refactor(checks): on-demand log fetch with React Query and CL-scoped state

Fetch logs only for the selected build (SSE while building), replace manual
batch fetch with React Query caching, cap CachedLogPanel mounts with LRU,
and split index.tsx into useBuildSelection/useLogCache hooks. Scope buildId
and logs to CL via atomFamily, sync ?tab=check&build= URL, remember last
build per task, and add retry on log fetch errors.

Author: benjamin-747

.github/workflows/web-deploy.yml

@@ -61,24 +61,10 @@ jobs:
         with:
           registry-type: public
 
-      - name: Configure AWS Credentials (ECR Private, ap-southeast-2)
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ap-southeast-2
-
-      - name: Login to Amazon ECR Private
-        id: login-ecr-private
-        uses: aws-actions/amazon-ecr-login@v2
-        with:
-          registry-type: private
-
       - name: Build & push unified image
         working-directory: moon
         env:
           ECR_PUBLIC_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
-          ECR_PRIVATE_REGISTRY: ${{ steps.login-ecr-private.outputs.registry }}
           PLATFORM: linux/amd64
         run: |
           set -euo pipefail
@@ -88,9 +74,7 @@ jobs:
           SHA_TAG="${SHORT_SHA}-${ARCH_SUFFIX}"
 
           PUBLIC_IMAGE="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
-          PRIVATE_IMAGE="$ECR_PRIVATE_REGISTRY/${{ env.REPOSITORY }}:$IMAGE_TAG"
           PUBLIC_IMAGE_SHA="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$SHA_TAG"
-          PRIVATE_IMAGE_SHA="$ECR_PRIVATE_REGISTRY/${{ env.REPOSITORY }}:$SHA_TAG"
 
           docker buildx build \
             --platform "$PLATFORM" \
@@ -100,9 +84,7 @@ jobs:
             --sbom=false \
             -f apps/web/Dockerfile \
             -t "$PUBLIC_IMAGE" \
-            -t "$PRIVATE_IMAGE" \
-            -t "$PUBLIC_IMAGE_SHA" \
-            -t "$PRIVATE_IMAGE_SHA" . \
+            -t "$PUBLIC_IMAGE_SHA" . \
             --push
 
   manifest:

docker/README.md

@@ -7,8 +7,8 @@
 - [Demo Walk-Through](#demo-walk-through)
 - [Service Endpoints](#service-endpoints)
 - [FAQ](#faq)
-- [Stopping & Cleanup](#stopping--cleanup)
-- [Log Streaming](#log-streaming)
+- [Stopping and Cleanup](#stopping-and-cleanup)
+- [View logs](#view-logs)
 - [Architecture Overview](#architecture-overview)
 
 ---
@@ -90,10 +90,23 @@ The main configurable environment variables include:
 
 - **Service Images**:
   - `MEGA_ENGINE_IMAGE`: Mega backend image (default: `public.ecr.aws/m8q5m4u3/mega/mono-engine:latest`)
-  - `MEGA_UI_IMAGE`: Mega UI image (default: `public.ecr.aws/m8q5m4u3/mega/mega-ui:demo-latest`)
+  - `MEGA_UI_IMAGE`: Mega UI unified image (default: `public.ecr.aws/m8q5m4u3/mega/mega-ui:latest`)
   - `CAMPSITE_API_IMAGE`: Campsite API image (default: `public.ecr.aws/m8q5m4u3/mega/campsite-api:latest`)
+  - `CAMPSITE_HOST_PORT`: Host port for Campsite API (default: `18080`, maps to container port `8080`; avoids conflict with local tools such as Cursor on `8080`)
   - `CAMPSITE_RUN_MIGRATIONS`: Whether to run database migrations when the container starts; `1` (default) to run, can be changed to `0` after the first successful migration to skip and speed up subsequent starts.
 
