Repository navigation
ci: validate dev-stack implementation for upstream #65 - #1
Draft
1932819331hy-debug wants to merge 106 commits into
Draft
1932819331hy-debug wants to merge 106 commits into
1932819331hy-debug wants to merge 106 commits into
Conversation
From the 2026-10-16 pilot rehearsal on the Linux, Windows 11 and macOS lab VMs: - F1: workspace add/remove apply the mounts to the running core and CLI services (compose recreates them only when the mounts changed); on failure they say to run up. - F3: on Linux, workspace add prints the setfacl command that lets the CLIs (uid 10001) write to a host-owned folder without changing its owner. - F4: OpenCode gets the Anthropic and OpenAI keys set for Claude Code and Codex, so a non-Zen key no longer has to go into credentials set opencode (which broke free models). - F8: backup adds spaceapp-config.json (workspace list) and cli-config.tar.gz (Claude, Codex and OpenCode settings: MCP servers, base URLs; no logins or keys); restore puts the settings back and lists the workspaces to add again. A failure there keeps the backup. - F9: uninstall --purge-data accepts purgeConfirm in --answers for unattended removal.
…ilot F13) Naming invariant 2026-10-13: the canonical memory is Space Memory. New installs seed space_memory.md and space_memory_monthly.md (SPACE_MEMORY_* paths in compose); an install made earlier moves its gemini_history*.md files once at core start and keeps the old names as links (deploy/docker/memory-names.sh). Space readers already accept both names and skip the links. A restored older backup is moved the same way on the next start.
Agents often check their work with a short python3 script; the CLI image had none. python3-minimal adds about 13 MB (apt reports 12.6 MB on spaceapp-cli 1.1.6), far under the 2800 MiB CLI image budget. The apt lists leave in the same layer.
With an API key the pinned 2.1.206 started on Opus 4.8. 2.1.301 is the version Space stable runs (and npm latest on 2026-10-16); license metadata unchanged (SEE LICENSE IN README.md), still owner-installed only and not in the image. The release acceptance checks the model a fresh Claude pane starts on.
…-segment session tokens, fail-closed revocations, logout reports unsaved revocations; install telemetry after the owner's Yes; review fixes) Sanitized source @ b9122162ac (4409 files). See CHANGELOG.md.
…aths printed doubled backslashes)
…s each command (pilot F17; seccomp default + userns, no AppArmor profile)
…ile into the project directory (F17 lab finding)
…revocation fixes and the route-guard test fix; CI installs ffmpeg for the Nous attachment tests) Sanitized source @ 732e9f3a78. See CHANGELOG.md.
…namespaces (F17, operator decision 2026-10-17)
…4, not for release yet) Plan clipboard:evAaFYqrgDfd step 5. user enable turns SpaceApp accounts on (core SPACE_MULTI_USER_ENABLED); user add <user-id> [--memory 2g] gives an invited user the service spaceapp-cli-<slug> with its own CLI state, memory, workspaces and socket volumes and secrets/users/<slug>/providers; the core gets the user -> pane host socket map (cli-hosts.json, SPACE_CLI_HOST_SOCKETS_FILE). credentials set|remove and workspace add|remove|list take --user <user-id> and reach only that user's container. Users require isolated access (host-root would let every agent read the whole host). user remove drops the container and keeps its volumes. Kept off the release branch until the multi-user rehearsal (step 6) passes and the operator turns it on.
Security review 2026-10-17 (plan clipboard:evAaFYqrgDfd step 6): spaceapp-cli-<slug> joined the shared spaceapp network, so a user's agent could reach the owner's internal services (temporal, codex-lb, headroom). It now joins spaceapp-user-<slug> only: internet, no other service and no other user. The core still reaches it only through its socket volume.
… again Plan clipboard:evAaFYqrgDfd step 6: accounts, rooms and shares come back with the database, but each user's CLI container and workspaces are host configuration; restore prints user enable, user add <id> and workspace add ... --user <id> for what the backup had, like the owner's workspaces.
…nly where the host allows it (F17)
…y (never keys or logins); restore and 'user restore' put them back (MU-004)
…vider install --user installs into that user's container (multi-user step 6)
…, not the backup restore saves first (lab recheck 2026-10-18)
… options, per-user backup and restore)
… (see docs/operations.md)
Keep shutdown signal handling idempotent through slow Docker cleanup. Add real API watch, browser HMR and worker failure/restart probes with durable source-edit recovery. Reviewed tree: 052e89b Node 22.23.0 dev-stack tests: 56 passed.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| edit = await editSource("apps/api/src/health-routes.ts", (text) => { | ||
| const updated = replaceOnce(text, | ||
| 'async () => ({ ok: true, service: "space-api" })', | ||
| `async () => ({ ok: true, service: "space-api", devStackWatchProbe: ${JSON.stringify(marker)}, devStackWatchPid: process.pid${expectedPackageProbe ? ", devStackPackageProbe: __devStackRebuildProbe" : ""} })`); |
| await rm(recoveryExit, { force: true }); | ||
| const recoveryOffset = (await stat(log)).size; | ||
| // Same documented command; no reset, dev-login, reused auth session, or alternate environment. | ||
| recovery = spawn("bash", ["-c", 'set +e; npm run dev:stack >>"$1" 2>&1; code=$?; printf "%s\\n" "$code" >"$2.tmp"; mv "$2.tmp" "$2"; exit "$code"', "dev-stack-recovery", log, recoveryExit], { cwd: root, detached: true, stdio: "ignore", env: process.env }); |
…her work: pilot fixes F1/F3/F4/F8/F9/F11/F13/F17/F18, per-user CLI containers and the multi-user core MU-001/002/003/007; install telemetry; session revocation and review fixes)
…y private (load gate script, Vault broker units, Vault MCP server; 1.1.6 re-cut)
…ngine, which stays private (1.1.6 re-cut)
…Design pane's tenth module; source fix 3f302e9713 is not in the 1.1.6 base f8803d5d96)
…work, the multi-user core, the public-suite fixes and test exclusions; OpenCode 1 kept; install telemetry; session revocation and review fixes)
…; Linux, Windows, macOS and all profiles on e2be6ab; known exception: OpenCode Zen refuses the free-model first answer from the lab address, operator-approved; AI checks on Claude)
Owner
Author
|
Owner-requested GitHub connector comment-permission test (2026-10-18 UTC). This is only a connectivity test; it makes no code, test, review, or merge-readiness claim. No action is needed. |
…ator decision efc30984) OpenCode Zen refused every free model from the lab's address while 1.1.6 was tested, so the free-model first answer could not run. validateEvidence now accepts a missing first-agent proof for a platform only when the version is exactly 1.1.6 and release/acceptance.json names operator decision efc30984 for that platform; every other version, platform and check stays as strict as before. Tests: 1.1.6 with the decision passes; without it, with another decision, for one platform only, for another scenario or for 1.1.7 it fails.
…ted on e2be6ab, source f8803d5d96; operator-approved Zen exception efc30984 named per platform)
…reserve source-stack isolation)
…ers (release run 39188998567): nous-attachments takes a fixed 4x3 PNG instead of the host's ffmpeg (Ubuntu's ffmpeg 6.1 writes it as 4x2), design-run accepts either order for two assets saved in the same millisecond; export transforms and their manifest entries only
…tack Track transient npm migrations and pinned OpenCode installs using the existing owned-command lifecycle. A real-process regression reproduces both orphaned process trees before the fix and checks down/reset cleanup plus unrelated-process preservation. Validation: Node 22.23.3 dev-stack suite 65/65; both new cases fail on the unchanged 73237e2 baseline.
| else if (name === "required" || name === "allowed") { | ||
| // A rule lists classes and [custom] characters separated by commas; one required rule means "at least one of these". | ||
| let alphabet = ""; | ||
| for (const token of value.match(/\[[^\]]*\]|[^,\s]+/g) ?? []) { |
| const call: Call = { url, googleKey: headers["x-goog-api-key"] ?? null, bearer: headers.authorization?.replace("Bearer ", "") ?? null, | ||
| body: init?.body ? JSON.parse(String(init.body)) as Record<string, unknown> : null }; | ||
| calls.push(call); | ||
| if (url.startsWith("https://api.openai.com")) return url.endsWith("/models") ? json({ data: [] }) : json({ data: [{ embedding: [1, 0] }], usage: { prompt_tokens: 3 } }); |
Integrate upstream adb96ac, including ba7f46f's fixed PNG fixture and deterministic design-run assertions, while retaining the reviewed dev-stack command ownership and shutdown fixes. Validated Nous and design-run API tests: 2 files, 9 tests passed on Node 22.23.3 and FFmpeg 6.1.1. Dev-stack production/test blobs remain unchanged from 57fc285.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Internal validation PR for the upstream SpaceApp oll4com#65 contribution. Do not merge; this exists only to execute the fork's pull-request workflows on
feat/dev-stack-65while the upstream fork workflows await maintainer approval.