The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
195 lines
7.4 KiB
JavaScript
195 lines
7.4 KiB
JavaScript
function spaceTools() {
|
||
const axis = space.views.graph.axis;
|
||
const deep = axis !== "none";
|
||
return h("div", {class: "space-tools"},
|
||
h("div", {class: "segmented", role: "group", "aria-label": "Tiefenachse"}, AXES.map(([id, label, hint]) => h("button", {type: "button", "aria-pressed": String(axis === id), title: hint, "aria-label": `Tiefenachse ${label}: ${hint}`, on: {click: () => chooseAxis(id)}}, label))),
|
||
deep ? h("button", {type: "button", class: "btn small ghost", title: "Drehung, Zoom und Verschiebung zurücksetzen (Taste 0)", "aria-label": "3D-Ansicht zurücksetzen", on: {click: () => resetView("graph")}}, "⟲ Ansicht") : null,
|
||
deep ? h("span", {class: "muted", id: "space-help"}, "Ziehen dreht · Umschalt+Ziehen verschiebt · Rad oder zwei Finger zoomen · Pfeile, + / −, 0") : null);
|
||
}
|
||
|
||
const graph3d = () => ui.screen === "graph" && ui.graph === "orbit" && space.views.graph.axis !== "none";
|
||
const wantsTrack = () => graph3d() && space.views.graph.axis === "time";
|
||
|
||
function chooseAxis(id) {
|
||
if (id === space.views.graph.axis) {
|
||
return;
|
||
}
|
||
setView("graph", {...space.views.graph, axis: id}, false);
|
||
render(false);
|
||
}
|
||
|
||
function stage() {
|
||
if (!graphDom || ui.screen !== "graph") {
|
||
return;
|
||
}
|
||
graphDom.pulses = null;
|
||
if (graph3d()) {
|
||
stageSpace();
|
||
return;
|
||
}
|
||
graphDom.stage.replaceChildren({orbit, chord, swimlane}[ui.graph]());
|
||
}
|
||
|
||
function drawSide() {
|
||
if (graphDom && ui.screen === "graph") {
|
||
graphDom.aside.replaceChildren(...side());
|
||
}
|
||
}
|
||
|
||
function seenView(kind) {
|
||
const glide = space.glides[kind];
|
||
const progress = glide && !calm.matches ? Math.min((performance.now() - glide.start) / GLIDE, 1) : 1;
|
||
if (progress >= 1) {
|
||
space.glides[kind] = null;
|
||
return space.views[kind];
|
||
}
|
||
return Space.tween(kind, glide.from, space.views[kind], Space.ease(progress));
|
||
}
|
||
|
||
function settle(kind) {
|
||
if (space.glides[kind]) {
|
||
space.views[kind] = Space.clampView(kind, seenView(kind));
|
||
space.glides[kind] = null;
|
||
}
|
||
}
|
||
|
||
function setView(kind, next, smooth) {
|
||
space.glides[kind] = smooth && !calm.matches ? {from: seenView(kind), start: performance.now()} : null;
|
||
space.views[kind] = Space.clampView(kind, next);
|
||
space.edits += 1;
|
||
window.clearTimeout(space.timer);
|
||
space.timer = window.setTimeout(persistViews, SAVE_DELAY);
|
||
if (kind === "graph") {
|
||
requestSpace();
|
||
} else {
|
||
redrawSky();
|
||
}
|
||
}
|
||
|
||
const nudge = (kind, change, smooth) => setView(kind, change(space.views[kind]), smooth);
|
||
const savedSpace = () => ({graph: Space.tidy(space.views.graph), sky: Space.tidy(space.views.sky)});
|
||
|
||
async function persistViews() {
|
||
const mark = space.edits;
|
||
if (await saveSettings({...settings, space: savedSpace()}) && space.edits === mark) {
|
||
space.saved = mark;
|
||
}
|
||
}
|
||
|
||
function resetView(kind) {
|
||
setView(kind, kind === "graph" ? {...Space.DEFAULTS.graph, axis: space.views.graph.axis} : {...Space.DEFAULTS.sky}, true);
|
||
}
|
||
|
||
function steerKey(event, kind, hooks) {
|
||
const arrows = {ArrowLeft: [-1, 0], ArrowRight: [1, 0], ArrowUp: [0, -1], ArrowDown: [0, 1]};
|
||
if (event.altKey || event.ctrlKey || event.metaKey) {
|
||
return;
|
||
}
|
||
if (Object.hasOwn(arrows, event.key)) {
|
||
const [x, y] = arrows[event.key];
|
||
if (event.shiftKey && hooks.panStep) {
|
||
hooks.panStep(x, y);
|
||
} else {
|
||
hooks.turnStep(x, y);
|
||
}
|
||
} else if (event.key === "+" || event.key === "=") {
|
||
hooks.zoomStep(ZOOM);
|
||
} else if (event.key === "-" || event.key === "_") {
|
||
hooks.zoomStep(1 / ZOOM);
