feat: production serving, Tailscale sidecar, README update - #8
Conversation
… cleanup - Fix onExit handler accumulation: register once per session via guard set - Add try/catch on /api/projects for SDK errors - Persist sidebarOpen in Zustand (survives refresh), default to open - Client clears session immediately on PTY exit (WS close code 4010) - Extract PageTheme type alias in Sidebar (simplifier) - Type the listSessions result to avoid implicit any Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hono now serves the built dashboard static files in production (with SPA fallback). Tailscale sidecar in deploy/ creates a dedicated `autonomos` node on the tailnet, proxying 80/443 to the host. - Makefile simplified to `up`, `down`, `check` - `make up` = dev (Vite HMR + sidecar at :5173) - `make up MODE=prod` = prod (built dashboard + sidecar at :3000) - deploy/ holds Docker Compose + generated serve.json - .env.example documents required TS_AUTHKEY - Removed redundant package.json scripts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace research-phase README with actual setup instructions, tech stack, deployment guide, and project structure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
||
| app.get("/", (c) => c.json({ name: "autonomos", version: "0.0.1" })); | ||
| app.use("*", cors({ origin: process.env.CORS_ORIGIN || "*" })); | ||
|
|
There was a problem hiding this comment.
🟡 Warning
Problem: cors({ origin: "*" }) is the fallback when CORS_ORIGIN is unset — meaning any origin can call the API in both dev and prod.
Why it matters: Even behind Tailscale, a wildcard CORS policy allows any page running on an authorized tailnet device to make credentialed cross-origin requests to autonomOS. If a tab on the same machine opens a malicious site, it can hit your API freely.
Suggested fix: Add CORS_ORIGIN to .env.example so it's always set in prod, or tighten the default:
// .env.example
CORS_ORIGIN=http://autonomos
// index.ts — keep wildcard only in explicit dev mode
app.use("*", cors({ origin: process.env.CORS_ORIGIN || "http://localhost:5173" }));Low urgency for a personal tailnet tool, but worth closing the loop.
nox-0x
left a comment
nox-0x
left a comment
There was a problem hiding this comment.
Clean PR — production serving via Hono static + SPA fallback is solid, the Tailscale sidecar setup is well-structured, and the PTY onExit → 4010 close code handshake is a nice touch for clean client-side cleanup. One non-blocking note: the wildcard CORS fallback (origin: "*") is worth tightening — consider adding CORS_ORIGIN=http://autonomos to .env.example so prod always has a sane default. Nothing here blocks merge.
2 participants
Summary
deploy/creates a dedicatedautonomosnode on the tailnet, proxying 80/443 to the hostup(dev/prod),down,check. Both modes start the Tailscale sidecarFollows up on PRs #6 and #7.
Test plan
make up MODE=prod→ dashboard served at localhost:3000, API works, SPA fallback worksmake up→ Vite HMR on :5173, API on :3000, Tailscale sidecar proxies to :5173http://autonomosfrom another device on tailnet🤖 Generated with Claude Code