[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_1222":-5,"_1225":1226,"_1227":1228},"routes/shell",{"_1040":1041,"_1221":-5,"_1222":-5,"_1223":1224},"routes/repo",{"_1033":-7,"_1034":1035,"_1036":1037,"_1038":1039,"_1040":1041,"_1042":26,"_1043":26,"_1044":26,"_1045":26,"_1046":26,"_1047":26,"_1048":208,"_1049":208,"_1050":26,"_1051":-7,"_1052":-7,"_1053":1054,"_1055":1056,"_1057":1058,"_1059":-5,"_1060":1061,"_1062":1063,"_1064":1065,"_1066":1067},"routes/repo.commit",{"_13":14,"_15":16,"_17":18},"commit",{"_200":22,"_1011":1012,"_1013":1014,"_1015":1016,"_1017":1018,"_1019":-5,"_1020":1018,"_1021":1022},"diff",{"_19":20,"_21":22,"_23":24,"_25":26},"checks",[],"old","eeb8ae01f6fcf67a5a4d99963b5c6d1a0ffa9f1d","new","a289334d74723e5b1f01ef282042a13f7190e711","files",[27,28,29,30,31,32,33,34,35,36,37,38],"truncated",false,{"_39":990,"_19":991,"_21":992,"_43":44,"_45":211,"_47":208,"_49":993},{"_39":942,"_19":943,"_21":944,"_43":44,"_45":139,"_47":208,"_49":945},{"_39":816,"_19":817,"_21":818,"_43":44,"_45":819,"_47":389,"_49":820},{"_39":776,"_19":777,"_21":778,"_43":44,"_45":389,"_47":208,"_49":779},{"_39":730,"_19":-5,"_21":731,"_43":44,"_45":636,"_47":208,"_49":732},{"_39":589,"_19":590,"_21":591,"_43":44,"_45":538,"_47":110,"_49":592},{"_39":531,"_19":532,"_21":533,"_43":44,"_45":534,"_47":208,"_49":535},{"_39":493,"_19":494,"_21":495,"_43":44,"_45":496,"_47":211,"_49":497},{"_39":386,"_19":387,"_21":388,"_43":44,"_45":46,"_47":389,"_49":390},{"_39":307,"_19":-5,"_21":308,"_43":44,"_45":309,"_47":208,"_49":310},{"_39":205,"_19":-5,"_21":206,"_43":44,"_45":207,"_47":208,"_49":209},{"_39":40,"_19":41,"_21":42,"_43":44,"_45":46,"_47":48,"_49":50},"path","scripts/dev.ts",{"_200":204,"_202":203},{"_200":201,"_202":203},"kind","text","add",32,"del",5,"hunks",[51,52,53,54],{"_55":185,"_57":186,"_59":185,"_61":187,"_63":188},{"_55":138,"_57":139,"_59":140,"_61":141,"_63":142},{"_55":107,"_57":108,"_59":109,"_61":110,"_63":111},{"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"aStart",128,"aLen",9,"bStart",145,"bLen",19,"ops",[65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84],{"_85":86,"_87":106},{"_85":86,"_87":105},{"_85":86,"_87":104},{"_85":47,"_87":103},{"_85":45,"_87":102},{"_85":45,"_87":101},{"_85":45,"_87":100},{"_85":45,"_87":90},{"_85":86,"_87":99},{"_85":86,"_87":98},{"_85":45,"_87":97},{"_85":45,"_87":96},{"_85":45,"_87":95},{"_85":45,"_87":94},{"_85":45,"_87":93},{"_85":45,"_87":92},{"_85":45,"_87":91},{"_85":86,"_87":90},{"_85":86,"_87":89},{"_85":86,"_87":88},"tag","eq","line","","];","\t}),","\t\t\t: {}),","\t\t\t}","\t\t\t\tPORT: \"8787\",","\t\t\t\tSERVER_HOST: \"0.0.0.0\",","\t\t\t\tAPP_ORIGIN: exe.origin,","\t\t\t? {","\t\t...(exe","\t\tDEV_CLIENT: WEB,","\tstart(\"server\", \"apps/server\", [\"bun\", \"--watch\", \"src/main.ts\"], {","\t\tCHOPIN_DEV_EXE_HOST: exe?.host ?? \"\",","\t\tAPP_ORIGIN: exe?.origin ?? process.env.APP_ORIGIN ?? \"\",","\tstart(\"web\", \"apps/web\", [\"bun\", \"node_modules/vite/bin/vite.js\"], {","\tstart(\"web\", \"apps/web\", [\"bun\", \"node_modules/vite/bin/vite.js\"]),","\t// which is one more thing that has to be installed for no benefit.","\t// wrapper described above, and the shim in `.bin` carries a Node shebang —","\t// Vite's own entry, run by Bun. Going through `bun run dev` would add the",112,10,127,12,[112,113,114,115,116,117,118,119,120,121,122,123,124,125],{"_85":86,"_87":137},{"_85":86,"_87":88},{"_85":86,"_87":136},{"_85":47,"_87":135},{"_85":45,"_87":134},{"_85":86,"_87":133},{"_85":86,"_87":132},{"_85":47,"_87":131},{"_85":45,"_87":130},{"_85":45,"_87":129},{"_85":45,"_87":128},{"_85":86,"_87":127},{"_85":86,"_87":92},{"_85":86,"_87":126},"\t\t} catch {}","\t\t\t\treturn;","\t\t\t\tconsole.log();","\t\t\t\tif (HMR) console.log(`[dev] vite hmr is at ${HMR} (private alternate port)`);","\t\t\t\tconsole.log(`\\n[dev] chopin is at ${APP}`);","\t\t\t\tconsole.log(`\\n[dev] chopin is at ${APP}\\n`);","\t\t\tif (response.ok) {","\t\t\tawait response.body?.cancel();","\t\t\tlet response = await fetch(READY, { redirect: \"manual\" });","\t\t\tlet response = await fetch(APP, { redirect: \"manual\" });","\t\ttry {","\t\tif (stopping) return;",36,8,37,22,[143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"_85":86,"_87":88},{"_85":86,"_87":184},{"_85":86,"_87":88},{"_85":47,"_87":183},{"_85":47,"_87":182},{"_85":45,"_87":181},{"_85":45,"_87":180},{"_85":45,"_87":179},{"_85":45,"_87":178},{"_85":45,"_87":177},{"_85":45,"_87":176},{"_85":45,"_87":175},{"_85":45,"_87":174},{"_85":45,"_87":88},{"_85":45,"_87":173},{"_85":45,"_87":88},{"_85":45,"_87":172},{"_85":45,"_87":171},{"_85":45,"_87":170},{"_85":45,"_87":169},{"_85":45,"_87":168},{"_85":86,"_87":88},{"_85":86,"_87":167},{"_85":86,"_87":88},"const READY_MS = 30_000;","const HMR = exe ? `wss://${exe.host}:5173` : undefined;","const READY = exe ? \"http://127.0.0.1:8787\" : APP;","\t?? `http://${process.env.SERVER_HOST || \"127.0.0.1\"}:${process.env.PORT || 8787}`;","const APP = exe?.origin","/** Local defaults kept in step with `apps/server/src/config.ts`. */","let exe = await exeDevelopment();","}","\t}","\t\tprocess.exit(1);","\t\tconsole.error(`[dev] ${error instanceof Error ? error.message : String(error)}`);","\t} catch (error) {","\t\treturn parseDevTarget(process.argv.slice(2)) === \"exe\" ? await discoverExeDev() : undefined;","\ttry {","async function exeDevelopment() {","const APP = `http://${process.env.SERVER_HOST || \"127.0.0.1\"}:${process.env.PORT || 8787}`;","/** Defaults kept in step with `apps/server/src/config.ts`. */","const WEB = \"http://127.0.0.1:5173\";",21,6,7,[189,190,191,192,193,194,195],{"_85":86,"_87":88},{"_85":86,"_87":199},{"_85":86,"_87":198},{"_85":45,"_87":197},{"_85":86,"_87":88},{"_85":86,"_87":196},{"_85":86,"_87":88},"import type { Subprocess } from \"bun\";","import { discoverExeDev, parseDevTarget } from \"./dev-options\";","import manifest from \"../package.json\";","import { dirname, join } from \"node:path\";","oid","e4396161","mode","100644","7d628492","scripts/dev-options.ts",{"_200":306,"_202":203},55,0,[210],{"_55":208,"_57":208,"_59":211,"_61":207,"_63":212},1,[213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267],{"_85":45,"_87":305},{"_85":45,"_87":304},{"_85":45,"_87":303},{"_85":45,"_87":88},{"_85":45,"_87":302},{"_85":45,"_87":88},{"_85":45,"_87":301},{"_85":45,"_87":300},{"_85":45,"_87":299},{"_85":45,"_87":298},{"_85":45,"_87":297},{"_85":45,"_87":88},{"_85":45,"_87":296},{"_85":45,"_87":295},{"_85":45,"_87":294},{"_85":45,"_87":293},{"_85":45,"_87":174},{"_85":45,"_87":88},{"_85":45,"_87":292},{"_85":45,"_87":291},{"_85":45,"_87":290},{"_85":45,"_87":175},{"_85":45,"_87":289},{"_85":45,"_87":288},{"_85":45,"_87":174},{"_85":45,"_87":88},{"_85":45,"_87":287},{"_85":45,"_87":286},{"_85":45,"_87":285},{"_85":45,"_87":284},{"_85":45,"_87":283},{"_85":45,"_87":282},{"_85":45,"_87":180},{"_85":45,"_87":281},{"_85":45,"_87":275},{"_85":45,"_87":280},{"_85":45,"_87":175},{"_85":45,"_87":279},{"_85":45,"_87":278},{"_85":45,"_87":175},{"_85":45,"_87":88},{"_85":45,"_87":277},{"_85":45,"_87":180},{"_85":45,"_87":276},{"_85":45,"_87":275},{"_85":45,"_87":274},{"_85":45,"_87":175},{"_85":45,"_87":273},{"_85":45,"_87":272},{"_85":45,"_87":271},{"_85":45,"_87":270},{"_85":45,"_87":269},{"_85":45,"_87":175},{"_85":45,"_87":268},{"_85":45,"_87":174},"\treturn exeDev(name);","\t\tthrow new Error(\"exe.dev Reflection did not return a VM name\");","\tif (typeof name !== \"string\") {","\t\t: undefined;","\t\t? (value as Record).name","\tlet name = value && typeof value === \"object\" && !Array.isArray(value)","\t\tthrow new Error(\"exe.dev Reflection returned unreadable JSON\", { cause });","\t} catch (cause) {","\t\tvalue = await response.json();","\tlet value: unknown;","\t\tthrow new Error(`exe.dev Reflection returned HTTP ${response.status}`);","\tif (!response.ok) {","\t\tthrow new Error(\"cannot reach the exe.dev Reflection integration\", { cause });","\t\tresponse = await request(REFLECTION_URL);","\tlet response: Response;","): Promise {","\t\tfetch(url, { signal: AbortSignal.timeout(REFLECTION_TIMEOUT_MS) }),","\trequest: (url: string) => Promise = url =>","export async function discoverExeDev(","/** Discover the canonical VM name without relying on undocumented metadata. */","\treturn { name, host, origin: `https://${host}` };","\tlet host = `${name}.exe.xyz`;","\t\tthrow new Error(`exe.dev returned an invalid VM name: ${JSON.stringify(name)}`);","\tif (!VM_NAME.test(name)) {","export function exeDev(name: string): ExeDev {","\tthrow new Error(\"usage: bun scripts/dev.ts [--exe]\");","\tif (args.length === 1 && args[0] === \"--exe\") return \"exe\";","\tif (args.length === 0) return \"local\";","export function parseDevTarget(args: string[]): DevTarget {","};","\torigin: string;","\thost: string;","\tname: string;","export type ExeDev = {","export type DevTarget = \"local\" | \"exe\";","const VM_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;","const REFLECTION_TIMEOUT_MS = 5_000;","const REFLECTION_URL = \"https://reflection.int.exe.xyz/\";","e8404ac3","scripts/dev-options.test.ts",{"_200":385,"_202":203},41,[311],{"_55":208,"_57":208,"_59":211,"_61":309,"_63":312},[313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353],{"_85":45,"_87":384},{"_85":45,"_87":88},{"_85":45,"_87":383},{"_85":45,"_87":88},{"_85":45,"_87":382},{"_85":45,"_87":381},{"_85":45,"_87":380},{"_85":45,"_87":379},{"_85":45,"_87":378},{"_85":45,"_87":377},{"_85":45,"_87":355},{"_85":45,"_87":88},{"_85":45,"_87":376},{"_85":45,"_87":375},{"_85":45,"_87":374},{"_85":45,"_87":373},{"_85":45,"_87":372},{"_85":45,"_87":363},{"_85":45,"_87":371},{"_85":45,"_87":370},{"_85":45,"_87":369},{"_85":45,"_87":355},{"_85":45,"_87":88},{"_85":45,"_87":368},{"_85":45,"_87":367},{"_85":45,"_87":366},{"_85":45,"_87":365},{"_85":45,"_87":364},{"_85":45,"_87":363},{"_85":45,"_87":88},{"_85":45,"_87":362},{"_85":45,"_87":361},{"_85":45,"_87":355},{"_85":45,"_87":88},{"_85":45,"_87":360},{"_85":45,"_87":359},{"_85":45,"_87":358},{"_85":45,"_87":357},{"_85":45,"_87":356},{"_85":45,"_87":355},{"_85":45,"_87":354},"});","\t});","\t\t\t.toThrow(\"HTTP 503\");","\t\texpect(discoverExeDev(async () => new Response(null, { status: 503 }))).rejects","\t\t\t.toThrow(\"invalid VM name\");","\t\texpect(discoverExeDev(async () => Response.json({ name: \"not/a/name\" }))).rejects","\tit(\"rejects an unusable Reflection response\", async () => {","\t\texpect(found.origin).toBe(\"https://sample-vm.exe.xyz\");","\t\texpect(requested).toBe(\"https://reflection.int.exe.xyz/\");","\t\t});","\t\t\treturn Response.json({ name: \"sample-vm\", emoji: \"ignored\" });","\t\t\trequested = url;","\t\tlet found = await discoverExeDev(async url => {","\t\tlet requested: string | undefined;","\tit(\"discovers the current VM through Reflection\", async () => {","\t\t}","\t\t\texpect(() => exeDev(name)).toThrow(\"invalid VM name\");","\t\tfor (let name of [\"\", \"Sample\", \"sample.exe.xyz\", \"-sample\", \"sample-\"]) {","\t\t\torigin: \"https://sample-vm.exe.xyz\",","\t\t\thost: \"sample-vm.exe.xyz\",","\t\t\tname: \"sample-vm\",","\t\texpect(exeDev(\"sample-vm\")).toEqual({","\tit(\"builds an exe.dev origin only from a valid VM name\", () => {","\t\texpect(() => parseDevTarget([\"--exe\", \"--other\"])).toThrow(\"usage\");","\t\texpect(() => parseDevTarget([\"exe\"])).toThrow(\"usage\");","\t\texpect(parseDevTarget([\"--exe\"])).toBe(\"exe\");","\t\texpect(parseDevTarget([])).toBe(\"local\");","\tit(\"selects local and exe.dev targets explicitly\", () => {","describe(\"development options\", () => {","import { discoverExeDev, exeDev, parseDevTarget } from \"./dev-options\";","import { describe, expect, it } from \"bun:test\";","07e5c6da","readme.md",{"_200":492,"_202":203},{"_200":491,"_202":203},3,[391,392,393],{"_55":138,"_57":186,"_59":138,"_61":433,"_63":434},{"_55":413,"_57":139,"_59":414,"_61":139,"_63":415},{"_55":394,"_57":187,"_59":395,"_61":139,"_63":396},106,134,[397,398,399,400,401,402,403,404,405],{"_85":86,"_87":412},{"_85":86,"_87":411},{"_85":86,"_87":410},{"_85":47,"_87":409},{"_85":45,"_87":408},{"_85":45,"_87":407},{"_85":86,"_87":88},{"_85":86,"_87":406},{"_85":86,"_87":88},"## Architecture","for the exe.dev two-port development setup.","edited. This single-port example does not carry Vite HMR; use `bun run dev:exe`","edited.","GitHub, and repository access is checked before a channel is listed, opened, or","`https://chopin.example/auth/github/callback`. Every participant signs in with","Update the GitHub OAuth App callback to",95,123,[416,417,418,419,420,421,422,423,424,425],{"_85":86,"_87":88},{"_85":86,"_87":432},{"_85":86,"_87":88},{"_85":47,"_87":431},{"_85":47,"_87":430},{"_85":45,"_87":429},{"_85":45,"_87":428},{"_85":86,"_87":88},{"_85":86,"_87":427},{"_85":86,"_87":426},"SERVER_HOST=0.0.0.0 APP_ORIGIN=https://chopin.example bun run dev","```bash","needs no separate application WebSocket setting:","The client derives the application socket from the page origin, so a tunnel","separate WebSocket setting:","The client derives its socket from the page origin, so a tunnel needs no","## Sharing",34,[435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468],{"_85":86,"_87":88},{"_85":86,"_87":490},{"_85":86,"_87":88},{"_85":45,"_87":489},{"_85":45,"_87":88},{"_85":45,"_87":488},{"_85":45,"_87":487},{"_85":45,"_87":88},{"_85":45,"_87":486},{"_85":45,"_87":485},{"_85":45,"_87":480},{"_85":45,"_87":88},{"_85":45,"_87":484},{"_85":45,"_87":483},{"_85":45,"_87":88},{"_85":45,"_87":427},{"_85":45,"_87":482},{"_85":45,"_87":481},{"_85":45,"_87":480},{"_85":45,"_87":88},{"_85":45,"_87":479},{"_85":45,"_87":478},{"_85":45,"_87":477},{"_85":45,"_87":476},{"_85":45,"_87":475},{"_85":45,"_87":88},{"_85":45,"_87":474},{"_85":45,"_87":473},{"_85":45,"_87":472},{"_85":45,"_87":471},{"_85":45,"_87":88},{"_85":86,"_87":470},{"_85":86,"_87":88},{"_85":86,"_87":469},"The production image builds the browser client and serves it from the same Bun","### Docker","public demonstration.","development only; use an exact callback and a built client for production or a","not control. Keep this OAuth configuration and the Vite alternate port for","The wildcard callback trusts sibling `*.exe.xyz` hosts that this project does","and application WebSocket remain on the portless primary URL.","alternate URL `wss://.exe.xyz:5173`. The application, API, OAuth flow,","`.env`, binds Bun on port `8787`, and exposes Vite HMR through the private","name. It sets the runtime origin to `https://.exe.xyz` without changing","`dev:exe` uses exe.dev's documented Reflection integration to discover the VM","```","bun run dev:exe","ssh exe.dev share port 8787","primary proxy at Bun, then use the dedicated supervisor mode:","Chopin still sends the exact callback for the current VM. Point exe.dev's","https://exe.xyz/auth/github/callback","```text","register this callback with wildcard matching enabled:","For development across changing exe.dev VMs, the reusable GitHub OAuth App can","### exe.dev","Set `AGENT=off` to run the editor without Copilot.","64a2c8d9","47faf5be","package.json",{"_200":530,"_202":203},{"_200":529,"_202":203},2,[498],{"_55":48,"_57":110,"_59":48,"_61":499,"_63":500},13,[501,502,503,504,505,506,507,508,509,510,511,512,513,514],{"_85":86,"_87":528},{"_85":86,"_87":527},{"_85":86,"_87":526},{"_85":45,"_87":525},{"_85":86,"_87":524},{"_85":86,"_87":523},{"_85":86,"_87":522},{"_85":86,"_87":521},{"_85":86,"_87":520},{"_85":47,"_87":519},{"_85":45,"_87":518},{"_85":86,"_87":517},{"_85":86,"_87":516},{"_85":86,"_87":515},"\t\t\"ci\": \"dprint check && oxlint && bun scripts/check-tokens.ts\",","\t\t\"start\": \"bun run --filter '@chopin/server' start\",","\t\t\"build\": \"bun run --filter '@chopin/web' build\",","\t\t\"migrate\": \"bun apps/server/src/storage/migrate.ts\",","\t\t\"migrate\": \"bun run --filter '@chopin/server' migrate\",","\t\t\"test:postgres\": \"TEST_DATABASE_URL=postgresql://chopin:chopin@127.0.0.1:5432/chopin?sslmode=disable bun test apps/server/src/storage/postgres\",","\t\t\"docker:down\": \"docker compose --profile app down\",","\t\t\"docker:up\": \"docker compose --profile app up -d --build --wait app\",","\t\t\"db:down\": \"docker compose down\",","\t\t\"db:up\": \"docker compose up -d --wait db\",","\t\t\"dev:exe\": \"bun scripts/dev.ts --exe\",","\t\t\"dev\": \"bun scripts/dev.ts\",","\t\"scripts\": {","\t\"type\": \"module\",","a7ce0f9e","6a7497fc","docs/authentication.md",{"_200":588,"_202":203},{"_200":587,"_202":203},23,[536],{"_55":537,"_57":186,"_59":537,"_61":538,"_63":539},31,29,[540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568],{"_85":86,"_87":586},{"_85":86,"_87":585},{"_85":86,"_87":88},{"_85":45,"_87":584},{"_85":45,"_87":88},{"_85":45,"_87":583},{"_85":45,"_87":582},{"_85":45,"_87":88},{"_85":45,"_87":486},{"_85":45,"_87":581},{"_85":45,"_87":480},{"_85":45,"_87":88},{"_85":45,"_87":580},{"_85":45,"_87":579},{"_85":45,"_87":578},{"_85":45,"_87":88},{"_85":45,"_87":486},{"_85":45,"_87":577},{"_85":45,"_87":480},{"_85":45,"_87":88},{"_85":45,"_87":576},{"_85":45,"_87":575},{"_85":45,"_87":574},{"_85":45,"_87":573},{"_85":45,"_87":572},{"_85":45,"_87":88},{"_85":86,"_87":571},{"_85":86,"_87":570},{"_85":86,"_87":569},"does not write repository content. The token lists and authorizes repositories,","but it is required to discover private repositories with an OAuth App. Chopin","The OAuth App currently requests `read:user repo`. The `repo` scope is broad,","untrusted.","`redirect_uri` remain enforced; incoming Host and `X-Forwarded-*` values remain","PKCE, the confidential-client exchange, and the exact configured","control. It is a development tradeoff, not a production callback policy. State,","The wildcard setting covers sibling `*.exe.xyz` hosts outside this project's","https://.exe.xyz/auth/github/callback","GitHub then accepts the exact callback Chopin sends for each VM:","`https://exe.xyz/auth/github/callback` with GitHub wildcard matching enabled.","A reusable development OAuth App may register","APP_ORIGIN=https://.exe.xyz","integration and supplies this exact runtime value without editing `.env`:","`bun run dev:exe` discovers the current VM through exe.dev's Reflection","### exe.dev development","never from incoming Host or forwarded headers.","such as `http://127.0.0.1:8787`. OAuth callbacks are built only from this value,","564865d8","0624a1b2","apps/web/vite.config.ts",{"_200":729,"_202":203},{"_200":728,"_202":203},[593,594,595,596],{"_55":389,"_57":187,"_59":389,"_61":675,"_63":676},{"_55":662,"_57":186,"_59":597,"_61":139,"_63":663},{"_55":636,"_57":110,"_59":637,"_61":108,"_63":638},{"_55":597,"_57":598,"_59":599,"_61":58,"_63":600},40,15,63,[601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618],{"_85":86,"_87":635},{"_85":86,"_87":634},{"_85":86,"_87":633},{"_85":47,"_87":632},{"_85":47,"_87":631},{"_85":47,"_87":630},{"_85":47,"_87":629},{"_85":45,"_87":628},{"_85":45,"_87":627},{"_85":45,"_87":626},{"_85":86,"_87":625},{"_85":47,"_87":624},{"_85":47,"_87":623},{"_85":47,"_87":622},{"_85":47,"_87":621},{"_85":47,"_87":620},{"_85":86,"_87":619},{"_85":86,"_87":354},"\t},","\t\t},","\t\t\tclientPort: PORT,","\t\t\thost: \"127.0.0.1\",","\t\t\tprotocol: \"ws\",","\t\thmr: {","\t\t */","\t\t * allowlisted. Bun cannot relay it because `/ws` belongs to the product.","\t\t * exe.dev it uses the VM's private alternate port with the exact VM host","\t\t * Hot reload is the exception. Locally its socket points at loopback; in","\t\t * perfectly and cannot be tested from here. Nothing proxies a socket.","\t\t * relaying a WebSocket upgrade is the one thing that has to work","\t\t * pointed straight back here rather than through the server, because","\t\t * Hot reload is the exception, and deliberately so. Its socket is","\t\t *","\t\t * would need to know which mode it was in.","\t\t * second origin that only exists during development, and the client",27,52,[639,640,641,642,643,644,645,646,647,648,649,650,651],{"_85":86,"_87":661},{"_85":86,"_87":660},{"_85":86,"_87":625},{"_85":47,"_87":659},{"_85":86,"_87":658},{"_85":86,"_87":657},{"_85":47,"_87":88},{"_85":86,"_87":656},{"_85":47,"_87":655},{"_85":45,"_87":654},{"_85":86,"_87":633},{"_85":86,"_87":653},{"_85":86,"_87":652},"\t\t * everything else to this process, so development, production and a","\t\t * The Bun server is the only origin: it owns `/ws` and forwards","\t\t * Normal browser traffic never comes here directly.","\t\t * The browser never comes here directly.","\t\t/*","\t\tstrictPort: true,","\t\tport: PORT,","\t\thost: \"127.0.0.1\",","\t\t * in the one nobody is watching.","\t\t * server proxying to whichever the OS resolves first and edits landing",17,[664,665,666,667,668,669,670,671],{"_85":86,"_87":619},{"_85":86,"_87":88},{"_85":86,"_87":674},{"_85":45,"_87":673},{"_85":45,"_87":88},{"_85":86,"_87":656},{"_85":86,"_87":672},{"_85":86,"_87":633},"\t\t * One address, explicitly.","\t\t...devNetwork(process.env.CHOPIN_DEV_EXE_HOST),","\tserver: {",30,[677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706],{"_85":86,"_87":727},{"_85":86,"_87":726},{"_85":86,"_87":88},{"_85":45,"_87":725},{"_85":45,"_87":88},{"_85":86,"_87":724},{"_85":45,"_87":723},{"_85":45,"_87":88},{"_85":45,"_87":722},{"_85":45,"_87":88},{"_85":45,"_87":721},{"_85":45,"_87":720},{"_85":45,"_87":719},{"_85":45,"_87":622},{"_85":45,"_87":718},{"_85":45,"_87":717},{"_85":45,"_87":716},{"_85":45,"_87":175},{"_85":45,"_87":715},{"_85":45,"_87":714},{"_85":45,"_87":175},{"_85":45,"_87":713},{"_85":45,"_87":712},{"_85":45,"_87":711},{"_85":45,"_87":710},{"_85":45,"_87":709},{"_85":45,"_87":174},{"_85":86,"_87":88},{"_85":86,"_87":708},{"_85":86,"_87":707},"\tplugins: [react(), tailwindcss(), tsconfigPaths()],","export default defineConfig({","\t};","\t\thmr: { protocol: \"wss\", host: exeHost, clientPort: PORT },","\t\tallowedHosts: [exeHost],","\t\thost: \"0.0.0.0\",","\treturn {","\t\tthrow new Error(\"CHOPIN_DEV_EXE_HOST must be one exact .exe.xyz hostname\");","\tif (!EXE_HOST.test(exeHost)) {","\t\t};","\t\t\thmr: { protocol: \"ws\", host: \"127.0.0.1\", clientPort: PORT },","\t\t\tallowedHosts: [],","\t\treturn {","\tif (!exeHost) {","export function devNetwork(exeHost: string | undefined): DevNetwork {","type DevNetwork = Pick;","const EXE_HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.exe\\.xyz$/;","const PORT = 5173;","import type { ServerOptions } from \"vite\";","import tsconfigPaths from \"vite-tsconfig-paths\";","import react from \"@vitejs/plugin-react\";","e0e39752","7a573bc3","apps/web/vite.config.test.ts",{"_200":775,"_202":203},[733],{"_55":208,"_57":208,"_59":211,"_61":636,"_63":734},[735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761],{"_85":45,"_87":384},{"_85":45,"_87":88},{"_85":45,"_87":774},{"_85":45,"_87":88},{"_85":45,"_87":773},{"_85":45,"_87":772},{"_85":45,"_87":771},{"_85":45,"_87":622},{"_85":45,"_87":718},{"_85":45,"_87":770},{"_85":45,"_87":363},{"_85":45,"_87":355},{"_85":45,"_87":88},{"_85":45,"_87":769},{"_85":45,"_87":768},{"_85":45,"_87":767},{"_85":45,"_87":766},{"_85":45,"_87":765},{"_85":45,"_87":363},{"_85":45,"_87":355},{"_85":45,"_87":88},{"_85":45,"_87":764},{"_85":45,"_87":763},{"_85":45,"_87":762},{"_85":45,"_87":369},{"_85":45,"_87":355},{"_85":45,"_87":354},"\t\t\texpect(() => devNetwork(host)).toThrow(\"one exact\");","\t\tfor (let host of [\".exe.xyz\", \"sample-vm.exe.xyz:5173\", \"evil.test\", \"Sample.exe.xyz\"]) {","\tit(\"does not accept a broad or malformed host\", () => {","\t\t\thmr: { protocol: \"wss\", host: \"sample-vm.exe.xyz\", clientPort: 5173 },","\t\t\tallowedHosts: [\"sample-vm.exe.xyz\"],","\t\t\thost: \"0.0.0.0\",","\t\texpect(devNetwork(\"sample-vm.exe.xyz\")).toEqual({","\tit(\"uses the exact exe.dev host for remote HMR\", () => {","\t\t\thmr: { protocol: \"ws\", host: \"127.0.0.1\", clientPort: 5173 },","\t\texpect(devNetwork(undefined)).toEqual({","\tit(\"keeps ordinary development on loopback\", () => {","describe(\"the Vite development network\", () => {","import { devNetwork } from \"./vite.config\";","f51f8b0c","apps/server/src/github/client.test.ts",{"_200":815,"_202":203},{"_200":814,"_202":203},[780,781],{"_55":636,"_57":186,"_59":636,"_61":139,"_63":798},{"_55":782,"_57":186,"_59":783,"_61":187,"_63":784},56,58,[785,786,787,788,789,790,791],{"_85":86,"_87":797},{"_85":86,"_87":796},{"_85":86,"_87":795},{"_85":45,"_87":794},{"_85":86,"_87":793},{"_85":86,"_87":792},{"_85":86,"_87":355},"\t\texpect(called!.init!.redirect).toBe(\"error\");","\t\texpect(body.get(\"code_verifier\")).toBe(\"verifier\");","\t\texpect(body.get(\"redirect_uri\")).toBe(\"https://chopin.test/auth/github/callback\");","\t\texpect(body.get(\"client_secret\")).toBe(\"client-secret\");","\t\tlet body = new URLSearchParams(called!.init!.body as string);","\t\texpect(called!.url).not.toContain(\"client-secret\");",[799,800,801,802,803,804,805,806],{"_85":86,"_87":88},{"_85":86,"_87":813},{"_85":86,"_87":812},{"_85":45,"_87":811},{"_85":45,"_87":810},{"_85":86,"_87":809},{"_85":86,"_87":808},{"_85":86,"_87":807},"\t\texpect(url.searchParams.get(\"code_challenge\")).toBe(\"challenge\");","\t\texpect(url.searchParams.get(\"state\")).toBe(\"state\");","\t\texpect(url.searchParams.get(\"scope\")).toBe(\"read:user repo\");","\t\t\t.toBe(\"https://chopin.test/auth/github/callback\");","\t\texpect(url.searchParams.get(\"redirect_uri\"))","\t\texpect(url.searchParams.get(\"client_id\")).toBe(\"client-id\");","\t\texpect(url.origin).toBe(\"https://github.com\");","e1e96e2d","d065bc90","apps/server/src/auth/routes.test.ts",{"_200":941,"_202":203},{"_200":940,"_202":203},42,[821,822],{"_55":662,"_57":662,"_59":662,"_61":62,"_63":901},{"_55":823,"_57":186,"_59":824,"_61":825,"_63":826},187,189,43,[827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869],{"_85":86,"_87":900},{"_85":86,"_87":355},{"_85":86,"_87":88},{"_85":45,"_87":899},{"_85":45,"_87":898},{"_85":45,"_87":897},{"_85":45,"_87":896},{"_85":45,"_87":895},{"_85":45,"_87":894},{"_85":45,"_87":893},{"_85":45,"_87":892},{"_85":45,"_87":716},{"_85":45,"_87":88},{"_85":45,"_87":891},{"_85":45,"_87":890},{"_85":45,"_87":879},{"_85":45,"_87":889},{"_85":45,"_87":876},{"_85":45,"_87":874},{"_85":45,"_87":363},{"_85":45,"_87":888},{"_85":45,"_87":887},{"_85":45,"_87":886},{"_85":45,"_87":885},{"_85":45,"_87":88},{"_85":45,"_87":884},{"_85":45,"_87":883},{"_85":45,"_87":882},{"_85":45,"_87":881},{"_85":45,"_87":880},{"_85":45,"_87":879},{"_85":45,"_87":878},{"_85":45,"_87":877},{"_85":45,"_87":876},{"_85":45,"_87":875},{"_85":45,"_87":874},{"_85":45,"_87":873},{"_85":45,"_87":363},{"_85":45,"_87":355},{"_85":45,"_87":88},{"_85":86,"_87":872},{"_85":86,"_87":871},{"_85":86,"_87":870},"\t\tlet storage = new MemoryStorage();","\t\tlet now = new Date(\"2026-08-13T12:00:00.000Z\");","\tit(\"revokes the local session when GitHub rejects its token\", async () => {","\t\t\tcode: \"oauth-code\",","\t\t\tredirectUri: \"https://sample-vm.exe.xyz/auth/github/callback\",","\t\t\tclientSecret: \"client-secret\",","\t\t\tclientId: \"client-id\",","\t\texpect(github.exchanged).toMatchObject({","\t\texpect(callback!.status).toBe(303);","\t\t);","\t\t\t),","\t\t\t\t{ headers: { ...forwarded, cookie: pair(stateCookie) } },","\t\t\t\t`http://127.0.0.1:8787/auth/github/callback?code=oauth-code&state=${state}`,","\t\t\tnew Request(","\t\tlet callback = await router.handle(","\t\tlet state = new URL(start!.headers.get(\"location\")!).searchParams.get(\"state\");","\t\texpect(stateCookie).toContain(\"; Secure\");","\t\texpect(stateCookie).toStartWith(\"__Host-chopin_oauth_state=\");","\t\tlet stateCookie = cookies(start!)[0]!;","\t\texpect(github.authorized).toMatchObject({","\t\t\tnew Request(\"http://127.0.0.1:8787/auth/github\", { headers: forwarded }),","\t\tlet start = await router.handle(","\t\t\t\"x-forwarded-proto\": \"http\",","\t\t\t\"x-forwarded-host\": \"evil.test\",","\t\tlet forwarded = {","\t\tregisterAuthRoutes(router, { config, storage: new MemoryStorage(), github });","\t\tlet router = new Router();","\t\tlet github = new FakeGitHub();","\t\tlet config = { ...CONFIG, origin: \"https://sample-vm.exe.xyz\" };","\tit(\"uses the configured public origin behind a reverse proxy\", async () => {","\t\texpect(cookies(missing!)[0]).toContain(\"Max-Age=0\");",[902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923],{"_85":86,"_87":174},{"_85":86,"_87":88},{"_85":86,"_87":939},{"_85":47,"_87":938},{"_85":45,"_87":937},{"_85":45,"_87":936},{"_85":86,"_87":935},{"_85":86,"_87":88},{"_85":47,"_87":934},{"_85":45,"_87":933},{"_85":45,"_87":932},{"_85":86,"_87":931},{"_85":86,"_87":930},{"_85":86,"_87":929},{"_85":86,"_87":928},{"_85":86,"_87":175},{"_85":86,"_87":88},{"_85":47,"_87":927},{"_85":45,"_87":926},{"_85":86,"_87":925},{"_85":86,"_87":924},{"_85":86,"_87":175},"\t\treturn \"gho_route_secret\";","\t\tthis.exchanged = input;","\tasync exchange(input: Parameters[0]): Promise {","\tasync exchange(input: { code: string; verifier: string }): Promise {","\t\treturn url.href;","\t\turl.searchParams.set(\"challenge\", input.challenge);","\t\turl.searchParams.set(\"state\", input.state);","\t\tlet url = new URL(\"https://github.test/authorize\");","\t\tthis.authorized = input;","\tauthorize(input: Parameters[0]): string {","\tauthorize(input: { state: string; challenge: string }): string {","\tdenyRepositories = false;","\texchanged: Parameters[0] | undefined;","\tauthorized: Parameters[0] | undefined;","\texchanged: { code: string; verifier: string } | undefined;","class FakeGitHub implements GitHub {","1bba628c","da668078","agents.md",{"_200":989,"_202":203},{"_200":988,"_202":203},[946,947],{"_55":187,"_57":186,"_59":187,"_61":187,"_63":975},{"_55":948,"_57":186,"_59":949,"_61":499,"_63":950},25,26,[951,952,953,954,955,956,957,958,959,960,961,962,963],{"_85":86,"_87":974},{"_85":86,"_87":973},{"_85":86,"_87":88},{"_85":45,"_87":972},{"_85":45,"_87":971},{"_85":45,"_87":970},{"_85":45,"_87":969},{"_85":45,"_87":968},{"_85":45,"_87":967},{"_85":45,"_87":88},{"_85":86,"_87":966},{"_85":86,"_87":965},{"_85":86,"_87":964},"as `/api` and `/ws`. Its default command migrates before serving and runs as the","stage produces `apps/web/dist`, and the Bun server serves it on the same origin","`Dockerfile` is one application image, not a web tier and an API tier: the build","Do not replace it with `.exe.xyz` or `allowedHosts: true`.","`CHOPIN_DEV_EXE_HOST` is the supervisor's internal exact-host handoff to Vite.","Vite HMR connects separately to the private alternate port `5173` over WSS;","`0.0.0.0:8787`. Portless