adminandClaude Opus 5.5
48ec722660
Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.7 KiB
TypeScript
76 lines
2.7 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
||
import {
|
||
API_ENDPOINT,
|
||
dataPath,
|
||
MCP_PATH,
|
||
moveOldStoredKeys,
|
||
sitePath,
|
||
socketUrl,
|
||
} from '../../src/core/site';
|
||
|
||
function memoryStore(initial: Record<string, string>) {
|
||
const items = new Map(Object.entries(initial));
|
||
return {
|
||
items,
|
||
get length() {
|
||
return items.size;
|
||
},
|
||
key: (i: number) => [...items.keys()][i] ?? null,
|
||
getItem: (key: string) => items.get(key) ?? null,
|
||
setItem: (key: string, value: string) => void items.set(key, value),
|
||
removeItem: (key: string) => void items.delete(key),
|
||
};
|
||
}
|
||
|
||
describe('site', () => {
|
||
it('serves the API and the data files under /feuerwerk/', () => {
|
||
expect(API_ENDPOINT).toBe('/feuerwerk/api/index.php');
|
||
expect(dataPath('textures')).toBe('/feuerwerk/data/textures');
|
||
});
|
||
|
||
it('opens the MCP relay on the page’s own host, encrypted on an encrypted page (#429)', () => {
|
||
expect(MCP_PATH).toBe('/feuerwerk/mcp');
|
||
expect(socketUrl('/mcp', { protocol: 'https:', host: 'feuerwerk.nockal.com' })).toBe(
|
||
'wss://feuerwerk.nockal.com/mcp',
|
||
);
|
||
expect(socketUrl('/feuerwerk/mcp', { protocol: 'http:', host: '127.0.0.1:8081' })).toBe(
|
||
'ws://127.0.0.1:8081/feuerwerk/mcp',
|
||
);
|
||
});
|
||
|
||
it('takes the path from the folder of the open page', () => {
|
||
expect(sitePath('/feuerwerk/')).toBe('/feuerwerk/');
|
||
expect(sitePath('/feuerwerk/index.html')).toBe('/feuerwerk/');
|
||
expect(sitePath('/feuerwerk/play.html')).toBe('/feuerwerk/');
|
||
expect(sitePath('/')).toBe('/');
|
||
expect(sitePath('/play.html')).toBe('/');
|
||
});
|
||
|
||
it('moves the keys stored under the old name and leaves the others alone', () => {
|
||
const store = memoryStore({
|
||
'game-maker.panel-sizes': '{"left":300}',
|
||
'game-maker.saves.p1.Savegame': '{"Lives":2}',
|
||
'other-site.key': 'x',
|
||
});
|
||
expect(moveOldStoredKeys(store)).toBe(2);
|
||
expect(Object.fromEntries(store.items)).toEqual({
|
||
'feuerwerk.panel-sizes': '{"left":300}',
|
||
'feuerwerk.saves.p1.Savegame': '{"Lives":2}',
|
||
'other-site.key': 'x',
|
||
});
|
||
});
|
||
|
||
it('keeps a value the new name already has and drops the old one', () => {
|
||
const store = memoryStore({ 'game-maker.general-settings': 'old', 'feuerwerk.general-settings': 'new' });
|
||
expect(moveOldStoredKeys(store)).toBe(0);
|
||
expect(Object.fromEntries(store.items)).toEqual({ 'feuerwerk.general-settings': 'new' });
|
||
});
|
||
|
||
it('does nothing the second time', () => {
|
||
const store = memoryStore({ 'game-maker.folded-sections': '[]' });
|
||
moveOldStoredKeys(store);
|
||
expect(moveOldStoredKeys(store)).toBe(0);
|
||
expect(Object.fromEntries(store.items)).toEqual({ 'feuerwerk.folded-sections': '[]' });
|
||
});
|
||
});
|