Fluksio/app
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
593 Commits 1 Branch 8 Tags
bfd1358b241903f2870af2147407048b88d825c8
Commit Graph
593 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Melvin StroblandClaude Opus 5.5 bfd1358b24 Name pill held its full 1000 ms once faded in, as the docs and openpanel count it 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ezWcLmBCtTVKFPxfdK2MK
 2026-10-15 10:04:07 +02:00
Melvin Strobl 36fafae065 Merge remote-tracking branch 'origin/main'
Docs / docs (push) Successful in 49s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 4m41s
Details
Playwright Tests / test-playwright (2, 2) (push) Successful in 2m16s
Details
pre-commit / pre-commit (push) Failing after 4m23s
Details
Test Backend / test-backend (push) Failing after 4m54s
Details
Compose Smoke Test / test-compose (push) Successful in 38s
Details
Playwright Tests / merge-reports (push) Successful in 1m41s
Details
2026-10-15 07:47:21 +02:00
Melvin StroblandClaude Opus 5.5 78498cbbf8 Dashboard name pill opaque: the look's card colour with a hairline border, no blur 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ezWcLmBCtTVKFPxfdK2MK
 2026-10-14 22:19:34 +02:00
Melvin StroblandClaude Opus 5.5 2a9b39ddb1 Dashboard name pill on a round panel: 56 high, icon and title at 24, at most 280 wide 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ezWcLmBCtTVKFPxfdK2MK
 2026-10-14 22:16:00 +02:00
stroblmeandClaude Opus 5.5 b18cb30492 Add websocket node: client or served socket, listener or sender
Docs / docs (push) Successful in 26s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 3m56s
Details
Playwright Tests / test-playwright (2, 2) (push) Successful in 2m1s
Details
pre-commit / pre-commit (push) Failing after 2m38s
Details
Test Backend / test-backend (push) Failing after 3m18s
Details
Compose Smoke Test / test-compose (push) Successful in 46s
Details
Playwright Tests / merge-reports (push) Successful in 1m35s
Details 
ws:// and wss:// URLs dial out and hold a supervised connection; a path is
served under /hooks/<flow>/ with an optional secret. Outputs only listen,
inputs send. Frames are JSON keyed by port, with json_key and on_connect.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011CT3mowxKeZywDCH4fS1gt
 2026-10-14 18:42:19 +02:00
Melvin StroblandClaude Opus 5.5 0bf2b12268 Round panel: the dashboards either side drawn in advance and live, on the face they open on, and dragged in up and down as faces are sideways; the name pill only on landing 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 17:20:22 +02:00
Melvin StroblandClaude Opus 5.5 603635f947 Round paging follows the finger: faces and dashboards on a track, swiped one to one with the next beside it, turned or sent back on release, rubber-banded at the ends; keys and dots slide the same track; the reading dot a smaller companion of the handle
Docs / docs (push) Successful in 24s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 4m14s
Details
Playwright Tests / test-playwright (2, 2) (push) Successful in 2m11s
Details
pre-commit / pre-commit (push) Failing after 2m2s
Details
Test Backend / test-backend (push) Failing after 3m23s
Details
Compose Smoke Test / test-compose (push) Successful in 34s
Details
Playwright Tests / merge-reports (push) Successful in 1m33s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 17:08:51 +02:00
Melvin StroblandClaude Opus 5.5 541dbce584 Round faces: a bar as concentric arcs with a legend in the middle; larger title, gap line and face text; Read-only in the ring's gap; a round dashboard unpadded on a phone; reduced-motion ring assertion 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 16:52:46 +02:00
Melvin StroblandClaude Opus 5.5 f5412d2f7d Marks as dots inside the track: ticks, a selector's options and a slider's reading on the track's midline and the ring's centre line, coloured by the fill or the handle over them; the selector ring fills to its option 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 16:42:56 +02:00
Melvin StroblandClaude Opus 5.5 b500af84ec Dashboard motion: round dashboards page up and down, the ring eases to a notch or a reading, the slider tile to a value set elsewhere; reduced motion honoured by every tween; motion spec in the docs 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 16:34:10 +02:00
Melvin StroblandClaude Opus 5.5 5b2769c141 Slider: the set value to its step's decimals; the reading marked on the track and on the ring; mark geometry in the docs 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 16:00:53 +02:00
