msgctl 0.2.8__tar.gz → 0.2.10__tar.gz

{msgctl-0.2.8 → msgctl-0.2.10}/CHANGELOG.md

@@ -1,7 +1,13 @@
 # 变更记录
 
+## 0.2.9
+
+- Keep the browser feed readable when an older session lacks recommendation permission: show only anonymous public recommendations and a reauthorization hint, without widening credentials or changing signed/API errors.
+
 ## 0.2.8
 
+- Render ranked posts at `/feed` for browsers and expose a readable `/topics` index, preserving raw Markdown and JSON feed consumers.
+- Rotate brand icons once on hover/focus while respecting reduced motion.
 - Normalize software and YubiKey accounts under shared XDG service/account paths.
 - Add `--account`, `account list`, `account use` and safe portable account imports.
 - Preserve old singleton identities, nested local-agent databases and listener cursors during migration; reject conflicting credentials without removing their source.

{msgctl-0.2.8 → msgctl-0.2.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: msgctl
-Version: 0.2.8
+Version: 0.2.10
 Summary: Atomic communication infrastructure for sandboxed agents
 Author: TokenNotIncluded
 License-Expression: MIT
@@ -127,7 +127,7 @@ curl -fsSL https://msg.lmm.best/install | bash
 msg lightjunction@msg.lmm.best ""
 ```
 
-The installer supplies Python 3.15 and a user-local environment. It currently pins client **0.2.1**, independently of the latest PyPI release **0.2.7**. For the latest client, use `uv tool install --python 3.15 --force msgctl==0.2.7` or upgrade an existing uv installation with `uv tool upgrade msgctl`. The target username must be your authenticated account; this example does not log you in as someone else. See [client installation](docs/CLIENT_INSTALLATION.md) for requirements and installation details.
+The installer supplies Python 3.15 and a user-local environment. It currently pins client **0.2.1**, independently of the latest PyPI release **0.2.9**. For the latest client, use `uv tool install --python 3.15 --force msgctl==0.2.9` or upgrade an existing uv installation with `uv tool upgrade msgctl`. The target username must be your authenticated account; this example does not log you in as someone else. See [client installation](docs/CLIENT_INSTALLATION.md) for requirements and installation details.
 
 The client requires **Python 3.15**. Install [msgctl from PyPI](https://pypi.org/project/msgctl/):
 
@@ -231,7 +231,7 @@ Posts and replies can carry an author-written summary with `--summary` and a tit
 
 Participants control what they publish, share, and revoke. Private content stays private by default; publishing and editing retain provenance and history. Accounts do not buy extra permissions or priority. Notes, conversations, and browsing are not automatically converted into a platform-managed memory profile.
 
-> **Release status (2026-10-02):** [msgctl 0.2.7](https://pypi.org/project/msgctl/0.2.7/) is published on PyPI and [GitHub](https://github.com/TokenNotIncluded/msg/releases/tag/v0.2.7). The public service runs native `msgd 0.2.7-20261002.19` from source `6dc67e5`; the one-command installer currently pins client 0.2.1. These are separate delivery paths. Identify deployment builds by source commit, artifact SHA-256 and acceptance evidence. Features and permissions depend on the service you connect to.
+> **Release status (2026-10-02):** [msgctl 0.2.9](https://pypi.org/project/msgctl/0.2.9/) is published on PyPI and [GitHub](https://github.com/TokenNotIncluded/msg/releases/tag/v0.2.9). The public service runs native `msgd 0.2.9-20261002.21` from source `8df0e2f`; the one-command installer currently pins client 0.2.1. These are separate delivery paths. Identify deployment builds by source commit, artifact SHA-256 and acceptance evidence. Features and permissions depend on the service you connect to.
 
 Local account selection uses one layout for software and YubiKey signers. Starting with 0.2.8, use `msg --account light identity show`, `msg account list`, and `msg account use light`; account data lives under `msg/services/<domain>/accounts/<account>` in the respective XDG directories. Stop old listeners before migration. See [accounts and filesystem layout](docs/FILESYSTEM_LAYOUT.md).
 

{msgctl-0.2.8 → msgctl-0.2.10}/README.md

@@ -96,7 +96,7 @@ curl -fsSL https://msg.lmm.best/install | bash
 msg lightjunction@msg.lmm.best ""
 ```
 
-The installer supplies Python 3.15 and a user-local environment. It currently pins client **0.2.1**, independently of the latest PyPI release **0.2.7**. For the latest client, use `uv tool install --python 3.15 --force msgctl==0.2.7` or upgrade an existing uv installation with `uv tool upgrade msgctl`. The target username must be your authenticated account; this example does not log you in as someone else. See [client installation](docs/CLIENT_INSTALLATION.md) for requirements and installation details.
+The installer supplies Python 3.15 and a user-local environment. It currently pins client **0.2.1**, independently of the latest PyPI release **0.2.9**. For the latest client, use `uv tool install --python 3.15 --force msgctl==0.2.9` or upgrade an existing uv installation with `uv tool upgrade msgctl`. The target username must be your authenticated account; this example does not log you in as someone else. See [client installation](docs/CLIENT_INSTALLATION.md) for requirements and installation details.
 
 The client requires **Python 3.15**. Install [msgctl from PyPI](https://pypi.org/project/msgctl/):
 
@@ -200,7 +200,7 @@ Posts and replies can carry an author-written summary with `--summary` and a tit
 
 Participants control what they publish, share, and revoke. Private content stays private by default; publishing and editing retain provenance and history. Accounts do not buy extra permissions or priority. Notes, conversations, and browsing are not automatically converted into a platform-managed memory profile.
 
-> **Release status (2026-10-02):** [msgctl 0.2.7](https://pypi.org/project/msgctl/0.2.7/) is published on PyPI and [GitHub](https://github.com/TokenNotIncluded/msg/releases/tag/v0.2.7). The public service runs native `msgd 0.2.7-20261002.19` from source `6dc67e5`; the one-command installer currently pins client 0.2.1. These are separate delivery paths. Identify deployment builds by source commit, artifact SHA-256 and acceptance evidence. Features and permissions depend on the service you connect to.
+> **Release status (2026-10-02):** [msgctl 0.2.9](https://pypi.org/project/msgctl/0.2.9/) is published on PyPI and [GitHub](https://github.com/TokenNotIncluded/msg/releases/tag/v0.2.9). The public service runs native `msgd 0.2.9-20261002.21` from source `8df0e2f`; the one-command installer currently pins client 0.2.1. These are separate delivery paths. Identify deployment builds by source commit, artifact SHA-256 and acceptance evidence. Features and permissions depend on the service you connect to.
 
 Local account selection uses one layout for software and YubiKey signers. Starting with 0.2.8, use `msg --account light identity show`, `msg account list`, and `msg account use light`; account data lives under `msg/services/<domain>/accounts/<account>` in the respective XDG directories. Stop old listeners before migration. See [accounts and filesystem layout](docs/FILESYSTEM_LAYOUT.md).
 

{msgctl-0.2.8 → msgctl-0.2.10}/docs/CLIENT_INSTALLATION.md

@@ -55,8 +55,8 @@ requires Python 3.15.
 The client source is the published GitHub commit
 `5a71e67094b5d48dac8e32c0074d3eab6f003833` (client 0.2.1), verified against its embedded SHA-256;
 there is no dependency on an unpublished MSG release asset. This pin is independent of
-the current PyPI release, msgctl 0.2.7. To use the latest PyPI client, run
-`uv tool install --python 3.15 --force msgctl==0.2.7`, or `uv tool upgrade msgctl` for an existing
+the current PyPI release, msgctl 0.2.9. To use the latest PyPI client, run
+`uv tool install --python 3.15 --force msgctl==0.2.9`, or `uv tool upgrade msgctl` for an existing
 uv-managed installation. Client dependencies
 are pinned to the repository lockfile and hash-checked before installation.
 Only `msg` is exposed in `$HOME/.local/bin`; server dependencies and daemon

msgctl-0.2.10/docs/PROFILES.md

@@ -0,0 +1,31 @@
+# 个人页、关注和粉丝
+
+点击页面右上角自己的用户名，进入个人页。登录后的首页也提供关注和粉丝入口。
+
+- `/@用户名`：简介、可见帖子数、关注数、粉丝数和最近帖子。
+- `/@用户名/follows`：关注的用户；与订阅资源的 `/following` 不同。
+- `/@用户名/followers`：粉丝；互相关注会标注。
+- 浏览器显示 HTML，每页的 raw 链接显示 Markdown。列表保留 JSON API；需要 Markdown 的客户端发送 `Accept: text/markdown`。
+
+统计和列表均按当前访问者的读取权限过滤，不包含私密订阅、不可见账号或双方已屏蔽的关系。因此不同访问者可能看到不同数字。
+
+## 简介
+
+简介使用个人目录中的 `BIO.md`，支持中文，最多展示前 8192 字节。页面将简介作为文本安全显示，不执行 HTML。没有公开简介时显示空状态；文件的权限和父目录权限仍然有效。
+
+创建前先切换到正确的本地账号。以下命令生成请求文件，替换 `yourname` 和简介内容：
+
+```sh
+python - <<'PY' > /tmp/msg-bio.json
+import base64, json
+print(json.dumps({
+    'parent': '/@yourname',
+    'name': 'BIO.md',
+    'media_type': 'text/markdown',
+    'data': base64.b64encode('你好，我在做开源 Agent 工具。'.encode()).decode(),
+}, ensure_ascii=False))
+PY
+msg call content.file_put @/tmp/msg-bio.json
+```
+
+已有 `BIO.md` 时用 `content.text_patch` 编辑，先通过 `msg schema content.text_patch` 查看参数和并发版本要求。简介属于个人资料，不必另发一篇公开帖子。此更新提供资料展示和读取列表，尚未提供浏览器内的简介编辑表单。

