headquarter/openspec/specs/instance-proxy/spec.md at debug/mobile-terminal-scroll

Files

T

Fusion 063a839790 feat: implement repository clone mode with SSH key support

- Add clone_mode and branch fields to tool_instances
- Add ssh_key_id to git_repositories for per-repo SSH key assignment
- Implement host-side git cloning with branch selection (default: main)
- Mount SSH keys into containers for git operations in clone mode
- Add dirty state check on clone-mode instance deletion with confirmation
- Update SessionsPage with mount/clone selector, branch input, SSH key display
- Add SSH key selector to repository creation form
- Add dirty delete confirmation modal with changed files list
- Update API schemas and endpoints for new fields
- Sync delta specs to main specs (git-repo, tool-instances, repo-clone-mode)
- Archive completed OpenSpec change: repo-clone-mode-with-ssh
- Document git requirement for custom tool types

Quality gates: Frontend typecheck and build passed
OpenSpec: repo-clone-mode-with-ssh archived with all tasks complete

2026-05-22 22:56:35 +02:00

1.8 KiB

Raw Permalink Blame History

ADDED Requirements

Requirement: Proxy endpoint exists for running instances

The API SHALL expose an endpoint that forwards HTTP requests to a running tool instance.

Scenario: Access running instance

WHEN an authenticated user sends a GET request to /instances/{id}/proxy/
THEN the request is forwarded to the instance's container
AND the response is returned to the user

Scenario: Access instance subpath

WHEN an authenticated user sends a request to /instances/{id}/proxy/api/status
THEN the request is forwarded to {container_url}/api/status
AND the response is returned to the user

Requirement: Only instance owner can access proxy

The proxy endpoint SHALL verify that the authenticated user owns the instance before forwarding.

Scenario: Owner accesses instance

WHEN the instance owner requests /instances/{id}/proxy/
THEN the request is forwarded to the instance

Scenario: Non-owner attempts access

WHEN a user who does not own the instance requests /instances/{id}/proxy/
THEN the API returns 403 Forbidden

Requirement: Proxy handles WebSocket upgrades

The proxy endpoint SHALL support WebSocket upgrade requests for real-time features.

Scenario: WebSocket connection to instance

WHEN a user sends a request with Upgrade: websocket header
THEN the API establishes a bidirectional WebSocket connection to the instance
AND messages are relayed between user and instance

Requirement: Frontend uses proxy URL for instance access

The frontend SHALL link to the proxy endpoint instead of the internal container URL.

Scenario: User clicks Open button

WHEN a user clicks "Open" on a running instance
THEN a new tab opens to /instances/{id}/proxy/
AND the proxied instance content is displayed

1.8 KiB Raw Permalink Blame History