Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Initial g1t: services, event bus, intents and attempts | 1 | import { createRequestHandler } from "react-router"; |
| 2 | ||
| Merge branch 'worktree-agent-a8385d293d42c913a' | 3 | import { identityClient, isNamespaceShaped } from "@g1t/contracts"; |
| 4 | ||
| Repository files and avatars on g1tusercontent.com: raw files, a Raw button, images on file pages and in READMEs | 5 | import { addressesFor } from "../app/lib/addresses"; |
| Registry answers run nothing in a browser: nosniff, a sandbox policy, and publisher documents as downloads | 6 | import { hardenRegistryHeaders } from "../app/lib/content-safety"; |
| The site's pages run only their own scripts: a nonce policy, nosniff, a referrer policy and no framing | 7 | import { withSiteHeaders } from "../app/lib/page-headers"; |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 8 | import { finishResponse, withRequestPerf } from "../app/lib/perf.server"; |
| Composer from the workspace's own repositories, and go get from g1t.sh | 9 | import { goImport } from "../app/lib/go-get"; |
| Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy | 10 | import { repositoryOfPage, stillPublic } from "../app/lib/public-cache"; |
| Merge branch 'worktree-agent-a8385d293d42c913a' | 11 | import { registryWorkspace, servicePath } from "../app/lib/registry-paths"; |
| Repository files and avatars on g1tusercontent.com: raw files, a Raw button, images on file pages and in READMEs | 12 | import { usercontentPath } from "../app/lib/usercontent"; |
| 13 | import { serveUsercontent } from "./usercontent"; | |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 14 | |
| Initial g1t: services, event bus, intents and attempts | 15 | const requestHandler = createRequestHandler( |
| 16 | () => import("virtual:react-router/server-build"), | |
| 17 | import.meta.env.MODE, | |
| 18 | ); | |
| 19 | ||
| Docs as their own app; shared theme package | 20 | const DOCS = "https://docs.g1t.sh"; |
| Initial g1t: services, event bus, intents and attempts | 21 | |
| Docs as their own app; shared theme package | 22 | /** Where the documentation pages that used to live under /docs are now. */ |
| 23 | const MOVED_DOCS: Record<string, string> = { | |
| 24 | "/docs": "/quickstart/", | |
| 25 | "/docs/concepts": "/concepts/overview/", | |
| 26 | "/docs/authentication": "/guides/authentication/", | |
| 27 | "/docs/git": "/guides/git/", | |
| g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent | 28 | "/docs/g1t-agents": "/guides/working-with-g1t/", |
| Docs as their own app; shared theme package | 29 | "/docs/agents": "/guides/bring-your-own-agent/", |
| 30 | "/docs/api": "/reference/api/", | |
| Merge branch 'worktree-agent-ab2e39e11a6493412' | 31 | "/docs/api/reference": "/reference/api/", |
| Docs as their own app; shared theme package | 32 | }; |
| docs.g1t.sh, generated OpenAPI with an interactive reference, full footer | 33 | |
| Initial g1t: services, event bus, intents and attempts | 34 | export default { |
| Icons are cached at the edge | 35 | async fetch(request, env, ctx) { |
| Repository files and avatars on g1tusercontent.com: raw files, a Raw button, images on file pages and in READMEs | 36 | // Repository files and avatars, on their own origin |
| 37 | // (g1tusercontent.com): answered before anything of the site's runs, | |
| 38 | // so nothing there reads or sets the session cookie. | |
| 39 | const usercontent = usercontentPath(new URL(request.url), addressesFor(env).usercontent); | |
| 40 | if (usercontent !== null) return serveUsercontent(env, ctx, request, usercontent); | |
| The site's pages run only their own scripts: a nonce policy, nosniff, a referrer policy and no framing | 41 | // Every answer: no sniffing, a referrer of the origin alone, and no |
| 42 | // framing of pages (app/lib/page-headers.ts). | |
| 43 | return withSiteHeaders(await site(request, env, ctx)); | |
| Initial g1t: services, event bus, intents and attempts | 44 | }, |
| 45 | } satisfies ExportedHandler<Env>; | |
| Workspace names and icons, and a component kit for every control | 46 | |
| The site's pages run only their own scripts: a nonce policy, nosniff, a referrer policy and no framing | 47 | async function site(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> { |
| 48 | const { pathname } = new URL(request.url); | |
| 49 | // Git over HTTPS shares this hostname but belongs to the repos service. | |
| 50 | // Its answer goes back to the git client as it is: a repository under a | |
| 51 | // renamed workspace's old name answers with a 301, which git follows and | |
| 52 | // must see, so the redirect is never followed here. | |
| 53 | // The container registry (`docker login g1t.sh`) and the npm registry | |
| 54 | // (`g1t.sh/-/npm/`) are the packages | |
| 55 | // service's, handed over the same way. | |
| 56 | // `go get g1t.sh/<workspace>/<repo>`: where its code is, from the | |
| 57 | // address alone, so it costs nothing and caches. | |