Melvin StroblandClaude Opus 5.5 a6a1f2a2c3 Slider reading in a tile: a line under the value in every look, row and fader; Beside it on every dashboard; tile geometry in the docs 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 15:51:04 +02:00
Melvin StroblandClaude Opus 5.5 84071ee106 Round dashboards: one face at a time, a face per widget type, paged by swipe, dots and keys; slider reading; face row in the editor 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 15:24:25 +02:00
Melvin StroblandClaude Opus 5.5 8b8cb5cda9 Round dashboards: shape and ring, the ring drawn and turned in every look, Knob preset and face guide in the editor 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 14:23:55 +02:00
Melvin StroblandClaude Opus 5.5 f067fb60d4 Gauge: no value arc at the minimum
Docs / docs (push) Successful in 22s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 3m53s
Details
Playwright Tests / test-playwright (2, 2) (push) Successful in 1m57s
Details
pre-commit / pre-commit (push) Failing after 2m37s
Details
Test Backend / test-backend (push) Failing after 3m6s
Details
Compose Smoke Test / test-compose (push) Successful in 30s
Details
Playwright Tests / merge-reports (push) Successful in 1m55s
Details 
At 0 the value arc is a zero-length dash (pathLength 0), and its round
caps still painted a primary dot on the dial in every look. The arc is
now transparent while its fraction is not above 0. The widget spec puts
a gauge at 0 on its panel and checks it in each look; its tile count,
stale since the buttons widget, is 11.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 12:29:07 +02:00
Melvin StroblandClaude Opus 5.5 3c08e6ef1e Docs: panels without a browser (openpanel), device-interpreted I/O ports
Docs / docs (push) Successful in 29s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 3m48s
Details
Playwright Tests / test-playwright (2, 2) (push) Failing after 2m25s
Details
pre-commit / pre-commit (push) Failing after 2m33s
Details
Test Backend / test-backend (push) Failing after 2m59s
Details
Compose Smoke Test / test-compose (push) Successful in 34s
Details
Playwright Tests / merge-reports (push) Successful in 1m59s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 11:33:27 +02:00
Melvin StroblandClaude Opus 5.5 28a44853e3 Colour widget: commit the value being released 
The brightness column changes and commits in one handler, so the commit
read the render's draft (still null) and sent nothing; the queued draft then
stuck and rode along with the next release. The pending colour lives in a ref
now. color-drag.spec gains a column drag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 08:44:38 +02:00
Melvin StroblandClaude Opus 5.5 340b4f3447 LAN proxy: no 1 MB upload cap 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 08:14:19 +02:00
Melvin StroblandClaude Opus 5.5 3f98fff7e5 Defer ffmpeg in the image; record the decision 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 07:33:59 +02:00
Melvin StroblandClaude Opus 5.5 47d0a42849 Clip transcoding: ffmpeg in the backend image, panel recipe in the node docs 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 07:30:36 +02:00
Melvin StroblandClaude Opus 5.5 c462f9acab Panel I/O: PanelDef.io ports, scoped publish and upload, I/O section in the Panels dialog 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-13 21:10:54 +02:00
stroblme b2aa932b6d docs
Docs / docs (push) Successful in 26s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 4m7s
Details
Playwright Tests / test-playwright (2, 2) (push) Failing after 2m30s
Details
pre-commit / pre-commit (push) Failing after 2m42s
Details
Test Backend / test-backend (push) Failing after 3m3s
Details
Compose Smoke Test / test-compose (push) Successful in 32s
Details
Playwright Tests / merge-reports (push) Successful in 1m51s
Details
2026-10-13 10:02:20 +02:00
stroblmeandClaude Opus 5.5 8d97b8ffaa Open in dashboard: searchable Command list 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 22:07:17 +02:00
stroblmeandClaude Opus 5.5 cfd2556053 Dashboard message picker: searchable combobox instead of a plain select 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 22:06:31 +02:00
stroblmeandClaude Opus 5.5 0ef7d027b8 Dashboard palette: switch dashboard, publish, settings; ⌘S publishes 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 22:05:39 +02:00
stroblmeandClaude Opus 5.5 72b4cf3556 Shared Dock, PublishButton, DiscardButton, DiscardDraftDialog for the flow and dashboard editors 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 22:04:34 +02:00
stroblmeandClaude Opus 5.5 8d158169e5 Button icon-touch/sm-touch sizes replace the repeated touch-target classes 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 22:02:35 +02:00
stroblmeandClaude Opus 5.5 9c75d7ae13 Dashboard add widget: searchable command palette with ⌘P, as on flows 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 21:59:16 +02:00
stroblmeandClaude Opus 5.5 2cfa251036 Docs: getting started mirrors the README quick start
Docs / docs (push) Successful in 20s
Details
pre-commit / pre-commit (push) Failing after 3m28s
Details
Test Backend / test-backend (push) Failing after 3m45s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 21:50:21 +02:00
stroblmeandClaude Opus 5.5 9e7f07e883 Docs: make init in the setup steps
Docs / docs (push) Successful in 22s
Details
pre-commit / pre-commit (push) Failing after 2m35s
Details
Test Backend / test-backend (push) Failing after 3m2s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 21:41:39 +02:00
stroblmeandClaude Opus 5.5 c73c110406 Add make init for a standalone setup
Docs / docs (push) Successful in 23s
Details
pre-commit / pre-commit (push) Canceled after 1m23s
Details
Test Backend / test-backend (push) Canceled after 0s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 21:39:59 +02:00
stroblmeandClaude Opus 5.5 9a84d27347 Embed widget: Image option scales a camera stream to the tile
Docs / docs (push) Successful in 19s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 3m41s
Details
Playwright Tests / test-playwright (2, 2) (push) Failing after 2m21s
Details
pre-commit / pre-commit (push) Failing after 2m36s
Details
Test Backend / test-backend (push) Failing after 2m58s
Details
Compose Smoke Test / test-compose (push) Successful in 31s
Details
Playwright Tests / merge-reports (push) Successful in 1m36s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-11 20:23:37 +02:00
stroblmeandClaude Opus 5.5 022079728c Dashboard icons: add cctv 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-11 20:20:54 +02:00
stroblmeandClaude Opus 5.5 38013a0774 Do not check a pinned certificate's dates
Docs / docs (push) Successful in 32s
Details
Playwright Tests / test-playwright (1, 2) (push) Failing after 6m58s
Details
Playwright Tests / test-playwright (2, 2) (push) Failing after 2m33s
Details
pre-commit / pre-commit (push) Failing after 3m1s
Details
Test Backend / test-backend (push) Failing after 3m13s
Details
Compose Smoke Test / test-compose (push) Successful in 31s
Details
Playwright Tests / merge-reports (push) Successful in 1m34s
Details 
A pin trusts one exact certificate, so an expired one or an engine clock
that is off no longer locks a device out (X509_V_FLAG_NO_CHECK_TIME).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 10:11:08 +02:00
stroblmeandClaude Opus 5.5 c954a0ab6d Lift certificate pinning into the connector contract 
fluksio.flow.connector_tls: trust the certificate a device presented on
first contact, kept in ConnectorNode.store, and name the new fingerprint
when another one is refused. Additive, so no contract version bump; hue
and wfrac use it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:48:24 +02:00
stroblmeandClaude Opus 5.5 25706fedff Portal link: send the instance credential as Authorization: Bearer 
Not ?token= in the tunnel URL, which access logs keep. The hub has to be
upgraded first; websockets>=14 for additional_headers on the asyncio client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:41:44 +02:00
stroblmeandClaude Opus 5.5 5eeeb08be4 Drop --token from the hand-started worker examples 
The worker reads FLUKSIO_WORKER_TOKEN itself; on the command line the
token shows in ps. The --token row in the options table says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:35:00 +02:00
stroblmeandClaude Opus 5.5 cb2a6315c9 Make alert dialog footer buttons 44px below md 
The same treatment `ui/dialog.tsx` got: every footer button is a 44px
target on a phone; desktop keeps its sizes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:32:07 +02:00
stroblmeandClaude Opus 5.5 0869e5b156 Serve index.html no-cache on every route; check the theme script's CSP hash 
`try_files` served the SPA fallback inside `location /`, so `/` and every
client route went out without `Cache-Control: no-cache`. The fallback is now
the last argument, an internal redirect to the exact no-cache location.

