plugins/feedback/admin/views/feedback.js

@@ -16,7 +16,7 @@
 import {api, loadKit, store} from '../lib/kit.js';
 
 const ROUTE = /^#\/plugins\/feedback(\/|$)/;
-const V = '1.1.0';
+const V = '1.1.4';
 const TABS = [
     {key: 'inbox', label: 'Inbox', icon: 'inbox'},
     {key: 'mine', label: 'My feedback', icon: 'send'}

package/plugins/feedback/lib/receiver.js

@@ -7,7 +7,7 @@
  * admins' names and emails.
  *
  * A site is who its fleet token says it is (site-manager/services/fleetTokens.js,
- * memory only, minted when the manager forked it). The module is imported at
+ * minted when the manager forked it and kept in site-manager/data/fleet-tokens.json). The module is imported at
  * call time and only exists where Site Manager does, which is also how this
  * plugin knows it is on the manager.
  *

package/plugins/feedback/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "feedback",
   "displayName": "Feedback",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "tier": "free",
   "description": "Tell Domma what is broken, missing or good - straight from your admin - and see what became of it: seen, planned, in progress, done, with Domma's reply.",
   "author": "Domma CMS",
-  "date": "2026-10-03",
+  "date": "2026-10-13",
   "icon": "message-square",
   "permissions": [
     {
@@ -40,7 +40,7 @@
     ],
     "views": {
       "plugin-feedback": {
-        "entry": "feedback/admin/views/feedback.js?v=1.1.1",
+        "entry": "feedback/admin/views/feedback.js?v=1.1.4",
         "exportName": "feedbackView"
       }
     }