+- **Mega UI Runtime URLs** (injected at container start; must be browser-reachable):
+  - `NEXT_PUBLIC_API_URL`: Campsite API for the **browser** (default: `http://api.gitmono.local:18080`)
+  - `NEXT_PUBLIC_INTERNAL_API_URL`: Campsite API for **Next.js SSR inside the mega_ui container** (default: `http://api.gitmono.local:8080` — Docker network alias + container port `8080`, not host port `18080`)
+  - `NEXT_PUBLIC_MONO_API_URL`: Mega / mono API (default: `http://git.gitmono.local:8000`)
+  - `NEXT_PUBLIC_ORION_API_URL`: Orion Server API (default: `http://orion.gitmono.local:8004`)
+  - `NEXT_PUBLIC_AUTH_URL`: OAuth / auth endpoint (default: `http://auth.gitmono.local:18080`)
+  - `NEXT_PUBLIC_WEB_URL`: Web UI origin (default: `http://app.gitmono.local`)
+  - `NEXT_PUBLIC_SYNC_URL`: Real-time sync WebSocket URL (optional; leave empty if not used)
+  - `NEXT_PUBLIC_CRATES_PRO_URL`: Crates Pro API URL (optional; leave empty if not used)
+
+  The UI image is **environment-agnostic**: it is built once with placeholder URLs and `docker-entrypoint.sh` rewrites them from the variables above when `mega_ui` starts. You no longer need per-environment image tags such as `demo-latest`.
+
 - **RustFS Configuration**:
   - `RUSTFS_ACCESS_KEY`: RustFS access key (default: `rustfsadmin`)
   - `RUSTFS_SECRET_KEY`: RustFS secret key (default: `rustfsadmin`)
@@ -111,14 +124,23 @@ Execute in the project root directory:
 docker compose -f docker/demo/docker-compose.demo.yml up -d
 ```
 
+Or, if you maintain a local `.env` under `docker/demo/`:
+
+```bash
+cd docker/demo
+docker compose -f docker-compose.demo.yml up -d
+```
+
 This command will:
 
 1. Pull the required Docker images (may take a long time for the first run)
 2. Create Docker networks and volumes
 3. Start all services in dependency order:
    - First, start infrastructure services (PostgreSQL, MySQL, Redis, RustFS)
    - Then, start application services (Mega, Orion Server, Campsite API)
-   - Finally, start client services (Mega UI, Orion Build Client)
+   - Finally, start `mega_ui`, which injects `NEXT_PUBLIC_*` URLs at container start and serves the web UI on port 80
+
+On first `mega_ui` start you should see log lines such as `[entrypoint] injecting runtime environment` followed by `NEXT_PUBLIC_* applied` — that confirms the unified image picked up your demo URLs.
 
 ### 4. Check service status
 
@@ -224,7 +246,7 @@ Log in with the following credentials:
 | **Mega UI** | <http://app.gitmono.local> | Web Frontend UI |
 | **Mega API** | <http://api.gitmono.local:8000> | Mega backend API |
 | **Orion Server** | <http://orion.gitmono.local:8004> | Orion build server API |
-| **Campsite API** | <http://api.gitmono.local:8080> | Campsite OAuth/SSO API |
+| **Campsite API** | <http://api.gitmono.local:18080> | Campsite OAuth/SSO API |
 | **PostgreSQL** | localhost:5432 | Database (used by Mega & Orion, mapped to host port 5432 in demo) |
 | **MySQL** | localhost:3306 | Database (used by Campsite API, mapped to host port 3306 in demo) |
 | **Redis** | localhost:6379 | Cache service (mapped to host port 6379 in demo) |
@@ -233,14 +255,32 @@ Log in with the following credentials:
 
 ### API Health Check Endpoints
 
-- **Mega API**: `GET http://api.gitmono.lcoal:8000/api/v1/status`
+- **Mega API**: `GET http://api.gitmono.local:8000/api/v1/status`
 - **Orion Server**: `GET http://orion.gitmono.local:8004/v2/health`
-- **Campsite API**: `GET http://api.gitmono.local:8080/health`
+- **Campsite API**: `GET http://api.gitmono.local:18080/health`
 
 ---
 
 ## FAQ
 
+### Mega UI points at wrong API URLs
+
+**Problem**: After opening <http://app.gitmono.local>, API calls fail or target placeholder hostnames such as `rt-api.placeholder.local`.
+
+**Cause**: The unified UI image did not receive `NEXT_PUBLIC_*` values at container start (older image without `docker-entrypoint.sh`, or missing environment block).
+
+**Solution**:
+
+1. Ensure `mega_ui` uses `public.ecr.aws/m8q5m4u3/mega/mega-ui:latest` (or a locally built unified image).
+2. Confirm `docker/demo/.env` includes the `NEXT_PUBLIC_*` block from `.env.example`, or rely on the defaults in `docker-compose.demo.yml`.
+3. Restart the UI container and check logs:
+
+   ```bash
+   docker compose -f docker/demo/docker-compose.demo.yml logs mega_ui | grep entrypoint
+   ```
+
+   You should see `NEXT_PUBLIC_* applied` for each configured variable.
+
 ### Port Conflict
 
 **Issue**: Docker reports the port is already allocated
@@ -526,11 +566,28 @@ The demo environment includes the following services:
 
 - **Application services**:
   - `mega`: Mega backend (Rust)
-  - `mega_ui`: Mega Web UI (Next.js)
+  - `mega_ui`: Mega Web UI (Next.js, unified image with runtime `NEXT_PUBLIC_*` injection)
   - `orion_server`: Orion build server (Rust)
-  - `orion_build_client`: Orion build client (based on the orion-client image)
   - `campsite_api`: Campsite API (Ruby/Rails, built locally by default; if you have the encrypted development credentials configured you can pull the pre-built image directly via `CAMPSITE_API_IMAGE=public.ecr.aws/m8q5m4u3/mega/campsite-api:latest`)
 
+### Mega UI: unified image + runtime configuration
+
+Previously each environment shipped its own UI image tag (`demo-latest`, `gitmono-latest`, etc.) with URLs baked in at build time. The current flow uses **one** `mega-ui:latest` image for every environment:
+
+1. **Build** (`moon/apps/web/Dockerfile`): compile with placeholder URLs from `moon/apps/web/.env.runtime`.
+2. **Start** (`moon/apps/web/docker-entrypoint.sh`): replace placeholders in the compiled assets with `NEXT_PUBLIC_*` values from the container environment, then run `node server.js`.
+3. **Configure locally**: set the `NEXT_PUBLIC_*` block in `docker/demo/.env` (see `.env.example`). Defaults in `docker-compose.demo.yml` already target the `gitmono.local` demo hostnames.
+
+To build the UI image locally instead of pulling from ECR:
+
+```bash
+./scripts/demo/build-demo-images-local.sh mega-ui
+# then in docker/demo/.env:
+# MEGA_UI_IMAGE=public.ecr.aws/m8q5m4u3/mega/mega-ui:latest-<arch>
+```
+
+Replace `<arch>` with `arm64` or `amd64` to match your machine.
+
 For a detailed architecture diagram and dependency list, see the [Mega / Orion Demo architecture design document](./mega-orion-demo-compose-arch.md).
 
 ---

docker/demo/.env.example

@@ -51,10 +51,32 @@ S3_SECRET_ACCESS_KEY=rustfsadmin
 # You can override these to use local images or different tags
 
 MEGA_ENGINE_IMAGE=public.ecr.aws/m8q5m4u3/mega/mono-engine:latest
-MEGA_UI_IMAGE=public.ecr.aws/m8q5m4u3/mega/mega-ui:demo-latest
+# Unified web image (same tag for all environments; URLs injected at container start).
+# Remote default: mega-ui:latest
+# Local build (build-demo-images-local.sh): mega-ui:latest-<arch>  e.g. latest-arm64
+MEGA_UI_IMAGE=public.ecr.aws/m8q5m4u3/mega/mega-ui:latest
 ORION_SERVER_IMAGE=public.ecr.aws/m8q5m4u3/mega/orion-server:latest
 CAMPSITE_API_IMAGE=public.ecr.aws/m8q5m4u3/mega/campsite-api:latest
 
+# ----------------------------------------------------------------------------
+# Mega UI Runtime Configuration (unified image)
+# ----------------------------------------------------------------------------
+# The web image is built once with placeholder URLs. docker-entrypoint.sh
+# rewrites them with these values when the container starts. URLs must be
+# reachable from the browser (use gitmono.local hostnames, not in-container
+# service names).
+
+NEXT_PUBLIC_API_URL=http://api.gitmono.local:18080
+# Server-side (SSR) from mega_ui container — container network port, not host port
+NEXT_PUBLIC_INTERNAL_API_URL=http://api.gitmono.local:8080
+NEXT_PUBLIC_MONO_API_URL=http://git.gitmono.local:8000
+NEXT_PUBLIC_ORION_API_URL=http://orion.gitmono.local:8004
+NEXT_PUBLIC_AUTH_URL=http://auth.gitmono.local:18080
+NEXT_PUBLIC_WEB_URL=http://app.gitmono.local
+# Optional — leave empty when sync / crates-pro are not part of the demo stack
+NEXT_PUBLIC_SYNC_URL=
+NEXT_PUBLIC_CRATES_PRO_URL=
+
 # ----------------------------------------------------------------------------
 # Mega Backend Service Configuration
 # ----------------------------------------------------------------------------
@@ -76,7 +98,7 @@ MEGA_LOG__PRINT_STD=true
 MEGA_BUILD__ENABLE_BUILD=true
 MEGA_BUILD__ORION_SERVER=http://orion_server:8004
 
-MEGA_OAUTH__CAMPSITE_API_DOMAIN=http://api.gitmono.local:8080
+MEGA_OAUTH__CAMPSITE_API_DOMAIN=http://api.gitmono.local:18080
 MEGA_OAUTH__UI_DOMAIN=http://app.gitmono.local
 MEGA_OAUTH__COOKIE_DOMAIN=gitmono.local
 MEGA_OAUTH__ALLOWED_CORS_ORIGINS="http://app.gitmono.local"
@@ -100,6 +122,9 @@ ORION_MONOBASE_URL=http://mega:8000
 # Campsite API Configuration
 # ----------------------------------------------------------------------------
 
+# Host port mapped to campsite_api container port 8080 (default 18080 to avoid local 8080 conflicts)
+CAMPSITE_HOST_PORT=18080
+
 CAMPSITE_REDIS_URL=redis://redis:6379
 CAMPSITE_RAILS_ENV=demo
 CAMPSITE_SERVER_COMMAND=bundle exec puma

docker/demo/docker-compose.demo.yml

@@ -201,20 +201,33 @@ services:
     restart: "no"
 
   # ---------------------------------------------------------------------------
-  # Mega UI (Next.js)
+  # Mega UI (Next.js, unified image)
   # ---------------------------------------------------------------------------
-  # Use pre-built image from ECR Public: public.ecr.aws/m8q5m4u3/mega/mega-ui:{env}-latest
-  # Available environments: staging, openatom, gitmono
-  # Set MEGA_UI_IMAGE environment variable to use ECR image, or tag the ECR image as mega:mono-ui-latest-release
-  # Default uses local tag (mega:mono-ui-latest-release) if ECR image is tagged locally
+  # Single environment-agnostic image: built with placeholder URLs (.env.runtime)
+  # and configured at container start by docker-entrypoint.sh using the
+  # NEXT_PUBLIC_* variables below. Override MEGA_UI_IMAGE to pin a tag or use
+  # a locally built image (see scripts/demo/build-demo-images-local.sh).
   mega_ui:
-    image: ${MEGA_UI_IMAGE:-public.ecr.aws/m8q5m4u3/mega/mega-ui:demo-latest}
+    image: ${MEGA_UI_IMAGE:-public.ecr.aws/m8q5m4u3/mega/mega-ui:latest}
     container_name: mega-demo-ui
     depends_on:
       mega:
         condition: service_healthy
       orion_server:
         condition: service_healthy
+    environment:
+      # Runtime injection for the unified web image (browser-facing URLs).
+      # Browser-facing Campsite URL (host port 18080).
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://api.gitmono.local:18080}
+      # SSR / server-side calls from mega_ui run inside Docker; use container port 8080.
+      NEXT_PUBLIC_INTERNAL_API_URL: ${NEXT_PUBLIC_INTERNAL_API_URL:-http://api.gitmono.local:8080}
+      NEXT_PUBLIC_MONO_API_URL: ${NEXT_PUBLIC_MONO_API_URL:-http://git.gitmono.local:8000}
+      NEXT_PUBLIC_ORION_API_URL: ${NEXT_PUBLIC_ORION_API_URL:-http://orion.gitmono.local:8004}
+      NEXT_PUBLIC_AUTH_URL: ${NEXT_PUBLIC_AUTH_URL:-http://auth.gitmono.local:18080}
+      NEXT_PUBLIC_WEB_URL: ${NEXT_PUBLIC_WEB_URL:-http://app.gitmono.local}
+      # Optional: leave unset when the demo stack has no sync / crates-pro service.
+      NEXT_PUBLIC_SYNC_URL: ${NEXT_PUBLIC_SYNC_URL:-}
+      NEXT_PUBLIC_CRATES_PRO_URL: ${NEXT_PUBLIC_CRATES_PRO_URL:-}
     ports:
       # Container listens on 3000, host port is 80
       - "80:3000"
@@ -321,8 +334,8 @@ services:
 
         exec ${CAMPSITE_SERVER_COMMAND:-bundle exec puma}
     ports:
-      # Container listens on 8080, host port is 8080
-      - "8080:8080"
+      # Container listens on 8080; host port 18080 avoids conflict with Cursor / other local services on 8080
+      - "${CAMPSITE_HOST_PORT:-18080}:8080"
     healthcheck:
       # Campsite API health check
