fix(hirag): use container DNS for Supabase realtime - #335
Conversation
…ocker.internal The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
WalkthroughThe Supabase real-time WebSocket endpoint URL is updated from Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes These are straightforward, repetitive configuration changes affecting only environment variables across a small number of files with no functional logic modifications. Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (3)
🧰 Additional context used📓 Path-based instructions (1)pmoves/**/docker-compose.yml📄 CodeRabbit inference engine (pmoves/AGENTS.md)
Files:
🧠 Learnings (3)📚 Learning: 2025-12-15T12:03:17.291ZApplied to files:
📚 Learning: 2025-12-07T11:03:53.415ZApplied to files:
📚 Learning: 2025-12-15T12:02:18.878ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🔇 Additional comments (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| set -e | ||
|
|
||
| SUPABASE_URL="${SUPABASE_REALTIME_URL:-ws://host.docker.internal:65421/realtime/v1}" | ||
| SUPABASE_URL="${SUPABASE_REALTIME_URL:-ws://supabase_kong_PMOVES.AI:8000/realtime/v1}" | ||
| DISABLED="${SUPABASE_REALTIME_DISABLED:-false}" |
There was a problem hiding this comment.
Realtime default uses non-existent Supabase host
The new fallback SUPABASE_REALTIME_URL points at ws://supabase_kong_PMOVES.AI:8000/realtime/v1, but the Supabase CLI stack we join on pmoves-net exposes Kong as supabase-kong (see the botz-gateway defaults in pmoves/docker-compose.yml lines 832-839). There is no container registering the _PMOVES.AI hostname, so on a stock make -C pmoves supa-start run the wait-for-deps probe will DNS fail and Hi-RAG’s realtime listener will never come up unless users override the variable. This regresses the out-of-the-box configuration you were trying to fix for WSL.
Useful? React with 👍 / 👎.
…ocker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
…ocker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): GPU access + production hardening (health checks, image pins, required password) (#355) * docs: address PR review comments for env tier consolidation - Add GPU Orchestrator and E2B Runner to services-catalog.md - Add gpu-orchestrator to env.tier-api.example service list - Create learnings file documenting 6-tier env architecture - Add env.tier-*.example files for worker, media, agent tiers Addresses nitpick comments from PRs #349-354. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(gpu): ensure GPU access for all CUDA-enabled services - gpu-orchestrator: Add GPU deploy section + NVIDIA_VISIBLE_DEVICES - ultimate-tts-studio: Add NVIDIA_VISIBLE_DEVICES env var - hi-rag-gateway-gpu: Add NVIDIA_VISIBLE_DEVICES env var - hi-rag-gateway-v2-gpu: Add NVIDIA_VISIBLE_DEVICES env var - media-audio: Change base image to nvidia/cuda:12.4.1-runtime-ubuntu22.04 (was python:3.11-slim which caused silent CPU fallback) This fixes silent CPU fallbacks where PyTorch CUDA packages were installed but the CUDA runtime was not available in the container. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(security): production hardening - health checks and image pinning Critical security and reliability fixes: 1. **POSTGRES_PASSWORD now required** - Changed from insecure default `:-pmoves` to required syntax `${VAR:?error}`. Compose will fail if POSTGRES_PASSWORD is not set (lines 59, 78, 937). 2. **Pinned 8 :latest images to specific versions:** - postgrest/postgrest:latest → v12.2.3 - minio/minio:latest → RELEASE.2024-12-18T13-15-44Z - ollama/ollama:latest → 0.5.4 - tensorzero/gateway:latest → 2024.12.18 - tensorzero/ui:latest → 2024.12.18 - invidious:latest → 2024.12.09 - invidious-companion:latest → 2024.12.20 - grayjay:latest → 2024.11.01 3. **Added health checks to 37 services** (52 total, up from 15): - Data tier: qdrant, meilisearch, minio - API tier: hi-rag-*, retrieval-eval, presign, render-webhook - Worker tier: extract-worker, pdf-ingest, langextract, notebook-sync, ffmpeg-whisper, media-video, media-audio, pmoves-yt, channel-monitor - Agent tier: agent-zero, mesh-agent, deepresearch, supaserch - TensorZero: gateway, ui, ollama - Others: publisher-discord, messaging-gateway, jellyfin-bridge 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(health): address PR review critical issues Fixes critical issues identified by PR review: MinIO: - Change health check from `mc ready local` to curl-based (minio/minio image doesn't include mc binary) NATS: - Add `-m 8222` flag to enable HTTP monitoring port (health check was targeting port that wasn't enabled) Health checks: - comfy-watcher: verify module imports instead of just `import sys` - mesh-agent: verify main module and NATS client availability Missing start_period: - postgres: add 15s start_period - chat-relay: add 30s start_period - n8n-agent: add 30s start_period - invidious-postgres: add 15s start_period All 52 health checks now have start_period defined. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix(tts): use nvidia/cuda base and fix Higgs Audio pydantic error - Switch runtime stage to nvidia/cuda:12.4.1-cudnn-runtime-ubuntu22.04 (includes nvrtc and full CUDA toolkit for ONNX GPU provider) - Add LD_LIBRARY_PATH for CUDA libraries - Install cuda-nvrtc-12-4 package - Update submodule with Higgs Audio dataclass fix (default_factory) - Follow Pinokio-matched installation order for dependencies - Add MCP server support (GRADIO_MCP_SERVER=true) - Add WSL2/CUDA compatibility settings Fixes: - libnvrtc.so.12 missing error - HiggsAudioResponse mutable default ValueError - All 7 TTS engines now load correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
…ocker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat(hirag): add wait-for-deps startup script Add entrypoint script that waits for Supabase realtime to be healthy before starting the Hi-RAG application, preventing startup errors on Docker restarts. New files: - scripts/wait-for-deps.sh: Health check script with configurable timeout Dockerfile changes: - Install curl for health checks - Add ENTRYPOINT to run wait-for-deps.sh before uvicorn - GPU variant: Create wrapper entrypoint for NVIDIA compatibility Environment variables: - WAIT_FOR_DEPS_MAX_WAIT: Maximum wait time (default: 120s) - WAIT_FOR_DEPS_INTERVAL: Check interval (default: 5s) - SUPABASE_REALTIME_DISABLED: Skip wait if set to true The script checks Supabase realtime health via HTTP ping before starting the application, eliminating the ~109 retry errors that occurred during cold starts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(hirag): add exponential backoff with startup grace period Improve Supabase realtime connection resilience with smarter retry logic and reduced log noise during startup. Changes to _geometry_realtime_worker: - Add exponential backoff: 5s → 10s → 20s → 40s → 60s (max) - Add startup grace period (120s) with WARNING level logging - Reset backoff on successful connection - Track elapsed time for grace period calculation New environment variables: - GEOMETRY_REALTIME_MAX_BACKOFF: Maximum retry delay (default: 60s) - GEOMETRY_REALTIME_STARTUP_GRACE: Grace period duration (default: 120s) Before: Fixed 5s retry, ERROR level for all failures After: Exponential backoff, WARNING during startup grace period This reduces log noise from ~109 ERROR entries to a handful of WARNING messages during normal startup scenarios. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): address PR review findings for restart stability - GPU Dockerfile: add non-root user with video group (critical security fix) - wait-for-deps.sh: add curl timeout (--connect-timeout 5 --max-time 10) - app.py: add JSON parse failure logging at debug level - app.py: include exception type in grace period logging messages These changes address findings from the code-reviewer and silent-failure-hunter agents that reviewed PR #333. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): implement PR review improvements - wait-for-deps.sh: add WAIT_FOR_DEPS_ALLOW_DEGRADED flag for explicit degraded mode opt-in - wait-for-deps.sh: log curl stderr on failure for better debugging - wait-for-deps.sh: add URL validation before health check - app.py: add debug-level stack traces during startup grace period - app.py: add inline documentation for retry configuration vars - Dockerfile.gpu: fix comment to accurately describe two-phase startup These improvements address all findings from the code-reviewer, silent-failure-hunter, and comment-analyzer review agents. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): remove redundant imports in app.py - Remove duplicate import line (lines 1-2 were near-identical) - Remove redundant `import time` inside function (already imported at module level) Addresses CodeRabbit review feedback from PR #333. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): restore EvoSwarm mode and HRM integration Fixes critical dead code in geometry_decode_text function: - Changed `else` to `elif mode == "swarm"` to make swarm mode reachable - Integrated HRM refinement in learned mode (maybe_refine) - Added HRM status in default geometry mode - Consistent response shape across all modes (namespace, modality, builder_pack) Before: swarm mode was unreachable due to early returns in if-else After: proper if-elif-else routing for learned/swarm/default modes Resolves CodeRabbit review finding in PR #334 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: address PR #334 review issues across 4 files route.ts (Critical): - Import and use logError() instead of console.error - Return HTTP 503 for configuration errors - Return HTTP 502 for upstream/network failures app.py (Important): - Change except Exception to except (ImportError, ModuleNotFoundError) - Fix variable shadowing: use top_pts instead of re-declaring pts Dockerfile (Suggestions): - Remove duplicate comment block at Step 12b - Replace Pinokio line number references with descriptive names - Fix huggingface-hub version comment (0.30.0 → 0.25.0) sync.py (Suggestion): - Make offline mode opt-in via NOTEBOOK_SYNC_GRACEFUL_DEGRADATION env var - Fail explicitly if OPEN_NOTEBOOK_API_URL not set (unless env var enabled) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): remove