I turned a browser chat-and-editor tool into an AI development orchestrator: a three-panel IDE that generates code, reviews diffs hunk by hunk, commits through a dedicated bot git identity behind branch protection, runs live previews in a memory-capped sandbox, and retrieves project history from a self-hosted RAG service. It then turned a real credential leak into a "never authenticate as the owner" rule.
The challenge
I set out to build a self-hosted alternative to a cloud agentic coding tool: an AI development orchestrator that keeps scoping and code execution in one session with shared context. The problem it targets is handoff and context-loss: in a normal "plan in a chat, then execute in a separate tool" workflow, planning gets lossily compressed into prompts. This IDE keeps both in one place, reading live repositories over a self-hosted Git server (not stale copies) and querying a self-hosted RAG service for historical context.
Going in, the app was actually broken: it served HTTP 200 but the chat-and-git round-trip didn't work, and a stubborn cleanup blocked the work before it could start. The build then spanned five milestones. Midway through, a credential leak forced a cross-cutting security objective on top of the feature work.
Approach
My guiding principle: keep the human merge gate, make every default safe, and read authority from the server, not the client.
- Bot git identity + branch protection. Every git operation authenticates as a dedicated, non-admin bot account with a narrowly scoped token, granted write on a test repo only. Both release branches are protected to reject the bot. The bot pushes a working branch; promoting that branch is a manual merge (the human control gate), which is what triggers auto-deploy. The clone logic is health-gated and self-healing, and deliberately reuses rather than auto-resets a working tree, so in-flight work is never silently destroyed.
- A memory-capped live-preview sandbox. Each preview runs as a transient, resource-capped process, localhost-only, one at a time. A boot-time health check verifies the cap is actually enforceable and sets an availability flag. Because a failed scope must never silently fall back to an uncapped spawn, the process is verified after launch (the spawn doesn't throw synchronously on failure).
- RAG as a retrieval call, not an LLM call. Retrieval is config-gated, never-throws, and timeout-bounded. It injects a delimited "retrieved context" system message ahead of the unchanged model call, augmenting the conversation without ever being able to break it, and without touching the rule that all AI routes through a central gateway.
- Hybrid model routing. The app owns the granular knob (selecting the model per project phase and routing each turn under a phase-named function segment) while the platform's per-function override stays unset by default as the central guardrail. Neither is required; both are honored.
- Read authority from the server. The phase that drives routing and cost is read from the database by project ID. The client supplies only the ID, never the phase, so it can't spoof a cheaper or pricier route.
Results
- All five milestones built and shipping on the development server, health green each deploy. The execution orchestrator core is complete on the test repo: phase-routed generation → per-hunk diff review → commit gate → a generated senior-review prompt, each milestone gated on a documented smoke test, honestly recorded as PASS or PARTIAL, never a false "full pass."
- A multi-table schema, a three-panel IDE, a bot git identity behind server-enforced branch protection, a resource-capped preview sandbox, and RAG retrieval proven with a real cited retrieval quoting an actual source document.
- Two security hardenings that became standing rules. A failed clone wrote the git auth header into a log line; pasting that log into chat exposed the token. Because the app had been authenticating as the owner account, the leaked token carried effectively root-level access, not just repo scope. I revoked it immediately, moved to a dedicated non-admin bot scoped to one test repo, and branch-protected the release branches against it. Then I closed the leak's actual path: the auth header was still visible in process args and interpolated into thrown error messages that the server then logged. I fixed it by passing the header a different way, behaviorally identical, but off argv and out of error messages.
- Safe-by-default, everywhere. RAG retrieval never-throws; auto-commit rules default to confirm on any parse error or unknown value; the review-prompt template falls back to a built-in default; unknown placeholders are left literal so an operator typo shows up instead of vanishing. The final review-prompt step makes zero model calls: it's pure deterministic template fill from a PR-style three-dot diff, verified by inspection.
- Honest scope. Execution against real application repos is gated on production promotion and a "multiple real workshop sessions" bar I haven't yet cleared. Known promotion blockers (hardcoded dev URLs, a CDN-loaded browser code editor the production node can't reach, a manual schema migration) are documented, not glossed. It is not yet promoted past the dev branch.
What this demonstrates
- Blast radius is the whole story. An owner-scoped credential leak is effectively root; the fix is a dedicated non-admin bot per app, scoped grants, and server-enforced branch protection. And credentials should never touch argv: it's world-readable and routinely interpolated into logs and error messages.
- Closing a bug on the wrong root cause is worse than leaving it open. The blocking cleanup was "resolved" twice on false premises before the truth emerged; the real systemic fix was switching deploys to
npm ci with a tracked lockfile, killing a whole class of per-deploy dependency drift. - Safe-by-default and never-throw for every augmenting integration: RAG, auto-commit, and template fill all degrade to a safe fallback rather than breaking the base path. And read authority from the server, not the client, so routing and cost decisions can't be spoofed.
- Surface footguns, don't hide them, and record partial verification honestly. A known staging quirk got flagged in the UI rather than silently patched, and a false "full pass" is a debt you pay later.