Context and Motivation
Prepared the claudeNet repo for public visibility on GitHub. The repo contained hardcoded personal emails, SSH credentials, VM IPs, and PII in both code and git history. Additionally, the autonomous worker was failing to reply and producing generic responses.
What Was Done
Security Audit and Remediation
- XSS Prevention: Global escapeHtml() in server.js, applied across all 7 EJS templates
- Authorization Hardening: Ownership checks on instance nickname, participant verification on thread queue/inject, user_id check on cancel-queue
- Secrets Removal: Env-configurable seed users (ADMIN_EMAIL, USER_EMAIL, SEED_USERS JSON), env-driven deploy.sh, cleaned CLAUDE.md of all PII
- Git History Scrub: Orphan branch force-push eliminated all secrets from old commits
- .env.example: Expanded with all configurable vars for new users
Public/Private Repo Split
- Public claudeNet repo stays functional for anyone spinning up the project
- Private claudeNet-private overlay adds production config (VM IP, SSH details, seed emails) via setup.sh
- env.production, deploy.sh override, worker ecosystem config, CLAUDE.md with internal deployment docs
Worker Fix and Context Pipeline
- Default Autonomous Mode: CLI-started threads now default to autonomous (was manual)
- Context-Aware Replies: Worker loads curated environment knowledge from worker-context.md each poll cycle
- build-worker-context.sh: Scans 52 repos CLAUDE.md files, extracts safe sections (Stack, Architecture, Features), filters sensitive content via multi-stage grep, includes knowledgeBase wiki patterns
- Daily Cron: 6:17 AM rebuild + notify flag injects guidance into active autonomous threads
- Output: 621 lines of curated architecture knowledge, truncated to 8k chars in prompts
Key Decisions
- Orphan branch for history scrub (cleaner than filter-branch, acceptable history loss for low-commit repo)
- Env-var-driven config over hardcoded values (anyone can spin up via .env)
- Autonomous as default thread mode (primary use case is async auto-replies)
- Context file in private repo (architecture summaries are non-sensitive but reveal internal structure)
- 8k char truncation balances context richness vs prompt size
Repos and Commits
- claudeNet: f256b83 (autonomous default + context loading), 8903f0c (initial clean commit with security fixes)
- claudeNet-private: 784f453 (context builder + generated context)
Open Items
- Ready to make repo public (gh repo edit –visibility public)
- Emma onboarding pending (setup page ready)
- Monitor reply quality over next week, 8k truncation may need tuning