SvelteKit's built-in cross-site POST guard was blocking legitimate
multipart uploads from our own UI (HTTP 403 'Cross-site POST form
submissions are forbidden') whenever the operator reaches the app via
a hostname/port that doesn't match the browser's Origin header — LAN
IPs, reverse proxies, and .local hostnames all trip it. This tool is
scoped to private networks and has no cross-origin surface to defend
against, so the guard is more friction than protection here.
If Electric Cherry ever gets exposed to the public internet, do
per-route origin checks in hooks.server.ts instead of re-enabling
this blanket rule.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Ports push_scripts.sh (1497 lines of bash) to a SvelteKit + SQLite web app
that manages a fleet of T5 Plutonium servers running on Komodo. Same push
and beta workflow as the shell script, with a live SSE pipeline view, a
!rt-token-gated auth modal that hard-pauses deployments on stale tokens,
per-file audit diffs, and a Komodo-container deployment target.
- Push/beta engines port the exact filter, held-by-beta, conflict, and
stale-backup rules from the shell script
- SQLite (better-sqlite3) replaces script_metadata.json; a one-shot
importer moves legacy state over on first boot
- 16 vitest tests cover push add/update/skip, beta open→rollback,
open→promote, conflict guards, sweep frozen/manual branches, and IW4M
login/status parsing
- docker/ + komodo/stack.toml deploy as a managed container on the same
host as the game servers, /root/zombies bind-mounted at the same path
the shell script used
joshandClaude Opus 4.7