12 commits

Author	SHA1	Message	Date
Agent	38b55e1855	fix: [nomad-step-5] S5-fix-6 — chat Dockerfile must bake Claude CLI (same as agents #984) (#1016)	2026-04-18 13:08:01 +00:00
Agent	4f5e546c42	fix: [nomad-step-5] S5-fix-6 — chat Dockerfile must bake Claude CLI (same as agents #984) (#1016)	2026-04-18 13:01:12 +00:00
Claude	8799a8c676	fix: [nomad-prep] P5 — add healthchecks to agents, edge, staging, woodpecker-agent (#794) ... Add Docker healthcheck blocks so Nomad check stanzas map 1:1 at migration: - agents / agents-llama: pgrep -f entrypoint.sh (60s interval) - woodpecker-agent: wget healthz on :3333 (30s interval) - edge: curl Caddy admin API on :2019 (30s interval) - staging: wget Caddy admin API on :2019 (30s interval) - chat: add /health endpoint to server.py (no-auth 200 OK), fix Dockerfile HEALTHCHECK to use it, add compose-level healthcheck Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-15 19:39:35 +00:00
Claude	6d148d669b	fix: address AI review feedback - early-return guard and unused volume	2026-04-12 03:38:46 +00:00
Claude	dae15410ab	fix: vision(#623): disinto-chat conversation history persistence (#710)	2026-04-12 03:38:46 +00:00
Claude	3b4238d17f	fix: vision(#623): disinto-chat cost caps + rate limiting (#711) ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-12 03:06:06 +00:00
Claude	f8ac1d2ae2	fix: vision(#623): Caddy Remote-User forwarding + chat-side validation (defense-in-depth) (#709) ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-12 02:21:02 +00:00
Claude	30e19f71e2	fix: vision(#623): Forgejo OAuth gate for disinto-chat (#708) ... Gate /chat/* behind Forgejo OAuth2 authorization-code flow. - Extract generic _create_forgejo_oauth_app() helper in lib/ci-setup.sh; Woodpecker OAuth becomes a thin wrapper, chat gets its own app. - bin/disinto init now creates TWO OAuth apps (woodpecker-ci + disinto-chat) and writes CHAT_OAUTH_CLIENT_ID / CHAT_OAUTH_CLIENT_SECRET to .env. - docker/chat/server.py: new routes /chat/login (→ Forgejo authorize), /chat/oauth/callback (code→token exchange, user allowlist check, session cookie). All other /chat/* routes require a valid session or redirect to /chat/login. Session store is in-memory with 24h TTL. - lib/generators.sh: pass FORGE_URL, CHAT_OAUTH_CLIENT_ID, CHAT_OAUTH_CLIENT_SECRET, EDGE_TUNNEL_FQDN, DISINTO_CHAT_ALLOWED_USERS to the chat container environment. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-12 01:52:16 +00:00
Claude	0c5bb09e16	fix: address review — move LOGFILE to tmpfs, add CapDrop check (#706) ... LOGFILE=/var/chat/chat.log is unwritable on read-only rootfs; move to /tmp/chat.log (tmpfs-backed). Add CapDrop=ALL assertion to verify script so removing cap_drop from compose is caught. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-12 01:19:42 +00:00
Claude	e74fc29b82	fix: vision(#623): disinto-chat sandbox hardening (#706) ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-12 01:08:23 +00:00
Claude	938cd319aa	fix: address AI review feedback for disinto-chat (#705)	2026-04-12 00:46:57 +00:00
Claude	eada673493	fix: vision(#623): disinto-chat container scaffold (no auth) (#705)	2026-04-12 00:46:57 +00:00