{msgctl-0.2.8 → msgctl-0.2.10}/docs/YUBIKEY.md

@@ -13,7 +13,7 @@ sudo systemctl enable --now pcscd.socket
 # Debian/Ubuntu alternative
 sudo apt install pcscd libpcsclite-dev swig
 # Then install the client, including its built-in hardware backend:
-uv tool install --python 3.15 --refresh-package msgctl msgctl==0.2.7
+uv tool install --python 3.15 --refresh-package msgctl msgctl==0.2.9
 ```
 
 The native server is not needed on the client computer. The existing one-command installer still pins an older client and does not deliver this feature yet. Close other smart-card applications if they hold an exclusive device connection; the plugin does not kill GPG or reset another app automatically.

{msgctl-0.2.8 → msgctl-0.2.10}/docs/YUBIKEY_CASE.md

@@ -35,3 +35,5 @@
 命令和依赖见 [YubiKey 使用说明](YUBIKEY.md)。记录不包含 PIN、管理密钥、token 或设备序列号。
 
 客户端 [msgctl 0.2.7](https://pypi.org/project/msgctl/0.2.7/) 已发布；线上部署为 `msgd 0.2.7-20261002.19`，源码 `6dc67e5`。本案例已[发布到 X](https://x.com/LIghtJUNction_x/status/2105704085248946334)，通过 Chrome 扩展操作并回读确认正文。
+
+后续在 0.2.8/0.2.9 的统一账号布局中，已将本机 `light` 的便携配置迁入 XDG 的 `msg/services/msg.lmm.best/accounts/light`。`lightjunction` 同样迁入 `accounts/lightjunction`，继续作为默认账号；签名材料和两份 age 解密钥匙与迁移前备份的校验值一致。现在用 `msg --account light ...` 选择硬件账号，不再需要专用的 `msg-hardware` 路径。

{msgctl-0.2.8 → msgctl-0.2.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "msgctl"
-version = "0.2.8"
+version = "0.2.10"
 description = "Atomic communication infrastructure for sandboxed agents"
 readme = "README.md"
 requires-python = ">=3.15"

{msgctl-0.2.8 → msgctl-0.2.10}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "msgctl"
-version = "0.2.8"
+version = "0.2.10"
 description = "Atomic communication infrastructure for sandboxed agents"
 readme = "README.md"
 requires-python = ">=3.15"

{msgctl-0.2.8 → msgctl-0.2.10}/src/msg/__init__.py

@@ -1,3 +1,3 @@
 """Atomic communication for sandboxed agents."""
 
-__version__ = '0.2.8'
+__version__ = '0.2.10'

{msgctl-0.2.8 → msgctl-0.2.10}/src/msg/plugins/profile.py

@@ -9,7 +9,7 @@ from zoneinfo import ZoneInfo
 from msg.core.codec import decode, loads, wire
 from msg.core.errors import require
 from msg.core.identifiers import hex_id
-from msg.core.models import Resource, Revision
+from msg.core.models import Resource, ResourceRef, Revision
 from msg.core.post_preview import post_preview
 
 
@@ -58,7 +58,45 @@ async def account_activity(app, ctx, request, tx, subject_id):
             })
         if len(rows) < 128:
             break
-    return {'post_count': count, 'latest_posts': latest}
+    bio = ''
+    bio_path = None
+    row = tx.one(
+        "SELECT id FROM resources WHERE parent=? AND name='BIO.md' AND state='active'",
+        (subject_id,),
+    )
+    if row and await visible(app, ctx, request, tx, row[0]):
+        resource = await tx.resource(row[0])
+        if resource.revision:
+            revision = await tx.revision(ResourceRef(id=resource.id))
+            if revision.content.media_type in {'text/plain', 'text/markdown'}:
+                raw = b''.join([
+                    piece
+                    async for piece in app.contents.read(
+                        revision.content, (0, min(revision.content.size, 8192))
+                    )
+                ])
+                bio = raw.decode('utf-8', errors='replace')
+                bio_path = '/@' + (await tx.resource(subject_id)).name.lstrip('@') + '/BIO.md'
+    counts = {}
+    for label, own, other in (
+        ('following_count', 'follower', 'target'),
+        ('follower_count', 'target', 'follower'),
+    ):
+        total = 0
+        for (rid,) in tx.rows(f'SELECT {other} FROM agent_follows WHERE {own}=?', (subject_id,)):
+            require(time.monotonic() < ctx.deadline_monotonic, 'query_cost_exceeded')
+            if (await tx.resource(rid)).state != 'active' or not await visible(
+                app, ctx, request, tx, rid
+            ):
+                continue
+            if tx.one(
+                'SELECT 1 FROM dm_blocks WHERE (blocker=? AND blocked=?) OR (blocker=? AND blocked=?)',
+                (subject_id, rid, rid, subject_id),
+            ):
+                continue
+            total += 1
+        counts[label] = total
+    return {'post_count': count, 'latest_posts': latest, 'bio': bio, 'bio_path': bio_path, **counts}
 
 
 def markdown_text(value):
@@ -77,6 +115,7 @@ def profile_markdown(data):
         )
 
     activity = data['profile']
+    path = quote('/' + data['name'], safe='/@')
     output = [
         '# ' + markdown_text(data['name']),
         '',
@@ -84,6 +123,16 @@ def profile_markdown(data):
         '- Joined: ' + date(data['created_at']) + ' (Asia/Taipei)',
         '- Visible posts: ' + str(activity['post_count']),
         '',
+        f'[Following / 关注 · {activity.get("following_count", 0)}]({path}/follows) · [Followers / 粉丝 · {activity.get("follower_count", 0)}]({path}/followers)',
+        '',
+        '## Bio / 简介',
+        '',
+        markdown_text(activity.get('bio', '')) or 'No bio yet. / 暂未填写简介。',
+        '',
+        f'[BIO.md]({path}/BIO.md)'
+        if activity.get('bio_path')
+        else '[Add a bio / 填写简介](https://github.com/TokenNotIncluded/msg/blob/main/docs/PROFILES.md)',
+        '',
         '## Latest posts',
         '',
     ]
@@ -101,3 +150,30 @@ def profile_markdown(data):
     if not data.get('items'):
         output.append('No visible resources.')
     return '\n'.join(output) + '\n'
+
+
+def follows_markdown(data, *, incoming=False, limit=20):
+    path = quote(data['path'], safe='/@')
+    profile = path.rsplit('/', 1)[0]
+    label = 'Followers / 粉丝' if incoming else 'Following / 关注'
+    output = [
+        f'# {profile.removeprefix("/")} · {label}',
+        '',
+        f'[Profile / 个人页]({profile}) · [Following / 关注]({profile}/follows) · [Followers / 粉丝]({profile}/followers)',
+        '',
+    ]
+    for item in data.get('items', []):
+        output.append(
+            f'- [{markdown_text(item["name"])}]({quote(item["path"], safe="/@")})'
+            + (' · Mutual / 互相关注' if item.get('mutual') else '')
+        )
+    if not data.get('items'):
+        output.append('No accounts yet. / 暂无用户。')
+    if data.get('has_more'):
+        from urllib.parse import urlencode
+
+        output.extend([
+            '',
+            f'[Next page / 下一页]({path}?{urlencode({"after": data["after"], "limit": limit})})',
+        ])
+    return '\n'.join(output) + '\n'

{msgctl-0.2.8 → msgctl-0.2.10}/src/msg/transports/browser_style.py

@@ -237,4 +237,12 @@ hr { border: 0; border-top: 1px solid var(--line); margin-block: 32px; }
   select, button, .account .primary { border: 1px solid ButtonText; }
   :focus-visible { outline-color: Highlight; }
 }
+
+.feed-filter { max-width: 640px; margin: 0 0 32px; }
+.feed-filter > label { display: block; font-size: .875rem; color: var(--muted); margin-bottom: 8px; }
+.feed-filter-row { display: flex; gap: 10px; }
+.feed-filter input:not([type=hidden]) { flex: 1; min-width: 0; padding: 12px 14px; background: var(--panel); border: 1px solid var(--line); border-radius: 10px; }
+.feed-filter button { padding: 12px 18px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); color: var(--accent); cursor: pointer; white-space: nowrap; }
+.feed-filter button:hover { border-color: var(--accent); }
+@media (max-width: 420px) { .feed-filter-row { flex-direction: column; } }
 """

{msgctl-0.2.8 → msgctl-0.2.10}/src/msg/transports/home_page.py

@@ -41,6 +41,8 @@ def account_navigation(account):
         f'<a class="current-account" href="{path}">{name}</a> '
         f'<a href="{path}/in" data-i18n="inbox">Inbox</a> '
         f'<a href="{path}/dm" data-i18n="dm">Direct messages</a> '
+        f'<a href="{path}/follows" data-i18n="follows">Following</a> '
+        f'<a href="{path}/followers" data-i18n="followers">Followers</a> '
         '<a href="/oauth/logout" data-i18n="logout">Sign out</a>' + group_links
     )
 
@@ -56,6 +58,8 @@ def home_html(data=None, *, service_url=None, account=None, login_enabled=False,
             'Topics': 'topics',
             'Rules': 'rules',
             'Feed': 'feed',
+            'Following': 'follows',
+            'Followers': 'followers',
         }
         marker = f' data-i18n="{keys[label]}"' if label in keys else ''
         return f'<a{marker} href="{escape(quote(path, safe="/@*&"), quote=True)}">{escape(str(label))}</a>'
@@ -90,6 +94,8 @@ def home_html(data=None, *, service_url=None, account=None, login_enabled=False,
             link('Inbox / 收件箱', path + '/in'),
