A supervisor that runs as a standalone container kept the image it was
started with, so broker fixes never reached it. The deploy now rebuilds
that image when its sources change and recreates the container with the
same network, restart policy, mounts and environment, restoring the old
one if the new one stays unhealthy. The broker socket moves into the data
directory and is shared from containerized supervisors too.
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
Co-authored-by: Claude <noreply@anthropic.com>
Chief's computer still timed out reaching the GitHub broker after the
socket mount shipped. A reused computer kept its old container whenever
the image matched, so one created without the mount never got it, and
the socket was only served for a loopback-bound supervisor.
- Recreate a reused computer that lacks the socket mount once the
supervisor serves the socket.
- Serve the socket from any supervisor running directly on a Linux host.
- Give the broker listeners the same long request timeout as the main
server, so large brokered clones are not cut after five minutes.
- The broker client now says which path failed (no socket, socket exit,
network exit) so a relayed error points at the cause.
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
Co-authored-by: Claude <noreply@anthropic.com>
Computers on evo could not reach the broker over TCP: the git shim
reported that evOo's GitHub connection was unreachable, so cloning
private repositories still failed. Container-to-host traffic depends on
the host firewall and on which Docker network the computer joined.
- On a Linux host the supervisor also serves the broker on a unix socket
in a host directory (SANDBOX_GITHUB_BROKER_SOCKET_DIR, default
~/.rakazo/github-broker), and mounts that directory read-only into
each new computer once the socket listens.
- The shim uses the socket when it is present and falls back to the
network otherwise; connections time out after 5 seconds and the
unreachable message names the curl exit code.
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
Co-authored-by: Claude <noreply@anthropic.com>
The computer's git and gh shims passed a literal "--" into the JSON argv
(python -c keeps it in sys.argv), so every brokered clone arrived as
"git -- clone" and the broker refused it. Agents then fell back to real
git with the broker run token as a password, which GitHub rejects.
- Drop the stray "--" from both shim payloads.
- Route git through the broker even behind -c/-C/--no-pager options.
- Share one broker client that falls back to the default gateway for
computers created before host.docker.internal was mapped, and says
plainly when the broker is unreachable or refuses a request.
- Broker normalizes GitHub SSH remotes and pasted credentials to plain
HTTPS and points a rejected stored token at reconnecting GitHub.
- Prompt says plain git clone works and the run token is not a GitHub token.
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
Co-authored-by: Claude <noreply@anthropic.com>
* Let computer git reach GitHub through the broker with working credentials
The broker URL handed to computers pointed at the supervisor's loopback
address, which a container cannot reach, and host git ignored the
integration token for HTTPS remotes. Computers now get the host through
host.docker.internal, host git receives the token via a one-off
credential helper, and clone paths and the working directory map from
the computer onto the host workspace.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
* Serve the GitHub broker to computers on a Linux host-run supervisor
A loopback-bound supervisor is unreachable from containers on Linux, so
it also serves the broker routes alone on the default bridge gateway,
which only containers on the same host can reach.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Broker GitHub integration token for computer git/gh
Use the Integrations GitHub MCP secret for supervisor broker sessions
so home and project computers can clone private repos without PAT prompts.
Add rakazo git/gh shims, push policy, deploy image rebuild, and tests.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: retrigger product checks after runner timeout
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: run product change detection on GitHub-hosted runners
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* style: format deployment-github-token
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: self-hosted change detection with timeout and fail-open gate
Keep Detect product changes on evoo-ci with a 10-minute cap, continue-on-error
filtering, and a fail-open product flag when detection fails. Downstream jobs
and Product CI treat a failed or timed-out changes job as full product impact.
