adminandClaude Opus 5.5
48ec722660
Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Feuerwerk
A browser-based tool "one step before a game engine": create assets (scenes, cameras, sprites), place them into scenes, tweak their properties in an inspector and press Play, all in one program, all drawn inside a single WebGL canvas.
Live: https://nockal.com/feuerwerk/ · Widget playground: https://nockal.com/feuerwerk/?playground
The documentation is the wiki: https://git.nockal.com/meleki/feuerwerk/wiki: every concept, node, tab and shortcut, plus the architecture and the development workflow. This file is the short way in.
In one screen
- An asset is a named, typed thing (scene, camera, sprite, text, behavior, variables, struct, collider, rigidbody, joint, container, clip area, texture, vector art, pixel art, palette, animation, curve, tile, tilemap, state machine, shader, shader function, font, sound, sound FX, instrument, pattern, song, bus, video, composition, particles) with properties and no position.
- A scene object places an asset: position, sparse overrides of its properties, an optional parent. Only what differs from the asset is stored; the inspector paints it gold and offers ↺ / ↑.
- A container is a reusable group edited once and placed many times; its content is resolved from the template on every read. A screen is a container switched on and off.
- A behavior is logic as a node graph, placed like anything else and parented to the object it acts on. Play has no built-in behaviour: everything that happens is a graph.
- An account owns projects: the editor asks for a user name and a password first, and each account sees only its own projects. The Account menu at the far right of the toolbar changes the password and signs out.
- Play runs a throwaway copy of the project; every panel stays usable and Stop brings back exactly what was saved. Release… shares a link that plays the saved game on its own, without the editor and without signing in.
Quick start
Node 22 is required.
npm install
npm run dev # http://localhost:5175/; API and data calls are proxied to production
npm run check # typecheck + lint + format:check + unit tests; the gate CI runs too
npm run build # writes dist/ and regenerates index.html; the folder is what nginx serves
The browser suite and the three example games need a machine with a GPU:
node tools/seed-e2e.mjs && node tools/e2e.mjs # the editor, 2090 checks (GM_STEPS=20 for one step)
# every tool signs in first; see the Accounts page
node tools/seed-jumprun.mjs && node tools/smoke-jumprun.mjs
node tools/seed-tetris.mjs && node tools/smoke-tetris.mjs
node tools/seed-actor.mjs && node tools/smoke-actor.mjs
Every push runs all of it on the Gitea runners: the gate as one job, build and suite as another beside it. So locally take the gate plus the step your change touches and leave the full run to CI. Details, the GPU requirement and the detached runner are in Development.
Documentation
| Page | What it covers |
|---|---|
| Concepts | Assets, scene objects, overrides, play mode, the camera, the console |
| Accounts | Signing in and out, the accounts, who a project belongs to, what the check tools need |
| Scenes | The edited scene, the start scene, and switching scenes from a graph |
| Scene editing | Placing, z-order, hierarchy, the editor offset |
| Behaviors | Node graphs: variables, the node set, structs and lists, loops, nesting, editing |
| Structs | Struct assets: a named shape that struct variables, fields and Pack/Expand follow |
| Colliders | Shapes (box, circle, capsule, polygon), collision events, blocking movement, one-way colliders and raycasts |
| Physics | Rigidbodies, the collider material, gravity, the fixed step, joints |
| Textures | Images, frames, nine-slice, the filter, upload limits |
| Vector art | Pictures drawn from shapes: the pen, curves, gradients and texture fills, combining shapes |
| Pixel art | Pictures painted pixel by pixel: the palette, the tools, layers and frames |
| Fonts | Font assets, the picker, what a text falls back to |
| Sounds | Sound assets and clips, Play sound, buses and the Master routing, sound FX |
| Instruments | Instruments as node graphs, Chips and presets, the keys of the Instrument tab, Play note |
| Patterns | Patterns and the piano roll, playing one in a loop or from a game |
| Songs | Songs, their tracks and items, routing, recording, playing one from a game |
| Videos | Video assets and clips, wearing one on a sprite, recording the game view or the editor |
| Animations | Animation assets and the Animation tab |
| Curves | Easings drawn by hand, the Curve tab, using one on a key or a Lerp |
| Shaders | Shader graphs that sprites, texts, particle fields and cameras wear, their node set, passes, shader functions |
| Particles | Particle graphs: a particle as a function of its age |
| State machines | The asset, named transitions, State branch, Set state and State transition |
| Containers | Templates, instances, screens |
| Compositions | Objects, videos and sounds laid out in time, the Composition tab, playing one in a game |
| Tiles | The tile asset, plain tiles and the two autotile kinds, the pictures as animation steps, the Tile tab |
| Tilemaps | The tilemap asset, painting in the scene view, layers, what it looks like in the game |
| Plugins | Extending the editor: the plugin file, how it is loaded, switching one on and off, API v1 |
| Keyboard | Every shortcut |
| Architecture | Stack, source layout, the rules that keep it organised |
| Development | Commands, the e2e suite, the example games, CI |
| API | The PHP JSON API and the project document |
Ideas, gaps and bugs
They live in the issue tracker: https://git.nockal.com/meleki/feuerwerk/issues. What is not there yet is listed on the wiki's Home page.