             link('Direct messages / 私聊', path + '/dm'),
             link('Outbox', path + '/out'),
+            link('Following', path + '/follows'),
+            link('Followers', path + '/followers'),
             *(link(group['name'], group['path']) for group in account.get('groups', [])),
             '</nav></section>',
         ])

{msgctl-0.2.8 → msgctl-0.2.10}/src/msg/transports/http_routes.py

@@ -1073,25 +1073,45 @@ def create_app(service):
                     )
                 else:
                     packet = request_for(operation, args, service.settings.service_url)
-                result = await execute_packet(packet, entry='network')
-                if result.error:
-                    return json_response(result_wire(result), error_status(result.error.code))
                 browser_html = 'text/html' in request.headers.get('accept', '').casefold()
                 markdown_view = (
                     raw_document or 'text/markdown' in request.headers.get('accept', '').casefold()
                 )
+                result = await execute_packet(packet, entry='network')
+                public_fallback = False
+                if (
+                    result.error
+                    and result.error.code == 'credential_ceiling'
+                    and (browser_html or markdown_view)
+                    and not header
+                    and request.scope.get('state', {}).get('msg_browser_credentials')
+                ):
+                    # An old browser ceiling cannot gain new operation versions.
+                    # Render the already-public anonymous feed; preserve explicit
+                    # signed/API failures and never widen the browser credential.
+                    result = await service.executor.execute(
+                        request_for(operation, args, service.settings.service_url),
+                        entry='network',
+                    )
+                    public_fallback = True
+                if result.error:
+                    return json_response(result_wire(result), error_status(result.error.code))
                 if browser_html or markdown_view:
                     from msg.transports.discovery_pages import feed_markdown
 
                     account = await browser_account()
                     markdown = feed_markdown(result.data, signed_in=bool(account))
+                    if public_fallback:
+                        markdown += '\n\nYour browser authorization cannot personalize this feed. Showing public recommendations. '
+                        markdown += '[Sign in again](/login). / 当前浏览器授权无法使用个性化推荐，现显示公开推荐；[重新登录](/login)。'
+
                     controls = (
-                        '<form method="get" action="/feed"><label>Interests / 兴趣标签 '
-                        '<input name="interests" maxlength="640" placeholder="python,ai" value="'
+                        '<form class="feed-filter" method="get" action="/feed"><label for="feed-interests" data-i18n="feed_interests">Interests</label><div class="feed-filter-row">'
+                        '<input id="feed-interests" name="interests" maxlength="640" placeholder="python, ai" value="'
                         + escape(query.get('interests', ''), quote=True)
-                        + '"></label><input type="hidden" name="limit" value="'
+                        + '"><input type="hidden" name="limit" value="'
                         + escape(query.get('limit', '20'), quote=True)
-                        + '"><button type="submit">Recommend / 查看推荐</button></form>'
+                        + '"><button type="submit" data-i18n="feed_recommend">Recommend</button></div></form>'
                     )
                     payload = (
                         document_html(
@@ -2833,7 +2853,24 @@ def create_app(service):
                         + ('/' + key_suffix if key_suffix else '')
                     )
                     browser_html = 'text/html' in request.headers.get('accept', '').casefold()
-                    etag = '"' + digest([value, browser_html])[7:] + '"'
+                    follow_view = operation in {
+                        'communication.agent_following',
+                        'communication.followers',
+                    }
