yamine 0.10.3 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9db7f2ecccb27a731e287afd46aee1e3bcea4654ccaed6f44e1fa622ec4ba4c4
-  data.tar.gz: aa2ad6be04141dc6b4f3dabf89c67b8ff93dc8c4d296369735f2ddc8cda9201d
+  metadata.gz: 1efaa2b9488a10007f6a386cf874eb78b3e8489e9b772efb2e88713286e98e2d
+  data.tar.gz: 410ac56d153c94589d1d36fd1a6b5670ac215c6c5999ca956590acd3d7c46a98
 SHA512:
-  metadata.gz: a0787fe2e1c69fa0842fae4a4048b2eb42187ee3ce43a4b850db0e9956d32aa3c7be7c733b81574e1d619bb1f33542de31489b987fc3fde06d0351875777eac9
-  data.tar.gz: 5441bf6b2c0bf9fd8d375d22386d906c8ff71c1f35db7f8845c31dfe78fecc45c00134aec213c548e14a4bf3b6b803bb9b6e5f7b673b08c23db575f70ad832ec
+  metadata.gz: ed28898e26abce37591fb15902697e2f96d2dc4ed4bc20d951872c48f586e19482affdafb24606bbe8c95cd0016b63a637d45f23c15fd7778f6ebd9a2415e0b7
+  data.tar.gz: 075d1d80e12a0578377d956421bfbc7ac9dc61e414552262d0ffd61ea9613f1382732135c5b8e7c7af8fbfb9d54e02905d05bc53347cba7054ced38879fef0d4

data/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## [0.11.0] — 2026-09-11
+
+### Added
+
+- **Ruby, git, and curl now trust the local CA — so an app can call
+  another app at `https://<name>.localhost` with no configuration.** The
+  gap surfaced when anywaye (a Rails app) tried to reach anymark at
+  `https://anymark-directory.localhost`: `certificate verify failed`. The
+  CA was trusted everywhere a human looks (Safari, Chrome, curl) and
+  nowhere a child process looks — only Node was covered, via
+  `NODE_EXTRA_CA_CERTS`.
+
+  The naive fix is wrong in a way that shows up much later. `SSL_CERT_FILE`
+  does not *add* to OpenSSL's roots, it *replaces* them, so pointing it at
+  `~/.yamine/ca.pem` would break every public HTTPS call the app makes —
+  rubygems, payment APIs, an LLM provider — while fixing the local one. So
+  yamine now builds `~/.yamine/bundle.pem`: the system's roots plus its own
+  CA, regenerated only when either changes, and exports it as
+  `SSL_CERT_FILE` and `GIT_SSL_CAINFO` for every child. Node keeps getting
+  the CA alone, because its variable really is additive.
+
+  `yamine doctor` reports the bundle (`bundle: 129 certificates`), so a
+  missing or stale one is visible before an app fails on it, and a real
+  TLS handshake against a yamine-minted certificate is pinned by a test —
+  not just the presence of the environment variables.
+
+## [0.10.4] — 2026-09-11
+
+### Fixed
+
+- **A stale `tmp/pids/server.pid` no longer kills the boot 2s in.** The
+  anywaye incident: an interrupted earlier run left puma alive, Rails
+  refused to start ("A server is already running (pid: N)"), `web` died
+  before its first healthcheck, and the failure line only said "process
+  exited" — the actual reason sat in the log file. Now:
+  - Pre-flight `Readiness.server_pid_conflict` checks the pidfile BEFORE
+    spawning. A live holder is a conflict, not a mystery crash; a dead
+    pid is fine (Rails overwrites it).
+  - When the holder is this app's own leftover puma (`puma ... [app]`),
+    yamine reaps it automatically. Anything else fails with the exact
+    fix (`kill N && rm tmp/pids/server.pid`), or `--force` to take over.
+  - `Readiness.fatal_line` recognizes the common killers (already
+    running, address in use, missing gems, missing database) in the
+    process's own log and puts the real reason in the failure line.
+- **No more orphans on any failure path.** The incident left puma +
+  solid-queue + ask-app-server running for 24 minutes with no routes
+  after the CLI exited. Now `Runner#boot_run` reaps the backend when
+  registration is refused (quota/conflict), `boot_concurrent` tracks
+  every spawned HTTP backend in `children` before adopt, and `boot_all`
+  wraps spawn+boot so a raise mid-boot kills every child and removes
+  every route already registered. Tests pin all three (with `expects`
+  so they cannot pass vacuously).
+
 ## [0.10.3] — 2026-09-11
 
