- Unbuffer C stdout via setbuf(stdout, NULL) so prompts flush before blocking on input
- Break Emscripten FS.read loop with justFinishedLine and upgrade float/%f to double/%lf for PicoC compatibility
- Provide reactive waitingForInput state with auto-focus, dynamic placeholder, and highlighted send button in ConsolePanel
- Enable full multi-step interactive stdin flow in browser execution mode via SharedArrayBuffer and Atomics
- Add client-side code runner via Web Workers (PicoC for C, MicroPython WASM for Python)
- Support interactive stdin with SharedArrayBuffer and Atomics
- Implement offline database mirror using Dexie.js with opportunistic auto-sync
- Add execution mode toggle in Playground (Browser vs Server)
- Configure COOP, COEP, and CORP security headers in SvelteKit server hook
- Fix Velxio and Flowchart Nginx headers and add credentialless attribute to iframes
- Mount Nginx configs in podman-compose.yml for velxio and flowchart services
- Add unit and E2E Playwright integration tests (100% passed)
3 - Integration of KaTeX in frontend (SvelteKit) with a custom
renderMath` action.
- Added `python-markdown-math` extension in backend (Flask). to handle math blocks.
- Configured Vite to handle KaTeX during SSR and browser rendering.
- Added a LaTeX test lesson and updated home navigation.
- Supported both inline ($) and block ($$) math rendering,
including multi-line support.
Implements multiple layers of security to address high-risk session
and authentication vulnerabilities identified in the security review:
- Allow code compilation (C, Python, Arduino) for anonymous users.
- Enforce a 1-request-per-2-minutes rate limit for anonymous IPs.
- Implement a global anonymous compilation queue with 20 concurrent slots.
- Proxy Velxio (Arduino) compilation through Flask to prevent API hijacking.
- Exempt authenticated users (tokens/cookies) from all rate limits.
- Fix networking and DNS resolution in podman-compose.
- Fix Svelte a11y warnings and trailing slash routing issues.
- Cookie Security: Added dynamic 'secure' flag support via COOKIE_SECURE
env variable for HTTPS/Tailscale Funnel compatibility.
- Rate Limiting: Integrated Flask-Limiter on /login (50 req/min) to
prevent API abuse while accommodating shared school networks (NAT).
- Tarpitting: Added 1.5s artificial delay on failed logins to neutralize
automated brute-force tools without blocking legitimate users.
- Session Invalidation: Implemented an in-memory token blacklist on
logout to ensure session tokens cannot be reused.
- Documentation: Updated technical docs and proposal status to reflect
the current security architecture.
Ref: @elemes/proposal.md (Poin 6.1, 6.2, 6.3)
- Added proxy handling for `/assets/` in `sinau-c-tail.json` to route requests to the asset server.
- Enhanced `hooks.server.ts` to support proxying for both `/api/*` and `/assets/*` endpoints, including handling binary content.
- Introduced an anti copy-paste system in the lesson page to prevent text selection and copying from lesson content.
- Updated `CodeEditor.svelte` to prevent pasting from external sources with multiple layers of protection.
- Improved lesson page structure to support floating editor functionality and mobile responsiveness.
- Added celebration overlay for successful code completion in the lesson page.
- Adjusted `vite.config.ts` to include asset proxy configuration.
- Modified `podman-compose.yml` for production deployment with gunicorn and updated network settings.
a2nr
a2nr