Add read-only raw access by davidlsneider · Pull Request #3 · davidlsneider/Vincent

davidlsneider · 2026-02-21T01:19:44Z

Summary

add read-only raw endpoints for authenticated pages scoped to union of API-key secrets
add read-only token model/service plus mint/list/revoke endpoints
enforce raw host isolation, GET-only access, rate limiting, audit logging, and response metadata
document requirements and add E2E coverage for raw access

Testing

not run (migration required)

Notes

Prisma migration required for ReadOnlyToken + ReadOnlyTokenSecret (not included in this PR)
Raw host isolation uses RAW_DOMAIN if set, otherwise hostnames starting with raw.

* Fix skill install links to point to agent-skills repo The "other agents" install commands were pointing to HeyVincent-ai/Vincent/{skill} but the skills are published to the agent-skills repo. Updated to use HeyVincent-ai/agent-skills/{skill} instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Update Discord invite link --------- Co-authored-by: David Sneider <davidsneider@Davids-MacBook-Pro-2.local> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

The "other agents" install commands were pointing to HeyVincent-ai/Vincent/{skill} but the skills are published to the agent-skills repo. Updated to use HeyVincent-ai/agent-skills/{skill} instead. Co-authored-by: David Sneider <davidsneider@Davids-MacBook-Pro-2.local> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Replaces placeholder Lit Protocol terms with Vincent-specific TOS structured as a cloud provider rental agreement. Key material sections modeled after Turnkey's non-custodial approach (encrypted keys on our infra, no raw key access, Policy Rules, Key Export/Import). Adds AI agent risk disclosures, rental fee structure, and service tier provisions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Chris Axolotl Bot <chris@litprotocol.com>

Feature/terms rewrite

* Add scheduled Sentry triage automation and summaries * Switch Sentry automation from GitHub Actions to local cron * Load local env file for cron triage runner --------- Co-authored-by: Chris Axolotl Bot <chris@litprotocol.com>

* fix tests, add CI * fix ci * lint fixes * eslint config * fix test file linting

* take ownership plan * self custody ready for testing * skill update * published * take ownership improvements * walletconnect, fix typo * walletconnect almost working * yay self custody for evm wallets works * fix address passing * self custody actually works * frontend env cleanup * fix race condition * Remove if statement if zerodev env var not provided * ternary expression fix * Take ownership stores challenge in db * update docs * sig validation * update plans * Test written * fix issue with legacy wallets * min for zerodev api key * Update src/services/ownership.service.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * eslint fix * npm i --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Add phase 3 Sentry noise filtering for actionable alerts * Add draft fix-attempt PR automation for safe Sentry candidates --------- Co-authored-by: Chris Axolotl Bot <chris@litprotocol.com> Co-authored-by: Chris Cassano <1285652+glitch003@users.noreply.github.com>

* track chains transferred * Remove unrelated CSP changes from this PR The CSP updates were unrelated to chains-transferred tracking and were accidentally included. They belong in a separate PR. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* basic plan * new plan * phases 1 through 3 mostly done * datasources and preinstall * empty commit * data source credit fix * fix ci * add skills

* speed up railway build * trying dockerfile * try again * try again * vite env vars * non root fix

* api docs * copilot fixes

* Initial plan * Add POLYMARKET_WALLET option to create secret dropdown Co-authored-by: glitch003 <1285652+glitch003@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: glitch003 <1285652+glitch003@users.noreply.github.com>

* better docs * docs link

* some phases completed * Add all skill tests and fix agent harness for AI SDK v6 - Fix model ID (google/gemini-2.5-flash, not -preview) - Fix body double-serialization in http_request tool - Use AI SDK v6 API (stopWhen/stepCountIs, inputSchema, staticToolCalls) - Add brave-search, twitter, polymarket tests - All 4 tests pass against production (~15s total) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* faster builds * another fix * fix * coilot fix