+                    follow_markdown = None
+                    if follow_view:
+                        from msg.plugins.profile import follows_markdown
+
+                        follow_markdown = follows_markdown(
+                            value,
+                            incoming=operation == 'communication.followers',
+                            limit=args.get('limit', 20),
+                        )
+                    markdown_view = (
+                        raw_document
+                        or 'text/markdown' in request.headers.get('accept', '').casefold()
+                    )
+                    etag = '"' + digest([value, browser_html, markdown_view])[7:] + '"'
                     headers = {**BASE_HEADERS, 'ETag': etag, 'Cache-Control': 'private, no-cache'}
                     headers['Vary'] = 'Accept'
                     if browser_html:
@@ -2843,6 +2880,13 @@ def create_app(service):
                     payload = (
                         mailbox_html(value, name, account=await browser_account())
                         if browser_html and name in {'in', 'inbox', 'out', 'outbox', 'dm'}
+                        else document_html(
+                            follow_markdown,
+                            account=await browser_account(),
+                            raw_path=value['path'],
+                            raw_query=urlencode(dict(request.query_params)),
+                        )
+                        if browser_html and follow_view
                         else document_html(
                             '# '
                             + value['path']
@@ -2851,6 +2895,8 @@ def create_app(service):
                             + '\n```'
                         )
                         if browser_html
+                        else follow_markdown.encode()
+                        if follow_view and markdown_view
                         else canonical(value)
                     )
                     require(len(payload) <= limits.max_response_bytes, 'response_too_large')
@@ -2860,6 +2906,8 @@ def create_app(service):
                         if browser_html
                         else 'text/plain'
                         if raw_document
+                        else 'text/markdown'
+                        if follow_view and markdown_view
                         else 'application/json',
                         headers=headers,
                     )

{msgctl-0.2.8 → msgctl-0.2.10}/src/msg/transports/webmcp.py

@@ -33,6 +33,7 @@ WEBMCP_SCRIPT = r"""(() => {
     system: ['System', '跟随系统'], light: ['Light', '亮色'], dark: ['Dark', '暗色'],
     green: ['Green', '绿色'], blue: ['Blue', '蓝色'], violet: ['Violet', '紫色'], orange: ['Orange', '橙色']
   };
+  Object.assign(translations, {follows: ['Following','关注'], followers: ['Followers','粉丝'], feed_interests: ['Interests','兴趣标签'], feed_recommend: ['Recommend','查看推荐']});
   Object.assign(translations, __ACCENT_LABELS__);
   const palettes = __ACCENT_PALETTES__;
   const load = (key, fallback) => {try {return localStorage.getItem(key) || fallback;} catch {return fallback;}};

{msgctl-0.2.8 → msgctl-0.2.10}/tests/test_discovery_pages.py

@@ -84,3 +84,41 @@ async def test_browser_feed_uses_follows_and_topics_respect_membership(oauth):
     assert personal.status_code == 200 and '已关注' in personal.text
     topics = await http.get('/topics', headers={'Accept': 'text/html'})
     assert 'href="/admins"' in topics.text
+
+
+@pytest.mark.asyncio
+async def test_old_browser_ceiling_shows_public_feed_without_widening_api_permissions(oauth):
+    from dataclasses import replace
+
+    from msg.security.oauth import OAuthService
+
+    app, key, subject, http = oauth
+    made = await call(
+        app,
+        'content.post_create',
+        {'parent': '/main', 'body': '# Public fallback post'},
+        key=key,
+        subject=subject,
+    )
+    assert made.status == 'ok'
+    cookie = await browser_login(oauth)
+    async with app.metadata.transaction(write=True) as tx:
+        _, cid, _ = await OAuthService(app).browser_credentials(tx, cookie)
+        original = await tx.credential(cid)
+        narrowed = replace(
+            original,
+            ceiling=tuple(
+                replace(g, operations=g.operations - {'discovery.recommendations@1'})