Add job timeouts on remaining self-hosted ci jobs.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: continueRun tests and broker home path guard
- Skip broker workspace resolution when computer homeKey is absent
- Add shared continue-run Prisma/home/secretStore test stubs
- Update computer PATH expectation and evo-deploy command sequence
- Remove unused executor imports flagged by Biome
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* style: Biome format and import order for broker CI
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: compose YAML, typecheck for broker stubs and GitHub hint
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: retrigger Product CI after compose and typecheck fixes
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: retry Product CI queue
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: give self-hosted Web E2E a 45m job timeout
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: extend Web E2E job timeout to 60m on self-hosted runners
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: keep github-broker-token off the core browser barrel
Export broker HMAC helpers only from @rakazo/core/node/github-broker-token so
Vite does not pull node:crypto into the web client and break Playwright signup.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* Allow ZIP uploads up to 5 GiB and stream them onto Docker computers
Repository archives could not be picked at all: application/zip was not an
allowed attachment type. ZIPs are now allowed with their own 5 GiB cap,
upload as a stream, and reach the bot's Docker computer through a new
streamed supervisor write that commits only after the body ended cleanly.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
* Use a disallowed type for the invalid-attachment check now that ZIP is allowed
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat(web): Oo computer browser panel with cowork and local preview
Wire the in-app browser panel to the active Oo's live Chromium via the
computer screen stream, page-browser navigation, and interactive cowork
input with AgentCursor. User browser actions become system meta lines in
thread context; localhost preview remains as Lokale Vorschau.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(i18n): sync Lingui catalogs for Oo browser panel
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* Fix the Oo browser's lint and E2E failures
The shared-browser overlay is a focusable input surface, so it gets the
application role and a translated label. The local preview focuses the
address field again when no page is open, which the split out of
InAppBrowser had dropped. The Oo browser spec opens the panel by its exact
name, because the signed-up user's name also contains "Browser", and reads
the user action from the RPC body's json envelope.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wy1md9QE1ayJbDCwJ4vAQs
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
.env.example ships RAKAZO_COMPUTER_MEMORY, _CPUS and _PIDS_LIMIT with no
value. Loaded as empty strings, they bypassed the ?? defaults and the
startup validation threw, so the supervisor crashed on a fresh setup.
Claude-Session: https://claude.ai/code/session_012UBam2saiShpLy5o2cy3h8
Co-authored-by: Claude <noreply@anthropic.com>
* fix(ci): restore browser preview module and onboarding e2e
The web bundle imported a browser-preview store that was never added, so production builds and every Playwright signup failed before the shell rendered. Mobile check failed because Expo packages were a patch behind the SDK.
Restore the store, type the optional desktop bridge, and walk whichever onboarding step scripted CI actually opens.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(ci): stop the blank web client and the send 500
The core barrel pulled git checkout into the browser, so node:child_process crashed the page before sign-up. Serve that module from a node export instead.
Add the missing run tool-call budget columns that threads/send writes. Guard an indexed shell flag for typecheck, and expect the files key the desktop preload already exposes.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(ci): isolate pnpm setup and the takeover membership
The Team Computer takeover journey inserted a space member the
default-space trigger had already created, so shared Postgres rejected
the unique pair. Self-hosted jobs now keep a per-job pnpm home and
store, and artifact uploads no longer fail a job that already passed.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(ci): clear typecheck, lint, and unit failures
Inbound channel rosters can mark a participant list as authoritative.
Answered channel asks stay off the group, and clearing a thread waits
until delegated returns land. Lint, unit, and web e2e contracts follow
the current shell, composer, and settings.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): align e2e with the shipped shell and onboarding
Web E2E still expected older focus buttons, nested project rows, and
settings that never opened MCP. Persist the signed-in space, list
non-default spaces under Projekte, and keep the quote control on screen.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): open group reply from a revealed hover rail
The first user row covered its Reply control until the rail accepted
pointer events. The group transcript now reveals that rail, then replies.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): stop the shell render loop and settle computer and mention UI
A working bot rewrote preview state on every render, the computer menu never stayed still, and the mention picker did not expose its expanded state or option name.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(ci): stop idle probes hanging and accept a follow-up send
Background probes walked every process fd and timed out on the shared runner. Linux now tracks the marker with flock and /proc/locks. A new composer draft can send while an earlier send is still refreshing, and group members stay mentionable.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(adapters): detect background work when flock ids are padded
The idle probe compared /proc/locks with an unpadded device key, so majors
or minors under 16 never matched. It deleted the live marker and reported
idle while the command still held the lock. Probe by taking the lock, and
print the cancel key the way the kernel does.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(adapters): stabilize background-work probe tests on self-hosted CI
Clear stale marker files before each probe scenario and allow longer
polling so launch can acquire flock on busy persistent runners.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): do not block onboarding on spaces list
Render the first onboarding step from me and integration setup alone.
