fix: use host bind mount for repos so tool instances can access workspace files

Replace named Docker volume (repo_data) with bind mount (/data/repos) in both development and production compose files. The named volume trapped repo files inside the API container; tool instances started via Docker socket on the host could not see them, causing /workspace to mount as an empty directory. Also fix 6 pre-existing test failures in test_tool_instances_legacy.py caused by get_container_id/get_container_name moving to docker.py and new helpers (_ensure_web_bind_address, _ensure_container_name_in_compose) being added. - docker-compose.yml: repo_data:/data/repos -> /data/repos:/data/repos - docker-compose.traefik.yml: same change + remove repo_data volume decl - tests: update patch targets and add missing mock parameters Quality gates: pytest test_tool_instances_legacy.py (10 passed)
fix: mobile terminal scroll in both normal mode and tmux
2026-06-02 12:47:14 +02:00 · 2026-05-29 20:35:28 +02:00 · 2026-05-29 20:23:19 +02:00 · 2026-05-29 20:16:12 +02:00 · 2026-05-29 20:08:58 +02:00 · 2026-05-29 20:03:11 +02:00
9 changed files with 335 additions and 46 deletions
@@ -0,0 +1,148 @@
+"""Fix code-server bind address to include port
+
+Revision ID: 2026_05_29_fix_code_server_bind_addr_port
+Revises: 2026_05_29_remove_lsio_command_override
+Create Date: 2026-05-29 18:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import yaml
+
+# revision identifiers, used by Alembic.
+revision: str = "2026_05_29_fix_code_server_bind_addr_port"
+down_revision: Union[str, None] = "2026_05_29_remove_lsio_command_override"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _fix_tool_type_templates(conn) -> None:
+    """Fix code-server tool type templates with broken --host override."""
+    result = conn.execute(
+        sa.text("""
+            SELECT id, compose_template, default_port
+            FROM tool_types
+            WHERE name = 'code-server'
+            AND compose_template LIKE '%--host%'
+        """)
+    ).fetchall()
+
+    for tool_id, compose_template, default_port in result:
+        port = default_port or 8443
+        expected = f"--bind-addr 0.0.0.0:{port}"
+
+        # Replace any line containing --host with the correct bind-addr
+        lines = compose_template.split("\n")
+        new_lines = []
+        modified = False
+        for line in lines:
+            if "command:" in line and "--host" in line:
+                indent = line[: len(line) - len(line.lstrip())]
+                new_lines.append(f"{indent}command: {expected}")
+                modified = True
+            else:
+                new_lines.append(line)
+
+        if not modified:
+            continue
+
+        updated = "\n".join(new_lines)
+        conn.execute(
+            sa.text("""
+                UPDATE tool_types
+                SET compose_template = :compose_template
+                WHERE id = :id
+            """),
+            {"compose_template": updated, "id": tool_id},
+        )
+        print(f"Fixed code-server template ({tool_id}): replaced --host with {expected}")
+
+
+def _fix_instance_compose_files(conn) -> None:
+    """Fix existing instance compose files on disk with broken --host override."""
+    from pathlib import Path
+
+    # Use information_schema to check if compose_path column exists
+    col_result = conn.execute(
+        sa.text("""
+            SELECT column_name
+            FROM information_schema.columns
+            WHERE table_name = 'tool_instances'
+            AND column_name = 'compose_path'
+        """)
+    ).fetchone()
+
+    if not col_result:
+        print("compose_path column not found, skipping instance file fixes")
+        return
+
+    result = conn.execute(
+        sa.text("""
+            SELECT id, compose_path, tool_type_id
+            FROM tool_instances
+            WHERE compose_path IS NOT NULL
+        """)
+    ).fetchall()
+
+    for instance_id, compose_path, tool_type_id in result:
+        path = Path(compose_path)
+        if not path.exists():
+            continue
+
+        try:
+            content = path.read_text()
+        except Exception:
+            continue
+
+        if "--host" not in content:
+            continue
+
+        # Get default_port from tool_type
+        port_result = conn.execute(
+            sa.text("""
+                SELECT default_port FROM tool_types WHERE id = :id
+            """),
+            {"id": tool_type_id},
+        ).fetchone()
+        port = port_result[0] if port_result and port_result[0] else 8443
+        expected = f"--bind-addr 0.0.0.0:{port}"
+
+        try:
+            data = yaml.safe_load(content)
+        except Exception:
+            continue
+
+        if not data or "services" not in data:
+            continue
+
+        modified = False
+        for svc in data["services"].values():
+            if "command" in svc:
+                cmd = svc["command"]
+                if "--host" in cmd:
+                    svc["command"] = expected
+                    modified = True
+
+        if not modified:
+            continue
+
+        try:
+            path.write_text(yaml.dump(data, default_flow_style=False))
+            print(
+                f"Fixed code-server instance compose ({instance_id}): "
+                f"replaced --host with {expected}"
+            )
+        except Exception as exc:
+            print(f"Failed to fix instance {instance_id}: {exc}")
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    _fix_tool_type_templates(conn)
+    _fix_instance_compose_files(conn)
+
+
+def downgrade() -> None:
+    pass
@@ -652,7 +652,9 @@ def _ensure_container_name_in_compose(compose_path: str, container_name: str) ->
        )


