adminandClaude Opus 5.5
48ec722660
Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
# Runs the whole proof on the Gitea runner: gate, the editor suite and the three example games.
|
||
#
|
||
# The suite runs on `feuerwerk-wsl`, the runner in the WSL2 distro feuerwerk-ci on
|
||
# melektaus-atx (#283). Its label picks the image built from tools/ci/Dockerfile. The GPU
|
||
# (/dev/dxg and the Windows driver libraries), /dev/shm and FEUERWERK_BROWSER=wsl come from that
|
||
# runner's own config.yaml, not from here – without them chromium falls back to software WebGL and
|
||
# the harness stops. The gate needs no GPU and runs on `feuerwerk-ci`, the runner on stein2 with
|
||
# the same image. Pointing the suite at that label too moves the browser runs back to stein2.
|
||
#
|
||
# Two jobs without `needs:`, so they start together. The gate does not stand in front of the
|
||
# suite: a lint error used to cost the full e2e run before it was reported, and the run reported
|
||
# it after six minutes instead of one. Both still have to pass for the push to be green.
|
||
#
|
||
# On two runners the gate's vitest no longer shares cores with the suite's chromium, which
|
||
# measures text widths and frame counts. GM_TEST_WORKERS still caps vitest at two workers, for the
|
||
# day both jobs share one runner again.
|
||
name: feuerwerk
|
||
|
||
on:
|
||
push:
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
gate:
|
||
runs-on: feuerwerk-ci
|
||
timeout-minutes: 20
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Install
|
||
run: npm ci --no-audit --no-fund
|
||
|
||
- name: Gate
|
||
run: ./check.sh
|
||
env:
|
||
GM_TEST_WORKERS: 2
|
||
|
||
# The API's own rules (#180, #179, #231, #266, #427, #429). Not part of check.sh: the host the
|
||
# editor is built on has no PHP, the image does. rights.test.php runs the API itself under
|
||
# `php -S`.
|
||
- name: PHP tests
|
||
run: |
|
||
php tests/php/accounts.test.php
|
||
php tests/php/snapshots.test.php
|
||
php tests/php/releases.test.php
|
||
php tests/php/files.test.php
|
||
php tests/php/videos.test.php
|
||
php tests/php/limits.test.php
|
||
php tests/php/demos.test.php
|
||
php tests/php/agents.test.php
|
||
php tests/php/rights.test.php
|
||
|
||
suite:
|
||
runs-on: feuerwerk-wsl
|
||
timeout-minutes: 45
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Versions
|
||
run: |
|
||
node --version
|
||
chromium --version
|
||
php --version | head -1
|
||
|
||
- name: Install
|
||
run: npm ci --no-audit --no-fund
|
||
|
||
- name: Build
|
||
run: npm run build
|
||
|
||
- name: Editor suite
|
||
run: tools/ci/run-e2e.sh
|
||
|
||
- name: Example games
|
||
run: tools/ci/run-smokes.sh
|