Skip to content

chore: v0.0.29 release preparation - #213

Merged
thushan merged 32 commits into
mainfrom
feature/v0029-release-prep
Aug 10, 2026
Merged

chore: v0.0.29 release preparation#213
thushan merged 32 commits into
mainfrom
feature/v0029-release-prep

Conversation

@thushan

@thushan thushan commented Aug 9, 2026

Copy link
Copy Markdown
Owner

Chores for vNext release, documentation updates and CI fixes.

Summary by CodeRabbit

  • New Features

    • Added embedded, read-only dashboard guidance, access details and light/dark screenshots.
    • Model listings now display metadata derived from model names.
    • Improved dashboard visual styling with blue chart and range indicators.
  • Bug Fixes

    • Requests now fail over cleanly when circuit breakers are open without marking endpoints unhealthy.
    • Improved error reporting after failover exhaustion.
  • Docker & Release

    • Streamlined runtime images and added release dry-run validation.
  • Documentation

    • Updated dashboard build requirements and expanded architecture, benchmarking, integration and enterprise guidance.

@thushan thushan self-assigned this Aug 9, 2026
@coderabbitai

coderabbitai Bot commented Aug 9, 2026

Copy link
Copy Markdown

Review Change Stack

Walkthrough

The PR prepares v0.0.29 with typed circuit-breaker failover, restricted Docker packaging, release dry-run checks, Bun version alignment, documentation updates, dynamic mock model metadata, and dashboard colour changes.

Changes

Circuit-breaker failover

Layer / File(s) Summary
Retry contract and specification
.agents/specs/...
The release specification defines the typed error, failover rules, acceptance tests, and excluded scope.
Typed error and failover implementation
internal/adapter/proxy/core/..., internal/adapter/proxy/olla/service_retry.go
Circuit-breaker-open errors use an exported sentinel. Eligible requests fail over without endpoint health demotion. Final errors distinguish circuit-breaker and connection failures.
Failover regression coverage
internal/adapter/proxy/core/*_test.go
Tests cover failover, exhaustion, POST retry guards, and error classification.

Release and container validation

Layer / File(s) Summary
Restricted container image inputs
.dockerignore, Dockerfile, scripts/generate-container-config.sh
Docker builds use explicit runtime files and private-network dashboard configuration.
GoReleaser and workflow configuration
.goreleaser.yml, .github/workflows/release-dryrun.yml
Prerelease and snapshot pushes are suppressed automatically. The workflow pins toolchains and prepares multi-platform builds.
Dry-run image checks
.github/workflows/release-dryrun.yml
A manual workflow checks health, dashboard content, assets, Host access, image contents, and cleanup.
Embedded dashboard build gate
makefile, docs/content/development/setup.md, docs/content/getting-started/installation.md
The required Bun version is 1.3.5. The build verifies the embedded index.html file.

Documentation and project positioning

Layer / File(s) Summary
Dashboard configuration and access documentation
docs/content/configuration/dashboard.md
The documentation covers the embedded SPA, configuration, Docker defaults, access checks, security boundaries, and troubleshooting.
Project and deployment guidance
readme.md, docs/content/{about,development,getting-started}/*, docs/content/index.md, docs/content/faq.md, docs/content/usage.md, docs/mkdocs.yml
The documentation adds dashboard guidance, TensorFoundry references, enterprise deployment links, installation guidance, and site metadata.
Comparison and integration references
docs/content/compare/*, docs/content/concepts/*, docs/content/integrations/backend/*
Comparison, benchmarking, and backend pages add further-reading links.

Mock backend and dashboard styling

Layer / File(s) Summary
Dynamic mock model metadata
test/cmd/ollamock/handlers.go, test/cmd/ollamock/ollamock_test.go
The Ollama mock derives model family, parameter count, quantisation, and estimated size from model names.
Blue dashboard indicators
web/dashboard/src/app.css, web/dashboard/src/components.css, web/dashboard/src/components/SparkStrip.svelte, web/dashboard/src/app.css.theme-parity.test.ts, web/dashboard/src/node-builtins.d.ts
Blue theme tokens colour range markers and sparkline strokes. Theme-parity tests cover theme property sets and use typed Node.js test APIs.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Retry
  participant Endpoint
  participant ErrorClassifier
  Client->>Retry: send request
  Retry->>Endpoint: attempt candidate
  Endpoint-->>Retry: ErrCircuitBreakerOpen
  Retry->>Endpoint: try next candidate
  Endpoint-->>Retry: response or exhaustion
  Retry->>ErrorClassifier: classify final error
  ErrorClassifier-->>Client: return typed result
Loading

