- Fix dev.sh unbound variable crash with ${VITE_DEV_API_TOKEN:-}
- Kill stale proxy on startup instead of skipping (token mismatch)
- Fix RSS middleware blocking all GET requests (check path before auth)
- Read dev auth token lazily from process.env (not cached at import)
- Restore network binding (host: true) for Vite dev server
- Add macOS keychain lookup for Claude Code OAuth token in proxy
- Rewrite proxy streaming to pipe SSE directly instead of await json()
- Prevent double web search (client-side + proxy) in useAI
- Reduce SearXNG timeout 6s→3s and max tries 8→3
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Require https: protocol for remote content pack imports, rejecting
http:, file:, javascript:, and other schemes. Add schema validation
to verify required fields (id, name, items) and item shape (type,
title) before accepting imported packs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Track accumulated body size during req.on('data') and abort with 413
if it exceeds 1MB, preventing unbounded memory allocation from
oversized payloads.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove --host flag from dev.sh that was overriding vite.config.ts to
bind on 0.0.0.0. Server now defaults to localhost; use VITE_HOST env
var to opt-in to LAN access for mobile testing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
storeApiKey() now throws when encryption is not available instead of
storing keys in plaintext. ApiKeyManager.vue catches the error and
displays a warning message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add sliding-window rate limiter in server/dev-auth.ts (60 req/min reads,
10 req/min writes per IP). Apply checkRateLimit() in all Vite plugins
and claude-proxy.ts after auth validation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Change default allowedOrigin from '*' to null. Derive from
window.location.origin when init() is called without explicit origin.
Always validate event.origin — reject messages when origin is not set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Install dompurify and replace the hand-rolled DOM walker sanitizer
with DOMPurify.sanitize() configured with the same allowed tags.
Handles mutation XSS edge cases the custom version couldn't.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace localStorage.getItem/setItem with storeApiKey/getApiKey/deleteApiKey
from key-vault. Make loadConnection(), connect(), and disconnect() async.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Track accumulated body length during PUT /api/dev-chats and abort
with 413 if payload exceeds 5MB.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add post-DNS SSRF validation using dns.lookup() to verify resolved IPs
are not in private ranges. Block non-http(s) schemes (file://, ftp://)
in discoverFeedUrl(). Extract isPrivateIp() helper for reuse.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add SENSITIVE_PATTERNS denylist to handleRead() in vite-fs.ts.
Blocks access to .env*, .git/, credentials, secrets, .pem, .key,
and SSH key files. Returns 403 for matched paths.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add VideoPlayerOverlay component for free film playback
- Add GuidePage with interactive node setup walkthrough
- Add freeFilms data catalog with public domain films
- Enhance PlayerBar with video support and queue management
- Add video player store for overlay state management
- Refactor music search plugin (Jamendo integration cleanup)
- Add PWA cache version purge mechanism in main.ts
- Add PWA icon cache fix skill for Brave/Chrome
- Improve content grids: loading states, image fallbacks
- Enhance useArchy composable with node context
- Update useNostr with relay pool management
- Expand chat store with guide conversation support
- Add test fixtures for guide and node demo prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove CSP meta tag from index.html (breaks Vite HMR, should be
set via HTTP headers in production nginx instead)
- isCryptoEnabled() now checks crypto.subtle is available (undefined
over HTTP on non-localhost origins)
- Add try/catch + error feedback to passphrase submit flow
- PassphraseDialog accepts error prop, focuses input on visible
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- iOS: Capacitor vs WKWebView vs React Native WebView analysis
- Mac: Tauri v2 vs Electron comparison with menu bar app patterns
- Plugins: Signature validation, sandboxed iframes, permission system
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Handles 413 status for files > 1MB with user-friendly error message.
Adds fileLoading and fileError state for loading indicator support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Skips redundant API calls when price was fetched within the last 30
seconds, reducing network requests while keeping data fresh.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uses defineAsyncComponent to lazy load heavy renderers, reducing
initial bundle size. Shows loading text while components load.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates alt attributes to include contextual info: songs include artist,
films include year and director, books include author, TV series include
type label.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents WCAG AA contrast ratios in main.css. Increases text-white/40
to /50 for settings labels, section headers, and loading states to
meet 4.5:1 minimum contrast ratio.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds role="dialog", aria-modal, focus trap, auto-focus close button,
and Escape key handling to ZapDialog and SettingsModal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds descriptive aria-label to card buttons in SongGrid, FilmGrid,
TVSeriesGrid, PlaceGrid, BookGrid, PodcastGrid, NewsGrid, ImageGrid,
and AppsGrid for screen reader accessibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds aria-label to all 6 icon-only buttons in ChatMessage.vue:
edit, regenerate, reply, branch, upvote, downvote.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents how file types map to content surfaces, how ContextBroker
filtering works, and adds a reusable HelpSection UI component.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates vite-fs tree walker to include .claude directories so users
can browse CLAUDE.md, settings, hooks, and memory files.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds /browse route with project listing, recursive file tree with
expand/collapse, and file preview sidebar (desktop) / overlay (mobile).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests keyboard detection, viewport height tracking, debounce behavior.
Includes withSetup test helper for composables with lifecycle hooks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests tab switching, detail open/close, panel state management,
design system mode. 9 test cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests queue management, state transitions, progress computation,
deduplication, and API shape. 9 test cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Restricts script, style, img, connect, media, and frame sources to
known-safe origins. Blocks object embeds and enforces base-uri self.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Configurable origin replaces wildcard '*' for both sending and receiving.
Origin check filters incoming messages when a specific origin is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SSE stream callbacks and AI response parsing now handle malformed data
gracefully instead of throwing unhandled exceptions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Rewrote loop/plan.md with 34 checkbox tasks across 8 phases
- Updated loop/prompt.md for new overnight scope
- Added .claude/commands/overnight.md skill
- Self-destructing dev SW from previous session
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dev mode SW was caching stale responses and breaking page loads.
Disabled devOptions.enabled to prevent SW registration during development.
Added mobile-web-app-capable meta tag (the modern replacement for
apple-mobile-web-app-capable).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The always-on HTTPS plugin prevented HTTP access at the LAN IP.
PWA install requires HTTPS but that should be handled at deploy time,
not in dev config.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
