mirror of https://github.com/tinyhumansai/openhuman.git synced 2026-07-28 13:32:23 +00:00

Files

T

* feat: add initial project structure and documentation

- Introduced the GNU General Public License (GPL) v3 in LICENSE file.
- Added MCP configuration in .claude/mcp.json for server integration.
- Created architecture documentation in docs/ARCHITECTURE.md outlining the platform's design and components.
- Defined MVP specifications in docs/MVP.md for the Telegram-based Agent Assistant.
- Established API reference for team management in docs/teams-api-reference.md.
- Set up basic HTML structure in public/index.html and added logo image in public/logo.png.

* feat: add initial project documentation and HTML structure

- Introduced CODE_OF_CONDUCT.md to establish community guidelines and standards for behavior.
- Created CONTRIBUTING.md to outline contribution process, development setup, and project conventions.
- Added SECURITY.md to define the security policy, supported versions, and reporting procedures for vulnerabilities.
- Established basic HTML structure in index.html for the application interface.

* chore: remove hello-python skill files

- Deleted skill.json and skill.py files for the Hello Python example runtime skill, as they are no longer needed in the project.

* feat: port tinyhuman agent runtime from ZeroClaw into Tauri backend

Port daemon supervisor, health registry, security (policy, secrets, audit,
pairing), agent traits, and config modules from ZeroClaw (MIT) into a new
tinyhuman/ module under src-tauri/src/. The daemon auto-starts on desktop
and shuts down gracefully on app exit via CancellationToken.

- health: global HealthRegistry with component tracking and JSON snapshots
- security/policy: SecurityPolicy with command validation, risk levels, rate limiting
- security/secrets: ChaCha20-Poly1305 SecretStore with legacy XOR migration
- security/audit: AuditLogger with JSON-line events and log rotation
- security/pairing: PairingGuard with brute-force protection and SHA-256 hashing
- security/traits: Sandbox trait + NoopSandbox
- config: minimal DaemonConfig with autonomy, reliability, secrets, audit sub-configs
- daemon: supervisor with health state writer emitting Tauri events
- agent/traits: Provider, Tool, Memory, Observer, RuntimeAdapter traits + Noop impls
- commands/tinyhuman: Tauri commands for health, security policy, encrypt/decrypt
- 185 inline unit tests across all modules
- README updated with custom inference/tunneling/memory positioning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: update README to reflect AlphaHuman Mk1 branding and enhanced description

- Changed project title to "AlphaHuman Mk1" for clarity.
- Revised project description to emphasize user-friendly AI capabilities and the use of the Neocortex Mk1 model.
- Removed outdated sections on custom inference, tunneling, and memory, streamlining the content for better readability.

* update readme

* Port zeroclaw runtime into tinyhuman

* Replace CLI mentions with UI language

* Split gateway module into smaller units

* Split channels and config schema modules

* Fix tinyhuman build, tests, and tunnel integration

* feat(tinyhuman): add missing modules and ui-friendly services

* refactor: rename tinyhuman to alphahuman

* chore: remove bottom text from Welcome component

* feat(settings): add tauri command console

* feat(daemon): enhance daemon mode handling and integrate rustls with ring feature

* feat(settings): implement comprehensive configuration management in TauriCommandsPanel

* refactor(TauriCommandsPanel): streamline error handling and enhance async function usage

* feat(settings): add skill management functionality to TauriCommandsPanel

* style(TauriCommandsPanel): update input styles for improved readability and user experience

* feat(settings): add Skills and Agent Chat panels with navigation and integration management

* feat(settings): implement browser access management in SkillsPanel and enhance AgentChatPanel with local storage functionality

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-20 13:03:15 +04:00

2.6 KiB

Raw Blame History

Security Policy

Supported Versions

We provide security updates for the following versions of AlphaHuman:

Version	Supported
Latest	✅
Previous minor	✅
Older	❌

We recommend always running the latest release. AlphaHuman is in early beta; older versions may not receive patches.

Reporting a Vulnerability

We take security seriously. If you believe you have found a security vulnerability, please report it responsibly.

How to Report

Do not open a public GitHub issue for security vulnerabilities.
Email the maintainers with a clear description of the issue, steps to reproduce, and impact. You can reach us via the contact details listed in the AlphaHuman organization or repository.
Include as much detail as possible (platform, version, configuration) so we can reproduce and triage quickly.

What to Expect

We will acknowledge your report as soon as possible (typically within 5 business days).
We will keep you updated on our assessment and any fix or mitigation.
We will credit you in our security advisories and release notes (unless you prefer to remain anonymous).

Scope

We are especially interested in:

Authentication or authorization bypass
Data exfiltration or exposure (credentials, messages, user data)
Remote code execution (frontend, Tauri/Rust backend, or skills runtime)
Issues in dependency chain (npm, Cargo) that affect our build or runtime
Platform-specific issues (macOS, Windows, Linux, Android, iOS) that compromise user data or device security

Out-of-scope for this process: general bugs, feature requests, and issues in third-party services we integrate with (e.g., Telegram, Notion) unless they are specific to how AlphaHuman uses them.

Safe Harbor

We support safe harbor for security researchers who report in good faith. We will not pursue legal action or involve law enforcement against you for discovering or reporting vulnerabilities in accordance with this policy.

Security Practices

Credentials: Desktop uses OS-level credential storage (e.g., macOS Keychain, Windows Credential Manager). We do not store secrets in plain text.
Data: Message content is processed on request and not retained for training or long-term storage.
Skills: Skills run in a sandboxed environment with defined boundaries; we review skill behavior and dependencies where possible.

Thank you for helping keep AlphaHuman and its users safe.

2.6 KiB Raw Blame History