New page MCP: setting up Claude Code with an agent token, switching
the agent on in the editor, the tools and the rules.
- API: the routes for agent tokens and the relay.
- Architecture: the relay and the agent parts of the editor.
- Development: the relay in deployment and CI.
- Sidebar: link to MCP.
API, Architecture, Development: the editor on feuerwerk.nockal.com
The same folder now answers on the subdomain as well, so the pages
no longer name /feuerwerk/ as the one fixed path.
- API: the session cookie has no Path, and the old /feuerwerk/
cookie is cleared on every sign-in and sign-out.
- Architecture: site.ts takes the path from the folder of the page.
- Development: why the build has a relative base.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Accounts, API, Architecture: guests and demo copies (#428)
- Accounts: what a guest picks on the sign-in screen, what they get and
do not get, and how an administrator makes a demo copy and offers
demo material.
- API: the demo routes, the PATCH {demo} of the four file kinds, what
answers without a session, and a section on demo copies and demo
material.
- Architecture: DemoStore, MemoryProjectStore, session, guestStores
and DemoFiles.php.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
API, Development: what the server refuses and hands out (#427)
- API: 429 at the sign-in routes, a section on the brake, the quota,
writes from other sites and the Secure cookie, and the upload limits
as they are now (the page still said nginx takes 1 MB).
- Development: a Deployment section with the nginx list, the
Content-Security-Policy and where both live, the two new PHP tests.
- Architecture: LoginThrottle.php and Quota.php.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
API, Videos: recording options, kept originals and the 4K cap
The editor recording now opens a dialog, and the server keeps what was
uploaded next to the MP4.
- Videos describes Start recording... with its options, Convert and
Import after conversion, and that Stop always uploads.
- Download gives the original, a file left unconverted shows in the
picker with a Convert button, and the cap is 3840x2160.
- API names convert=0 on upload and POST videos/{file}/convert.
- Development names 2045 e2e checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Videos: a new page for the video asset, its tab and worker (#402)
- Videos: getting a video in, the conversion, the asset, the Video
tab, wearing it on a sprite, and the worker container.
- API: the videos routes and what a record says on its way.
- Architecture: the new files on both sides.
- Development: the PHP test, ffmpeg in the CI image, 1994 checks.
- Sidebar: Videos after Fonts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Note the delete order of the file API and graph captions
- API: deleting someone else's file answers 403 before 404, so a
stranger learns nothing about another folder.
- Tilemaps: graph notes and groups keep their caption while painting.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe each account's folder of uploaded files (#344)
Uploaded images, fonts and sounds now belong to the account that
uploaded them, and the pickers can delete them.
- API: a new section Uploaded files belong to an account, with the
folder in the file name, who sees what, and DELETE with 403/409.
- Textures: the Delete button in the picker and when it refuses.
- Fonts, Sounds, Home: file names carry the account's folder.
- Development: the PHP test files.test.php and 1850 checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Concepts: a section on render layers, Sees and Overlay, and why z
never sorts across cameras.
- API: the fields renderLayers, renderLayer, sees and overlay.
- Architecture: renderLayers in the model, the overlay views in
WorldViewport.
- Development: e2e total 1720.
The API now answers an administrator 403 when they delete somebody
else's project. The pages still said an administrator deletes every
project like their own.
- API: the DELETE row names the 403, and the paragraph on
administrators says deleting stays with the owner.
- Accounts: the list of what an administrator may do, and the Delete
row of the user management.
- Architecture: one line on what `seesAll` covers.
- Development: the e2e total, 1602 to 1603.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Document admin-only deletes, file modes and Esc as Cancel (#85)
Brings the pages in line with refactoring round 8 of the code.
- API: deleting an image, font or sound is for administrators only, a
bad upload answers 422, private files are 0640 and the web server
answers 403 for them, and saves take turns on a lock file. The line
that said there was no authentication yet is gone.
- Home: the "Not yet" list named several scenes in one run, auth and
graph comments and groups, which all exist.
- Concepts, Keyboard, Vector art: Escape on a question is its Cancel,
deleting a project leads back to the picker, and Delete removes
shapes picked in the list.
- Architecture: AtomicFile, routeFiles, HashedFileStore, the lock
file, removeSelection and removeShapes, objectName and groupName,
and the Escape of a Dialog.
- Development: the check sum, and the race check in
accounts.test.php needs pcntl.
- Eight pages lose the 38 characters Gitea flagged as ambiguous, and
quoted labels follow the editor's American spelling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe the game link and the new zoom steps (#266)
A project can now be released as a link that plays without the
editor and without a login.
- Concepts: a Release section, the new main menu entry and the zoom
steps 300%, 500% and 600% in the game tab table.
- API: the four release routes, and that the public one is the only
route besides auth that needs no session.
- Architecture: GameRun, the player page, gamePointer, projectFiles
and WorldViewport in its new place under src/viewport.
- Development: the PHP release test and the measured sum of 1574
e2e checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe project snapshots and their API routes (#231)
The editor can now keep named snapshots of a project. The wiki
explains how to use them and where they live.
- Concepts: new section "Snapshots" on create, restore with the
automatic "Before restoring" copy, and delete.
- API: the four routes under projects/{id}/snapshots.
- Architecture: SnapshotStore on server and client, and the dialog.
- Development: e2e module 50, the PHP test and the check sum 1393.
Describe roles and the user management tab (#180, #179)
- Accounts: roles, the User management tab, the account table and the
role argument of make-user.php.
- API: the users routes and how admins reach other users' projects.
- Concepts, Plugins, Architecture: the shared closable tab.
- Development: check sum 1333.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collision layers and masks: Physics and Colliders describe the layer and the mask of layers a collider meets, that a pair only meets when both masks name the other's layer, and where the names are edited - "Collision layers..." in the toolbar's Project menu, as one undo step, up to 16 of them; API names the project field collisionLayers, Architecture lists collisionLayers and CollisionLayersDialog, Concepts and Tilemaps name the two new inspector rows, Development carries the check sum 1138
Plugins belong to the project: Plugins describes the load order and why it has to come before deserializing, the switch as an undo step on the project, the project switch and the open delivery of every plugin file, API drops PUT ?r=plugins/{file} and active and names the project field, Architecture lists projectPlugins, prepare and syncTo and the Plugins tab's own icon, Concepts names the puzzle piece, Development carries the check sum 1129
Changing the password: Accounts gained a section of its own for it and names the Account menu instead of the Logout button, API describes POST auth/password with its 401 and 422 and the other sessions ending, Architecture lists PasswordDialog, Concepts mentions the account menu, Development carries the check sum 1126
Accounts: a new page for the user accounts, projects and sessions; API lists auth/session, auth/login and auth/logout and the 401 without a session, Architecture the auth modules, Concepts the sign-in and the Logout button that changes what the canvas draws instead of reloading, Development the check sum 1118 and how the tools sign in
API: name on both listings and both uploads, and what the server does to it.
Textures and Fonts: tiles and rows are captioned by name, and an asset made
in the picker is named after the file. Architecture: the api/ line names the
libraries. Development: 780 editor checks.
admin
