- Sort toggle now says 'most recent' instead of 'date added'
- Sort logic uses index position instead of text matching
- Detail pages show just the date without 'added' prefix
Rendering consistency:
- Create shared renderProtocolPill() and renderCollectionPill() functions
used everywhere: library, collection detail, user profile, picker
- All protocol/collection modules now look identical across all contexts
- Profile page collections and protocols use the same shared renderers
- Protocol grids wrapped in .protocol-grid for consistent spacing
New features:
- Footer with CC-BY 4.0 license link and Terms of Service link
- Terms of Service page stating admin reserves right to remove content
- CC-BY 4.0 default license for submitted content
Deployment:
- README now recommends git clone for initial deployment
- README documents git pull for updates without data loss
- All nav links use #protocols instead of #library
Bug fixes (from previous commits, re-applied to current codebase):
- Delete redirect: reset currentRoute guard so navigate works after delete
- #protocols routing instead of #library
- forked_from: null no longer shows as clickable link
- Source field suppressed when it duplicates author
- Collections say 'curated by' instead of 'authored by'
- Breadcrumb home click works from detail pages
- Search debounce and double-navigation guard
- When source equals @username (same as the author), don't show SOURCE line
- When source is empty, don't show a leading · separator before 'authored by'
- Collections say 'curated by' instead of 'authored by'
- Fix YAML fallback parser to properly handle folded scalars (>-) at
both top-level (description, outcome, practice) and step-level
(step descriptions). Previously stored '>-' as the literal value
instead of the folded text.
- Fix delete protocol/collection: reset currentRoute guard so
navigate('library') actually works after deletion.
- Change #library hash to #protocols throughout (routing, nav links,
breadcrumb shows 'protocols/' on the main page).
- Fix breadcrumb home click not working from detail pages (allow
re-navigation to library even if currentRoute matches).
- Fix forked_from: null showing as a clickable link — now suppressed
when value is null or the string 'null'.
- README: replace curl seed instructions with About page button,
add About page customization instructions for whitelabeling.
The API router's parse_path() only stripped /api from the URI, but
when deployed in a subdirectory (e.g. /protocol-droid/), the URI is
/protocol-droid/api/auth/register — the /api regex didn't match.
Now detects base path from SCRIPT_NAME and strips it before routing.
- Rewrite db.php to use SQLite via PDO (no external DB server needed)
- Rewrite schema.sql for SQLite (AUTOINCREMENT, CHECK constraints,
triggers for updated_at, ON CONFLICT instead of ON DUPLICATE KEY)
- Fix config.php upsert to use ON CONFLICT syntax
- Fix index.php: tag filter via json_each, vote upsert via ON CONFLICT,
and fix protocol create route (was returning 405 for POST /api/protocols)
- Fix yaml.php seed import: replace invalid false callbacks with fn() => null,
fix yaml_parse pos argument (-1 -> 0)
- Update Dockerfile: drop pdo_mysql/mysqli (pdo_sqlite is built in)
- Update CloudronManifest.json: remove mysql addon, bump to v0.3.0
- Update README for SQLite deployment
index.html uses absolute /frontend/ paths for CSS and JS, and app.js
hardcoded const API = '/api'. In subdirectory deployments these resolve
to the wrong URL, causing unstyled HTML and broken API calls.
- index.php: rewrite /frontend/ references in index.html with detected basePath
- app.js: derive BASE_PATH from the script's own URL and prefix API calls
A tool for authoring, sharing, and curating social protocols.
Features:
- Protocol library with search, tag filtering, and sort by date/relevance
- Protocol authoring with structured fields (title, description, steps, outcome, practice, source, tags)
- Protocol forking with provenance tracking
- Collection creation with searchable protocol picker and ordering
- User accounts with roles (admin, member, viewer)
- YAML import/export for portability
- Self-hostable on LAMP/Cloudron, works in subdirectories
- Responsive design with hamburger menu on mobile
- About page
Security:
- CSRF protection via Origin/Referer validation
- Session regeneration on login/register
- Secure session cookie params (HttpOnly, SameSite, Secure)
- Visibility enforcement on private/unlisted items
- YAML object injection hardening
- Login rate limiting
- Path traversal protection
- Input validation and length clamping
- Vote value constraining
Stack: PHP 8.x + MySQL/MariaDB, vanilla JS frontend, no external dependencies.
Hippocratic License (HL3-CORE).
Protocolbot