[GoDeskio]

The management console could create a database, then failed the moment you tried to use it. This replaces that page with a site you can run on its own, and a small package other GoDesk apps can adopt.

What was broken

Clicked through the old console and the flow page in Chrome:

• Browse answered 405 method not allowed. GET /v1/databases/{name}/keys was tested and drawn in the page, and the handler never routed it.
• The database name pattern is invalid in current Chrome (v flag), so the field logged Invalid character class and did not validate.
• Delete and limit changes existed on the API and had no buttons.
• An empty error line rendered as a red bar.
• The flow page had no navigation, ignored reduced motion, and kept spawning dots.
• The console CSP allowed unsafe-inline scripts.
• Unknown URLs, including a favicon request, came back 401 instead of 404.
• There was no agent, and no way for GitGoat, RailYard, Portkyl, Komboe, or Cerebro to adopt the cache in a few lines.

What this changes

python3 site/server.py --demo serves the site on 127.0.0.1 only. Create, browse, limits, rotate, and delete run against an in-memory database, including a labeled sample key. The same pages are what cmo_mgmt.py serves when it is pointed at a real server.

• Home has a hero, glass cards, and flat shadowed buttons. Other product names appear only inside the feature cards that link to them.
• The pointer moves a soft highlight. prefers-reduced-motion turns that off and stops the flow animation.
• The agent lists, creates, deletes, rotates, limits, browses, explains, and opens pages with no model. Free-form text uses OLLAMA_BASE_URL and drops any action outside that list.
• Scripts and styles are files. The page CSP no longer uses unsafe-inline.
• integration/ is version 1.0.0: a Python client, a browser/Node client, a loopback sidecar, and an updater. INTEGRATION.md is the adoption note. The updater checks SHA256SUMS and will not write a symlink or a path that leaves the directory. No token is stored in the repo.

Tests

Unit tests: management API, key browser, flow feed, site/test_site.py, integration/test_integration.py.

Browser: site/e2e (Playwright). CI job Site, integration, and browser runs those and uploads the screenshots. The Valkey build jobs are unchanged.

  

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​playwright/​test@​1.55.1

View full report