adminandClaude Opus 5.5 48ec722660 Let an AI agent see the open editor through MCP (#429) ...

Claude Code should be able to work inside the user's open editor tab.
This first stage connects the two and lets the agent look: what the
user sees and a picture of it. Changing the project comes in stage 2.

- An agent token per account opens only /mcp, no API route. The
  dialog "Agent tokens..." in the account menu creates it once, shows
  the ready "claude mcp add" line and revokes it. The server keeps
  only its sha256 (api/lib/AgentTokens.php).
- Wrong tokens count into the sign-in brake from #427. Changing the
  password, renaming or deleting an account ends its tokens.
- The relay (tools/mcp/) is a small Node service without packages,
  WebSocket server included. It runs in the container feuerwerk-mcp
  because PHP-FPM cannot hold connections. Whether a token or a tab
  ticket is valid is still decided by the PHP API, through two routes
  that answer only with the relay key.
- The tab joins over WebSocket on the same origin with the normal
  session, an Origin check and a one-time ticket. It connects only
  after "Agent" is switched on in the account menu. One tab per
  account is active, a new one takes over. Guests get nothing.
- Tools: get_view (project, tab, document, selection with names,
  camera, play state, open dialog) and screenshot. The resource
  feuerwerk://view can be subscribed. Claude Code does not act on
  that reliably, so a changed view is also noted on the next answer.
- A badge next to the account menu shows the connected agents. It
  counts only agents with an open stream or a request in the last
  two minutes.
- CI starts the relay in front of php -S (tools/ci/serve.sh), and
  e2e 71 runs the whole path in the browser.

Found on the live test: the badge showed four agents because old
sessions of revoked tokens were still counted.

Tests:
- Gate on atx: 316 files, 4888 tests
- relay protocol test with fake API and fake tabs: 23/23
- get_view, tools, socketUrl: 16/16
- PHP agents 29, rights 103 checks
- e2e 71 on atx 10/10, against the live site 10/10, no CSP violation
- real Claude Code against the live site: get_view answered
- ZAP against /mcp: nothing at High or Medium
- every new check fails when the guard it covers is taken out (6)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-18 10:39:34 +02:00

..

AccountRules.php

Add roles and a user management tab for admins (#180, #179)

2026-09-23 13:59:04 +02:00

AgentTokens.php

Let an AI agent see the open editor through MCP (#429)

2026-10-18 10:39:34 +02:00

AtomicFile.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

Auth.php

Serve the editor from feuerwerk.nockal.com as well

2026-10-16 08:40:18 +02:00

DemoFiles.php

Let guests try a demo project without an account (#428)

2026-10-16 06:58:30 +02:00

FileUsage.php

Let guests try a demo project without an account (#428)

2026-10-16 06:58:30 +02:00

FontStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

HashedFileStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

LoginThrottle.php

Prune old sign-in failures by their current time (#427)

2026-10-15 23:12:10 +02:00

OriginalName.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

PixelStore.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

PluginStore.php

Plugins belong to the project, and they load before it: the project file gained the field plugins: ["demo-plugin.js"] (default empty, no formatVersion bump), the Plugins tab's switch writes into it as an ordinary undo step (SetPluginActiveCommand) instead of into a server-wide plugins.json, and the start order is turned around - startPlugins only fetches the list of files, then editor.boot() runs and ProjectStore.load(id, prepare) hands the raw JSON through before it is deserialized, where pluginsOf(raw) reads the list and PluginManager.syncTo() activates exactly those; that is the point of the issue, because what a plugin registers has to stand there before normalizeGraph would throw it away as unknown (#126, #127), a project switch first stops what the new project does not name and then starts what it does, a file the server does not have is passed over silently, and after signing out the manager is dead so a late event cannot start anything in a torn-down session; on the server plugins.json, PluginStore::setActive, isActive, the route PUT ?r=plugins/{file} and the 403 for inactive modules are gone and GET ?r=plugins only answers {file,bytes,updatedAt}, which makes every plugin file fetchable - the consequence accepted in #117, written down in the wiki for #115 and #116; publishPlugins(root) only copies files now, the seeder switches the demo plugin on in the fixture project, and the Plugins tab carries a puzzle piece as its icon while only a plugin's own tab still goes without one (the knob and the socket are cubic curves, not arcs, which Pixi's parser draws as a spike after an L); 3 new e2e checks in module 38 and 5 new unit tests cover the project as the owner of the switch, its undo, the order, pluginsOf against crude input and an unknown file name (#119)

2026-09-20 14:24:27 +02:00

Quota.php

Lock the server down before the editor goes public (#427)

2026-10-15 23:05:32 +02:00

ReleaseStore.php

Let guests try a demo project without an account (#428)

2026-10-16 06:58:30 +02:00

Response.php

Add textures for sprites

2026-09-08 13:43:08 +02:00

SessionStore.php

Rename Game Maker to Feuerwerk and serve it at /feuerwerk/ (#422)

2026-10-13 13:27:43 +02:00

SnapshotStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

SoundStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

Store.php

Let only the owner delete a project, not an administrator (#272)

2026-09-30 21:13:20 +02:00

TextureStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

UserStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

VideoFormat.php

Give video posters the colours the video shows (#411)

2026-10-13 16:45:20 +02:00

VideoQueue.php

Move repo, CI and the video worker over to the name Feuerwerk (#422)

2026-10-13 13:42:52 +02:00

VideoStore.php

Choose size, rate and what follows when recording the editor

2026-10-12 17:01:55 +02:00

VideoWorker.php

Give video posters the colours the video shows (#411)

2026-10-13 16:45:20 +02:00