Sameh Khamis 3f6fe69c57 build(docker): keep keys out of the image and run as non-root by default ...

The build context excluded only .env, so .env.local and the like or
pinokio/ENVIRONMENT would be baked into image layers; exclude every dotenv
file except .env.example, plus local state and QA output. Pin the base to
CI's Node 24.14.0 by digest, default to the image's node user, and correct
the HOST comment. Log the trusted peers as the operator's when set. README
notes that MCP and ChatGPT sign-in voice are unavailable under Docker, and
how to trust no gateway when widening the publish.

2026-10-15 13:07:00 -07:00

..

fixtures

Street Level: Panoramax review follow-ups (gekh, #1134)

2026-10-15 16:55:59 +01:00

voice-bench

fix(voice): resolve follow-up review edge cases

2026-10-07 14:21:46 -07:00

build-admin-packs.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

build-military-names.py

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

build-panel.mjs

Run the worker prelude ahead of Cesium's own workers script

2026-10-02 18:29:42 -07:00

build-sf-neighborhoods.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

check-import-directions.mjs

feat: describe what the app shows as a view

2026-10-02 15:21:36 -07:00

check-layer-state-tokens.mjs

fix: allocate share-link layer tokens without collisions

2026-09-24 16:25:55 +05:30

check-package-boundaries.mjs

feat(sdr): local receivers — browser RTL-SDR, Local ADS-B layer and decoder feeds (#732)

2026-09-23 16:00:53 -05:00

dev-cctv.sh

fix: share CCTV startup and keep proxy diagnostics bounded

2026-09-10 23:01:51 -07:00

dev-fresh.sh

fix(setup): stop presenting ChatGPT OAuth as the default voice fallback

2026-10-08 11:02:52 -07:00

dev-secure.sh

refactor(tools): support an explicit project directory

2026-09-14 07:35:38 -07:00

docker-start.mjs

build(docker): keep keys out of the image and run as non-root by default

2026-10-15 13:07:00 -07:00

focus-allocation-check.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

format-runtime.json

build: discover owned runtime modules in the formatter gate

2026-09-15 07:26:32 -07:00

format-scope.json

Merge upstream main into pr/panoramax

2026-10-15 16:56:15 +01:00

format.mjs

build: discover owned runtime modules in the formatter gate

2026-09-15 07:26:32 -07:00

google-server-key.mjs

fix: separate Google browser and server keys (#110)

2026-09-11 15:08:23 -07:00

military-names-files.json

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

military-names.sql

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

module-analysis.mjs

refactor: enforce import directions and expose source factories

2026-09-14 21:12:01 -07:00

next-layer-state-token.mjs

fix: allocate share-link layer tokens without collisions

2026-09-24 16:25:55 +05:30

opensky-import-client.sh

refactor(tools): support an explicit project directory

2026-09-14 07:35:38 -07:00

package-boundaries.json

Merge upstream main into pr/panoramax

2026-10-15 16:56:15 +01:00

pinokio-environment.mjs

fix: separate Google browser and server keys (#110)

2026-09-11 15:08:23 -07:00

pinokio-install.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-preflight.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-reset.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-start.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-update.mjs

fix(pinokio): disclose incoming changes before Update pulls and installs (#507)

2026-09-14 19:34:23 -05:00

precompute-cctv-heights.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

project-root.mjs

refactor(tools): support an explicit project directory

2026-09-14 07:35:38 -07:00

qa-admin-outlines.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-alpr-journey.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-application.mjs

style: adopt application modules into scoped formatting

2026-09-11 17:03:35 -07:00

qa-attribution-b12.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-browserEvidence.mjs

docs(street-level): shorten docs and comments before merge

2026-10-06 21:59:12 +01:00

qa-cables-overlay.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

qa-cables-render-probe.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

qa-cables-shot.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-camera-controls.mjs

fix: preserve camera controls when rebuilding the Radio panel

2026-09-13 01:23:55 -07:00

qa-cctv-v2.mjs

feat(cctv): seven camera packs, semantic labels, terrain-clear monitor planes (#433)

2026-09-13 21:48:33 -05:00

qa-chrome.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-cockpit-plates.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-cockpit-utility.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-context-arrivals.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-directions.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-director-camera.mjs

feat(director): add authored camera directions and anchors

2026-09-15 16:53:26 -07:00

qa-director-interactions.mjs

feat: add declarative Director feature actions

2026-09-15 19:16:49 -07:00

qa-director-packs.mjs

feat(director): add bounded scene data packs and placement

2026-09-15 17:59:53 -07:00

qa-director-sharing.mjs

Add Director authoring, import previews and scene bundles

2026-09-15 20:15:32 -07:00

qa-director-timing.mjs

refactor(director): separate timing clocks and scene pack presentation

2026-09-15 15:41:42 -07:00

qa-draw-tool.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-emergency-squawk.mjs

fix: address GNSS integrity and aircraft emergency review findings

2026-10-14 17:43:13 +02:00

qa-enrich-ambient.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-failstate-b10.mjs

test: name the vessel provider in the feed-failure QA fixture

2026-10-03 23:20:42 -07:00

qa-final-polish-credits.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-firms.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-firstrun-mutations.mjs

fix(qa): repoint stale mutation anchors after the September refactors

2026-10-11 13:52:30 -07:00

qa-firstrun.mjs

fix(qa): align renderer evidence and attribution keyboard assertions

2026-09-11 14:50:57 -07:00

qa-floor-hold.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-floor-verify.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-floorhold-mutations.mjs

fix(qa): repoint stale mutation anchors after the September refactors

2026-10-11 13:52:30 -07:00

qa-floorhold-probe-cost.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

qa-floorhold-staircase.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

qa-flyroute-cinema.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-flyroute-mutations.mjs

fix(qa): repoint stale mutation anchors after the September refactors

2026-10-11 13:52:30 -07:00

qa-focus-evidence.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-gbfs-names.mjs

Frame mobile GBFS QA in supported clean view

2026-10-13 23:48:21 +02:00

qa-geo-import-large.mjs

fix(import): correct clamping and bound local-file rendering

2026-10-15 04:10:41 +02:00

qa-geo-import-regressions.mjs

fix(import): correct clamping and bound local-file rendering

2026-10-15 04:10:41 +02:00

qa-geo-import.mjs

fix(import): correct clamping and bound local-file rendering

2026-10-15 04:10:41 +02:00

qa-gnss.mjs

test: verify GNSS map clicks with production canvas pixels

2026-10-14 17:53:19 +02:00

qa-heading-b3.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-height-datum.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-infra-lod.mjs

fix(infrastructure): stop idle republishing and respect settled terrain

2026-09-11 08:59:32 -07:00

qa-installation-navigation.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-installation-polish.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-journey-recorder.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-l9-matrix.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-label-readability.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-labels.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-layer-panel.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-layer-token-twochar.mjs

fix: allocate share-link layer tokens without collisions

2026-09-24 16:25:55 +05:30

qa-location-controls.mjs

style: format state subscriptions and their adopted controls

2026-09-13 05:43:05 -07:00

qa-map-source-controls.mjs

test: wait for settled map imagery in control captures

2026-09-12 22:26:29 -07:00

qa-map-source-tray.mjs

Update UI acceptance fixtures for panel ownership

2026-09-14 15:43:27 -07:00

qa-military-names.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-nepal-media-playback.mjs

fix: scope Nepal media playback to explicit scene actions

2026-09-16 12:14:15 +05:30

qa-overlay-baseline.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-overpass-offload.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-panel-resize.mjs

fix(street-level): point a key-gated layer at Street View; button beside the hint

2026-10-09 00:05:58 +01:00

qa-panelDrag.mjs

docs(street-level): shorten docs and comments before merge

2026-10-06 21:59:12 +01:00

qa-perf.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

qa-radio.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-recent-imagery.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-scene-controls.mjs

Add Director authoring, import previews and scene bundles

2026-09-15 20:15:32 -07:00

qa-sprites-b5.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-street-level.mjs

Merge upstream/main (KartaView #1121 merged) into pr/panoramax

2026-10-14 15:52:21 +01:00

qa-terrain-429.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-traffic-baseline.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-traffic-jamviz-ab.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-traffic-motion.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-traffic-navigation.mjs

fix(traffic): recover road loading after city navigation

2026-09-13 14:47:26 -07:00

qa-traffic-oblique.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-traffic-preset-ab.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-traffic.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-transit-browser.mjs

fix(transit): keep the real silhouettes under sensor presets, make the selected trail visible, put Transit in Movement (#596)

2026-09-15 13:26:41 -05:00

qa-transit-controls.mjs

feat(transit): live public-transit vehicles from open GTFS-Realtime feeds (#587)

2026-09-15 05:18:30 -05:00

qa-transit-heading.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-transit-recovery.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-transit-scenes.mjs

fix(transit): keep the real silhouettes under sensor presets, make the selected trail visible, put Transit in Movement (#596)

2026-09-15 13:26:41 -05:00

qa-transit.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-ui-disposal.mjs

feat(ui): toggle rendered frame rate with backtick

2026-09-13 14:51:24 -07:00

qa-vessel-cards.mjs

Extract vessel components and preserve source lifecycle

2026-09-13 10:54:32 -07:00

qa-vessel-datum.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-view-target-prewarm.mjs

fix(qa): choose portable browser renderers outside macOS

2026-09-11 14:43:13 -07:00

qa-visual-effects.mjs

style: format state subscriptions and their adopted controls

2026-09-13 05:43:05 -07:00

qa-visual-input.mjs

style: format Display controls and browser acceptance checks

2026-09-12 21:25:05 -07:00

qa-voice-auth-focus.mjs

fix: preserve focus when changing voice auth

2026-10-06 20:36:56 +05:00

qa-voice-auth.mjs

test(voice): match API-key realtime auth response

2026-10-04 23:03:09 +05:00

qa-voice-bench.mjs

feat(voice): voice core — honest layer reach, spoken summary with on-screen card, narration, point-and-ask

2026-09-28 21:19:23 -05:00

qa-voice-routing.mjs

fix the remaining voice review gaps

2026-10-05 04:37:28 +05:30

qa-voice-wav.mjs

refactor(voice): separate Realtime state and resource owners

2026-09-15 12:05:01 -07:00

qa-weather-journey.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-weather-perf.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-weather-swap.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-weather-teardown.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-wind-canvas.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

read-dotenv-value.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

run-unit-tests.mjs

test: say which CI job and which files the discovery guard covers

2026-10-14 11:59:14 -07:00

setup-doctor.mjs

fix(setup): stop presenting ChatGPT OAuth as the default voice fallback

2026-10-08 11:02:52 -07:00

shot-sink.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

track-regression.mjs

test(track): stub the geocode proxy routes, not the browser call

2026-10-15 14:36:06 +01:00

traffic-fixtures.mjs

refactor: separate traffic and bikeshare components

2026-09-13 14:10:38 -07:00

voice-turn-spans.mjs

feat(voice): voice core — honest layer reach, spoken summary with on-screen card, narration, point-and-ask

2026-09-28 21:19:23 -05:00