The old claude-3-5-haiku-20241022 model ID returns 404 from the Anthropic API.
Updated proxy mapping and test to use claude-haiku-4-5-20251001.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create useContentImages<T> composable eliminating ~240 lines of duplicated
image loading/fallback logic across 6 grid components
- Fix book covers: use full fetchBookImage chain (Open Library → Google Books → Wikipedia)
- Fix TV series images: try disambiguated Wikipedia title first (e.g. "Chernobyl (TV series)")
- Add Wikipedia image fetching for places (fetchPlaceImage)
- Rewrite all SVG fallbacks to consistent text-only style (no icons)
- Add generateWebsiteFallback for NewsGrid websites variant
- Fix song extraction regex catching raw song_ext: prefix in titles
- Fix player bar: clean song_ext: prefix from display, mute error text
- Fix Code panel: auto-load projects on mount when list is empty
- Improve chat bubble spacing (py-2.5) and first message top margin (pt-6)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Convert "Choose Your Path" screen to informative (read-only cards)
- Harden "Choose Your Setup" (gray out Coming Soon options, auto-select Fresh Start)
- Auto-fetch DID on mount with retry and auto-advance after success
- Improve backup download for mobile compatibility
- Add retry logic to verify step with graceful skip option
- Route verify → done → login for complete onboarding flow
- Add AIUI install confirmation via custom event (SEC-001)
- Add file path whitelist for AIUI file access (SEC-002)
- Add log redaction for container logs sent to AIUI (SEC-003)
- Add Secure flag to session cookie in production (SEC-004)
- Fix ISO build script to handle zstd compression errors gracefully
- Sync archipelago.service from live server
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- TOTP 2FA: full setup/confirm/disable/login flow with Argon2id + ChaCha20-Poly1305
encrypted secret storage, QR code generation, and bcrypt-hashed backup codes
- API key switcher: OAuth vs personal API key toggle in AIUI chat settings with
status indicator, key validation, and help text
- Login progress bar: server startup detection with health check polling, form
disabled until server is ready
- AI quarantine docs: comprehensive HTML page documenting all 6 security layers
- Settings: AI Data Access permission toggles with per-category control
- Alpha hardening plan: 28-task overnight automation plan across 7 phases
(onboarding, login, app install, AIUI, UI polish, security, ISO build)
- Backlog: node discovery spatial map feature for alpha demo
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- loop/prompt-pentest-fix.md: dedicated prompt for pentest fix overnight
runs, instructs Claude to run verify-pentest-fixes.sh as final step
- loop/loop.sh: automatically runs verification script when all plan
tasks are complete (runs for any plan, not just pentest)
Usage: PROMPT_FILE=loop/prompt-pentest-fix.md caffeinate -i ./loop/loop.sh
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- scripts/verify-pentest-fixes.sh: 26-check automated verification
that tests all 21 pentest findings against the live server
- loop/plan.md: add permanent post-fix verification section
- scripts/overnight-loop.sh: accept plan file arg, run verification
after all fixes complete
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix dev.sh unbound variable crash with ${VITE_DEV_API_TOKEN:-}
- Kill stale proxy on startup instead of skipping (token mismatch)
- Fix RSS middleware blocking all GET requests (check path before auth)
- Read dev auth token lazily from process.env (not cached at import)
- Restore network binding (host: true) for Vite dev server
- Add macOS keychain lookup for Claude Code OAuth token in proxy
- Rewrite proxy streaming to pipe SSE directly instead of await json()
- Prevent double web search (client-side + proxy) in useAI
- Reduce SearXNG timeout 6s→3s and max tries 8→3
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Overnight pentest run produced recon, analysis, exploitation reports,
and a full security assessment. Plan.md updated with 22 prioritized
fix items for auth, SSRF, injection, XSS, and hardening.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Require https: protocol for remote content pack imports, rejecting
http:, file:, javascript:, and other schemes. Add schema validation
to verify required fields (id, name, items) and item shape (type,
title) before accepting imported packs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Track accumulated body size during req.on('data') and abort with 413
if it exceeds 1MB, preventing unbounded memory allocation from
oversized payloads.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove --host flag from dev.sh that was overriding vite.config.ts to
bind on 0.0.0.0. Server now defaults to localhost; use VITE_HOST env
var to opt-in to LAN access for mobile testing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
storeApiKey() now throws when encryption is not available instead of
storing keys in plaintext. ApiKeyManager.vue catches the error and
displays a warning message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add sliding-window rate limiter in server/dev-auth.ts (60 req/min reads,
10 req/min writes per IP). Apply checkRateLimit() in all Vite plugins
and claude-proxy.ts after auth validation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Change default allowedOrigin from '*' to null. Derive from
window.location.origin when init() is called without explicit origin.
Always validate event.origin — reject messages when origin is not set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Install dompurify and replace the hand-rolled DOM walker sanitizer
with DOMPurify.sanitize() configured with the same allowed tags.
Handles mutation XSS edge cases the custom version couldn't.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace localStorage.getItem/setItem with storeApiKey/getApiKey/deleteApiKey
from key-vault. Make loadConnection(), connect(), and disconnect() async.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Track accumulated body length during PUT /api/dev-chats and abort
with 413 if payload exceeds 5MB.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add post-DNS SSRF validation using dns.lookup() to verify resolved IPs
are not in private ranges. Block non-http(s) schemes (file://, ftp://)
in discoverFeedUrl(). Extract isPrivateIp() helper for reuse.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add SENSITIVE_PATTERNS denylist to handleRead() in vite-fs.ts.
