Skip to content

Declare a showcase frame for the hqtui.com apps gallery - #178

Merged
ralyodio merged 1 commit into
masterfrom
worktree-showcase-frame
Sep 8, 2026
Merged

Declare a showcase frame for the hqtui.com apps gallery#178
ralyodio merged 1 commit into
masterfrom
worktree-showcase-frame

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

hqtui.com/apps captures screenshots of applications built on the library. The capture script takes an application directory and imports scripts/showcase.ts from it, because only the application knows what a good state looks like.

This adds ours: the live dashboard, connected.

╭──────────────────────────────────────────────────────────────────────────────────────╮
│ ⚡ THREATCRUSH   ● LIVE      daemon pid 4242                            uptime 14d 6h │
╰──────────────────────────────────────────────────────────────────────────────────────╯
╭─  EVENTS  ──────────╮ ╭─  THREATS  ─────────╮ ╭─  MODULES  ─────────╮ ╭─  EVENTS/SEC ─╮
│ 3.9k    10 buffered │ │ 4                0% │ │ 3/4          active │ │ 0.00          │
╰─────────────────────╯ ╰─────────────────────╯ ╰─────────────────────╯ ╰───────────────╯
╭─  MODULES  ──────────╮╭─  LIVE EVENTS  ──────────────────────────────╮╭─  TOP THREATS  ─╮
│ ●  network-monit… 847││ 15:12:04 INFO  Monitoring 847 connections     ││ 91.232.105.3  47│
│ ●  ssh-guard       47││ 15:12:11 MEDI… SQLi attempt — :443 /api/…     ││ 45.33.32.156  23│
│ ●  file-integrity 219││ 15:12:18 HIGH  SSH brute force — :22 47 f…    ││ 185.43.21.8   12│
│ ○  code-scanner     0││ 15:12:46 CRIT… XSS attempt — :443 /searc…     ││ 103.97.202.44  9│
╰─ 3/4 active ─────────╯╰──────────────────────────────────────────────╯╰─────────────────╯

It goes through the real reducer

The state is driven from a real connected status and the real demo script through reducer, not assembled by hand. A screenshot of a state the reducer cannot actually produce is a picture of something that does not exist — the one thing a showcase must never be.

Two details worth the review

The clock is pinned. demoEvent stamps new Date(), which is right for a live demo and wrong for a committed screenshot twice over: the image would differ on every regeneration, and ten events sharing one second does not read as a feed. Only the timestamp is overridden — the content is still the real script.

demo: false on purpose. That flag drives the badge saying whether the numbers came from a live daemon. A showcase that quietly flags itself as demo data is advertising the wrong thing, and the dashboard is honest about this distinction by design — worth not undermining in the screenshot.

Scope

Build-time fixture only. Nothing here ships in the CLI, and no application code changed.

tsc --noEmit on the new file is clean, and the pre-commit hooks (CLI build, landing page build) passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_017Df2FNu5DhinMV2soRz3cy

hqtui.com/apps captures screenshots of applications built on the
library. The capture script takes an application directory and imports
`scripts/showcase.ts` from it, because only the application knows what a
good state looks like.

The state is driven through the real reducer, from a real connected
status and the real demo script, rather than assembled by hand. A
screenshot of a state the reducer cannot actually produce is a picture
of something that does not exist.

`demoEvent` stamps `new Date()`, which is right for a live demo and
wrong for a committed screenshot twice over: the image would differ on
every regeneration, and ten events sharing one second does not look like
a feed. Only the clock is pinned; the content is still the real script.

`demo: false` on purpose. That flag drives the badge saying whether the
numbers came from a live daemon, and a showcase that quietly flags
itself as demo data advertises the wrong thing.

Build-time fixture only; nothing here ships in the CLI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Df2FNu5DhinMV2soRz3cy
@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5

Severity Rule Location
HIGH secret-aws-access-key prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM js-open-redirect apps/web/src/app/auth/login/page.tsx:50
MEDIUM js-unescaped-html-sink apps/web/src/app/hire/page.tsx:104
MEDIUM js-unescaped-html-sink apps/web/src/app/hire/page.tsx:108
MEDIUM js-open-redirect apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM js-unescaped-html-sink apps/web/src/components/GuideReader.tsx:265
MEDIUM js-uninitialized-buffer packages/scan/src/node-rules.ts:456
LOW secret-generic-credential PRD.md:269
LOW tls-verification-disabled prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW tls-verification-disabled prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW sh-remote-script-execution scripts/smoke-test.sh:47
LOW secret-aws-access-key scripts/smoke-test.sh:112

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit fcbc92a into master Sep 8, 2026
11 checks passed
@ralyodio
ralyodio deleted the worktree-showcase-frame branch September 8, 2026 15:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant