Repository navigation
feat(extension): the hub-host client posture — amicode.hubServerUrl spawns nothing, the panel becomes one server (#1760 P4) - #1784
Merged
aarontrowbridge merged 5 commits intoOct 13, 2026
Conversation
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
… P4) The hub-host client posture's pure core: readHubClientConfig (empty = base posture byte-identical; a valid http(s) URL arms; garbage fails to base with a named reason) and bootPosture (the explicit setting outranks the inferred darwin fleet-client guard; unarmed keeps today's ladder). The reserved hub port range 4094-4097 is declared (guard lands next).
P4) Nothing the extension starts may bind 4094-4097 (the hub plane's ports: runner engine 4094, hub service 4095, frontdoor 4096/4097). A pinned amicode.opencodePort in the range is refused with a named log line and falls back to a free ephemeral port; the picked free port is re-checked. Unguarded, a 4096-pinned spawn health-checked against the LIVE frontdoor and reported ready while talking to the wrong server — the erlich three-bounce pattern in miniature.
… surface (#1760 P4) startHubClientSession mirrors the fleet-client tunnel poll's hysteresis discipline against the configured hub URL: attach hands the caller the hub URL for EVERY server resolution (ready URL, SSE, framed panel); detach rides the failure-streak window; the session owns no spawn surface at all. Injectable fetch/poll/interval keep it unit-tested against a real mock hub.
P4) amicode.hubServerUrl armed → bootPosture hub-client branch: no adopt-or- spawn, no ServerManager, no amicode service, no keepalive — the hub session attaches every server resolution to the hub URL (the framed app's registry IS { hub }: entry.tsx derives it from the document origin). restartServer re-probes the hub (poke, hysteresis-correct); Go Standalone clears the setting before the local spawn; deactivate stops the session. The reserved-hub-port guard also wraps the two opencodePort read sites and the service's enginePort+1 derivation. The darwin fleet-client branch body is byte-identical (only the branch condition carries the posture decision).
…nel (#1760 P4) postEventStreamUrlAssert ships one greppable JSON line {assert:global-sdk-event-url, url} to the serving origin's /__amicode_client_log at stream start — the production-visible proof that the panel's global SDK resolves the hub URL when the hub-host client posture is armed (the headless probe greps the hub's client-errors.log for it). Manifest hash synced (auto-refresh, minimal diff: one file hash + extracted_at).
aarontrowbridge
force-pushed
the
opencode/issue-1760-p4-hub-client
branch
from
October 13, 2026 13:50
ca0fb06 to
0a825a9
Compare
aarontrowbridge
added a commit
that referenced
this pull request
Oct 13, 2026
# Conflicts: # packages/app-bundle/manifest.json # packages/app-bundle/overlay/packages/app/src/context/server-sdk.test.ts # packages/app-bundle/overlay/packages/app/src/context/server-sdk.tsx # packages/extension/src/extension.ts
This was referenced Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements P4 (sharpened) — the hub-host client posture from #1760. TOP PRIORITY: the last prerequisite before P1's shared-secret can arm. Cut from
live-test/stack-e2e@01ed5476 (the union base); PR targets that lane.The confirmed root cause this kills
isFleetClientGuard(extension.ts:189) opens withif (process.platform !== "darwin") return false— on a Linux extension host (erlich, VS Code remote-SSH) the extension ALWAYS spawns its own service (:4095) + engine (--port 4094, racing shard 1 — the mystery three-bounce pattern), and that spawned engine becomes the panel's DEFAULT server: the global event stream + question dock ride a private bus where fleet events never arrive — stuck thinking while the engine runs fine, replies 404ing on an engine holding no questions. This one bug explains the remaining panel stuck-thinking AND the live-question-cards red (the #1756 shard-1 probe was the browser panel — one server, the hub — while the VS Code panel rode the spawn).The four requirements (Aaron's contract, verbatim scope)
amicode.hubServerUrl(string, default""— the repo's empty-string-means-absent convention; aclientModeenum would need a companion URL key anyway). ALL platforms, explicit-only — never inferred from platform or fleet projection (inference is what made the darwin guard brittle). Armed → the hub branch runs no adopt-or-spawn, no ServerManager, no service, no keepalive — the spawn block is unreachable by branch structure. The darwin fleet posture is byte-identical (condition header only).opencodeReadyUrl = hub, every resolver rides it (SSE client, provider signal,frameUrl()for every panel site: ChatPanel ×9, DeckPanel, bug_report, compute-connect), and the app derives its ENTIRE server registry from the document origin → registry IS {hub}: global SDK, session views, question dock, replies.restartServerpokes the session (hysteresis-correct);goStandaloneclears the setting before any spawn — the escape hatch never spawns under an armed setting.ServerManager.startchoke point (all five construction sites), theopencodePortread site, the enginePort+1 derivation (a 4093 pin would have put the service ON 4094), andrespawnForVault— with a RED test proving the unguarded 4096 pin health-checked against the live frontdoor and reported ready against the wrong server. The hub's own ops-spawned runner defaults are deliberately unguarded — it IS the hub.postEventStreamUrlAssertposts{"assert":"global-sdk-event-url","url":…}at stream start through the fix(app+ops): client telemetry — ungate the capture, root-relative ingest, heartbeat canary + freshness check #1748 channel, so a panel framed at the hub lands the proof in the liveclient-errors.logwhere the probe greps it; exact post-deploy probe commands in the notes (arm → reload → no-spawn output-channel proof →ssport proof → the assert line → the macbookssereq.mjsprobe).Gates (orchestrator-run)
sidebar_view.tserror, identical on base — zero newdrift_gate.mjsPASS (895 files, minimal manifest diff)Honest notes
activate()has no automated-test harness (repo-wide precedent — no test drives extension.ts); the wiring is thin delegation over the unit-tested seams, and the post-deploy probes are the end-to-end proof. A harness would be its own slice.AMICODE_ENGINE_SHARED_SECRETin the diff; P1 stays in shadow until this lands + the P1-arming checklist in the notes passes (no-spawn proof, 4097-only panel, the assert line, macbook clients on the gateway).