Possibly related PRs

Suggested labels: documentation, bug

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely identifies the pull request as preparation for the v0.0.29 release.
Docstring Coverage ✅ Passed Docstring coverage is 93.33% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feature/v0029-release-prep

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 20

🧹 Nitpick comments (2)
docs/content/configuration/dashboard.md (1)

28-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add language identifiers to the fenced blocks.

markdownlint-cli2 reports MD040 at Lines 28 and 183. Add a language such as text to both fences.

Proposed change
-```
+```text
 http://localhost:40114/internal/ui/
-```
+```

-```
+```text
 403 forbidden: ip not in allowed range (ip=172.17.0.1, host=172.17.0.1:40114)
 403 forbidden: host not accepted (ip=10.0.1.5, host=olla.corp.example:40114)
-```
+```

Also applies to: 183-183

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/content/configuration/dashboard.md` at line 28, Add the text language
identifier to both unlabeled fenced code blocks in the dashboard configuration
documentation, including the blocks containing the localhost URL and
forbidden-response examples, so they satisfy markdownlint MD040.

Source: Linters/SAST tools

test/cmd/ollamock/handlers.go (1)

230-253: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Precompile the fixed regular expressions.

modelMetadata compiles the parameter and quantisation expressions on every call, and the quantisation expression is compiled twice for the same match. Move these fixed expressions to package-level variables and reuse them across the configured models.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/cmd/ollamock/handlers.go` around lines 230 - 253, Update modelMetadata
to reuse package-level compiled regular expressions for parameter parsing and
each quantization pattern, replacing all inline regexp.MustCompile calls and
avoiding duplicate compilation for MatchString/FindString. Preserve the existing
matching order and quantization behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/specs/v0.0.29-release-prep.md:
- Line 1: Remove every em dash character from the release-preparation document,
including the heading and other changed lines, replacing each with permitted
punctuation while preserving the existing meaning and Australian English.

In @.dockerignore:
- Around line 9-13: Update the .dockerignore negation rules so the build and
config parent directories are re-admitted before their files, and ensure the
config/profiles directory contents, including README.md, are not excluded.
Preserve the existing exclusions for other files while making
build/docker-config.yaml and config/profiles available to the repository-root
Docker build context.

In @.github/workflows/release-dryrun.yml:
- Around line 55-60: Update the GoReleaser invocation in the “Run GoReleaser
(build only, no publish)” step to include the --snapshot argument alongside the
existing release flags, so the dry run uses the current commit and snapshot
configuration.

In `@docs/content/about.md`:
- Line 14: Update the project description around “free to use under its licence”
to explicitly state that Olla is licensed under Apache 2.0 and link the licence
name to its authoritative terms, while preserving the existing TensorFoundry and
product-page references.

In `@docs/content/concepts/sticky-sessions.md`:
- Line 223: Update the benchmark statement in the sticky-session documentation
to qualify the 7.6x time-to-first-token improvement as applying to the
32,768-token first warm turn in a warm multi-turn conversation spanning at least
two backends. Keep the existing benchmark link and avoid presenting 7.6x as a
general sticky-session gain.

In `@docs/content/configuration/dashboard.md`:
- Around line 175-178: Update the dashboard documentation around the Host-header
acceptance rule to clarify that IP literals bypass only the allowed_hosts check,
not network access controls. State that allowed_cidrs remains the effective
network boundary, and remove the claim that the IP literal must be the address
the browser dialled.

In `@docs/content/development/benchmarking.md`:
- Line 517: Update the benchmark source entry in the development benchmarking
documentation to remove the “independently measured” characterization, replacing
it with “TensorFoundry benchmark results” or a methodology-focused description
while preserving the existing link and benchmark context.

In `@docs/content/getting-started/installation.md`:
- Line 65: Update the Bun version references to consistently require 1.3.5+:
change the linked Development Setup heading/comment and shared
installation/release-notes anchors in
docs/content/getting-started/installation.md (line 65) and
docs/content/about/release-notes.md (line 111). Ensure all affected links and
anchor targets use the enforced 1.3.5+ wording.

