yamine 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 46a9c0208ca1d5581c3c25d45b60370a6e37c7dd4fcf721bda7a5573fc1c70db
-  data.tar.gz: 0b534671965987794b3872969dcc3065dfca5532a401f12701e531a0779e7820
+  metadata.gz: 65dc796c2e121f6376d6a76b1baa7bb1ada3598c7facf8634262c83915c9cf2c
+  data.tar.gz: 0a2cea7a624133d68512b79e5e1060a96337a7da4948504313ea24ba6ecce080
 SHA512:
-  metadata.gz: 339e64fabec8dab3c019bfdec8ec8f9f558dc4700b647fd462c4898e4f8796f93c1b65078d9ff171c338f38c70d055a8185b1d21bb547c63831bd816c5b7c6de
-  data.tar.gz: a71d56eef8327103f46a050307bb01095810ccd70085f3728a430617d3230cf567ffe3e9a04047428d6988d63efa7dd6965546bbb5e689f270991f8d4cc55d6d
+  metadata.gz: c1f73c73193f3e9c4eae8615ad0b790111bd2c6f29615a19f35c380e99db2d2a1a239e38b10c9328795a6f1c7cf1b28b0ecce721cb5414710769ba63a99b622b
+  data.tar.gz: 2200ab3b518fac757902b25e7ec2e6933d08e2183830aba2bbf5d893622b2ded021cc7bf4f07064e6efe9ff7500dad408ea73f7bc30a4c83c25b645829bdfdf2

data/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## [0.9.0] — 2026-09-10
+
+### Fixed
+
+- **The service proxy now records its own state.** The launchd/systemd
+  service runs `proxy start --foreground`, and that path recorded
+  nothing: `write_pid` was reachable only from `spawn_daemon`. So after
+  `yamine setup`, the pid/port/scheme files still held the PREVIOUS
+  daemon's values. On a machine whose root service was serving clean
+  `https://<app>.localhost` on 443, the recorded port still said 8443 —
+  `yamine start` printed and baked `:8443` into `YAMINE_URL`, doctor
+  warned about the long-dead 8443, and `proxy stop` aimed at a pid that
+  was already gone. `setup` even contradicted itself in one run:
+  "proxy is up on port 443" followed by "listening on port 8443". The
+  foreground path now writes pid/port/tls plus a new `proxy.version`
+  marker BEFORE it serves.
+- The launchd plist and systemd unit pass `--port 443` explicitly. They
+  relied on the default, which consults `YAMINE_PORT` — one stray export
+  would silently move the boot service off 443.
+- **`proxy stop` no longer claims success on a root-owned proxy.** The
+  kill raised `Errno::EPERM`, which was swallowed by a blanket rescue:
+  the state files were cleared and "Proxy stopped." printed while the
+  service kept serving — now with nothing on disk to find or stop it by.
+  It reports `needs_root` and points at `sudo yamine service uninstall`.
+
+### Added
+
+- `doctor` gains a `proxy state` check and now finds the proxy that is
+  actually serving (`ProxyControl.serving_port`, ownership-proven)
+  instead of trusting the recorded port. It warns when the recorded port
+  disagrees with reality, and when the running proxy is an older gem
+  version than the CLI (the root service keeps serving old code after an
+  upgrade until `sudo yamine service install` re-registers it).
+- The clean default port wins when our proxy serves there, so a leftover
+  daemon on another port can no longer make the machine report a
+  downgraded URL as its state. A non-default port is still reported when
+  it is the only proxy — the deliberate CI/sandbox case.
+
+
+## [0.8.2] — 2026-09-10
+
+### Fixed
+
+- **The rest of the `--json` stdout leaks.** Two writers still reached
+  stdout during a machine-readable run, corrupting the stream a parser
+  reads: the `-> <url>` line from the sequential boot path, and
+  "Starting proxy..." — which is printed before the reporter is even
+  installed, so it would have been the FIRST line of a `--json` run.
+  Both now route through the same stderr-when-json rule as the rest of
+  the narration, and the contract is pinned by tests rather than assumed
+  (two separate leaks have now been caught here).
+
+
 ## [0.8.1] — 2026-09-10
 
