yamine 0.7.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1003241d7826eb9d1b2c1f511a7e9b8e99f4be0d9438d2651dd86864d3cee1cc
-  data.tar.gz: 58ee2023a0f951f508c5032af8079d9417f97427bf76d48af08ec734661fd7a7
+  metadata.gz: 96bdebf9dc726c4caf747a07f2599bbde292a975e3395bd7cf43b1daf752bea3
+  data.tar.gz: 4abda73bc87a74f344070a3d69e87d470b788f05d04abfa4d6fb5783649fea20
 SHA512:
-  metadata.gz: ea87625511591d754116bda3a16849466d9d982c7ba8f69a773508e36142e224e9c9a9ed96335c2f1d28c28f285116a488caa5c34d4ab7704cb06b4bb1d14a3f
-  data.tar.gz: 701589715a07e31778aefd39c60d05f7bdd9c865d77d72517f0a3881054046067ae60c2dc3ae97ecebe6f8b1dfd238ab95de5dd12d3a163bbd0f63aefaba9f3a
+  metadata.gz: 627bc6d9fcb038635d90ec9b49eb7a321fae414cb58ed584b02f4bcc7fbd8fd3a49fe98b610d7fb033564c416ab8ccdbed1b87c5ef6983ef7c70023eca351110
+  data.tar.gz: 19a0c6f70d82fddf4385c616e820d04d00a12d60be5016a13ce12054da5bf82aeb5fc7a47940d030518645eda95dac28a1957502d7df139715da65695681863f

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.7.1] — 2026-09-10
+
+### Fixed
+
+- **`yamine start` now honors `YAMINE_PORT`.** `ensure_workstation!`
+  hardcoded port 443, so the documented escape hatch for CI and
+  sandboxes — "where 443 is impossible" — was ignored: with
+  `YAMINE_PORT=8443` on a non-interactive machine, `start` aborted with
+  "port 443 needs root to bind" and demanded sudo for a port the user
+  had deliberately chosen to avoid. The port and scheme now come from
+  the context, and an unprivileged port is started directly instead of
+  being treated as a setup failure. The root path is unchanged: 443 on a
+  non-interactive machine still points at `yamine setup`.
+
 ## [0.7.0] — 2026-09-10
 
 Keeping the no-port promise when the machine's recorded port goes stale,

data/lib/yamine/cli/system.rb

@@ -700,9 +700,15 @@ module Yamine
 
 
       # Quiet workstation setup for `start`: trust the CA, ensure a proxy
-      # on 443 (root service, sudo daemon fallback), and sync hosts.
-      # Each step is idempotent; only missing pieces run. Non-interactive
-      # CI without a proxy fails fast rather than prompting for sudo.
+      # on this run's port (443 by default — root service, sudo daemon
+      # fallback), and sync hosts. Each step is idempotent; only missing
+      # pieces run. Non-interactive CI without a proxy fails fast rather
+      # than prompting for sudo.
+      #
+      # The port comes from ctx, not a literal: YAMINE_PORT is the
+      # documented escape hatch for CI and sandboxes ("where 443 is
+      # impossible"), and hardcoding 443 here demanded root for a port
+      # those users had already chosen to avoid.
       def ensure_workstation!(ctx)
         # 1. CA
         unless Yamine::Certs.trusted?(ctx.store.dir)
@@ -714,19 +720,30 @@ module Yamine
           end
         end
 
-        # 2. Proxy on 443
-        port = 443
-        tls = true
+        # 2. Proxy on the port this run wants
+        port = ctx.proxy_port
+        tls = ctx.proxy_tls
         unless Yamine::ProxyControl.listening?(port) && ProxyControl.ours?(port, tls: tls)
-          if port < 1024 && !Yamine::ProxyControl.root? && !ctx.interactive?
-            abort_setup("Proxy is not running and port 443 needs root to bind.", *privileged_port_hint)
+          privileged = port < 1024
+          if privileged && !Yamine::ProxyControl.root? && !ctx.interactive?
+            abort_setup("Proxy is not running and port #{port} needs root to bind.", *privileged_port_hint)
           end
           ok =
             if ProxyControl.root?
               Yamine::CLI::SystemCommand.ensure_root_service(ctx)
             elsif ctx.interactive?
               begin
-                Yamine::ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, sudo: true)
+                Yamine::ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, sudo: privileged)
+                wait_for_ours(ctx, port, tls: tls)
+              rescue Yamine::ProxyNotRunningError, SystemCallError => e
+                warn "    daemon start failed: #{e.message.lines.first&.strip}"
+                false
+              end
+            elsif !privileged
+              # Non-interactive but unprivileged: nothing to elevate, so
+              # start the daemon directly instead of failing.
+              begin
+                Yamine::ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, sudo: false)
                 wait_for_ours(ctx, port, tls: tls)
               rescue Yamine::ProxyNotRunningError, SystemCallError => e
                 warn "    daemon start failed: #{e.message.lines.first&.strip}"
@@ -736,7 +753,8 @@ module Yamine
               false
             end
           unless ok
-            abort_setup("Proxy is not running and could not be started on port 443.", *privileged_port_hint)
+            abort_setup("Proxy is not running and could not be started on port #{port}.",
+              *privileged_port_hint)
           end
         end
 

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.7.0"
+  VERSION = "0.7.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Kaka Ruto