In `@docs/content/integrations/backend/docker-model-runner.md`:
- Line 626: Update the link description in the documentation to state that the
article includes Docker Model Runner rather than comparing it directly with the
listed engines, while preserving the existing link and engine names.
- Around line 623-626: Update the “Further Reading” description in
docs/content/integrations/backend/docker-model-runner.md (lines 623-626) and
docs/content/integrations/backend/lemonade.md (lines 844-847) to describe the
linked article as providing a brief overview of Docker Model Runner and
Lemonade, respectively, rather than claiming a detailed comparison;
alternatively, replace the link with a direct comparison source.

In `@docs/content/integrations/backend/lemonade.md`:
- Line 847: Update the TensorFoundry “LLM Inference Servers Compared” link
description to state that the article includes or briefly mentions Lemonade,
while reserving the detailed comparison wording for vLLM, SGLang, llama.cpp, and
Ollama.

In `@internal/adapter/proxy/core/cbopen_test.go`:
- Around line 110-150: Add an application-level integration test alongside
TestExecuteWithRetry_AllCBOpen_CleanExhaustionError that sends a proxy request
through the application engine with every candidate returning cbOpenErr. Assert
the resulting HTTP 502 status, the expected client-facing response body, and
that no endpoint is health-demoted, ensuring Application.handleProxyError is
exercised rather than calling RetryHandler.ExecuteWithRetry directly.

In `@internal/adapter/proxy/core/retry.go`:
- Around line 335-340: Update the exhaustion handling around the
ErrCircuitBreakerOpen check in the retry flow so a circuit-breaker message does
not classify all endpoints when earlier attempts had different failures.
Describe the returned error as the last failure, or track mixed failure classes
and use a generic exhaustion message, while preserving the existing wrapped
error details.

In `@readme.md`:
- Line 42: Update the README recommendation text to use Australian spelling by
changing “datacenter” to “data centre”, and separate the FoundryOS and Alloy
recommendations into distinct sentences instead of joining them with a comma.
Preserve the existing links and avoid em dashes.
- Around line 136-137: Update the dashboard installation guidance in readme.md
(lines 136-137) and docs/content/getting-started/quickstart.md (lines 113-115)
to distinguish release/Docker images that bundle the frontend from go install
binaries that require building it. In the quickstart, either link to the
frontend build instructions for go install users or limit the “no extra setup
required” statement to installations containing the bundled dashboard.

In `@scripts/generate-container-config.sh`:
- Around line 16-18: The generated dashboard policy in
scripts/generate-container-config.sh must not authorize broad private CIDRs by
default. Update the sed-generated CIDR list to allow only the required Docker
bridge gateway address or gate broader LAN ranges behind an explicit opt-in,
while preserving the existing loopback entry and config generation behavior.

In `@test/cmd/ollamock/handlers.go`:
- Around line 212-215: Update the comments around modelMetadata and its related
parsing logic to use Australian English, replacing “quantization” with
“quantisation” at all referenced locations. Expand the comments to explain why
the parser selects the first parameter token, why Q4_K_M is used as the
fallback, and why the derived model size is only an estimate.
- Around line 230-238: Update the parameter parsing in the name-handling logic
around ParseFloat to reject parse errors, range errors, and non-finite values
such as +Inf before calculating billions, paramDisplay, or sizeBytes; only
continue with finite representable values.
- Around line 230-238: Update the parameter-extraction regexp in the model-name
handling block to match both uppercase and lowercase B/M suffixes, while
preserving the existing strings.EqualFold conversion and billion-value
calculations.

In `@web/dashboard/src/app.css`:
- Line 98: Add --blue: `#3fbce6`; to the :root[data-theme='dark'] block so
explicit dark-theme selection consistently overrides the light-theme value.

---

Nitpick comments:
In `@docs/content/configuration/dashboard.md`:
- Line 28: Add the text language identifier to both unlabeled fenced code blocks
in the dashboard configuration documentation, including the blocks containing
the localhost URL and forbidden-response examples, so they satisfy markdownlint
MD040.

In `@test/cmd/ollamock/handlers.go`:
- Around line 230-253: Update modelMetadata to reuse package-level compiled
regular expressions for parameter parsing and each quantization pattern,
replacing all inline regexp.MustCompile calls and avoiding duplicate compilation
for MatchString/FindString. Preserve the existing matching order and
quantization behavior.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3f4690e9-1c52-4c00-b756-9639bc0b427f

📥 Commits

Reviewing files that changed from the base of the PR and between 200c24f and d4291ec.

