Repository navigation
chore: recover genuine work from mixed tree (i18n, publish pin gate, session recovery, rate-limit health, sonner, hardening) - #308
Conversation
The working tree contained an accidental wholesale revert of the late-V2 line (#296-#306: workspace train, bos.app.ts canonical config, core-ui stubs, manifest v2, node/pnpm cutover, MF fix series, two-database contract, builtAt byte-stability) layered together with genuine new work. This commit re-applies only the genuine work on top of main and drops the revert entirely. Kept: - i18n deepening: locale negotiation (cookie + Accept-Language with q-values), Vary header, request-scoped SSR locale in router context, shared locale across bundle runtimes, degraded-compose toast, localized RouterError copy; framework-level plumbing the ui surface can adopt - publish pin-verification gate: block publishes whose pinned slots' bytes fail SRI verification against their production URLs - session recovery: a failing getSession errors instead of caching null as signed-out - rate limiter /health exemption + integration test (bind-probe guard for 127/8 aliases absent on macOS) - sonner as an optional UI shared dependency - defensive error formatting across host, every-plugin, better-near-auth - staging config parsing through BosConfigInputSchema - hygiene: typed server bootstrap await, proxiedFetch env forwarding, CSP/e2e test type fixes, Effect.sync/void hardening Dropped (accidental revert): workspace.ts/workspace-catalog.ts deletions, bos.config.json precedence flip, core-ui stubs + manifest v1 downgrade, node->bun re-migration (every-plugin and child scaffolding), MF fix-series rollback, builtAt re-introduction, two-database fallback removal, better-near-auth citynode.app URL revert and @tanstack/intent downgrade, skills version downgrades. 8 changesets added for the user-facing work.
| const uiSharedDeps = createUiSharedDeps({ | ||
| role, | ||
| workspaceRoot: workspaceRootAbsolute, | ||
| dependencies: { ...pkg.dependencies, ...pkg.devDependencies }, |
There was a problem hiding this comment.
Are we sure about adding dependencies here?
There was a problem hiding this comment.
Agreed — reverted. The dependencies map was only a presence check (versions still came from resolveSharedVersion), so it was caller-coupled API surface for little value. The sonner optional-shared-dep feature is deferred out of this PR entirely: spec flag, dependencies option, rsbuild pass-through, and tests are all gone (cfe45e2). Will redesign in its own PR. The hydrate degraded-toast's runtime import("sonner") stays — it resolves in the ui workspace, which declares sonner.
| collectCatalogs: boolean; | ||
| visit?: (link: WalkLink) => Promise<void>; | ||
| registerCleanup?: (fn: () => Promise<void>) => void; | ||
| registerCleanup?: (this: void, fn: () => Promise<void>) => void; |
There was a problem hiding this comment.
Is the this necessary on all of it?
There was a problem hiding this comment.
No — reverted the whole file in cfe45e2. Good catch beyond the this: void noise: the hunk also carried a slipped-in revert of dispatchEntry (hardcoding join(sourceDir, "bos.config.json") over findConfigPath), which broke authored bos.app.ts projects — a regression hiding inside a hygiene hunk. Both are gone; the file is back to main.
- Revert resolution/session.ts to main: drops the this: void annotations flagged in review, and a slipped-in dispatchEntry hunk that hardcoded bos.config.json over findConfigPath — a real regression for bos.app.ts-authored repos. - Defer the sonner optional-shared-dep feature (spec flag, dependencies option, rsbuild pass-through, tests) — the dependencies map was a caller-coupled presence check; redesign in its own PR. The hydrate degraded-toast's runtime sonner import stays (resolvable in the ui workspace).
