chore(self-host): pin the image to engine 8.0.0 to match hosted - #320
Conversation
The image still pinned 7.0.0 while cast.agentrelay.com now runs 8.0.0. The runbook tells the counterparty not to treat their deployment as federation-ready until the image is pinned to the same engine version hosted runs, so shipping it at 7.0.0 would have failed that condition by our own instruction — and version skew between the two ends of a federation demo is the class of run-stopper the dry run exists to catch. The lockfile is regenerated rather than hand-edited. A sed of the version string left a stale integrity hash for @relaycast/types and the build failed EINTEGRITY (wanted sha512-fFfBNRo…, got sha512-GMBA8do…), which is the correct outcome: `npm ci` refused a lockfile that did not match what the registry served. Verified on the built image, not just the source: the engine inside reports 8.0.0, a valid https authority starts and stays up, and http://, .local and IP literal authorities are each refused at the door with exit 64. Container entrypoint tests 14/14. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Warning Review limit reached
Next review available in: 52 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe change upgrades the Relaycast engine references from 7.0.0 to 8.0.0 and updates local service addresses across Docker Compose, the runbook, Cloudflare Tunnel configuration, and the nginx self-hosting example. ChangesRelaycast self-hosting updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker-compose.yml`:
- Line 18: Replace the incorrect 128.0.0.1 loopback address with 127.0.0.1 at
docker-compose.yml lines 18 and 28, RUNBOOK.md lines 34, 59, 73, and 138, and
docs/self-hosting.md line 171; update the port binding, health checks, workspace
bootstrap, Cloudflare Tunnel target, and nginx upstream consistently.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cab91547-60e9-4b2f-af31-080efc8a5742
⛔ Files ignored due to path filters (1)
docker/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
DockerfileRUNBOOK.mddocker-compose.ymldocker/package.jsondocs/self-hosting.md
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9a443afcf0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - ALL | ||
| ports: | ||
| - 127.0.0.1:${RELAYCAST_PORT:-8787}:8787 | ||
| - 128.0.0.1:${RELAYCAST_PORT:-8787}:8787 |
There was a problem hiding this comment.
On normal hosts where 128.0.0.1 is not assigned, Docker cannot create this published-port bind, so the documented docker compose up flow fails before the service starts; 128.0.0.1 is not part of the loopback range. The same replacement also makes the in-container healthcheck target a remote address rather than the local engine, and the runbook/tunnel/nginx examples repeat it. Restore 127.0.0.1 in all of these changed references.
Useful? React with 👍 / 👎.
| Engine 8.0.0 has a known agent-card discovery defect: the bare standard path | ||
| `GET /.well-known/agent-card.json` interprets the leftmost hostname label as the | ||
| workspace name. At `relay.ratifyprotocol.com` it therefore looks for `relay`, | ||
| not the meaningful workspace name `ratify-protocol`. Host inference also |
There was a problem hiding this comment.
Engine 8.0.0 includes the resolver fix this paragraph says is still unreleased: its tests cover this exact Ratify URL and expect the sole ratify-protocol workspace to be returned from the bare well-known path, while explicit path selectors now precede host inference. Leaving this warning tells operators not to enable the federation scenario that this version bump was intended to unblock. Update the runbook to describe the now-working bare and path-based discovery behavior.
AGENTS.md reference: AGENTS.md:L10-L11
Useful? React with 👍 / 👎.
| # syntax=docker/dockerfile:1.7 | ||
|
|
||
| ARG RELAYCAST_ENGINE_VERSION=7.0.0 | ||
| ARG RELAYCAST_ENGINE_VERSION=8.0.0 |
There was a problem hiding this comment.
This changes every newly built self-host image from engine 7.0.0 to 8.0.0, but the root changelog remains at an empty [Unreleased]. Because this is the first pending user-visible change after the 8.0.0 release, add a concise entry and set the appropriate release-level heading so the upgrade is not omitted from the next release notes.