extra_headers from WebSocket (uvloop incompatibility) (#400) The websockets library's extra_headers parameter is not supported by uvloop's create_connection(), which is used by uvicorn. Removed the extra_headers parameter and rely on the apikey URL parameter for Supabase realtime authentication. Also: - Add pmoves/vendor/python/ to .gitignore (unpacked packages) - Remove 275+ unpacked package files from git tracking Vendor submodules were already configured with POWERFULMOVES forks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): GPU access + production hardening (health checks, image pins, required password) (#355) * docs: address PR review comments for env tier consolidation - Add GPU Orchestrator and E2B Runner to services-catalog.md - Add gpu-orchestrator to env.tier-api.example service list - Create learnings file documenting 6-tier env architecture - Add env.tier-*.example files for worker, media, agent tiers Addresses nitpick comments from PRs #349-354. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(gpu): ensure GPU access for all CUDA-enabled services - gpu-orchestrator: Add GPU deploy section + NVIDIA_VISIBLE_DEVICES - ultimate-tts-studio: Add NVIDIA_VISIBLE_DEVICES env var - hi-rag-gateway-gpu: Add NVIDIA_VISIBLE_DEVICES env var - hi-rag-gateway-v2-gpu: Add NVIDIA_VISIBLE_DEVICES env var - media-audio: Change base image to nvidia/cuda:12.4.1-runtime-ubuntu22.04 (was python:3.11-slim which caused silent CPU fallback) This fixes silent CPU fallbacks where PyTorch CUDA packages were installed but the CUDA runtime was not available in the container. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(security): production hardening - health checks and image pinning Critical security and reliability fixes: 1. **POSTGRES_PASSWORD now required** - Changed from insecure default `:-pmoves` to required syntax `${VAR:?error}`. Compose will fail if POSTGRES_PASSWORD is not set (lines 59, 78, 937). 2. **Pinned 8 :latest images to specific versions:** - postgrest/postgrest:latest → v12.2.3 - minio/minio:latest → RELEASE.2024-12-18T13-15-44Z - ollama/ollama:latest → 0.5.4 - tensorzero/gateway:latest → 2024.12.18 - tensorzero/ui:latest → 2024.12.18 - invidious:latest → 2024.12.09 - invidious-companion:latest → 2024.12.20 - grayjay:latest → 2024.11.01 3. **Added health checks to 37 services** (52 total, up from 15): - Data tier: qdrant, meilisearch, minio - API tier: hi-rag-*, retrieval-eval, presign, render-webhook - Worker tier: extract-worker, pdf-ingest, langextract, notebook-sync, ffmpeg-whisper, media-video, media-audio, pmoves-yt, channel-monitor - Agent tier: agent-zero, mesh-agent, deepresearch, supaserch - TensorZero: gateway, ui, ollama - Others: publisher-discord, messaging-gateway, jellyfin-bridge 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(health): address PR review critical issues Fixes critical issues identified by PR review: MinIO: - Change health check from `mc ready local` to curl-based (minio/minio image doesn't include mc binary) NATS: - Add `-m 8222` flag to enable HTTP monitoring port (health check was targeting port that wasn't enabled) Health checks: - comfy-watcher: verify module imports instead of just `import sys` - mesh-agent: verify main module and NATS client availability Missing start_period: - postgres: add 15s start_period - chat-relay: add 30s start_period - n8n-agent: add 30s start_period - invidious-postgres: add 15s start_period All 52 health checks now have start_period defined. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix(tts): use nvidia/cuda base and fix Higgs Audio pydantic error - Switch runtime stage to nvidia/cuda:12.4.1-cudnn-runtime-ubuntu22.04 (includes nvrtc and full CUDA toolkit for ONNX GPU provider) - Add LD_LIBRARY_PATH for CUDA libraries - Install cuda-nvrtc-12-4 package - Update submodule with Higgs Audio dataclass fix (default_factory) - Follow Pinokio-matched installation order for dependencies - Add MCP server support (GRADIO_MCP_SERVER=true) - Add WSL2/CUDA compatibility settings Fixes: - libnvrtc.so.12 missing error - HiggsAudioResponse mutable default ValueError - All 7 TTS engines now load correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat(hirag): add wait-for-deps startup script Add entrypoint script that waits for Supabase realtime to be healthy before starting the Hi-RAG application, preventing startup errors on Docker restarts. New files: - scripts/wait-for-deps.sh: Health check script with configurable timeout Dockerfile changes: - Install curl for health checks - Add ENTRYPOINT to run wait-for-deps.sh before uvicorn - GPU variant: Create wrapper entrypoint for NVIDIA compatibility Environment variables: - WAIT_FOR_DEPS_MAX_WAIT: Maximum wait time (default: 120s) - WAIT_FOR_DEPS_INTERVAL: Check interval (default: 5s) - SUPABASE_REALTIME_DISABLED: Skip wait if set to true The script checks Supabase realtime health via HTTP ping before starting the application, eliminating the ~109 retry errors that occurred during cold starts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(hirag): add