Add SENSITIVE_PATTERNS denylist to handleRead() in vite-fs.ts.
Blocks access to .env*, .git/, credentials, secrets, .pem, .key,
and SSH key files. Returns 403 for matched paths.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add VideoPlayerOverlay component for free film playback
- Add GuidePage with interactive node setup walkthrough
- Add freeFilms data catalog with public domain films
- Enhance PlayerBar with video support and queue management
- Add video player store for overlay state management
- Refactor music search plugin (Jamendo integration cleanup)
- Add PWA cache version purge mechanism in main.ts
- Add PWA icon cache fix skill for Brave/Chrome
- Improve content grids: loading states, image fallbacks
- Enhance useArchy composable with node context
- Update useNostr with relay pool management
- Expand chat store with guide conversation support
- Add test fixtures for guide and node demo prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove CSP meta tag from index.html (breaks Vite HMR, should be
set via HTTP headers in production nginx instead)
- isCryptoEnabled() now checks crypto.subtle is available (undefined
over HTTP on non-localhost origins)
- Add try/catch + error feedback to passphrase submit flow
- PassphraseDialog accepts error prop, focuses input on visible
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- iOS: Capacitor vs WKWebView vs React Native WebView analysis
- Mac: Tauri v2 vs Electron comparison with menu bar app patterns
- Plugins: Signature validation, sandboxed iframes, permission system
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Handles 413 status for files > 1MB with user-friendly error message.
Adds fileLoading and fileError state for loading indicator support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Skips redundant API calls when price was fetched within the last 30
seconds, reducing network requests while keeping data fresh.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uses defineAsyncComponent to lazy load heavy renderers, reducing
initial bundle size. Shows loading text while components load.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates alt attributes to include contextual info: songs include artist,
films include year and director, books include author, TV series include
type label.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents WCAG AA contrast ratios in main.css. Increases text-white/40
to /50 for settings labels, section headers, and loading states to
meet 4.5:1 minimum contrast ratio.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds role="dialog", aria-modal, focus trap, auto-focus close button,
and Escape key handling to ZapDialog and SettingsModal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds descriptive aria-label to card buttons in SongGrid, FilmGrid,
TVSeriesGrid, PlaceGrid, BookGrid, PodcastGrid, NewsGrid, ImageGrid,
and AppsGrid for screen reader accessibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds aria-label to all 6 icon-only buttons in ChatMessage.vue:
edit, regenerate, reply, branch, upvote, downvote.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents how file types map to content surfaces, how ContextBroker
filtering works, and adds a reusable HelpSection UI component.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates vite-fs tree walker to include .claude directories so users
can browse CLAUDE.md, settings, hooks, and memory files.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds /browse route with project listing, recursive file tree with
expand/collapse, and file preview sidebar (desktop) / overlay (mobile).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests keyboard detection, viewport height tracking, debounce behavior.
Includes withSetup test helper for composables with lifecycle hooks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests tab switching, detail open/close, panel state management,
design system mode. 9 test cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests queue management, state transitions, progress computation,
deduplication, and API shape. 9 test cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Restricts script, style, img, connect, media, and frame sources to
known-safe origins. Blocks object embeds and enforces base-uri self.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Configurable origin replaces wildcard '*' for both sending and receiving.
Origin check filters incoming messages when a specific origin is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SSE stream callbacks and AI response parsing now handle malformed data
gracefully instead of throwing unhandled exceptions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Rewrote loop/plan.md with 34 checkbox tasks across 8 phases
- Updated loop/prompt.md for new overnight scope
- Added .claude/commands/overnight.md skill
- Self-destructing dev SW from previous session
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dev mode SW was caching stale responses and breaking page loads.
Disabled devOptions.enabled to prevent SW registration during development.
Added mobile-web-app-capable meta tag (the modern replacement for
apple-mobile-web-app-capable).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The always-on HTTPS plugin prevented HTTP access at the LAN IP.
PWA install requires HTTPS but that should be handled at deploy time,
not in dev config.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Root container height now bound to visualViewport.height when keyboard
is open — the whole layout shrinks instead of being pushed offscreen
- Tab bar gets 24px vertical margin (12px top + 12px bottom + safe area)
- Added @vitejs/plugin-basic-ssl for HTTPS dev server — required for PWA
install on non-localhost origins (LAN IP access)
- Improved useVisualViewport to track fullHeight for accurate keyboard
offset calculation across orientation changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Lock viewport: position:fixed on html/body prevents iOS bounce scroll
- No zoom on input focus: maximum-scale=1, user-scalable=no
- Keyboard-responsive chat: visualViewport API detects keyboard, hides
tab bar, scrolls chat to bottom, scrollIntoView on input focus
- iOS HIG tab bar: 49pt height, vertical icon+label, safe-area-inset-bottom
- PWA fix: manifest start_url/scope/id changed from '/' to './' for
subpath deployment compatibility
- PlayerBar: variant prop (fixed/inline), inline on mobile above tab bar,
fixed on desktop. No more overlap with tab bar.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The from-black/60 gradient overlay was making SVG text fallbacks appear
completely black. Now the gradient only renders when there's an actual
image, letting the designed SVG fallbacks show through properly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 8 SVG generators (song, podcast, news, image, film, TV, book, place)
had backgrounds at 9-10% lightness which appeared black under grid gradient
overlays. Bumped to 18% with proportionally brighter text and icons.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Songs: 19/21 now have iTunes album art URLs (2 niche Bitcoin artists use fallback)
- Podcasts: 21/21 now have iTunes artwork URLs
- News: 21/21 now have Unsplash topic images
- Books: Fixed The Network State cover URL
- Places: 21/21 now have photos (Unsplash + Wikimedia)
- Added generateNewsFallback() and generateImageFallback() SVG generators
- Updated NewsCard, NewsGrid, ImageCard to use SVG text fallback instead of emoji
- Added error handling to PlaceCard and PlaceGrid for failed photo loads
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The news tab was missing because hasNews evaluated to false when web
search results hadn't arrived yet. Now shows the tab eagerly for news
queries — results populate when they arrive via the deep watcher.
Also fixes RSS late-insertion to place before the Prompt tab.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Prompt tab now renders the full AI response using magazine extraction
(extractMagazineSections) to create nicely formatted tiles. The user's
query appears as the hero headline, and the response is broken into
styled sections — same as the Brief tab but always available.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a 'Prompt' tab that is always present as the rightmost tab in the
content panel. Shows the user's original query as a single magazine-style
tile using the existing MagazineGrid component.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 15 seed prompts now load as one conversation ("Content Showcase")
instead of 15 separate ones. /seed collapses chat to show PromptIndex
so users can quickly pick any prompt to see its content surface.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Chat aside has z-[100], PlayerBar had z-50 so it rendered underneath.
Bumped to z-[999] to ensure the player always floats above all panels.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
