Files
skills/hub/templates/page-alerts.js
T
Kevin Veen-BirkenbachandClaude Opus 5.5 8ba45efd04 feat(hub): kvb-hub review hub with passkey-signed approvals
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:46:40 +00:00

76 lines
3.7 KiB
JavaScript

function play(kind, volume) {
const sound = context();
if (!sound) {
return;
}
const level = Math.max(volume * 0.5, 0.0002);
duck(Math.max(...TONES[kind].map(([, at, length]) => at + length)));
for (const [frequency, at, length] of TONES[kind]) {
const oscillator = sound.createOscillator();
const gain = sound.createGain();
const start = sound.currentTime + at;
oscillator.type = kind === "mayday" ? "square" : "sine";
oscillator.frequency.value = frequency;
gain.gain.setValueAtTime(0.0001, start);
gain.gain.exponentialRampToValueAtTime(level, start + 0.02);
gain.gain.exponentialRampToValueAtTime(0.0001, start + length);
oscillator.connect(gain).connect(sound.destination);
oscillator.start(start);
oscillator.stop(start + length + 0.05);
}
}
const notifyButton = document.getElementById("notify");
function notifyLabel() {
if (!("Notification" in window)) {
return;
}
const labels = {granted: "Benachrichtigungen an", denied: "Benachrichtigungen blockiert", default: "Benachrichtigungen aktivieren"};
notifyButton.hidden = Notification.permission === "granted";
notifyButton.textContent = labels[Notification.permission] || labels.default;
notifyButton.disabled = Notification.permission !== "default";
}
notifyButton.addEventListener("click", async () => {
await Notification.requestPermission();
notifyLabel();
});
function announce() {
const alarms = new Map(alarmRows().map((row) => [`${row.ts}|${row.from}`, row]));
const radio = new Set(state.radio.map((row) => `${row.ts}|${row.from}|${row.text.slice(0, 40)}`));
if (known.inbox !== null && live()) {
const fresh = state.inbox.filter((item) => !known.inbox.has(keyOf(item)));
const newAlarms = [...alarms].filter(([key]) => !known.alarms.has(key)).map(([, row]) => row);
const newRadio = state.radio.filter((row) => !known.radio.has(`${row.ts}|${row.from}|${row.text.slice(0, 40)}`));
const direct = newRadio.filter((row) => row.to.includes(HUMAN));
const present = {mayday: newAlarms.length > 0, review: fresh.some((item) => item.kind !== "operator"), direct: direct.length > 0, radio: newRadio.length > 0};
const kind = SOUND_KINDS.map(([id]) => id).find((id) => present[id] && settings.sounds[id].on);
if (kind) {
play(kind, loudness(kind));
}
const lead = kind ? Math.max(...TONES[kind].map(([, at, length]) => at + length)) : 0;
window.setTimeout(() => speakRows(newRadio), lead * 1000);
if (settings.notify && "Notification" in window && Notification.permission === "granted") {
for (const row of newAlarms) {
new Notification(`${row.class === "mayday" ? "Mayday" : "Pan-Pan"} von ${dash(row.from)}`, {body: row.text.slice(0, 200), tag: `alarm-${row.ts}`, requireInteraction: row.class === "mayday"});
}
for (const item of fresh) {
new Notification(`${ITEM_LABELS[item.kind]} wartet`, {body: item.title.slice(0, 200), tag: `item-${keyOf(item)}`, requireInteraction: item.kind === "ask"});
}
for (const row of direct) {
new Notification(`Funk von ${dash(row.from)}`, {body: row.text.slice(0, 200), tag: `direct-${row.ts}`});
}
}
}
known.inbox = new Set(state.inbox.map(keyOf));
known.alarms = new Set(alarms.keys());
known.radio = radio;
for (const batch of state.pending) {
if (!known.batches.has(batch.id)) {
known.batches.add(batch.id);
const source = batch.source.startsWith("rule:") ? "Regel" : "Freigabe";
undoToast(batch, `${source}: ${batch.items.map((item) => short(item.title)).join(", ")}`);
}
}
}