 ### Fixed

data/lib/yamine/cli/boot.rb

@@ -21,7 +21,7 @@ module Yamine
         # Ownership gate before any side effects: no proxy spawn, no
         # port allocation when we'd refuse anyway.
         check_worktree_ownership!(ctx, resolved, force: opts[:force])
-        ensure_proxy!(ctx)
+        ensure_proxy!(ctx, json: opts[:json])
         boot_all(ctx, resolved, opts)
       end
 
@@ -180,7 +180,7 @@ module Yamine
             rails_dev_host: item[:hostname], database_url: db_url)
           routes_registered << { hostnames: item[:hostnames], app: app }
 
-          puts "  -> #{item[:url]}"
+          say opts, "  -> #{item[:url]}"
         end
         children
       end
@@ -548,7 +548,11 @@ module Yamine
         Yamine::Resolver.resolve(Dir.pwd, variant: variant, tld: tld)
       end
 
-      def ensure_proxy!(ctx)
+      # json: keeps stdout free for the machine-readable stream — this runs
+      # BEFORE boot_all installs the reporter, so its progress line is the
+      # one piece of narration that could still land mid-JSON and break a
+      # parser on the first line of a --json run.
+      def ensure_proxy!(ctx, json: false)
         port = ctx.proxy_port
         tls = ctx.proxy_tls
         if ProxyControl.listening?(port)
@@ -570,7 +574,8 @@ module Yamine
           $stderr.puts "  Or start the proxy by hand: sudo yamine proxy start"
           exit 1
         end
-        puts "Starting proxy#{privileged ? " (sudo)" : ""}..."
+        starting = "Starting proxy#{privileged ? " (sudo)" : ""}..."
+        json ? $stderr.puts(starting) : puts(starting)
         begin
           Yamine::ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, sudo: privileged)
         rescue Yamine::ProxyNotRunningError => e

data/lib/yamine/cli/context.rb

@@ -28,10 +28,7 @@ module Yamine
       # listening there. A dead proxy leaves the machine on the clean
       # default (443), and an explicit YAMINE_PORT always wins.
       def proxy_port
-        recorded = ProxyControl.proxy_port(store)
-        return recorded if recorded && ProxyControl.listening?(recorded)
-
-        ProxyControl.default_port(proxy_tls)
+        ProxyControl.active_port(store)
       end
 
       def proxy_tls

data/lib/yamine/cli/system.rb

@@ -70,6 +70,14 @@ module Yamine
           if foreground
             write_tls_marker(ctx, tls)
             write_tlds_file(ctx, tlds)
+            # Record BEFORE serving. This process (the launchd/systemd
+            # service, or a hand-run foreground proxy) IS the proxy, and
+            # every reader trusts these files: doctor, Context's URL
+            # building, the supervisor, `proxy stop`. Not recording left
+            # the previous proxy's port on disk, so a machine serving
+            # clean 443 still advertised :8443 everywhere.
+            ProxyControl.write_proxy_state(ctx.store,
+              pid: Process.pid, port: port, tls: tls)
             sup = Supervisor.new(store: ctx.store, runner: Runner.new(store: ctx.store),
               on_event: ->(m) { warn m })
             sup.start
@@ -85,6 +93,13 @@ module Yamine
           when :stale then puts "Removed stale proxy state."
           when :not_running then puts "Proxy is not running."
           when :unknown_process then puts "Port in use by an unknown process."
+          when :needs_root
+            # A root service keeps serving; say so rather than implying
+            # success. Uninstalling is the real answer — signalling it
+            # would just leave launchd's KeepAlive restarting it.
+            $stderr.puts "The proxy runs as root (the launchd/systemd service)."
+            $stderr.puts "  Uninstall it: sudo yamine service uninstall"
+            exit 1
           end
         else
           raise Error, "Usage: yamine proxy [start|stop]"
@@ -282,6 +297,7 @@ module Yamine
               <string>#{RbConfig.ruby}</string>
               <string>#{ProxyControl.bin_path}</string>
               <string>proxy</string><string>start</string><string>--foreground</string>
+              <string>--port</string><string>#{ProxyControl::DEFAULT_TLS_PORT}</string>
             </array>
             <key>EnvironmentVariables</key>
             <dict>
@@ -357,7 +373,7 @@ module Yamine
           After=network.target
 
           [Service]
-          ExecStart=#{RbConfig.ruby} #{ProxyControl.bin_path} proxy start --foreground
+          ExecStart=#{RbConfig.ruby} #{ProxyControl.bin_path} proxy start --foreground --port #{ProxyControl::DEFAULT_TLS_PORT}
           Environment=YAMINE_STATE_DIR=#{state_dir}
           Environment=HOME=#{home}
 

data/lib/yamine/doctor.rb

@@ -18,12 +18,18 @@ module Yamine
 
     def run(store:, port: nil, tls: nil)
       checks = []
-      port ||= ProxyControl.proxy_port(store)
       tls = ProxyControl.proxy_tls(store) if tls.nil?
+      # Prove ownership rather than trusting the port file: doctor is
+      # where a wrong answer is expensive, and a connection is cheap. This
+      # finds the proxy on the scheme default even when a stale port file
+      # says otherwise, which is how a root service serving clean 443 went
+      # unreported while doctor warned about a dead 8443.
+      port ||= ProxyControl.serving_port(store)
 
       checks << check_state_dir(store)
       checks << check_disk(store)
       checks << check_proxy(port, tls: tls)
+      checks << check_proxy_state(store, port)
       checks << check_routes(store)
       checks << check_dns(store)
       checks << check_ca
@@ -93,6 +99,41 @@ module Yamine
       end
     end
 
+    # The recorded port, and whether the proxy serving is the version we
+    # have installed.
+    #
+    # A file that disagrees with reality is the failure mode this whole
+    # area keeps producing: a stopped daemon's port outliving it made
+    # `yamine start` bake :8443 into URLs while the machine served clean
+    # 443, and a root service left from an old gem keeps serving old code
+    # after an upgrade (`sudo yamine service install` re-registers it).
+    # Neither is visible from the URL bar, so both are named here.
+    def check_proxy_state(store, serving)
+      recorded = ProxyControl.proxy_port(store)
+      version = ProxyControl.proxy_version(store)
+      problems = []
+
+      if recorded && serving && recorded != serving
+        problems << "state says port #{recorded} but the proxy is on #{serving}" \
+          " — run: yamine proxy stop"
+      elsif recorded && serving.nil?
+        problems << "state says port #{recorded}, but no yamine proxy is serving" \
+          " — run: yamine proxy stop"
+      end
+
+      if version && version != Yamine::VERSION
+        problems << "the running proxy is v#{version}, this CLI is v#{Yamine::VERSION}" \
+          " — re-register it: sudo yamine service install"
+      end
+
+      if problems.empty?
+        Check.new(name: "proxy state", ok: true, message: "consistent")
+      else
+        Check.new(name: "proxy state", ok: true, warn: true,
+          message: problems.join("; "))
+      end
+    end
+
     def check_routes(store)
       routes = store.load_routes
       if routes.empty?