-def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
+def _ensure_web_bind_address(
+    compose_path: str, tool_type_name: str, default_port: int
+) -> None:
    """Auto-inject bind address for known web tools that default to 127.0.0.1.

    Many web tools (code-server, jupyter) bind to localhost by default,
@@ -662,9 +664,12 @@ def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
    import yaml
    from pathlib import Path

-    KNOWN_BIND_FIXES = {
-        "code-server": "--host 0.0.0.0",
-        "jupyter-notebook": "start-notebook.sh --ip=0.0.0.0",
+    if default_port <= 0:
+        return
+
+    KNOWN_BIND_FIXES: dict[str, str] = {
+        "code-server": f"--bind-addr 0.0.0.0:{default_port}",
+        "jupyter-notebook": f"start-notebook.sh --ip=0.0.0.0 --port={default_port} --no-browser",
    }

    bind_command = KNOWN_BIND_FIXES.get(tool_type_name)
@@ -713,8 +718,15 @@ def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:

        existing_command = service_config.get("command", "")
        if existing_command:
-            # Fix broken --bind-addr (replaces with --host)
-            if "--bind-addr" in existing_command:
+            # Already correct — nothing to do
+            if bind_command in existing_command:
+                return
+            # Fix broken or outdated bind flags
+            if (
+                "--bind-addr" in existing_command
+                or "--host" in existing_command
+                or "--ip=" in existing_command
+            ):
                service_config["command"] = bind_command
                compose_file.write_text(
                    yaml.dump(compose_data, default_flow_style=False)
@@ -726,9 +738,6 @@ def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
                    bind_command,
                )
                return
-            # Already has correct --host, nothing to do
-            if "--host" in existing_command or "--ip=" in existing_command:
-                return
            # Some other command override exists — don't touch it
            return

@@ -1673,7 +1682,9 @@ async def start_instance(

    # Auto-fix bind address for known web tools that default to localhost
    if tool_type and tool_type.interface_type == "web":
-        _ensure_web_bind_address(instance.compose_path, tool_type.name)
+        _ensure_web_bind_address(
+            instance.compose_path, tool_type.name, tool_type.default_port
+        )

    # Ensure predictable container name for tunnel connectivity
    _ensure_container_name_in_compose(instance.compose_path, instance.name)
@@ -2151,7 +2162,9 @@ async def restart_instance(
        _sanitize_compose_file(instance.compose_path)
        tool_type = await session.get(ToolType, instance.tool_type_id)
        if tool_type and tool_type.interface_type == "web":
-            _ensure_web_bind_address(instance.compose_path, tool_type.name)
+            _ensure_web_bind_address(
+                instance.compose_path, tool_type.name, tool_type.default_port
+            )
        _ensure_container_name_in_compose(instance.compose_path, instance.name)

        returncode, stdout, stderr = execute_compose_command(
@@ -184,7 +184,7 @@ class TestToolTypesAPIExtended:
                "interfaces": ["web", "terminal"],
                "default_port": 8443,
                "definition_type": "compose",
-                "compose_template": "version: '3.8'\nservices:\n  app:\n    image: code-server\n    command: --host 0.0.0.0\n    ports:\n      - '8443:8443'\n    volumes:\n      - \"{{REPO_PATH}}:/workspace\"",
+                "compose_template": "version: '3.8'\nservices:\n  app:\n    image: code-server\n    command: --bind-addr 0.0.0.0:8443\n    ports:\n      - '8443:8443'\n    volumes:\n      - \"{{REPO_PATH}}:/workspace\"",
                "readiness_probe": {
                    "command": "curl -f http://localhost:8443",
                    "timeout": 30,
@@ -411,8 +411,9 @@ class TestStartInstanceLegacyFallback:
    @patch("src.api.tool_instances.wait_for_container_running")
    @patch("src.api.tool_instances.execute_compose_command")
    @patch("src.api.tool_instances.get_container_id")
-    @patch("src.api.tool_instances.get_container_name")
    @patch("src.api.tool_instances.connect_container_to_network")
+    @patch("src.api.tool_instances._ensure_container_name_in_compose")
+    @patch("src.api.tool_instances._ensure_web_bind_address")
    @patch("src.api.tool_instances._sanitize_compose_file")
    @patch("src.api.tool_instances._prepare_manifest_instance")
    @patch("src.api.tool_instances._get_user")
@@ -423,8 +424,9 @@ class TestStartInstanceLegacyFallback:
        mock_get_user,
        mock_prepare_manifest,
        mock_sanitize,
+        mock_ensure_web_bind,
+        mock_ensure_container_name,
        mock_connect_network,
-        mock_get_container_name,
        mock_get_container_id,
        mock_execute_compose,
        mock_wait_container,
@@ -440,7 +442,6 @@ class TestStartInstanceLegacyFallback:
        mock_get_project.return_value = AsyncMock()
        mock_execute_compose.return_value = (0, "started", "")
        mock_get_container_id.return_value = "abc123"
-        mock_get_container_name.return_value = "test-container"
        mock_connect_network.return_value = True
        mock_wait_container.return_value = {
            "success": True,
@@ -509,8 +510,9 @@ class TestStartInstanceLegacyFallback:
    @patch("src.api.tool_instances.wait_for_container_running")
    @patch("src.api.tool_instances.execute_compose_command")
    @patch("src.api.tool_instances.get_container_id")
-    @patch("src.api.tool_instances.get_container_name")
    @patch("src.api.tool_instances.connect_container_to_network")
+    @patch("src.api.tool_instances._ensure_container_name_in_compose")
+    @patch("src.api.tool_instances._ensure_web_bind_address")
    @patch("src.api.tool_instances._sanitize_compose_file")
    @patch("src.api.tool_instances._prepare_manifest_instance")
    @patch("src.api.tool_instances._get_user")
@@ -521,8 +523,9 @@ class TestStartInstanceLegacyFallback:
        mock_get_user,
        mock_prepare_manifest,
        mock_sanitize,
+        mock_ensure_web_bind,
+        mock_ensure_container_name,
        mock_connect_network,
-        mock_get_container_name,
        mock_get_container_id,
        mock_execute_compose,
        mock_wait_container,
@@ -538,7 +541,6 @@ class TestStartInstanceLegacyFallback:
        mock_get_project.return_value = AsyncMock()
        mock_execute_compose.return_value = (0, "started", "")
        mock_get_container_id.return_value = "abc123"
-        mock_get_container_name.return_value = "test-container"
        mock_connect_network.return_value = True
        mock_wait_container.return_value = {
            "success": True,
@@ -606,8 +608,9 @@ class TestStartInstanceLegacyFallback:
    @patch("src.api.tool_instances.wait_for_container_running")
    @patch("src.api.tool_instances.execute_compose_command")
    @patch("src.api.tool_instances.get_container_id")
-    @patch("src.api.tool_instances.get_container_name")
    @patch("src.api.tool_instances.connect_container_to_network")
+    @patch("src.api.tool_instances._ensure_container_name_in_compose")
+    @patch("src.api.tool_instances._ensure_web_bind_address")
    @patch("src.api.tool_instances._sanitize_compose_file")
    @patch("src.api.tool_instances._prepare_manifest_instance")
    @patch("src.api.tool_instances._get_user")
@@ -618,8 +621,9 @@ class TestStartInstanceLegacyFallback:
        mock_get_user,
        mock_prepare_manifest,
        mock_sanitize,
+        mock_ensure_web_bind,
+        mock_ensure_container_name,
        mock_connect_network,
-        mock_get_container_name,
        mock_get_container_id,
        mock_execute_compose,
        mock_wait_container,
@@ -635,7 +639,6 @@ class TestStartInstanceLegacyFallback:
        mock_get_project.return_value = AsyncMock()
        mock_execute_compose.return_value = (0, "started", "")
        mock_get_container_id.return_value = "abc123"
-        mock_get_container_name.return_value = "test-container"
        mock_connect_network.return_value = True
        mock_wait_container.return_value = {
            "success": True,
@@ -705,12 +708,14 @@ class TestStartInstanceSshPermissions:
    """SSH key mounts trigger permission fixes after container starts."""