| 58 | const go = request.method === "GET" ? goImport(new URL(request.url)) : null; | |
| 59 | if (go) { | |
| 60 | return new Response(go, { | |
| 61 | headers: { "content-type": "text/html; charset=utf-8", "cache-control": "public, max-age=3600" }, | |
| 62 | }); | |
| 63 | } | |
| 64 | const service = servicePath(pathname); | |
| 65 | if (service === "git") { | |
| 66 | return proxyGit(env, request); | |
| 67 | } | |
| 68 | if (service === "packages") { | |
| 69 | return proxyPackages(env, request); | |
| 70 | } | |
| 71 | // The documentation is its own site. | |
| 72 | if (pathname === "/docs" || pathname.startsWith("/docs/")) { | |
| 73 | const page = pathname.endsWith("/") ? pathname.slice(0, -1) : pathname; | |
| 74 | const target = MOVED_DOCS[page] ?? "/"; | |
| 75 | return Response.redirect(DOCS + target, 301); | |
| 76 | } | |
| 77 | // Every page and data request says where its time went (Server-Timing) | |
| 78 | // and keeps the reader's D1 bookmarks (app/lib/perf.server.ts). | |
| 79 | const render = () => withRequestPerf(request, async () => finishResponse(request, await requestHandler(request))); | |
| 80 | if (anonymousPage(request, pathname)) return servePublic(env, request, ctx, render); | |
| 81 | return render(); | |
| 82 | } | |
| 83 | ||
| Workspace names and icons, and a component kit for every control | 84 | /** |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 85 | * Public pages as someone signed out sees them: the same for every such |
| 86 | * visitor, so kept in this data centre's cache. Reserved first segments | |
| 87 | * (settings, sign-in, invitations and the like) and workspace pages (`-`) | |
| Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy | 88 | * are never kept; docs/PERFORMANCE.md lists the rules. A repository's kept |
| 89 | * page is served only while repos says the repository is still public: one | |
| 90 | * made private or deleted is never served from any data centre's copy. | |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 91 | */ |
| 92 | const PUBLIC_TOP = /^\/(?:|_root\.data|pricing|explore|security|support|policies(?:\/[a-z-]+)?)(?:\.data)?$/; | |
| 93 | const PUBLIC_PROJECT = | |
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 94 | /^\/(?!(?:settings|u|auth|oauth|integrations|new|invite|workspaces|device|verify|confirm-email|login|register|logout|forgot|reset|search|status|avatars|docs)\/)[^/]+\/(?!-\/|-$)[^/]+(?:\/(?:code|commits|issues|pulls|pull\/\d+|issues\/\d+|commit\/[0-9a-f]+|tree\/.+|blob\/.+))?(?:\.data)?$/; |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 95 | /** Fresh for this long; then served once more while a new copy is made. */ |
| 96 | const PUBLIC_FRESH_SECONDS = 30; | |
| 97 | const PUBLIC_STALE_SECONDS = 300; | |
| 98 | ||
| 99 | function anonymousPage(request: Request, pathname: string): boolean { | |
| 100 | if (request.method !== "GET") return false; | |
| 101 | if (/(?:^|;\s*)g1t_session=/.test(request.headers.get("cookie") ?? "")) return false; | |
| 102 | return PUBLIC_TOP.test(pathname) || PUBLIC_PROJECT.test(pathname); | |
| 103 | } | |
| 104 | ||
| Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy | 105 | async function servePublic(env: Env, request: Request, ctx: ExecutionContext, render: () => Promise<Response>): Promise<Response> { |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 106 | const cache = (caches as unknown as { default: Cache }).default; |
| 107 | const key = new Request(request.url, { method: "GET" }); | |
| Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy | 108 | const repository = PUBLIC_PROJECT.test(new URL(request.url).pathname) ? repositoryOfPage(new URL(request.url).pathname) : null; |
| 109 | // Asked alongside the cache, so a hit waits for one indexed read at most. | |
| 110 | const [cached, visible] = await Promise.all([cache.match(key), repository ? isStillPublic(env, repository) : Promise.resolve(true)]); | |
| 111 | if (cached && !visible) { | |
| 112 | ctx.waitUntil(cache.delete(key).then(() => undefined, () => undefined)); | |
| 113 | return render(); | |
| 114 | } | |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 115 | const keptAt = Number(cached?.headers.get("x-g1t-kept-at") ?? 0); |
| 116 | const age = Math.round((Date.now() - keptAt) / 1000); | |
| 117 | const refresh = async () => { | |
| 118 | const fresh = await render(); | |
| 119 | // Only a plain answer for everyone: nothing that sets a cookie or says | |
| 120 | // it is private. | |
| 121 | const cacheable = | |
| 122 | (fresh.status === 200 || fresh.status === 404) && | |
| 123 | !fresh.headers.has("set-cookie") && | |
| 124 | !/private|no-store/.test(fresh.headers.get("cache-control") ?? ""); | |
| 125 | if (cacheable) { | |
| 126 | const copy = new Response(fresh.clone().body, fresh); | |
| 127 | copy.headers.set("x-g1t-kept-at", String(Date.now())); | |
| 128 | copy.headers.set("cache-control", `public, max-age=${PUBLIC_STALE_SECONDS}`); | |
| 129 | ctx.waitUntil(cache.put(key, copy)); | |
| 130 | } | |
| 131 | return fresh; | |
| 132 | }; | |
| 133 | if (cached && keptAt > 0 && age < PUBLIC_STALE_SECONDS) { | |
| 134 | if (age >= PUBLIC_FRESH_SECONDS) ctx.waitUntil(refresh().then(() => undefined, () => undefined)); | |
| 135 | const answer = new Response(cached.body, cached); | |
| 136 | answer.headers.delete("x-g1t-kept-at"); | |
| 137 | answer.headers.delete("cache-control"); | |
| 138 | answer.headers.set("server-timing", `cache;desc="hit, ${age}s old"`); | |
| 139 | return answer; | |
| 140 | } | |
| 141 | return refresh(); | |
| 142 | } | |
| 143 | ||
| Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy | 144 | /** Whether the repository is there and public; anything else, including no answer, is no. */ |
| 145 | async function isStillPublic(env: Env, repository: string): Promise<boolean> { | |
| 146 | try { | |
| 147 | const answer = await env.REPOS.fetch("https://service/rpc/visibility", { | |
| 148 | method: "POST", | |
| 149 | headers: { "content-type": "application/json" }, | |
| 150 | body: JSON.stringify({ paths: [repository] }), | |
| 151 | }); | |
| 152 | return answer.ok && stillPublic(await answer.json(), repository); | |
| 153 | } catch { | |
| 154 | return false; | |
| 155 | } | |
| 156 | } | |
| 157 | ||
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 158 | /** |
| Mission control shows where you are needed and what agents landed without you; git answers in about 200ms | 159 | * A git request, answered by the repos service. Its `Server-Timing` header |
| 160 | * gains `repos`: how long the answer took to start from here, so the time | |
| 161 | * between this Worker and the repos service shows beside the steps the | |
| 162 | * repos service reports. | |
| 163 | */ | |
| 164 | async function proxyGit(env: Env, request: Request): Promise<Response> { | |
| 165 | const started = Date.now(); | |
| 166 | const answer = await env.REPOS.fetch(new Request(request, { redirect: "manual" })); | |
| 167 | const response = new Response(answer.body, answer); | |
| 168 | response.headers.append("server-timing", `repos;dur=${Date.now() - started}`); | |
| 169 | return response; | |
| 170 | } | |
| 171 | ||
| 172 | /** | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 173 | * A registry request, answered by the packages service as it is: its |
| 174 | * redirects (a large blob sent to storage) go back to the client, which | |
| Merge branch 'worktree-agent-a8385d293d42c913a' | 175 | * follows them itself. One that found nothing under a workspace's old name |
| 176 | * or an alias staff set (`g1t` for `flagon-io`) is sent to the same path | |
| 177 | * under the workspace's name: only the not-found answer pays for the lookup. | |
| Registry answers run nothing in a browser: nosniff, a sandbox policy, and publisher documents as downloads | 178 | * Every answer runs nothing in a browser (app/lib/content-safety.ts): what |
| 179 | * a registry serves is its publisher's, on this origin. | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 180 | */ |
| 181 | async function proxyPackages(env: Env, request: Request): Promise<Response> { | |
| 182 | const started = Date.now(); | |
| 183 | const answer = await env.PACKAGES.fetch(new Request(request, { redirect: "manual" })); | |
| Merge branch 'worktree-agent-a8385d293d42c913a' | 184 | const moved = answer.status === 404 ? await registryMoved(env, request) : null; |
| 185 | const response = moved ?? new Response(answer.body, answer); | |
| Registry answers run nothing in a browser: nosniff, a sandbox policy, and publisher documents as downloads | 186 | hardenRegistryHeaders(response.headers); |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 187 | response.headers.append("server-timing", `packages;dur=${Date.now() - started}`); |
| 188 | return response; | |
| 189 | } | |
| 190 | ||
| Merge branch 'worktree-agent-a8385d293d42c913a' | 191 | /** Where a registry request under an alias or old name goes now, or null. */ |
| 192 | async function registryMoved(env: Env, request: Request): Promise<Response | null> { | |
| 193 | const url = new URL(request.url); | |
| 194 | const named = registryWorkspace(url.pathname); | |
| 195 | if (!named || !isNamespaceShaped(named.slug)) return null; | |
| 196 | let current: string | null = null; | |
| 197 | try { | |
| 198 | current = await identityClient(env.IDENTITY).resolveSlug(named.slug); | |
| 199 | } catch { | |
| 200 | return null; | |
| 201 | } | |
| 202 | if (!current || current === named.slug) return null; | |
| 203 | const get = request.method === "GET" || request.method === "HEAD"; | |
| 204 | // 308 keeps a publish a PUT, for the clients that follow it. | |
| 205 | return new Response(null, { status: get ? 301 : 308, headers: { location: named.under(current) + url.search } }); | |
| Workspace names and icons, and a component kit for every control | 206 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.