data/lib/yamine/proxy_control.rb

@@ -156,17 +156,33 @@ module Yamine
       nil
     end
 
-    def write_pid(store, pid, port, tls)
+    # Record this process as THE running proxy: pid, port, scheme, and the
+    # gem version serving it.
+    #
+    # Every reader trusts these files — doctor reports the port, Context
+    # and the supervisor build URLs from it, `proxy stop` signals the pid
+    # — so a proxy that serves without recording is worse than one that
+    # fails to start: it leaves the previous proxy's state on disk and the
+    # whole CLI acts on it. The launchd/systemd service used to take
+    # exactly that path (it runs `proxy start --foreground`, which
+    # recorded nothing), so a stopped 8443 daemon's port stayed on disk
+    # and `yamine start` baked :8443 into URLs while the machine served
+    # clean https://<app>.localhost on 443.
+    def write_proxy_state(store, pid:, port:, tls:)
       store.ensure_dir
+      version_path = File.join(store.dir, "proxy.version")
       File.write(store.pid_path, "#{pid}\n")
       File.write(store.port_path, "#{port}\n")
       File.write(File.join(store.dir, "proxy.tls"), tls ? "1" : "0")
-      Ownership.fix(store.pid_path, store.port_path, File.join(store.dir, "proxy.tls"))
+      File.write(version_path, "#{Yamine::VERSION}\n")
+      Ownership.fix(store.pid_path, store.port_path,
+        File.join(store.dir, "proxy.tls"), version_path)
     end
 
     def clear_pid(store)
       FileUtils.rm_f(store.pid_path)
       FileUtils.rm_f(store.port_path)
+      FileUtils.rm_f(File.join(store.dir, "proxy.version"))
     end
 
     def proxy_port(store)
@@ -178,6 +194,54 @@ module Yamine
       nil
     end
 
+    # The gem version of the proxy that recorded its state, or nil when
+    # nothing is recorded. Compared against Yamine::VERSION so a service
+    # left behind by an older install is visible instead of silently
+    # serving stale code.
+    def proxy_version(store)
+      path = File.join(store.dir, "proxy.version")
+      return nil unless File.file?(path)
+
+      version = File.read(path).strip
+      version.empty? ? nil : version
+    rescue SystemCallError
+      nil
+    end
+
+    # Cheap resolution for the hot paths (URL building on every boot):
+    # the recorded port while something is listening there, else the
+    # scheme default. Proves liveness, not ownership — a foreign process
+    # on the recorded port still wins here and is then caught by
+    # `ensure_proxy!` ("port in use by another process"). Use
+    # `serving_port` when the answer must be OUR proxy.
+    def active_port(store)
+      recorded = proxy_port(store)
+      return recorded if recorded && listening?(recorded)
+
+      default_port(proxy_tls(store))
+    end
+
+    # Where OUR proxy is actually serving, or nil when it is not running.
+    # Proves ownership, so it costs a probe — doctor-only, where an
+    # occasional connection is free and a wrong answer is not.
+    #
+    # The default port wins when our proxy serves there, because that is
+    # the configuration yamine exists to produce: after `yamine setup`
+    # installs the 443 service, a leftover daemon on another port must not
+    # make doctor report the downgraded URL as the state of the machine.
+    # Only when the default has no proxy do we report the recorded port —
+    # which is the deliberate CI/sandbox case (`proxy start -p 1355`).
+    def serving_port(store)
+      tls = proxy_tls(store)
+      default = default_port(tls)
+      return default if ours?(default, tls: tls)
+
+      recorded = proxy_port(store)
+      return recorded if recorded && recorded != default && ours?(recorded, tls: tls)
+
+      nil
+    end
+
     # Start the proxy as a detached daemon. Sudo is used for privileged
     # ports (portless auto-elevate pattern); the state dir is passed
     # explicitly because sudo does not preserve the environment.
@@ -205,7 +269,7 @@ module Yamine
 
         sleep 0.25
       end
-      write_pid(store, pid, port, tls)
+      write_proxy_state(store, pid: pid, port: port, tls: tls)
       pid
     end
 
@@ -231,6 +295,11 @@ module Yamine
       end
       begin
         Process.kill("TERM", pid)
+      rescue Errno::EPERM
+        # The proxy runs as root (launchd/systemd service) and we do not.
+        # Clearing the state here would be a lie: the proxy keeps serving,
+        # now with nothing on disk to find or stop it by.
+        return :needs_root
       rescue SystemCallError
         clear_pid(store)
         return :stale

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.8.1"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.8.1
+  version: 0.9.0
 platform: ruby
 authors:
 - Kaka Ruto