    @patch("src.api.tool_instances.write_compose_file")
+    @patch("src.api.tool_instances.prepare_ssh_key_files")
    @patch("src.api.tool_instances.apply_ssh_permissions")
    @patch("src.api.tool_instances.wait_for_container_running")
    @patch("src.api.tool_instances.execute_compose_command")
    @patch("src.api.tool_instances.get_container_id")
-    @patch("src.api.tool_instances.get_container_name")
    @patch("src.api.tool_instances.connect_container_to_network")
+    @patch("src.api.tool_instances._ensure_container_name_in_compose")
+    @patch("src.api.tool_instances._ensure_web_bind_address")
    @patch("src.api.tool_instances._sanitize_compose_file")
    @patch("src.api.tool_instances._get_user")
    @patch("src.api.tool_instances._get_owned_project")
@@ -719,12 +724,14 @@ class TestStartInstanceSshPermissions:
        mock_get_project,
        mock_get_user,
        mock_sanitize,
+        mock_ensure_web_bind,
+        mock_ensure_container_name,
        mock_connect_network,
-        mock_get_container_name,
        mock_get_container_id,
        mock_execute_compose,
        mock_wait_container,
        mock_apply_ssh,
+        mock_prepare_ssh,
        mock_write_compose,
        mock_session,
        fake_user_id,
@@ -743,7 +750,6 @@ class TestStartInstanceSshPermissions:
        mock_get_project.return_value = AsyncMock()
        mock_execute_compose.return_value = (0, "started", "")
        mock_get_container_id.return_value = "abc123"
-        mock_get_container_name.return_value = "test-container"
        mock_connect_network.return_value = True
        mock_wait_container.return_value = {
            "success": True,
@@ -836,12 +842,14 @@ class TestStartInstanceSshPermissions:
        assert result["status"] == "running"
        mock_apply_ssh.assert_called_once_with("abc123", "/home/user/.ssh", "user")

+    @patch("src.api.tool_instances.prepare_ssh_key_files")
    @patch("src.api.tool_instances.apply_ssh_permissions")
    @patch("src.api.tool_instances.wait_for_container_running")
    @patch("src.api.tool_instances.execute_compose_command")
    @patch("src.api.tool_instances.get_container_id")
-    @patch("src.api.tool_instances.get_container_name")
    @patch("src.api.tool_instances.connect_container_to_network")
+    @patch("src.api.tool_instances._ensure_container_name_in_compose")
+    @patch("src.api.tool_instances._ensure_web_bind_address")
    @patch("src.api.tool_instances._sanitize_compose_file")
    @patch("src.api.tool_instances._get_user")
    @patch("src.api.tool_instances._get_owned_project")
@@ -850,12 +858,14 @@ class TestStartInstanceSshPermissions:
        mock_get_project,
        mock_get_user,
        mock_sanitize,
+        mock_ensure_web_bind,
+        mock_ensure_container_name,
        mock_connect_network,
-        mock_get_container_name,
        mock_get_container_id,
        mock_execute_compose,
        mock_wait_container,
        mock_apply_ssh,
+        mock_prepare_ssh,
        mock_session,
        fake_user_id,
        fake_project_id,
@@ -870,7 +880,6 @@ class TestStartInstanceSshPermissions:
        mock_get_project.return_value = AsyncMock()
        mock_execute_compose.return_value = (0, "started", "")
        mock_get_container_id.return_value = "abc123"
-        mock_get_container_name.return_value = "test-container"
        mock_connect_network.return_value = True
        mock_wait_container.return_value = {
            "success": True,
@@ -933,14 +942,15 @@ class TestStartInstanceSshPermissions:
        mock_session.get.side_effect = _get

        with patch("os.path.exists", return_value=True):
-            result = await start_instance(
-                project_id=fake_project_id,
-                repo_id=fake_repo_id,
-                instance_id=fake_instance_id,
-                data=None,
-                user_id=fake_user_id,
-                session=mock_session,
-            )
+            with patch("src.api.tool_instances._modify_compose_file"):
+                result = await start_instance(
+                    project_id=fake_project_id,
+                    repo_id=fake_repo_id,
+                    instance_id=fake_instance_id,
+                    data=None,
+                    user_id=fake_user_id,
+                    session=mock_session,
+                )

        assert result["status"] == "running"
        mock_apply_ssh.assert_called_once_with("abc123", "/root/.ssh", "root")
@@ -952,8 +962,9 @@ class TestStartInstanceManifestBranch:
    @patch("src.api.tool_instances.wait_for_container_running")
    @patch("src.api.tool_instances.execute_compose_command")
    @patch("src.api.tool_instances.get_container_id")
-    @patch("src.api.tool_instances.get_container_name")
    @patch("src.api.tool_instances.connect_container_to_network")
+    @patch("src.api.tool_instances._ensure_container_name_in_compose")
+    @patch("src.api.tool_instances._ensure_web_bind_address")
    @patch("src.api.tool_instances._sanitize_compose_file")
    @patch("src.api.tool_instances._prepare_manifest_instance")
    @patch("src.api.tool_instances.write_compose_file")
@@ -966,8 +977,9 @@ class TestStartInstanceManifestBranch:
        mock_write_compose,
        mock_prepare_manifest,
        mock_sanitize,
+        mock_ensure_web_bind,
+        mock_ensure_container_name,
        mock_connect_network,
-        mock_get_container_name,
        mock_get_container_id,
        mock_execute_compose,
        mock_wait_container,
@@ -987,7 +999,6 @@ class TestStartInstanceManifestBranch:
        mock_get_project.return_value = AsyncMock()
        mock_execute_compose.return_value = (0, "started", "")
        mock_get_container_id.return_value = "abc123"
-        mock_get_container_name.return_value = "test-container"
        mock_connect_network.return_value = True
        mock_wait_container.return_value = {
            "success": True,
@@ -313,6 +313,96 @@ export const TerminalComponent = React.forwardRef<TerminalRef, TerminalProps>(
 			term.focus();
 			const ws = connectWebSocket();

+			// Mobile touch scroll.
+			// In normal mode xterm.js has a scrollable viewport; in alternate
+			// screen (tmux/vim) there is no scrollback and the only way to
+			// scroll is to send mouse-wheel protocol sequences to the
+			// application.  We detect which situation we're in by checking
+			// whether the viewport has scrollable height.
+			let touchCleanup: (() => void) | undefined;
+			if (isMobile) {
+				let startY = 0;
+				let startX = 0;
+				let isScrolling = false;
+
+				const onTouchStart = (e: TouchEvent) => {
+					if (e.touches.length === 1) {
+						startY = e.touches[0].clientY;
+						startX = e.touches[0].clientX;
+						isScrolling = false;
+					}
+				};
+				const onTouchMove = (e: TouchEvent) => {
+					if (e.touches.length !== 1) return;
+					const touch = e.touches[0];
+					const deltaY = startY - touch.clientY;
+					const deltaX = Math.abs(startX - touch.clientX);
+					if (!isScrolling) {
+						if (Math.abs(deltaY) > deltaX && Math.abs(deltaY) > 4) {
+							isScrolling = true;
+						}
+					}
+					if (isScrolling) {
+						e.preventDefault();
+						const viewport = container.querySelector(
+							".xterm-viewport",
+						) as HTMLElement | null;
+						if (!viewport) return;
+
+						// If the viewport is scrollable, scroll it directly.
+						// Otherwise we are in alternate screen (tmux/vim) and must
+						// send SGR 1006 mouse-wheel protocol data.
+						const hasScrollback =
+							viewport.scrollHeight > viewport.clientHeight;
+						if (hasScrollback) {
+							viewport.scrollTop += deltaY;
+						} else {
+							const ws = wsRef.current;
+							if (
+								ws?.readyState === WebSocket.OPEN &&
+								termRef.current
+							) {
+								// Use the cursor position as the wheel location so
+								// tmux knows which pane to scroll.
+								const buf = termRef.current.buffer.active;
+								const col = buf.cursorX + 1;
+								const row = buf.cursorY + 1;
+								// SGR 1006: 64 = wheel-up, 65 = wheel-down
+								const btn = deltaY > 0 ? 64 : 65;
+								ws.send(`\x1b[<${btn};${col};${row}M`);
+							}
+						}
+						startY = touch.clientY;
+					}
+				};
+				const onTouchEnd = () => {
+					isScrolling = false;
+				};
+
+				container.addEventListener("touchstart", onTouchStart, {
+					passive: true,
+					capture: true,
+				});
+				container.addEventListener("touchmove", onTouchMove, {
+					passive: false,
+					capture: true,
+				});
+				container.addEventListener("touchend", onTouchEnd, {
+					capture: true,
+				});
+				touchCleanup = () => {
+					container.removeEventListener("touchstart", onTouchStart, {
+						capture: true,
+					});
+					container.removeEventListener("touchmove", onTouchMove, {
+						capture: true,
+					});
+					container.removeEventListener("touchend", onTouchEnd, {
+						capture: true,
+					});
+				};
+			}
+
 			// Initial fit after layout settles (terminal must be opened first)
 			let fitAttempts = 0;
 			const doInitialFit = () => {
@@ -440,6 +530,7 @@ export const TerminalComponent = React.forwardRef<TerminalRef, TerminalProps>(
 					"visibilitychange",
 					handleVisibilityChange,
 				);
+				if (touchCleanup) touchCleanup();
 				if (ws) {
 					ws.close(1000, "Component unmounting");
 				}
@@ -568,7 +659,9 @@ export const TerminalComponent = React.forwardRef<TerminalRef, TerminalProps>(
 		};

 		return (
-			<div className={`terminal-wrapper ${isMobile ? "mobile" : ""} ${!showControls ? "no-controls" : ""}`}>
+			<div
+				className={`terminal-wrapper ${isMobile ? "mobile" : ""} ${!showControls ? "no-controls" : ""}`}
+			>
 				{showControls && (
 					<div className="terminal-header">
 						<div className="terminal-header-left">
@@ -204,6 +204,18 @@ export const TerminalPage: React.FC = () => {
 		};
 	}, []);

+	// Lock page scroll on mobile terminal so swipes scroll the terminal buffer,
+	// not the page.
+	useEffect(() => {
+		if (!isMobile) return;
+		document.documentElement.classList.add("terminal-page-open");
+		document.body.classList.add("terminal-page-open");
+		return () => {
+			document.documentElement.classList.remove("terminal-page-open");
+			document.body.classList.remove("terminal-page-open");
+		};
+	}, [isMobile]);
+
 	// Click outside terminal content/header to exit fullscreen
 	const handleFullscreenClick = useCallback(
 		(e: React.MouseEvent<HTMLElement>) => {
@@ -77,6 +77,11 @@ body {
 	color: var(--ink);
 }

+html.terminal-page-open,
+body.terminal-page-open {
+	overflow: hidden;
+}
+
 [data-theme="dark"] body {
 	background: radial-gradient(circle at top right, #2a2520, var(--bg));
 }
@@ -3703,6 +3708,7 @@ a.nav-item,
 	padding: 0;
 	overflow: hidden;
 	position: relative;
+	touch-action: none;
 }

 /* xterm.js manages its own sizing */
@@ -13,7 +13,11 @@ services:
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-headquarter} -d ${POSTGRES_DB:-headquarter}"]
+      test:
+        [
+          "CMD-SHELL",
+          "pg_isready -U ${POSTGRES_USER:-headquarter} -d ${POSTGRES_DB:-headquarter}",
+        ]
      interval: 10s
      timeout: 5s
      retries: 5
@@ -92,7 +96,7 @@ services:
      AUTHENTIK_AUTHORIZE_URL: ${AUTHENTIK_AUTHORIZE_URL:-}
      AUTHENTIK_TOKEN_URL: ${AUTHENTIK_TOKEN_URL:-}
    volumes:
-      - repo_data:/data/repos
+      - /data/repos:/data/repos
      - /data/instances:/data/instances
      - avatar_uploads:/app/uploads
      - /var/run/docker.sock:/var/run/docker.sock
@@ -116,7 +120,6 @@ services:
 volumes:
  postgres_data:
  redis_data:
-  repo_data:
  avatar_uploads:

