Public: anyone can read this; the crew can change it.

A child forge in a cell serves its apps: their hosts reach the cell (client forge Starck answered 404 while saying running) #7956

Merged trevatoowner opened this 12d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

**P0: a client's forge (Starck) says "App · running" while every app address answers 404. The owner has a client meeting on it.**

shipped production is serving it deploy 47e6991

trevatoowner opened this 12d ago

P0: a client's forge (Starck) says "App · running" while every app address answers 404. The owner has a client meeting on it.

Measured on production:

deal-clock--starck--forge.open-platform.sh (the address Starck advertises) returns 404 not found.
Asked directly inside the pod with that Host, the Starck cell serves all three apps with 200.

Two bugs:

server.ts looked up child apps only when the parent's own app domain called the host unknown. In production the parent's apps hang from --forge-trevato-apps… and its children from --forge.…, so the lookup never ran, and the host was read as a child named deal-clock--starck.
resolveHostedChildApp opened the child in-process. A cell child has no runtime there, so even when reached it answered "unknown". Every forge placed in a cell since #6019 has unreachable apps.

Fix: the lookup always runs after the parent's own apps have had their say, and a cell child's app host is forwarded to its cell, as its plain host already is.

Proof: test/spawn-cell-app-hosts.test.ts drives the real server with the parent's domain differing from the children's: 3 pass with the fix, 2 of the 3 fail without it. spawn-cell and spawn-child-runs-apps: 26 pass with it. tsc is clean.

Not in this pull: websockets through a cell's forward (forward is a fetch).

🤖 Generated with Claude Code

sentinelcrew Changes requested 12d ago— before the latest push

The fix is right and tested: app hosts of a cell child now reach the cell, and the child lookup no longer depends on the parent app domain. No security finding. One cleanliness change: the cell-serving block is now copied (answered, counted, logged, settleBody, close handling), so the next fix to one copy will miss the other. Extract it into one helper in server.ts that takes the cell name, and call it from both places.

trevatoowner commented 12d ago

Taken over by @trevato; stopped @sentinel.

sentinelcrew Approved 12d ago

Reviewed the diff since 1b3b1732df02. The cell app-host lookup now runs for every request, so a cell child's app hosts reach the cell. The Host header is passed through unchanged. The client address goes through notePeer, as it already did for the child's own host. Closing, body cap and security floor behave the same as before, because the cell path is the existing one moved into fromCell. A host that names no existing child still answers 404. The tests cover the lookup, the server path with the Host reaching the cell, and the 404 case, and each would fail without the change. I found no new security, test or cleanliness asks in the changed lines. I did not re-check the earlier asks one by one.