Bugs fixes

.github/workflows/release.yml

@@ -54,11 +54,13 @@ jobs:
         with:
           context: apps/api
           push: true
+          build-args: |
+            BUILD_TIME=${{ github.sha }}
           tags: |
             ${{ env.API_IMAGE }}:${{ steps.version.outputs.VERSION }}
             ${{ steps.version.outputs.IS_PRERELEASE == 'false' && format('{0}:latest', env.API_IMAGE) || format('{0}:next', env.API_IMAGE) }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=api-${{ github.sha }}
+          cache-to: type=gha,scope=api-${{ github.sha }},mode=max
 
       - name: Build and push Web image
         uses: docker/build-push-action@v6
@@ -67,22 +69,25 @@ jobs:
           push: true
           build-args: |
             DEQUEL_VERSION=${{ steps.version.outputs.VERSION }}
+            BUILD_TIME=${{ github.sha }}
           tags: |
             ${{ env.WEB_IMAGE }}:${{ steps.version.outputs.VERSION }}
             ${{ steps.version.outputs.IS_PRERELEASE == 'false' && format('{0}:latest', env.WEB_IMAGE) || format('{0}:next', env.WEB_IMAGE) }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=web-${{ github.sha }}
+          cache-to: type=gha,scope=web-${{ github.sha }},mode=max
 
       - name: Build and push Agent image
         uses: docker/build-push-action@v6
         with:
           context: apps/agent
           push: true
+          build-args: |
+            BUILD_TIME=${{ github.sha }}
           tags: |
             ${{ env.AGENT_IMAGE }}:${{ steps.version.outputs.VERSION }}
             ${{ steps.version.outputs.IS_PRERELEASE == 'false' && format('{0}:latest', env.AGENT_IMAGE) || format('{0}:next', env.AGENT_IMAGE) }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=agent-${{ github.sha }}
+          cache-to: type=gha,scope=agent-${{ github.sha }},mode=max
 
       - name: Build config tarball
         run: |

.gitignore

@@ -20,3 +20,5 @@ apps/docs/.blume/
 FEATURES.md
 docs/plans/
 .agents/skills/verify-dequel/
+.worktrees/
+artifacts

VERSION

@@ -1 +1 @@
-0.3.0-rc.8
+0.3.0

apps/agent/Dockerfile

@@ -1,5 +1,7 @@
 FROM oven/bun:1
 
+ARG BUILD_TIME=0
+
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git caddy gnupg iproute2 wireguard-tools \
   && install -m 0755 -d /etc/apt/keyrings \
   && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \

apps/agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dequel-agent",
-  "version": "0.3.0-rc.8",
+  "version": "0.3.0",
   "private": true,
   "type": "module",
   "scripts": {

apps/agent/src/config.ts

@@ -24,4 +24,4 @@ export const config = {
 export const requireControlPlaneUrl = () => {
   if (!config.controlPlaneUrl) throw new Error("DEQUEL_CONTROL_PLANE is required");
   return config.controlPlaneUrl;
-};
+};

apps/agent/src/executor.ts

@@ -417,4 +417,4 @@ const applyRoute = async (payload: RemoteRoutePayload, signal: AbortSignal): Pro
   return { routeFile: payload.routeFile, status: payload.action === "add" ? "active" : "removed" };
 };
 
-export const validateRoutePayload = validateRoutePayloadImpl;
+export const validateRoutePayload = validateRoutePayloadImpl;

apps/agent/src/protocol.ts

@@ -55,4 +55,4 @@ export const parseP2PResponse = (raw: unknown): P2PResponse | null => {
   } catch {
     return null;
   }
-};
+};

apps/agent/src/stats.ts

@@ -55,4 +55,4 @@ const parseMemToMb = (mem: string): number => {
     case "KiB": case "KB": return val / 1024;
     default: return val;
   }
-};
+};

apps/api/Dockerfile

@@ -1,5 +1,7 @@
 FROM oven/bun:1
 
+ARG BUILD_TIME=0
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
@@ -11,6 +13,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 RUN curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz | tar -xz -C /usr/local/bin --strip-components=1 && \
+    mkdir -p /usr/local/lib/docker/cli-plugins && \
+    curl -fsSL "https://github.com/docker/compose/releases/download/v2.32.4/docker-compose-linux-x86_64" -o /usr/local/lib/docker/cli-plugins/docker-compose && \
+    chmod +x /usr/local/lib/docker/cli-plugins/docker-compose && \
     curl -sSL https://railpack.com/install.sh | sh -s -- --bin-dir /usr/local/bin
 
 

apps/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dequel-api",
-  "version": "0.3.0-rc.8",
+  "version": "0.3.0",
   "private": true,
   "type": "module",
   "scripts": {
@@ -19,8 +19,10 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
+    "@esbuild/linux-x64": "^0.28.2",
     "@types/nodemailer": "^8.0.0",
     "@types/pg": "^8.23.1",
-    "drizzle-kit": "^0.31.10"
+    "drizzle-kit": "^0.31.10",
+    "esbuild": "^0.28.2"
   }
 }

apps/api/src/agents/job-channel.ts

@@ -119,4 +119,4 @@ export const processAgentJobUpdate = async (serverId: string, update: Exclude<P2
 export const nextJobBatch = async (serverId: string) => {
   const job = await leaseNextAgentJob(serverId);
   return { jobs: job ? [job] : [], cancelJobIds: await listCancelledJobIds(serverId) };
-};
+};

apps/api/src/agents/stats-cache.ts

@@ -48,4 +48,4 @@ class AgentStatsCache {
   }
 }
 
-export const agentStatsCache = new AgentStatsCache();
+export const agentStatsCache = new AgentStatsCache();

apps/api/src/api/github/index.ts

@@ -1,33 +1,9 @@
 import { Elysia } from "elysia";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { getGithubIntegration, setGithubIntegration, createDeployment, listProjects } from "../../db/repo";
+import { getGithubIntegration, setGithubIntegration, createDeployment, listProjects, getGithubSession, createGithubSession, deleteGithubSession } from "../../db/repo";
 import { orchestrator } from "../../orchestrator";
 import { config } from "../../utils/config";
 import { ok, fail } from "../response";
 
-const SESSIONS_FILE = join(process.env.DATA_DIR ?? "./data", ".github-sessions.json");
-
-let SESSIONS = new Map<string, { token: string }>();
-
-const loadSessions = () => {
-	try {
-		const raw = readFileSync(SESSIONS_FILE, "utf-8");
-		const entries: [string, { token: string }][] = JSON.parse(raw);
-		SESSIONS = new Map(entries);
-	} catch {}
-};
-
-const saveSessions = () => {
-	try {
-		const dir = SESSIONS_FILE.substring(0, SESSIONS_FILE.lastIndexOf("/"));
-		mkdirSync(dir, { recursive: true });
-		writeFileSync(SESSIONS_FILE, JSON.stringify([...SESSIONS]), "utf-8");
-	} catch {}
-};
-
-loadSessions();
-
 const validateToken = async (token: string): Promise<boolean> => {
 	try {
 		const res = await fetch("https://api.github.com/user", {
@@ -43,21 +19,19 @@ const getSession = async (cookie: string | null): Promise<string | null> => {
 	if (!cookie) return null;
 	const match = cookie.match(/github_session=([^;]+)/);
 	if (!match) return null;
-	const session = SESSIONS.get(match[1]);
-	if (!session) return null;
-	const valid = await validateToken(session.token);
+	const token = await getGithubSession(match[1]);
+	if (!token) return null;
+	const valid = await validateToken(token);
 	if (!valid) {
-		SESSIONS.delete(match[1]);
-		saveSessions();
+		await deleteGithubSession(match[1]);
 		return null;
 	}
-	return session.token;
+	return token;
 };
 
-const createSession = (token: string): string => {
+const createSession = async (token: string): Promise<string> => {
 	const id = crypto.randomUUID();
-	SESSIONS.set(id, { token });
-	saveSessions();
+	await createGithubSession(id, token);
 	return id;
 };
 
@@ -188,7 +162,7 @@ export const githubRoutes = new Elysia({ prefix: "/github" })
 			set.headers["Location"] = `${origin}/?github=error=${msg}`;
 			return;
 		}
-		const sessionId = createSession(data.access_token);
+		const sessionId = await createSession(data.access_token);
 		set.status = 302;
 		set.headers["Set-Cookie"] = `github_session=${sessionId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=315360000`;
 		set.headers["Location"] = `${origin}/?github=connected`;
@@ -324,8 +298,7 @@ export const githubRoutes = new Elysia({ prefix: "/github" })
 		const cookie = request.headers.get("cookie");
 		const match = cookie?.match(/github_session=([^;]+)/);
 		if (match) {
-			SESSIONS.delete(match[1]);
-			saveSessions();
+			await deleteGithubSession(match[1]);
 		}
 		set.headers["Set-Cookie"] = "github_session=; Path=/; Max-Age=0";
 		return ok(null, "GitHub disconnected");

apps/api/src/db/migrations/0021_add_github_sessions.sql

@@ -0,0 +1,8 @@
+-- GitHub sessions table with encrypted access tokens
+CREATE TABLE IF NOT EXISTS github_sessions (
+  id text PRIMARY KEY,
+  access_token_encrypted text NOT NULL,
+  access_token_iv text NOT NULL,
+  access_token_tag text NOT NULL,
+  created_at timestamp with time zone DEFAULT now() NOT NULL
+);

apps/api/src/db/repo/github-sessions.ts

@@ -0,0 +1,28 @@
+import { eq } from "drizzle-orm";
+import { getDb } from "../db-provider";
+import { githubSessions } from "../schema";
+import { encryptValue, decryptValue } from "../../utils/crypto";
+import { config } from "../../utils/config";
+
+export const getGithubSession = async (id: string): Promise<string | null> => {
+  const db = await getDb();
+  const [row] = await db.select().from(githubSessions).where(eq(githubSessions.id, id)).execute();
+  if (!row) return null;
+  return decryptValue(row.accessTokenEncrypted, row.accessTokenIv, row.accessTokenTag, config.envEncryptionKey);
+};
+
+export const createGithubSession = async (id: string, accessToken: string): Promise<void> => {
+  const db = await getDb();
+  const enc = encryptValue(accessToken, config.envEncryptionKey);
+  await db.insert(githubSessions).values({
+    id,
+    accessTokenEncrypted: enc.encrypted,
+    accessTokenIv: enc.iv,
+    accessTokenTag: enc.tag,
+  }).execute();
+};
+
+export const deleteGithubSession = async (id: string): Promise<void> => {
+  const db = await getDb();
+  await db.delete(githubSessions).where(eq(githubSessions.id, id)).execute();
+};

apps/api/src/db/repo/index.ts

@@ -53,10 +53,12 @@ export { createAlert, listAlerts, getAlertById, updateAlertEnabled, deleteAlert
 
 export { getGithubIntegration, setGithubIntegration } from "./github";
 
+export { getGithubSession, createGithubSession, deleteGithubSession } from "./github-sessions";
+
 export { getSmtpSettings, upsertSmtpSettings } from "./settings";
 export type { SmtpSettingsData } from "./settings";
 
-export { upsertRoute, getRouteByHostname, listRoutes, listIngressRoutes, updateRouteStatus, deleteRouteByHostname, deleteRoute, deleteRoutesByDeployment } from "./routes";
+export { upsertRoute, getRouteByHostname, listRoutes, listIngressRoutes, listRoutesByDeployment, updateRouteStatus, deleteRouteByHostname, deleteRoute, deleteRoutesByDeployment } from "./routes";
 
 export { getPlatformSettings, setIngressServer } from "./platform-settings";
 export type { Route } from "../../types";

apps/api/src/db/repo/routes.ts

@@ -142,6 +142,12 @@ export const deleteRoutesByDeployment = async (deploymentId: string): Promise<vo
   await db.delete(routes).where(eq(routes.deploymentId, deploymentId)).execute();
 };
 
+export const listRoutesByDeployment = async (deploymentId: string): Promise<Route[]> => {
+  const db = await getDb();
+  const rows = await db.select().from(routes).where(eq(routes.deploymentId, deploymentId)).execute();
+  return rows.map(mapRoute);
+};
+
 export const deleteRoute = async (id: string): Promise<void> => {
   const db = await getDb();
   await db.delete(routes).where(eq(routes.id, id)).execute();

apps/api/src/db/schema.ts

@@ -1,5 +1,13 @@
 import { pgTable, text, integer, real, boolean, serial, jsonb, timestamp, foreignKey, uniqueIndex, index } from "drizzle-orm/pg-core";
 
+export const githubSessions = pgTable("github_sessions", {
+  id: text().primaryKey(),
+  accessTokenEncrypted: text("access_token_encrypted").notNull(),
+  accessTokenIv: text("access_token_iv").notNull(),
+  accessTokenTag: text("access_token_tag").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
 export const githubIntegrations = pgTable("github_integrations", {
   id: text().primaryKey(),
   clientId: text("client_id").notNull(),
@@ -68,7 +76,7 @@ export const deploymentLogs = pgTable("deployment_logs", {
   message: text().notNull(),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 }, (table) => [
-  foreignKey({ columns: [table.deploymentId], foreignColumns: [deployments.id] }),
+  foreignKey({ columns: [table.deploymentId], foreignColumns: [deployments.id], onDelete: "cascade" }),
   uniqueIndex("idx_logs_dep_seq").on(table.deploymentId, table.sequence),
 ]);
 

apps/api/src/executors/agent.ts

@@ -100,4 +100,4 @@ export const agentExecutor: DeploymentExecutor = {
     await updateDeploymentStatus(deployment.id, "failed", { failureReason: "Cancelled" });
     await appendLog(deployment.id, "system", "Deployment cancelled by user");
   },
-};
+};