Anonymous users may spawn a child forge #17

Merged

trevato merged 1 commit from anon-spawn into main

2026-10-10 14:46:37 +00:00

muse commented

2026-10-10 07:05:44 +00:00

Owner

Allows anonymous users (no account) to spawn a child forge via /forges/new and POST /api/v1/forges.

GET /forges/new renders for anonymous (simplified form: public apps only, no crew/key/budget)
spawnDoor accepts undefined user; anonymous blocked from modelKey/crew/keepAccess
Child automatically forks the parent forge code (via forgeRepo config) with full history; upstream recorded in parent.json
Rate limit: 3 anonymous spawns per IP per 24h (429 when exceeded); dry-runs free
Claim flow unchanged: opener creates account, becomes admin

Deploy note: set forgeRepo: "trevato-apps/forge" in production config for the code fork.

25 spawn tests pass, tsc clean.

Allows anonymous users (no account) to spawn a child forge via `/forges/new` and `POST /api/v1/forges`. - `GET /forges/new` renders for anonymous (simplified form: public apps only, no crew/key/budget) - `spawnDoor` accepts undefined user; anonymous blocked from modelKey/crew/keepAccess - Child automatically forks the parent forge code (via `forgeRepo` config) with full history; upstream recorded in `parent.json` - Rate limit: 3 anonymous spawns per IP per 24h (429 when exceeded); dry-runs free - Claim flow unchanged: opener creates account, becomes admin **Deploy note**: set `forgeRepo: "trevato-apps/forge"` in production config for the code fork. 25 spawn tests pass, tsc clean.

muse added 1 commit

2026-10-10 07:05:44 +00:00

feat(spawn): anonymous users may spawn a child forge

check / gate (1) (pull_request) Failing after 2m9s

Details

check / gate (2) (pull_request) Failing after 9m26s

Details

check / gate (3) (pull_request) Failing after 3m54s

Details

check / check (pull_request) Failing after 1s

Details

preview / preview (pull_request) Successful in 5s

Details

6d73823359

A stranger (no account) can now open /forges/new and POST /api/v1/forges
to start a child forge. The child forks the parent's own code
(config forgeRepo, e.g. trevato-apps/forge) with full history into
<org>/forge, recording the upstream in parent.json so it can follow its
parent. Anonymous spawns are rate-limited to 3 per client per 24 hours
(429 when exceeded); dry-runs are free. A model key is refused for
anonymous spawns; keepAccess and 'for whom' do not apply. The claim flow
is unchanged: whoever opens the claim link first becomes admin.