Said TurkseverandClaude Fable 5.1 55f979c128 fix(overpass): keyless gate, loopback admission headroom and per-phase arrival budgets ...

Address gekh's review of 69a87fe2:

- P1: /api/overpass now uses admitSameSiteKeyless, like /api/terrain/heights,
  so an instance behind the README's reverse proxy keeps its Overpass-backed
  layers; cross-site shapes are still refused and forwarding headers no
  longer launder them. SECURITY.md, the gate header and CURRENT-STATE say so.
- P2: admission keys IPv6 peers by /64 and folds IPv4-mapped peers
  (clientNetworkKey), and loopback has its own 300/min window outside the
  900/min global, so a few LAN peers cannot lock the owner's browser out.
- P2 (track): the settle and reveal frames each get their own 500 ms budget,
  measured from moveEnd and from the settle frame respectively, so a ~300 ms
  SwiftShader frame no longer trips the reveal deadline while both stay
  inside the 1 s idle refresh.
- Smaller: drop the dead settings-block check and stale probe comment in
  query.js, clamp whitespace-tolerant [ timeout : N ], and add tests for the
  global window, the /64 keying, loopback headroom, proxied admission and
  cache hits spending admission but not upstream budget.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

2026-10-21 16:17:37 +01:00

..

fixtures

fix(street-level): /revmain cleanup after the slim rebuild

2026-10-20 14:02:09 +04:00

voice-bench

feat(voice): harden Gemini Live provider integration

2026-10-16 17:09:03 +05:30

assemble-changelog.mjs

Make changelog assembly recoverable after a partial write

2026-10-16 11:01:25 +01:00

build-admin-packs.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

build-military-names.py

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

build-panel.mjs

Run the worker prelude ahead of Cesium's own workers script

2026-10-02 18:29:42 -07:00

build-sf-neighborhoods.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

check-import-directions.mjs

feat: describe what the app shows as a view

2026-10-02 15:21:36 -07:00

check-layer-state-tokens.mjs

fix: allocate share-link layer tokens without collisions

2026-09-24 16:25:55 +05:30

check-package-boundaries.mjs

feat(sdr): local receivers — browser RTL-SDR, Local ADS-B layer and decoder feeds (#732)

2026-09-23 16:00:53 -05:00

dev-cctv.sh

fix: share CCTV startup and keep proxy diagnostics bounded

2026-09-10 23:01:51 -07:00

dev-fresh.sh

feat(voice): harden Gemini Live provider integration

2026-10-16 17:09:03 +05:30

dev-secure.sh

refactor(tools): support an explicit project directory

2026-09-14 07:35:38 -07:00

docker-start.mjs

build(docker): keep keys out of the image and run as non-root by default

2026-10-15 13:07:00 -07:00

focus-allocation-check.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

format-runtime.json

build: discover owned runtime modules in the formatter gate

2026-09-15 07:26:32 -07:00

format-scope.json

fix(overpass): keyless gate, loopback admission headroom and per-phase arrival budgets

2026-10-21 16:17:37 +01:00

format.mjs

style(agent): apply pinned Prettier output and remove temporary probe

2026-10-17 05:12:15 -05:00

generate-icons.mjs

feat: ship a web app manifest and home-screen icons

2026-10-13 18:54:58 -04:00

google-server-key.mjs

fix: separate Google browser and server keys (#110)

2026-09-11 15:08:23 -07:00

i18n.mjs

i18n: fix the LGTM review findings and tidy the branch texts

2026-10-16 21:00:28 +04:00

military-names-files.json

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

military-names.sql

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

module-analysis.mjs

refactor: enforce import directions and expose source factories

2026-09-14 21:12:01 -07:00

next-layer-state-token.mjs

fix: allocate share-link layer tokens without collisions

2026-09-24 16:25:55 +05:30

opensky-import-client.sh

refactor(tools): support an explicit project directory

2026-09-14 07:35:38 -07:00

package-boundaries.json

Merge branch 'main' into codex/fix-overpass-request-admission

2026-10-21 15:00:44 +01:00

pinokio-environment.mjs

feat(voice): harden Gemini Live provider integration

2026-10-16 17:09:03 +05:30

pinokio-install.mjs

fix(setup): stop Node's DEP0190 warning when npm runs on Windows (#1057)

2026-10-16 15:28:39 -07:00

pinokio-preflight.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-reset.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-start.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

pinokio-update.mjs

fix(pinokio): disclose incoming changes before Update pulls and installs (#507)

