Skip to content

Ready for the public: security, long histories, a second demo, docs - #1

Merged
andududu merged 3 commits into
mainfrom
open-source-prep
Sep 21, 2026
Merged

andududu merged 3 commits into
mainfrom
open-source-prep

Conversation

@andududu

Copy link
Copy Markdown
Owner

Everything from the pre-public pass, in three commits.

Server

  • A web page on another site could send Jev requests through Jeview with the stored key. Such requests are now refused (403) before Jev, unrecorded; the API refuses cross-site requests; Jev's CORS headers are no longer relayed. Programs that are not pages are unaffected. Tested.
  • Nothing is held in memory: history is read from SQLite a page at a time (?since, ?latest, ?ids). Existing cursors stay valid.
  • Call ids are counted in the database, so two Jeviews can share a data folder.
  • llms.txt rewritten and checked line by line against the code.

Viewer

  • Fixed: one slow frame as a ball landed threw in arc() (negative radius) and froze the map for good. Reproduced under CPU throttling, fixed, and the drawing loop now survives any failed frame.
  • First-visit welcome, click-away closes panels, simpler key panel with a key icon, solid recent-calls panel, Deduplicate on by default.
  • Opens on the latest 20,000 calls; older ones are fetched when search, a link or a trigger names them.

Demos and docs

  • New Support Desk demo (npm run demo:support).
  • Pixel Knight fits a half-screen window.
  • launch.sh, a README for the public (unofficial, both demos, data and how to erase it), hero image.
  • CI: read-only token, and the browser scripts are checked for syntax.

10 tests pass locally; typecheck clean.

🤖 Generated with Claude Code

andududu and others added 3 commits September 21, 2026 20:12
… to hold

- A web page on another site could POST a Jev request here without asking
  first, and it went out with the stored key. Requests that name a foreign
  Origin are now refused before Jev and left unrecorded, the API refuses
  what a browser marks as cross-site, and Jev's own CORS grants are no
  longer passed on. Callers that are not pages send no Origin and are
  untouched.
- Nothing is held in memory any more. Summaries are read from SQLite a page
  at a time (?since, ?latest, ?ids, with "cursor" and "more"), so starting
  up and opening the viewer cost the same at a thousand calls as at a
  million. Positions from existing databases stay valid.
- Call ids are counted in the database in one statement, and stay ahead of
  every id already saved, so two Jeviews may share a data folder and each
  shows the calls of both.
- llms.txt says what Jeview is (a gateway, not a model), what it stores and
  where, how its refusals look, and the limits of the read API.
- flush() had no callers and save() was synchronous behind a promise.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…longer stop the map

- A landing was stamped during a frame and aged against the frame's start,
  so a frame that ran late gave it a negative age, a negative radius, and
  an exception in arc(). The drawing loop scheduled itself on its last
  line, so that one frame froze the map for good while the list went on
  counting. Ages no longer go below zero, and a frame that fails is
  logged, the canvas put back, and the next one drawn.
- The first visit in a browser opens on what Jeview is and how to use it,
  and a press anywhere else closes any of the panels.
- The key panel is the key and nothing else: the field shows the key that
  is set, masked but for its ending, and the button that opens it is a key.
- The page opens on the latest 20,000 calls and reads them a page at a
  time; search, links and triggers fetch older calls when they name them.
- An empty viewer's first call flies in like any other, instead of being
  redrawn once a second.
- The list of recent calls is solid and fades into itself, so the map no
  longer shows through it, and Deduplicate starts on.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Support Desk is a second demo: a made-up support chat that Jev triages
  through Jeview. It reads each message once, and the answers lead on: the
  topic decides the team, a doubtful topic is read again, an upset customer
  may get a credit, a how-to gets its article, and a message about nothing
  we do is checked for spam. The replies are templates filled in with what
  Jev decided, and the page says so.
- Pixel Knight fits half a screen beside Jeview without scrolling, which is
  how the README says to watch it.
- launch.sh finds a Node that is new enough (on the PATH, from nvm or from
  Homebrew), starts Jeview from where you stand and opens the viewer.
- The README says Jeview is unofficial, what it is, how to run both demos,
  how to pass options, what is stored and where, and how to erase it.
- CI runs with a read-only token and checks that the browser scripts parse.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@andududu
andududu merged commit 014a2af into main Sep 21, 2026
2 checks passed
@andududu
andududu deleted the open-source-prep branch September 21, 2026 19:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant