Repository navigation
feat(studio): X02b serve card on the Code tab - #1118
Merged
Merged
Conversation
/serve/<id>/* answers the SDK's whole chat API for the agent's pinned
published version: a Studio-global serve.json holds the per-agent
{enabled, token, allowedOrigins} switch, the Express<->Fetch bridge
streams raw bodies (mounted before express.json), and the SDK
createRouteHandler enforces the per-agent bearer + origin rules.
Handlers cache per published version and rebuild on a moved pointer;
rotating the token drops the cached handler so the old bearer dies.
Sessions persist under .lousho/agents/<id>/serve-sessions via a new
sessions slot on StudioRunDeps.
Management routes GET/PUT /agents/:id/serve, GET .../serve/token and
POST .../serve/rotate-token ride the studio-token /agents gate; /serve
itself is host-only at the global middleware and stays out of
API_PREFIXES, the SPA fallback and the Vite proxy.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The X02a serve-surface wiring pushed createApp's cognitive complexity to 17 (gate: 15). Store/service construction moves into createStudioStores + createAuthorRunner; createApp is now a flat list of register* calls. No behavior change. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
ServeCard loads GET /agents/:id/serve, toggles serving through PUT, reveals/copies/rotates the bearer (memory only, 30 s reveal), edits allowed origins one-per-line and shows a curl snippet with $LOUSHO_SERVE_TOKEN. Refreshes on agent.changed version/meta events. Mounted at the bottom of the Code tab. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
4 tasks done
LinuxDevil
force-pushed
the
fb-x02a-serve-http
branch
from
November 14, 2026 10:56
eb897ed to
e8fe273
Compare
# Conflicts: # apps/agent-forge/server/app.ts # apps/agent-forge/src/runtime/__tests__/runtimeClient.test.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ServeCardon the Code tab (/agents/:id/code): enable/disable/serve/<id>for the published version, masked token with Reveal (30 s, memory only) / Rotate, allowed-origins editor, and a curl snippet that uses$LOUSHO_SERVE_TOKEN— never the real bearer.useServeStatushook:GET /agents/:id/serveon mount + live refresh onagent.changedversion/metaevents.Test plan
ServeCard.test.tsx— 14 tests: loading/error/retry, unpublished + disabled states, toggle, reveal/auto-hide, rotate toast, origins save + 400, clipboard success/failure, event refreshCodeTab.test.tsx— updated mocks, 9 tests greenGenerated with Devin