Four issues found via live testing of the embedded Chat/AIUI panel
(Archipelago phase 02-07 follow-up), each root-caused rather than
patched over:
1. Loading overlay never dismissed: archyBridge.init() used
window.location.origin (this iframe's OWN origin) as the target for
postMessage calls TO the parent, instead of the parent's actual
origin. Silently correct only when AIUI is served same-origin as
its host (production's /aiui/ proxy) — broken the moment AIUI runs
on a different origin than its embedding page (any dev setup with a
separate AIUI dev server). The 'ready' message, and every
permissions/theme/context/action response after it, was being
dropped by the browser. Fixed by deriving the parent's real origin
from document.referrer (archyBridge.ts).
2. White/black background instead of the branded look: initTheme()
decides light/dark from localStorage or the OS's prefers-color-
scheme, with no awareness of being embedded — App.vue now forces
dark immediately on mount when embedded (before any handshake
completes) and useArchy.ts's theme-update callback now applies
Archy's reported mode too. Separately, body had no background-color
at all, so ChatPage.vue's embedded `background: transparent` fell
through to the browser's white UA default; main.css now paints body
to match the active theme. And ChatPage.vue's embedded branch was
opting out of the same background-image treatment the standalone
dark app uses — it now shares that exact styling instead of a flat
fallback color, matching the standalone look precisely.
3. Dead end when no AI provider credential is available: useAI.ts now
emits a narrow, one-shot needsApiKey signal (401/403, "api key",
"unauthorized", or a proxy-unreachable failure — deliberately not
every transient error) that ChatWindow.vue watches to auto-open
Settings, so the user lands on the fix instead of a silent/dead
chat.
4. claude-proxy.ts's CLI fallback spawned a hardcoded ~/.local/bin/claude
path, breaking with ENOENT on any machine where the CLI lives
elsewhere (e.g. an nvm install). Now resolves via `command -v claude`
first (an optional CLAUDE_BIN env override, then the historical path,
then the bare command name as a last resort so spawn() itself can
still try PATH), and surfaces an actionable in-UI error naming three
ways to fix it when none resolve.
Verified: full send→spawn→response round trip against the local proxy
(both directly and through vite's /api/claude proxy), vue-tsc clean,
vitest 332/335 passing (3 pre-existing unrelated failures, confirmed
present before this commit too), production build clean with both
chatExpanded/mobileChat flags and the new background rule present in
the built assets.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The old claude-3-5-haiku-20241022 model ID returns 404 from the Anthropic API.
Updated proxy mapping and test to use claude-haiku-4-5-20251001.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix dev.sh unbound variable crash with ${VITE_DEV_API_TOKEN:-}
- Kill stale proxy on startup instead of skipping (token mismatch)
- Fix RSS middleware blocking all GET requests (check path before auth)
- Read dev auth token lazily from process.env (not cached at import)
- Restore network binding (host: true) for Vite dev server
- Add macOS keychain lookup for Claude Code OAuth token in proxy
- Rewrite proxy streaming to pipe SSE directly instead of await json()
- Prevent double web search (client-side + proxy) in useAI
- Reduce SearXNG timeout 6s→3s and max tries 8→3
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Track accumulated body size during req.on('data') and abort with 413
if it exceeds 1MB, preventing unbounded memory allocation from
oversized payloads.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add sliding-window rate limiter in server/dev-auth.ts (60 req/min reads,
10 req/min writes per IP). Apply checkRateLimit() in all Vite plugins
and claude-proxy.ts after auth validation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create useArchy composable wrapping archyBridge with reactive Vue state
- Initialize bridge in App.vue when ?embedded=true detected
- Inject Archy node context (apps, system, network) into AI system prompt
- Make API paths base-aware (import.meta.env.BASE_URL) for /aiui/ deployment
- Add nginx-archy.conf for production Anthropic API proxy with SSE support
- Fix archyBridge.ts typecheck error, export ActionResponse type
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allows the proxy to spawn claude CLI even when the dev server was
started from within a Claude Code session.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reverts all proxy changes back to the last known working version.
The proxy uses Claude CLI for all requests and only uses the Anthropic
API for web search tool calling when a credential is available.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Removes all OpenRouter proxy code from claude-proxy.ts. The fallback
chain is now just: Anthropic API (key/OAuth) → Claude CLI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When no Anthropic API credential is available, the proxy now falls back
to OpenRouter before trying the Claude CLI. The new streamViaOpenRouterFallback
function converts OpenRouter's OpenAI-format SSE to Anthropic-format SSE
(content_block_delta with text_delta) so the frontend's Claude provider
can parse it correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Redesign MagazineGrid with editorial New Yorker-inspired layout
- Simplify ArticleDetail and ArticleOverlay components
- Enhance claude-proxy with improved content extraction
- Add HTML utility for content processing
- Update NewsCard styling and chat message handling
- Clean up worktree references
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Updated ChatMessage and ChatWindow components to support inline web search results and articles.
- Integrated new web search and RSS plugins into the chat system for real-time information retrieval.
- Enhanced useContentPanel to manage web search results alongside existing media types.
- Added ArticleOverlay component for displaying selected articles from search results.
- Improved UI elements and styles for better user interaction with web search features.
Made-with: Cursor
- Updated the app to support light and dark themes with appropriate CSS classes.
- Enhanced PWA configuration with manifest details and caching strategies.
- Improved the chat UI with dynamic theme adjustments for various components.
- Added new meta tags for better mobile web app experience.
- Refactored environment variables to include new Anthropic token.
- Updated package dependencies for better compatibility and performance.
Made-with: Cursor
