claudecord 0.2.1__tar.gz

claudecord-0.2.1/.dockerignore

@@ -0,0 +1,7 @@
+# Nothing the image is not built from goes to the builder (it is sent on every build).
+**
+!Cargo.toml
+!Cargo.lock
+!src/**
+!examples/**
+!web/dist/**

claudecord-0.2.1/.env.example

@@ -0,0 +1,22 @@
+# Optional settings. Copy to .env if you like; claudecord does not read .env itself, so export these in your shell or put them in
+# the systemd unit. NONE of these are secrets: the Discord token, the OAuth secret and bucket keys are never environment
+# variables. They live in files in the hub's data folder (mode 0600), written by `claudecord discord set` and
+# `claudecord storage ...`.
+
+# How much is logged: error, warn, info (default) or debug.
+# CLAUDECORD_LOG=info
+
+# Where a machine keeps its login, daemon socket and per-agent logs (default: ~/.claudecord).
+# CLAUDECORD_HOME=
+
+# Machine placement: how many agents this machine should run at once, and labels such as gpu.
+# CLAUDECORD_MAX_AGENTS=8
+# CLAUDECORD_LABELS=gpu,fast
+
+# How agents run: tmux (default where installed) or pty (the built-in terminal, used on native Windows).
+# CLAUDECORD_TERMINAL=tmux
+# The name of the private tmux server claudecord uses, so it never touches your own tmux.
+# CLAUDECORD_TMUX_SOCKET=claudecord
+
+# npm package only: run this program instead of the platform package's (for development).
+# CLAUDECORD_BINARY=

claudecord-0.2.1/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @kanavdhanda

claudecord-0.2.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Something does not work
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: And what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      placeholder: "1. Run ...\n2. Then ...\n3. See ..."
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `npx claudecord --version`, or the commit.
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options: [macOS, Linux, Windows (WSL2), Windows (native)]
+    validations:
+      required: true
+  - type: dropdown
+    id: agent
+    attributes:
+      label: Agent
+      options: [Claude Code, agy, Codex, Not agent specific]
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: "Remove anything secret first. The daemon log is in ~/.claude-mesh/daemon.log."
+      render: shell

claudecord-0.2.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security problem
+    url: https://github.com/kanavdhanda/claudeCord/security/advisories/new
+    about: Please report security problems privately, not in a public issue.

claudecord-0.2.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Suggest an improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do
+      description: The problem first, before the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would you like to happen
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What have you tried or considered

claudecord-0.2.1/.github/dependabot.yml

@@ -0,0 +1,10 @@
+# Opens pull requests for new versions of the Rust crates and the GitHub actions. Each one runs the full CI, so an update
+# only merges when every test, the self-check and the smoke test still pass.
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule: { interval: weekly }
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: { interval: weekly }

claudecord-0.2.1/.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## What and why
+
+<!-- One or two sentences. -->
+
+## Tests
+
+<!-- Which test fails without this change? (The test bot comments if none was added.) -->
+
+## Cost impact
+
+<!-- Does this change how many agent turns or tokens a message costs? Write "none" if it does not touch delivery, briefs or
+     anything an agent reads, and say why. If it does, say what changes (more turns? a longer standing brief?) and show the
+     measurement (scripts/cost/ has the benchmarks; they spend real tokens, so run them yourself, CI does not). -->
+
+Cost impact:
+
+## Scale impact
+
+<!-- Does this change how many users, machines or agents one hub can carry? Write "none" if not, and say why. If it adds work
+     per connection, per message or per agent (memory held, database writes, timers), say how much, and run
+     scripts/load/smoke.sh (or the load.yml workflow) to show the numbers. -->
+
+Scale impact:

