.github/workflows/release.yml runs on Gitea and on the GitHub mirror (release: published only)
and pushes selfphoneng-api and selfphoneng-asterisk to that forge's registry: ghcr.io with the
job token, the Gitea registry with secrets REGISTRY_USER + REGISTRY_TOKEN (Gitea's job token
can't push packages). Tags: the version, plus <major>.<minor> and latest unless it's a
pre-release. It stops unless the tag is v + package.json's version, and checks the images
before pushing.
Run locally with act_runner exec against a throwaway registry: v0.0.1 pushed 0.0.1, 0.0 and
latest for both images (VERSION 0.0.1, OCI labels, source archive selfphoneng-0.0.1/);
v9.9.9 failed at the version check.
Version 0.0.1 in all package.json files, CHANGELOG.md started, release steps in 08 §3.1.
Task: none (owner request, 2026-10-20)
The 08 §1 threat table checked line by line against the code, plus a review by a separate agent
that hadn't written it. Findings were reproduced with a failing test before each fix:
- Critical: "011…,4" turned the route's Goto into Goto(sp-route-…,011…,4,1), starting past the
class check, so any extension could call abroad. FILTER on the dialed number (also stops "&"
adding a Dial target). trunk-test.ts proves it.
- High: -web endpoints (desk phone's password, any transport) skipped the phone ACL; now
127.0.0.1 only when it's on. call-test.ts: UDP refused, WebSocket from 127.0.0.1 registers.
- IVR direct dial no longer reaches paging groups or parked calls (sp-ivr-direct).
- Trunks identify_by = ip: a From of trunk-<id> from anywhere no longer rings phones.
- .dockerignore is an allowlist, so the public source archive can't pick up stray files.
- CSRF check on the matched route (/%61pi/… got around it); Linphone tokens masked in logs;
/api/live checks Origin and re-checks the session; *45/** filter digits; pg_dump password in
the environment; more webhook ranges blocked.
The review and what's left for the owner are in 08 §6.
Task: M11-T8
System page laid out after 3CX's admin dashboard: a System information panel (version,
host name, company, public IP, LAN IPs, ports, telephony, restart needed, copy buttons,
how to restart) and an Event log panel (system_events, 90 days: trunk down/up, Asterisk
down/up, restart needed, config failed, 911, public IP changed, backups, disk) with Load
more and a CSV download.
About (/about, no sign-in, linked from the login page, My phone and System): AGPL-3.0
notice, credits, the repository link, and "Code v<version>", which downloads
selfphone.tar.gz: the api image now tars its own build context (no .env, data,
node_modules, build output or .git) before installing anything.
Task: M11-T7
iamdoubz