feat(recipes): seed the index with caddy

[NovusEdge]

Why

index.toml shipped with an empty [recipes] table. No index name resolved, so add_recipe, update_recipe and remove_recipe had no coverage past their argument guards, and the project-workflow guide had to tell readers the index was empty.

What

• index.toml gains a caddy entry pointing at NovusEdge/stoat-recipe-caddy.
• Four tests in internal/core cover the three tools' core paths: index-name resolution, the bundled-name collision, ref repinning, and the in-use removal refusal with its force path.
• docs/recipes/sharing.md documents how to publish an entry. docs/guides/project-workflow.md no longer says the index is empty.
• core.Update now keeps allow_exec in step with agent_access.

The allow_exec bug

core.Update set AgentAccess without recomputing AllowExec. stoat update <vm> --agent-access exec left vm.toml with agent_access = "exec" and allow_exec = false, breaking the invariant stated at internal/core/core.go:293. Enforcement reads AgentAccess, so exec worked; the stale value reached readers of the legacy allow_exec field, which every MCP VM payload still carries. Found by raising a test VM to exec and reading vm_status back.

The bundled-name rule

CheckCollision refuses an index name that repeats a bundled recipe, and add_recipe passes no force. An entry named tailscale, docker, xfce, devtools, build-deps, pkg-tools, python-dev or service-tools is therefore unreachable from an agent. Both index.toml and the sharing guide state it.

Testing

The recipe ran on a real Ubuntu 24.04 cloud VM: package installed from noble universe, caddy.service enabled and active, generated Caddyfile in place, curl localhost:8080 returning 200 with the expected body, both outputs recorded, health ok, and all of it intact across a stop/start.

add, update, update with no name, and rm were driven through the CLI against a local index repo before the Go tests were written.

Draft until the recipe repository is public

The entry's source does not resolve yet. Merging before NovusEdge/stoat-recipe-caddy exists would make stoat recipe search list a name that stoat recipe add cannot install.

[coderabbitai]

Warning

Review limit reached

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 23dc4461-d287-4ef0-aa45-6d5c64932b1f

📥 Commits

Reviewing files that changed from the base of the PR and between 3469f78 and bdc9eb8.

📒 Files selected for processing (9)

• CHANGELOG.md
• docs/guides/project-workflow.md
• docs/recipes/sharing.md
• index.toml
• internal/core/remote_recipes_test.go
• internal/core/snapshot.go
• internal/core/snapshot_test.go
• internal/core/update.go
• internal/core/update_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}