claudecord-0.2.1/.github/workflows/deploy.yml

@@ -0,0 +1,45 @@
+name: deploy
+
+# Updates the hub on your server and checks it is ready. The server builds the image itself from a clone of this repository (nothing is
+# published to a registry). If the new version does not become ready, the one that was running is put back. Run it by hand
+# (Actions > deploy > Run workflow) with a git ref: a release tag such as v0.2.1, a branch, or a commit.
+# Set up once: secrets DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_KEY, DEPLOY_KNOWN_HOSTS; variables HUB_URL (https://claudecord.kdhanda.com) and
+# DEPLOY_DIR (the clone of the repository on the server, such as /opt/claudeCord), with deploy/compose.yml already set up there.
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to run (v0.2.1, main, or a commit)
+        required: true
+        default: main
+
+concurrency: deploy
+
+jobs:
+  deploy:
+    if: vars.DEPLOY_DIR != ''
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Trust only the server we pinned
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id; chmod 600 ~/.ssh/id
+          echo "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
+      - name: Build on the server, restart, check, roll back on failure
+        env:
+          REF: ${{ inputs.ref }}
+          DIR: ${{ vars.DEPLOY_DIR }}
+        run: |
+          ssh_ () { ssh -i ~/.ssh/id -o StrictHostKeyChecking=yes "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "$@"; }
+          # The running image is kept as claudecord:previous, and the commit it came from in .previous, so a failed deploy can put it back.
+          ssh_ "set -e; cd '$DIR' && git rev-parse HEAD > .previous && { docker tag claudecord:local claudecord:previous 2>/dev/null || true; } \
+            && git fetch --tags origin && git checkout --detach '$REF' && cd deploy && docker compose up -d --build"
+          for i in $(seq 1 20); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "${{ vars.HUB_URL }}/readyz" || true)
+            [ "$code" = "200" ] && { echo "ready after $i checks"; exit 0; }
+            sleep 3
+          done
+          echo "the new version never became ready, putting the previous one back"
+          ssh_ "set -e; cd '$DIR' && git checkout --detach \$(cat .previous) && docker tag claudecord:previous claudecord:local && cd deploy && docker compose up -d --no-build"
+          exit 1

claudecord-0.2.1/.github/workflows/docker.yml

@@ -0,0 +1,26 @@
+name: docker
+
+# Checks that the hub's container image still builds. Nothing is published anywhere: the image is built on the server itself
+# (deploy/compose.yml), so a change to the Dockerfile or to what goes into it is caught here and not on the server.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths: [Dockerfile, .dockerignore, Cargo.toml, Cargo.lock, "src/**", "web/dist/**", "examples/**", .github/workflows/docker.yml]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

claudecord-0.2.1/.github/workflows/load.yml

@@ -0,0 +1,25 @@
+name: load
+
+# Runs the k6 load test (users with three bots each, all talking at once) against a hub limited to the size of a free
+# server. Run it by hand from the Actions tab; it is never run on a push because it takes a long time.
+on:
+  workflow_dispatch:
+    inputs:
+      users:
+        description: Simulated users (each has three bots)
+        default: "10000"
+
+jobs:
+  load:
+    strategy:
+      fail-fast: false
+      matrix:
+        profile: [oracle-arm, small-vps, oracle-micro]
+    runs-on: ubuntu-latest
+    # Long and heavy, so each size waits for your approval (Settings > Environments > load-test > Required reviewers).
+    environment: load-test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: grafana/setup-k6-action@v1
+      - run: docker build -t claudecord .
+      - run: scripts/load/profile.sh ${{ matrix.profile }} ${{ inputs.users }} 60

claudecord-0.2.1/.github/workflows/pages.yml

@@ -0,0 +1,28 @@
+name: pages
+
+# Publishes the one-page site in site/ to GitHub Pages (free). Turn it on once: Settings > Pages > Source: GitHub Actions.
+# The site is plain HTML with no scripts, no cookies and no analytics.
+on:
+  push:
+    branches: [main]
+    paths: ["site/**"]
+  workflow_dispatch:
+
+permissions:
+  pages: write
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+      - id: deployment
+        uses: actions/deploy-pages@v4

claudecord-0.2.1/.github/workflows/pr-tests.yml

@@ -0,0 +1,36 @@
+name: pr-tests
+
+# A bot that reads each pull request and comments when source changed without a test. It keeps one comment up to date
+# instead of adding a new one each push, and fails the check so it is not missed.
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  tests-came-with-the-change:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: python3 scripts/tests_gate.py --self-check
+      - id: gate
+        run: |
+          set +e
+          python3 scripts/tests_gate.py "origin/${{ github.base_ref }}" > verdict.md
+          echo "status=$?" >> "$GITHUB_OUTPUT"
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const body = '<!-- tests-gate -->\n' + require('fs').readFileSync('verdict.md', 'utf8');
+            const { owner, repo } = context.repo;
+            const issue_number = context.issue.number;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
+            const mine = comments.find((c) => c.body.startsWith('<!-- tests-gate -->'));
+            if (mine) await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body });
+            else await github.rest.issues.createComment({ owner, repo, issue_number, body });
+      - if: steps.gate.outputs.status != '0'
+        run: exit 1

