mirror of https://github.com/hanzoai/bot-hub.git synced 2026-10-30 18:46:42 +00:00

Files

T

zeekay 0078c826cb rebrand souls → personas across entire codebase

Rename all soul/Soul/SOUL references to persona/Persona/PERSONA:
- 73 files renamed and updated
- Routes: /souls/ → /personas/, /souls/$slug → /personas/$slug
- API: /v1/souls → /v1/personas, soulsApi → personasApi
- DB: souls → personas, soul_versions → persona_versions, etc.
- Components: SoulCard → PersonaCard, SoulDetailPage → PersonaDetailPage
- Types: PublicSoul → PublicPersona, Soul → Persona
- Env: VITE_SOULHUB_* → VITE_PERSONAHUB_*
- Remove onlycrabs.ai branding → personas.hanzo.ai
- SOUL.md → PERSONA.md throughout

Personas are scientifically modeled personality profiles, not "bot souls".

2026-02-17 14:09:29 -08:00

3.0 KiB

Raw Permalink Blame History

summary, read_when

summary

read_when

Security + moderation controls (reports, bans, upload gating).

Working on moderation or abuse controls

Reviewing upload restrictions

Troubleshooting hidden/removed skills

Security + Moderation

Roles + permissions

user: upload skills/personas (subject to GitHub age gate), report skills.
moderator: hide/restore skills, view hidden skills, unhide, soft-delete, ban users (except admins).
admin: all moderator actions + hard delete skills, change owners, change roles.

Reporting + auto-hide

Reports are unique per user + skill.
Report reason required (trimmed, max 500 chars). Abuse of reporting may result in account bans.
Per-user cap: 20 active reports.
- Active = skill exists, not soft-deleted, not moderationStatus = removed, and the owner is not banned.
Auto-hide: when unique reports exceed 3 (4th report), the skill is:
- soft-deleted (softDeletedAt)
- moderationStatus = hidden
- moderationReason = auto.reports
- embeddings visibility set to deleted
- audit log entry: skill.auto_hide
Public queries hide non-active moderation statuses; staff can still access via staff-only queries and unhide/restore/delete/ban.
Skills directory supports an optional "Hide suspicious" filter to exclude active-but-flagged (flagged.suspicious) entries from browse/search results.

Bans

Banning a user:
- hard-deletes all owned skills
- revokes API tokens
- sets deletedAt on the user
Admins can manually unban (deletedAt + banReason cleared); revoked API tokens stay revoked and should be recreated by the user.
Optional ban reason is stored in users.banReason and audit logs.
Moderators cannot ban admins; nobody can ban themselves.
Report counters effectively reset because deleted/banned skills are no longer considered active in the per-user report cap.

User account deletion

User-initiated deletion is irreversible.
Deletion flow:
- sets deactivatedAt + purgedAt
- revokes API tokens
- clears profile/contact fields
- clears telemetry
Deleted accounts cannot be restored by logging in again.
Published skills remain public.

Upload gate (GitHub account age)

Skill + persona publish actions require GitHub account age ≥ 7 days.
Lookup uses GitHub created_at fetched by the immutable GitHub numeric ID (providerAccountId) and caches on the user:
- githubCreatedAt (source of truth)
Gate applies to web uploads, CLI publish, and GitHub import.
If GitHub responds 403 or 429, publish fails with:
- GitHub API rate limit exceeded — please try again in a few minutes
To reduce rate-limit failures, set GITHUB_TOKEN in Convex env for authenticated GitHub API requests.

Empty-skill cleanup (backfill)

Cleanup uses quality heuristics plus trust tier to identify very thin/templated skills.
Word counting is language-aware (Intl.Segmenter with fallback), reducing false positives for non-space-separated languages.

3.0 KiB Raw Permalink Blame History