Skip to content

feat(website): the gateway serves a one-image site and keeps its data plane off the site's route (FD-4683) - #391

Open
williamloo-scale wants to merge 1 commit into
wloo/web-app-contractfrom
wloo/web-apps-deploy
Open

williamloo-scale wants to merge 1 commit into
wloo/web-app-contractfrom
wloo/web-apps-deploy

Conversation

@williamloo-scale

@williamloo-scale williamloo-scale commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

The gateway runs a website whose server image serves its pages as one container: /website/<name>/ and /svc/<name>/ both reach it, and compose checks it at its declared health path. A site's route now never forwards its data plane or env card (/agentenv/…, /.well-known/agent-env.json, however the path is spelled), so an agent browsing a site can't read what grades it; agentenv still reaches them through /svc/<name>/, as the design's website/v1 contract requires. Sites built on a separate frontend image deploy as before.

Validation: unit suite passes, with tests for the one-image compose and topology, and the reserved paths through the site route versus /svc/.

🤖 Generated with Claude Code

RetriggerView in GreptileConfidence Score: 5/5

The PR appears safe to merge; no actionable defects were found.

Summary

The gateway now serves websites with one server image while preserving support for separate frontend images.

  • Website deployments can serve pages and APIs from one server image.
  • Site browsing cannot fetch a website's card or data plane.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Browser[Site request] --> Site["/website/name/path"]
  Site --> Guard{Reserved path?}
  Guard -->|Yes| Reject[404]
  Guard -->|No| Target{Separate frontend?}
  Target -->|Yes| Frontend[Frontend image]
  Target -->|No| Server[Server image]
  Agentenv[agentenv request] --> Service["/svc/name/path"]
  Service --> Server
Loading

Reviews (9) · Last reviewed commit: "feat(website): the gateway serves a one-..." · Reviewed by Greptile

@socket-security

socket-security Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

Comment thread src/agent_env/env/envs/web_apps/env.py Outdated
Comment thread src/agent_env/env/envs/web_apps/composer.py Outdated
Comment thread src/agent_env/env/envs/web_apps/runtime/server.py Outdated
Comment thread src/agent_env/env/envs/web_apps/runtime/server.py Outdated
@williamloo-scale williamloo-scale changed the title feat(web-apps): compose and deploy web_apps envs, each app at <name>.localhost in the browser feat(web-apps): compose and deploy web_apps envs, each app at <name>.localhost in the browser (FD-4683) Oct 29, 2026
Comment thread src/agent_env/env/envs/web_apps/runtime/server.py Outdated
Comment thread src/agent_env/env/envs/web_apps/composer.py Outdated
@williamloo-scale williamloo-scale changed the title feat(web-apps): compose and deploy web_apps envs, each app at <name>.localhost in the browser (FD-4683) feat(web-app): compose and deploy web_app envs, each website its own container at <name>.localhost (FD-4683) Oct 30, 2026
Comment thread src/agent_env/providers/env_providers/env_gateway_provider.py Outdated
@williamloo-scale williamloo-scale changed the title feat(web-app): compose and deploy web_app envs, each website its own container at <name>.localhost (FD-4683) feat(website): the gateway serves a one-image site and keeps its data plane off the site's route (FD-4683) Oct 30, 2026
… plane off the site's route (FD-4683)

A website whose server image serves its pages runs as one container: /website/<name>/ and /svc/<name>/ both reach
it, and it's checked at its declared health path. A site's route never forwards its data plane or env card, however
the path is spelled, so an agent browsing the site can't read what grades it; agentenv reaches them through
/svc/<name>/. A site built on a separate frontend image deploys as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant