diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2216a16..014e891 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,13 +16,13 @@ If you cloned without `--recursive`, run `git submodule update --init --recursiv ## Repo layout -| Path | What | -|---|---| -| `usr/plugins/share_chat/` | The plugin itself (manifests + one HTML extension) | -| `docs/spec/` | Behaviour contract (BEH-N), implementation plan, e2e spec docs | -| `tests/component/` | L1 shape suite (testkit assertions, fast, no A0 boot) | -| `tests/e2e/features/` + `tests/e2e/steps/` | Behaviour-first BDD (Gherkin + Playwright steps) | -| `tests/_testkit/` | Devkit submodule — runner, gates, shared steps. Do not edit here; PR the devkit repo. | +| Path | What | +| ------------------------------------------ | ------------------------------------------------------------------------------------- | +| repo root | The plugin itself (root layout — manifests + one HTML extension) | +| `docs/spec/` | Behaviour contract (BEH-N), implementation plan, e2e spec docs | +| `tests/component/` | L1 shape suite (testkit assertions, fast, no A0 boot) | +| `tests/e2e/features/` + `tests/e2e/steps/` | Behaviour-first BDD (Gherkin + Playwright steps) | +| `tests/_testkit/` | Devkit submodule — runner, gates, shared steps. Do not edit here; PR the devkit repo. | ## Workflow @@ -48,8 +48,7 @@ If you cloned without `--recursive`, run `git submodule update --init --recursiv - **No fake green.** Never wrap an assertion in `try/catch` to pass, never add a bare `@skip` — skips need a tracked issue link. -- **Version bumps:** keep `usr/plugins/share_chat/plugin.yaml` and `meta.yaml` versions in - sync. +- **Version bumps:** keep `plugin.yaml` and `meta.yaml` versions in sync. - **License:** contributions are accepted under [Apache-2.0](LICENSE). - **No secrets** — this plugin has no credentials and it must stay that way. CI and the static validator scan for committed secrets. diff --git a/SECURITY.md b/SECURITY.md index 1c901b2..d516532 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -32,7 +32,7 @@ and copies it to the clipboard. Being honest about the security properties: - **Token entropy / guessability of `ctxid`:** Agent Zero chat context ids are short (~8 char) random ids generated client- or server-side. They are identifiers, **not** secrets — Agent Zero's security boundary is its authentication layer, not ctxid secrecy. - Anyone already authenticated to the *same* instance could enumerate or guess chat ids; + Anyone already authenticated to the _same_ instance could enumerate or guess chat ids; the plugin does not change that pre-existing property. - **Exposure surface = your instance's exposure.** If your A0 instance is exposed on a LAN or the internet without auth, the link points anyone straight at your conversation. That risk @@ -51,7 +51,7 @@ and copies it to the clipboard. Being honest about the security properties: (prevents accidentally re-sharing tokens that were in your current URL). - No-op when no chat is selected (`getContext()` falsy → return). - No network calls, no storage, no server-side component — the audit surface is a single - ~150-line declarative HTML file: `usr/plugins/share_chat/extensions/webui/chat-top-end/share-chat.html`. + ~150-line declarative HTML file: `extensions/webui/chat-top-end/share-chat.html`. ## Supported versions diff --git a/docs/marketplace-draft.md b/docs/marketplace-draft.md index fbc9ae6..2f80e53 100644 --- a/docs/marketplace-draft.md +++ b/docs/marketplace-draft.md @@ -30,7 +30,7 @@ screenshots: ## Thumbnail -Copy `usr/plugins/share_chat/webui/thumbnail.png` (256×256 square, ~3.3 KB < 20 KB ✓) +Copy `webui/thumbnail.png` (256×256 square, ~3.3 KB < 20 KB ✓) to `plugins/share_chat/thumbnail.png` in the index PR. ## Pre-submission checklist (flip-time)