 ### Added

data/lib/yamine/certs.rb

@@ -44,6 +44,12 @@ module Yamine
       { cert: File.join(dir, "ca.pem"), key: File.join(dir, "ca-key.pem") }
     end
 
+    # The CA certificate's path on disk. Generated on first ask.
+    def ca_cert_path(dir = state_dir)
+      ensure_ca(dir)
+      ca_paths(dir)[:cert]
+    end
+
     def ensure_ca(dir = state_dir)
       FileUtils.mkdir_p(dir, mode: 0o755)
       Ownership.fix(dir)
@@ -79,6 +85,68 @@ module Yamine
        OpenSSL::PKey.read(File.read(paths[:key]))]
     end
 
+    # A CA bundle a child process can verify against: the system roots
+    # *plus* this CA.
+    #
+    # Why a bundle and not just the CA: `SSL_CERT_FILE` (Ruby/OpenSSL,
+    # curl, git) *replaces* the default store rather than adding to it, so
+    # pointing it at a file containing only our CA makes every public
+    # HTTPS request in that process fail verification. Concatenating gives
+    # both — yamine's names verify and rubygems, APIs, and git-over-https
+    # keep working.
+    #
+    # Built fresh when the CA or the system store changes, and cached
+    # otherwise: the bundle is ~230 KB and regenerating it on every boot
+    # would be pure waste, while serving a stale one after `yamine trust`
+    # regenerates the CA would silently break every TLS connection in the
+    # app.
+    def bundle_path(dir = state_dir)
+      File.join(dir, "bundle.pem")
+    end
+
+    # The system's own roots, in the order OpenSSL would consider them.
+    # SSL_CERT_FILE wins when set (that is the variable we are about to
+    # write, and a caller may have pointed it somewhere deliberately),
+    # else OpenSSL's compiled-in file, else the usual macOS/Linux paths.
+    def system_bundle
+      candidates = [ENV["SSL_CERT_FILE"],
+        OpenSSL::X509::DEFAULT_CERT_FILE,
+        "/etc/ssl/cert.pem",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        "/etc/ssl/certs/ca-certificates.crt"].compact
+      candidates.find { |path| File.file?(path) && File.size(path).positive? }
+    end
+
+    def ensure_bundle(dir = state_dir)
+      paths = ensure_ca(dir)
+      target = bundle_path(dir)
+      ca = File.read(paths[:cert])
+      system_file = system_bundle
+      # Regenerate when the CA changed, when the system store changed, or
+      # when the bundle is missing. mtime comparison is enough: these files
+      # are written by installers, not edited in place.
+      return target if bundle_current?(target, paths[:cert], system_file)
+
+      FileUtils.mkdir_p(dir)
+      content = +""
+      content << File.read(system_file) if system_file
+      content << "\n" unless content.empty? || content.end_with?("\n")
+      content << ca
+      File.write(target, content, mode: "w", perm: 0o644)
+      Ownership.fix(target)
+      target
+    end
+
+    def bundle_current?(target, ca_path, system_file)
+      return false unless File.file?(target)
+
+      target_mtime = File.mtime(target)
+      return false if File.mtime(ca_path) > target_mtime
+      return false if system_file && File.mtime(system_file) > target_mtime
+
+      true
+    end
+
     # Mint a leaf cert for one hostname, signed by the CA.
     def mint_host(hostname, ca_cert, ca_key)
       key = OpenSSL::PKey::EC.generate("prime256v1")

data/lib/yamine/cli/boot.rb

@@ -90,6 +90,28 @@ module Yamine
           exit 1
         end
 
+        # Pre-flight: a live tmp/pids/server.pid makes Rails refuse to
+        # boot ("A server is already running") the moment web starts.
+        # When the holder is this app's own puma (`puma ... [app]`), take
+        # over automatically — that is one of ours. Anything else is not
+        # ours to kill: fail with the exact fix before spawning.
+        conflict_ok, conflict_detail, conflict_pid = Readiness.server_pid_conflict(Dir.pwd)
+        unless conflict_ok
+          if own_orphan_puma?(conflict_pid, resolved.app, Dir.pwd)
+            say opts, "  reaping own orphaned server (pid #{conflict_pid})"
+            reap_stale_server(conflict_pid)
+          elsif opts[:force]
+            say opts, "  --force: taking over pid #{conflict_pid}"
+            reap_stale_server(conflict_pid)
+          else
+            $stderr.puts "Error: #{conflict_detail}."
+            $stderr.puts "  Rails will refuse to boot while it runs. Free it first:"
+            $stderr.puts "    kill #{conflict_pid} && rm tmp/pids/server.pid"
+            $stderr.puts "  Or re-run with --force to let yamine take over that pid."
+            exit 1
+          end
+        end
+
         runner = Runner.new(store: ctx.store)
         children = []
         routes_registered = []
@@ -111,12 +133,21 @@ module Yamine
         with_wait = !opts[:no_wait]
         spawn_plan = collect_spawns(ctx, runner, resolved, opts, db_url, children)
 
-        if with_wait
-          boot_concurrent(ctx, runner, resolved, opts, spawn_plan, children,
-            routes_registered, db_url, db_name, db_created, events: events)
-        else
-          boot_sequential(ctx, runner, resolved, opts, spawn_plan, children,
-            routes_registered, db_url, events: events)
+        begin
+          if with_wait
+            boot_concurrent(ctx, runner, resolved, opts, spawn_plan, children,
+              routes_registered, db_url, db_name, db_created, events: events)
+          else
+            boot_sequential(ctx, runner, resolved, opts, spawn_plan, children,
+              routes_registered, db_url, events: events)
+          end
+        rescue StandardError
+          # A raise mid-boot (route conflict, quota, unexpected error)
+          # must never leave half a tree running: reap every child and
+          # every route already registered, then surface the error.
+          children.each { |c| stop_spawned_pid(c[:pid]) }
+          cleanup_routes(ctx, routes_registered.flat_map { |r| r[:hostnames] })
+          raise
         end
 
         background = processes.select { |_, v| v["proxy"] == false }
@@ -137,6 +168,35 @@ module Yamine
         supervise_tree(ctx, all_hostnames, named_pids, reporter: events)
       end
 
+      # TERM the old server and make sure the pidfile no longer names
+      # a live process before we spawn (wait a moment; then remove the
+      # file if the process is still refusing to die, so Rails can boot
+      # over it — the socket it held is already ours to take).
+      def reap_stale_server(pid)
+        Process.kill("TERM", pid)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 5
+        while Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+          break unless ProxyControl.pid_alive?(pid)
+          sleep 0.2
+        end
+        FileUtils.rm_f(File.join(Dir.pwd, "tmp", "pids", "server.pid"))
+      rescue SystemCallError
+        FileUtils.rm_f(File.join(Dir.pwd, "tmp", "pids", "server.pid"))
+      end
+
+      # Is this pid a leftover backend of THIS app? `puma (tcp://...)
+      # [app]` names the app; we also accept a command containing the
+      # app dir. Only then may we reap it unasked.
+      def own_orphan_puma?(pid, app, dir)
+        _out, status = Open3.capture2("ps", "-p", pid.to_s, "-o", "command=")
+        return false unless status.success?
+
+        cmd = _out.to_s
+        cmd.include?("[#{app}]") || cmd.include?(File.expand_path(dir))
+      rescue SystemCallError
+        false
+      end
+
       # One pass over config: background processes spawn immediately
       # (no route to wait on), HTTP processes become a spawn plan the
       # boot mode executes. Compound-line refusal happens here so both
@@ -198,12 +258,18 @@ module Yamine
         apps = {}
         plan.each do |item|
           say opts, "  [#{item[:name]}] #{item[:url]}"
+          app = runner.spawn_http(name: item[:name], hostname: item[:hostname],
+            url: item[:url], dir: Dir.pwd, command: item[:command],
+            port: item[:port], rails_dev_host: item[:hostname],
+            database_url: db_url, force: opts[:force])
+          # Tracked before registration so any later failure (a raise
+          # during adopt, a crash while another process waits) can
+          # always reap it. Duplicate names in named_pids are harmless.
+          children << { name: item[:name], pid: app.pid }
           apps[item[:name]] = {
             item: item,
-            app: runner.spawn_http(name: item[:name], hostname: item[:hostname],
-              url: item[:url], dir: Dir.pwd, command: item[:command],
-              port: item[:port], rails_dev_host: item[:hostname],
-              database_url: db_url, force: opts[:force])
+            log_path: File.join(Dir.pwd, "log", "yamine-#{item[:name]}.log"),
+            app: app
           }
         end
         wait_result = Readiness.wait_all(apps, sink: events)

data/lib/yamine/doctor.rb

@@ -33,6 +33,7 @@ module Yamine
       checks << check_routes(store)
       checks << check_dns(store)
       checks << check_ca
+      checks << check_ca_bundle
       checks
     end
 
@@ -195,6 +196,22 @@ module Yamine
       end
     end
 
+    # The child-process trust bundle. Its absence is not theoretical: an
+    # app whose process was started before the bundle existed (or with a
+    # regenerated CA) fails every call to another *.localhost with
+    # "certificate verify failed". Regenerating it here is safe and is
+    # exactly what the next boot would do anyway.
+    def check_ca_bundle
+      dir = Certs.state_dir
+      return Check.new(name: "bundle", ok: false, message: "no CA yet — run: yamine trust") unless File.file?(Certs.ca_paths(dir)[:cert])
+
+      target = Certs.ensure_bundle(dir)
+      count = File.read(target).scan("BEGIN CERTIFICATE").size
+      Check.new(name: "bundle", ok: true, message: "#{count} certificates (system roots + yamine CA)")
+    rescue StandardError => e
+      Check.new(name: "bundle", ok: false, message: "could not build #{Certs.bundle_path(dir)}: #{e.message}")
+    end
+
     # How many trusted certificates carry one of our CA names without
     # being the CA currently on disk. Best-effort: 0 when the keychain
     # cannot be read (doctor must never fail on a read-only probe).

data/lib/yamine/readiness.rb

@@ -168,8 +168,7 @@ module Yamine
       until Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
         unless process_alive?(app.pid)
           ms = elapsed_ms(started)
-          return fail_result(name, started, ms,
-            "process exited before becoming healthy — see log/yamine-#{name}.log", sink)
+          return fail_result(name, started, ms, died_detail(name, slot), sink)
         end
         ok, detail = probe(item[:hostname], item[:port], path: path)
         if ok
@@ -182,13 +181,24 @@ module Yamine
       ms = elapsed_ms(started)
       status = process_alive?(app.pid) ? "timeout" : "fail"
       detail = process_alive?(app.pid) ? "no healthy response within #{timeout}s (#{last_error})" :
-        "process exited before becoming healthy — see log/yamine-#{name}.log"
+        died_detail(name, slot)
       event = Event.new(phase: "process", action: name, status: status,
         duration_ms: ms, detail: detail)
       sink&.event(event)
       { name: name, status: status, phase: "process", detail: detail, duration_ms: ms }
     end
 
+    # Why a process that died before answering died: the recognized
+    # fatal line when there is one, else point at its log.
+    def died_detail(name, slot)
+      reason = fatal_line(slot[:log_path])
+      if reason
+        "process exited: #{reason} (log/yamine-#{name}.log)"
+      else
+        "process exited before becoming healthy — see log/yamine-#{name}.log"
+      end
+    end
+
     def ok_result(name, started, ms, path, sink)
       detail = path ? "healthcheck #{path} returned 2xx-3xx" : "port accepted connection"
       event = Event.new(phase: "process", action: name, status: "ok",
@@ -204,6 +214,53 @@ module Yamine
       { name: name, status: "fail", phase: "process", detail: detail, duration_ms: ms }
     end
 
