3 Commits

Include renames

Author	SHA1	Message	Date
Omar SobhandClaude Opus 4.8	3554a3aaf2	CI: remove k8s stages, fix the Docker-level pipeline green ... Survey + fixes so the pipeline passes at the Docker level (no k8s). - Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the "Helm chart lints" gate step. release.yml was already k8s-clean. - Rust job: - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing). - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api fleet.rs doc list indentation, node_rules map_or→is_none_or). - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test query → offline compile failed). DB-backed tests use testcontainers at runtime. - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against the committed cache deterministically (no DB needed at compile time). - Frontend job: - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect; tag the slice with agentId + derive null on mismatch). - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the current APP_IDS + use a genuinely-unknown id for the reject case). Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline), frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-26 18:15:31 -07:00
Omar SobhandClaude Opus 4.8	fb59378aa2	Fleet P2b: run agent sandboxes on connected nodes (RemoteDriver + placement) ... Agents can now provision their sandbox on a connected fleet node instead of the gateway host. Local stays the strict default, so existing agents are byte-for- byte unaffected until explicitly placed elsewhere. Security parity: the daemon links the REAL cm-sandbox DockerDriver and runs the typed container ops (sb_provision/sb_exec/sb_destroy/sb_health/sb_list) through it — identical hardening (cap-drop ALL, seccomp, no-net, read-only, non-root) to local sandboxes. cm-sandbox spec types are now Serialize/Deserialize so the spec crosses the channel. - cm-api: RemoteDriver (impl SandboxDriver over the node channel) + HubDriverProvider (impl cm_runtime::NodeDriverProvider, hands out a driver only for connected nodes via a sync online set) + NodeHub.call/is_connected. AppState.with_node_hub so the hub is shared with the placement provider. - cm-runtime SandboxManager: driver_for(node_id) routes by the recorded agent_containers.node_id (local default = existing driver, identical path); placement_node() reads the workspace setting and falls back to local if the node is offline; exec/release route accordingly. NodeDriverProvider trait. - DB: 0020_workspace_placement + repo (for_agent/get/set/clear). - main.rs: build the NodeHub first; inject HubDriverProvider into the agent manager + share the hub with AppState. - API+UI: GET/PUT /api/fleet/placement + a "Run agents on: Local / <node>" selector in the Fleet overview. Note: a node must be able to pull the agent image (the daemon docker-pulls it); interactive PTY for agent containers on remote nodes is not wired (Terminal app stays local) — the in-dashboard node shell already covers host access. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-24 12:48:50 -07:00
Omar SobhandClaude Opus 4.8	7332d69f8a	Fleet P1: BYO Tailscale + network metrics, Tailscale SSH, exec hardening ... Security hardening: - The gateway no longer sends arbitrary shell to nodes. The WSS exec op is replaced by a typed `verify` op the daemon runs itself (fixed host+docker check); future container ops are typed too. cm-api NodeHub.verify() + the daemon's handle_command only dispatches vetted ops. BYO Tailscale: - migrations/0019_workspace_tailscale.sql + cm-db fleet_tailscale repo (store the user's Tailscale API key + tailnet, server-side only). - cm-api routes/tailscale.rs: POST/GET/DELETE /api/fleet/tailscale + GET /api/fleet/tailscale/devices (proxies api.tailscale.com device list). - Daemon: --tailscale-authkey → `tailscale up --authkey … --ssh` (enables Tailscale SSH for keyless user access); else `tailscale set --ssh=true`. Reports its tailscale IP (already). UI: - Fleet overview gains a Tailscale section: connect (key+tailnet) + live tailnet device status (online/last-seen/IP/os). Node cards show a copyable Tailscale SSH target (ssh <ip>). Remaining: P2 — RemoteDriver + placement (run agents on nodes) and the in-UI remote terminal (PTY proxied over the WSS channel). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-24 10:27:58 -07:00