[FEAT] Web connection capture: connect widget + pending-connection routes - #1
Merged
Merged
Conversation
…utes Rescues uncommitted work that existed only on local disk — this branch had no commits of its own and no remote. - src/connect-widget/main.ts + scripts/build-connect-widget.mjs: browser widget for capturing provider credentials, built to public/connect-widget.js (generated, now gitignored) - connections-routes.js (+ tests): pending-connection endpoints - migrations/002_pending_connections.sql: pending_connections table - server.js / server-security.js: route mounting and hardening Server-side counterpart to canopy PR #29 (web-hosted API key capture). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The file was written but never added to the npm test script, so its four tests — including the ones proving the ephemeral key is fresh per call and that tampered ciphertext fails AEAD verification — had never run in CI. They pass; suite is 53 green. It is the JS half of a cross-repo pair: canopy's js_interop_check test pins a ciphertext produced by this exact module. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Server-side counterpart to canopy PR #29 (web-hosted API key capture).
Rescued from a worktree that had no commits of its own and no remote — all of this existed only as uncommitted changes on local disk, and its branch was mistracking
origin/mainas upstream so nothing would ever have reported it as unpushed.What's here
src/connect-widget/main.ts+scripts/build-connect-widget.mjs— browser widget that encrypts the pasted key to the requesting Canopy install's X25519 public key before it leaves the page (ECDH → HKDF-SHA256 → ChaCha20-Poly1305). canopy-admin only ever sees ciphertext. Built topublic/connect-widget.js, which is generated and now gitignored.connections-routes.js(+ tests) — pending-connection endpointsmigrations/002_pending_connections.sql—pending_connectionstableserver.js/server-security.js— route mounting and hardeningVerification
npm test→ 53 passing. A follow-up commit wiresconnect-widget.test.jsinto the test script; it had been written but never run.Its Rust counterpart pins a ciphertext produced by this exact module — see canopy PR #94.
🤖 Generated with Claude Code