Skip to content
Sign up

flagon-io/g1t

public
0
241 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Sidebar: the panels really slide1import { createRequestHandler } from "react-router";
2
Merge branch 'worktree-agent-a8385d293d42c913a'3import { identityClient, isNamespaceShaped } from "@g1t/contracts";
4
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address5import { addressesFor } from "../app/lib/addresses";
Merge site-audit: SEO routes, analytics with consent first in Europe, security page, founder and X account, docs header; the tour opens on the pull request and leads with Code, on the real shell, with Agents and Docs working today6import { visitorAsksFirst } from "../app/lib/analytics-consent";
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address7import { hardenRegistryHeaders } from "../app/lib/content-safety";
8import { withSiteHeaders } from "../app/lib/page-headers";
Fast pages, required checks on the branch, self-hosted runners, honest incidents9import { finishResponse, withRequestPerf } from "../app/lib/perf.server";
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address10import { gitLimited, pageLimited, usercontentLimited } from "../app/lib/front-door-limits";
Composer from the workspace's own repositories, and go get from g1t.sh11import { goImport } from "../app/lib/go-get";
Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy12import { repositoryOfPage, stillPublic } from "../app/lib/public-cache";
Merge branch 'worktree-agent-a8385d293d42c913a'13import { registryWorkspace, servicePath } from "../app/lib/registry-paths";
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address14import { usercontentPath } from "../app/lib/usercontent";
Merge main into Artifacts Phase 215import { TOKEN_CHALLENGE } from "../app/lib/website-token";
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address16import { serveUsercontent } from "./usercontent";
Fast pages, required checks on the branch, self-hosted runners, honest incidents17
Merge the site's CPU: code highlighted once per data centre by content, markdown parsed once per text, and the request handler built once per isolate18const loadBuild = () => import("virtual:react-router/server-build");
19
20/**
21 * Given a function for the build, React Router derives everything from it
22 * again on every request: each route wrapped for the timings in
23 * entry.server.tsx, then the route table flattened and ranked, about a
24 * millisecond and a half of CPU a page. The build never changes while an
25 * isolate lives, so outside development it is loaded once and the handler
26 * made once. Development keeps the function, so a changed file is picked up.
27 * Only the made handler is kept, never a promise of one, so no request
28 * waits on another's (a build that fails to load is loaded again next time).
29 */
30let handler: ReturnType<typeof createRequestHandler> | undefined;
31async function requestHandler(request: Request): Promise<Response> {
32 if (import.meta.env.DEV) return createRequestHandler(loadBuild, import.meta.env.MODE)(request);
33 handler ??= createRequestHandler(await loadBuild(), import.meta.env.MODE);
34 return handler(request);
35}
Sidebar: the panels really slide36
37const DOCS = "https://docs.g1t.sh";
38
39/** Where the documentation pages that used to live under /docs are now. */
40const MOVED_DOCS: Record<string, string> = {
41 "/docs": "/quickstart/",
42 "/docs/concepts": "/concepts/overview/",
43 "/docs/authentication": "/guides/authentication/",
44 "/docs/git": "/guides/git/",
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent45 "/docs/g1t-agents": "/guides/working-with-g1t/",
Sidebar: the panels really slide46 "/docs/agents": "/guides/bring-your-own-agent/",
47 "/docs/api": "/reference/api/",
Merge branch 'worktree-agent-ab2e39e11a6493412'48 "/docs/api/reference": "/reference/api/",
Sidebar: the panels really slide49};
50
51export default {
Icons are cached at the edge52 async fetch(request, env, ctx) {
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address53 // Repository files and avatars, on their own origin
54 // (g1tusercontent.com): answered before anything of the site's runs,
55 // so nothing there reads or sets the session cookie.
56 const usercontent = usercontentPath(new URL(request.url), addressesFor(env).usercontent);
57 if (usercontent !== null) {
58 return (await usercontentLimited(env, request, usercontent)) ?? serveUsercontent(env, ctx, request, usercontent);
Composer from the workspace's own repositories, and go get from g1t.sh59 }
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address60 // Every answer: no sniffing, a referrer of the origin alone, and no
61 // framing of pages (app/lib/page-headers.ts).
62 return withSiteHeaders(await site(request, env, ctx));
Sidebar: the panels really slide63 },
64} satisfies ExportedHandler<Env>;
Workspace names and icons, and a component kit for every control65
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address66async function site(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
67 const { pathname } = new URL(request.url);
68 // Git over HTTPS shares this hostname but belongs to the repos service.
69 // Its answer goes back to the git client as it is: a repository under a
70 // renamed workspace's old name answers with a 301, which git follows and
71 // must see, so the redirect is never followed here.
72 // The container registry (`docker login g1t.sh`) and the npm registry
73 // (`g1t.sh/-/npm/`) are the packages
74 // service's, handed over the same way.
75 // `go get g1t.sh/<workspace>/<repo>`: where its code is, from the
76 // address alone, so it costs nothing and caches.