HTTPS reaches Bun through exe.dev's primary proxy.","VM name, overrides `APP_ORIGIN` only in its child processes, and binds Bun to","`bun run dev:exe` queries the documented Reflection integration for the current","which is what both suites use.","and a session encryption key. `AGENT=off` runs everything except the agent,",[976,977,978,979,980,981,982],{"_85":86,"_87":88},{"_85":86,"_87":427},{"_85":86,"_87":987},{"_85":45,"_87":986},{"_85":86,"_87":985},{"_85":86,"_87":984},{"_85":86,"_87":983},"bun run types # every package, and e2e","bun run e2e # Chromium, PostgreSQL, builds the client first","bun test # no browser, no agent spawned","bun run dev:exe # exe.dev origin discovery and remote HMR","bun run dev # supervisor: Vite + server on one origin, Ctrl-C stops both","be61767e","41992193",".env.example",{"_200":1010,"_202":203},{"_200":1009,"_202":203},[994],{"_55":389,"_57":186,"_59":389,"_61":187,"_63":995},[996,997,998,999,1000,1001,1002],{"_85":86,"_87":1008},{"_85":86,"_87":88},{"_85":86,"_87":1007},{"_85":45,"_87":1006},{"_85":86,"_87":1005},{"_85":86,"_87":1004},{"_85":86,"_87":1003},"GITHUB_OAUTH_CLIENT_SECRET=","GITHUB_OAUTH_CLIENT_ID=","APP_ORIGIN=http://127.0.0.1:8787","# `bun run dev:exe` discovers the VM and overrides this local origin in memory.","# GitHub sign-in. Generate the key with `openssl rand -hex 32`.","DATABASE_URL=postgresql://chopin:chopin@127.0.0.1:5432/chopin?sslmode=disable","1e0ed2bf","a545cc35","parents",[20],"author",{"_1024":1025,"_1026":1027,"_1030":1032},"committer",{"_1024":1028,"_1026":1029,"_1030":1031},"message","Add exe.dev development mode","signature","subject","authors",[1023],{"_1024":1025,"_1026":1027},"name","Krzysztof Cieslak","email","krzysztof_cieslak@windowslive.com","Krzysztof Cieślak","krzysztof-cieslak@github.com","time",1786714164,1786713237,"documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars","watchers","watching","pinned","notify","views",[1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189],"navigation",{"_1053":1054,"_1137":1138,"_1139":1140,"_1141":1142,"_1143":1144,"_1145":1146,"_85":1147},"sources",[],"viewer","meta",{"_1130":1131,"_1132":1133,"_1134":88,"_1042":26,"_1135":1125,"_1136":26,"_1048":208,"_1049":208},"branches",[1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129],"tags",[1068,1069,1070,1071],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","main","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","head","empty","pins",[1160,1161,1162],"documents",{"_1155":1156,"_1157":1158},"code",{"_1152":1153,"_1154":499},"automations",{"_1150":389,"_1151":-5},"delivery",{"_1148":208,"_1149":-5},"04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows","deployments","commits",1000,"changes","counts",{"_1159":1158},"total",11,"issue",{"_1163":1154,"_1024":1175,"_39":1154,"_1166":1176,"_1051":1168,"_1169":26,"_1170":1168,"_1171":499},{"_1163":1172,"_1024":1173,"_39":1172,"_1166":1174,"_1051":1168,"_1169":26,"_1170":1168,"_1171":208},{"_1163":1164,"_1024":1165,"_39":1164,"_1166":1167,"_1051":1168,"_1169":26,"_1170":1168,"_1171":1158},"id","issues","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_1163":1154,"_1024":1175,"_39":1154,"_1166":1220,"_1051":1168,"_1169":26,"_1170":1168},{"_1163":1172,"_1024":1173,"_39":1172,"_1166":1219,"_1051":1168,"_1169":26,"_1170":1168},{"_1163":1164,"_1024":1165,"_39":1164,"_1166":1218,"_1051":1168,"_1169":26,"_1170":1168},{"_1163":1215,"_1024":1216,"_39":1215,"_1166":1217,"_1051":26,"_1169":26,"_1170":1168},{"_1163":1212,"_1024":1213,"_39":1212,"_1166":1214,"_1051":26,"_1169":26,"_1170":1168},{"_1163":1150,"_1024":1210,"_39":1143,"_1166":1211,"_1051":26,"_1169":26,"_1170":1168},{"_1163":1151,"_1024":1207,"_39":1208,"_1166":1209,"_1051":26,"_1169":26,"_1170":1168},{"_1163":1148,"_1024":1205,"_39":1148,"_1166":1206,"_1051":26,"_1169":26,"_1170":1168},{"_1163":1201,"_1024":1202,"_39":1203,"_1166":1204,"_1051":26,"_1169":26,"_1170":1168},{"_1163":1139,"_1024":1199,"_39":1139,"_1166":1200,"_1051":26,"_1169":26,"_1170":26},{"_1163":1196,"_1024":1197,"_39":1196,"_1166":1198,"_1051":26,"_1169":26,"_1170":26},{"_1163":1193,"_1024":1194,"_39":1193,"_1166":1195,"_1051":26,"_1169":26,"_1170":26},{"_1163":1190,"_1024":1191,"_39":1190,"_1166":1192,"_1051":26,"_1169":26,"_1170":26},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794435065490,"sidebar","expanded"]