fix(deploy): 生产工作台上线——/workbench/ 路由、nginx 前缀与 OIDC 回调集合对齐 - #1662
Conversation
approved-real 联调发现并修复生产缺口：agenthub-web 镜像从未部署导致 /workbench/ 404；web 容器补 /workbench/ 前缀剥离 + SPA fallback；OIDC 回调 canonical 集合修正（首页 SPA / 工作台 / 桌面 loopback）
|
Warning Review limit reached
Next review available in: 2 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe web container now installs nginx routing for the workbench and SPA fallbacks. Production OIDC configuration now supports SPA, workbench, and desktop loopback redirect URIs through the shared callback endpoint. ChangesWeb serving
OIDC callback configuration
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
app/Dockerfile (1)
24-25: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winMake the healthcheck probe the deployed workbench route.
The existing healthcheck probes
/. With this SPA fallback,/can return200even when/workbench/prefix stripping is broken. Probe/workbench/so the container health reflects the required production route.Suggested healthcheck update
- CMD wget -qO- http://localhost:80/ || exit 1 + CMD wget -qO- http://localhost:80/workbench/ || exit 1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@app/Dockerfile` around lines 24 - 25, Update the Dockerfile HEALTHCHECK command to probe /workbench/ instead of /. Keep the existing healthcheck mechanism and validation behavior unchanged so it verifies the deployed workbench route.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deployments/production/docker-compose.yml`:
- Around line 92-93: Remove the production hostname from both OIDC variable
defaults in deployments/production/docker-compose.yml:92-93, making them
required deployment-provided values or safe placeholders. Replace the production
hostname with a non-production placeholder in
deployments/production/.env.example:25-27; both sites require direct changes so
no real production origin remains tracked.
---
Nitpick comments:
In `@app/Dockerfile`:
- Around line 24-25: Update the Dockerfile HEALTHCHECK command to probe
/workbench/ instead of /. Keep the existing healthcheck mechanism and validation
behavior unchanged so it verifies the deployed workbench route.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d866a359-4083-4ec7-b130-b9f658b43d57
📒 Files selected for processing (4)
app/Dockerfileapp/web/nginx.confdeployments/production/.env.exampledeployments/production/docker-compose.yml
| AGENTHUB_TOKENDANCE_ID_REDIRECT_URI: ${AGENTHUB_TOKENDANCE_ID_REDIRECT_URI:-https://hub.tokendancelab.com/api/auth/callback} | ||
| AGENTHUB_TOKENDANCE_ID_ALLOWED_REDIRECT_URIS: ${AGENTHUB_TOKENDANCE_ID_ALLOWED_REDIRECT_URIS:-https://hub.tokendancelab.com/api/auth/callback,https://hub.tokendancelab.com/workbench/auth/tokendance/callback,http://127.0.0.1/callback} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove the production hostname from both tracked files.
Both changes commit the production hostname. Move the actual origin to deployment-only environment configuration and use required variables or placeholders in tracked files.
deployments/production/docker-compose.yml#L92-L93: remove production URL fallbacks from both OIDC variables.deployments/production/.env.example#L25-L27: replace the production hostname with a non-production placeholder.
As per coding guidelines: **/*: 禁止提交 API key、token、cookie、私钥、证书、真实服务器或内网地址、生产账号、个人路径、生产数据库 dump、用户数据、敏感日志以及本机 Agent 记忆。
📍 Affects 2 files
deployments/production/docker-compose.yml#L92-L93(this comment)deployments/production/.env.example#L25-L27
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deployments/production/docker-compose.yml` around lines 92 - 93, Remove the
production hostname from both OIDC variable defaults in
deployments/production/docker-compose.yml:92-93, making them required
deployment-provided values or safe placeholders. Replace the production hostname
with a non-production placeholder in deployments/production/.env.example:25-27;
both sites require direct changes so no real production origin remains tracked.
Source: Coding guidelines
pipefail 下 pnpm audit 发现漏洞返回非零会把例外登记后的通过误判为失败；显式捕获管道状态以 verifier 判定为准，fail-closed 语义保持。同步修复 package.json/lockfile/脚本 CRLF。
* fix(deploy): 生产工作台上线——/workbench/ 路由、nginx 前缀与 OIDC 回调集合对齐 approved-real 联调发现并修复生产缺口：agenthub-web 镜像从未部署导致 /workbench/ 404；web 容器补 /workbench/ 前缀剥离 + SPA fallback；OIDC 回调 canonical 集合修正（首页 SPA / 工作台 / 桌面 loopback） * fix(security): pnpm audit 新公告——dompurify/nanoid overrides 修复，image-size 登记无修复例外 (#1663) 08-08 npm 公告：dompurify <=3.4.12（moderate XSS）、nanoid <3.3.17（high）、image-size <=2.0.2（high×2，无修复版）。可修复项走 pnpm.overrides；image-size 登记 vulnerability-exceptions.json 例外（门禁降级警告 + 追踪 #1663），待上游修复后移除。 * fix(ci): pnpm audit 门禁例外通过时以 verifier 退出码为准（pipefail 交互）+ LF 行尾 pipefail 下 pnpm audit 发现漏洞返回非零会把例外登记后的通过误判为失败；显式捕获管道状态以 verifier 判定为准，fail-closed 语义保持。同步修复 package.json/lockfile/脚本 CRLF。 * fix(ci): pnpm audit 步骤去掉 pipefail——例外登记后以 verifier 判定为准 * fix(ci): pnpm audit 落盘后喂 verifier——GHA bash 默认 pipefail 无法脚本内关闭 --------- Co-authored-by: Codex <codex@vectorcontrol.tech>
approved-real 生产联调（#1656）发现并修复的部署缺口：
生产侧已同步执行（hk3）：Tunnel 补 hub-edge ingress、nginx server_name 补 hub-edge + sites-enabled 符号链接化、web 容器上线。本 PR 固化仓库侧镜像与模板。
Summary by CodeRabbit
New Features
/workbench/asset paths and single-page application navigation.Configuration