adminandClaude Opus 5.5
48ec722660
Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
89 lines
3.9 KiB
Bash
89 lines
3.9 KiB
Bash
#!/bin/bash
|
||
# Sourced, not run: it leaves the PHP server in the caller's background and exports
|
||
# FEUERWERK_BASE_URL, which every tool reads.
|
||
#
|
||
# The checkout is served under /feuerwerk/ like on stein2 – hence the symlink into /srv rather
|
||
# than `-t .`.
|
||
|
||
export FEUERWERK_BASE_URL=http://127.0.0.1:8080/feuerwerk/
|
||
# The MCP relay (#429) in front of the same server, so the editor's tab reaches it on its own
|
||
# origin as it does behind nginx on stein2. Only step 71 opens the editor there.
|
||
export FEUERWERK_MCP_BASE_URL=http://127.0.0.1:8081/feuerwerk/
|
||
|
||
feuerwerk_serve() {
|
||
local root
|
||
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
|
||
|
||
mkdir -p "$root/data/projects" "$root/data/textures"
|
||
node "$root/tools/ci/project-shells.mjs"
|
||
# The sign-in checks type wrong passwords on purpose, and every request here comes from one
|
||
# address: two runs within 15 minutes would lock the second one out (#427).
|
||
rm -rf "$root/data/sign-ins"
|
||
|
||
# Since #177 the API needs a session, and the check tools sign in as `e2e`. A fresh checkout has
|
||
# no accounts at all, so the job makes the one it needs, with a password of its own.
|
||
if [ ! -f "$root/data/e2e-password.txt" ]; then
|
||
head -c 24 /dev/urandom | base64 | tr -d '\n' >"$root/data/e2e-password.txt"
|
||
echo >>"$root/data/e2e-password.txt"
|
||
fi
|
||
php "$root/tools/make-user.php" e2e "$(cat "$root/data/e2e-password.txt")"
|
||
# The user management step (#179) needs an administrator of its own; it owns no project.
|
||
if [ ! -f "$root/data/e2e-admin-password.txt" ]; then
|
||
head -c 24 /dev/urandom | base64 | tr -d '\n' >"$root/data/e2e-admin-password.txt"
|
||
echo >>"$root/data/e2e-admin-password.txt"
|
||
fi
|
||
php "$root/tools/make-user.php" e2e-admin "$(cat "$root/data/e2e-admin-password.txt")" admin
|
||
# The key the relay asks the API with.
|
||
if [ ! -f "$root/data/mcp-relay.key" ]; then
|
||
head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' >"$root/data/mcp-relay.key"
|
||
echo >>"$root/data/mcp-relay.key"
|
||
fi
|
||
|
||
# A server from an earlier step of the same job is fine to keep. Asked of the one route that
|
||
# answers without a session, so "is it up" does not depend on being signed in.
|
||
if curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
|
||
echo "server already up at $FEUERWERK_BASE_URL"
|
||
feuerwerk_relay "$root"
|
||
return 0
|
||
fi
|
||
|
||
mkdir -p /srv && ln -sfn "$root" /srv/feuerwerk
|
||
# Uploaded videos are converted by the worker (#402); on stein2 that is the container
|
||
# feuerwerk-video, here a process beside the server.
|
||
php "$root/tools/video-worker.php" "$root/data" >/tmp/video-worker.log 2>&1 &
|
||
# Without workers the single-threaded dev server stalls: the editor fetches project and
|
||
# textures in parallel. The router serves videos with Range requests, see there.
|
||
PHP_CLI_SERVER_WORKERS=8 php -S 0.0.0.0:8080 -t /srv "$root/tools/ci/router.php" >/tmp/php-server.log 2>&1 &
|
||
|
||
for _ in $(seq 60); do
|
||
curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1 && break
|
||
sleep 0.5
|
||
done
|
||
if ! curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
|
||
echo "the server never came up" >&2
|
||
tail -20 /tmp/php-server.log >&2
|
||
return 1
|
||
fi
|
||
echo "serving $root at $FEUERWERK_BASE_URL"
|
||
feuerwerk_relay "$root"
|
||
}
|
||
|
||
# Starts the relay unless it answers already: without a token it says 401.
|
||
feuerwerk_relay() {
|
||
local root=$1
|
||
local mcp="${FEUERWERK_MCP_BASE_URL}mcp"
|
||
[ "$(curl -s -o /dev/null -w '%{http_code}' -X POST "$mcp")" = 401 ] && return 0
|
||
FEUERWERK_MCP_API="${FEUERWERK_BASE_URL}api/index.php" \
|
||
FEUERWERK_MCP_ORIGINS=http://127.0.0.1:8081 \
|
||
FEUERWERK_MCP_HOST=127.0.0.1 FEUERWERK_MCP_PORT=8081 \
|
||
FEUERWERK_MCP_BACKEND=http://127.0.0.1:8080 \
|
||
node "$root/tools/mcp/serve.mjs" >/tmp/mcp-relay.log 2>&1 &
|
||
for _ in $(seq 40); do
|
||
[ "$(curl -s -o /dev/null -w '%{http_code}' -X POST "$mcp")" = 401 ] && return 0
|
||
sleep 0.25
|
||
done
|
||
echo "the MCP relay never came up" >&2
|
||
tail -20 /tmp/mcp-relay.log >&2
|
||
return 1
|
||
}
|