- Logo 32px to fill more of the header height
- Logo on left, text + crumb path stacked to its right (not below)
- .crumb-text wrapper keeps $ protocol-droid and path together
- Path aligns with the $ sign, not underneath the logo
- Logo (24px) sits to the LEFT of $ protocol-droid on the first line
- Crumb path wraps to second line below
- Both in a column layout via .crumb-main wrapper
- Logo is clearly visible at 24x24px
- Smaller head, removed mouth grill, bigger cuter eyes with green centers
- Compact viewBox (100x100) with no empty space below shoulders
- Logo sized 18x22px in header — fits within the bar without resizing it
- Regenerated all PWA icons (192, 512) and favicon
- Geometric Companion logo: rounded head, blue outline, green eyes,
green antenna tip. SVG for crisp rendering at any size.
- Logo appears in header next to site name
- PWA manifest (manifest.json) with 192px and 512px PNG icons
- Favicon (favicon.ico) for browser tab
- Apple touch icon for iOS home screen
- README: logo replacement instructions for whitelabeling
To replace the logo for whitelabeling, just swap frontend/logo.svg
and the icon PNGs. Update <link> tags in index.html if filename changes.
The isRouting flag prevents showDetail, showCollectionDetail,
showUser, and navigate from setting location.hash when called
from route() (triggered by back button hashchange). This was
creating duplicate history entries that trapped the user.
Also fixed: init() re-route check now uses #protocols not #library,
and removed duplicate location.hash = 'about' in navigate().
- Removed white-space:nowrap from .meta so source text wraps
- Kept max-width:140px so description still gets the majority of space
- Steps count stays on one line (nowrap only on .steps)
- .info now uses flex: 1 1 auto (grows to fill available space)
- .meta constrained to max-width: 120px with ellipsis truncation
- Long source text no longer squeezes the description — description
takes the majority of the width, source is truncated if too long
- 'Load Seed Protocols' button now appears on the admin's own profile
page instead of the About page. Can be repeated to re-import seeds.
- After loading, the profile refreshes to show updated protocol list.
- 'Change Password' button also appears on own profile page for all
users (not just admin), opening a modal with current/new/confirm fields.
- Password modal added to HTML.
- README updated: seed loading instructions point to profile page,
mentions 100 protocols, notes repeat seeding is supported.
When the back button triggers hashchange -> route(), the isRouting
flag prevents navigate() and showDetail() from re-setting location.hash,
which was creating duplicate history entries and trapping the user.
Now the back button properly traverses history.
- Add text-decoration:none and color:inherit to .protocol-pill so
<a> tags don't show underlines or link colors
- Guard hash setting in showDetail/showCollectionDetail/showUser:
only set location.hash if it's not already the target, preventing
the redundant hashchange that was breaking the back button
- Protocol and collection pills now use <a href> instead of <div onclick>,
so ctrl+click (or cmd+click) opens in a new tab, and middle-click works
- Applied consistently: library, collection detail, user profile
- After deleting a protocol or collection, currentRoute is reset so
navigation back to the list actually works
- Password change: when viewing your own profile, a 'Change Password'
button appears. Opens a modal requiring current password + new password
+ confirmation. New API endpoint POST /api/auth/password validates
the current password and updates the hash.
All 100 seed YAML files now have:
- Filenames that match their id field
- IDs that are slugs of their titles
- No cultural identifiers in titles or IDs
70 files renamed. e.g. quaker-meeting-for-worship.yaml -> meeting-for-worship.yaml,
moroccan-jmaa-village.yaml -> jmaa-village-assembly.yaml,
japanese-hansei.yaml -> hansei-reflection.yaml
Cultural context remains in descriptions. Titles now uniformly use the
practice name without prefixing the culture, country, religion, or people.
e.g. 'Quaker Meeting for Worship' -> 'Meeting for Worship',
'Moroccan Jmaa Village Assembly' -> 'Jmaa Village Assembly',
'Aboriginal Yarning Circle' -> 'Yarning Circle'.
43 titles updated across the seed library.
Covers: site name/tagline (config.yaml), About page editing,
Terms of Service editing, footer customization, CSS theme variables,
and navigation links.
