3 Commits

Include renames

Author	SHA1	Message	Date
adminandClaude Opus 5.5	48ec722660	Let an AI agent see the open editor through MCP (#429) ... Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-18 10:39:34 +02:00
adminandClaude Opus 5.5	925a39a276	Let guests try a demo project without an account (#428) ... The editor was only open to somebody with an account. A guest now picks a demo project on the sign-in screen and gets the whole editor on a copy held in the tab. The server writes nothing for a guest, so there is no guest session, no guest folder and no quota to keep. - Demo copies are frozen copies like a release, in data/demos/. An administrator makes, updates and removes one with "Demo copy..." in the project's main menu. GET demos and GET demos/{token} need no session. An empty project is just a demo that is empty. - Demo material: an administrator offers an uploaded file with "Offer as demo" in the pickers (PATCH {demo}, data/demo-files.json). Every list carries it with demo: true, for accounts and guests alike. Signed out, a list holds the demo material alone, without the owner. - An offered file is only an administrator's to delete. A file a demo copy names counts as used, like one a release names. - The guest's project lives in MemoryProjectStore. Every store that would write refuses in the tab before a request is made, and the autosave is not attached at all. - The main menu drops projects, snapshots and release for a guest. The pickers drop Upload and Delete, a dropped or pasted file is refused, and a recording is saved as a download. - The toolbar says the work is not saved. The Account menu holds "Sign in..." instead of Logout and the password. - A guest's demo never goes into the address: a reload brings the sign-in screen back, not the copy. Found by e2e 70. - GET plugins needs no session any more, since a demo may switch one on. It only reads the server's own modules. Tests: - e2e 70 (atx): ALL PASSED, 13 checks. Counter-test with the guest autosave sent to the server: 70f and 70g red on the PUT. - tests/core/guest.test.ts: 9 tests. PHP: demos 20, files 46, rights 80 checks (the matrix asks every new route). - Gate (atx): CHECK EXIT 0, 314 files, 4852 tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 06:58:30 +02:00
adminandClaude Opus 5.5	cfd6d7a8df	Lock the server down before the editor goes public (#427) ... The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 23:05:32 +02:00