The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
97 lines
4.6 KiB
JavaScript
97 lines
4.6 KiB
JavaScript
async function act(action, label, payload) {
|
|
ui.busy = true;
|
|
const result = await sendJson(`/api/board/${action}`, payload);
|
|
ui.busy = false;
|
|
if (result.data && result.data.runs) {
|
|
toast(`${label}: ${result.data.ok ? "erledigt" : "fehlgeschlagen"}`, runLines(result.data), result.data.ok);
|
|
} else {
|
|
toast(`${label}: fehlgeschlagen`, [`${result.status} ${result.text}`.trim()], false);
|
|
}
|
|
await load();
|
|
return result.ok && result.data && result.data.ok;
|
|
}
|
|
|
|
function confirmAct(action) {
|
|
const [, label, question] = ACTIONS.find(([id]) => id === action);
|
|
if (window.confirm(question)) {
|
|
act(action, label, {});
|
|
}
|
|
}
|
|
|
|
function boardContent() {
|
|
if (ui.order === null || ui.order.some((name) => !state.priority.includes(name)) || ui.order.length !== state.priority.length) {
|
|
ui.order = [...state.priority];
|
|
}
|
|
const [mode, modeTone] = NIGHT[state.night] || [state.night, "neutral"];
|
|
const broadcast = h("textarea", {"aria-label": "Rundruf", placeholder: "Nachricht an alle Agenten …", on: {input: (event) => {
|
|
ui.draft = event.target.value;
|
|
}}});
|
|
broadcast.value = ui.draft;
|
|
const list = h("ol", {class: "order-list"});
|
|
let dragged = null;
|
|
ui.order.forEach((name, index) => {
|
|
const item = h("li", {draggable: "true", "data-name": name}, h("span", {class: "rank"}, `${index + 1}.`), face(name, false), person(name));
|
|
item.addEventListener("dragstart", (event) => {
|
|
dragged = name;
|
|
item.classList.add("dragging");
|
|
event.dataTransfer.effectAllowed = "move";
|
|
event.dataTransfer.setData("text/plain", name);
|
|
});
|
|
item.addEventListener("dragend", () => item.classList.remove("dragging"));
|
|
item.addEventListener("dragover", (event) => event.preventDefault());
|
|
item.addEventListener("drop", (event) => {
|
|
event.preventDefault();
|
|
if (dragged === null || dragged === name) {
|
|
return;
|
|
}
|
|
const next = ui.order.filter((entry) => entry !== dragged);
|
|
next.splice(next.indexOf(name) + (ui.order.indexOf(dragged) < ui.order.indexOf(name) ? 1 : 0), 0, dragged);
|
|
ui.order = next;
|
|
boardSheet();
|
|
});
|
|
list.append(item);
|
|
});
|
|
const changed = JSON.stringify(ui.order) !== JSON.stringify(state.priority);
|
|
return h("div", {class: "board"},
|
|
h("article", {class: `card${state.silence ? " alarm" : ""}`},
|
|
h("div", {class: "card-head"}, h("h3", {}, "Mayday"), state.silence ? pill("Funkstille", "bad") : pill("ruhig", "ok")),
|
|
state.silence ? h("p", {class: "text"}, `${state.silence.by}: ${state.silence.text}`) : h("p", {class: "muted"}, "Keine Funkstille aktiv."),
|
|
h("div", {class: "actions"}, h("button", {type: "button", class: "btn danger", disabled: !state.silence, on: {click: () => confirmAct("clear-mayday")}}, "Mayday aufheben"))),
|
|
h("article", {class: "card"},
|
|
h("div", {class: "card-head"}, h("h3", {}, "Rundruf an alle")),
|
|
broadcast,
|
|
h("div", {class: "actions"}, h("span", {class: "spacer"}), h("button", {type: "button", class: "btn soft", on: {click: async () => {
|
|
if (!ui.draft.trim()) {
|
|
return;
|
|
}
|
|
if (await act("broadcast", "Rundruf", {text: ui.draft})) {
|
|
ui.draft = "";
|
|
broadcast.value = "";
|
|
}
|
|
}}}, "Senden"))),
|
|
h("article", {class: "card"},
|
|
h("div", {class: "card-head"}, h("h3", {}, "Tag und Nacht"), pill(mode, modeTone)),
|
|
h("p", {class: "muted"}, "Abend: Agenten beenden ihre Aufgabe. Sonnenuntergang: sie schlafen. Sonnenaufgang: alle wachen auf."),
|
|
h("div", {class: "actions"}, ACTIONS.slice(1).map(([id, label]) => btn(label, "btn", () => confirmAct(id))))),
|
|
h("article", {class: "card"},
|
|
h("div", {class: "card-head"}, h("h3", {}, "Priorität der Agenten"), counter(ui.order.length)),
|
|
ui.order.length ? list : h("p", {class: "muted"}, "Kein Agent mit offener Aufgabe."),
|
|
h("div", {class: "actions"},
|
|
h("span", {class: "muted"}, "Ziehen zum Umsortieren"),
|
|
h("span", {class: "spacer"}),
|
|
h("button", {type: "button", class: "btn ghost", disabled: !changed, on: {click: () => {
|
|
ui.order = [...state.priority];
|
|
boardSheet();
|
|
}}}, "Zurücksetzen"),
|
|
h("button", {type: "button", class: "btn primary", disabled: !changed, on: {click: async () => {
|
|
if (await act("order", "Priorität", {agents: ui.order})) {
|
|
ui.order = null;
|
|
boardSheet();
|
|
}
|
|
}}}, "Reihenfolge speichern"))));
|
|
}
|
|
|
|
function boardSheet() {
|
|
openSheet("Steuerung", [boardContent()], true);
|
|
}
|