Remove accidentally staged worktree and plan file

This commit is contained in:
Operator & Claude Code 2026-05-14 12:58:04 +02:00
parent 538e9e6f1b
commit 8637c52e39
2 changed files with 0 additions and 94 deletions

@ -1 +0,0 @@
Subproject commit 50513681b4c4c494845df2a5f0189338989affc5

View file

@ -1,93 +0,0 @@
# 3 Fixes for Multitenant Branch
## Status: READY TO EXECUTE
Re-validated against `origin/multitenant` at `9ed3ce6` (4 new commits since last analysis).
All 3 fixes confirmed still present and valid. No conflicts with new commits (dns.ts, sites schema, jail-name defaults, apply-plan collapse — all touch different files).
Execute after plan mode ends. Push to `origin/multitenant` only.
---
## Fix 1: Remove duplicate trusted origin in src/auth.ts
**File:** `src/auth.ts:17-22`
`PLATFORM_INTERNAL_DOMAIN` resolves to `ai.home.arpa` (via `platformServiceDomain('ai', 'home.arpa')`). `ai.${PLATFORM_INTERNAL_BASE}` also resolves to `ai.home.arpa`. The `Set` deduplication hides the duplicate, but if `PLATFORM_INTERNAL_DOMAIN` ever changes its label (e.g. to `cp.home.arpa`), the hardcoded `ai.` on line 21 would silently diverge.
**Changes:**
1. Remove `PLATFORM_INTERNAL_BASE` from imports (line 9)
2. Remove the `http://ai.${PLATFORM_INTERNAL_BASE}:${CONTROLPLANE_API_PORT}` line (line 21)
3. `PLATFORM_INTERNAL_DOMAIN` is the canonical source — no other change needed
No test changes needed — `auth.test.ts` mocks `PLATFORM_INTERNAL_DOMAIN` and doesn't assert on the array contents.
---
## Fix 2: Inconsistent domain derivation in src/local-hosts.ts
**File:** `src/local-hosts.ts:31-34`
4 constants use tenant-scoped `AGENT_INTERNAL_DOMAIN` for what are platform infrastructure hosts. The other 7 constants in the same file correctly use platform-scoped exports (`CONTROLPLANE_INTERNAL_DOMAIN`, `DB_INTERNAL_DOMAIN`, `CODE_SERVICE_INTERNAL_DOMAIN`, `CMS_INTERNAL_DOMAIN`, `OLLAMA_INTERNAL_DOMAIN`, `LLAMA_CPP_INTERNAL_DOMAIN`, `PLATFORM_INTERNAL_BASE`). Worker/browser/GUI/docs are platform services, not tenant content.
**Changes:**
```typescript
// BEFORE
export const WORKER_LOCAL_HOST = `worker.${AGENT_INTERNAL_DOMAIN}`;
export const BROWSER_LOCAL_HOST = `browser.${AGENT_INTERNAL_DOMAIN}`;
export const GUI_LOCAL_HOST = `gui.${AGENT_INTERNAL_DOMAIN}`;
export const DOCS_LOCAL_HOST = `docs.${AGENT_INTERNAL_DOMAIN}`;
// AFTER
export const WORKER_LOCAL_HOST = `worker.${PLATFORM_INTERNAL_BASE}`;
export const BROWSER_LOCAL_HOST = `browser.${PLATFORM_INTERNAL_BASE}`;
export const GUI_LOCAL_HOST = `gui.${PLATFORM_INTERNAL_BASE}`;
export const DOCS_LOCAL_HOST = `docs.${PLATFORM_INTERNAL_BASE}`;
```
Keep `AGENT_LOCAL_SITE_HOST = AGENT_INTERNAL_DOMAIN` (line 35) and `www.${AGENT_INTERNAL_DOMAIN}` (line 69) — these are legitimately tenant-scoped. `AGENT_INTERNAL_DOMAIN` stays in imports.
---
## Fix 3: Remove dead AGENT_PID_FILE alias from src/config.ts
**File:** `src/config.ts:378`
`AGENT_PID_FILE` is exported as an alias for `PLATFORM_PID_FILE` but has **zero imports** anywhere in the codebase. Confirmed with grep. Dead exports create confusion about which name is canonical.
**Change:** Remove `export const AGENT_PID_FILE = PLATFORM_PID_FILE;` (line 378)
---
## Commit message
```
fix(multitenant): remove dead alias, duplicate origin, and tenant-scoped platform hosts (Sam & zAI)
Remove duplicate trusted origin in auth.ts where PLATFORM_INTERNAL_DOMAIN
and ai.${PLATFORM_INTERNAL_BASE} resolve to the same string.
Switch worker/browser/GUI/docs local hostnames from tenant-scoped
AGENT_INTERNAL_DOMAIN to PLATFORM_INTERNAL_BASE — these are platform
infrastructure, not tenant content.
Remove AGENT_PID_FILE dead alias — zero consumers, PLATFORM_PID_FILE
is canonical.
---
Build: pass | Tests: pass — N passed (M files)
```
## Verification
1. `npm run build` — must pass
2. `npx vitest run src/auth.test.ts setup/hosts.test.ts` — must pass
3. `npx vitest run` — full suite (2 pre-existing vision test failures expected)
4. `git push origin multitenant` after commit
## Note for the other agent
The new `setup/dns.ts` emits `no-resolv` and `no-hosts` without any `server=` upstream directive. If deployed as the system resolver, the host would lose all external DNS. This is likely intentional (supplementary config for the `home.arpa` zone only), but worth flagging — the config as-written cannot be used as `/etc/local/dnsmasq.conf` on its own without an upstream forwarder.