77 const go = request.method === "GET" ? goImport(new URL(request.url)) : null;
78 if (go) {
79 return new Response(go, {
80 headers: { "content-type": "text/html; charset=utf-8", "cache-control": "public, max-age=3600" },
81 });
82 }
83 const service = servicePath(pathname);
84 if (service === "git") {
85 // Per address without credentials, per credential with them
86 // (app/lib/front-door-limits.ts): anonymous clones are not free to
87 // the repository's owner.
88 return (await gitLimited(env, request)) ?? proxyGit(env, request);
89 }
90 if (service === "packages") {
91 return proxyPackages(env, request);
92 }
93 // The documentation is its own site.
94 if (pathname === "/docs" || pathname.startsWith("/docs/")) {
95 const page = pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
96 const target = MOVED_DOCS[page] ?? "/";
97 return Response.redirect(DOCS + target, 301);
98 }
99 // Pages and data requests, limited per address signed out and per
100 // session signed in (app/lib/front-door-limits.ts).
101 const limited = await pageLimited(env, request, pathname);
102 if (limited) return limited;
103 // Every page and data request says where its time went (Server-Timing)
104 // and keeps the reader's D1 bookmarks (app/lib/perf.server.ts).
105 const render = () => withRequestPerf(request, async () => finishResponse(request, await requestHandler(request)));
106 if (anonymousPage(request, pathname)) return servePublic(env, request, ctx, render);
Merge main into Artifacts Phase 2107 const answer = await render();
108 // A token the site refused (app/lib/website-token.ts) is told so as the
109 // API tells it: React Router drops the headers of what middleware throws.
110 if (answer.status === 401 && request.headers.has("authorization")) answer.headers.set("www-authenticate", TOKEN_CHALLENGE);
111 return answer;
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address112}
113
Workspace names and icons, and a component kit for every control114/**
Fast pages, required checks on the branch, self-hosted runners, honest incidents115 * Public pages as someone signed out sees them: the same for every such
116 * visitor, so kept in this data centre's cache. Reserved first segments
117 * (settings, sign-in, invitations and the like) and workspace pages (`-`)
The docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.118 * are never kept. A repository's kept page is served only while repos
119 * says the repository is still public: one made private or deleted is
120 * never served from any data centre's copy.
Fast pages, required checks on the branch, self-hosted runners, honest incidents121 */
122const PUBLIC_TOP = /^\/(?:|_root\.data|pricing|explore|security|support|policies(?:\/[a-z-]+)?)(?:\.data)?$/;
123const PUBLIC_PROJECT =
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)124 /^\/(?!(?:settings|u|auth|oauth|integrations|new|invite|workspaces|device|verify|confirm-email|login|register|logout|forgot|reset|search|status|avatars|docs)\/)[^/]+\/(?!-\/|-$)[^/]+(?:\/(?:code|commits|issues|pulls|pull\/\d+|issues\/\d+|commit\/[0-9a-f]+|tree\/.+|blob\/.+))?(?:\.data)?$/;
Fast pages, required checks on the branch, self-hosted runners, honest incidents125/** Fresh for this long; then served once more while a new copy is made. */
126const PUBLIC_FRESH_SECONDS = 30;
127const PUBLIC_STALE_SECONDS = 300;
128
129function anonymousPage(request: Request, pathname: string): boolean {
130 if (request.method !== "GET") return false;
131 if (/(?:^|;\s*)g1t_session=/.test(request.headers.get("cookie") ?? "")) return false;
Merge main into Artifacts Phase 2132 // A token signs the request in (app/lib/website-token.ts): never kept, never served a kept page.
133 if (request.headers.has("authorization")) return false;
Fast pages, required checks on the branch, self-hosted runners, honest incidents134 return PUBLIC_TOP.test(pathname) || PUBLIC_PROJECT.test(pathname);
135}
136
Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy137async function servePublic(env: Env, request: Request, ctx: ExecutionContext, render: () => Promise<Response>): Promise<Response> {
Fast pages, required checks on the branch, self-hosted runners, honest incidents138 const cache = (caches as unknown as { default: Cache }).default;
Merge site-audit: SEO routes, analytics with consent first in Europe, security page, founder and X account, docs header; the tour opens on the pull request and leads with Code, on the real shell, with Agents and Docs working today139 // Visitors asked about analytics first get a page that says so, kept apart.
140 const keyUrl = new URL(request.url);
141 if (visitorAsksFirst(request)) keyUrl.searchParams.set("_g1t_consent", "1");
142 const key = new Request(keyUrl, { method: "GET" });
Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy143 const repository = PUBLIC_PROJECT.test(new URL(request.url).pathname) ? repositoryOfPage(new URL(request.url).pathname) : null;
144 // Asked alongside the cache, so a hit waits for one indexed read at most.
145 const [cached, visible] = await Promise.all([cache.match(key), repository ? isStillPublic(env, repository) : Promise.resolve(true)]);
146 if (cached && !visible) {
147 ctx.waitUntil(cache.delete(key).then(() => undefined, () => undefined));
148 return render();
149 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents150 const keptAt = Number(cached?.headers.get("x-g1t-kept-at") ?? 0);
151 const age = Math.round((Date.now() - keptAt) / 1000);
152 const refresh = async () => {
153 const fresh = await render();
154 // Only a plain answer for everyone: nothing that sets a cookie or says
155 // it is private.
156 const cacheable =
157 (fresh.status === 200 || fresh.status === 404) &&
158 !fresh.headers.has("set-cookie") &&
159 !/private|no-store/.test(fresh.headers.get("cache-control") ?? "");
160 if (cacheable) {
161 const copy = new Response(fresh.clone().body, fresh);
162 copy.headers.set("x-g1t-kept-at", String(Date.now()));
163 copy.headers.set("cache-control", `public, max-age=${PUBLIC_STALE_SECONDS}`);
164 ctx.waitUntil(cache.put(key, copy));
165 }
166 return fresh;
167 };
168 if (cached && keptAt > 0 && age < PUBLIC_STALE_SECONDS) {
169 if (age >= PUBLIC_FRESH_SECONDS) ctx.waitUntil(refresh().then(() => undefined, () => undefined));
170 const answer = new Response(cached.body, cached);
171 answer.headers.delete("x-g1t-kept-at");
172 answer.headers.delete("cache-control");
173 answer.headers.set("server-timing", `cache;desc="hit, ${age}s old"`);
174 return answer;
175 }
176 return refresh();
177}
178
Signed-out page cache: a repository's kept page is served only while the repository is still public, so one made private or deleted never shows from any data centre's copy179/** Whether the repository is there and public; anything else, including no answer, is no. */
180async function isStillPublic(env: Env, repository: string): Promise<boolean> {
181 try {
182 const answer = await env.REPOS.fetch("https://service/rpc/visibility", {
183 method: "POST",
184 headers: { "content-type": "application/json" },
185 body: JSON.stringify({ paths: [repository] }),
186 });
187 return answer.ok && stillPublic(await answer.json(), repository);
188 } catch {
189 return false;
190 }
191}
192
Fast pages, required checks on the branch, self-hosted runners, honest incidents193/**
Mission control shows where you are needed and what agents landed without you; git answers in about 200ms194 * A git request, answered by the repos service. Its `Server-Timing` header
195 * gains `repos`: how long the answer took to start from here, so the time
196 * between this Worker and the repos service shows beside the steps the
197 * repos service reports.
198 */
199async function proxyGit(env: Env, request: Request): Promise<Response> {
200 const started = Date.now();
201 const answer = await env.REPOS.fetch(new Request(request, { redirect: "manual" }));
202 const response = new Response(answer.body, answer);
203 response.headers.append("server-timing", `repos;dur=${Date.now() - started}`);
204 return response;
205}
206
207/**
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member208 * A registry request, answered by the packages service as it is: its
209 * redirects (a large blob sent to storage) go back to the client, which
Merge branch 'worktree-agent-a8385d293d42c913a'210 * follows them itself. One that found nothing under a workspace's old name
211 * or an alias staff set (`g1t` for `flagon-io`) is sent to the same path
212 * under the workspace's name: only the not-found answer pays for the lookup.
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address213 * Every answer runs nothing in a browser (app/lib/content-safety.ts): what
214 * a registry serves is its publisher's, on this origin.
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member215 */
216async function proxyPackages(env: Env, request: Request): Promise<Response> {
217 const started = Date.now();
218 const answer = await env.PACKAGES.fetch(new Request(request, { redirect: "manual" }));
Merge branch 'worktree-agent-a8385d293d42c913a'219 const moved = answer.status === 404 ? await registryMoved(env, request) : null;
220 const response = moved ?? new Response(answer.body, answer);
Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address221 hardenRegistryHeaders(response.headers);
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member222 response.headers.append("server-timing", `packages;dur=${Date.now() - started}`);
223 return response;
224}
225
Merge branch 'worktree-agent-a8385d293d42c913a'226/** Where a registry request under an alias or old name goes now, or null. */
227async function registryMoved(env: Env, request: Request): Promise<Response | null> {
228 const url = new URL(request.url);
229 const named = registryWorkspace(url.pathname);
230 if (!named || !isNamespaceShaped(named.slug)) return null;
231 let current: string | null = null;
232 try {
233 current = await identityClient(env.IDENTITY).resolveSlug(named.slug);
234 } catch {
235 return null;
236 }
237 if (!current || current === named.slug) return null;
238 const get = request.method === "GET" || request.method === "HEAD";
239 // 308 keeps a publish a PUT, for the clients that follow it.
240 return new Response(null, { status: get ? 301 : 308, headers: { location: named.under(current) + url.search } });
Workspace names and icons, and a component kit for every control241}

This file's history is long; its oldest lines are credited to the oldest commit read.