Blocks access to .env*, .git/, credentials, secrets, .pem, .key,
and SSH key files. Returns 403 for matched paths.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Redesign favicon SVG with gradient border matching splash screen
- Rename all icon files with -v2 suffix to bypass browser/SW/PWA caches
- Delete 9 old/duplicate icon files (~13MB removed)
- Add nginx cache-control headers for icons and manifest
- Rename assets-cache to assets-cache-v2 to orphan stale SW cache
- Update all HTML, manifest, and component icon references
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add VideoPlayerOverlay component for free film playback
- Add GuidePage with interactive node setup walkthrough
- Add freeFilms data catalog with public domain films
- Enhance PlayerBar with video support and queue management
- Add video player store for overlay state management
- Refactor music search plugin (Jamendo integration cleanup)
- Add PWA cache version purge mechanism in main.ts
- Add PWA icon cache fix skill for Brave/Chrome
- Improve content grids: loading states, image fallbacks
- Enhance useArchy composable with node context
- Update useNostr with relay pool management
- Expand chat store with guide conversation support
- Add test fixtures for guide and node demo prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Register bitcoin.rs and lnd.rs modules in mod.rs and add route entries
for bitcoin.getinfo and lnd.getinfo. Add bitcoinInfo ref and context
display to AIUI useArchy.ts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add readFileAsText() to filebrowser client, read-file and tail-logs action
handlers to context broker, bitcoin.getinfo and lnd.getinfo RPC enrichment
for context categories, and update AIUI protocol types.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Moves dynamic pt-20/pt-40 padding from perspective-container-wrapper (which
shrank the content area) to the inner scroll container via computed style.
Removes spacer divs in CloudFolder, AppDetails, MarketplaceAppDetails.
Reduces excessive bottom padding in Marketplace. Hides Cloud/Network tabs
in CloudFolder detail view. Teleports mobile back buttons to body to escape
CSS transform containing block.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The mobile close button uses position: fixed, which breaks inside
a CSS transform containing block. Wrapping in <Teleport to="body">
ensures correct fixed positioning relative to the viewport.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 25 tasks in the overnight loop plan are now [DONE].
Phase 4 research (Capacitor/TWA, StartOS comparison, roadmap)
was documented inline during plan creation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Verified all four integration points on live server:
- AIUI loads in iframe (HTTP 200, embedded mode with postMessage)
- Claude proxy responds (streaming API call successful)
- Context broker sends real data (all 10 categories wired)
- Close button works on mobile (bottom bar) and desktop (top-right pill)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add --cap-drop=ALL, --security-opt=no-new-privileges:true to all
non-privileged containers. Per-app capability grants for apps needing
CHOWN/SETUID/SETGID. Read-only root filesystem with tmpfs for
compatible apps (searxng, grafana, uptime-kuma, filebrowser,
photoprism, vaultwarden). Add Fedimint "Create a Community" goal
with 4-step wizard. Fix deploy script cp -rf for audio directory.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Create DID button generates a did:key identity (tries backend RPC first,
falls back to client-side Web Crypto P-256 key generation). DID stored in
localStorage. Copy DID button for sharing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- --frontend-only skips Rust build and container rebuilds (35s vs 130s)
- SSH connectivity check fails fast if server is unreachable
- Each section now prints elapsed time
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- sanitizeFiles() now fetches real data from FileBrowser (usage, folders, recent files)
- Fixed media state check to include 'running' and 'stopped' states, not just 'installed'
- Removed unused bottomPosition variable in CloudFolder.vue
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a search input to the Apps page that filters installed apps by title,
description, or app ID. Styled consistently with the Marketplace search bar.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Added proxy configurations for Grafana (3000), Jellyfin (8096), Uptime Kuma
(3001), Portainer (9000), OnlyOffice (9980), and all remaining apps (SearXNG,
LND, Mempool, PhotoPrism, Fedimint, Tailscale, Ollama, Bitcoin UI, Electrs,
Endurain, Nginx Proxy Manager, BTCPay, Home Assistant) to the HTTP server
block. Previously these were only available via HTTPS. Also added
client_max_body_size and proxy_request_buffering to the HTTPS filebrowser
snippet for large file uploads.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace hardcoded "All Running", "Connected", "12" in the Network
overview card with computed values from useAppStore. Services status
reflects actual running/total app counts, connectivity uses WebSocket
connection state, and running apps count is live.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Unified the Easy and Pro mode home views into a single tabbed interface.
Both modes now show Dashboard and Setup tabs, replacing the mode-specific
conditional rendering. Added missing homeTab ref that was referenced in
template but never declared.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dynamically builds searchable items from installed packages so typing
an app name in CMD-K finds and launches it via the app launcher overlay.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When localStorage confirms auth, the background revalidation now uses
store.checkSession() directly instead of the 8-second timeout wrapper.
This prevents premature redirects to /login on slow networks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Drag files over the native file browser area to see a drop zone overlay
with dashed orange border. Dropping files triggers the existing upload
handler. Uses debounced dragleave to prevent flicker between children.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add getUsage() method to filebrowser-client that fetches root directory
and returns total size and folder count. Home.vue Cloud card now shows
real storage used and folder count instead of hardcoded values.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