       # NOTE: avoid curl dependency; use bash built-in /dev/tcp

docker/deployment/.env.example

@@ -51,11 +51,25 @@ S3_SECRET_ACCESS_KEY=rustfsadmin
 # You can override these to use local images or different tags
 
 MEGA_ENGINE_IMAGE=ghcr.io/web3infra-foundation/mono-engine:latest
-# waiting for next release for demo image 
-MEGA_UI_IMAGE=public.ecr.aws/m8q5m4u3/mega/mega-ui:demo-latest
+# Unified web image (same tag for all environments; URLs injected at container start)
+MEGA_UI_IMAGE=public.ecr.aws/m8q5m4u3/mega/mega-ui:latest
 ORION_SERVER_IMAGE=ghcr.io/web3infra-foundation/orion-server:latest
 CAMPSITE_API_IMAGE=ghcr.io/web3infra-foundation/campsite-api:latest
 
+# ----------------------------------------------------------------------------
+# Mega UI Runtime Configuration (unified image)
+# ----------------------------------------------------------------------------
+
+NEXT_PUBLIC_API_URL=http://api.gitmono.local:18080
+# Server-side (SSR) from mega_ui container — container network port, not host port
+NEXT_PUBLIC_INTERNAL_API_URL=http://api.gitmono.local:8080
+NEXT_PUBLIC_MONO_API_URL=http://git.gitmono.local:8000
+NEXT_PUBLIC_ORION_API_URL=http://orion.gitmono.local:8004
+NEXT_PUBLIC_AUTH_URL=http://auth.gitmono.local:18080
+NEXT_PUBLIC_WEB_URL=http://app.gitmono.local
+NEXT_PUBLIC_SYNC_URL=
+NEXT_PUBLIC_CRATES_PRO_URL=
+
 # ----------------------------------------------------------------------------
 # Mega Backend Service Configuration
 # ----------------------------------------------------------------------------
@@ -77,7 +91,7 @@ MEGA_LOG__PRINT_STD=true
 MEGA_BUILD__ENABLE_BUILD=true
 MEGA_BUILD__ORION_SERVER=http://orion_server:8004
 
-MEGA_OAUTH__CAMPSITE_API_DOMAIN=http://api.gitmono.local:8080
+MEGA_OAUTH__CAMPSITE_API_DOMAIN=http://api.gitmono.local:18080
 MEGA_OAUTH__UI_DOMAIN=http://app.gitmono.local
 MEGA_OAUTH__COOKIE_DOMAIN=gitmono.local
 MEGA_OAUTH__ALLOWED_CORS_ORIGINS="http://app.gitmono.local"

moon/Caddyfile

@@ -1,10 +1,30 @@
+# Local HTTPS reverse proxy for Next.js dev.
+#
+# Browser → Caddy (:443, HTTPS) → Next.js dev (127.0.0.1:80)
+#
+# Prerequisites:
+#   1. Add to /etc/hosts:
+#        127.0.0.1 local.xuanwu.openatom.cn
+#   2. TLS certs in this directory (moon/):
+#        ./local.xuanwu.openatom.cn.pem
+#        ./local.xuanwu.openatom.cn-key.pem
+#   3. Start Next.js dev on port 80 before Caddy.
+#
+# Usage (run from moon/):
+#   sudo caddy run --config Caddyfile          # foreground
+#   sudo caddy start --config Caddyfile        # background
+#   sudo caddy stop
+#   caddy validate --config Caddyfile
+#   caddy fmt --overwrite Caddyfile
+#
+# Open: https://local.xuanwu.openatom.cn
 {
-    # Next.js dev already owns port 80, so don't let Caddy bind it for
-    # the HTTP->HTTPS redirect vhost.
-    auto_https disable_redirects
+	# Next.js dev already owns port 80, so don't let Caddy bind it for
+	# the HTTP->HTTPS redirect vhost.
+	auto_https disable_redirects
 }
 
 https://local.xuanwu.openatom.cn {
-    tls ./local.xuanwu.openatom.cn.pem ./local.xuanwu.openatom.cn-key.pem
-    reverse_proxy 127.0.0.1:80
-}
+	tls ./local.xuanwu.openatom.cn.pem ./local.xuanwu.openatom.cn-key.pem
+	reverse_proxy 127.0.0.1:80
+}

moon/apps/web/components/ClView/components/Checks/LogViewer.tsx

@@ -321,3 +321,24 @@ export function LogViewer({ text, height }: LogViewerProps) {
     </div>
   )
 }
+
+/** Keep LogViewer mounted but visually hidden so Virtuoso retains scroll position. */
+export const CachedLogPanel = memo(function CachedLogPanel({
+  text,
+  height,
+  visible
+}: LogViewerProps & { visible: boolean }) {
+  return (
+    <div
+      className='absolute inset-0'
+      style={{
+        visibility: visible ? 'visible' : 'hidden',
+        zIndex: visible ? 1 : 0,
+        pointerEvents: visible ? 'auto' : 'none'
+      }}
+      aria-hidden={!visible}
+    >
+      <LogViewer text={text} height={height} />
+    </div>
+  )
+})