* Add Stytch auth flow for data source tests Brave-search and twitter tests now create a properly claimed DATA_SOURCES secret via Stytch sandbox magic link auth before running the agent, so they verify real search results (200 + data) instead of accepting 403/402 errors. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Address copilot review feedback on skill CI tests - Add explicit null check for claim URL token instead of non-null assertion - Document the Stytch sandbox magic link token with reference link - Add afterAll cleanup to delete test secrets in both twitter and brave-search tests - Export deleteSecret helper from auth module Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* Add Stytch auth flow for data source tests Brave-search and twitter tests now create a properly claimed DATA_SOURCES secret via Stytch sandbox magic link auth before running the agent, so they verify real search results (200 + data) instead of accepting 403/402 errors. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Address copilot review feedback on skill CI tests - Add explicit null check for claim URL token instead of non-null assertion - Document the Stytch sandbox magic link token with reference link - Add afterAll cleanup to delete test secrets in both twitter and brave-search tests - Export deleteSecret helper from auth module Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * script to run manually --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* claude autoreview * comment fix * address feedback

davidlsneider · 2026-02-21T01:20:56Z

Closing in favor of upstream PR: https://github.com/HeyVincent-ai/Vincent/pull/91

davidlsneider and others added 30 commits February 11, 2026 15:25

stripe credit add fix

00430b3

polymarket insta deploy

33ef474

removed unused old method

dd6b4c2

backfill script

7b9cc70

backfill fix

c7ba95e

better credits fix (#22)

80ea0d1

fix provision issue

d2aeb27

checking more vps plans

6c1510e

fix vps ordering to look for more plans

0f02271

race condition on vps delivery

9a6e2ec

cleaner vps ordering

b899f7e

Add Sentry triage reporting script (#31)

137562c

Co-authored-by: Chris Axolotl Bot <chris@litprotocol.com>

Merge pull request #29 from davidlsneider/feature/terms-rewrite

7ce6d35

Feature/terms rewrite

Add scheduled Sentry triage automation pipeline (#32)

f39c82c

* Add scheduled Sentry triage automation and summaries * Switch Sentry automation from GitHub Actions to local cron * Load local env file for cron triage runner --------- Co-authored-by: Chris Axolotl Bot <chris@litprotocol.com>

fix tests, add CI (#30)

693e124

* fix tests, add CI * fix ci * lint fixes * eslint config * fix test file linting

csp fix

37ea357

fix csp again

b36fd76

fix csp

5ea016a

Fix triage query to include unresolved backlog by default (#35)

72cdb52

Add data sources and passthrough billing (#18)

d3b3bbf

* basic plan * new plan * phases 1 through 3 mostly done * datasources and preinstall * empty commit * data source credit fix * fix ci * add skills

speed up railway build (#43)

a376d17

* speed up railway build * trying dockerfile * try again * try again * vite env vars * non root fix

api docs (#44)

6ce5c2a

* api docs * copilot fixes

fix docker build with openapi

6711d31

glitch003 and others added 17 commits February 15, 2026 13:00

only put api key secret type

1ad384b

better docs (#53)

a3f0756

* better docs * docs link

faster builds (#55)

4f7a989

* faster builds * another fix * fix * coilot fix

publish new skills

59a244d

claude autoreview (#60)

47308c9

* claude autoreview * comment fix * address feedback

claude autofix

43a0dc5

fix token scope

13a91dc

show full output

1737f65

api key fix

4e3790a

full output off for security reasons

7652832

Fix asset totals using priced token balances

31f32f3

Document Alchemy network chunk limit

3ce2861

Fix OpenClaw dashboard health and COOP headers

9a3fb93

Add read-only raw access

67efaa4

davidlsneider closed this Feb 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add read-only raw access#3

Add read-only raw access#3
davidlsneider wants to merge 47 commits intomainfrom
codex/raw-readonly

davidlsneider commented Feb 21, 2026

Uh oh!

davidlsneider commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

davidlsneider commented Feb 21, 2026

Summary

Testing

Notes

Uh oh!

davidlsneider commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants