Arche
Self-hosted CLI that wires a Jira ticket to a GitLab merge request via a plan → execute → review pipeline with human approval gates. Code runs in per-run Docker sandboxes; LLM calls go through OpenRouter.
- Year
- 2026
- Role
- Solo creator
- Duration
- ~3 weeks (Apr 9 – May 1, 2026)
- Team
- Solo
- Links
- Code↗
Context
Run a planning → coding → review loop on a Jira ticket without depending on a SaaS agent platform. Everything has to run on a VPS the operator controls, with Docker isolation around code execution and human approval at the gates that matter.
What I did
- 3-process layout (CLI, Fastify server, Node worker) sharing a SQLite database via better-sqlite3 + Drizzle
- Plan / execute / review state machine with bounded review cycles, auto-retry on reviewer changes, human approval timeouts
- Docker sandbox lifecycle with tokenized command allowlist (no implicit shell escape)
- Jira + GitLab + GitHub orchestration with git remote auth
- 18 vitest files covering policy, sandbox, SQLite, lease/heartbeat, manual-run flows
Results
- Demoable end-to-end on the author's machine: Jira ticket → branch + commits → GitLab merge request
- Sandbox is hardened by default: read-only rootfs, no_new_privileges, tokenized command allowlist
- Tokenized (non-shell) command allowlist preventing pnpm test && rm -rf / style escapes
- Worker lease/heartbeat for safe concurrency on shared SQLite
- Fail-closed network bind: server aborts on non-loopback host without ARCHE_SERVER_AUTH_TOKEN
Key features
- CLI with arche init wizard, arche doctor environment checks, and arche runs manual <KEY> to trigger a run
- Fastify HTTP API (~15 endpoints) protected by bearer token, with a Jira webhook entrypoint
- React 19 + daisyUI web dashboard to monitor runs, approve plans, and view diffs/logs
- Per-run Docker sandbox (read-only rootfs, cap_drop ALL, no_new_privileges, pids/memory/cpu limits) with a tokenized (non-shell) command allowlist
- Plan / execute / review state machine with bounded max_review_cycles and human approval gates
- Multi-model execution profiles (planner / executor / reviewer) via OpenRouter
Stack
