Kevin Veen-BirkenbachandClaude Opus 5.5
8ba45efd04
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
3.2 KiB
Python
68 lines
3.2 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from .council import agent
|
|
from .events import event
|
|
from .names import Directory
|
|
from .records import epoch, read_json, shown
|
|
|
|
CRON_ACTIVE = 900
|
|
TIMER_KEYS = ("OnCalendar", "OnActiveSec", "OnBootSec", "OnStartupSec", "OnUnitActiveSec", "OnUnitInactiveSec")
|
|
CRON_LABELS = {"cron": "Cron", "wakeup": "Wakeup", "background": "Hintergrund", "timer": "Timer", "queue": "Queue"}
|
|
|
|
|
|
def cron_state(cron: dict, beats: dict[str, float], now: float) -> dict:
|
|
beat = beats.get(cron["session"])
|
|
alive = cron["deleted"] is None and (cron["until"] is None or cron["until"] > now)
|
|
return {**cron, "active": alive and beat is not None and now - beat < CRON_ACTIVE}
|
|
|
|
|
|
def timer_rows(folder: Path) -> list[dict]:
|
|
try:
|
|
paths = sorted(folder.glob("*.timer"))
|
|
except OSError:
|
|
return []
|
|
rows = []
|
|
for path in paths:
|
|
try:
|
|
lines = [line.strip() for line in path.read_text(encoding="utf-8", errors="replace").splitlines()]
|
|
created = path.stat().st_mtime
|
|
except OSError:
|
|
continue
|
|
pairs = [line.partition("=") for line in lines]
|
|
schedule = [value.strip() for key, _, value in pairs if key.strip() in TIMER_KEYS]
|
|
description = next((value.strip() for key, _, value in pairs if key.strip() == "Description"), "")
|
|
enabled = (folder / "timers.target.wants" / path.name).exists()
|
|
rows.append({
|
|
"key": f"timer:{path.name}", "type": "timer", "session": "", "sub": "", "created": created, "deleted": None, "until": None,
|
|
"job": "", "expression": ", ".join(schedule) or "-", "prompt": description, "reason": path.name, "active": enabled,
|
|
})
|
|
return rows
|
|
|
|
|
|
def queue_rows(council: Path) -> list[dict]:
|
|
data = read_json(council / "queue.json")
|
|
entries = data.get("entries") if isinstance(data, dict) else None
|
|
rows = []
|
|
for entry in entries if isinstance(entries, list) else []:
|
|
created = epoch(entry.get("enqueued")) if isinstance(entry, dict) else None
|
|
if created is None:
|
|
continue
|
|
running = "läuft" if entry.get("status") == "active" else "wartet"
|
|
rows.append({
|
|
"key": f"queue:{shown(entry.get('id'))}", "type": "queue", "session": shown(entry.get("session")), "sub": "", "created": created,
|
|
"deleted": None, "until": None, "job": shown(entry.get("id")), "expression": f"{shown(entry.get('kind'))} · {running}",
|
|
"prompt": shown(entry.get("cmd")), "reason": shown(entry.get("task")), "active": True, "agent": agent(entry.get("name")),
|
|
})
|
|
return rows
|
|
|
|
|
|
def cron_event(cron: dict, directory: Directory) -> dict:
|
|
text = "\n".join(part for part in (cron["prompt"], cron["reason"]) if part and part != "-")
|
|
return event({
|
|
"id": f"cron:{cron['key']}", "ts": cron["created"], "kind": "cron", "agent": directory.at(cron["session"], cron["created"]) or cron.get("agent", ""),
|
|
"now": directory.now(cron["session"]), "session": cron["session"], "sub": cron["sub"], "title": f"{CRON_LABELS[cron['type']]}: {cron['expression']}", "text": text,
|
|
"ref": {key: cron[key] for key in ("type", "expression", "created", "deleted", "until", "active", "job")},
|
|
})
|