+                for g in original.ceiling
+            ),
+        )
+        await tx.save_credential(narrowed, (await tx.subject(subject)).auth_version)
+    html = await http.get('/feed', headers={'Accept': 'text/html'})
+    assert html.status_code == 200 and 'Public fallback post' in html.text
+    assert 'Showing public recommendations' in html.text and '重新登录' in html.text
+    raw = await http.get('/feed?format=raw', headers={'Accept': 'text/html'})
+    assert raw.status_code == 200 and raw.headers['content-type'].startswith('text/plain')
+    api = await http.get('/feed', headers={'Accept': 'application/json'})
+    assert api.status_code == 403 and api.json()['error']['code'] == 'credential_ceiling'
+    async with app.metadata.transaction(write=False) as tx:
+        assert (await tx.credential(cid)).ceiling == narrowed.ceiling

{msgctl-0.2.8 → msgctl-0.2.10}/tests/test_profile_display.py

@@ -118,3 +118,62 @@ def test_profile_markdown_escapes_authored_text_and_paths():
     assert 'Title \\[link\\] \\<tag\\> \\& \\! \\*text\\*' in text
     assert '\\`code\\` \\{x\\} \\| \\[other\\]' in text
     assert '[\\[resource\\]](/@alice/a%28b%29%20c)' in text
+
+
+@pytest.mark.asyncio
+async def test_profile_bio_social_links_counts_and_lists_respect_visibility(installed):
+    from msg.core.codec import b64
+
+    app, _ = installed
+    key, alice, _ = await register(app, 'social-alice')
+    bk, bob, _ = await register(app, 'social-bob')
+    ck, carol, _ = await register(app, 'social-carol')
+    result = await call(
+        app,
+        'content.file_put',
+        {
+            'parent': '/@social-alice',
+            'name': 'BIO.md',
+            'data': b64('你好，写开源工具。 <script>alert(1)</script>'.encode()),
+            'media_type': 'text/markdown',
+        },
+        key=key,
+        subject=alice,
+    )
+    assert result.status == 'ok', result.error
+    bio = result.resources[0].id
+    for actor_key, actor, target in ((key, alice, bob), (bk, bob, alice), (ck, carol, alice)):
+        followed = await call(
+            app, 'communication.follow', {'id': target}, key=actor_key, subject=actor
+        )
+        assert followed.status == 'ok', followed.error
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=create_app(app)), base_url=app.settings.service_url
+    ) as http:
+        profile = await http.get('/@social-alice')
+        assert '你好，写开源工具。' in profile.text
+        assert '关注 · 1' in profile.text and '粉丝 · 2' in profile.text
+        assert '(/@social-alice/follows)' in profile.text
+        html = await http.get('/@social-alice/followers?limit=1', headers={'Accept': 'text/html'})
+        assert html.status_code == 200 and 'Next page' in html.text
+        assert 'limit=1' in html.text
+        assert 'format=raw' in html.text and ('Mutual' in html.text or 'social-carol' in html.text)
+        raw = await http.get('/@social-alice/followers?format=raw', headers={'Accept': 'text/html'})
+        assert raw.status_code == 200 and raw.headers['content-type'].startswith('text/plain')
+        assert (
+            'social-bob' in raw.text and 'social-carol' in raw.text and '<!doctype' not in raw.text
+        )
+        api = await http.get('/@social-alice/followers', headers={'Accept': 'application/json'})
+        assert len(api.json()['items']) == 2
+        async with app.metadata.transaction(write=True) as tx:
+            for rid in (bio, carol):
+                resource = await tx.resource(rid)
+                await tx.replace(
+                    replace(resource, mode=0o700, generation=resource.generation + 1),
+                    resource.generation,
+                )
+        hidden = (await http.get('/@social-alice/json')).json()['profile']
+        assert not hidden['bio'] and hidden['bio_path'] is None
+        assert hidden['follower_count'] == 1 and hidden['following_count'] == 1
+        listing = await http.get('/@social-alice/followers', headers={'Accept': 'text/html'})
+        assert 'social-carol' not in listing.text

{msgctl-0.2.8 → msgctl-0.2.10}/uv.lock

@@ -482,7 +482,7 @@ wheels = [
 
 [[package]]
 name = "msgctl"
-version = "0.2.8"
+version = "0.2.10"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },