runAb() in scripts/_cipc_service.js resolved only on proc.on('close'),
but agent-browser is a daemon-per-session CLI. When it has to START the
session browser daemon (first call after a reboot, after the daemon died,
or after the app restarts), the new daemon inherits the spawned CLI
stdout pipe. The pipe then never reaches EOF, so Node 'close' event
never fires - even though the CLI exited cleanly with code 0. The 30s
timeout in runAb called proc.kill(SIGTERM), but the process had already
exited, so the kill was a no-op and the promise never settled. The
wrapper serialised mutex then held inFlight forever, every later request
queued behind it, and CIPC search silently 500-ed for days with no log
line to show why - which is what made this look like a flaky / restart-
only issue.
Fixes:
- runAb now settles on 'exit' (with a 250ms flush grace for stdio to
drain), escalates the timeout kill to SIGKILL, and guarantees an
unconditional forced settle if neither fires. The promise can no
longer remain pending.
- app/api/cipc/search/route.ts: ensureWrapperService() now probes port
6002 on every search and respawns the wrapper (rate-limited to once
per 30s) if it is down. Hot reloads still no-op once a wrapper is up,
but a dead wrapper now self-heals instead of 500-ing forever.
Verified end to end: killed the browser daemon and the wrapper, started
a fresh wrapper, its first isWarm() spawned a new daemon (the previous
deadlock path) and returned in under 1s. A real enterprise search of
K2018435959 came back in 31.7s on the cold path and 50.9s on the warm
path with full company + director data.
middleware.ts previously 404'd every external request, which meant the
app was unusable once hosted. There are no per-user accounts, so this
adds a single-password gate:
- /login page + POST /api/auth/login, POST /api/auth/logout
- lib/auth.ts: HMAC-SHA256 signed session cookie (lib/auth), Web Crypto
only so the same code runs in Edge middleware and Node handlers
- middleware now admits: the signing flow (unchanged, still public),
/login + /api/auth/*, local requests, and valid sessions. Everything
else redirects to /login (pages) or returns 401 JSON (API calls).
- password compared with a constant-time compare, wrong attempts
delayed 600ms to slow online guessing
- cookie is HttpOnly + SameSite=Lax, 12h, Secure when x-forwarded-proto
says https (Coolify serves the proxy on http today)
APP_PASSWORD / AUTH_SECRET added to .env.example, with a warning: an
unquoted # in an env value starts a comment, which silently truncated
the first generated password and made login fail.
Verified against a real built server: anon->307 /login, anon API->401,
wrong password->401, correct password->200+cookie, signed-in request
reaches PocketBase, /resign/ still 200 without a cookie, forged
cookie->401.
next build runs 'Linting and checking validity of types' and fails on
the first type error, so the Coolify image build died at
app/api/cipc/search/route.ts:640. These errors were pre-existing but
only surface on next build (npm run dev does not type check).
- cipc/search/route.ts: coerce spawnSync stdout/stderr with toString();
result is typed as the un-overloaded return, so they are string|Buffer
- group-report pdf+email: use fetchCollection<YsterbaardGroup> instead of
an invalid cast; normalise description null -> undefined for ReportData
- CipcExplorer (cipc + cipc-2): split the state ternary into two returns;
the RowState union correlates state with differs, so 'diff' | 'match'
matched neither variant
- ComplianceTreeGrid: ar_non_compliance_date is optional; the API omits it
and this component never reads it
Verified: tsc --noEmit 0 errors, next build exit 0, standalone output ok.
- add .dockerignore: without it the build context shipped .env.local
(PB_TOKEN + CIPC passwords), node_modules and the full .git history
- bake NEXT_PUBLIC_PB_URL / NEXT_PUBLIC_BASE_URL / NEXT_PUBLIC_APP_URL
as build args; NEXT_PUBLIC_PB_URL was read by client components but
never supplied, so browser-side PocketBase calls would break
- docker-compose: same build args + Telegram runtime env
- document that agent-browser / PDFD sidecar routes stay on the PC
PB returns 400 when sorting a freshly imported collection by autodate system
fields (created, updated) — those fields aren't yet exposed for sorting.
id always works.
