zlh-grind/OPEN_THREADS.md

Open Threads – zlh-grind

This file tracks active but unfinished work.

Keep it short.

---

Agent (zlh-agent)

Dev Runtime System

Completed:

• catalog validation implemented
• runtime installs artifact-backed
• install guard implemented

Outstanding:

• runtime install verification improvements
• catalog hash validation
• runtime removal / upgrade handling

---

Dev Environment

Completed:

• dev user creation
• workspace root /home/dev/workspace
• console runs as dev user

Outstanding:

• PATH normalization
• shell profile consistency
• runtime PATH injection

---

Code Server Addon

Status: ✅ Installed and running inside dev containers

Confirmed:

• compiled release artifact fixed on zlh-artifacts
• install confirmed working
• process confirmed running inside container
• binds to 0.0.0.0:6000
• launched from /opt/zlh/services/code-server

Port: 6000

---

Access Model (Updated)

The previous approach using:

• Cloudflare DNS
• Technitium DNS
• Traefik dynamic config per container

has been abandoned.

Reason:

• too many moving pieces
• TLS and proxy complexity
• per-container DNS automation
• unnecessary exposure of internal dev services

---

New Access Strategy

Dev containers will support two access paths.

Path 1 — Browser IDE (Primary)

Browser
  ↓
Portal
  ↓
API proxy
  ↓
container:6000

URL format: /dev/<vmid>/ide

Implementation requirements:

• API proxy using http-proxy-middleware
• WebSocket support (ws: true)
• server.on('upgrade', proxy.upgrade)
• code-server launch args: --base-path /dev/<vmid>/ide --auth none

Authentication handled by portal JWT.

---

Path 2 — Local Dev Access (Advanced Users)

Direct developer access via Headscale/Tailscale.

Use cases:

• SSH
• VS Code Remote
• local development tools

Outstanding tasks:

• confirm zlh-ctl Headscale server status
• implement Tailscale addon install
• API auth key generation
• portal instructions

Headscale constraints:

• magic_dns: false
• no exit nodes
• no DNS takeover

---

Agent Future Work (priority order)

1. Structured logging (slog) for Loki
2. Dev container provisioningComplete state
3. Crash recovery backoff
4. Graceful shutdown verification
5. Process reattachment on agent restart

---

API (zpack-api)

Completed:

• dev provisioning payload
• runtime/version fields
• enable_code_server flag
• API status endpoint for frontend state

Outstanding:

• /dev/:id/ide proxy route
• websocket upgrade handling
• ownership validation before proxy
• Headscale auth key generation
• dev runtime catalog endpoint

---

Portal (zpack-portal)

Completed:

• dev runtime dropdown
• dotnet runtime support
• enable code-server checkbox
• dev file browser support

Outstanding:

• "Open IDE" button
• /dev/<vmid>/ide page
• Headscale setup instructions

---

Platform

Active thread:

• implement browser IDE proxy

Future work:

• Tailscale dev access
• artifact version promotion
• runtime rollback support

---

Closed Threads

• ✅ PTY console (dev + game)
• ✅ Mod lifecycle
• ✅ Upload pipeline
• ✅ Runtime artifact installs
• ✅ Dev container filesystem model
• ✅ Code-server artifact fix
• ✅ API status endpoint for frontend agent-state consumption