Repository navigation
Run the library workflow in a browser without Electron - #156
Conversation
The existing Angular UI now starts and works in Google Chrome against the storage service. The desktop app keeps working. Frontend boundaries (src/kc_angular/src/app/platform): - Platform, BackendService, SettingsStore, WindowControls, NativeFiles, and ManagedFiles each have a desktop and a browser implementation, chosen once at startup. - Desktop-only services no longer throw without the Electron bridge. - IDs come from crypto.randomUUID() instead of IPC. - Both clients import files the same way: upload the selected File with POST /v1/assets and store the asset ID. The desktop adds the original path as metadata. Path-based copy stays for watched folders. - Desktop-only actions are hidden or disabled in the browser with a reason: website saving and examples, chat, embedded browser, import settings, window controls, open in default app, show in folder, file thumbnails and icons, drag-out. - The browser never fetches other websites from the page. - kc_shared no longer imports an Angular model. The @shared path alias in kc_electron/tsconfig.json is no longer needed and is removed. Default settings come from a shared createDefaultSettings(). Backend (kc_storage): - --web-root serves the built UI (SPA fallback, base href "/", CSP). - Browser sessions: one-time launch codes from bearer clients, HttpOnly SameSite=Strict per-port cookie, CSRF token, own-Origin check for writes, Sec-Fetch-Site check, idle and maximum age, logout. - GET /v1/assets/<id>/content/<filename> keeps the filename. Only PDF, raster images, and text show inline; text is text/plain; other files are downloads; non-PDF content gets a sandbox CSP. yarn browser (scripts/start-browser.mjs) starts the service and prints a launch link. Tests: 6 service tests for sessions and UI serving, and e2e/browser/library.e2e.mjs (yarn e2e-browser) in Chrome. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RobRoyce
left a comment
RobRoyce
left a comment
There was a problem hiding this comment.
Focused integration review of PR #156 at 75e0adc93e64d3a32f2629271649878f4051cd56.
No confirmed blocking finding in the combined revival stack. The independent code review checked storage writes, schema migration, managed files, backup/restore, local authentication, session recovery, Electron startup, and dependency removal. Main's conflicts were resolved without downgrading the stack's dependencies. All original commits are preserved.
Validation on the combined stack at 6ee979b2615db242ca6525bb7d0ccc36d563479f, using Node.js 24.21.0 in an isolated checkout:
- Clean immutable dependency install: passed.
- Development build and storage type check: passed.
- Unit tests: 8 passed.
- Storage tests: 35 passed.
- Hidden-window desktop tests: 4 passed.
- Headless Chrome tests: 6 passed.
- Unsigned production package and packaged workflow: passed (1 test).
Each historical intermediate branch was not rebuilt independently. Signing, live AI credentials, other operating systems, and broad dependency security auditing are outside this review.
This is a review record submitted through the PR author's account, not the independent approving review required by main's branch protection. CodeQL status is reported separately by GitHub.
1 participant
Serve the library UI from the storage service and introduce platform interfaces for browser and desktop behavior. Add one-time launch links, browser sessions, CSRF checks, and controlled managed-file responses.
The browser supports projects, file upload, reading, annotations, search, backup, and restore. Website capture and chat remain desktop-only. The inbox, session recovery, and desktop-action defects in this intermediate snapshot are fixed by #158.
Depends on #155. Merge the stack in order with merge commits, retargeting each next PR to main after its predecessor lands. Do not squash or delete intermediate branches during integration.
Validation on the combined stack at
6ee979b2615db242ca6525bb7d0ccc36d563479f, using Node.js 24.21.0 in an isolated checkout:Each historical intermediate branch was not rebuilt independently. Signing, live AI credentials, other operating systems, and broad dependency security auditing are outside this review.
Focused review found no confirmed blocker in the combined stack. The review covers basic workflows, data preservation, authentication, and the dependency changes. Broader modernization remains separate work.