The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
187 lines
8.2 KiB
JavaScript
187 lines
8.2 KiB
JavaScript
async function fetchEvents() {
|
||
if (stream.busy) {
|
||
stream.again = true;
|
||
return;
|
||
}
|
||
const key = `${windowKey()}&${filterQuery()}`;
|
||
if (stream.key !== key) {
|
||
stream.key = key;
|
||
stream.events = [];
|
||
stream.entries = [];
|
||
stream.last = 0;
|
||
}
|
||
stream.busy = true;
|
||
try {
|
||
const response = await fetch(`/api/events?${windowQuery()}&${filterQuery()}&after=${stream.last}`, {cache: "no-store"});
|
||
if (response.ok) {
|
||
const data = await response.json();
|
||
if (stream.key === key) {
|
||
const seen = new Set(stream.entries.map((entry) => entry.id));
|
||
stream.events = data.events;
|
||
stream.entries = [...stream.entries, ...data.entries.filter((entry) => !seen.has(entry.id))].sort((a, b) => a.ts - b.ts).slice(-STREAM_KEEP);
|
||
stream.last = data.last;
|
||
stream.sessions = data.sessions;
|
||
stream.error = "";
|
||
}
|
||
} else {
|
||
stream.error = `${response.status} ${(await response.text()).trim()}`;
|
||
}
|
||
} catch {
|
||
ui.offline = true;
|
||
}
|
||
stream.busy = false;
|
||
drawStream();
|
||
if (stream.again) {
|
||
stream.again = false;
|
||
fetchEvents();
|
||
}
|
||
}
|
||
|
||
async function expand(entry, holder, button) {
|
||
button.disabled = true;
|
||
const response = await fetch(`/api/stream/${entry.ref.entry}`, {cache: "no-store"});
|
||
if (response.ok) {
|
||
const data = await response.json();
|
||
entry.text = data.text;
|
||
entry.ref.truncated = false;
|
||
holder.textContent = data.text;
|
||
button.remove();
|
||
} else {
|
||
button.textContent = "Nicht mehr verfügbar";
|
||
}
|
||
}
|
||
|
||
function focusSub(session, sub) {
|
||
filter.view = "";
|
||
filter.saved = "";
|
||
filter.kinds = new Set(["transcript"]);
|
||
filter.waiting = false;
|
||
filter.session = session;
|
||
filter.sub = sub;
|
||
closeAgent();
|
||
if (ui.screen === "stream" && stream.dom) {
|
||
refilter();
|
||
} else {
|
||
go("stream", null);
|
||
}
|
||
}
|
||
|
||
function inboxOf(entry) {
|
||
const id = entry.kind === "operator" ? entry.ref.task : entry.ref.id;
|
||
return state.inbox.find((item) => item.kind === entry.kind && item.id === id) || null;
|
||
}
|
||
|
||
function kindPill(entry) {
|
||
if (entry.kind === "radio") {
|
||
return klass(entry.part);
|
||
}
|
||
if (entry.kind === "transcript") {
|
||
return pill((PARTS.find(([id]) => id === entry.part) || [entry.part, entry.part])[1], PART_TONES[entry.part] || "neutral");
|
||
}
|
||
return pill((KINDS.find(([id]) => id === entry.kind) || [entry.kind, entry.kind])[1], KIND_TONES[entry.kind] || "neutral");
|
||
}
|
||
|
||
function extras(entry) {
|
||
const ref = entry.ref;
|
||
if (entry.kind === "review") {
|
||
return [status(ref.status), ref.gate ? pill(ref.gate === "pass" ? "Gate grün" : "Gate rot", ref.gate === "pass" ? "ok" : "bad") : null];
|
||
}
|
||
if (entry.kind === "ask") {
|
||
return [status(ref.status), ...ref.warnings.map((warning) => pill(warning, "bad"))];
|
||
}
|
||
if (entry.kind === "decision") {
|
||
return [status(ref.status), ref.choice ? pill(ref.choice, "ok") : null];
|
||
}
|
||
if (entry.kind === "cron") {
|
||
return [pill(ref.active ? "aktiv" : "inaktiv", ref.active ? "ok" : "neutral")];
|
||
}
|
||
if (entry.kind === "run" || entry.kind === "operator" || entry.kind === "register") {
|
||
return [ref.status ? status(ref.status) : null];
|
||
}
|
||
return [];
|
||
}
|
||
|
||
function body(entry) {
|
||
if (entry.kind === "transcript") {
|
||
const text = h("pre", {}, entry.text);
|
||
const more = entry.ref.truncated ? h("button", {type: "button", class: "btn small ghost"}, "Ganzen Text zeigen") : null;
|
||
if (more) {
|
||
more.addEventListener("click", () => expand(entry, text, more));
|
||
}
|
||
return [text, more];
|
||
}
|
||
if (entry.kind === "ask" || entry.kind === "operator") {
|
||
const where = entry.kind === "ask" ? entry.ref.cwd : entry.ref.directory;
|
||
return [h("div", {class: "command"}, h("code", {}, entry.kind === "ask" ? entry.text : entry.title), copyButton(entry.kind === "ask" ? entry.text : entry.title)), h("span", {class: "muted"}, `in ${dash(where)}`), entry.kind === "operator" && entry.text !== "-" ? h("p", {class: "text"}, entry.text) : null];
