Track accumulated body size during req.on('data') and abort with 413
if it exceeds 1MB, preventing unbounded memory allocation from
oversized payloads.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove --host flag from dev.sh that was overriding vite.config.ts to
bind on 0.0.0.0. Server now defaults to localhost; use VITE_HOST env
var to opt-in to LAN access for mobile testing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
storeApiKey() now throws when encryption is not available instead of
storing keys in plaintext. ApiKeyManager.vue catches the error and
displays a warning message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add sliding-window rate limiter in server/dev-auth.ts (60 req/min reads,
10 req/min writes per IP). Apply checkRateLimit() in all Vite plugins
and claude-proxy.ts after auth validation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Change default allowedOrigin from '*' to null. Derive from
window.location.origin when init() is called without explicit origin.
Always validate event.origin — reject messages when origin is not set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Install dompurify and replace the hand-rolled DOM walker sanitizer
with DOMPurify.sanitize() configured with the same allowed tags.
Handles mutation XSS edge cases the custom version couldn't.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace localStorage.getItem/setItem with storeApiKey/getApiKey/deleteApiKey
from key-vault. Make loadConnection(), connect(), and disconnect() async.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Track accumulated body length during PUT /api/dev-chats and abort
with 413 if payload exceeds 5MB.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add post-DNS SSRF validation using dns.lookup() to verify resolved IPs
are not in private ranges. Block non-http(s) schemes (file://, ftp://)
in discoverFeedUrl(). Extract isPrivateIp() helper for reuse.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add SENSITIVE_PATTERNS denylist to handleRead() in vite-fs.ts.
Blocks access to .env*, .git/, credentials, secrets, .pem, .key,
and SSH key files. Returns 403 for matched paths.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add VideoPlayerOverlay component for free film playback
- Add GuidePage with interactive node setup walkthrough
- Add freeFilms data catalog with public domain films
- Enhance PlayerBar with video support and queue management
- Add video player store for overlay state management
- Refactor music search plugin (Jamendo integration cleanup)
- Add PWA cache version purge mechanism in main.ts
- Add PWA icon cache fix skill for Brave/Chrome
- Improve content grids: loading states, image fallbacks
- Enhance useArchy composable with node context
- Update useNostr with relay pool management
- Expand chat store with guide conversation support
- Add test fixtures for guide and node demo prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove CSP meta tag from index.html (breaks Vite HMR, should be
set via HTTP headers in production nginx instead)
- isCryptoEnabled() now checks crypto.subtle is available (undefined
over HTTP on non-localhost origins)
- Add try/catch + error feedback to passphrase submit flow
- PassphraseDialog accepts error prop, focuses input on visible
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Handles 413 status for files > 1MB with user-friendly error message.
Adds fileLoading and fileError state for loading indicator support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Skips redundant API calls when price was fetched within the last 30
seconds, reducing network requests while keeping data fresh.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uses defineAsyncComponent to lazy load heavy renderers, reducing
initial bundle size. Shows loading text while components load.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates alt attributes to include contextual info: songs include artist,
films include year and director, books include author, TV series include
type label.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents WCAG AA contrast ratios in main.css. Increases text-white/40
to /50 for settings labels, section headers, and loading states to
meet 4.5:1 minimum contrast ratio.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds role="dialog", aria-modal, focus trap, auto-focus close button,
and Escape key handling to ZapDialog and SettingsModal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds descriptive aria-label to card buttons in SongGrid, FilmGrid,
TVSeriesGrid, PlaceGrid, BookGrid, PodcastGrid, NewsGrid, ImageGrid,
and AppsGrid for screen reader accessibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds aria-label to all 6 icon-only buttons in ChatMessage.vue:
edit, regenerate, reply, branch, upvote, downvote.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents how file types map to content surfaces, how ContextBroker
filtering works, and adds a reusable HelpSection UI component.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates vite-fs tree walker to include .claude directories so users
can browse CLAUDE.md, settings, hooks, and memory files.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds /browse route with project listing, recursive file tree with
expand/collapse, and file preview sidebar (desktop) / overlay (mobile).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests keyboard detection, viewport height tracking, debounce behavior.
Includes withSetup test helper for composables with lifecycle hooks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests tab switching, detail open/close, panel state management,
design system mode. 9 test cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests queue management, state transitions, progress computation,
deduplication, and API shape. 9 test cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Restricts script, style, img, connect, media, and frame sources to
known-safe origins. Blocks object embeds and enforces base-uri self.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Configurable origin replaces wildcard '*' for both sending and receiving.
Origin check filters incoming messages when a specific origin is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SSE stream callbacks and AI response parsing now handle malformed data
gracefully instead of throwing unhandled exceptions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Rewrote loop/plan.md with 34 checkbox tasks across 8 phases
- Updated loop/prompt.md for new overnight scope
- Added .claude/commands/overnight.md skill
- Self-destructing dev SW from previous session
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dev mode SW was caching stale responses and breaking page loads.
Disabled devOptions.enabled to prevent SW registration during development.
Added mobile-web-app-capable meta tag (the modern replacement for
apple-mobile-web-app-capable).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The always-on HTTPS plugin prevented HTTP access at the LAN IP.
PWA install requires HTTPS but that should be handled at deploy time,
not in dev config.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Root container height now bound to visualViewport.height when keyboard
is open — the whole layout shrinks instead of being pushed offscreen
- Tab bar gets 24px vertical margin (12px top + 12px bottom + safe area)
- Added @vitejs/plugin-basic-ssl for HTTPS dev server — required for PWA
install on non-localhost origins (LAN IP access)
- Improved useVisualViewport to track fullHeight for accurate keyboard
offset calculation across orientation changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Lock viewport: position:fixed on html/body prevents iOS bounce scroll
- No zoom on input focus: maximum-scale=1, user-scalable=no
- Keyboard-responsive chat: visualViewport API detects keyboard, hides
tab bar, scrolls chat to bottom, scrollIntoView on input focus
- iOS HIG tab bar: 49pt height, vertical icon+label, safe-area-inset-bottom
- PWA fix: manifest start_url/scope/id changed from '/' to './' for
subpath deployment compatibility
- PlayerBar: variant prop (fixed/inline), inline on mobile above tab bar,
fixed on desktop. No more overlap with tab bar.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The from-black/60 gradient overlay was making SVG text fallbacks appear
completely black. Now the gradient only renders when there's an actual
image, letting the designed SVG fallbacks show through properly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 8 SVG generators (song, podcast, news, image, film, TV, book, place)
had backgrounds at 9-10% lightness which appeared black under grid gradient
overlays. Bumped to 18% with proportionally brighter text and icons.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Songs: 19/21 now have iTunes album art URLs (2 niche Bitcoin artists use fallback)
- Podcasts: 21/21 now have iTunes artwork URLs
- News: 21/21 now have Unsplash topic images
- Books: Fixed The Network State cover URL
- Places: 21/21 now have photos (Unsplash + Wikimedia)
- Added generateNewsFallback() and generateImageFallback() SVG generators
- Updated NewsCard, NewsGrid, ImageCard to use SVG text fallback instead of emoji
- Added error handling to PlaceCard and PlaceGrid for failed photo loads
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The news tab was missing because hasNews evaluated to false when web
search results hadn't arrived yet. Now shows the tab eagerly for news
queries — results populate when they arrive via the deep watcher.
Also fixes RSS late-insertion to place before the Prompt tab.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
