Skip to content

fix(shell): restart browser sidecar reliably via healthcheck + DinD isolation#157

Open
konard wants to merge 14 commits intoProverCoderAI:mainfrom
konard:issue-137
Open

fix(shell): restart browser sidecar reliably via healthcheck + DinD isolation#157
konard wants to merge 14 commits intoProverCoderAI:mainfrom
konard:issue-137

Conversation

@konard
Copy link
Contributor

@konard konard commented Mar 18, 2026 •
edited
Loading

Closes #137
Supersedes #140

Summary

  • Healthcheck на browser-сервисе: добавлен healthcheck (curl /json/version на порту 9223) — Docker теперь знает когда CDP реально готов, а не просто когда контейнер запустился
  • depends_on: condition: service_healthy: основной контейнер ждёт здорового browser перед стартом — устраняет race condition при перезагрузке
  • DinD изоляция в docker-compose.api.yml: хостовый docker.sock заменён на выделенный docker:27-dind сервис с DOCKER_HOST=tcp://dind:2375
  • CI fixes: removed dead api-client.ts (sonarjs/no-clear-text-protocols), replaced node:fs + try/catch in docker-env.ts with @effect/platform FileSystem + Effect-TS

Математические гарантии

Инварианты:

  • ∀ restart: main_container_start → browser_cdp_ready (гарантировано через condition: service_healthy)
  • ∀ p: docker_ops(p) → isolated_daemon (docker.sock хоста не задействован)

Предусловия:

  • browser-контейнер отвечает на GET /json/version по порту 9223

Постусловия:

  • main-контейнер стартует только после 10 успешных healthcheck-проверок
  • при перезагрузке browser-контейнера — main автоматически ждёт его готовности

Test plan

  • pnpm --filter ./packages/lib test — 81/81 passed
  • pnpm --filter ./packages/lib lint — 0 errors
  • pnpm --filter ./packages/app lint — 0 errors
  • pnpm --filter ./packages/app lint:effect — 0 errors
  • pnpm --filter ./packages/lib lint:effect — 0 errors
  • All CI checks passing (Lint, Lint Effect-TS, E2E OpenCode, E2E Login context, E2E Clone cache, Build, Test, Types)
  • Поднять стек с --mcp-playwright, перезапустить browser-контейнер, убедиться что main дожидается готовности

🤖 Generated with Claude Code

skulidropek and others added 11 commits March 15, 2026 20:08
@skulidropek @claude
fix(shell): restart browser sidecar reliably via healthcheck + DinD i…
924b7fa 
…solation

- add healthcheck to browser service (curl /json/version on port 9223) so Docker
  knows when CDP is actually ready instead of just when the container started
- switch depends_on to condition: service_healthy so the main container waits
  for a healthy browser before starting — fixes the restart race condition (ProverCoderAI#137)
- replace host docker.sock bind-mount in docker-compose.api.yml with a dedicated
  DinD service (docker:27-dind) and set DOCKER_HOST=tcp://dind:2375 in api,
  providing full Docker isolation without touching the host daemon

Closes ProverCoderAI#137

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek @claude
feat(api): add auth/state/scrap/sessions/mcp-playwright endpoints
9dda672 
- Add REST endpoints for all CLI commands: /auth/github, /auth/codex, /auth/claude, /state/*, /scrap/*, /sessions/*, /mcp-playwright, /projects/down-all, /projects/:id/apply
- Add captureLogOutput utility to capture Effect.log output as response body
- POST /projects/down-all placed before parametric /:projectId routes
- INVARIANT: ∀ cmd ∈ CLICommands \ {Attach, Panes, Menu}: ∃ endpoint: API handles cmd

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek @claude
feat(app): add api-client HTTP module
c9531d0 
- HTTP client for the unified REST API via DOCKER_GIT_API_URL env var
- Typed ProjectCreateRequest and ProjectApplyRequest interfaces (no unknown/Record<string,unknown>)
- O(n) trailing slash removal without backtracking regex (sonarjs/slow-regex safe)
- ProjectDetailsSchema extends ProjectSummarySchema.fields (no code duplication)
- EFFECT: Effect<T, ApiClientError, HttpClient.HttpClient> per request

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek @claude
feat(app): rewrite CLI program to use unified REST API
d91380a 
- CLI is now a thin HTTP client: all business logic delegated to REST API
- Extract named handler functions (handleStateX, handleAuthX, etc.) to satisfy max-lines-per-function
- Attach and Panes remain local (require tmux/terminal)
- Create command: maps config fields → ProjectCreateRequest, conditionally calls attachTmux for openSsh
- main.ts: provide FetchHttpClient.layer alongside NodeContext.layer for HttpClient requirement
- INVARIANT: ∀ cmd ∈ CLICommands \ {Attach, Panes, Menu}: handler(cmd) = httpCall(apiEndpoint(cmd))

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek @claude
fix(api): change auth status routes from GET to POST
c0cef75 
- /auth/github/status, /auth/codex/status, /auth/claude/status use POST
- WHY: status requests carry a body (envGlobalPath, claudeAuthPath)
- INVARIANT: all 3 auth status endpoints match CLI apiPost() calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek @claude
feat(ssh): enable password auth out of the box
a7d99b6 
- PasswordAuthentication yes in sshd_config (was: no)
- Default password = SSH username (dev:dev) set via chpasswd at build time
- PubkeyAuthentication yes kept — authorized_keys still works if provided
- WHY: users need exactly one command to connect, no key setup required
- INVARIANT: sshCommand from REST API works immediately after clone/create

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek @claude
feat(ssh): embed password in sshCommand via sshpass
ccb578e 
- buildSshCommand: when no key → sshpass -p <sshUser> ssh ...
- sshUser is also the default password (set via chpasswd at build time)
- Result: one command from clone/create output connects immediately
- Key auth path unchanged (ssh -i <key> ...)
- INVARIANT: sshCommand from REST API is always directly executable

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@skulidropek
Merge remote-tracking branch 'origin/main' into issue-137
48e563e
@skulidropek
sync
35fd964
@konard @claude
fix: merge main and resolve conflicts, preserve sshpass support
2d75759 
Merges latest main into issue-137 branch. Resolves conflicts by
adopting main's ipAddress-based SSH host resolution while preserving
sshpass password authentication for keyless environments (DinD).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@konard @claude
fix(lint): resolve CI failures — remove dead api-client, fix Effect-T…
bbd6655 
…S lint, fix code duplication

- Remove unused api-client.ts (CLI uses direct lib calls, not REST API)
- Revert main.ts to upstream version (no FetchHttpClient needed)
- Rewrite docker-env.ts to use @effect/platform FileSystem instead of banned node:fs
- Extract shared tmux session logic to avoid duplicate code detection
- Refactor SSH args builders to share constants and stay within max-lines-per-function
- Fix unicorn/no-immediate-mutation in buildSshProbeArgs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@konard konard mentioned this pull request Mar 18, 2026
Open
4 tasks
@konard @claude
fix(app): revert main.ts to upstream — FetchHttpClient no longer needed
593f3f1 
api-client.ts was removed, so FetchHttpClient.layer is unnecessary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@konard
Copy link
Contributor Author

konard commented Mar 18, 2026

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Public pricing estimate: $18.556486
  • Calculated by Anthropic: $10.151405 USD
  • Difference: $-8.405080 (-45.29%)

🤖 Models used:

  • Tool: Claude
  • Requested: opus
  • Main model: Claude Opus 4.6 (ID: claude-opus-4-6, Anthropic, cutoff: 2025-05)
    📎 Log file uploaded as Gist (2876KB)
    🔗 View complete solution draft log

Now working session is ended, feel free to review and add any feedback on the solution draft.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

2 participants

@konard @skulidropek