Repository navigation
bb connect: multi-host execution, cloud tunnel, getbb.app site + prod staging - #510
Merged
Merged
Conversation
Relax the single-primary-host funnel: supplied hostIds are now validated by assertUsableHostId (any non-destroyed public host) instead of being pinned to the primary host. Default resolution is unchanged, so single-host setups behave exactly as before. Adds --host <id> to bb thread spawn, with guide + bb-cli skill updates. Verified live with two daemons on one server; full server suite green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New surfaces for reaching a bb server from anywhere at <handle>.getbb.app, all verified end-to-end on the vibecodethis.site staging zone: - packages/tunnel-contract: binary frame codec shared by DO + client - packages/connect-db: drizzle schema for D1 (better-auth tables, profiles, servers, connect codes, machine credentials) + migrations - apps/connect: gate worker (handle -> session/machine-credential auth -> TunnelDO with hibernation + edge caching) + tunnel client scripts - apps/web: getbb.app dashboard (TanStack Start on Workers, better-auth + GitHub OAuth, handle claim, connect codes, add-a-machine) apps/server is untouched by the tunnel path; plans/bb-connect-v1.md carries full status and the remaining productization work. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
List hosts with connection status and last-seen time, so host ids for bb thread spawn --host are discoverable from the CLI instead of only via GET /api/v1/hosts. Documented in the environments guide chapter and the bb-cli skill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CONNECT_ALLOWED_GITHUB_USERS (comma-separated GitHub usernames, case-insensitive, fail-closed when unset) gates better-auth: the GitHub login is stored on user.github_login (refreshed each sign-in via overrideUserInfoOnSignIn) and checked in the user-create hook (signup) and session-create hook (every sign-in), so delisting locks out at next login. Migration 0002 applied to staging D1; bb-web-staging deployed with the var set to "sawyerhood". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New multiMachine experiment (Settings → Experiments, off by default; migration 0053). assertUsableHostId now rejects non-primary hosts with 403 multi_machine_disabled while the experiment is off; the primary host is always usable so single-host setups are unaffected. bb connect in-product surfaces will check the same experiment as they land. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
apps/landing is gone; apps/web now serves the marketing page at / and the bb connect dashboard at /dashboard, with the landing worker's /download/macos redirect and /api/subscribe endpoints ported to TanStack server routes (framework-free logic + tests in src/landing/endpoints.ts). Marketing CSS and the dashboard's Tailwind theme both define :root tokens, so each loads via its own route-level stylesheet link and cross-navigation stays full-page. turbo build override, repository overview, and Resend/PostHog env plumbing updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gate worker bb-connect now has a prod config (BASE_DOMAIN=getbb.app, D1 bb-connect-prod, *.getbb.app/* wildcard route) and 301s reserved subdomains (www, api, ...) to the apex. apps/web gains env.production (bb-web worker, prod vars, workers_dev preview) selected at build time via CLOUDFLARE_ENV; routes must stay [] there since the staging custom domain otherwise inherits into prod deploys. CI workflow renamed deploy-landing -> deploy-web, building @bb/web for production; CLOUDFLARE_ENV added to the turbo build cache key. Deployed live: prod D1 migrated, both prod workers up with secrets, wildcard route serving the gate. Apex cutover (custom-domain flip off bb-landing) intentionally not done pending approval. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reachable over the tailnet; vite allowedHosts admits .ts.net MagicDNS names. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Element-wise toEqual over ~2 MiB of numbers exceeded the 5s test timeout on CI runners. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Server-side multi-machine gate was incomplete: the host file API, host utility RPC routes (directory/paths/pick/provider-cli), and host_path terminal creation reached non-primary hosts without the experiment check. Route all three through assertUsableHostId (primary always passes, so single-host installs are unaffected); regression test added for the file route. Connect worker hardening: - /__tunnel now re-resolves the handle fresh (bypassing the ~15s isolate cache) so a just-revoked credential can't re-establish a tunnel. - Session-cookie cache keyed on the full token.sig, not the token alone, so a forged signature can't hit a cached-good entry or poison a good one before the HMAC check. - Machine-limit re-checked at redeem, closing the mint-N-codes TOCTOU. Also delete the dead resolveStable*FromProjectData path (zero callers) that dropped the primary-host restriction without the multi-machine gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The host_path terminal gate needs config.dataDir; the integration-tests harness constructor call was the third site and broke its typecheck. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The gate had no deploy workflow, so its worker was only ever updated by hand (leaving prod behind the branch). Add deploy-connect.yml: on pushes touching apps/connect, packages/connect-db, or packages/tunnel-contract, plain `wrangler deploy` ships the production bb-connect worker. No build step (wrangler bundles the worker's workspace deps from source); BETTER_AUTH_SECRET stays hand-set and is not CI-synced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
SawyerHood
added a commit
that referenced
this pull request
Jul 8, 2026
## Summary PR #510 shipped two separable things: multi-host thread execution and bb connect. Multi-host isn't ready for prime time yet — this removes it from main while keeping every bb connect feature, and renames the gating experiment from "Multi-machine" to **"bb connect"** so it gates only the connect surfaces. ### Multi-host execution removed (host targeting back to pre-#510, primary-only) - Restored `assertPrimaryHostId` (non-primary → 400 `unsupported_host`); deleted `assertUsableHostId`, the `multi_machine_disabled` error, and its experiment dependency. Reverted all call sites: `routes/files.ts`, `routes/hosts.ts`, `routes/projects.ts`, `services/system/host-lookup.ts`, `services/threads/thread-request-eligibility.ts` (restores the `StableThreadRequestProjectData` machinery), `services/terminals/terminal-session-lifecycle.ts` (gate + `config` dep, incl. the integration-harness change). - Deleted `bb host list` and `bb thread spawn --host` (commands, registration, tests, guide/skill/docs mentions). - Removed the multi-host section from docs and guide templates; deleted `docs/m4-multimachine-evolution-overview.html`. ### Experiment renamed: `multiMachine` → `bbConnect` ("bb connect") - Domain schema, db data access, column rename via generated migration `0057_useful_manta.sql` (`RENAME COLUMN multi_machine → bb_connect` — existing opt-ins carry over). - All consumers: `server.ts` `isConnectEnabled`, plugin-service gate + user-facing strings, `routes/system.ts` reconcile, CLI plugin-proxy fallback (string contract kept in sync), Settings UI, builtin skills, guide templates (regenerated), `docs/configuration.md`. ### Untouched `plugins/connect`, `apps/connect`, `apps/web`, `packages/tunnel-contract`, `packages/connect-db`, deploy workflows — verified byte-for-byte identical. The live plugin load/unload on experiment toggle from #533 keeps working under the new name. ## Validation - Typecheck: server, cli, db, app, domain, templates, desktop — all pass - Tests: server (983), app (1282), cli (231), db (320), domain, templates, bb-plugin-connect, integration (54) — all pass - Independently reviewed (adversarial pass): diffed result against pre-#510 file states (only legitimate upstream drift remains), verified generated templates reproduce, migration/journal chain drizzle-generated, grep sweep clean outside `plans/` and historical migration artifacts - Desktop unit tests couldn't run in the worktree (broken local Electron install, unrelated); desktop typecheck passes — CI covers it here 🤖 Generated with [Claude Code](https://claude.com/claude-code)
SawyerHood
added a commit
that referenced
this pull request
Jul 12, 2026
## Summary bb becomes honestly multi-machine: the server orchestrates daemons on any number of computers, gated behind a new **Multi-machine** experiment (independent of bb connect). Product plan + mockups + status: `plans/multi-machine-v1.html`. - **Pick where work happens**: the composer's environment picker groups options by machine (status dots, "this machine" badge, offline w/ last-seen); projectless threads get a machine chip too. Sticky last-used per project. - **Machine-independent projects**: a project anchors to its git remote; each machine holds a source (checkout). Guided setup clones onto a new machine in one dialog (or points at an existing folder); non-git projects link manually. - **Machines management**: Settings → Machines (rename, remove w/ revocation, live status) + Add-a-machine dialog minting a 15-min join code with a copyable one-liner. - **One-command install**: `curl -fsSL <server>/install.sh | sh -s -- --join-code … --host-id … --server …` — installs bb-app, joins, registers launchd/systemd service. Works over LAN or through bb connect (daemon `x-bb-connect-machine` credential wiring, gate `/api/v1` machine access, defense-in-depth preserved). - **Server-distributed updates**: the server serves its own bb-app tarball (`/install/bb-app.tgz`); installs prefer it over npm (unpublished versions work by construction) and daemons self-update on protocol mismatch (newer-server-only, rate-limited, downgrade-refusing) with a "Needs update" state in the UI. - **Remote-correct execution**: injected skills sync via content-addressed pull (byte-identical staging verified); workspace `AGENTS.md` + project skills read via daemon RPC — fixes the silent instruction/skill loss that sank the earlier multi-host attempt (#510/#536). - **CLI**: `bb machine list`, `--machine` on `thread spawn` / `project source add` (+ clone variant), guide/skill/docs updated. Also fixes two pre-existing bugs found along the way: enroll keys lived ~10.4 days instead of 15 minutes (better-auth `defaultExpiresIn` is seconds), and join-code minting left phantom "pending" host rows. ## Verification Every step was live-verified on a two-daemon rig (second daemon with fresh identity/data dir) including browser QA of the picker, guided setup (success + `target_not_empty` error paths), Machines pane, add-machine dialog, and a projectless thread on the second machine. Capstone: one CLI command provisioned a managed worktree on the second machine and the agent answered from planted workspace instructions. Full repo typecheck green; all package suites green. The bb connect machine path is covered by a full workerd auth-matrix (cross-tenant 403s, header stripping, revocation) — a real staging tunnel run remains (needs staging gate/web deploys). Migrations are consolidated into a single generated `0064` (dev data dirs that applied interim migrations need a reset). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Samuka007
added a commit
to Samuka007/bb
that referenced
this pull request
Oct 7, 2026
…ilities branch — new gitlink tip
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The bb connect v1 branch: reach your bb server from any browser at
<handle>.getbb.appthrough an authenticated Cloudflare tunnel, plus multi-host thread execution. Full architecture + status:plans/bb-connect-v1.md.bb product changes
assertUsableHostIdaccepts any connected public host;bb thread spawn --host <id>; newbb host listcommand. Default resolution unchanged (single-host setups unaffected).multi_machine_disablederror. bb connect product surfaces will check the same experiment as they land.apps/server— a scoped exception to the plan's "server untouched" invariant, for the multi-machine goal (tunnel path itself needs zero server changes).Cloud (new apps/packages, staging-verified end to end)
packages/tunnel-contract— binary frame codec (DO ↔ tunnel client)packages/connect-db— D1 schema (better-auth tables, profiles, servers, connect codes, machine credentials) + migrationsapps/connect— gate worker: handle → session/machine-credential auth → TunnelDO (hibernation, edge caching); reserved subdomains 301 to apexapps/web— getbb.app site: marketing page folded in fromapps/landing(deleted;/download/macos+/api/subscribeported to server routes with tests) + bb connect dashboard at/dashboard; GitHub OAuth via better-authCONNECT_ALLOWED_GITHUB_USERS(fail-closed) checked at signup and every sign-inDeploy/CI
deploy-landing.yml→deploy-web.yml(builds@bb/webwithCLOUDFLARE_ENV=production, deploys thebb-webworker)*.getbb.appwildcard route serving the gate). The apex custom-domain flip offbb-landinghappens manually at cutover — merging this PR does not move the domains.Validation
sawyer.vibecodethis.site); prod preview atbb-web.sawyer-7bb.workers.dev; marketing page visually verified against the live site🤖 Generated with Claude Code