The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
152 lines
5.4 KiB
JavaScript
152 lines
5.4 KiB
JavaScript
const activeKinds = () => (filter.view ? new Set(state.views[filter.view].kinds) : filter.kinds);
|
||
const activeWaiting = () => (filter.view ? state.views[filter.view].waiting : filter.waiting);
|
||
|
||
function filterQuery() {
|
||
const params = new URLSearchParams();
|
||
if (filter.view) {
|
||
params.set("view", filter.view);
|
||
} else {
|
||
params.set("kinds", [...filter.kinds].join(","));
|
||
if (filter.waiting) {
|
||
params.set("waiting", "1");
|
||
}
|
||
}
|
||
for (const name of ["q", "agent", "session", "sub"]) {
|
||
if (filter[name]) {
|
||
params.set(name, filter[name]);
|
||
}
|
||
}
|
||
if (filter.parts.size !== PARTS.length) {
|
||
params.set("parts", [...filter.parts].join(","));
|
||
}
|
||
return params.toString();
|
||
}
|
||
|
||
function windowKey() {
|
||
if (ui.preset === -1) {
|
||
return `custom:${ui.from}:${ui.to}`;
|
||
}
|
||
return `${ui.preset}:${ui.asOf === null ? "live" : ui.asOf}`;
|
||
}
|
||
|
||
function customize() {
|
||
if (filter.view) {
|
||
filter.kinds = new Set(state.views[filter.view].kinds);
|
||
filter.waiting = state.views[filter.view].waiting;
|
||
filter.view = "";
|
||
}
|
||
filter.saved = "";
|
||
}
|
||
|
||
function refilter() {
|
||
drawFilters();
|
||
drawStream();
|
||
fetchEvents();
|
||
}
|
||
|
||
function useView(id) {
|
||
filter.view = id;
|
||
filter.saved = "";
|
||
filter.session = "";
|
||
filter.sub = "";
|
||
filter.agent = "";
|
||
filter.q = "";
|
||
if (ui.screen === "stream" && stream.dom) {
|
||
stream.dom.search.value = "";
|
||
refilter();
|
||
} else {
|
||
go("stream", null);
|
||
}
|
||
}
|
||
|
||
function useSaved(view) {
|
||
filter.view = "";
|
||
filter.saved = view.name;
|
||
filter.kinds = new Set(view.kinds);
|
||
filter.waiting = view.waiting;
|
||
filter.q = view.q;
|
||
filter.agent = view.agent;
|
||
filter.session = "";
|
||
filter.sub = "";
|
||
if (ui.screen === "stream" && stream.dom) {
|
||
stream.dom.search.value = filter.q;
|
||
refilter();
|
||
} else {
|
||
go("stream", null);
|
||
}
|
||
}
|
||
|
||
function saveView() {
|
||
const name = (window.prompt("Name der Ansicht", filter.saved || "") || "").trim();
|
||
if (!name) {
|
||
return;
|
||
}
|
||
const entry = {name: name.slice(0, 60), kinds: [...activeKinds()], waiting: activeWaiting(), q: filter.q, agent: filter.agent};
|
||
userViews = [...userViews.filter((view) => view.name !== entry.name), entry];
|
||
if (!keep(STORE.views, userViews)) {
|
||
toast("Ansicht nur bis zum Neuladen gespeichert", ["Der Browser erlaubt kein localStorage."], false);
|
||
}
|
||
useSaved(entry);
|
||
}
|
||
|
||
function dropView(name) {
|
||
userViews = userViews.filter((view) => view.name !== name);
|
||
keep(STORE.views, userViews);
|
||
if (filter.saved === name) {
|
||
filter.saved = "";
|
||
}
|
||
drawFilters();
|
||
}
|
||
|
||
function drawFilters() {
|
||
if (!stream.dom) {
|
||
return;
|
||
}
|
||
const kinds = activeKinds();
|
||
const presets = Object.entries(state.views).map(([id, view]) => h("button", {type: "button", class: "chip preset", "aria-pressed": String(filter.view === id), on: {click: () => useView(id)}}, view.label));
|
||
const mine = userViews.map((view) => h("span", {class: "chip", "aria-pressed": String(!filter.view && filter.saved === view.name), role: "button", tabindex: 0, on: {
|
||
click: () => useSaved(view),
|
||
keydown: (event) => {
|
||
if (event.key === "Enter") {
|
||
useSaved(view);
|
||
}
|
||
},
|
||
}}, view.name, h("button", {type: "button", class: "x", "aria-label": `${view.name} löschen`, on: {click: (event) => {
|
||
event.stopPropagation();
|
||
dropView(view.name);
|
||
}}}, "×")));
|
||
stream.dom.presets.replaceChildren(...presets, ...mine, btn("+ Ansicht speichern", "btn small ghost", saveView));
|
||
const kindChips = KINDS.map(([id, label]) => h("button", {type: "button", class: "chip", "aria-pressed": String(kinds.has(id)), on: {click: () => {
|
||
customize();
|
||
if (filter.kinds.has(id) && filter.kinds.size > 1) {
|
||
filter.kinds.delete(id);
|
||
} else {
|
||
filter.kinds.add(id);
|
||
}
|
||
refilter();
|
||
}}}, label));
|
||
const waiting = h("button", {type: "button", class: "chip", "aria-pressed": String(activeWaiting()), on: {click: () => {
|
||
customize();
|
||
filter.waiting = !filter.waiting;
|
||
refilter();
|
||
}}}, "nur Wartendes");
|
||
stream.dom.kinds.replaceChildren(waiting, ...kindChips);
|
||
const parts = kinds.has("transcript") ? PARTS.map(([id, label]) => h("button", {type: "button", class: "chip", "aria-pressed": String(filter.parts.has(id)), on: {click: () => {
|
||
if (filter.parts.has(id) && filter.parts.size > 1) {
|
||
filter.parts.delete(id);
|
||
} else {
|
||
filter.parts.add(id);
|
||
}
|
||
refilter();
|
||
}}}, label)) : [];
|
||
const focus = filter.sub || filter.session ? h("span", {class: "chip", "aria-pressed": "true"}, filter.sub ? `Subagent ${filter.sub.slice(0, 12)}` : `Session ${filter.session.slice(0, 8)}`,
|
||
h("button", {type: "button", class: "x", "aria-label": "Filter entfernen", on: {click: () => {
|
||
filter.sub = "";
|
||
filter.session = "";
|
||
refilter();
|
||
}}}, "×")) : null;
|
||
stream.dom.parts.replaceChildren(...parts, focus || "");
|
||
const names = [...new Set([...Object.values(stream.sessions), ...Object.values(people()).flatMap((entry) => entry.names), ...state.claims.map((claim) => claim.agent), ...state.priority].filter(Boolean))].sort((a, b) => a.localeCompare(b));
|
||
stream.dom.agents.replaceChildren(h("option", {value: ""}, "Alle Agenten"), names.map((name) => h("option", {value: name, selected: name === filter.agent}, name)));
|
||
}
|