The previous note was wrong: it said lp-shot needs a session handed to it
in the environment and that agents should ask the maintainer for one.
It doesn't. The backend keeps {username, passwordHash, jwtSecret} in
frontend/.auth.json and mints cookies as jwt.sign({sub}, jwtSecret), so a
tool on the host signs the same token /api/auth/login would issue — no
password anywhere (the stored one is a bcrypt hash). The env overrides
are only for shooting a remote instance.
Also note the boot-splash wait, since a splash in the PNG now means boot
actually stalled rather than the tool firing too early.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
lp-shot now exists on this machine, and two things about it were not
written down anywhere: every WebUI route except / sits behind the login
so it needs a session in the environment, and screenshotting a change
means copying it into the bind-mounted live tree first.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Directive for agents working on the repo: after a user-visible WebUI change,
screenshot the route with the lp-shot helper and review the PNG before marking
done, rather than relying on syntax checks alone. Box-specific setup (port
discovery, auth, install) is kept out of the repo.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>
