2 commits

Author	SHA1	Message	Date
Carlos Arias	a2da708418	Phase 2/3: projects media admin (galleries + Instagram) ... - /admin/projects list + /admin/projects/edit gallery editor (AdminLayout chrome, session-guarded). Upload/replace images per slot, captions, add/remove, Instagram reel URL. Save -> cja_projects -> rebuild -> live. - adminprojects API (list/get/save); media path validation (local paths only). - runner /rebuild endpoint: build public/ + commit after structured edits. - Ownership: app/ + public/ now owned by carlos-arias-agent:caweb so the agent can rebuild its own output; www serves via the caweb group. Documented in SETUP.md — never build as root. Verified end to end: upload image -> save to gallery -> rebuild -> image live on the project page and served. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a	2026-07-23 22:55:32 +00:00
Carlos Arias	e57856173a	Phase 1: console runner service + nginx gate + systemd ... - agents/console/server.mjs: Node runner (as carlos-arias-agent, 127.0.0.1:3011). run/stream(SSE)/publish/discard/ping/auth. Agent edits files (no Bash); the runner builds isolated previews and git-commits on publish. Git ops scoped to content paths (app, brand, api/db, api/cli) — never infra or secrets. - adminauth check() — nginx auth_request target (204 admin / 401 not). - nginx: /devconsole + /_preview gated by auth_request, runner proxied, previews admin-only. Runner never exposed directly. - systemd unit (hardened: NoNewPrivileges, ProtectSystem, scoped ReadWritePaths). Verified end to end: admin login -> agent edits about.astro -> isolated preview (admin-gated) -> discard reverts. Unauthenticated access is 401 throughout. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a	2026-07-23 20:53:32 +00:00