* chore(connect): provider-host ratchet in check:guards, drop the dead Arcim gateway client
Two boundary chores from the Connect plan. (1) A per-file ratchet in
scripts/checks/no-new-antipatterns.mjs over files under lib/, app/ and
extensions/ that name a provider API host (Enable Banking, Skatteverket,
Qvalia, Fortnox, Visma, Briox, Bjorn Lunden, Bokio, Bolagsverket, TIC, Meta,
Gmail). The 22 files that do so today are grandfathered in the baseline; a
new one fails the guard with the connector routing as the remedy, and the set
may only shrink as upstreams move behind the connector. (2) The client for
the retired Arcim Sync gateway (extensions/general/arcim-migration/lib/
arcim-client.ts) is deleted with its test: provider-client.ts replaced it and
nothing else imported it. The --update rewrite also locks in the lower
naive-ore-round count (620 to 617) that main already reached.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMUUom4fUk6zi4xYZSSfat
Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
* chore(guards): provider-host ratchet is case-insensitive and skips colocated .test.tsx; document the own-credentials exception
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
---------
Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* feat(mcp): allowlist Grok's connector callback and document the Grok path
Grok custom connectors self-register through /api/mcp-oauth/register with
redirect_uri https://grok.com/connectors-oauth-exchange-code/, which the
built-in allowlist rejected with invalid_redirect_uri before consent. Add
the callback as an exact-path BUILT_IN_PATTERNS entry (trailing slash
optional, no prefix) with provider 'grok', named "Grok (xAI)" on the
consent page. Tests: accept, foreign-host and other-path rejection,
provider mapping, and a register route test for the Grok DCR shape.
Surface Grok next to ChatGPT: a "Using Grok?" side door on the onboarding
Claude step (one side door open at a time, telemetry step grok), a Grok row
under "Other clients" in the API & MCP settings tab using ?client=grok, and
sv/en strings for both. Docs: mcp-server rule, ARCHITECTURE, README,
registry entry (install section), DECISIONS.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EGbspj3hiNqvqTWZqdwysa
Signed-off-by: Emil <emilmattsson14@gmail.com>
* fix(mcp): cite X Corp's published Grok callback, test the consent label
Review pass on #2158: the allowlist comment and DECISIONS entry claimed
xAI publishes no callback and the value came from a live observation; X
Corp lists https://grok.com/connectors-oauth-exchange-code/ as the "Grok
(web)" redirect URL at docs.x.com/x-ads-api/mcp, and grok.com serves the
path itself (slash form 308s to no-slash on the same origin). Reworded
both to cite that. Adds the consent-page test for "Grok (xAI)" next to
the ChatGPT one and a JSDoc on the onboarding side-door toggle.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EGbspj3hiNqvqTWZqdwysa
Signed-off-by: Emil <emilmattsson14@gmail.com>
---------
Signed-off-by: Emil <emilmattsson14@gmail.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Every statement was verified against the code on main before editing; the
docs had drifted from the product in ways a customer or agent would act on.
- public/docs/arkivplan-mall.md: product named erp-base; magic-link login;
BAS 2025/2026; eu-central/eu-west region; US subprocessors for AI. Now
Accounted, e-mail + password + TOTP (BankID optional), BAS 2026,
eu-north-1 Stockholm, Bedrock in EU with Resend as the only US
subprocessor; adds rättelselogg, Peppol inbound, skattekonto imports and
the säkerhetsbackup ZIP to the räkenskapsinformation tables.
- ARCHITECTURE.md: adds the inline-rättelse correction path, OAuth 2.1 and
lazy MCP auth, accounted-mcp and claude-plugin, 150+ tools.
- AGENTS.md: defers to CLAUDE.md instead of a drifted copy; keeps the
Codex-only constraints with the Supabase project name fixed (erp-base).
- README.md: drops LangChain/OpenAI (not dependencies), Node 20/22 facts,
150+ tools, adds betalfil, Peppol, skattekonto and the Claude plugin.
- docs/PEPPOL_FOUNDATION.md: the two sentences denying network delivery
and inbound support now describe the live Qvalia path.
- docs/SELF-HOSTING.md, docs/DOCKER.md: clone URLs and directory names,
Sentry DSNs are not read by the app, image pinning uses the 7-char SHA
tags the workflow actually publishes (no semver tag has been cut).
- docs/EXTENSIONS.md: replaces the fictional sector tree with the 19 real
extensions/general directories; lib/reports/sru-encoding.ts.
- .claude/rules/database.md: 680+ migrations, ~170 live tables, adds the
tables and RPCs that matter since July, drops sandbox_users.
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* docs: add community health files, ARCHITECTURE.md, and README overhaul
Community layer: CODE_OF_CONDUCT (Contributor Covenant 2.1), issue
templates (bug/feature YAML forms + contact links), PR template
mirroring the Definition of Done, and a visitor-grade ARCHITECTURE.md
distilled from internal docs.
README: fix the clone/cd case mismatch, add CI/docker badges and site
links, add a Why section (compliance-by-construction, agent-native MCP
surface, self-hostable), add missing payroll and MCP feature bullets,
and restructure the documentation/community sections. Hero screenshot
slot left as a comment pending an approved shot.
CONTRIBUTING: fix stale gnubok name, link Code of Conduct and
ARCHITECTURE.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jakob Wennberg <jakob.wennberg@gmail.com>
* docs: address review feedback on community files
Disable blank issues so security reports stay on the private path,
require npm run build in the PR checklist to match CONTRIBUTING, and
align ARCHITECTURE.md immutability wording with the actual trigger
behavior (controlled posted-to-reversed transition is permitted).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jakob Wennberg <jakob.wennberg@gmail.com>
---------
Signed-off-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg