Three improvements bundled because they all ship as zddc-server v0.0.2: * /.admin/ debug dashboard with /whoami, /config, /logs sub-routes. Authorization via a top-level `admins:` glob list in <ZDDC_ROOT>/.zddc (root-only — subdir entries deliberately ignored to prevent privilege escalation via subtree write access). Non-admin requests get 404 so the page is invisible. Recent logs surface via a 500-entry slog ring buffer teed off the existing TextHandler. Lets operators debug without kubectl exec. * Default ZDDC_EMAIL_HEADER changes from `X-Email` to `X-Auth-Request-Email` — the oauth2-proxy / nginx auth-request convention that the TND helm chart already sets explicitly. Operators who set the env var explicitly are unaffected; deployments relying on the previous default need to set ZDDC_EMAIL_HEADER=X-Email or update their proxy. * dispatch() rejects any URL whose segments contain a dot prefix other than the recognized virtual prefixes (.admin, cfg.IndexPath / .archive). Matches the existing listing-pipeline filter so hidden subtrees on the served PVC (e.g. /srv/.devshell — used by the in-cluster dev-shell for persistent home-dir state) become unreachable via direct HTTP fetch, not just hidden in listings. Refreshes the X-Email reference in website/index.html accordingly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5 KiB
5 KiB
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Authoritative docs — read these first
This repo already has two thorough agent-facing references. Always consult them before working — they cover details intentionally omitted here:
AGENTS.md— commands, build-system rules, per-tool parser quirks, testing gotchas, git/worktree workflow, release process, zddc-server notesARCHITECTURE.md— single-file HTML pattern rationale, JS module/state patterns, per-tool architecture, security model
If something in this CLAUDE.md conflicts with those, those win — and please update them rather than letting drift accumulate.
Repo shape
This is a monorepo of independent tools, not one application:
archive/,transmittal/,classifier/,mdedit/,landing/— five self-contained HTML tools, each compiled to a single inlined HTML file in its owndist/. Naming: the first four outputdist/tool.html;landing/outputsdist/index.html(it's the project picker served at the root ofzddc-server).zddc/— Go HTTP server (separate sub-project, podman/podman-compose; Go 1.24+). ServesZDDC_ROOT/index.htmlatGET /as the landing page;Accept: application/jsonon/returns the ACL-filtered project list.shared/—base.cssplus shared JS modules (zddc.js,hash.js,zddc-filter.js,theme.js,help.js) included by every tool's build, andbuild-lib.sh(POSIX sh helpers sourced by every tool'sbuild.sh)website/— published artifacts:index.html(root URL),releases/<tool>_v<X.Y.Z>.html(immutable stable archives),releases/<tool>_stable.html(symlink to current stable),releases/<tool>_{alpha,beta}.html(mutable channel files), plus bootstrap zips (install.zip,track-{alpha,beta,stable}.zip).--releaseis the only path to publishing — there is nowebsite/dev/.tests/— Playwright specs (Chromium only, requires File System Access API).tests/schema.spec.jsvalidatestransmittal.schema.jsonagainst canonical fixtures viaajv(only dev dep besides Playwright)
Most-used commands
sh build.sh # build all five HTML tools (dist/ only)
sh tool/build.sh # build one (archive|transmittal|classifier|mdedit|landing)
sh tool/build.sh --release [version] # cut stable; tag, write website/releases/<tool>_v<ver>.html, refresh _stable symlink
sh tool/build.sh --release alpha|beta # cut channel build; overwrites website/releases/<tool>_<channel>.html (mutable, no tag)
npm test # all Playwright specs (build first!)
npx playwright test <tool> # one spec
./dev-server start # ./dev-server stop # cache-busting HTTP on :8000
No lint/typecheck/format commands exist — vanilla JS + POSIX sh by design.
Things that bite if you forget
dist/is gitignored but force-committed (git add -f tool/dist/tool.html). Never hand-edit adist/file.- Never write to
website/index.html,website/releases/<tool>_v*.html,website/releases/<tool>_stable.html, orwebsite/releases/<tool>_beta.htmldirectly — promote viash tool/build.sh --release [version|alpha|beta]. Stable releases writewebsite/releases/<tool>_v<ver>.html(immutable) and refresh<tool>_stable.html; alpha/beta overwrite<tool>_<channel>.htmlin place. Exception:<tool>_alpha.htmlfiles — every plaintool/build.shreasserts them as relative symlinks into<tool>/dist/, so dev builds stay clean in git.--release alphaoverwrites the symlink with a real file; the next plain build re-symlinks. - Always build before running tests — Playwright opens
dist/tool.htmlviafile://. </in JS string/template literals breaks inline<script>embedding.shared/build-lib.shprovidesescape_js_close_tags; every tool'sbuild.shruns JS through it before inlining.- All ZDDC parsing/formatting/hashing goes through
window.zddc(fromshared/zddc.js+shared/hash.js+shared/zddc-filter.js). API:parseFilename,parseFolder,parseRevision,formatFilename,formatFolder,compareRevisions,isValidStatus,splitExtension,joinExtension,crypto.{sha256Hex, sha256String, sha256File, bytesToHex},filter.{parse, matches}. File objects across tools usetrackingNumber(string) andextension(string, no leading dot — usezddc.joinExtension(name, ext)to build a filename). Add edge cases totests/zddc.spec.js, not per-tool tests. - Two globals only:
window.app(per-tool app state + modules) andwindow.zddc(shared library). No others — anything that crosses tool boundaries goes through one of these. - Worktrees live at
~/src/zddc-<branch>. Checkgit worktree listbefore starting a feature branch; nevergit checkout/switchinside a worktree another agent might be using. - Build scripts are POSIX
shwithset -eu, not bash.concat_filestakes positional args only.