fix: disable native touch panning on mobile terminal and archive specs

- Change mobile terminal CSS to use touch-action: none and overscroll-behavior: none so the custom touch handler owns swipes - Archive completed/partial OpenSpec specs to openspec/changes/archive/2026-06-14-completed-specs-archive/ - Regenerate project maps Quality gates: npm run typecheck, npm run lint (apps/web)
2026-06-14 18:07:01 +00:00
parent 896674195c
commit c8db6ce933
580 changed files with 4678 additions and 4333 deletions
@@ -0,0 +1,19 @@
+# 2026-06-14-completed-specs-archive/instance-proxy (index)
+dir: 2026-06-14-completed-specs-archive/instance-proxy
+
+## role
+Defines the API contract for a secure proxy service that routes HTTP/WebSocket traffic to running tool instances with owner-based access control.
+## parent
+index: 2026-06-14-completed-specs-archive/.pi-map.index.md
+map: 2026-06-14-completed-specs-archive/.pi-map.md
+## children
+-
+## files
+- spec.md
+## links
+index: 2026-06-14-completed-specs-archive/instance-proxy/.pi-map.index.md
+map: 2026-06-14-completed-specs-archive/instance-proxy/.pi-map.md
+## workflows
+-
+## dirty
+-
@@ -0,0 +1,19 @@
+# 2026-06-14-completed-specs-archive/instance-proxy
+dir: 2026-06-14-completed-specs-archive/instance-proxy
+
+index: 2026-06-14-completed-specs-archive/instance-proxy/.pi-map.index.md
+
+## role
+Defines the API contract for a secure proxy service that routes HTTP/WebSocket traffic to running tool instances with owner-based access control.
+## files
+- spec.md | Specifies API requirements for an HTTP/WebSocket proxy endpoint that forwards requests to running tool instances with owner-based access control
+## arch
+API specification using markdown-based documentation; defines REST/WebSocket endpoint patterns with authentication/authorization requirements, request forwarding semantics, and ownership-based access control policies.
+## tags
+spec, specifies, api, requirements, http, websocket, proxy, endpoint
+## symbols
+-
+## workflows
+-
+## dirty
+-
@@ -0,0 +1,41 @@
+## ADDED Requirements
+
+### Requirement: Proxy endpoint exists for running instances
+The API SHALL expose an endpoint that forwards HTTP requests to a running tool instance.
+
+#### Scenario: Access running instance
+- **WHEN** an authenticated user sends a GET request to `/instances/{id}/proxy/`
+- **THEN** the request is forwarded to the instance's container
+- **AND** the response is returned to the user
+
+#### Scenario: Access instance subpath
+- **WHEN** an authenticated user sends a request to `/instances/{id}/proxy/api/status`
+- **THEN** the request is forwarded to `{container_url}/api/status`
+- **AND** the response is returned to the user
+
+### Requirement: Only instance owner can access proxy
+The proxy endpoint SHALL verify that the authenticated user owns the instance before forwarding.
+
+#### Scenario: Owner accesses instance
+- **WHEN** the instance owner requests `/instances/{id}/proxy/`
+- **THEN** the request is forwarded to the instance
+
+#### Scenario: Non-owner attempts access
+- **WHEN** a user who does not own the instance requests `/instances/{id}/proxy/`
+- **THEN** the API returns 403 Forbidden
+
+### Requirement: Proxy handles WebSocket upgrades
+The proxy endpoint SHALL support WebSocket upgrade requests for real-time features.
+
+#### Scenario: WebSocket connection to instance
+- **WHEN** a user sends a request with `Upgrade: websocket` header
+- **THEN** the API establishes a bidirectional WebSocket connection to the instance
+- **AND** messages are relayed between user and instance
+
+### Requirement: Frontend uses proxy URL for instance access
+The frontend SHALL link to the proxy endpoint instead of the internal container URL.
+
+#### Scenario: User clicks Open button
+- **WHEN** a user clicks "Open" on a running instance
+- **THEN** a new tab opens to `/instances/{id}/proxy/`
+- **AND** the proxied instance content is displayed