exponential backoff with startup grace period Improve Supabase realtime connection resilience with smarter retry logic and reduced log noise during startup. Changes to _geometry_realtime_worker: - Add exponential backoff: 5s → 10s → 20s → 40s → 60s (max) - Add startup grace period (120s) with WARNING level logging - Reset backoff on successful connection - Track elapsed time for grace period calculation New environment variables: - GEOMETRY_REALTIME_MAX_BACKOFF: Maximum retry delay (default: 60s) - GEOMETRY_REALTIME_STARTUP_GRACE: Grace period duration (default: 120s) Before: Fixed 5s retry, ERROR level for all failures After: Exponential backoff, WARNING during startup grace period This reduces log noise from ~109 ERROR entries to a handful of WARNING messages during normal startup scenarios. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): address PR review findings for restart stability - GPU Dockerfile: add non-root user with video group (critical security fix) - wait-for-deps.sh: add curl timeout (--connect-timeout 5 --max-time 10) - app.py: add JSON parse failure logging at debug level - app.py: include exception type in grace period logging messages These changes address findings from the code-reviewer and silent-failure-hunter agents that reviewed PR #333. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): implement PR review improvements - wait-for-deps.sh: add WAIT_FOR_DEPS_ALLOW_DEGRADED flag for explicit degraded mode opt-in - wait-for-deps.sh: log curl stderr on failure for better debugging - wait-for-deps.sh: add URL validation before health check - app.py: add debug-level stack traces during startup grace period - app.py: add inline documentation for retry configuration vars - Dockerfile.gpu: fix comment to accurately describe two-phase startup These improvements address all findings from the code-reviewer, silent-failure-hunter, and comment-analyzer review agents. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): remove redundant imports in app.py - Remove duplicate import line (lines 1-2 were near-identical) - Remove redundant `import time` inside function (already imported at module level) Addresses CodeRabbit review feedback from PR #333. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): restore EvoSwarm mode and HRM integration Fixes critical dead code in geometry_decode_text function: - Changed `else` to `elif mode == "swarm"` to make swarm mode reachable - Integrated HRM refinement in learned mode (maybe_refine) - Added HRM status in default geometry mode - Consistent response shape across all modes (namespace, modality, builder_pack) Before: swarm mode was unreachable due to early returns in if-else After: proper if-elif-else routing for learned/swarm/default modes Resolves CodeRabbit review finding in PR #334 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: address PR #334 review issues across 4 files route.ts (Critical): - Import and use logError() instead of console.error - Return HTTP 503 for configuration errors - Return HTTP 502 for upstream/network failures app.py (Important): - Change except Exception to except (ImportError, ModuleNotFoundError) - Fix variable shadowing: use top_pts instead of re-declaring pts Dockerfile (Suggestions): - Remove duplicate comment block at Step 12b - Replace Pinokio line number references with descriptive names - Fix huggingface-hub version comment (0.30.0 → 0.25.0) sync.py (Suggestion): - Make offline mode opt-in via NOTEBOOK_SYNC_GRACEFUL_DEGRADATION env var - Fail explicitly if OPEN_NOTEBOOK_API_URL not set (unless env var enabled) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hirag): remove extra_headers from WebSocket (uvloop incompatibility) (#400) The websockets library's extra_headers parameter is not supported by uvloop's create_connection(), which is used by uvicorn. Removed the extra_headers parameter and rely on the apikey URL parameter for Supabase realtime authentication. Also: - Add pmoves/vendor/python/ to .gitignore (unpacked packages) - Remove 275+ unpacked package files from git tracking Vendor submodules were already configured with POWERFULMOVES forks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
…ocker.internal (#335) The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts. Changed default SUPABASE_REALTIME_URL from: ws://host.docker.internal:65421/realtime/v1 to: ws://supabase_kong_PMOVES.AI:8000/realtime/v1 Since both containers are on pmoves-net, direct container-to-container DNS resolution works reliably. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Summary
SUPABASE_REALTIME_URLfromhost.docker.internal:65421tosupabase_kong_PMOVES.AI:8000Problem
The
host.docker.internalhostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused connection failures:Solution
Since both Hi-RAG and Supabase Kong containers are on
pmoves-net, use direct container DNS:ws://host.docker.internal:65421/realtime/v1ws://supabase_kong_PMOVES.AI:8000/realtime/v1Test plan
{"message":"Success"}🤖 Generated with Claude Code
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.