|
||
} else if (event.key === "0") {
|
||
resetView(kind);
|
||
} else if (event.key === "Escape" && kind === "sky") {
|
||
skyLook(false);
|
||
} else {
|
||
return;
|
||
}
|
||
event.preventDefault();
|
||
event.stopPropagation();
|
||
}
|
||
|
||
function steer(element, kind, hooks) {
|
||
const pointers = new Map();
|
||
let travel = 0;
|
||
let spread = 0;
|
||
const gap = () => {
|
||
const [a, b] = [...pointers.values()];
|
||
return Math.hypot(a.x - b.x, a.y - b.y);
|
||
};
|
||
element.addEventListener("pointerdown", (event) => {
|
||
if (event.pointerType === "mouse" && event.button !== 0) {
|
||
return;
|
||
}
|
||
element.setPointerCapture(event.pointerId);
|
||
pointers.set(event.pointerId, {x: event.clientX, y: event.clientY});
|
||
settle(kind);
|
||
travel = pointers.size === 1 ? 0 : Infinity;
|
||
spread = pointers.size === 2 ? gap() : 0;
|
||
});
|
||
element.addEventListener("pointermove", (event) => {
|
||
const last = pointers.get(event.pointerId);
|
||
if (!last) {
|
||
return;
|
||
}
|
||
const dx = event.clientX - last.x;
|
||
const dy = event.clientY - last.y;
|
||
pointers.set(event.pointerId, {x: event.clientX, y: event.clientY});
|
||
travel += Math.abs(dx) + Math.abs(dy);
|
||
if (pointers.size === 2) {
|
||
const next = gap();
|
||
if (spread > 0 && next > 0) {
|
||
hooks.zoom(next / spread);
|
||
}
|
||
spread = next;
|
||
} else if (pointers.size === 1 && travel > 3) {
|
||
if (event.shiftKey && hooks.pan) {
|
||
hooks.pan(dx, dy);
|
||
} else {
|
||
hooks.rotate(dx, dy);
|
||
}
|
||
}
|
||
});
|
||
const release = (event) => {
|
||
if (!pointers.delete(event.pointerId)) {
|
||
return;
|
||
}
|
||
spread = pointers.size === 2 ? gap() : 0;
|
||
if (event.type === "pointerup" && !pointers.size && travel <= 3 && hooks.pick) {
|
||
const box = element.getBoundingClientRect();
|
||
hooks.pick(event.clientX - box.left, event.clientY - box.top);
|
||
}
|
||
};
|
||
element.addEventListener("pointerup", release);
|
||
element.addEventListener("pointercancel", release);
|
||
element.addEventListener("wheel", (event) => {
|
||
event.preventDefault();
|
||
settle(kind);
|
||
hooks.zoom(Math.exp(-event.deltaY * [1, 16, 400][event.deltaMode] * 0.0015));
|
||
}, {passive: false});
|
||
element.addEventListener("keydown", (event) => steerKey(event, kind, hooks));
|
||
}
|
||
|
||
const graphHooks = {
|
||
rotate: (dx, dy) => nudge("graph", (view) => ({...view, yaw: view.yaw - dx * 0.4, pitch: view.pitch + dy * 0.4}), false),
|
||
pan: (dx, dy) => nudge("graph", (view) => ({...view, pan_x: view.pan_x + dx / (space.cam ? space.cam.scale : 1), pan_y: view.pan_y + dy / (space.cam ? space.cam.scale : 1)}), false),
|
||
zoom: (factor) => nudge("graph", (view) => ({...view, zoom: view.zoom * factor}), false),
|
||
turnStep: (x, y) => nudge("graph", (view) => ({...view, yaw: view.yaw - x * TURN, pitch: view.pitch + y * TURN}), true),
|
||
panStep: (x, y) => nudge("graph", (view) => ({...view, pan_x: view.pan_x + x * NUDGE, pan_y: view.pan_y + y * NUDGE}), true),
|
||
zoomStep: (factor) => nudge("graph", (view) => ({...view, zoom: view.zoom * factor}), true),
|
||
pick: (x, y) => pickSpace(x, y),
|
||
};
|
||
|
||
const skyLens = () => Space.lens(seenView("sky"), window.innerWidth, window.innerHeight);
|
||
|
||
const skyHooks = {
|
||
rotate: (dx, dy) => {
|
||
const sight = skyLens();
|
||
nudge("sky", (view) => ({...view, azimuth: view.azimuth - dx / sight.kx, altitude: view.altitude + dy / sight.ky}), false);
|
||
},
|
||
pan: null,
|
||
zoom: (factor) => nudge("sky", (view) => ({...view, fov: view.fov / factor}), false),
|
||
turnStep: (x, y) => nudge("sky", (view) => ({...view, azimuth: view.azimuth + x * TURN, altitude: view.altitude - y * TURN}), true),
|
||
panStep: null,
|
||
zoomStep: (factor) => nudge("sky", (view) => ({...view, fov: view.fov / factor}), true),
|
||
pick: null,
|
||
};
|