Resolve the optional skip-to-app redirect after that so Playwright
signups are not stuck on the loading shell when spaces.list is slow.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(ci): restore green gates after second main rebase
Re-apply biome formatting on Shell/SortableGroup and strict TypeScript
assertions in computer-idle tests dropped when skipping the duplicate
conflict-resolution commit.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): wait for onboarding bootstrap before E2E proceeds
Expose data-onboarding-step on the onboarding shell and have Playwright
wait until loading finishes. Ignore ad-hoc screenshot scripts on
self-hosted runners so they do not fail lint.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): fall back when onboarding bootstrap stalls
Race me/integration setup against a timeout and promote loading to the
emoji step after 20s so Playwright is not blocked on a hung RPC.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): render onboarding immediately for E2E signups
Start on the emoji step instead of a loading shell that waits on RPC.
Bootstrap can still redirect once me and integration setup resolve.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(ci): stabilize web e2e on self-hosted runners
Per-job pnpm stores broke node_modules symlinks when setup-node restored
cached installs, so Vite could not resolve react during dependency
optimization. Keep a runner-scoped store, clear stale Vite caches, and pin
Playwright to one worker in CI to reduce onboarding RPC contention.
Add Vite resolve aliases for react/react-dom, wait for an interactive
onboarding step in E2E helpers, and include the React hook smoke spec from
main.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): resolve React aliases through pnpm package layout
Root node_modules/react does not exist under pnpm, so Vite aliases pointed
at missing paths and broke production builds and the Playwright webServer.
Resolve react and react-dom from the web package and map jsx-runtime to the
actual entry files.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(core): type the lazy child_process spawn cache
Main's lazy require left spawn typed as null after assignment, which broke
Typecheck on the rebased branch.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(db): mock git-checkout export path in unit tests
Vitest resolves vi.mock against package exports; the .js suffix is not
declared for @rakazo/core/git-checkout.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): stabilize E2E after main sidebar and onboarding changes
Use first() for duplicate transcript lines, wait for interactive onboarding
before model-required assertions, and allow project sidebar to settle after
create. Extend the Playwright job timeout so the single-worker suite can finish.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): restore Projekte sidebar and integrations MCP entry
Use the default space for Unterhaltungen/Projekte separation instead of the
active space header, persist the bootstrapped space in localStorage, wire
SettingsOverlay to MCP management, and compare hover tones on inactive rows.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): satisfy biome format on homeSpaceId line
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): align sidebar E2E with nested Projekte shell layout
Scope Unterhaltungen assertions to conversation rows only, target project-space
Chief actions under .sidebar-projekte, and stabilize hover-tone polling.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: satisfy lint after main merge (format and unused var)
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): show project-space 1:1 bots in Projekte sidebar
Include lone bots in projectSidebarGroups, render bot rows in Projekte,
and stabilize E2E for nested sidebar layout and duplicate group entries.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): disambiguate duplicate group sidebar buttons in E2E
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): align spaces and group-chats E2E with Projekte sidebar IA
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): dedupe Projekte sidebar rows and stabilize E2E specs
- Deduplicate project space and group-chat entries in projectSidebarGroups
- Scope group-chats/spaces E2E clicks to first Projekte match after IA split
- Wait for shell ready before mention-picker keyboard test; restore main locators
- Fix PrivacySettingsOverlay lint and align biome schema with CLI 2.5.13
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): restrict project drag handle and stabilize space E2E
- Move SortableGroup drag listeners to ProjectDragGrip only so sidebar clicks work
- Scope space delete actions to project-space rows; wait for menu in E2E
- Switch group settings E2E via direct navigation after unsaved draft check
- Merge main (DataTrustPanel) and fix Shell import order for CI lint
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): stabilize message hover Escape assertion in E2E
Assert the More menu closes and the hover rail stays visible instead of
requiring focus restoration, which is flaky across Chromium builds.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* chore: format apps/api/src/app.ts after main merge
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(web): stabilize team-computer E2E send after bot switch
Wait for shell ready and use the Send button instead of Enter after
switching bots and closing the computer overlay. The prior run timed
out on threads/send with only an apps/api format commit in between.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
cynarAI