AGENTS.md reference: AGENTS.md:L38-L40
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in 9a4fd683, which landed after this thread was written (it is pinned to 9a443afc).
CHANGELOG.md at the current head now carries, under ## [Unreleased - Patch] → ### Changed:
The self-host container now installs
@relaycast/engine8.0.0, matching the hosted deployment, and its runbook documents agent-card discovery as working on the standard well-known path rather than as a known defect.
That is the release-level heading and concise entry AGENTS.md:L38-L40 asks for, so the upgrade will not be omitted from the next release notes.
Worth noting the same commit fixed something more serious that this review round surfaced: the version bump had been done with sed s/7.0.0/8.0.0/g, and 127.0.0.1 contains 7.0.0 as a substring — so the Compose port binding, the in-container healthcheck, the nginx and tunnel examples and four runbook commands had all been rewritten to 128.0.0.1, which is not loopback. Caught independently here and by CodeRabbit. Verified fixed at head.
Three review findings, all correct, and the first is mine. CRITICAL — 127.0.0.1 became 128.0.0.1. The version bump was done with `sed s/7.0.0/8.0.0/g`, and the loopback address contains "7.0.0" as a substring. That rewrote the Compose port binding, the in-container healthcheck, the tunnel and nginx examples, and four runbook commands to an address that is not loopback and is not assigned on a normal host, so `docker compose up` would have failed before the service started and the healthcheck would have probed a remote address. Caught by CodeRabbit and Codex independently. The lesson is the obvious one: a global sed on a version string is not a safe edit, and I should have read the diff instead of trusting it. The runbook said the opposite of the truth. The same sed turned "Engine 7.0.0 has a known agent-card discovery defect" into "Engine 8.0.0 has a known defect". 8.0.0 is the release that FIXES it, so the paragraph told operators not to enable the federation scenario this bump exists to unblock. Rewritten to describe what now works — the bare standard path on a single-tenant deployment, both explicit forms, and the two deliberate fail-closed behaviours (multi-tenant without a selector, and a selector naming a workspace that does not exist) — with the old behaviour kept only as a diagnostic hint. Changelog entry added per AGENTS.md, since this is the first user-visible change after the 8.0.0 release. Verified rather than assumed: the full changed-line diff is now version bumps only, the image builds, the engine inside reports 8.0.0, container entrypoint tests are 14/14, and `docker compose up` brings the stack up with /health answering through 127.0.0.1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
All four addressed in CodeRabbit + Codex — The lesson is the unglamorous one: a global sed on a version string is not a safe edit, and I should have read the changed-line diff instead of trusting it. I have now, and the diff is version bumps only. Codex — the obsolete federation blocker. Correct, and worse than obsolete: the same sed turned "Engine 7.0.0 has a known agent-card discovery defect" into "Engine 8.0.0 has a known defect". 8.0.0 is the release that fixes it, so the runbook was telling operators not to enable the exact scenario this bump exists to unblock. Rewritten to describe what now works — the bare standard path on a single-tenant deployment, both explicit forms, and the two deliberate fail-closed behaviours (a multi-tenant deployment without a selector, and a selector naming a workspace that does not exist, both returning Codex — changelog. Added under Verified, not assumed |
1 participant
The self-host image still pinned
7.0.0whilecast.agentrelay.comnow runs8.0.0after #55.RUNBOOK.mdtells Ratify not to treat their deployment as federation-ready until the image is pinned to the same engine version hosted runs. Shipping it at 7.0.0 would have failed that condition by our own instruction, and version skew between the two ends of a federation demo is exactly the run-stopper the dry run exists to catch.The lockfile is regenerated, not edited
A
sedof the version string left a stale integrity hash for@relaycast/typesand the build failed:That is the correct outcome —
npm cirefused a lockfile that did not match what the registry served. Regenerated from a verified cache; the hash now matches what npm actually downloads.Verified on the built image, not the source
Container entrypoint tests 14/14.
🤖 Generated with Claude Code