feat(tcfeed): add RSS feeds as a third source, kept as OPML - #118
Merged
Conversation
tcfeed rss add https://leaddev.com/feed tcfeed rss list tcfeed rss remove https://leaddev.com/feed Feed bodies are concatenated and handed to reposIn(), not parsed. That function already looks for repository links anywhere in a document, which is the only thing wanted from a feed, and it behaves the same on RSS, Atom and the HTML some of them serve by mistake - none of which a feed parser would agree about. github.blog alone contributed 16 repositories on the first run. OPML, at ~/.moshcode/feeds.opml, for one reason each. OPML because a feed list is the one thing here somebody already has somewhere else: every reader imports and exports it, so the list can arrive from one and leave for another without this becoming the only place it exists. Under ~/.moshcode because that is the directory moshcode's `/save` copies to the account. That server validates shape rather than filenames - no `..`, no leading slash, 32 files, 256KB - so it takes this without anything being deployed; only moshcode's own SYNCED_FILES has to name it, which is a separate change. Nothing here depends on moshcode being installed: the file is made on demand and TCFEED_OPML moves it anywhere. A feed that fails is named and skipped rather than counted. One dead blog must not be why a scan produced nothing, and "3 feeds failed" is a number to shrug at where the URL is something to go and fix. The summary line now names every source including the ones that contributed nothing, because a feed that has stopped mentioning repositories looks exactly like a feed nobody added until its zero is on the screen. Only http(s) is accepted. The list is fetched with curl, and a `file://` entry in an OPML that came from somewhere else would make a shared feed list read this machine's disk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan67 finding(s) HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1
…and 17 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feeds are not parsed
The bodies are concatenated and handed to
reposIn(). That function already looks for repository links anywhere in a document, which is the only thing wanted from a feed, and it behaves identically on RSS, Atom, and the HTML some of them serve by mistake — none of which a feed parser would agree about.github.blogalone contributed 16 repositories on the first run. (leaddev.comcontributed none — it is a valid feed that simply does not link repositories, and its zero shows on the summary line rather than being hidden.)OPML, at
~/.moshcode/feeds.opmlOne reason each:
~/.moshcodebecause that is the directory moshcode's/savecopies to the account.I checked the sync server rather than assuming: it validates shape, not filenames — no
.., no leading slash, ≤32 files, ≤256KB — so it acceptsfeeds.opmlwith nothing deployed. Only moshcode's own client-sideSYNCED_FILEShas to name it, which is a separate one-line change in that repo.Nothing here depends on moshcode being installed. The file is created on demand and
TCFEED_OPMLmoves it anywhere.Failure and safety
tcfeed: rss https://… (HTTP network). One dead blog must not be why a scan produced nothing, and "3 feeds failed" is a number to shrug at where the URL is something to go and fix.http(s)is accepted. The list is fetched with curl, and afile://entry in an OPML that came from somewhere else would make a shared feed list read this machine's disk.addtime. A feed that is down this minute is still a feed.Verified
tsc --strictclean, every path against live feeds:rss/rss listemptyrss add×2, one duplicateadded,already there, valid OPML on diskrss removerss listrss add file:///etc/passwd16 from 2 feeds, deduped across all three sources0 from 1 feed, run continues🤖 Generated with Claude Code