2026-09-14 19:34:23 -05:00

precompute-cctv-heights.mjs

fix(cctv): space out failed background refreshes; test the stale paths

2026-10-19 17:02:06 +01:00

project-root.mjs

refactor(tools): support an explicit project directory

2026-09-14 07:35:38 -07:00

qa-admin-outlines.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-air-quality.mjs

feat(air-quality): add the Air quality layer to the Weather group

2026-10-02 15:12:37 -06:00

qa-alpr-journey.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-application.mjs

style: adopt application modules into scoped formatting

2026-09-11 17:03:35 -07:00

qa-attribution-b12.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-browserEvidence.mjs

refactor(street-level): trim QA, tests, styles and docs

2026-10-07 22:41:29 +04:00

qa-cables-overlay.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

qa-cables-render-probe.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

qa-cables-shot.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-camera-controls.mjs

fix: preserve camera controls when rebuilding the Radio panel

2026-09-13 01:23:55 -07:00

qa-cctv-v2.mjs

test(cctv): verify DEM placement in the keyless globe gate

2026-10-19 23:31:52 +01:00

qa-chrome.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-cockpit-plates.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-cockpit-utility.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-context-arrivals.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-directions.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-director-camera.mjs

feat(director): add authored camera directions and anchors

2026-09-15 16:53:26 -07:00

qa-director-interactions.mjs

feat: add declarative Director feature actions

2026-09-15 19:16:49 -07:00

qa-director-packs.mjs

feat(director): add bounded scene data packs and placement

2026-09-15 17:59:53 -07:00

qa-director-sharing.mjs

Add Director authoring, import previews and scene bundles

2026-09-15 20:15:32 -07:00

qa-director-timing.mjs

refactor(director): separate timing clocks and scene pack presentation

2026-09-15 15:41:42 -07:00

qa-draw-tool.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-emergency-squawk.mjs

fix: address GNSS integrity and aircraft emergency review findings

2026-10-14 17:43:13 +02:00

qa-enrich-ambient.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-failstate-b10.mjs

test: name the vessel provider in the feed-failure QA fixture

2026-10-03 23:20:42 -07:00

qa-final-polish-credits.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-firms.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-firstrun-mutations.mjs

fix(qa): repoint stale mutation anchors after the September refactors

2026-10-11 13:52:30 -07:00

qa-firstrun.mjs

fix(qa): align renderer evidence and attribution keyboard assertions

2026-09-11 14:50:57 -07:00

qa-floor-hold.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-floor-verify.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-floorhold-mutations.mjs

fix(qa): repoint stale mutation anchors after the September refactors

2026-10-11 13:52:30 -07:00

qa-floorhold-probe-cost.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

qa-floorhold-staircase.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

qa-flyroute-cinema.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-flyroute-mutations.mjs

fix(qa): repoint stale mutation anchors after the September refactors

2026-10-11 13:52:30 -07:00

qa-focus-evidence.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-gbfs-names.mjs

Frame mobile GBFS QA in supported clean view

2026-10-13 23:48:21 +02:00

qa-geo-import-large.mjs

fix(import): correct clamping and bound local-file rendering

2026-10-15 04:10:41 +02:00

qa-geo-import-regressions.mjs

fix(import): correct clamping and bound local-file rendering

2026-10-15 04:10:41 +02:00

qa-geo-import.mjs

fix(import): correct clamping and bound local-file rendering

2026-10-15 04:10:41 +02:00

qa-gnss.mjs

test: verify GNSS map clicks with production canvas pixels

2026-10-14 17:53:19 +02:00

qa-heading-b3.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-height-datum.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-infra-lod.mjs

fix(infrastructure): stop idle republishing and respect settled terrain

2026-09-11 08:59:32 -07:00

qa-installation-navigation.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-installation-polish.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-journey-recorder.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-l9-matrix.mjs

fix(i18n): keep English pixel-identical and stored data English

2026-10-13 20:03:54 +04:00

qa-label-readability.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-labels.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-layer-panel.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-layer-token-twochar.mjs

fix: allocate share-link layer tokens without collisions

2026-09-24 16:25:55 +05:30

qa-location-controls.mjs

Move the changelog entry into changelog.d and watch the Google geocode proxy in QA

2026-10-16 16:39:28 -07:00

qa-map-source-controls.mjs

test: wait for settled map imagery in control captures

2026-09-12 22:26:29 -07:00

qa-map-source-tray.mjs

Update UI acceptance fixtures for panel ownership

2026-09-14 15:43:27 -07:00

qa-military-names.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-nepal-media-playback.mjs

fix: scope Nepal media playback to explicit scene actions

2026-09-16 12:14:15 +05:30

qa-overlay-baseline.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-overpass-offload.mjs

fix: let keyless browser validation settle

2026-10-20 00:15:49 +01:00

qa-perf.mjs

release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

2026-08-31 17:49:45 -05:00

qa-radio.mjs

test(radio): fixture unavailable optional Google tokens

2026-10-16 18:56:17 +02:00

qa-recent-imagery.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-scene-controls.mjs

