Skip to content

refactor(sidecar)!: byte-for-byte copy of upstream apps/sidecar at 79adc433 #813

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheGreatAxios merged 1 commit into from
Sep 17, 2026
Merged

refactor(sidecar)!: byte-for-byte copy of upstream apps/sidecar at 79adc433 #813

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion VENDORED.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ never a convenience.

| Vendored path | What was copied | Upstream repo @ commit | Why not a published package | Owner | Kill date | Kill-date test |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ---------- | ----------------- |
| `apps/sidecar` | Derived from upstream's own `apps/sidecar`: six modules byte-identical (`default-harness.ts`, `signing-keypair.ts`, `source-asset-delivery.ts`, `workflow-closure-apply.ts`, `workflow-probe-handler.ts`, `workflow-run-pack-restore.ts`), three near-verbatim (`atomic-write.ts` differs only by the repo-wide logger namespace), the rest (`index.ts`, `config.ts`, `tool-materialization.ts`, `step-agent-tools.ts`, `workflow-host-wiring/`, `workflow-substrate-factory/`, …) substantially rewritten, plus workbench-only modules. A living fork, not a frozen copy, so this row carries no tree hash. | [faremeter/interchange](https://github.com/faremeter/interchange) @ `79adc433` (origin/main, 2026-09-17) | An app is never npm-published, so no publish can cover the execution host; retired by consuming an upstream-published host, or by renewing this row deliberately | sawyer | 2026-11-03 | `check:killdates` |
| `apps/sidecar` | Byte-identical to upstream `apps/sidecar` at this pin — no local delta; every Workbench-only module (`oauth-login.ts`, `originating-workbench.ts`, `hibernated-agent-identity-vault.ts`, `hub-link-watchdog.ts`, `workflow-deployment-record.ts`, `shutdown.ts`, `concurrency.ts`, `boot-restore-push-hold.ts`, the `workflow-host-wiring/`/`workflow-substrate-factory/` split directories, `step-strategy.ts`, `workbench-director.ts`, and their tests) deleted outright. | [faremeter/interchange](https://github.com/faremeter/interchange) @ `79adc433` (origin/main, 2026-09-17) | An app is never npm-published, so no publish can cover the execution host; retired by an upstream `@intx/sidecar` publish, or by renewing this row deliberately | sawyer | 2026-11-03 | none — no check scripts |
| `vendor/intx/agent` | `@intx/agent` source (`src/`, manifest, tsconfig) | [faremeter/interchange](https://github.com/faremeter/interchange) @ `79adc433` (origin/main, 2026-09-17) | npm 0.3.0 predates the operator-configurable doom-loop threshold (`afd0c82b`, `c421c092`) the re-vendored `workflow-host` configures; the CL-7190 `beforeToolExtension` delta is absorbed upstream at this pin — no local delta; retired by the next `@intx/agent` publish | sawyer | 2026-11-03 | `check:killdates` |
| `vendor/intx/db` | `@intx/db` source (`src/`, `migrations/`, drizzle config, manifest, tsconfigs) | [faremeter/interchange](https://github.com/faremeter/interchange) @ `79adc433` (origin/main, 2026-09-17) | npm 0.3.0 predates this pin's schema; the CL-6324 `wire_projection` column/loader and the CL-6452 `workflow_definition.origin` column are GONE upstream at this pin (CL-8206) — every hub-side reader of either is a hard cutover in this change, not a port — and the unpublished per-principal signing-key series (`principal_key`) this pin previously re-vendored is now upstream-native, so that delta is dropped; the pin keeps a CL-7505 serving-time refresh delta (`model-source-resolution.ts`: `buildSource`/`resolveModelSources`/`resolveInstanceModelSources` accept an optional `servingRefresh` hook, with a `credential_needs_reauth` skip so an unrefreshable `oauth_token` credential is never served) and a CL-7510 delta (`"openai-responses"` in `schema/catalog.ts`'s `modelProvider.plugin` enum, and an adapter registry-key dispatch rewrite in `model-source-resolution.ts`'s `buildSource` so `ollama`/`codex`/`xai-oauth` resolve their own registry key while the catalog `plugin` column keeps the wire-format id); retired when upstream absorbs the deltas | sawyer | 2026-11-03 | `check:killdates` |
