Files
skills/hub/templates/page-keyboard.js
T
Kevin Veen-BirkenbachandClaude Opus 5.5 8ba45efd04 feat(hub): kvb-hub review hub with passkey-signed approvals
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:46:40 +00:00

87 lines
2.9 KiB
JavaScript

function helpSheet() {
openSheet("Tastenkürzel", [h("dl", {class: "keys"}, KEYS.map(([key, text]) => [h("dt", {}, key), h("dd", {}, text)])),
h("p", {class: "muted"}, "Leitstand: Vollbild mit großem Status für den zweiten Bildschirm. Auf schmalen Bildschirmen öffnet die Leiste unten die Inbox.")], false);
}
function overlayOpen() {
return !document.getElementById("palette").hidden || !document.getElementById("sheet").hidden;
}
function moveCursor(delta) {
const items = visibleInbox();
if (!items.length) {
return;
}
ui.cursor = Math.min(Math.max(ui.cursor + delta, 0), items.length - 1);
drawInbox();
const current = document.querySelector(`#rail .item[data-index="${ui.cursor}"]`);
if (current) {
current.scrollIntoView({block: "nearest"});
}
}
function keyboard(event) {
const target = event.target;
if ((event.ctrlKey || event.metaKey) && !event.altKey && event.key.toLowerCase() === "k") {
event.preventDefault();
if (document.getElementById("palette").hidden) {
openPalette();
} else {
closePalette();
}
return;
}
if (event.key === "Escape") {
if (!document.getElementById("palette").hidden) {
closePalette();
} else if (!document.getElementById("sheet").hidden) {
closeSheet();
} else if (space.look) {
skyLook(false);
} else if (ui.agent !== null) {
closeAgent();
} else {
document.body.classList.remove("inbox-open");
}
return;
}
if (event.altKey || event.ctrlKey || event.metaKey || event.isComposing || overlayOpen()) {
return;
}
if (target instanceof HTMLElement && (target.isContentEditable || ["INPUT", "TEXTAREA", "SELECT"].includes(target.tagName))) {
return;
}
const current = visibleInbox()[ui.cursor];
const index = Number(event.key) - 1;
if (/^[1-3]$/.test(event.key)) {
event.preventDefault();
go(SCREENS[index][0], null);
} else if (event.key === "j" || event.key === "k") {
event.preventDefault();
moveCursor(event.key === "j" ? 1 : -1);
} else if (event.key === "x") {
event.preventDefault();
toggle(current);
} else if (event.key === "a") {
event.preventDefault();
if (current && !current.held) {
approveOne(current);
}
} else if (event.key === "Enter" && current && target === document.body) {
event.preventDefault();
openItem(current);
} else if (event.key === "/") {
event.preventDefault();
if (ui.screen !== "stream") {
go("stream", null);
}
window.setTimeout(() => stream.dom && stream.dom.search.focus(), 0);
} else if (event.key === "?") {
event.preventDefault();
helpSheet();
} else if (event.key === "h") {
event.preventDefault();
skyLook(!space.look);
}
}