4 Commits

Include renames

Author	SHA1	Message	Date
stroblme	5955dd082e	up ... Signed-off-by: stroblme <stroblme@posteo.de>	2026-08-20 10:30:12 +02:00
Melvin StroblandClaude Fable 5	8d82d6c4ec	Let agents drive the flow API over MCP ... The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-16 00:22:41 +02:00
Melvin StroblandClaude Opus 5	11d491dae0	Keep flow state across a restart, and tighten the flow typing ... The engine fell back to MemoryState because there was no Redis to talk to, so every value was lost on restart. Adds a redis service with append-only persistence, reachable only from the backend, and points REDIS_HOST at it. state.py and pipeline.py leave the strict-mypy exclusion. redis-py types its calls as sync/async unions; the casts narrow that at the points of use rather than switching to redis.asyncio, which would make a deliberately synchronous backend asynchronous. nodes.py stays excluded. The .env.example CORS entry belongs with the CI work that follows. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o	2026-08-15 21:19:21 +02:00
Melvin StroblandClaude Opus 5	1916f7f778	Vendor backend and frontend into the monorepo ... The submodule collapse was only half applied: .gitmodules was deleted but backend/ and frontend/ were still recorded as gitlinks, so none of their files were tracked. Replace the gitlinks with the real trees. Also untrack .env (it carried placeholder secrets) in favour of a tracked .env.example, drop the committed __pycache__, and narrow the blanket *.png ignore that would have swallowed design assets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 15:14:54 +02:00