Protocol form:
- Title: 'Round Robin Check-In' → 'Name of the protocol'
- Source: 'Group Works Deck (or @username)' → 'Where it comes from (or @username)'
Collection form:
- Title: 'Protocols for Mutual Aid Groups' → 'Name of the collection'
- Source: 'Author or community (or @username)' → 'Where it comes from (or @username)'
Registration form:
- Display Name: 'Jane Doe' → 'Your name'
Browser tab titles:
- Protocol pages: 'Title · Site Name'
- Collection pages: 'Title · Site Name'
- User pages: '@username · Site Name'
- Resets to site name on library/collections/about
Social media previews (server-side, for crawlers):
- index.php detects /protocols/slug, /collections/slug, /users/username
- Looks up title + description from DB
- Injects og:title, og:description, og:type, og:site_name, og:url
- Injects twitter:card, twitter:title, twitter:description
- Replaces default <title> with enriched version
Frontend:
- Default og/twitter meta tags on homepage
- Path-based URLs (shared links) redirect to hash routes for SPA routing
Three recurring issues fixed together:
1. Ctrl+click: All protocol and collection pills now use <a href>
instead of <div onclick>, so ctrl/cmd+click opens in new tab.
text-decoration:none and color:inherit prevent link styling.
2. Consistent modules: Shared renderProtocolPill() and
renderCollectionPill() functions used everywhere — library,
collections list, collection detail, user profile. All produce
identical HTML with .protocol-grid wrapper for consistent spacing.
Profile collections no longer have .icon divs.
3. Header layout: Logo (32px) on left with crumb-text wrapper.
$ protocol-droid on first line, crumb path below it.
Favicon links and PWA manifest restored.
Relative paths (frontend/ not /frontend/) for subdirectory support.
Authoring page:
- 'Import YAML' button next to Save/Cancel on the create form
- Opens file picker for .yaml/.yml files
- Imports the YAML via API, then loads it into the form for editing
- Bad YAML is rejected by the API with an error message shown via toast
Admin profile (own profile page):
- 'Load Seed Protocols' button (loads 100 built-in seeds)
- 'Import YAML Files' button (multi-file picker)
- Bulk imports each file, reports count of imported vs failed
- Failed files are listed with error reasons in the toast
- Profile refreshes after import to show new protocols
Password change:
- 'Change Password' button on own profile for all users
- Modal with current/new/confirm password fields
- New API endpoint POST /api/auth/password
All imports validate format — incorrectly formatted files are
discarded and the user is informed which files failed and why.
Link tags for logo.svg, favicon.ico, icon-192.png, and manifest.json
were missing from the HTML head. Also fixed stylesheet path from
absolute (/frontend/) to relative (frontend/) for subdirectory support.
- Logo 32px to fill more of the header height
- Logo on left, text + crumb path stacked to its right (not below)
- .crumb-text wrapper keeps $ protocol-droid and path together
- Path aligns with the $ sign, not underneath the logo
- Logo (24px) sits to the LEFT of $ protocol-droid on the first line
- Crumb path wraps to second line below
- Both in a column layout via .crumb-main wrapper
- Logo is clearly visible at 24x24px
- Geometric Companion logo: rounded head, blue outline, green eyes,
green antenna tip. SVG for crisp rendering at any size.
- Logo appears in header next to site name
- PWA manifest (manifest.json) with 192px and 512px PNG icons
- Favicon (favicon.ico) for browser tab
- Apple touch icon for iOS home screen
- README: logo replacement instructions for whitelabeling
To replace the logo for whitelabeling, just swap frontend/logo.svg
and the icon PNGs. Update <link> tags in index.html if filename changes.
- Protocol and collection pills now use <a href> instead of <div onclick>,
so ctrl+click (or cmd+click) opens in a new tab, and middle-click works
- Applied consistently: library, collection detail, user profile
- After deleting a protocol or collection, currentRoute is reset so
navigation back to the list actually works
- Password change: when viewing your own profile, a 'Change Password'
button appears. Opens a modal requiring current password + new password
+ confirmation. New API endpoint POST /api/auth/password validates
the current password and updates the hash.
- Sort toggle now says 'most recent' instead of 'date added'
- Sort logic uses index position instead of text matching
- Detail pages show just the date without 'added' prefix
Rendering consistency:
- Create shared renderProtocolPill() and renderCollectionPill() functions
used everywhere: library, collection detail, user profile, picker
- All protocol/collection modules now look identical across all contexts
- Profile page collections and protocols use the same shared renderers
- Protocol grids wrapped in .protocol-grid for consistent spacing
New features:
- Footer with CC-BY 4.0 license link and Terms of Service link
- Terms of Service page stating admin reserves right to remove content
- CC-BY 4.0 default license for submitted content
Deployment:
- README now recommends git clone for initial deployment
- README documents git pull for updates without data loss
- All nav links use #protocols instead of #library
Bug fixes (from previous commits, re-applied to current codebase):
- Delete redirect: reset currentRoute guard so navigate works after delete
- #protocols routing instead of #library
- forked_from: null no longer shows as clickable link
- Source field suppressed when it duplicates author
- Collections say 'curated by' instead of 'authored by'
- Breadcrumb home click works from detail pages
- Search debounce and double-navigation guard
- Fix YAML fallback parser to properly handle folded scalars (>-) at
both top-level (description, outcome, practice) and step-level
(step descriptions). Previously stored '>-' as the literal value
instead of the folded text.
- Fix delete protocol/collection: reset currentRoute guard so
navigate('library') actually works after deletion.
- Change #library hash to #protocols throughout (routing, nav links,
breadcrumb shows 'protocols/' on the main page).
- Fix breadcrumb home click not working from detail pages (allow
re-navigation to library even if currentRoute matches).
- Fix forked_from: null showing as a clickable link — now suppressed
when value is null or the string 'null'.
- README: replace curl seed instructions with About page button,
add About page customization instructions for whitelabeling.
A tool for authoring, sharing, and curating social protocols.
Features:
- Protocol library with search, tag filtering, and sort by date/relevance
- Protocol authoring with structured fields (title, description, steps, outcome, practice, source, tags)
- Protocol forking with provenance tracking
- Collection creation with searchable protocol picker and ordering
- User accounts with roles (admin, member, viewer)
- YAML import/export for portability
- Self-hostable on LAMP/Cloudron, works in subdirectories
- Responsive design with hamburger menu on mobile
- About page
Security:
- CSRF protection via Origin/Referer validation
- Session regeneration on login/register
- Secure session cookie params (HttpOnly, SameSite, Secure)
- Visibility enforcement on private/unlisted items
- YAML object injection hardening
- Login rate limiting
- Path traversal protection
- Input validation and length clamping
- Vote value constraining
Stack: PHP 8.x + MySQL/MariaDB, vanilla JS frontend, no external dependencies.
Hippocratic License (HL3-CORE).
Protocolbot
ntnsndr