+    # Rails refuses to boot when tmp/pids/server.pid names a live
+    # process ("A server is already running (pid: N)") — the classic
+    # interrupted-run leftover. Report the exact reason and the fix
+    # BEFORE spawning anything, instead of letting `web` die 2s later.
+    # Returns [ok, detail, pid]; ok is true when there is nothing in the
+    # way (no file, unreadable, or a dead pid — Rails overwrites those).
+    def server_pid_conflict(dir = Dir.pwd)
+      path = File.join(dir, "tmp", "pids", "server.pid")
+      return [true, nil, nil] unless File.file?(path)
+
+      pid = File.read(path).strip.to_i
+      return [true, nil, nil] unless pid.positive? && process_alive?(pid)
+
+      [false, "a Rails server is already running (pid #{pid}, from #{path})", pid]
+    rescue SystemCallError, ArgumentError
+      [true, nil, nil]
+    end
+
+    # Known fatal patterns in a dying backend's log. The log line that
+    # killed the process is more useful than "process exited" — agents
+    # should not have to open the file to learn why.
+    FATAL_PATTERNS = [
+      [/A server is already running \(pid:\s*(\d+)/i,
+        ->(m) { "another server is already running (pid #{m[1]}); stale tmp/pids/server.pid" }],
+      [/Address already in use/i,
+        ->(_m) { "address already in use; another process holds the port" }],
+      [/Bundler::GemNotFound|Could not find .* locally installed gems|run `?bundle install/i,
+        ->(_m) { "gems missing; run `bundle install`" }],
+      [/ActiveRecord::NoDatabaseError|PG::ConnectionBad|database .* does not exist/i,
+        ->(_m) { "database unreachable or missing; check DATABASE_URL / the database server" }]
+    ].freeze
+
+    def fatal_line(path)
+      return nil unless path && File.file?(path)
+
+      lines = File.readlines(path).last(80)
+      FATAL_PATTERNS.each do |pattern, describe|
+        match = lines.reverse.find { |l| l.match?(pattern) }
+        next unless match
+
+        return describe.call(match.match(pattern))
+      end
+      nil
+    rescue SystemCallError
+      nil
+    end
+
     def process_alive?(pid)
       Process.kill(0, pid)
       true

data/lib/yamine/runner.rb

@@ -103,10 +103,17 @@ module Yamine
       Process.detach(pid)
       target = "127.0.0.1:#{port}"
       if register
-        spec ||= { "dir" => File.expand_path(dir), "proc" => name }
-        @store.add_route(hostname, target, Process.pid, kind: "tcp",
-          force: force, spec: spec)
-        write_backend_pid(hostname, pid)
+        begin
+          spec ||= { "dir" => File.expand_path(dir), "proc" => name }
+          @store.add_route(hostname, target, Process.pid, kind: "tcp",
+            force: force, spec: spec)
+          write_backend_pid(hostname, pid)
+        rescue StandardError
+          # Registration refused (quota, conflict): the backend is
+          # already spawned — never leave it running without a route.
+          stop_pid(pid)
+          raise
+        end
       end
       App.new(name: name, hostname: hostname, url: url, pid: pid,
         target: target, kind: "tcp", command: command)
@@ -148,8 +155,26 @@ module Yamine
       env = { "YAMINE_URL" => url }
       env["PORT"] = port.to_s if port
       env["HOST"] = "127.0.0.1"
-      ca = File.join(Certs.state_dir, "ca.pem")
-      env["NODE_EXTRA_CA_CERTS"] = ca if File.file?(ca)
+
+      # TLS: yamine's names present certificates signed by its own CA, so
+      # every process that talks to one of them has to be told to trust it.
+      # Three clients, three conventions — and getting this wrong is not
+      # subtle. A Ruby app calling https://other-app.localhost fails with
+      # "certificate verify failed", which reads as a broken app rather
+      # than a missing trust setting:
+      #
+      #   * Ruby/OpenSSL, curl, and git honor SSL_CERT_FILE — but it
+      #     *replaces* the store, so it points at the bundle (the system's
+      #     roots plus our CA), never at our CA alone; a CA-only file would
+      #     break every public HTTPS call the app makes.
+      #   * git takes GIT_SSL_CAINFO as its own override.
+      #   * Node ignores both and reads NODE_EXTRA_CA_CERTS, which is
+      #     additive — the CA by itself is right there.
+      bundle = Certs.ensure_bundle
+      env["NODE_EXTRA_CA_CERTS"] = Certs.ca_cert_path
+      env["SSL_CERT_FILE"] = bundle
+      env["GIT_SSL_CAINFO"] = bundle
+
       # Rails blocks unknown Host headers in development. Allow the
       # proxied hostname so Rails apps boot behind yamine with zero
       # config — this replaces the yamine-rails hosts patch.

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.10.3"
+  VERSION = "0.11.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.10.3
+  version: 0.11.0
 platform: ruby
 authors:
 - Kaka Ruto