Skip to content

Feat/operator edition - #602

Open
dashw00d wants to merge 59 commits into
oblien:mainfrom
dashw00d:feat/operator-edition
Open

Feat/operator edition#602
dashw00d wants to merge 59 commits into
oblien:mainfrom
dashw00d:feat/operator-edition

Conversation

@dashw00d

Copy link
Copy Markdown

Summary

Motivation

Related issue

Changes

Verification

Screenshots

Checklist

  • One change per PR — one bug, or one agreed feature, with nothing unrelated bundled in
  • The diff is scoped — no reformatting or lint fixes on lines I wasn't otherwise changing
  • A test fails without this change and passes with it (or I explained above why there isn't one)
  • bun run test, bun run --cwd <workspace> lint, and bun format all pass locally
  • I understand every line of this diff and can explain it in review

# Conflicts:
#	apps/api/src/modules/projects/project-crud.service.ts
#	apps/dashboard/src/app/(dashboard)/settings/_components/SettingsSidebar.tsx
#	packages/adapters/src/runtime/docker-transport.ts
#	packages/db/drizzle/meta/_journal.json
Runtime and code pointers are independent live state.
Compose name changes must not retarget reload or health checks.
Code-release projects take the mounted path; unrelated monorepo paths skip.
Hide Cloud/billing/waitlist on operator. Keep SaaS modules compiling.
Persist phases so a restart cannot activate a cancelled or half-done release.
Single-instance lock focuses the first window. Close hides to tray so
the embedded API/MCP stay up; quit is tray/menu only. Port fallback
now persists and advertises the live MCP origin instead of silently
invalidating OAuth. Settings → Instance and the titlebar show the
fingerprint, data path, and endpoint, with open/restart/repair/backup
actions. JSON config writes are atomic. Profiles are browser sessions
that share one PGlite database.
Stop reporting migration success when source stop or restart failed.
Keep clone tokens in extraheader env instead of https://x-access-token:TOKEN@
process arguments. Protect _management.conf on takeover, track imported
domains for ssl:renew, refuse bind-mount dest collisions, and add an
edge HEALTHCHECK on loopback :9145.
Snapshot the release contract; clean paths as directories; chmod trees after activate.
Keep Repair's original preferred ports across later fallback starts.
Treat false/null instance actions as failed/cancelled. Lock loser
exits before constructing stores. Packaged backup stops PGlite
before copy. Atomic JSON swaps via .bak and never writes dest
in place. Refresh stale close/menu comments.
Imported/restored hosts are an imported owner on the local edge so
ssl:renew no longer 404s. Carried PEMs are manualSsl; enrollment is
awaited. Start treats a missing container as a failed restore. Remote
clones write a 0600 extraheader gitconfig instead of interpolating
the token into the SSH command.
…plan/e2ff117d-pr-15-curate-operator-mcp-tools-and-github-credentials
Advertise the 12 stable operator MCP names by default. Generated REST
tools stay under advanced.* and list only when includeAdvanced is set.
spec.mcp.name wins so prompts can hard-code those names.

Long-running curated writes collapse to { operationId }. Reads have a
hard timeout, and tools/call now has an outer execution deadline.

GitHub settings show the connected browse identity and which stored
credential will actually clone. Saving a token or server cred runs
ls-remote via ASKPASS (token never on argv).
…eader

Flip a retained code-release pointer instead of fetching again. Probe the
public hostname after activation. Show combined live state on the project
deployments tab with a deploy preview and More menu.
Check in versioned release recipes for Dashwood, Lake Forest, AE Public,
AE Staff, and AE Mail, plus the human move-order runbook. Recipes carry
mountedRelease plus planner hints and round-trip without secret keys.
Replace the mounted-release settings pile with a five-step recipe wizard
(what runs, runtime install, how code ships, what persists, activation).
Laravel / static Next / Node / Compose presets fill project.mountedRelease
and feed planner path prefixes. Live header shows Runtime + Code converging
on the hostname, plus a versioned recipe summary from the same JSONB store.
Add a tiny always-on daemon that keeps production healthy when the
desktop control plane is closed. The agent executes decided ops over
HMAC-SHA256 envelopes, journals them on disk, and serializes builds.
Enrollment lives on the server row; jobs dispatch to an enrolled agent
and keep today's in-process path when none is present.
Add packDeterministicArtifact (tar+zstd or gzip, sorted files, mtime 0)
with a sidecar manifest and SHA-256 verification. Mounted releases now
have three drivers behind prepareRelease: git-prebuilt, local-upload,
and server-prepared. Upload mode is a user-triggered multipart path
(POST /api/deployments/artifact) that verifies the digest before
activation; webhooks stay on deploy_code and do not fetch. Unchanged
lockfile hashes skip prepareCommand and reuse builder-cache or the
previous ready tree. Mail keeps immutable image releases.
Keep the release-recipe wizard and presets. Add git-prebuilt / local-upload /
server-prepared drivers, SHA-256 verification, lockfile skip, and the
deterministic tar/zstd packer. Export allowlists upload plus wizard fields.
Operator is the only product. Unmount and remove billing/cloud modules,
Stripe/Oblien clients, plan-guard, Cloud connection UI, waitlist, and
Cloud deploy targeting. CLOUD_MODE / DEPLOY_MODE=cloud hard-fails at
boot. Grants no longer include billing or cloud. Drop SaaS tables and
organization billing columns in 0112. Keep local orgs, invites, audit,
credentials, MCP, and GitHub device/token/gh.
Drop unused billing/cloud schema and repos, remove cloudWorkspaceId,
and stop deriving a Cloud deploy target. Agent execute_release now
validates a versioned release manifest. Desktop already labels these
as browser sessions; the Cloud promote CLI/API path is gone.
node:crypto from the barrel export broke next build, which blocked the
Windows desktop package. API and the agent already import the subpath.
The desktop API crashed on boot because dump still listed that column
after the SaaS table was removed. Services never became ready.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant