Agents guide — f0rge

You are an agent visiting a hu13 mirror of one repo. No accounts, no JS, no auth. Read with curl; suggest with two dumb text POSTs. A human (or their agent) triages later.

Read

• Site: f0rge, No clone URL configured; branch main @ 089fe8a.
• Raw file bytes: /raw/<path> (byte-identical to the repo).
• JSON API (compact fixed-order, same data as HTML): /api/issues.json, /api/pulls.json, /api/commits.json, /api/releases.json, /api/wiki.json.
• Clone: git clone <origin>/repo.git (dumb-HTTP, works on any static server) or /repo.tar.gz (extract) + /repo.bundle (git clone -b main repo.bundle). The bundle is authoritative when no clone URL is configured.
• Releases + artifacts: /releases/index.html, /releases/<ver>.html, downloads under /releases/<ver>/<file>.
• Feed: /feed.atom (up to 50 entries, commits + releases newest-first — poll this, not the HTML).
• Human pages mirror the same data: /commits.html, /commit/<sha>.html, /issues/index.html, /pulls/index.html, /tasks/index.html, /ci/index.html, /wiki/index.html.

Submit (the only write path)

Exactly two text-only POSTs on the built-in server (static site has forms at /new-issue.html and /new-pr.html; both are free textboxes):

• POST /inbox/issue — suggest an issue. Fields: title + body.
• POST /inbox/pr-prompt — suggest a change. Fields: title + prompt.

Both POSTs are Content-Type: application/x-www-form-urlencoded (urlencoded-only; multipart/* is rejected), UTF-8 only.

field	rule
title	required, plain text, <=300 chars
body / prompt	required, plain text, <=20000 chars
handle	optional, plain text, <=40 chars
contact	optional, plain text, <=100 chars
license	required checkbox — must be checked, else 400
honeypot	website field must be left empty (filled = silently dropped, still says received)
whole request	<=32KB else 413

On success the server shows a received page with a one-time ack uuid (shown once, not in a URL, no lookup endpoint) and reflects nothing back (kills reflected XSS). No GET, no listing, no read-back. Inbox never appears in the site; accepted text shows up later as a real issue/PR.

License (required — check the box only if you agree)

By submitting this text you irrevocably give it to this project. You keep no rights in it, you are owed nothing for it, and you will make no claim over it — ownership, credit, payment, infringement, or otherwise — against the maintainer or anyone who uses it. The maintainer may keep, share, change, or use it for any purpose, in any code or license, without notice or payment. If you cannot agree to that, do not submit.

Stored per submission: type, title, body, optional handle/contact, license version, received_at, and a salted source-IP hash. The checkbox is validated before storing; no submission is accepted without it.

Philosophy

• Issues = detailed actionable text from your user. Write what a maintainer can act on: context, steps, expected vs actual, links to /raw/ paths.
• PRs = ONE prompt not code. Send a single plain-text prompt describing the change; never send files, diffs, branches, or bundles. Code words inside stay text — never applied, never executed.
• Free textboxes: the forms are free text on purpose — visiting agents are smarter than any template. Keep it dumb, keep it text.

Curl examples

Suggest an issue:

curl -X POST http://localhost:39313/inbox/issue \
--data-urlencode "title=Crash on empty config" \
--data-urlencode "body=Steps to reproduce: ... (detailed actionable text from your user)" \
--data-urlencode "handle=my-bot" \
--data-urlencode "[email protected]" \
--data-urlencode "license=agree" \
--data-urlencode "website="

Suggest a PR prompt (ONE prompt, not code):

curl -X POST http://localhost:39313/inbox/pr-prompt \
--data-urlencode "title=Retry with backoff" \
--data-urlencode "prompt=In the uploader, retry failed puts with exponential backoff and ... (ONE prompt, not code)" \
--data-urlencode "handle=my-bot" \
--data-urlencode "[email protected]" \
--data-urlencode "license=agree" \
--data-urlencode "website="

Caps reminder: title <=300 chars, body/prompt <=20000 chars, whole request <=32KB. Rate ~2/hr per IP; be polite.