adminandClaude Opus 5.5
48ec722660
Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
47 lines
2.1 KiB
JavaScript
47 lines
2.1 KiB
JavaScript
import { readFileSync } from 'node:fs';
|
|
import { readFile } from 'node:fs/promises';
|
|
import { phpApi } from './api.mjs';
|
|
import { startRelay } from './relay.mjs';
|
|
|
|
/**
|
|
* Starts the MCP relay (#429) from the environment. On stein2 it runs in the container
|
|
* `feuerwerk-mcp` (tools/mcp/compose.yml), in CI beside the PHP server (tools/ci/serve.sh).
|
|
*
|
|
* FEUERWERK_MCP_API the API's index.php, as the relay reaches it
|
|
* FEUERWERK_MCP_KEY_FILE the key both sides share (default data/mcp-relay.key)
|
|
* FEUERWERK_MCP_ORIGINS the editor's origins, comma-separated
|
|
* FEUERWERK_MCP_PORT, _HOST where to listen (8090 on all interfaces)
|
|
* FEUERWERK_MCP_TRUST_PROXY 1: the agent's address is nginx's X-Real-IP
|
|
* FEUERWERK_MCP_BACKEND pass everything else on to this server (CI)
|
|
*/
|
|
|
|
const env = process.env;
|
|
const keyFile = env.FEUERWERK_MCP_KEY_FILE ?? new URL('../../data/mcp-relay.key', import.meta.url);
|
|
const key = readFileSync(keyFile, 'utf8').trim();
|
|
if (key.length < 32) throw new Error('The relay key has to be at least 32 characters');
|
|
if (!env.FEUERWERK_MCP_API) throw new Error('FEUERWERK_MCP_API is not set');
|
|
const origins = (env.FEUERWERK_MCP_ORIGINS ?? '')
|
|
.split(',')
|
|
.map((origin) => origin.trim())
|
|
.filter(Boolean);
|
|
if (origins.length === 0) throw new Error('FEUERWERK_MCP_ORIGINS is not set');
|
|
|
|
// Read on every use: a deployment that brings new tools needs no restart of the relay.
|
|
const toolsFile = new URL('../../src/editor/agent/tools.json', import.meta.url);
|
|
|
|
const relay = await startRelay({
|
|
port: Number(env.FEUERWERK_MCP_PORT ?? 8090),
|
|
host: env.FEUERWERK_MCP_HOST ?? '0.0.0.0',
|
|
api: phpApi(env.FEUERWERK_MCP_API, key),
|
|
tools: async () => JSON.parse(await readFile(toolsFile, 'utf8')),
|
|
origins,
|
|
trustProxy: env.FEUERWERK_MCP_TRUST_PROXY === '1',
|
|
backend: env.FEUERWERK_MCP_BACKEND || undefined,
|
|
log: (line) => console.log(`${new Date().toISOString()} ${line}`),
|
|
});
|
|
console.log(`${new Date().toISOString()} relay on port ${relay.port} for ${origins.join(', ')}`);
|
|
|
|
for (const signal of ['SIGTERM', 'SIGINT']) {
|
|
process.on(signal, () => void relay.close().then(() => process.exit(0)));
|
|
}
|