 networks:
@@ -1,4 +1,4 @@
-version: '3.8'
+version: "3.8"

 services:
  # PostgreSQL Database
@@ -14,7 +14,11 @@ services:
    ports:
      - "5432:5432"
    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-headquarter} -d ${POSTGRES_DB:-headquarter}"]
+      test:
+        [
+          "CMD-SHELL",
+          "pg_isready -U ${POSTGRES_USER:-headquarter} -d ${POSTGRES_DB:-headquarter}",
+        ]
      interval: 10s
      timeout: 5s
      retries: 5
@@ -57,7 +61,7 @@ services:
      REPO_BASE_PATH: /data/repos
      INSTANCE_BASE_PATH: /data/instances
    volumes:
-      - repo_data:/data/repos
+      - /data/repos:/data/repos
      - /data/instances:/data/instances
    ports:
      - "8000:8000"
@@ -91,7 +95,6 @@ services:
 volumes:
  postgres_data:
  redis_data:
-  repo_data:

 networks:
  backend:
Author	SHA1	Message	Date
Alex Blank	c051929f8c	fix: use host bind mount for repos so tool instances can access workspace files Replace named Docker volume (repo_data) with bind mount (/data/repos) in both development and production compose files. The named volume trapped repo files inside the API container; tool instances started via Docker socket on the host could not see them, causing /workspace to mount as an empty directory. Also fix 6 pre-existing test failures in test_tool_instances_legacy.py caused by get_container_id/get_container_name moving to docker.py and new helpers (_ensure_web_bind_address, _ensure_container_name_in_compose) being added. - docker-compose.yml: repo_data:/data/repos -> /data/repos:/data/repos - docker-compose.traefik.yml: same change + remove repo_data volume decl - tests: update patch targets and add missing mock parameters Quality gates: pytest test_tool_instances_legacy.py (10 passed)	2026-06-02 12:47:14 +02:00
Alex Blank	4814ec2363	fix: mobile terminal scroll in both normal mode and tmux - Dual-mode touch scroll: - Normal mode: scroll .xterm-viewport directly when scrollHeight > clientHeight - Alternate screen (tmux/vim): send SGR 1006 mouse-wheel protocol data using cursor position so tmux knows which pane to scroll - Add touch-action: none to .terminal-container to prevent browser gestures - Lock both html and body overflow when terminal page is open on mobile - Remove synthetic WheelEvent approach (xterm.js SmoothScrollableElement doesn't reliably handle synthetic events)	2026-05-29 20:35:28 +02:00
Alex Blank	98b9d612fa	fix: container-level capture touch with direct viewport.scrollTop manipulation - Attach capture-phase touch listeners to .terminal-container (parent of xterm) - On vertical swipe: e.preventDefault() blocks page scroll, then directly adjust .xterm-viewport.scrollTop by the swipe delta - This bypasses term.scrollLines() API and directly manipulates the DOM element that xterm.js watches via its internal scroll handler - Remove all CSS touch-action overrides — container handles it in JS	2026-05-29 20:23:19 +02:00
Alex Blank	874873541d	fix: xterm.js mobile touch scrolling via viewport CSS and stopPropagation - Add full mobile viewport CSS: overflow-y scroll, -webkit-overflow-scrolling touch, overscroll-behavior-y contain, translate3d hardware accel, scroll-behavior smooth, touch-action pan-y - After term.open(), find .xterm-viewport and add passive touch listeners that call stopPropagation() (not preventDefault) — this lets the browser handle native touch scrolling while preventing xterm.js internal handlers from interfering - Based on xterm.js known issue #5489 and SCROLLING_FIX.md approach	2026-05-29 20:16:12 +02:00
Alex Blank	ef9ac76f06	fix: remove all touch interception, let browser scroll xterm viewport natively - xterm.js has zero touch event handlers (verified: only 1 'touch' ref in entire library), so it wasn't intercepting anything - Our touch-action: none + preventDefault() combo was blocking the browser from scrolling the .xterm-viewport natively - Removed all custom touch event handlers from terminal.tsx - Removed touch-action: none from .terminal-container - Added touch-action: pan-y to .xterm-viewport so browser allows vertical pan - Body scroll lock (terminal-page-open) prevents page from scrolling	2026-05-29 20:08:58 +02:00
