skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-14 23:26:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

Cross-harness, cross-OS: boot-time tool detection and native-first image gen

Browse Source 
context.mjs now probes cwebp/sips/magick/ffmpeg once (which/where per
OS) and prints IMAGE_TOOLS, replacing macOS-specific prose; the
IMAGE_GEN_AVAILABLE directive leads with the harness-native tool so a
present OpenAI key stops reading as an instruction to bill it; and the
sandboxed board-start guidance sheds codex vocabulary.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Paul Bakaus
2026-07-31 17:54:55 -07:00
co-authored by Claude Fable 5
parent af56fae571
commit b1c5707fde
5 changed files with 47 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skill/scripts/live-server.mjs
+17 -9
View File
@@ -689,16 +689,24 @@ function isLoopbackOrigin(origin) {
function createRequestHandler({ detectScript, liveScriptParts }) {
return (req, res) => {
const url = new URL(req.url, `http://localhost:${state.port}`);
// Loopback-restricted CORS. Reflect the caller's Origin only when it is a
// loopback origin, always paired with `Vary: Origin` so an intermediary
// cache never serves a response authorized for one origin to another. A
// remote page (e.g. https://evil.example probing the port from a tab open
// on the same machine) gets no Access-Control-Allow-Origin, so its
// JS-initiated fetch cannot read any response. Requests with no Origin
// header (script tags, curl, the agent's own fetches) are not subject to
// CORS and keep working; no ACAO header is needed for them.
// Token-or-loopback CORS. Reflect the caller's Origin when it is a
// loopback origin OR the request carries the valid session token, always
// paired with `Vary: Origin` so an intermediary cache never serves a
// response authorized for one origin to another. A remote page (e.g.
// https://evil.example probing the port from a tab open on the same
// machine) has no token and gets no Access-Control-Allow-Origin, so its
// JS-initiated fetch cannot read any response. The token branch exists for
// dev servers on non-localhost loopback aliases (ddev's *.ddev.site,
// Valet's *.test, hosts-file entries): the injected classic <script src>
// delivers the token to the page regardless of origin, every overlay
// request carries it in the query string (preflights included, since
// OPTIONS hits the same URL), and a token bearer is already fully
// authorized on every route — the token is the security boundary, not the
// origin. Requests with no Origin header (script tags, curl, the agent's
// own fetches) are not subject to CORS and keep working; no ACAO header
// is needed for them.
const origin = req.headers.origin;
if (origin && isLoopbackOrigin(origin)) {
if (origin && (isLoopbackOrigin(origin) || url.searchParams.get('token') === state.token)) {
res.setHeader('Access-Control-Allow-Origin', origin);
res.setHeader('Vary', 'Origin');
}