silentmode/site
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(hephaestus): rename "AI sessions" section to "CLI & programmatic access"

Browse source 
The section content was already about running the sign-in without a real
browser — the "AI" framing was a leftover from how the misdiagnoses first
surfaced. Rename to be tool-neutral: any CLI, CI job, curl-with-cookies,
Playwright, Puppeteer, or scripted client hits the same trap and benefits
from the same URL routing table and smoke-test snippets.

Also, hephaestus.x BCNR record updated (via Argus CLI) to point at the docs
landing page instead of straight-to-forge — users typing the name now get
docs + a "Sign in with wallet" button, not the login screen cold.
TXID 2359f99b4a5c4cc2b56594ce5b7c47df4a98cb361843bc7139f3550bab43d436.
This commit is contained in:
Local Dev 2026-08-31 12:23:06 +02:00
parent 38f567b20d
commit c63ae53988
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
hephaestus/index.html
View file

@ -131,9 +131,9 @@
<p class="note"><b>Why no email?</b> Nothing to leak, nothing to phish, no password-reset flow to hijack. The trade: if you lose your recovery phrase there is no support form to send you back in. Back the phrase up. Twice. On paper.</p> <p class="note"><b>Why no email?</b> Nothing to leak, nothing to phish, no password-reset flow to hijack. The trade: if you lose your recovery phrase there is no support form to send you back in. Back the phrase up. Twice. On paper.</p>
</section> </section>
<section id="ai-sessions"> <section id="cli">
<h2>For AI sessions &amp; programmatic testing <span class="pill">read before debugging</span></h2> <h2>For CLI &amp; programmatic access <span class="pill">read before debugging</span></h2>
<p class="lede">If you're an AI assistant, CI job, or anyone debugging the sign-in without a real browser, read this first. It heads off two misdiagnoses we've already hit.</p> <p class="lede">If you're driving the sign-in from a CLI, CI job, or any scripted client without a real browser, read this first. It heads off two misdiagnoses we've already hit.</p>
<h3>Misdiagnosis #1: "The login shell page is only 510 bytes — it's a broken stub"</h3> <h3>Misdiagnosis #1: "The login shell page is only 510 bytes — it's a broken stub"</h3>
<p>It's not a stub — it's a <b>deliberately small bootstrap page</b> that renders the wallet UI client-side via a JS module (standard SPA pattern). Size ≠ brokenness. The full UI (mnemonic generation, passphrase encryption, sign flow) is inside <code>wallet.js</code>, not the shell. Test by requesting <code>wallet.js</code> instead:</p> <p>It's not a stub — it's a <b>deliberately small bootstrap page</b> that renders the wallet UI client-side via a JS module (standard SPA pattern). Size ≠ brokenness. The full UI (mnemonic generation, passphrase encryption, sign flow) is inside <code>wallet.js</code>, not the shell. Test by requesting <code>wallet.js</code> instead:</p>
@ -178,7 +178,7 @@ curl -s -X POST -H 'content-type: application/json' \
<p>For the JS side (which is what the browser does), inspect <code>auth-proxy/public/wallet.js</code> in the repo — it's ~250 lines and does exactly this: <code>generateBip39Mnemonic → deriveHdPath("m/44'/145'/0'/0/0") → sign(magicHash(message))</code>. Nothing exotic.</p> <p>For the JS side (which is what the browser does), inspect <code>auth-proxy/public/wallet.js</code> in the repo — it's ~250 lines and does exactly this: <code>generateBip39Mnemonic → deriveHdPath("m/44'/145'/0'/0/0") → sign(magicHash(message))</code>. Nothing exotic.</p>
<h3>Common browser-side checks</h3> <h3>Common browser-side checks</h3>
<p>If you're in a browser (or a browser-driving tool) and want to know if you're actually signed in:</p> <p>If your CLI drives a real browser (Playwright, Puppeteer, curl-with-cookies) and you want to know if you're actually signed in:</p>
<pre>// The URL bar isn't reliable when Forgejo shows Security or Settings pages — <pre>// The URL bar isn't reliable when Forgejo shows Security or Settings pages —
// they render for logged-in users but don't have "Dashboard" in the title. // they render for logged-in users but don't have "Dashboard" in the title.
// Best check: does the profile menu render, and is there no "Sign in" link? // Best check: does the profile menu render, and is there no "Sign in" link?