Mark browser IDE as working — full proxy solution documented

OPEN_THREADS.md

@@ -44,31 +44,16 @@ Outstanding:
 
 ### Code Server Addon
 
-Status: ✅ Installed and running
+Status: ✅ Installed, running, and proxied through API
 
 Confirmed:
 
 - pulled from artifact server (tar.gz)
 - installed to `/opt/zlh/services/code-server`
-- binds to `0.0.0.0:6000`
+- binds to `0.0.0.0:8080`
 - lifecycle endpoints: `POST /dev/codeserver/start|stop|restart`
-- detection via `/proc/*/cmdline` scan (no longer relies solely on PID file)
-
-**BLOCKING — next task:**
-
-code-server must launch with:
-
-```
---bind-addr 0.0.0.0:6000
---auth none
---disable-telemetry
---base-path /api/dev/<vmid>/ide
-/home/dev/workspace
-```
-
-Without `--base-path`, WebSocket paths and static assets mismatch through
-the proxy. Result: IDE loads partially, WS closes with 1006, workspace
-shows `!` (not mounted), extension host fails to start.
+- detection via `/proc/*/cmdline` scan
+- browser IDE fully working end-to-end via API proxy
 
 ---
 
@@ -86,41 +71,44 @@ Completed:
 
 ### Agent Future Work (priority order)
 
-1. **Fix code-server `--base-path` launch arg** — unblocks IDE (IMMEDIATE)
-2. Structured logging (slog) for Loki
-3. Dev container `provisioningComplete` state in `/status`
-4. Graceful shutdown verification (SIGTERM + wait for Minecraft)
-5. Process reattachment on agent restart
+1. Structured logging (slog) for Loki
+2. Dev container `provisioningComplete` state in `/status`
+3. Graceful shutdown verification (SIGTERM + wait for Minecraft)
+4. Process reattachment on agent restart
 
 ---
 
 ## Dev IDE Access
 
-### Browser IDE
+### Browser IDE ✅ Working
 
 ```
-Browser → Portal → API (/api/dev/:id/ide) → container:6000
+Browser → Portal → API (bootstrap) → /__ide/:id/* → container:8080
 ```
 
-API layer: ✅ complete
-Agent layer: ⚠️ blocked on `--base-path`
+Working flow:
 
-What is confirmed working:
+1. frontend calls `POST /api/dev/:id/ide-token`
+2. API returns `/api/dev/:id/ide?token=...`
+3. frontend opens that URL in new tab
+4. bootstrap route validates token, sets HTTP-only IDE cookie, redirects to `/__ide/:id/`
+5. all live code-server HTTP + WS traffic proxied through `/__ide/:id/*`
+6. API proxies to `http://<container-ip>:8080`
 
-- API auth ✅
-- Token flow ✅
-- Proxy routing ✅
-- WebSocket upgrade handler ✅
-- Upstream targeting ✅
-- code-server process running ✅
+Key fixes that made it work:
 
-What is failing:
+- token bootstrap fixed new-tab auth loss
+- `/__ide/:id` tunnel separated from bootstrap to avoid API route interference
+- upstream port corrected to `8080` (Chrome blocks `6000` as unsafe)
+- `Host` header changed to pass browser host (`req.headers.host`) not container host
+- `Origin` override removed — browser origin passed through only when present
+- WS proxy separated from shared HTTP proxy — built target-bound WS proxy at upgrade time
+- target-bound WS eliminated `ECONNREFUSED 127.0.0.1:8080` fallback bug
 
-- Workbench WebSocket session ❌
-- Filesystem provider initialization ❌
-- Extension host startup ❌
+Current state:
 
-Root cause: code-server launched without `--base-path /api/dev/<vmid>/ide`
+- browser still sees API host/IP until portal is behind a proper domain/reverse proxy
+- host-based `dev-<vmid>.zlh.dev` support started but reverted — bootstrap path is canonical
 
 ### Local Dev Access (Headscale/Tailscale — Future)
 
@@ -144,7 +132,8 @@ Completed:
 - enable_code_server flag
 - `GET /api/servers/:id/status` — server status endpoint
 - `POST /api/dev/:id/ide-token` — IDE token generation
-- `GET /api/dev/:id/ide` + `GET /api/dev/:id/ide/*` — IDE proxy with WebSocket
+- `GET /api/dev/:id/ide` — bootstrap route (validates token, sets cookie, redirects)
+- `/__ide/:id/*` — live tunnel proxy (HTTP + WS, target-bound)
 - dev routing experiment removed (`devRouting.js`, `devDePublisher.js` deleted)
 
 Outstanding:
@@ -189,9 +178,9 @@ Future work:
 - ✅ Dev container filesystem model
 - ✅ Code-server artifact fix
 - ✅ API status endpoint for frontend agent-state consumption
-- ✅ Dev IDE proxy implementation (API proxy + token system)
 - ✅ Dev DNS/Traefik routing experiment — removed
 - ✅ Game server crash recovery with backoff
 - ✅ Crash observability (classification, log tail, exit metadata)
 - ✅ Code-server lifecycle endpoints (start/stop/restart)
 - ✅ Code-server process detection via /proc scan
+- ✅ Dev IDE proxy — browser IDE fully working end-to-end