Skip to content

feat: deploy --qr/--watch, admin UI, CI/release workflows, and storage/cache fixes - #2

Merged
pyeom merged 7 commits into
mainfrom
dev
Jul 16, 2026
Merged

feat: deploy --qr/--watch, admin UI, CI/release workflows, and storage/cache fixes#2
pyeom merged 7 commits into
mainfrom
dev

Conversation

@pyeom

@pyeom pyeom commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Summary

  • deploy --qr — prints a scannable QR code for the deployment URL (requires qrcode-terminal)
  • deploy --watch — watches a file/directory and redeploys on change with 300ms debounce; combine with --qr
  • uptool admin — opens a 100% local, token-authenticated admin web UI listing all deployments with delete and preview
  • CI (ci.yml) runs on push/PR for Node 20.x/22.x; Release (release.yml) publishes to npm on tag push
  • e2e test suite (test/e2e.test.ts) drives the real daemon as a child process through deploy/fetch/auth/touch/protect/remove
  • Storage: quota now reclaims bytes on update when versioning is off; keys are excluded from list() responses (exposed as protected: boolean)
  • Security: protected deployments get private, no-store cache-control; token file re-chmodded 0600 on read; empty token file treated as unauthenticated; timing-safe token comparison refactored
  • Fixes: encodeURIComponent(slug) in touch route; proper 413 status for oversized bodies; base64 size calculation accounts for padding; stale PID file cleanup on stop; systemd unit escaping for paths with special chars; readLogTail reads bounded chunk instead of whole file

Testing

  • Existing unit tests pass (npm test)
  • New API tests for /admin — rejects missing/bad token, serves HTML with correct token
  • New e2e tests cover deploy, fetch, auth, touch, protect, remove through the real daemon
  • --qr and --watch flags exercised manually; watch redeploy tested via file modification
  • Storage quota reclaim verified by deploying to an existing slug near the storage limit
  • private, no-store header confirmed on protected deployments via curl
  • Empty token file and stale PID file scenarios tested manually

pyeom and others added 7 commits July 16, 2026 01:33
@pyeom @claude
feat: add CI/release workflows and e2e integration tests
5a2204c 
- ci.yml: build + test on node 20.x/22.x for pushes and PRs
- release.yml: npm publish with provenance on GitHub release/tag
- test/e2e.test.ts: spawns the real built daemon as a child process and
  exercises deploy, public fetch, auth, touch, protected deploys, and
  removal end-to-end

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@pyeom
merge: CI workflows + e2e integration tests (P2 tasks 9-10)
3523872
@pyeom @claude
feat: local admin web UI (uptool admin)
3cf5322 
Adds a 100% local, token-authenticated admin page served by the internal
API at GET /admin?token=<token>. Lists deployments with slug/name/file,
relative created/expiry times, a lock indicator for protected deploys,
per-row Delete, and a preview link — auto-refreshing every 10s, inline
CSS/JS only (no CDN). Factors safeEqual() out of isAuthorized() and reuses
it for the query-param token check without bypassing the Host loopback
guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@pyeom @claude
feat: deploy --qr and --watch flags
b60533f 
--qr renders a terminal QR code for the deployed URL (per file, on
multi-deploy). --watch keeps the process alive and redeploys in place
(same slug) on source change, debounced 300ms, for a single file or
directory bundle; restricted to exactly one target and incompatible
with stdin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@pyeom
Merge branch 'worktree-agent-ab23fba714113176a' into dev
7497cd9
@pyeom
Merge branch 'worktree-agent-a877d7b21d08dcf4f' into dev
2941e86
@pyeom
Fix storage quota reclaim on update, hide key from list, secure cache
91afdd7 
- Reclaim freed bytes when replacing content without versioning
- Hide access key from list() output; expose only protected flag
- Serve protected content with private, no-store Cache-Control
- Validate key type on API update (must be string)
- URL-encode slug in touch endpoint
- Escape paths in systemd unit file generation
- Clean up stale PID file on status
- Re-enforce 0600 permissions on existing token
- Better error for empty token file
@coderabbitai

coderabbitai Bot commented Jul 16, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@pyeom, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 28 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 90d4202c-4088-4e69-9a76-be093389f547

📥 Commits

Reviewing files that changed from the base of the PR and between 53a9140 and 91afdd7.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (26)
  • .claude/worktrees/agent-a03a93fd17ee7f4bd
  • .claude/worktrees/agent-a26866f310f7301e9
  • .claude/worktrees/agent-a877d7b21d08dcf4f
  • .claude/worktrees/agent-ab23fba714113176a
  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • README.md
  • package.json
  • src/cli.ts
  • src/commands/admin.ts
  • src/commands/deploy.ts
  • src/commands/init.ts
  • src/commands/install-service.ts
  • src/commands/status.ts
  • src/commands/touch.ts
  • src/config/index.ts
  • src/lib/api-client.ts
  • src/lib/watch.ts
  • src/server/admin.ts
  • src/server/api.ts
  • src/server/public.ts
  • src/storage/index.ts
  • test/api.test.ts
  • test/e2e.test.ts
  • test/storage.test.ts
  • test/watch.test.ts
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pyeom
pyeom merged commit 490de9c into main Jul 16, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pyeom