|
||
}
|
||
if (entry.kind === "review") {
|
||
return [entry.text ? h("pre", {class: "notes"}, entry.text) : null, h("div", {class: "line-actions"}, btn("Diff ansehen", "btn small soft", () => reviewSheet(entry.ref.id)))];
|
||
}
|
||
if (entry.kind === "cron") {
|
||
const ref = entry.ref;
|
||
const ended = ref.deleted ? [" · beendet ", when(ref.deleted)] : [];
|
||
return [entry.text ? h("pre", {}, entry.text) : null, h("span", {class: "muted"}, "angelegt ", when(ref.created), ended)];
|
||
}
|
||
if (entry.kind === "run") {
|
||
return [entry.text ? h("pre", {}, entry.text) : null];
|
||
}
|
||
return [entry.text ? h("p", {class: "text"}, entry.text) : null];
|
||
}
|
||
|
||
function eventRow(entry) {
|
||
const item = entry.waiting ? inboxOf(entry) : null;
|
||
const alarm = entry.kind === "radio" && (entry.part === "mayday" || entry.part === "pan-pan");
|
||
const renamed = entry.now && entry.now !== entry.agent ? h("span", {title: `jetzt: ${entry.now}`}, person(entry.agent)) : person(entry.agent);
|
||
const who = entry.agent ? [face(entry.agent, false), renamed] : entry.session ? h("strong", {title: entry.session}, entry.session.slice(0, 8)) : null;
|
||
const headline = entry.kind === "transcript" || entry.kind === "ask" || entry.kind === "operator" ? null : h("span", {class: "headline"}, entry.title);
|
||
return h("li", {class: `entry k-${entry.kind}${entry.waiting ? " waiting" : ""}${alarm ? " alarm" : ""}`},
|
||
h("div", {class: "msg-meta"}, when(entry.ts), kindPill(entry), extras(entry)),
|
||
h("div", {},
|
||
h("div", {class: "route"}, who, entry.sub ? h("button", {type: "button", class: "linkish muted", on: {click: () => focusSub(entry.session, entry.sub)}}, `› Subagent ${entry.sub.slice(0, 12)}`) : null, entry.kind === "ask" ? h("strong", {}, entry.title) : null, headline),
|
||
body(entry),
|
||
item ? h("div", {class: "line-actions"}, actionsFor(item)) : null));
|
||
}
|
||
|
||
function drawStream() {
|
||
if (!stream.dom || ui.screen !== "stream") {
|
||
return;
|
||
}
|
||
const floor = live() && ui.preset > 0 ? nowSeconds() - ui.preset : -Infinity;
|
||
const rows = [...stream.events, ...stream.entries.filter((entry) => entry.ts >= floor)].sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1));
|
||
const shown = rows.slice(0, FEED_LIMIT);
|
||
stream.dom.count.textContent = `${rows.length} Einträge${live() ? " · folgt live" : ""}`;
|
||
if (stream.error) {
|
||
stream.dom.list.replaceChildren(emptyState("Stream nicht lesbar", stream.error));
|
||
return;
|
||
}
|
||
stream.dom.list.replaceChildren(rows.length
|
||
? h("div", {class: "card flush"}, h("ol", {class: "feed"}, shown.map(eventRow)),
|
||
rows.length > shown.length ? h("p", {class: "footnote"}, `${rows.length - shown.length} ältere Einträge ausgeblendet; grenze mit Filter oder Zeitraum ein.`) : null)
|
||
: emptyState(stream.busy ? "Lade …" : "Keine Einträge", activeWaiting() ? "Gerade wartet nichts auf dich." : "Im gewählten Zeitraum und Filter gibt es nichts."));
|
||
}
|
||
|
||
function streamScreen() {
|
||
const agents = h("select", {"aria-label": "Agent", on: {change: (event) => {
|
||
filter.agent = event.target.value;
|
||
filter.saved = "";
|
||
refilter();
|
||
}}});
|
||
const search = h("input", {type: "search", placeholder: "Suchen … (/)", value: filter.q, "aria-label": "Stream durchsuchen", on: {input: (event) => {
|
||
filter.q = event.target.value;
|
||
window.clearTimeout(searchTimer);
|
||
searchTimer = window.setTimeout(fetchEvents, 300);
|
||
}}});
|
||
const count = h("span", {class: "muted"});
|
||
const presets = h("div", {class: "chips", role: "group", "aria-label": "Gespeicherte Ansichten"});
|
||
const kinds = h("div", {class: "chips", role: "group", "aria-label": "Arten"});
|
||
const parts = h("div", {class: "chips", role: "group", "aria-label": "Transkript-Teile"});
|
||
const list = h("div", {});
|
||
stream.dom = {agents, search, count, presets, kinds, parts, list};
|
||
window.setTimeout(() => {
|
||
drawFilters();
|
||
drawStream();
|
||
fetchEvents();
|
||
}, 0);
|
||
return h("div", {}, presets, h("div", {class: "filters"}, agents, search, count), kinds, parts, list);
|
||
}
|