Add Director authoring, import previews and scene bundles

2026-09-15 20:15:32 -07:00

qa-scene-dialog-file-drop.mjs

i18n: fix the LGTM review findings and tidy the branch texts

2026-10-16 21:00:28 +04:00

qa-segmented-controls.mjs

Reserve full height for imagery segmented controls

2026-10-21 13:21:23 +02:00

qa-sprites-b5.mjs

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

qa-street-level.mjs

Unify segmented selectors and fix compact panel spacing

2026-10-21 13:07:51 +02:00

qa-terrain-429.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-traffic-baseline.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-traffic-jamviz-ab.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-traffic-motion.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-traffic-navigation.mjs

fix(traffic): recover road loading after city navigation

2026-09-13 14:47:26 -07:00

qa-traffic-oblique.mjs

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

qa-traffic-preset-ab.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-traffic.mjs

fix(qa): exit QA gates gracefully on Windows (#1064)

2026-10-14 14:48:53 -07:00

qa-transit-browser.mjs

fix(transit): keep the real silhouettes under sensor presets, make the selected trail visible, put Transit in Movement (#596)

2026-09-15 13:26:41 -05:00

qa-transit-controls.mjs

feat(transit): live public-transit vehicles from open GTFS-Realtime feeds (#587)

2026-09-15 05:18:30 -05:00

qa-transit-heading.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-transit-recovery.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-transit-scenes.mjs

fix(transit): keep the real silhouettes under sensor presets, make the selected trail visible, put Transit in Movement (#596)

2026-09-15 13:26:41 -05:00

qa-transit.mjs

fix(qa): run the macOS-only gates on Windows and Linux (#1061)

2026-10-14 15:36:35 -07:00

qa-ui-disposal.mjs

fix(street-level): /revmain cleanup after the slim rebuild

2026-10-20 14:02:09 +04:00

qa-vessel-cards.mjs

Extract vessel components and preserve source lifecycle

2026-09-13 10:54:32 -07:00

qa-vessel-datum.mjs

fix: update vulnerable dependencies and adapt browser QA to Puppeteer 25

2026-09-10 23:08:26 -07:00

qa-view-target-prewarm.mjs

fix(qa): choose portable browser renderers outside macOS

2026-09-11 14:43:13 -07:00

qa-visual-effects.mjs

style: format state subscriptions and their adopted controls

2026-09-13 05:43:05 -07:00

qa-visual-input.mjs

refactor(ui): share ordinary slider components

2026-10-20 14:48:42 +02:00

qa-voice-auth-focus.mjs

fix: preserve focus when changing voice auth

2026-10-06 20:36:56 +05:00

qa-voice-auth.mjs

test(voice): match API-key realtime auth response

2026-10-04 23:03:09 +05:00

qa-voice-bench.mjs

feat(voice): voice core — honest layer reach, spoken summary with on-screen card, narration, point-and-ask

2026-09-28 21:19:23 -05:00

qa-voice-routing.mjs

fix(location): preserve geocoded places and region provenance

2026-10-19 11:01:18 +05:30

qa-voice-wav.mjs

refactor(voice): separate Realtime state and resource owners

2026-09-15 12:05:01 -07:00

qa-weather-journey.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-weather-perf.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-weather-swap.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-weather-teardown.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

qa-wind-canvas.mjs

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

read-dotenv-value.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

run-unit-tests.mjs

test: say which CI job and which files the discovery guard covers

2026-10-14 11:59:14 -07:00

setup-doctor.mjs

fix(setup): stop Node's DEP0190 warning when npm runs on Windows (#1057)

2026-10-16 15:28:39 -07:00

shot-sink.mjs

Release God's Eye View as open source

2026-08-24 17:02:16 -05:00

track-regression.mjs

fix(overpass): keyless gate, loopback admission headroom and per-phase arrival budgets

2026-10-21 16:17:37 +01:00

traffic-fixtures.mjs

refactor: separate traffic and bikeshare components

2026-09-13 14:10:38 -07:00

voice-turn-spans.mjs

feat(voice): voice core — honest layer reach, spoken summary with on-screen card, narration, point-and-ask

2026-09-28 21:19:23 -05:00