`src/csp.check.ts` recomputes the inline theme script's sha256 and fails
`bun run check` with the new value when the CSP no longer names it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:32:06 +02:00
stroblmeandClaude Opus 5.5 8684f27f58 Hand a provisioned worker its token in the environment, not argv 
The generated batch script exported nothing and passed `--token`, which
any user on a shared compute node reads from `ps`. It now exports
FLUKSIO_WORKER_TOKEN after `prerun`, which the worker already reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:32:01 +02:00
stroblmeandClaude Opus 5.5 e85253a3dc Sandbox website tiles by default; opt into same-origin per widget 
A website tile now runs in an opaque origin (allow-scripts, popups, forms).
Its new "Trusted site" setting adds allow-same-origin for sites that need
their own cookies and storage, and a trusted tile pointing at the origin the
app runs on (its own, or the hub's) shows a notice instead of the frame.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 09:31:49 +02:00
stroblmeandClaude Opus 5.5 5259b8db0a Authenticate sockets by header or one-time ticket instead of ?token= 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 08:58:22 +02:00
stroblmeandClaude Opus 5.5 eb45fb2763 Serve artifacts of a type that can run script with CSP sandbox and nosniff 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 08:43:29 +02:00
stroblmeandClaude Opus 5.5 21537e2eb6 Bind a worker's name and labels into its token; list and revoke tokens by jti 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-07 08:42:14 +02:00
stroblmeandClaude Opus 5.5 71b0f986e9 Keep query-string tokens out of the uvicorn, nginx and Traefik access logs 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-06 17:32:51 +02:00
stroblmeandClaude Opus 5.5 1090bcabfd Quote names put into SDK client URL paths; share the helper with MCP 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-06 17:23:49 +02:00
stroblmeandClaude Opus 5.5 847abd67d6 Give connectors a store that survives restarts, and a way to clear it 
`ConnectorNode.store` keeps short strings per connector package in the
engine's database (`connector_state`, migration f8c3e5a91d27), so the nodes of
one package share them and `fluksio serve` needs nothing new: get, set and
delete, at most 64 kB a value and 256 keys a package. A superuser lists the
keys (never the values) and clears them through `/connectors/{node_type}/state`,
or under Stored state in a connector node's panel. Documented in the connector
contract.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-06 17:19:48 +02:00
stroblmeandClaude Opus 5.5 b086d5d22b Show Secrets to superusers only, and guard its route as Admin is 
The page reads GET /secrets/, which is a superuser's, so any other account
opened it onto a permission error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-06 12:33:00 +02:00
stroblmeandClaude Opus 5.5 19efb3a15d Use a placeholder password in the docs; ignore *.pem and *.key 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-06 12:30:57 +02:00
stroblmeandClaude Opus 5.5 6c0ab2049b Send a CSP and security headers from the frontend's nginx 
script-src admits the bundle and the pre-paint theme script by hash, with no
unsafe-inline or unsafe-eval; style-src keeps unsafe-inline for the <style>
elements Monaco, Radix and the toasts insert. frame-ancestors 'self',
nosniff and strict-origin-when-cross-origin go with it, and the Dockerfile
adds the API origin to connect-src when the bundle calls one elsewhere. Zod
runs jitless so its eval probe is not reported on every page. The embed
widget keeps allow-same-origin: the demo's weather map does not render
without it; the comment now says so and what it costs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
 2026-10-06 12:30:47 +02:00