⛔ Files ignored due to path filters (6)
  • docs/content/assets/images/dashboard/endpoints-dark.png is excluded by !**/*.png
  • docs/content/assets/images/dashboard/endpoints-light.png is excluded by !**/*.png
  • docs/content/assets/images/dashboard/models-dark.png is excluded by !**/*.png
  • docs/content/assets/images/dashboard/models-light.png is excluded by !**/*.png
  • docs/content/assets/images/dashboard/overview-dark.png is excluded by !**/*.png
  • docs/content/assets/images/dashboard/overview-light.png is excluded by !**/*.png
📒 Files selected for processing (39)
  • .agents/specs/v0.0.29-release-prep.md
  • .dockerignore
  • .github/workflows/release-dryrun.yml
  • .goreleaser.yml
  • Dockerfile
  • docs/content/about.md
  • docs/content/about/release-notes.md
  • docs/content/compare/gpustack.md
  • docs/content/compare/litellm.md
  • docs/content/compare/overview.md
  • docs/content/concepts/load-balancing.md
  • docs/content/concepts/sticky-sessions.md
  • docs/content/configuration/dashboard.md
  • docs/content/development/architecture.md
  • docs/content/development/benchmarking.md
  • docs/content/faq.md
  • docs/content/getting-started/installation.md
  • docs/content/getting-started/quickstart.md
  • docs/content/index.md
  • docs/content/integrations/backend/docker-model-runner.md
  • docs/content/integrations/backend/lemonade.md
  • docs/content/integrations/backend/llamacpp.md
  • docs/content/integrations/backend/ollama.md
  • docs/content/integrations/backend/omlx.md
  • docs/content/integrations/backend/sglang.md
  • docs/content/integrations/backend/vllm.md
  • docs/content/usage.md
  • docs/mkdocs.yml
  • internal/adapter/proxy/core/cbopen_test.go
  • internal/adapter/proxy/core/errors.go
  • internal/adapter/proxy/core/retry.go
  • internal/adapter/proxy/olla/service_retry.go
  • makefile
  • readme.md
  • scripts/generate-container-config.sh
  • test/cmd/ollamock/handlers.go
  • web/dashboard/src/app.css
  • web/dashboard/src/components.css
  • web/dashboard/src/components/SparkStrip.svelte

Comment thread .agents/specs/v0.0.29-release-prep.md Outdated
Comment thread .dockerignore
Comment on lines +9 to +13
*
!olla
!build/docker-config.yaml
!config/models.yaml
!config/profiles

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
docker build --check --file Dockerfile .

Repository: thushan/olla

Length of output: 194


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Tracked files of interest:\n'
git ls-files | rg '(^|/)(Dockerfile|\.dockerignore|docker-config\.yaml|models\.yaml|profiles/)' || true

printf '\n.dockerignore:\n'
cat -n .dockerignore

printf '\nDockerfile around COPYs:\n'
sed -n '1,80p' Dockerfile | cat -n

printf '\nDirectory structure for build/config:\n'
find build config -maxdepth 4 -type f -print 2>/dev/null | sort || true

printf '\nSearch COPY references:\n'
rg -n "COPY|--add-host|docker-config|models\.yaml|profiles" Dockerfile .dockerignore 2>/dev/null || true

Repository: thushan/olla

Length of output: 3658


🌐 Web query:

Docker .dockerignore directory ignored COPY directory source must also be included COPYdir

💡 Result:

When you use a.dockerignore file, any files or directories matching the patterns defined in that file are excluded from the build context before it is sent to the builder [1][2]. Consequently, any subsequent COPY or ADD instruction in your Dockerfile that attempts to reference those excluded paths will fail, as those files no longer exist within the build context available to the builder [3]. If you are encountering issues where a directory is being ignored, verify the following: 1. Check your.dockerignore file: Ensure the directory or files you are trying to COPY are not listed in your.dockerignore file. If you have conflicting patterns (e.g., using! to include a file that was previously excluded), verify that the negation is correctly defined according to standard.dockerignore rules [1]. 2. Use the --exclude flag: If you need to COPY a directory but exclude specific sub-contents within that same instruction, you can use the --exclude flag available in newer Docker versions (requires syntax=docker/dockerfile:1.7 or later) [4]. This allows you to selectively exclude files during the copy process without removing them from the build context entirely [4]. 3. Understanding build context: Remember that.dockerignore only applies to files within the build context (the directory where you run the docker build command) [1][4]. It does not affect COPY operations that use the --from flag to copy files from a different stage or image [5]. If you are attempting to copy a directory but it is missing, it is almost certainly being excluded by a pattern in your.dockerignore file [3]. You can verify what is included in your context by checking the files transferred during the first step of your build output.

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import os

dockerignore_lines = '''# Speed only, not correctness: the Dockerfile COPYs each runtime file by name,
# so nothing here can change what ends up in the image. This just keeps the repo
# root (Go source, node_modules, editor and agent scratch dirs) from being sent
# to the daemon on every `make docker-build-local`.
#
# GoReleaser builds from its own synthesised context and never reads this file.

# Exclude everything, then re-admit only what the Dockerfile COPYs.
*
!olla
!build/docker-config.yaml
!config/models.yaml
!config/profiles
'''.splitlines()

build_root = "."
dockerignore_path = Path(build_root) / ".dockerignore"
paths = [
    "olla",
    "build/docker-config.yaml",
    "config/models.yaml",
    "config/profiles",
    "config/profiles/README.md",
    "config/profiles/dmr.yaml",
]

results = {}
for relpath in paths:
    p = Path(build_root) / relpath
    # Simulate docker ignore matching with no .git and no slash-aware prefix hack;
    # just print pattern outcomes so we can see whether negated patterns can match.
    outcome = []
    for number, line in enumerate(dockerignore_lines, 1):
        if line.startswith("#") or line == "":
            continue
        outcome.append((number, line, os.path.exists(p), relpath == line.strip()))
    results[relpath] = outcome

for relpath, out in results.items():
    print(f"PATH {relpath} exists={Path(build_root) / relpath}.exists()")
    for o in out:
        print(" ", o)
PY

printf '\nRead-only Docker ignore semantics check:\n'
printf 'COPY build/docker-config.yaml requires that the ignored directory build is re-admitted; otherwise COPY source is excluded from the build context.\n'
printf 'COPY config/profiles/ requires that the ignored directory config is re-admitted, plus entries below config/profiles are re-admitted.\n'
printf '!config/profiles does not re-admit files below config/profiles because it matches only that directory entry.\n'
printf '!config/profiles/ also points at the root-profiles copy target, so it still should not cover child files.\n'

Repository: thushan/olla

Length of output: 2164


Re-admit ignored source directories before COPY.

Line 9 excludes build and config, but the exceptions do not make build/docker-config.yaml or config/profiles/README.md visible to the repo-root build context. Fix the negations so the parent directories are included and the profile contents are also re-admitted.

Proposed fix
 !olla
+!build/
 !build/docker-config.yaml
+!config/
 !config/models.yaml
-!config/profiles
+!config/profiles/
+!config/profiles/**
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
*
!olla
!build/docker-config.yaml
!config/models.yaml
!config/profiles
*
!olla
!build/
!build/docker-config.yaml
!config/
!config/models.yaml
!config/profiles/
!config/profiles/**
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.dockerignore around lines 9 - 13, Update the .dockerignore negation rules
so the build and config parent directories are re-admitted before their files,
and ensure the config/profiles directory contents, including README.md, are not
excluded. Preserve the existing exclusions for other files while making
build/docker-config.yaml and config/profiles available to the repository-root
Docker build context.

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified false positive. The built image's /app contains all 12 profile YAMLs plus README.md, and docker build --check reports no warnings - contradicting the premise that a copy-ignored-file check would fire. BuildKit's context walker descends into excluded directories when an exception pattern matches beneath them. The proposed fix would also be a regression: !config/ and !build/ re-admit config.local.yaml and build scratch into the context, defeating the file's purpose. Separately, the Dockerfile COPYs every runtime file by name and never uses COPY . ., so nothing in .dockerignore can change final image contents either way. Leaving unresolved for visibility.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thushan, confirmed. The finding was incorrect.

The existing negation patterns retain the required runtime files in the BuildKit context. Re-admitting config/ and build/ would include unintended files and weaken the restricted-context design. The explicit Dockerfile COPY instructions also preserve the intended image inputs.

I withdraw this review comment.

🐇


✏️ Learnings added
Learnt from: thushan
Repo: thushan/olla PR: 213
File: .dockerignore:9-13
Timestamp: 2026-08-09T23:47:29.866Z
Learning: In the Olla repository `.dockerignore`, BuildKit includes descendant files when a descendant negation pattern matches beneath an excluded parent directory. Do not add `!config/` or `!build/` before the existing allowlist entries because those rules re-include unintended files such as `config.local.yaml` and build scratch files. The Dockerfile uses explicit `COPY` instructions rather than `COPY . .`.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

Comment thread .github/workflows/release-dryrun.yml Outdated
Comment thread docs/content/about.md Outdated
Comment thread docs/content/concepts/sticky-sessions.md Outdated
Comment thread readme.md
Comment on lines +16 to +18
# Widen the dashboard CIDRs to the private ranges: traffic through a published
# port arrives from the bridge gateway (172.17.0.1), so loopback-only would 403.
sed -i 's|^ - "::1/128"$| - "::1/128"\n - "10.0.0.0/8"\n - "172.16.0.0/12"\n - "192.168.0.0/16"|' config/docker.yaml

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Do not authorise all private-network clients by default.

These CIDRs trust every matching private source address. AccessMiddleware accepts any such RemoteAddr, and an IP-literal Host passes host validation. A published port can therefore expose the dashboard to LAN clients without an explicit allowlist.

Restrict the generated policy to required bridge gateway addresses, or make broader LAN CIDRs an explicit opt-in.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/generate-container-config.sh` around lines 16 - 18, The generated
dashboard policy in scripts/generate-container-config.sh must not authorize
broad private CIDRs by default. Update the sed-generated CIDR list to allow only
the required Docker bridge gateway address or gate broader LAN ranges behind an
explicit opt-in, while preserving the existing loopback entry and config
generation behavior.

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deliberate product decision, captured as issue #214, which proposes gating all of /internal/* behind one access policy and dropping the Docker CIDR widening entirely. Worth noting: the /internal/status* JSON the dashboard renders is ungated regardless of allowed_cidrs today - a request from a non-allowed address gets 403 on /internal/ui/ but 200 on /internal/status - so the widening mostly affects who gets the rendered view rather than who can read the data. #214 fixes that properly. Leaving open.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thushan, understood. The finding remains open pending #214.

Issue #214 addresses the root cause by applying one access policy to all /internal/* endpoints and removing the Docker CIDR widening. The current widening changes access to /internal/ui/, but it does not protect the dashboard data at /internal/status*.


✏️ Learnings added
Learnt from: thushan
Repo: thushan/olla PR: 213
File: scripts/generate-container-config.sh:16-18
Timestamp: 2026-08-09T23:47:57.009Z
Learning: In Olla, the current dashboard `allowed_cidrs` policy protects `/internal/ui/` but does not protect `/internal/status*` JSON endpoints. GitHub issue `#214` tracks the intended fix: apply one access policy to all `/internal/*` endpoints and remove the Docker-specific private-CIDR widening in `scripts/generate-container-config.sh`.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

Comment thread test/cmd/ollamock/handlers.go Outdated
Comment thread test/cmd/ollamock/handlers.go Outdated
Comment thread web/dashboard/src/app.css

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@web/dashboard/src/app.css.theme-parity.test.ts`:
- Around line 33-36: Update customPropsInBlock to retain each custom-property’s
declaration value alongside its name, then change the assertions at the affected
dark-theme and light-theme checks to verify `#3fbce6` for both dark blocks and
`#0094c2` for the light block, rather than only checking property presence.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 94f1b706-456f-4480-ac5e-4cec804e892d

📥 Commits

Reviewing files that changed from the base of the PR and between d4291ec and 29bfa46.

