Blame · Line-by-line history
CLAUDE.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| fc1817a | 1 | # gluecron |
| 2 | ||
| 90fa787 | 3 | AI-native code intelligence platform — git hosting, automated CI, and push-time gate enforcement. |
| fc1817a | 4 | |
| 5472bea | 5 | ## Source of truth: Gluecron (self-canonical, no GitHub mirror) |
| 3b99c5f | 6 | |
| 5472bea | 7 | This repository self-hosts on Gluecron itself. The one canonical remote is |
| 8 | `https://gluecron.com/ccantynz/Gluecron.com.git`. **Gluecron is self-canonical: | |
| 9 | there is no GitHub mirror or fallback.** Durability comes from the offsite | |
| 10 | backup (`scripts/backup-offsite.sh` → rclone), not from GitHub. A fresh host | |
| 11 | re-seeds from a restored backup (`scripts/restore.sh`), never from GitHub. | |
| 12 | (Cutover status + operator steps: `docs/CUTOVER_RUNBOOK.md`.) | |
| 3b99c5f | 13 | |
| 14 | **For any AI session working in this repo:** | |
| 15 | ||
| 4cd9a67 | 16 | - Use the Gluecron MCP server. It is declared in `.mcp.json` at the |
| 17 | repo root (project scope — this is the file Claude Code actually | |
| 18 | loads MCP servers from, on both web/cloud sessions and the CLI; the | |
| 19 | old `mcpServers` block in `.claude/settings.json` was never read). | |
| 20 | Tools: `gluecron_create_pr`, `gluecron_merge_pr`, | |
| 3b99c5f | 21 | `gluecron_create_issue`, `gluecron_comment_pr`, etc. See |
| 22 | `src/lib/mcp-tools.ts` for the full 15-tool surface. | |
| 5472bea | 23 | - Push the feature branch straight to the canonical remote — |
| 4cd9a67 | 24 | `git push https://x:${GLUECRON_PAT}@gluecron.com/ccantynz/Gluecron.com.git HEAD:<branch>` |
| 25 | (requires `gluecron.com` in the environment's network allowlist) — | |
| 5472bea | 26 | then open the PR with `gluecron_create_pr`. There is no GitHub fallback; |
| 27 | if gluecron.com is unreachable, stop and surface it rather than pushing | |
| 28 | to GitHub. | |
| 3b99c5f | 29 | - Do NOT call any `mcp__github__*` write tool. The settings file's |
| 30 | `permissions.deny` already blocks them; if you encounter a deny | |
| 31 | error, switch to the equivalent `gluecron_*` tool. | |
| 32 | - The `.claude/skills/gluecron-pr`, `gluecron-issue`, and | |
| 33 | `gluecron-review` skills are the highest-leverage entry points for | |
| 34 | routine work. Invoke them when the user mentions a PR, an issue, | |
| 35 | or wants a second AI review pass. | |
| 36 | - Auth: the `GLUECRON_PAT` env var holds the user's personal access | |
| 37 | token. If it's missing, prompt the user to generate one at | |
| 38 | `/settings/tokens` (admin scope required for the merge tools). | |
| 39 | ||
| ab45e6a | 40 | **Deploys are self-driven now.** Push to the canonical Gluecron remote |
| 41 | and `src/hooks/post-receive.ts` fires `scripts/self-deploy.sh` directly. | |
| 42 | The live site reflects the push in ~25 seconds. Watch `/admin/deploys` | |
| 43 | for the live step stream. | |
| 44 | ||
| 8fcfd61 | 45 | **Server:** `gluecron.com` → `66.42.121.161` (Vultr VPS, not Fly.io or Hetzner — |
| ab45e6a | 46 | both are decommissioned). Working tree lives at `/opt/gluecron` on that box. |
| 47 | ||
| 8fcfd61 | 48 | **Operator access (AI sessions included):** the box is on the owner's |
| 49 | Tailscale tailnet as `jarvis` (`100.109.131.122`) with **Tailscale SSH | |
| 50 | enabled** — from an owner machine, `ssh root@100.109.131.122` just works | |
| 51 | (no key setup). Public-internet SSH (port 22) is password-only and the git | |
| 52 | SSH server port (2222) is not exposed; always go via Tailscale. | |
| 53 | ||
| 54 | **Runtime layout on the box (verified 2026-07-12):** | |
| 55 | - App runs via `docker compose -f docker-compose.standalone.yml` in | |
| 56 | `/opt/gluecron` (services: `gluecron`, `postgres`, `autoheal`). | |
| 57 | - **Database is the local `postgres` container (pgvector/pg16)** — NOT Neon. | |
| 58 | Any doc claiming Neon in production is stale. | |
| 59 | - Bare repos live in the docker volume `gluecron_git-repos` | |
| 60 | (host path `/var/lib/docker/volumes/gluecron_git-repos/_data`), mounted | |
| 61 | into the container at `/data/repos`. The host-side `/data/repos` dir is | |
| 62 | NOT the live store — always go through the volume path. | |
| 63 | - Auto-deploy: `gluecron-update.timer` (60s) runs `scripts/auto-update.sh` | |
| 64 | — fetches `origin main` in `/opt/gluecron` and rebuilds on change. | |
| 65 | `origin` = the canonical Gluecron repo. If the timer is disabled, deploys | |
| 66 | silently stop — check `systemctl list-timers 'gluecron-*'` first when the | |
| 67 | live build looks stale (compare `/api/version` builtAt vs latest commit). | |
| 68 | - Manual deploy: `cd /opt/gluecron && git fetch <src> main && git reset | |
| 69 | --hard FETCH_HEAD && docker compose -f docker-compose.standalone.yml up | |
| 70 | -d --build`, then `... exec -T gluecron bun run db:migrate`. | |
| 71 | ||
| ab45e6a | 72 | **To deploy:** |
| 73 | ```bash | |
| 74 | git push gluecron main | |
| 75 | # or first-time setup: | |
| 76 | git remote add gluecron https://x:${GLUECRON_PAT}@gluecron.com/ccantynz/Gluecron.com.git | |
| 77 | ``` | |
| 78 | ||
| 8fcfd61 | 79 | **Do NOT use Vercel** — it has been disconnected. |
| 80 | ||
| 81 | **GitHub reality check (2026-07-12):** the old GitHub repo | |
| 82 | (`ccantynz-alt/Gluecron.com`) is NOT frozen and is still writable — the | |
| 83 | cutover runbook (docs/CUTOVER_RUNBOOK.md) was designed but its operator | |
| 84 | phases were never fully executed. GitHub remains the emergency deploy | |
| 85 | source (`git fetch https://github.com/ccantynz-alt/Gluecron.com.git main` | |
| 86 | on the box) until offsite backups are armed and a restore drill has | |
| 87 | passed. Do not delete or archive the GitHub repo before that. Prefer the | |
| 88 | canonical Gluecron remote for normal work; keep GitHub in sync until the | |
| 89 | runbook's Phase 4 criteria are actually met. | |
| 3b99c5f | 90 | |
| 9ab6971 | 91 | ## READ FIRST — every session |
| 92 | ||
| 93 | **`BUILD_BIBLE.md` is mandatory reading for every Claude agent before any code changes.** | |
| 94 | ||
| 95 | It contains: | |
| 96 | - Agent policy (do-not-undo rule, continuous-build rule) | |
| 97 | - GitHub parity scorecard (what's shipped vs missing) | |
| 98 | - Numbered build plan (Blocks A–H) | |
| 99 | - Locked components that cannot be altered without owner permission | |
| 100 | - Session workflow | |
| 101 | ||
| 102 | Do not skip it. Do not refactor locked files. Do not stop mid-block. | |
| 103 | ||
| fc1817a | 104 | ## Stack |
| 105 | ||
| 106 | - **Runtime:** Bun | |
| 107 | - **Framework:** Hono (with JSX for server-rendered views) | |
| 8fcfd61 | 108 | - **Database:** Drizzle ORM + PostgreSQL (local pgvector/pg16 container in prod; Neon works for dev) |
| fc1817a | 109 | - **Git:** Smart HTTP protocol via git CLI subprocesses |
| 110 | ||
| 111 | ## Development | |
| 112 | ||
| 113 | ```bash | |
| 114 | bun install # install dependencies | |
| 115 | bun dev # start dev server (hot reload) | |
| 116 | bun test # run tests | |
| 117 | bun run db:migrate # run database migrations | |
| 118 | ``` | |
| 119 | ||
| 120 | ## Architecture | |
| 121 | ||
| 74a8784 | 122 | > Note (2026-06-10): the tree below is illustrative, not exhaustive — the |
| 123 | > platform has grown to ~190 route files in `src/routes/` and 161 tables in | |
| 124 | > `src/db/schema.ts`. `BUILD_BIBLE.md` §2 is the authoritative feature map. | |
| 125 | ||
| fc1817a | 126 | ``` |
| 127 | src/ | |
| 43de941 | 128 | index.ts Entry point (Bun server) |
| 129 | app.tsx Hono app composition + error handlers | |
| 130 | lib/ | |
| 131 | config.ts Environment config (getters, reads env at access time) | |
| 132 | auth.ts Password hashing (bcrypt), session tokens | |
| 133 | highlight.ts Syntax highlighting (highlight.js, 40+ languages) | |
| 134 | markdown.ts Markdown rendering (GFM + syntax highlighting) | |
| fc1817a | 135 | db/ |
| 43de941 | 136 | schema.ts Drizzle schema (all tables) |
| 137 | index.ts Lazy DB connection (proxy pattern) | |
| 138 | migrate.ts Migration runner | |
| fc1817a | 139 | git/ |
| 43de941 | 140 | repository.ts Git operations (tree, blob, commits, diff, branches, blame, search, raw) |
| 141 | protocol.ts Smart HTTP protocol (pkt-line, service RPC) | |
| fc1817a | 142 | hooks/ |
| 90fa787 | 143 | post-receive.ts GateTest + optional deploy webhook on push |
| 43de941 | 144 | middleware/ |
| 145 | auth.ts softAuth + requireAuth middleware | |
| fc1817a | 146 | routes/ |
| 43de941 | 147 | git.ts Git HTTP endpoints (clone/push) |
| 148 | api.ts REST API (repo CRUD, setup) | |
| 149 | auth.tsx Register, login, logout (web + API) | |
| 150 | web.tsx Web UI (file browser, commits, diffs, search, blame, raw) | |
| 151 | issues.tsx Issue tracker (CRUD, comments, close/reopen) | |
| 152 | pulls.tsx Pull requests (create, review, merge, close) | |
| 153 | editor.tsx Web file editor (create/edit via git plumbing) | |
| 154 | compare.tsx Branch comparison (diff + commit list) | |
| 155 | settings.tsx User settings (profile, SSH keys) | |
| 156 | repo-settings.tsx Repository settings (description, visibility, delete) | |
| 157 | webhooks.tsx Webhook management + delivery engine | |
| 158 | fork.ts Repository forking | |
| 159 | explore.tsx Explore/discover public repos | |
| 160 | tokens.tsx Personal access tokens | |
| 161 | contributors.tsx Contributor list + commit activity graph | |
| fc1817a | 162 | views/ |
| 43de941 | 163 | layout.tsx HTML shell + CSS (dark theme) + auth-aware nav |
| 164 | components.tsx UI components (file table, commit list, diff viewer, etc.) | |
| fc1817a | 165 | ``` |
| 166 | ||
| 43de941 | 167 | ## Database Schema |
| 168 | ||
| 169 | - `users` — accounts with bcrypt password hashing | |
| 170 | - `sessions` — cookie-based auth sessions (30 day expiry) | |
| 171 | - `repositories` — repos with fork tracking, star/fork/issue counts | |
| 172 | - `stars` — user-repo star relationships | |
| 173 | - `issues` — issue tracker with open/closed state | |
| 174 | - `issue_comments` — threaded comments on issues | |
| 175 | - `labels` + `issue_labels` — issue categorization | |
| 176 | - `pull_requests` — PRs with base/head branches, open/closed/merged state | |
| 177 | - `pr_comments` — PR comments with AI review flag + file/line annotations | |
| 178 | - `activity_feed` — event log for repos | |
| 179 | - `webhooks` — registered webhook URLs with HMAC secret + event filtering | |
| 180 | - `api_tokens` — personal access tokens with SHA-256 hashing | |
| 181 | - `repo_topics` — repository tags for discoverability | |
| 182 | - `ssh_keys` — user SSH public keys | |
| 183 | ||
| fc1817a | 184 | ## Integrations |
| 185 | ||
| 90fa787 | 186 | - **GateTest (optional):** third-party security scanner. When `GATETEST_URL` is set, `git push` POSTs to it; inbound results accepted at `POST /api/hooks/gatetest`. |
| 9ecf5a4 | 187 | - **Outbound deploy webhook (optional):** when `VAPRON_DEPLOY_URL` is set (legacy `CRONTECH_DEPLOY_URL` honored), pushes to the default branch POST to Vapron (formerly Crontech). |
| 90fa787 | 188 | - **Webhooks:** POST to user-registered URLs on push/issue/PR/star events with HMAC signatures. |
| fc1817a | 189 | |
| 190 | ## Environment Variables | |
| 191 | ||
| 192 | See `.env.example` for required variables. Key ones: | |
| 8fcfd61 | 193 | - `DATABASE_URL` — PostgreSQL connection string (prod: local postgres container) |
| fc1817a | 194 | - `GIT_REPOS_PATH` — directory for bare git repos (default: `./repos`) |
| 195 | - `PORT` — HTTP port (default: 3000) | |
| fc0785e | 196 | |
| 197 | ## Deployment | |
| 198 | ||
| ab45e6a | 199 | - **Production server:** `66.42.121.161` (`gluecron.com`) — VPS running Bun directly via systemd. |
| 200 | - **Deploy trigger:** `git push gluecron main` → `post-receive.ts` → `scripts/self-deploy.sh` → systemd reload. | |
| 201 | - **Fly.io:** decommissioned (fly.toml kept for reference, not active). | |
| 202 | - **Vercel:** disconnected — do not reconnect. | |
| 8fcfd61 | 203 | - **Database:** PostgreSQL via `DATABASE_URL` (prod: pgvector/pg16 container on the box). |
| ab45e6a | 204 | - **Logs:** `/var/log/gluecron-self-deploy.log` on the server; live stream at `/admin/deploys`. |
| 43095dc | 205 | |
| 206 | ## Skills available for this project | |
| 207 | ||
| 208 | Claude Code skill bundle for the Gluecron MCP write surface lives in | |
| 209 | `.claude/skills/`. The install script (`scripts/install.sh`) copies these | |
| 210 | into `~/.claude/skills/` so they are available across all projects: | |
| 211 | ||
| 212 | - **`gluecron-pr`** — open, list, fetch, comment on, merge, or close pull | |
| 213 | requests on a Gluecron-hosted repository. | |
| 214 | - **`gluecron-issue`** — create, list, comment on, close, or reopen issues | |
| 215 | on a Gluecron-hosted repository. | |
| 216 | - **`gluecron-review`** — act as a secondary AI code reviewer on a | |
| 217 | Gluecron PR; complements the built-in `src/lib/ai-review.ts` pass. | |
| 218 | ||
| 219 | All three skills drive the K1 MCP write tools defined in | |
| 220 | `src/lib/mcp-tools.ts` (`gluecron_create_issue`, `gluecron_create_pr`, | |
| 221 | `gluecron_merge_pr`, etc.). They auto-invoke when the active repo's | |
| 222 | origin URL contains `gluecron.com` or matches `$GLUECRON_HOST`. |