From 18033f8cc88b30866a6ae6848c54e184930d5a0a Mon Sep 17 00:00:00 2001 From: dirtydishes Date: Sun, 17 May 2026 09:05:00 -0400 Subject: [PATCH] docs: record daily bug scan replay regression --- ...aily-bug-scan-replay-proxy-regression.html | 208 ++++++++++++++++++ 1 file changed, 208 insertions(+) create mode 100644 docs/turns/2026-05-17-daily-bug-scan-replay-proxy-regression.html diff --git a/docs/turns/2026-05-17-daily-bug-scan-replay-proxy-regression.html b/docs/turns/2026-05-17-daily-bug-scan-replay-proxy-regression.html new file mode 100644 index 0000000..98b0ca2 --- /dev/null +++ b/docs/turns/2026-05-17-daily-bug-scan-replay-proxy-regression.html @@ -0,0 +1,208 @@ + + + + + + 2026-05-17 Daily Bug Scan: Replay Proxy Regression + + + +
+
+

Daily bug scan: public replay route regression

+

+ The scan found one concrete regression tied to recent durable-options routing work: the deployed + public route check now fails because /replay/options returns HTML instead of JSON on + https://flow.deltaisland.io. +

+
Recorded as Beads issue islandflow-r7n
+
+ +
+

Summary

+

+ I scanned the commits from the last 24 hours, focused on the recent options-history and live-tape + routing changes, and verified the new public route checker against the live app origin. The only + concrete failure was the replay endpoint check. +

+
+ +
+

Changes Made

+
    +
  • Created Beads bug islandflow-r7n to track the public replay proxy regression.
    • +
  • Added this turn document for the automation handoff.
    • +
+
+ +
+

Context

+

+ Commit 1424a27 added scripts/check-public-api-routes.ts and wired it into + deploy verification to catch same-origin routing mistakes after the durable options history work. + That script now provides a concrete signal that the public replay path is misrouted. +

+
+ +
+

Important Implementation Details

+
    +
  • services/api/src/index.ts does implement GET /replay/options.
    • +
  • + deployment/docker/README.md says same-origin proxy mode must forward + /replay/* to the API service. +
    • +
  • + The live check failed with HTML from the web app, which indicates the edge proxy is not forwarding + that path to the API host. +
    • +
+ 
bun run scripts/check-public-api-routes.ts https://flow.deltaisland.io
+...
+error: /replay/options returned non-JSON content (text/html; charset=UTF-8)
+
+ +
+

Expected Impact for End-Users

+

+ Replay-mode options data requested through the public app origin can land on the Next.js app instead + of the API, which breaks the endpoint and can leave replay experiences incomplete or empty. +

+
+ +
+

Validation

+
    +
  • Reviewed recent commits: 1424a27, d334e16, 23ed380.
    • +
  • + Ran bun run scripts/check-public-api-routes.ts https://flow.deltaisland.io and + reproduced the failing replay route. +
    • +
  • + Confirmed the API service route exists by inspecting services/api/src/index.ts. +
    • +
  • + Ran bun test apps/web/app/terminal.test.ts; it did not execute in isolation because + the file depends on workspace alias resolution for @islandflow/types. +
    • +
+
+ +
+

Issues, Limitations, and Mitigations

+
    +
  • This appears to be an environment or edge-proxy regression, not a source-level API bug.
    • +
  • No repo code fix was applied because the failing behavior is coming from live routing outside this checkout.
    • +
  • The Beads issue includes the minimal mitigation: update the public proxy matcher, then rerun the route check.
    • +
+
+ +
+

Follow-up Work

+
    +
  • islandflow-r7n: update the live proxy so /replay/* reaches the API service.
    • +
  • Rerun bun run check:public-api-routes after the edge change to confirm recovery.
    • +
  • + Optionally coordinate with islandflow-qd7 if the team still plans to move production to + api.flow.deltaisland.io and reduce same-origin proxy risk altogether. +
    • +
+
+
+ +