| `vendor/intx/harness` | `@intx/harness` source (`src/`, manifest, tsconfig) | [faremeter/interchange](https://github.com/faremeter/interchange) @ `79adc433` (origin/main, 2026-09-17) | npm 0.3.0 predates the connector reply drain (`driveConnectorReplies`, `ConnectorReplyDrain`, `AgentEventStream`; `11590e66`) the sidecar's warm mail loop drives; no local delta; retired by the next `@intx/harness` publish | sawyer | 2026-11-03 | `check:killdates` |
Expand Down
40 changes: 9 additions & 31 deletions apps/hub/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,6 @@ import {
createMcpOAuthRoutes,
createMcpServerRoutes,
createOAuthConnectRoutes,
createOAuthLoopbackRoutes,
createTenantConnectCredential,
createWorkflowConnectionRoutes,
DEFAULT_RETURN_PATH_ALLOWLIST,
Expand Down Expand Up @@ -516,26 +515,20 @@ export async function createHub(config: HubConfig) {
// process-provisioned sidecar reaches easily, since a child that
// outlives its allocation keeps reconnecting to the same hub.
const sidecarCredentials = createSidecarCredentialResolver({ db });
// CL-7508's loopback login (`oauthLogin` gate + `requestOAuthLogin`) is
// native to `@intx/hub-sessions`'s sidecar router, but it only works when
// the sidecar side answers the hub's `oauth.login.start` frame with an
// `oauthLoginExecutor` wired into `createSidecarOrchestrator`'s hub link
// (`@intx/hub-agent`). Absent that, the link falls back to a fail-closed
// placeholder executor that errors every `oauth.login.start` it receives.
// Upstream's `apps/sidecar` (the byte-for-byte copy this repo now runs)
// wires no such executor, so the gate is dead on arrival. Left unset here
// rather than configured against a sidecar that can never answer it.
const sidecarRouter = createSidecarRouter({
hubPublicKey,
authenticateSidecar: async ({ token }) => sidecarCredentials.resolve(token),
validateSidecarIdentity: sidecarCredentials.isCurrent,
lookups,
// CL-7508: a loopback login may only run on a sidecar whose allocation
// was provisioned by the `process` backend — the only one that runs on
// this host, where the user's browser can reach the pinned ports
// (1455/1456). A docker/e2b-provisioned sidecar's localhost is the
// container or the sandbox, never this machine, so it fails the gate
// and the connect request gets the typed gate outcome.
oauthLogin: {
isLocalSidecar: async (identity) => {
const allocation = await db.query.sidecarAllocation.findFirst({
where: (allocation, { eq: equals }) => equals(allocation.id, identity.allocationId),
columns: { provisionerId: true },
});
return allocation?.provisionerId === "process";
},
},
});
const isSidecarRoutable = (address: string) =>
sidecarRouter.getRoutableAddresses().includes(address);
Expand Down Expand Up @@ -1119,21 +1112,6 @@ export async function createHub(config: HubConfig) {
returnPathAllowlist: [...DEFAULT_RETURN_PATH_ALLOWLIST, "/plugins", "/w/"],
}),
);
// Loopback OAuth connect (CL-7508): codex/xai-oauth connect through a
// sidecar-hosted pinned-port login, not a hub redirect. The gate (a local
// sidecar) lives on the router; this mount only ships the authorize URL
// back to the caller and lets the sidecar's terminal result frame persist
// through the shared connect sequence.
app.route(
`${TENANT_PREFIX}/connections/oauth`,
createOAuthLoopbackRoutes({
hubUrl: config.baseUrl,
log: (line) => log.info`${line}`,
registry: CONNECTOR_REGISTRY,
requestOAuthLogin: (args) => sidecarRouter.requestOAuthLogin(args),
providerHealth: providerHealthStore,
}),
);
// MCP servers: the tenant-scoped connect/list/disconnect surface
// Plugins drives (CL-6142), mirroring `connections` above but for
// tenant-minted `mcp:<slug>` connectors rather than
Expand Down
Loading
Loading