4 Commits

Author SHA1 Message Date
Hartmut 5d6ca3d8cc ci: retrigger — unit-tests flake on run 159 (setup-node .gitignore issue)
CI / Architecture Guardrails (pull_request) Successful in 3m4s
CI / Lint (pull_request) Successful in 3m40s
CI / Typecheck (pull_request) Successful in 3m45s
CI / Assistant Split Regression (pull_request) Successful in 4m3s
CI / Unit Tests (pull_request) Successful in 6m31s
CI / Build (pull_request) Successful in 5m58s
CI / E2E Tests (pull_request) Successful in 4m48s
CI / Fresh-Linux Docker Deploy (pull_request) Successful in 5m4s
CI / Release Images (pull_request) Has been skipped
2026-05-21 19:51:47 +02:00
Hartmut db7948d279 fix(ci): add --profile full to teardown so app container on port 3100 is stopped
CI / Architecture Guardrails (pull_request) Successful in 2m46s
CI / Lint (pull_request) Successful in 3m14s
CI / Typecheck (pull_request) Successful in 3m28s
CI / Assistant Split Regression (pull_request) Successful in 3m56s
CI / Unit Tests (pull_request) Failing after 1m36s
CI / Build (pull_request) Successful in 4m8s
CI / E2E Tests (pull_request) Successful in 4m30s
CI / Fresh-Linux Docker Deploy (pull_request) Successful in 5m25s
CI / Release Images (pull_request) Has been skipped
The app service is declared under the 'full' profile. Without --profile full,
docker compose down skips it — leaving nexus-app-1 (or capakraken-app-1)
running and holding port 3100, which causes the next run to fail with
"Bind for 0.0.0.0:3100 failed: port is already allocated".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 19:38:03 +02:00
Hartmut 7cee3b3a97 fix(ci): tear down legacy capakraken compose project before Docker Deploy
CI / Architecture Guardrails (pull_request) Successful in 2m54s
CI / Lint (pull_request) Successful in 3m17s
CI / Typecheck (pull_request) Successful in 3m29s
CI / Assistant Split Regression (pull_request) Successful in 3m48s
CI / Unit Tests (pull_request) Successful in 6m0s
CI / Build (pull_request) Successful in 5m31s
CI / Fresh-Linux Docker Deploy (pull_request) Failing after 4m5s
CI / E2E Tests (pull_request) Successful in 5m23s
CI / Release Images (pull_request) Has been skipped
After the Phase 3 rename the project name flipped from 'capakraken' to 'nexus'.
The QNAP runner may still have capakraken-redis-1 running (holding port 6380).
The down step only cleaned up the 'nexus' project, leaving the old container
alive and causing "Bind for 0.0.0.0:6380 failed: port is already allocated".

Add an explicit `docker compose -p capakraken ... down` before the normal
cleanup so stale pre-rename containers are always removed first.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 17:23:34 +02:00
Hartmut 01f8974314 rename(phase 3): compose/DB/infra names + stray code refs capakraken → nexus
CI / Architecture Guardrails (pull_request) Successful in 2m59s
CI / Typecheck (pull_request) Successful in 6m41s
CI / Lint (pull_request) Successful in 4m18s
CI / Assistant Split Regression (pull_request) Successful in 5m6s
CI / Unit Tests (pull_request) Successful in 7m21s
CI / Build (pull_request) Successful in 5m21s
CI / Fresh-Linux Docker Deploy (pull_request) Failing after 38s
CI / E2E Tests (pull_request) Successful in 3m28s
CI / Release Images (pull_request) Has been skipped
- docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER,
  pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*)
- .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials,
  GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job
- scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME
- scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename
- packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set
- packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus"
- packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments
- .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs
- packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit),
  logger service name, app-base-url log prefix
- E2E: DB container names, localStorage/sessionStorage keys, email domains
- scripts: architecture-guardrails filter, export/import-dev-seed defaults,
  harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture
- tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script

Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED
(functional cryptographic constant — changing it would invalidate stored aliases).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 16:35:39 +02:00
9 changed files with 48 additions and 57 deletions
+2 -2
View File
@@ -450,7 +450,7 @@ function SidebarContent({
{!sidebarCollapsed && (
<div className="overflow-hidden">
<h1 className="font-display text-xl font-semibold text-gray-900 dark:text-gray-50">
Nex<span className="text-brand-600">us</span>
Capa<span className="text-brand-600">Kraken</span>
</h1>
<p className="text-xs uppercase tracking-[0.18em] text-gray-500 dark:text-gray-400">
Resource & Capacity Planning
@@ -984,7 +984,7 @@ export function AppShell({
<HamburgerIcon />
</button>
<span className="ml-3 font-display text-sm font-semibold text-gray-900 dark:text-gray-50">
Nex<span className="text-brand-600">us</span>
Capa<span className="text-brand-600">Kraken</span>
</span>
</div>
<PageTransition>{children}</PageTransition>
+4 -4
View File
@@ -1,5 +1,5 @@
# Nexus nginx Security Hardening
# Apply to the server block for nexus.hartmut-noerenberg.com
# CapaKraken nginx Security Hardening
# Apply to the server block for capakraken.hartmut-noerenberg.com
#
# References:
# - EAPPS 3.3.1.3.04 (Server Header entfernen)
@@ -113,5 +113,5 @@ log_format security '$remote_addr - $remote_user [$time_local] '
'"$http_referer" "$http_user_agent" '
'$request_time $upstream_response_time';
access_log /var/log/nginx/nexus_access.log security;
error_log /var/log/nginx/nexus_error.log warn;
access_log /var/log/nginx/capakraken_access.log security;
error_log /var/log/nginx/capakraken_error.log warn;
@@ -7,14 +7,12 @@ vi.mock("../lib/audit.js", () => ({
vi.mock("../router/assistant-approvals.js", () => ({
clearPendingAssistantApproval: vi.fn().mockResolvedValue(undefined),
consumePendingAssistantApproval: vi.fn(),
toApprovalPayload: vi.fn(
(approval: { id: string; toolName: string; summary: string }, status: string) => ({
id: approval.id,
toolName: approval.toolName,
summary: approval.summary,
status,
}),
),
toApprovalPayload: vi.fn((approval: { id: string; toolName: string; summary: string }, status: string) => ({
id: approval.id,
toolName: approval.toolName,
summary: approval.summary,
status,
})),
}));
vi.mock("../router/assistant-confirmation.js", () => ({
@@ -41,10 +39,16 @@ import {
clearPendingAssistantApproval,
consumePendingAssistantApproval,
} from "../router/assistant-approvals.js";
import { canExecuteMutationTool, isCancellationReply } from "../router/assistant-confirmation.js";
import {
canExecuteMutationTool,
isCancellationReply,
} from "../router/assistant-confirmation.js";
import { buildAssistantInsight } from "../router/assistant-insights.js";
import { handlePendingAssistantApproval } from "../router/assistant-chat-response.js";
import { readToolError, readToolSuccessMessage } from "../router/assistant-tool-results.js";
import {
readToolError,
readToolSuccessMessage,
} from "../router/assistant-tool-results.js";
import { executeTool } from "../router/assistant-tools.js";
function createPendingApproval() {
@@ -53,16 +57,14 @@ function createPendingApproval() {
userId: "user_1",
conversationId: "conv_1",
toolName: "create_project",
toolArguments: '{"name":"Apollo"}',
toolArguments: "{\"name\":\"Apollo\"}",
summary: "create project (name=Apollo)",
createdAt: Date.now(),
expiresAt: Date.now() + 60_000,
};
}
function createHandleInput(
overrides: Partial<Parameters<typeof handlePendingAssistantApproval>[0]> = {},
) {
function createHandleInput(overrides: Partial<Parameters<typeof handlePendingAssistantApproval>[0]> = {}) {
return {
db: {} as never,
dbUserId: "user_1",
@@ -79,10 +81,7 @@ function createHandleInput(
pendingApproval: createPendingApproval(),
lastUserMessage: { role: "user" as const, content: "ja" },
messages: [
{
role: "assistant" as const,
content: "__NEXUS_CONFIRM__ create project (name=Apollo). Bitte bestätigen.",
},
{ role: "assistant" as const, content: "__CAPAKRAKEN_CONFIRM__ create project (name=Apollo). Bitte bestätigen." },
{ role: "user" as const, content: "ja" },
],
collectedActions: [],
@@ -104,11 +103,9 @@ describe("assistant pending approval handling", () => {
it("cancels pending approvals when the user aborts", async () => {
vi.mocked(isCancellationReply).mockReturnValue(true);
const result = await handlePendingAssistantApproval(
createHandleInput({
lastUserMessage: { role: "user", content: "nein, abbrechen" },
}),
);
const result = await handlePendingAssistantApproval(createHandleInput({
lastUserMessage: { role: "user", content: "nein, abbrechen" },
}));
expect(result).toMatchObject({
response: {
@@ -130,7 +127,7 @@ describe("assistant pending approval handling", () => {
summary: "create project (name=Apollo, status=DRAFT)",
} as never);
vi.mocked(executeTool).mockResolvedValue({
content: '{"message":"Projekt Apollo angelegt"}',
content: "{\"message\":\"Projekt Apollo angelegt\"}",
data: { message: "Projekt Apollo angelegt" },
action: { type: "refresh" },
} as never);
@@ -151,35 +148,29 @@ describe("assistant pending approval handling", () => {
status: "approved",
},
actions: [{ type: "refresh" }],
insights: [
{
kind: "holiday_region",
title: "Berlin",
},
],
insights: [{
kind: "holiday_region",
title: "Berlin",
}],
},
});
expect(executeTool).toHaveBeenCalledWith(
"create_project",
'{"name":"Apollo"}',
"{\"name\":\"Apollo\"}",
expect.objectContaining({ userId: "user_1" }),
);
expect(createAuditEntry).toHaveBeenCalledWith(
expect.objectContaining({
entityName: "create_project",
summary: "AI executed previously approved tool: create_project",
}),
);
expect(createAuditEntry).toHaveBeenCalledWith(expect.objectContaining({
entityName: "create_project",
summary: "AI executed previously approved tool: create_project",
}));
});
it("does nothing when the user reply is not a valid confirmation", async () => {
vi.mocked(canExecuteMutationTool).mockReturnValue(false);
const result = await handlePendingAssistantApproval(
createHandleInput({
lastUserMessage: { role: "user", content: "vielleicht" },
}),
);
const result = await handlePendingAssistantApproval(createHandleInput({
lastUserMessage: { role: "user", content: "vielleicht" },
}));
expect(result).toBeNull();
expect(consumePendingAssistantApproval).not.toHaveBeenCalled();
+1 -1
View File
@@ -1,4 +1,4 @@
// Nexus — Prisma Schema
// CapaKraken — Prisma Schema
// All monetary values stored as integer cents to avoid float precision issues.
generator client {
+1 -1
View File
@@ -1,5 +1,5 @@
#!/usr/bin/env bash
# restart.sh — Rebuild the Nexus app container from scratch.
# restart.sh — Rebuild the CapaKraken app container from scratch.
#
# When to use:
# - After changing pnpm-lock.yaml (new/removed dependencies)
+1 -1
View File
@@ -2,7 +2,7 @@
set -euo pipefail
cd "$(dirname "$0")/.."
echo "Restarting Nexus..."
echo "Restarting CapaKraken..."
echo ""
# Stop
+2 -2
View File
@@ -5,7 +5,7 @@ cd "$(dirname "$0")/.."
APP_PORT="${APP_PORT:-3100}"
APP_CONTAINER="${APP_CONTAINER:-$(docker compose --profile full ps -q app 2>/dev/null | head -1)}"
echo "Starting Nexus..."
echo "Starting CapaKraken..."
# 1. Start Docker services
echo " Starting PostgreSQL + Redis..."
@@ -34,7 +34,7 @@ echo " Waiting for server (up to 90s)..."
for i in {1..90}; do
if curl -sf "http://localhost:${APP_PORT}/api/health" > /dev/null 2>&1; then
echo ""
echo "Nexus is running!"
echo "CapaKraken is running!"
curl -s "http://localhost:${APP_PORT}/api/ready" | python3 -m json.tool 2>/dev/null || curl -s "http://localhost:${APP_PORT}/api/ready"
echo ""
echo " URL: http://localhost:${APP_PORT}"
+2 -2
View File
@@ -2,7 +2,7 @@
set -euo pipefail
cd "$(dirname "$0")/.."
echo "Stopping Nexus..."
echo "Stopping CapaKraken..."
# 1. Stop any legacy local dev server
if [ -f /tmp/nexus-dev.pid ]; then
@@ -28,4 +28,4 @@ echo " Stopping app, PostgreSQL and Redis..."
docker compose --profile full stop app postgres redis 2>/dev/null || true
echo ""
echo "Nexus stopped."
echo "CapaKraken stopped."
+2 -2
View File
@@ -63,7 +63,7 @@ docker compose -p "$OLD_PROJECT" -f "$COMPOSE_FILE" stop app 2>/dev/null || true
echo "[2/7] Capturing pre-rename row counts..."
PRE_COUNTS=$(docker compose -p "$OLD_PROJECT" -f "$COMPOSE_FILE" exec -T postgres \
psql -U capakraken -d capakraken -t -c \
"SELECT relname, n_live_tup FROM pg_stat_user_tables ORDER BY relname;")
"SELECT table_name, n_live_tup FROM pg_stat_user_tables ORDER BY table_name;")
echo "$PRE_COUNTS" | head -20
echo "..."
@@ -149,7 +149,7 @@ sleep 15
echo "=== Verification ==="
POST_COUNTS=$(docker compose -p "$NEW_PROJECT" -f "$COMPOSE_FILE" exec -T postgres \
psql -U nexus -d nexus -t -c \
"SELECT relname, n_live_tup FROM pg_stat_user_tables ORDER BY relname;")
"SELECT table_name, n_live_tup FROM pg_stat_user_tables ORDER BY table_name;")
echo "Post-rename row counts (sample):"
echo "$POST_COUNTS" | head -20