- Sort toggle now says 'most recent' instead of 'date added'
- Sort logic uses index position instead of text matching
- Detail pages show just the date without 'added' prefix
Rendering consistency:
- Create shared renderProtocolPill() and renderCollectionPill() functions
used everywhere: library, collection detail, user profile, picker
- All protocol/collection modules now look identical across all contexts
- Profile page collections and protocols use the same shared renderers
- Protocol grids wrapped in .protocol-grid for consistent spacing
New features:
- Footer with CC-BY 4.0 license link and Terms of Service link
- Terms of Service page stating admin reserves right to remove content
- CC-BY 4.0 default license for submitted content
Deployment:
- README now recommends git clone for initial deployment
- README documents git pull for updates without data loss
- All nav links use #protocols instead of #library
Bug fixes (from previous commits, re-applied to current codebase):
- Delete redirect: reset currentRoute guard so navigate works after delete
- #protocols routing instead of #library
- forked_from: null no longer shows as clickable link
- Source field suppressed when it duplicates author
- Collections say 'curated by' instead of 'authored by'
- Breadcrumb home click works from detail pages
- Search debounce and double-navigation guard
- When source equals @username (same as the author), don't show SOURCE line
- When source is empty, don't show a leading · separator before 'authored by'
- Collections say 'curated by' instead of 'authored by'
- Fix YAML fallback parser to properly handle folded scalars (>-) at
both top-level (description, outcome, practice) and step-level
(step descriptions). Previously stored '>-' as the literal value
instead of the folded text.
- Fix delete protocol/collection: reset currentRoute guard so
navigate('library') actually works after deletion.
- Change #library hash to #protocols throughout (routing, nav links,
breadcrumb shows 'protocols/' on the main page).
- Fix breadcrumb home click not working from detail pages (allow
re-navigation to library even if currentRoute matches).
- Fix forked_from: null showing as a clickable link — now suppressed
when value is null or the string 'null'.
- README: replace curl seed instructions with About page button,
add About page customization instructions for whitelabeling.
The API router's parse_path() only stripped /api from the URI, but
when deployed in a subdirectory (e.g. /protocol-droid/), the URI is
/protocol-droid/api/auth/register — the /api regex didn't match.
Now detects base path from SCRIPT_NAME and strips it before routing.
- Rewrite db.php to use SQLite via PDO (no external DB server needed)
- Rewrite schema.sql for SQLite (AUTOINCREMENT, CHECK constraints,
triggers for updated_at, ON CONFLICT instead of ON DUPLICATE KEY)
- Fix config.php upsert to use ON CONFLICT syntax
- Fix index.php: tag filter via json_each, vote upsert via ON CONFLICT,
and fix protocol create route (was returning 405 for POST /api/protocols)
- Fix yaml.php seed import: replace invalid false callbacks with fn() => null,
fix yaml_parse pos argument (-1 -> 0)
- Update Dockerfile: drop pdo_mysql/mysqli (pdo_sqlite is built in)
- Update CloudronManifest.json: remove mysql addon, bump to v0.3.0
- Update README for SQLite deployment
index.html uses absolute /frontend/ paths for CSS and JS, and app.js
hardcoded const API = '/api'. In subdirectory deployments these resolve
to the wrong URL, causing unstyled HTML and broken API calls.
- index.php: rewrite /frontend/ references in index.html with detected basePath
- app.js: derive BASE_PATH from the script's own URL and prefix API calls
A tool for authoring, sharing, and curating social protocols.
Features:
- Protocol library with search, tag filtering, and sort by date/relevance
- Protocol authoring with structured fields (title, description, steps, outcome, practice, source, tags)
- Protocol forking with provenance tracking
- Collection creation with searchable protocol picker and ordering
- User accounts with roles (admin, member, viewer)
- YAML import/export for portability
- Self-hostable on LAMP/Cloudron, works in subdirectories
- Responsive design with hamburger menu on mobile
- About page
Security:
- CSRF protection via Origin/Referer validation
- Session regeneration on login/register
- Secure session cookie params (HttpOnly, SameSite, Secure)
- Visibility enforcement on private/unlisted items
- YAML object injection hardening
- Login rate limiting
- Path traversal protection
- Input validation and length clamping
- Vote value constraining
Stack: PHP 8.x + MySQL/MariaDB, vanilla JS frontend, no external dependencies.
Hippocratic License (HL3-CORE).
Protocolbot