…429, client retry The 300/15min edge budget was too strict for shared egress (NAT/VPN) and rate-limited clients saw the site crash: raw JSON as the page document, silently failing queries, and the session check erroring. Host: - general tier 300 → 2000 / 15min (RATE_LIMIT_MAX) - new mutation tier (60/15min, RATE_LIMIT_MUTATION_MAX) for non-GET requests outside the transports that own their throttling (oRPC, Better-Auth, MCP) — direct REST writes get brute-force protection without touching sessions, procedures, or agents - x-forwarded-for keying trusts only the LAST hop (proxy-appended); rotating a spoofed first hop no longer mints unlimited keys - rate-limited document navigations (Accept: text/html) get a styled HTML retry page honoring Retry-After semantics instead of raw JSON; API requests keep the JSON body - GET/HEAD /health stays exempt from both tiers Client (everything-dev ui/api): - the oRPC fetch retries 429s up to three times honoring Retry-After (capped 2s) — transient saturation self-heals in queries and the session check instead of surfacing errors Tests: - rewrite the Go regression burst: /health burst asserts the probe exemption (zero 429s); the 429 contract moved to /api/ping - host integration: HTML-vs-JSON 429, mutation-tier boundaries (exemptions + disjoint buckets), last-hop xff semantics - ui unit: retry-until-success and give-up-after-budget
|
Investigated the While fixing it, I also addressed the broader UX concern — a rate-limited client used to see the site effectively crash (raw JSON as the page document, silently failing queries, session check erroring). 41e626b retunes the limiter:
Go |
1 participant
What happened
The working tree on
maincontained an accidental wholesale revert of the late-V2 line (#296–#306) — workspace prerequisite train,bos.app.tscanonical config, core-ui generated stubs, manifest contract v2, node/pnpm cutover, the MF phantom-chunk fix series, the two-database contract, andbuiltAtbyte-stability — mixed together with genuine new work. This PR re-applies only the genuine work on top ofmainand drops the revert entirely. The original mixed tree is preserved locally onwip/mixed-cleanup(not pushed).Net diff: 73 files, +1,272 / −221 (the mixed tree was +2,608 / −4,580).
Kept
everything-dev):ui/locale.ts+ui/message-catalogs.ts; SSR locale negotiation fromcitynode_localecookie +Accept-Language(q-value parsing),Vary: Cookie, Accept-Language, request-scoped locale in router context, shared locale selection across the main-UI and auth-bundle runtimes, localized RouterError / API-connection / tenant-validation copy, degraded-compose toast with Reload action,application-startup-errorreload screen. Framework-level plumbing — theui/surface can adopt it.everything-dev): before writing to the registry, every pinned slot's bytes are fetched from its production URL and checked against the pin's SRI; mismatches block the publish.everything-dev): a failinggetSessionerrors instead of cachingnullas "signed out"./healthexemption (host) + integration test, with a bind-probe guard so the 127/8 isolation case skips gracefully on macOS (nolo0alias).host,every-plugin,better-near-auth): unknown throwables (symbols, objects) stringify safely instead of throwing or printing[object Object].BosConfigInputSchema, typed server bootstrapawaitinserver.ts,proxiedFetchforwardsenv/executionCtx, CSP/e2e test type fixes,Effect.sync/voidhardening.Dropped (the accidental revert + drive-bys)
workspace.ts/workspace-catalog.tsdeletions and the hardcoded 3-package train (ADR 0022 train stays)bos.config.jsonprecedence flip (authoredbos.app.tsstays canonical)@orpc/*re-sharing that broke plugin loading,splitChunks/named-module-ids, self-name resolution, deepest-cause stack logging)builtAtre-introduction in version manifests (byte-stability fix stays)*_DATABASE_URL→ API DB fallback stays)better-near-authrepo-URL revert tocitynode.app,@tanstack/intent^0.0.40downgrade, skillslibrary_versiondowngrades and brokenmetadata.sourcesprune-runtime-node-modules,router-server,plugins-ts-form,core-ui-*,remote-self-name,sync-retirement,workspace*)dependenciespresence map was caller-coupled API surface)Verification
pnpm run typecheck✓ (all 10 workspaces)pnpm run lint— 0 errors, 60 warnings (HEAD baseline: 119)