Add workspace isolation and global proxy - #537
Open
dbpolito wants to merge 31 commits into
Open
Conversation
- support Rift and Git worktree Compose isolation and lifecycle management - add deterministic global Caddy routing with HTTP and HTTPS support - show and stop source and workspace projects safely - propagate agent environment context and document workspace configuration
- compare canonical working-directory paths on macOS - upgrade Go security dependencies to patched releases
- skip workspace and proxy discovery unless configured - preserve legacy status, share, start, and stop behavior - isolate recursive working-directory environment changes - restore temporary Compose overrides and reject mixed listener modes
- map custom external networks through a stable Compose key - safely switch listeners between HTTP and HTTPS - remove stale TLS policies and cover regressions
- clear environment values loaded by the parent project - preserve shell-provided environment precedence - isolate child Compose overrides and restore the parent context
- distinguish newly created routes from existing updates - roll back only routes created by the failed prepare attempt - cover repeated route registration behavior
- snapshot and restore Caddy apps when preparation fails - serialize readiness, route updates, and reconciliation - preserve prepared routes when Compose start fails
- serialize route and TLS removal and reject duplicate host claims - hash canonical workspace paths to avoid basename collisions - exclude Compose one-off containers from workspace status
- remove project routes and TLS policy under one lock - reject shared exact host patterns across projects - preserve workspace hash suffixes for long names
- expose the Caddy Admin API only through a private Unix socket - roll back failed starts when proxy state remains unchanged - preserve concurrent Caddy updates during conditional rollback
- bind Caddy admin to a dedicated management interface - recreate legacy proxy containers and reject stale autosaves - retain conditional startup rollback without Unix socket coupling
- reject the proxy admin network for application routing - reject routes that claim Caddy admin port 2019 - cover both configuration validation failures
- always start Caddy from the generated secure base config - avoid substring-based trust of persisted autosaves - cover startup command security assumptions
- inspect stored proxy entrypoint and command during readiness - recreate containers that can still resume autosaves - cover secure and legacy compatibility signatures
- reapply desired routes and TLS after Compose succeeds - stamp route state with a per-prepare generation - prevent failed starts from matching another start state
- return final proxy reconciliation failures from start - keep failed-start rollback errors observable - detect attached recursive working-directory shorthand forms
- remove only failed-generation routes after concurrent updates - roll back foreground proxy state when Compose exits - join preparation and snapshot restoration failures
- merge failed generations with pre-start project routes - preserve unrelated concurrent route and TLS updates - snapshot and restore failed final reconciliation
- merge rollback changes into lossless Caddy app JSON - conditionally restore listener protocol and TLS policy presence - preserve unrelated server and application fields
- gate TLS rollback on active failed-generation ownership - preserve listener mode when surviving routes remain - cover newer same-project TLS and shared listeners
- compare surviving project routes with committed state - restore TLS when only unchanged project routes survive - cover partial-start rollback with unrelated updates
- recreate proxy with the union of listener ports and networks - restore complete Caddy apps after listener expansion - clear global network across recursive directory contexts
- recreate the original proxy after expansion failures - restore prior ports, networks, readiness, and Caddy apps - join expansion and container rollback failures
- snapshot live Caddy apps before legacy container removal - retain existing listener ports and connected networks - use transactional recreation rollback for migration failures
- retain host IP and host-to-container port mappings - reuse exact bindings during migration and rollback - remove or restore failed-generation listener servers
- exclude inherited Admin bindings from replacements - preserve explicit IPv4 host binding addresses - emit Docker-compatible bracketed IPv6 publishes
- canonicalize directory keys across macOS symlink paths - remove obsolete proxy helpers flagged by lint - keep recursive environment tracking platform-independent
- restart stopped proxy containers before Admin API access - bind Caddy admin to the Docker-published interface - cover reachable base configuration and readiness paths
- keep identity hashes out of public workspace URLs - retain hashes only for internal Compose isolation - stop the global proxy after its final managed route is removed
- start and await existing stopped Caddy containers - inspect listener ports only after Admin readiness - keep last-route automatic shutdown restartable
- keep clean hostnames for normally unique workspaces - detect duplicate Git worktree basenames from the worktree list - add identity suffixes only when hostname uniqueness requires them
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket
SKIPPED
Description
Add provider-neutral workspace isolation for Rift and Git worktrees, backed by dedicated Compose projects and a managed global Caddy proxy. Workspace lifecycle commands now coordinate source and workspace projects safely, while deterministic route ordering and cleanup keep source, tenant, Vite, and HTTPS traffic isolated.
Checklist
Workspace Lifecycle
kool statusProxy Routing
Runtime Integration
--working_diris appliedValidation
golangci-lintreports zero issues/usr/local/bin/koolmatches the development binary