claudecord-0.2.1/.github/workflows/race.yml

@@ -0,0 +1,47 @@
+name: race
+
+# Looks for timing bugs: things that pass most of the time and fail when two actions land together.
+#   stress      runs every test many times, with very few and very many threads, so order-dependent tests show themselves.
+#   sanitizer   runs the concurrency tests under ThreadSanitizer, which reports data races in the program and its dependencies.
+# The stress run happens every night; the sanitizer is slow, so it waits for your approval
+# (Settings > Environments > sanitizers > Required reviewers) and is started by hand.
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+jobs:
+  stress:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --no-run --release
+      - run: |
+          for i in 1 2 3; do
+            cargo test --release -- --test-threads=1 || exit 1
+            cargo test --release -- --test-threads=32 || exit 1
+          done
+      - run: 'for i in $(seq 50); do cargo test --release --test it races:: -q || exit 1; done'
+
+  sanitizer:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    environment: sanitizers
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rust-src
+      # Only the concurrency tests that do not depend on timing run here: under the sanitizer everything is 10 to 20 times slower, which makes
+      # timeouts in the socket tests fail for no reason that matters.
+      # ThreadSanitizer cannot see through tokio and the bundled SQLite, so it reports races inside them. The filter fails the job only if a
+      # racing access is in claudeCord's own code, or a test fails (see scripts/tsan_filter.py).
+      - run: |
+          set +e
+          cargo test -Zbuild-std --target x86_64-unknown-linux-gnu --test it -- races:: durability:: edge:: tiering:: hub:: 2>&1 | tee tsan.log
+          python3 scripts/tsan_filter.py tsan.log
+        env:
+          RUSTFLAGS: -Zsanitizer=thread
+          RUSTDOCFLAGS: -Zsanitizer=thread

claudecord-0.2.1/.github/workflows/release.yml

@@ -0,0 +1,172 @@
+name: release
+
+# Push a tag such as v0.2.0 to release. One tag builds the program for every platform and makes, from those same builds:
+#   - files on a draft GitHub release,
+#   - pip wheels (PyPI),
+#   - npm packages (one per platform, plus the main `claudecord` package).
+# Publishing to PyPI and npm only happens when it is set up: PyPI uses trusted publishing (no secret to keep), npm uses the NPM_TOKEN
+# repository secret (a granular token with read and write on all packages and "bypass two-factor" on, because no one is there to answer a passkey).
+# Ship with scripts/release.sh X.Y.Z, which bumps the version, tags it and pushes; this file does the rest. Without them the release still builds and the draft release holds every file.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # A tag that does not match Cargo.toml would publish packages with the wrong number, so stop here.
+      - run: |
+          v=$(sed -n 's/^version *= *"\(.*\)"/\1/p' Cargo.toml | head -1)
+          if [ "${GITHUB_REF_TYPE}" = "tag" ] && [ "${GITHUB_REF_NAME}" != "v$v" ]; then
+            echo "tag ${GITHUB_REF_NAME} does not match Cargo.toml version $v"; exit 1
+          fi
+
+  # Before anything is published, the packages are installed into clean folders and run on every platform.
+  verify-packaging:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: astral-sh/setup-uv@v7
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: python3 scripts/test_packaging.py
+
+  build:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl, name: linux-x64, ext: "" }
+          - { os: ubuntu-24.04-arm, target: aarch64-unknown-linux-musl, name: linux-arm64, ext: "" }
+          - { os: macos-latest, target: aarch64-apple-darwin, name: macos-arm64, ext: "" }
+          - { os: macos-15-intel, target: x86_64-apple-darwin, name: macos-x64, ext: "" }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc, name: windows-x64, ext: ".exe" }
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - run: sudo apt-get update && sudo apt-get install -y musl-tools
+        if: contains(matrix.target, 'musl')
+      - run: cargo build --release --target ${{ matrix.target }} --bin claudecord
+        env:
+          # The address a downloaded program goes to when nothing else is said (src/device/enroll.rs).
+          CLAUDECORD_HUB: https://claudecord.kdhanda.com
+      - run: cp target/${{ matrix.target }}/release/claudecord${{ matrix.ext }} claudecord-${{ matrix.name }}${{ matrix.ext }}
+        shell: bash
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bin-${{ matrix.name }}
+          path: claudecord-${{ matrix.name }}${{ matrix.ext }}
+
+  # Wheels for glibc Linux (almost every distribution) are built in maturin's manylinux container, where the C compiler the TLS library needs is
+  # present. The standalone programs further up are static musl builds, which is what npm and the release files use.
+  wheels:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu, extra: "" }
+          - { os: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu, extra: "" }
+          - { os: macos-latest, target: aarch64-apple-darwin, extra: "" }
+          - { os: macos-15-intel, target: x86_64-apple-darwin, extra: "" }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc, extra: "" }
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist ${{ matrix.extra }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheel-${{ matrix.target }}
+          path: dist
+
+  sdist:
+    needs: version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist
+
+  publish-pypi:
+    needs: [build, wheels, sdist, verify-packaging]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "{wheel-*,sdist}"
+          path: dist
+          merge-multiple: true
+      # Trusted publishing: PyPI is told once that this repository and workflow may publish, so there is no password to leak.
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        continue-on-error: true
+
+  publish-npm:
+    needs: [build, verify-packaging]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: npm
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "bin-*"
+          path: bins
+          merge-multiple: true
+      - run: python3 scripts/package_npm.py bins npm-out
+      - id: have
+        run: echo "token=${{ secrets.NPM_TOKEN != '' }}" >> "$GITHUB_OUTPUT"
+      - if: steps.have.outputs.token == 'true'
+        run: scripts/publish_npm.sh npm-out
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - if: steps.have.outputs.token != 'true'
+        run: echo "NPM_TOKEN is not set, so nothing was published to npm (the packages were built and checked)."
+
+  github-release:
+    needs: [build, wheels, sdist, publish-npm]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: files
+          merge-multiple: true
+      - uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/v')
+        with:
+          generate_release_notes: true
+          files: files/*