📒 Files selected for processing (20)
  • .agents/specs/v0.0.29-release-prep.md
  • .github/workflows/release-dryrun.yml
  • docs/content/about.md
  • docs/content/about/release-notes.md
  • docs/content/concepts/sticky-sessions.md
  • docs/content/configuration/dashboard.md
  • docs/content/development/benchmarking.md
  • docs/content/development/setup.md
  • docs/content/getting-started/installation.md
  • docs/content/getting-started/quickstart.md
  • docs/content/integrations/backend/docker-model-runner.md
  • docs/content/integrations/backend/lemonade.md
  • internal/adapter/proxy/core/retry.go
  • internal/adapter/proxy/core/retry_safety_test.go
  • makefile
  • readme.md
  • test/cmd/ollamock/handlers.go
  • test/cmd/ollamock/ollamock_test.go
  • web/dashboard/src/app.css
  • web/dashboard/src/app.css.theme-parity.test.ts
🚧 Files skipped from review as they are similar to previous changes (13)
  • docs/content/getting-started/installation.md
  • .github/workflows/release-dryrun.yml
  • docs/content/integrations/backend/docker-model-runner.md
  • makefile
  • docs/content/development/benchmarking.md
  • docs/content/concepts/sticky-sessions.md
  • docs/content/about.md
  • docs/content/integrations/backend/lemonade.md
  • docs/content/getting-started/quickstart.md
  • docs/content/about/release-notes.md
  • docs/content/configuration/dashboard.md
  • test/cmd/ollamock/handlers.go
  • readme.md

Comment thread web/dashboard/src/app.css.theme-parity.test.ts Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CLAUDE.md`:
- Line 26: Update the documentation sentence on line 26 to use sentence
punctuation: replace the spaced hyphen with appropriate punctuation and add a
comma before “and,” while preserving Australian English and avoiding em dashes.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 69a8215a-2cbb-4844-9329-75fbb7c0c3dd

📥 Commits

Reviewing files that changed from the base of the PR and between 29bfa46 and 6ea8b6c.

📒 Files selected for processing (3)
  • CLAUDE.md
  • web/dashboard/src/app.css.theme-parity.test.ts
  • web/dashboard/src/node-builtins.d.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • web/dashboard/src/app.css.theme-parity.test.ts

Comment thread CLAUDE.md
make help # All targets
```
Always run `make ready` before reporting work complete or committing.
Always run `make ready` before reporting work complete or committing. `make ready` is Go-only, so also run `make ci-web` when anything under `web/` changed - CI runs it and it catches what `make ready` cannot (svelte-check type errors, frontend test failures).

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use sentence punctuation on Line 26.

Replace the spaced hyphen and add a comma before and:

-Always run `make ready` before reporting work complete or committing. `make ready` is Go-only, so also run `make ci-web` when anything under `web/` changed - CI runs it and it catches what `make ready` cannot (svelte-check type errors, frontend test failures).
+Always run `make ready` before reporting work complete or committing. `make ready` is Go-only, so also run `make ci-web` when anything under `web/` changes. CI runs it, and it catches what `make ready` cannot (svelte-check type errors, frontend test failures).

As per coding guidelines, use Australian English in documentation and do not use em dashes.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
Always run `make ready` before reporting work complete or committing. `make ready` is Go-only, so also run `make ci-web` when anything under `web/` changed - CI runs it and it catches what `make ready` cannot (svelte-check type errors, frontend test failures).
Always run `make ready` before reporting work complete or committing. `make ready` is Go-only, so also run `make ci-web` when anything under `web/` changes. CI runs it, and it catches what `make ready` cannot (svelte-check type errors, frontend test failures).
🧰 Tools
🪛 LanguageTool

[uncategorized] ~26-~26: Use a comma before ‘and’ if it connects two independent clauses (unless they are closely connected and short).
Context: ...ything under web/ changed - CI runs it and it catches what make ready cannot (sv...

(COMMA_COMPOUND_SENTENCE)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CLAUDE.md` at line 26, Update the documentation sentence on line 26 to use
sentence punctuation: replace the spaced hyphen with appropriate punctuation and
add a comma before “and,” while preserving Australian English and avoiding em
dashes.

Sources: Coding guidelines, Linters/SAST tools

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not fully applied - line 26 was split into two sentences but the specific word fix wasn't carried through: it still reads "web/ changed - CI runs it and it catches" rather than the suggested "web/ changes. CI runs it, and it catches". Leaving this open pending the actual wording fix.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '22,29p' CLAUDE.md

Length of output: 652


@thushan, confirmed. The current text still uses changed - CI runs it and it catches.

The requested wording has not been applied. The review remains open pending this change:

when anything under `web/` changes. CI runs it, and it catches

🐇

You are interacting with an AI system.

@thushan
thushan merged commit 70058e2 into main Aug 10, 2026
8 checks passed
@thushan
thushan deleted the feature/v0029-release-prep branch August 10, 2026 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant