4 Commits

Include renames

Author	SHA1	Message	Date
stroblmeandClaude Opus 5	32d8b42682	Dashboard: run unchanged when a portal serves it ... The same bundle is served by a portal under /i/{id}, so it reads its API base, credential and router basepath from an injected config instead of the build-time URL and localStorage. A normal installation finds no config and behaves exactly as before; the credential deliberately never touches localStorage, since two installations open in one browser share an origin and would overwrite each other's session. The websocket URL was resolving an absolute path against the base, which discards the base's own path — harmless until the base gained one, then it aimed the socket at the wrong host entirely. Connection state gets a store of its own, apart from the engine's: the proxy's 503 carries {offline, last_seen}, which raises a banner naming when the installation was last heard from and turns a failed mutation into 'not delivered' rather than a generic error. The screen keeps its last data underneath, since stale readings with a timestamp beat a blank page. A reconnecting socket invalidates every query, because whatever happened while it was down was missed. Verified in a browser against a real hub and installation: the full UI loads through the tunnel with no console errors, and killing the installation raises the banner within a poll. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XtBzdDyLsmDaF1W7DLYtYM	2026-08-19 17:09:53 +02:00
stroblmeandClaude Fable 5	be6d4fc13c	Build dashboards you can actually look at and press ... Widgets bind to a message name and read it live off the socket the editor already had — lifted out of the flow editor so a dashboard route gets the same values, which also gives the home page live data for free. The input widgets close the loop the other way: a slider publishes into the graph and whatever consumes that message runs. Verified end to end in the running app — moving a slider set a flow input, and the stat bound to what the flow computed from it followed. View mode is plain CSS grid. A wall panel that only displays should not download the code that lets someone drag things around, and it now does not. Editing is a widget picker, a per-widget width control and a settings card fed by the message catalog. No new dependencies: the slider is a range input, the gauge is an arc, and the markdown is a five-line subset. Charts are the one widget still missing — they need a charting library and the chart tokens the design guidelines reserved — so they are stored and validated but not offered. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011LF61rxW1FG5YCD2J9YqjY	2026-08-16 09:33:02 +02:00
Melvin StroblandClaude Fable 5	8d82d6c4ec	Let agents drive the flow API over MCP ... The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-16 00:22:41 +02:00
Melvin StroblandClaude Opus 5	1916f7f778	Vendor backend and frontend into the monorepo ... The submodule collapse was only half applied: .gitmodules was deleted but backend/ and frontend/ were still recorded as gitlinks, so none of their files were tracked. Replace the gitlinks with the real trees. Also untrack .env (it carried placeholder secrets) in favour of a tracked .env.example, drop the committed __pycache__, and narrow the blanket *.png ignore that would have swallowed design assets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 15:14:54 +02:00