claudecord-0.2.1/.github/workflows/rust.yml

@@ -0,0 +1,84 @@
+name: rust
+
+# One pipeline, in order: the checks on Linux (x86 and ARM) and macOS, native Windows, and a small k6 run, all at once; then packaging
+# (the pip wheel and npm packages installed in clean folders and run) only once all of those have passed, because there is no point
+# packaging a build that fails its tests. Docs-only changes skip it, and a newer push replaces a run still going.
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths-ignore: ["**.md", "site/**", "learnings/**", "deploy/**"]
+  pull_request:
+    paths-ignore: ["**.md", "site/**", "learnings/**", "deploy/**"]
+
+concurrency:
+  group: rust-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+      - run: cargo fmt --check
+      - run: cargo clippy --all-targets -- -D warnings
+      # Every integration test is one program (tests/it), so it is compiled and linked once.
+      - run: cargo test
+      # The timing tests again, many times: a race that shows once in fifty runs is still a bug.
+      - run: 'for i in $(seq 20); do cargo test --test it races:: -q || exit 1; done'
+      - run: python3 scripts/codemap.py --check
+      # Health checks last: every feature alive, then the shipped binary used the way a person would.
+      - run: cargo run -q -- selftest
+      - run: scripts/smoke.sh
+
+  # Windows is built and tested natively. The stand-in-agent tests need a Unix shell and skip themselves there; the lints run
+  # on Linux and macOS, and the Windows-only code is compiled by the test build.
+  windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+      - run: cargo test
+      - run: cargo run -q -- selftest
+
+  # A small k6 run (200 users with three bots each, under a minute). The big runs are in load.yml and wait for approval.
+  load-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+      - uses: grafana/setup-k6-action@v1
+      - run: cargo build --release --bin claudecord
+      - run: scripts/load/smoke.sh 200 target/release/claudecord
+
+  # Only once everything above has passed. macOS and Windows packaging are checked by release.yml before anything is published.
+  packaging:
+    needs: [check, windows, load-smoke]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+      - uses: astral-sh/setup-uv@v7
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: python3 scripts/test_packaging.py

claudecord-0.2.1/.github/workflows/uptime.yml

@@ -0,0 +1,23 @@
+name: uptime
+
+# An outside check of the hub, from GitHub's network every 5 minutes, which is free. A failure here means the hub could not be
+# reached from the internet: DNS, TLS, the host or the hub itself. GitHub emails the repository owner when a scheduled run
+# fails. Set the repository variable HUB_URL (Settings > Secrets and variables > Actions > Variables) to turn it on.
+on:
+  schedule:
+    - cron: "*/5 * * * *"
+  workflow_dispatch:
+
+jobs:
+  probe:
+    if: vars.HUB_URL != ''
+    runs-on: ubuntu-latest
+    steps:
+      # Three tries, ten seconds apart, so one dropped packet is not an outage (the same debounce the prober uses).
+      - run: |
+          for i in 1 2 3; do
+            code=$(curl -s -o body.json -w '%{http_code}' --max-time 10 "${{ vars.HUB_URL }}/readyz" || true)
+            [ "$code" = "200" ] && { echo "ready"; exit 0; }
+            echo "try $i: HTTP $code"; cat body.json 2>/dev/null; sleep 10
+          done
+          exit 1

claudecord-0.2.1/.github/workflows/web.yml

@@ -0,0 +1,27 @@
+name: web
+
+# The dashboard (web/) is built with Vite and the build is committed in web/dist, because the Rust program embeds it and `cargo install`
+# must work without Node. This fails if the committed build is not what the source builds to, so the two cannot drift apart.
+on:
+  push:
+    paths: ["web/**"]
+  pull_request:
+    paths: ["web/**"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - run: npm ci
+      - run: npm run build
+      - name: The committed build matches the source
+        run: git diff --exit-code -- dist