Files
skills/hub/templates/page-music.js
T
Kevin Veen-BirkenbachandClaude Opus 5.5 8ba45efd04 feat(hub): kvb-hub review hub with passkey-signed approvals
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:46:40 +00:00

149 lines
4.4 KiB
JavaScript

function context() {
if (!audio) {
try {
audio = new window.AudioContext();
} catch {
audio = null;
}
}
if (audio && audio.state === "suspended") {
audio.resume().catch(() => null);
}
return audio;
}
function glide(param, target, seconds) {
const now = audio.currentTime;
param.cancelScheduledValues(now);
param.setValueAtTime(param.value, now);
param.linearRampToValueAtTime(target, now + seconds);
}
function impulse(sound) {
const length = sound.sampleRate * 4;
const buffer = sound.createBuffer(2, length, sound.sampleRate);
for (let channel = 0; channel < 2; channel += 1) {
const data = buffer.getChannelData(channel);
for (let index = 0; index < length; index += 1) {
data[index] = (Math.random() * 2 - 1) * (1 - index / length) ** 3;
}
}
return buffer;
}
function musicLevel() {
return settings.music.on && !radio.playing ? settings.music.volume * 0.3 * (music.ducked ? DUCK : 1) : 0;
}
function note() {
if (!music.gain) {
return;
}
if (audio.state === "running") {
const now = audio.currentTime;
const scale = Math.random() < (music.tension ? 0.3 + 0.5 * music.tension : 0) ? TENSE : CALM;
const frequency = BASE * 2 * scale[Math.floor(Math.random() * scale.length)] * (Math.random() < 0.3 ? 2 : 1);
const level = audio.createGain();
level.gain.setValueAtTime(0, now);
level.gain.linearRampToValueAtTime(0.07, now + 2.5);
level.gain.linearRampToValueAtTime(0, now + 8);
level.connect(music.filter);
for (const cents of [0, 5]) {
const oscillator = audio.createOscillator();
oscillator.type = "triangle";
oscillator.frequency.value = frequency;
oscillator.detune.value = cents;
oscillator.connect(level);
oscillator.start(now);
oscillator.stop(now + 8.5);
}
}
const slow = 4500 + Math.random() * 4000;
const fast = 2400 + Math.random() * 2600;
music.timer = window.setTimeout(note, slow + (fast - slow) * music.tension);
}
function startMusic() {
const sound = context();
if (!sound || music.gain) {
return;
}
const gain = sound.createGain();
gain.gain.value = 0;
gain.connect(sound.destination);
const reverb = sound.createConvolver();
reverb.buffer = impulse(sound);
reverb.connect(gain);
const filter = sound.createBiquadFilter();
filter.type = "lowpass";
filter.frequency.value = 700;
filter.Q.value = 0.4;
filter.connect(reverb);
const dry = sound.createGain();
dry.gain.value = 0.3;
filter.connect(dry).connect(gain);
music.drone = [BASE, BASE * 1.5].map((frequency) => {
const oscillator = sound.createOscillator();
const level = sound.createGain();
const lfo = sound.createOscillator();
const depth = sound.createGain();
oscillator.frequency.value = frequency;
level.gain.value = 0.04;
lfo.frequency.value = 0.05 + Math.random() * 0.05;
depth.gain.value = 0.02;
lfo.connect(depth).connect(level.gain);
oscillator.connect(level).connect(filter);
oscillator.start();
lfo.start();
return {oscillator, lfo};
});
Object.assign(music, {gain, filter});
note();
}
function stopMusic() {
if (!music.gain) {
return;
}
const {gain, drone} = music;
window.clearTimeout(music.timer);
glide(gain.gain, 0, 2);
music.gain = null;
window.setTimeout(() => {
for (const {oscillator, lfo} of drone) {
oscillator.stop();
lfo.stop();
}
gain.disconnect();
}, 2500);
}
function tuneMusic(seconds) {
music.tension = Math.min(waitingCount() / 4, 1);
if (music.gain) {
glide(music.filter.frequency, 700 + 900 * music.tension, 4);
glide(music.drone[1].oscillator.detune, 8 * music.tension, 6);
glide(music.gain.gain, musicLevel(), seconds);
}
}
function syncMusic() {
if (settings.music.on) {
startMusic();
} else {
stopMusic();
}
tuneMusic(FADE / 1000);
}
function musicButton() {
const button = document.getElementById("music-toggle");
button.setAttribute("aria-pressed", String(settings.music.on));
button.textContent = settings.music.on ? "♪ Musik an" : "♪ Musik";
}
function toggleMusic() {
context();
saveSettings({...settings, music: {...settings.music, on: !settings.music.on}});
}