Fluksio/app
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
160 Commits 1 Branch 6 Tags
a9461770b8ac6b720879e5f3710df711d9f4d684
Commit Graph
4 Commits
Author SHA1 Message Date
stroblme a9461770b8 up
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Details
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
Details
pre-commit / pre-commit (push) Canceled after 0s
Details
Compose Smoke Test / test-compose (push) Canceled after 0s
Details
Playwright Tests / merge-reports (push) Canceled after 0s
Details 
Signed-off-by: stroblme <stroblme@posteo.de>
 2026-08-20 10:30:12 +02:00
Melvin StroblandClaude Fable 5 8d82d6c4ec Let agents drive the flow API over MCP
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Details
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
Details
pre-commit / pre-commit (push) Canceled after 0s
Details
Test Backend / test-backend (push) Canceled after 0s
Details
Compose Smoke Test / test-compose (push) Canceled after 0s
Details
Playwright Tests / merge-reports (push) Canceled after 0s
Details 
The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization
server in front of it: an agent registers itself, sends a human to the browser
to approve it, and exchanges the resulting code for a token. PKCE is required,
codes are single-use and stored only as hashes, the browser is redirected to
the URI that was registered rather than the one asked for, and refresh tokens
rotate so that replaying a spent one revokes the whole line.

Twenty tools cover reading, building, publishing and running flows, and each
one calls the same REST endpoint the dashboard calls, in-process, carrying the
caller's own token. That keeps one description of what a flow is and what may
be done to it — validation, the draft/publish split, the version check — and
means an agent can do nothing a person could not do in the browser.

Agent tokens are RS256 with a keypair of their own rather than the secret that
signs browser sessions, so deleting the key withdraws every agent without
logging anyone out, and deps.decode_token grew the branch that trusting a
second issuer will need when the hosted login arrives.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-16 00:22:41 +02:00
Melvin StroblandClaude Opus 5 11d491dae0 Keep flow state across a restart, and tighten the flow typing 
The engine fell back to MemoryState because there was no Redis to talk
to, so every value was lost on restart. Adds a redis service with
append-only persistence, reachable only from the backend, and points
REDIS_HOST at it.

state.py and pipeline.py leave the strict-mypy exclusion. redis-py types
its calls as sync/async unions; the casts narrow that at the points of
use rather than switching to redis.asyncio, which would make a
deliberately synchronous backend asynchronous. nodes.py stays excluded.

The .env.example CORS entry belongs with the CI work that follows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o
 2026-08-15 21:19:21 +02:00
Melvin StroblandClaude Opus 5 1916f7f778 Vendor backend and frontend into the monorepo 
The submodule collapse was only half applied: .gitmodules was deleted but
backend/ and frontend/ were still recorded as gitlinks, so none of their
files were tracked. Replace the gitlinks with the real trees.

Also untrack .env (it carried placeholder secrets) in favour of a tracked
.env.example, drop the committed __pycache__, and narrow the blanket *.png
ignore that would have swallowed design assets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-09 15:14:54 +02:00