Alex Blank	ca9db195de	fix: document-level capture touch listeners for mobile terminal scroll - Attach touch listeners to document with capture:true instead of container - Check if touch target is inside terminal container before handling - This runs before xterm.js internal handlers, giving us full control - Add touch-action: none to terminal container to prevent browser gestures - Lower threshold to 3px, 20px per line for responsive scrolling	2026-05-29 20:03:11 +02:00
Alex Blank	c1e16f2163	fix: lock body scroll and re-add programmatic terminal touch scroll - Add body.terminal-page-open { overflow: hidden } to prevent page scroll - TerminalPage adds/removes 'terminal-page-open' class on body when mounted - Re-add capture-phase touch listeners in terminal.tsx with low 3px threshold - Call e.preventDefault() immediately when vertical gesture is detected, before browser compositor commits to page scroll - Remove CSS touch-action overrides on xterm viewport (now handled in JS) - Scroll forwarded via term.scrollLines() with 24px per line sensitivity	2026-05-29 19:57:48 +02:00
Alex Blank	61d32fa00f	fix: enable native touch scrolling on xterm.js viewport for mobile - Remove all custom touch event interception code from terminal.tsx - After term.open(), find the internal .xterm-viewport element and set touchAction=pan-y and overscrollBehavior=contain via inline styles - Add CSS targeting .xterm-viewport on mobile with touch-action: pan-y, -webkit-overflow-scrolling: touch, and overflow-y: auto - Let the browser handle vertical touch panning natively instead of trying to intercept and manually forward events	2026-05-29 19:41:23 +02:00
Alex Blank	cddb3f8ccf	fix: mobile terminal scroll via capture-phase touch listeners - Attach touch listeners to container wrapper in CAPTURE phase so they run before xterm.js internals stop propagation - Add e.stopPropagation() in touchmove after handling scroll to prevent xterm.js from conflicting with our scroll - Add wheel event fallback for mobile browsers that synthesize wheel from touch - Remove touch-action: none CSS which was blocking native xterm viewport scroll	2026-05-29 19:35:42 +02:00
Alex Blank	87a938fe58	fix: mobile terminal touch scrolling direction and target - Attach touch listeners to term.element (xterm root) instead of wrapper - Fix scroll direction: swipe up now scrolls up (shows older buffer) - Remove RAF indirection; scroll applied synchronously in touchmove - Accumulate delta between events for smoother scrolling - Lower threshold to 6px and px-per-line to 16 for better responsiveness - Add touch-action: none to terminal container on mobile	2026-05-29 19:29:29 +02:00
Alex Blank	9157694412	Merge branch 'dev' of ssh://git.commumedia.org:2222/alex/headquarter into dev	2026-05-29 19:21:35 +02:00
Alex Blank	aa34314175	feat: touch swipe scrolling in terminal on mobile - Intercepts touch events on the terminal container when isMobile=true - Detects vertical swipe gestures (dominant over horizontal movement) - Translates swipe distance to xterm.js scrollLines() calls - Uses requestAnimationFrame for smooth scroll updates - Threshold of 10px before scroll kicks in; 30px per line - Touch listeners cleaned up on component unmount	2026-05-29 19:20:52 +02:00
Developer	c7fc386d0f	Merge branch 'fix/code-server-bind-addr-port' into dev	2026-05-29 16:50:00 +00:00
Developer	6bd814e346	fix(cloudflared): use --bind-addr with port for code-server bind fix Root cause: _ensure_web_bind_address injected --host 0.0.0.0 for code-server, which only sets the bind host, not the port. code-server then listens on its default port (8080) instead of the tool type's default_port (8443). Cloudflared connects to port 8443 and gets connection refused, resulting in a 502. Changes: - _ensure_web_bind_address now accepts default_port and builds --bind-addr 0.0.0.0:{port} for code-server - Same fix for jupyter-notebook with explicit --port flag - Existing broken --host commands are now detected and replaced - New migration fixes tool_types templates and instance compose files on disk - Test fixture updated to use correct --bind-addr 0.0.0.0:8443	2026-05-29 16:49:52 +00:00