OxygenHub 0.6.1 a549ddd5941f

## Unreleased

- **Released oxy can clone repositories with an agent's release tag again (oxygen#131):** since keyless agents could tag releases with ten-minute certified keys, oxy 0.5.0 and older refused such a tag when cloning or fetching a repository with a trust policy (`key … may not create tags/v0.5.0 under this repository's policy`), and with it the whole clone, so andymccall/oxygen could not be cloned by any released client. The hub now leaves those tags out of its answer to a client that does not declare `certified-tags` in the new `Oxy-Features` request header (oxygen#131), which sees the repository as if the tag did not exist; current clients get it as before. Needs the oxygen pin with oxygen#131.

- **Drops: snippets of files, each its own small repository (#279):** a drop is one or more files, as a gist is, kept as an Oxygen repository of its own at `/{owner}/drops/{id}` (a 24-hex-digit id), so every edit is a signed change with history and diffs, and `oxy clone` and `oxy push` take its address. Make one at `/drops/new` (title, description, files, public or secret), with `POST /api/v1/drops`, or with `oh drop create FILE… [--secret] [-d TEXT] [-t TITLE]`; the hub commits it as your delegate, as web edits are, so you delegate to the hub's key first. Your Drops page (`/drops`, under your profile and in the site band) lists and manages them; someone else's shows their public drops only. A secret drop is listed nowhere but readable by anyone with its address. Drops never appear among repositories (profiles, the dashboard, Explore, search, `GET /api/v1/repos`); Admin › Storage labels them. Only the owner edits a drop; the owner or a site administrator deletes it. Push protection covers drop pushes and what the web and the API commit. API: `GET`/`POST /drops`, `GET /users/{name}/drops`, `GET`/`PATCH`/`DELETE /drops/{id}`; `oh drop list|view|delete`. `drops` is now a reserved name, for owners and for repositories. Not yet: forks, stars, comments, embedding, and drops in backups.

- **Repository settings are one page per setting (#278):** a repository's Settings was one long page; it is now a sidebar of grouped pages (General, Code, Flow, Integrations, Data, Danger zone) with the page shown beside it, the current one marked, each at its own address (`/{owner}/{name}/settings/push-protection`, `/settings/runs`, …; `/settings` is General). Pages a role cannot use are not listed and are not found. Every form keeps its address and now returns to its own page with what happened, so reloading does not send it again. Links elsewhere point at the new pages (the push protection refusal names `/settings/push-protection`), and a kept `/settings#section` link opens the page that has it. On a narrow screen the sidebar becomes a compact list above the page. An archived repository's settings open for its admins again, so they can bring it back.

[[package]]

name = "hub-api"

dependencies = [

 "schemars",

 "serde",

[[package]]

name = "oh"

dependencies = [

 "anyhow",

 "axum",

[[package]]

name = "oxy-core"

dependencies = [

 "blake3",

 "ed25519-dalek",

[[package]]

name = "oxy-server"

dependencies = [

 "axum",

 "axum-server",

[[package]]

name = "oxy-strata"

dependencies = [

 "async-trait",

 "bytes",

[[package]]

name = "oxygenhub"

dependencies = [

 "ammonia",

 "anyhow",

resolver = "2"

[workspace.package]

edition = "2021"

license = "MIT OR Apache-2.0"

authors = ["Andy McCall <[email protected]>"]

{% extends "base.html" %}

{% block title %}{% if editing %}Edit drop{% else %}New drop{% endif %}{% endblock %}

{% block content %}

<div class="head"><h1>{% if editing %}Edit drop{% else %}New drop{% endif %} <small>{% if editing %}saved as one signed change{% else %}a small repository of its own, never listed among your repositories{% endif %}</small></h1></div>

{% if let Some(d) = delegation %}<div class="strip warn">{{ d }}</div>{% endif %}

  {% if !kept.is_empty() %}<p class="small mute">Kept as they are (not text, or pushed with oxy): {% for k in kept %}<code>{{ k }}</code>{% if !loop.last %}, {% endif %}{% endfor %}.</p>{% endif %}

  {% if editing %}<label for="message">Change message</label><input type="text" id="message" name="message" value="{{ message }}" placeholder="Edit {{ title }}">{% endif %}

  <p class="small mute">The change is authored by your linked key and signed by this hub's key as your delegate. Push protection refuses anything that looks like a credential.</p>

    <button type="submit"{% if delegation.is_some() %} disabled{% endif %}>{% if editing %}SAVE{% else %}CREATE DROP{% endif %}</button>

    <a class="go" href="{{ cancel }}">CANCEL</a>

  </div>

{% extends "base.html" %}

{% block title %}Drops · {{ owner }}{% endblock %}

{% block content %}

{% if let Some(n) = notice %}<div class="strip">{{ n }}</div>{% endif %}

{% if is_me %}<p class="small mute">A drop is a small Oxygen repository: every edit is a signed change with history, and <code>oxy clone</code> takes its address. Drops never appear among your repositories. A secret drop is listed nowhere and readable by anyone with its address.</p>{% endif %}

<section class="card-box"><div class="card-head"><h2>Drops</h2><span class="count-chip">{{ drops.len() }}</span></div>

    <label><input type="radio" name="mode" value="propose"{% if !is_bookmark %} checked{% endif %}> new bookmark <input type="text" name="new_bookmark" placeholder="name (optional)" size="18"> and propose it</label>

  </div>

  <p class="small mute">The change is authored by your linked key and signed by this hub's key as your delegate; the repository's policy decides whether it may land.</p>

    <button type="submit"{% if delegation.is_some() %} disabled{% endif %}>SAVE</button>

    {% if !new_file %}<button type="submit" name="delete" value="1" class="danger-btn"{% if delegation.is_some() %} disabled{% endif %} data-confirm="Delete {{ path }}?">DELETE FILE</button>{% endif %}

    <a class="go" href="{{ repo.url }}/{% if new_file %}tree/{{ r }}{% else %}file/{{ r }}/{{ path }}{% endif %}">CANCEL</a>

button, a.go, button.go, summary.go { font: inherit; font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: .08em; background: var(--panel); color: var(--acc); border: 1px solid var(--acc); padding: 5px 10px; cursor: pointer; }

button:hover, a.go:hover { background: var(--acc); color: var(--now-ink); text-decoration: none; }

button.small, a.go.small { padding: 2px 8px; font-size: 11px; }

.tag { display: inline-block; font-size: 11px; text-transform: uppercase; letter-spacing: .06em; color: var(--acc); background: var(--soft); padding: 1px 6px; vertical-align: middle; }

.tag.bad { color: var(--bad); }

.tag.warn { color: var(--warn); }