Skip to main content

Current Status

This repository contains a working local fixture prototype, a fully implemented hosted API layer with OpenAPI generation, and a React SPA web application with OIDC authentication. It is not yet a production-hosted SaaS registry or packaged desktop app.

Implemented​

Core Platform​

  • TypeScript pnpm workspace monorepo.
  • Fixture package and workspace schemas (Zod v3).
  • Fixture registry client and HTTP-based RemoteRegistryClient.
  • Deterministic render plans for Claude, Codex, Copilot, and Gemini fixture assets.
  • CLI commands for validation, render, status, diff, pull, sync, restore, draft push, drift, and debug bundle.
  • Local approval flag and interactive approval prompt for committed Copilot projections.
  • Fixture-based and filesystem-based drift diagnostics.
  • Ownership-state-checked restore.
  • Provider adapter packages for Claude, Codex, Copilot, and preview-only Gemini.
  • Trust gates for hooks, MCP servers, permission wildcards, sandbox weakening, inline secrets, and unknown high-risk provider settings.
  • Windows path normalization tests.
  • Telemetry forbidden-field tests.

Hosted API (Hono + OpenAPI)​

  • Hono-based API server (apps/api) with @hono/zod-openapi for automatic OpenAPI 3.1 spec generation at GET /v1/openapi.json.
  • 26 REST endpoints covering health, auth, packages, workspaces, approvals, objects, audit, and telemetry.
  • API-mediated Supabase OIDC login (PKCE, ES256 id_token verification), issuing wl_ session tokens. (SAML and service accounts removed.)
  • Device login flow for CLI authentication; CI tokens.
  • Persistent, backend-selectable session store (in-memory / SQLite / Supabase).
  • Content-addressed object upload/download with signed URLs, sha256 verification, ETags, and range downloads.
  • Backend-selectable registry persistence — SQLite (WORKLOOM_API_DB_PATH) or Supabase (Postgres + Storage) — for packages, workspace revisions, approvals, and audit events.
  • CORS middleware for cross-origin SPA requests.
  • Telemetry ingestion, rejection counting, renderer failure tracking, duration rollups, and dashboard summaries.

API Client Generation Pipeline​

  • @workloom/fetch-client: Native fetch() wrapper with Bearer token injection, error normalization, and timeout handling.
  • @workloom/react-query: Lean @tanstack/react-query v5 re-export with useRetryDisable and getCombinedStatus utilities.
  • @workloom/workloom-api: Kubb v4.37.8-generated typed client functions, React Query hooks, TypeScript types, and Zod schemas derived from the OpenAPI spec.
  • CI-ready generate:check script for spec-to-code synchronization validation.

Web Application (React SPA)​

  • Vite-based React SPA (apps/web) on port 3050 with API proxy to port 4050.
  • API-mediated Supabase OIDC login (custom AuthProvider + supabase-js) with automatic token injection.
  • Client-side model composition hooks (useDashboardModel, useRegistryModel, useWorkspaceListModel) consuming generated React Query hooks.
  • Pages: Dashboard, Registry, Package Detail, Workspaces, Workspace Detail, Editor, Telemetry, Admin.
  • React Router v6 for client-side navigation.
  • Role-based access via JWT token decoding (useRoles hook).

GitHub Automation​

  • GitHub organization automation client for Copilot instruction file sync and Copilot coding-agent repository access policy.

Deployed​

  • Web on Vercel (workloom-x-web), API on Render (workloom-x-api), Supabase Cloud for data/auth/storage. Full login → dashboard verified live.

Remaining Work​

  • Custom production domain and TLS; hardened CI/CD gating.
  • Desktop native binary with signing and notarization.
  • Full enterprise approval workflow (current --approve-local is a local mechanism).
  • Additional login providers (only email/password enabled) and granular per-user roles.
  • Relational analytics tables are write-path parity only (dashboards still read from the snapshot / in-memory collector).
  • Remaining composition hooks (editor, telemetry detail, admin detail, package compare).