From 816cfb05807e19448d182d4824b1944c603567cb Mon Sep 17 00:00:00 2001 From: Coder-soft Date: Mon, 19 Oct 2026 18:08:47 +0500 Subject: [PATCH] docs(agents): correct stale checkout, PR and deploy facts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - main checkout is on `main`, not `feat/admin-panel-redesign` - `redesign/app` is fully merged (#107); no open PRs — stop pointing new work at it - document that merging needs the `creatorcluster` gh account, and that the red Vercel / opencode-review checks on fork PRs are environmental - record that the browser session is cookie OR bearer (third-party cookie blockers), so the only-credential regression isn't reintroduced - production deploys from `main` (Vercel tracks main SHAs); Worker deploys are manual — replace the outdated redesign/app deploy note - note the stale clone's gateway dir has no package.json (ERR_PNPM_NO_PKG_MANIFEST) --- AGENTS.md | 57 +++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 47 insertions(+), 10 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 0dba0b0a..c1d25304 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,11 +2,13 @@ ## Which checkout to work in -- **Canonical:** the worktree **`/Users/techspot/renderdragon-redesign`** (branch `redesign/app`) - of the main repo `/Users/techspot/renderdragon.org`. Do your work here. -- `/Users/techspot/reddragon/renderdragon.org` is a **separate, stale clone** (behind by many - commits). Do not work in it; it caused a lot of "wrong code / wrong port" confusion. -- `/Users/techspot/renderdragon.org` (main checkout) is a worktree on `feat/admin-panel-redesign`. +- **Canonical:** the worktree **`/Users/techspot/renderdragon-redesign`** of the main repo + `/Users/techspot/renderdragon.org`. Do your work here; start feature branches from `origin/main`. +- `/Users/techspot/reddragon/renderdragon.org` is a **separate, stale clone** (120+ commits behind). + Do not work in it; it caused a lot of "wrong code / wrong port" confusion. It has no `AGENTS.md` + and its `workers/assets-gateway/` contains only `node_modules` (no `package.json`), so pnpm there + dies with `ERR_PNPM_NO_PKG_MANIFEST` — an easy false alarm when following deploy instructions. +- `/Users/techspot/renderdragon.org` (main checkout) is a worktree on `main`. - `origin` = `Coder-soft/renderdragon.org` (fork), `upstream` = `creatorcluster/renderdragon.org`. ## Repository layout / pull requests @@ -23,8 +25,26 @@ gh pr create --repo creatorcluster/renderdragon.org --base main --head Coder-sof ``` GitHub's native linked-branch feature (`gh issue develop`) does not work in the fork, so reference the -relevant fork issue by URL in the PR body instead. There is an existing open redesign+partners PR -(`Coder-soft:redesign/app` → `creatorcluster:main`); pushing to that branch updates it. +relevant fork issue by URL in the PR body instead. + +The `redesign/app` line of work is **fully merged into `main`** (PR #107) and there were no open PRs as +of 2026-10-19. Branch from `origin/main`; don't use `redesign/app` as a base or expect pushing to it to +update a PR. + +**Merging requires the `creatorcluster` account.** `Coder-soft` can push branches and open PRs but gets +`does not have the correct permissions to execute MergePullRequest`: + +```sh +gh auth switch --user creatorcluster +gh pr merge --repo creatorcluster/renderdragon.org --merge +gh auth switch --user Coder-soft # restore the active account afterwards +``` + +Two checks are red on fork PRs for environmental reasons — don't chase them: + +- `Vercel` → "Authorization required to deploy": the fork PR has to be authorized in Vercel. +- `review` (opencode workflow) → "Could not fetch an OIDC token … add `id-token: write`": the job dies in + about a second without reviewing anything. CodeRabbit is the review that actually runs. ## Dev environment @@ -75,6 +95,13 @@ relevant fork issue by URL in the PR body instead. There is an existing open red id `api-router`). - **Supabase OAuth 2.1 server** is enabled (`site_url=https://renderdragon.org`, `oauth_server_authorization_path=/oauth/consent`, dynamic registration off). Consent notes below. +- **The browser session transport is cookie *or* bearer, on purpose.** `POST /__session` mints an + HMAC-signed token, sets it as the `rdgw` cookie **and** returns it in the body; `/__session` and every + proxied path accept either the cookie or `Authorization: Bearer `. The cookie is *third-party* + (`renderdragon.org` → `gateway.codersoft.xyz`), so Safari/ITP, Brave, Chrome incognito and strict + ETP/Firefox drop it — the bearer path is what keeps those visitors (Resources Hub, Font Picker, + Showcases, Background Generator) working. Keep both when editing `workers/assets-gateway` or + `src/lib/assetsApi.ts`; never make the cookie the only credential again. ## Secrets (NAMES ONLY — never print, echo, or commit values) @@ -132,8 +159,10 @@ relevant fork issue by URL in the PR body instead. There is an existing open red ## Deploy & verify ```sh -# Workers -cd workers/ && pnpm install --ignore-workspace && pnpm exec wrangler deploy +# Workers — run from the CANONICAL worktree (see "Which checkout to work in"). +# `pnpm install --ignore-workspace` is only needed if node_modules is missing. +cd /Users/techspot/renderdragon-redesign/workers/ +pnpm exec wrangler deploy # add --dry-run to validate the bundle without deploying # SQL migration sbase apply-migration --project-id bmywdrwjdqmrkafhiuwn --name --file @@ -151,6 +180,11 @@ curl https://gateway.codersoft.xyz/__version curl https://hamburger.codersoft.xyz/__health curl https://kuma.codersoft.xyz/api/status-page/renderdragon | head -c 200 curl https://renderdragon.org/api/uptime | head -c 200 + +# Session transport (401 without a session is expected; both must behave the same) +curl -si https://gateway.codersoft.xyz/__session | head -1 +curl -si https://gateway.codersoft.xyz/__session -H "Authorization: Bearer " | head -1 +curl -si https://gateway.codersoft.xyz/all -H "Authorization: Bearer " | head -1 ``` - **Auto-update:** pushing to `Renderdragonorg/resources_renderdragon` fires its webhook → @@ -180,4 +214,7 @@ curl https://renderdragon.org/api/uptime | head -c 200 - OIDC asymmetric signing keys are not yet enabled in Supabase. `standardScopesFor` requests `openid` (per `oauth-consent.md`), which needs RS256/ES256 signing keys enabled before ID tokens work. - Demo OAuth clients should be deleted. -- The site must be deployed from this branch for production to call the gateway. +- Production deploys from **`creatorcluster/renderdragon.org` `main`** (Vercel Production deployments + follow main SHAs, e.g. `07e76a9` on 2026-10-19), so merging a PR to `main` is enough for the site. + Worker deploys are **manual** (`wrangler deploy` from the canonical worktree) — merging never ships + Worker code.