@caelo-cms/provisioning 0.10.70 → 0.10.72

package/src/wizards/gcp-pulumi.ts

@@ -30,7 +30,12 @@ import {
   withoutAmbientGoogleCredentials,
 } from "../provisioner-identity.js";
 import { ensureGeneratedSecrets, stackSecretReplication } from "../runtime-secrets.js";
-import { ADMIN_MEMORY_DEFAULT } from "../stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "../stack-contract.js";
 import type { ResolvedBackend } from "../state-backend.js";
 
 /**
@@ -96,6 +101,13 @@ export interface PulumiUpInputs {
    * Defaults to 'gcp' for backwards compatibility.
    */
   provider?: "gcp" | "gcp-firebase";
+  /**
+   * #1082 — the remote-MCP identity the stack declares as env
+   * (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), resolved from the live
+   * install. Null when it could not be resolved (a fresh install before its
+   * first `up`): the config keeps what an earlier run wrote.
+   */
+  remoteMcpIdentity?: RemoteMcpIdentity | null;
 }
 
 export interface PulumiUpResult {
@@ -456,6 +468,7 @@ export type StackConfigInputs = Pick<
   | "wafAdaptiveProtection"
   | "iapAllowlist"
   | "imageDigests"
+  | "remoteMcpIdentity"
 > & { provider: "gcp" | "gcp-firebase" };
 
 /**
@@ -494,6 +507,13 @@ export async function applyStackConfig(
     // v0.3.2 — anthropicApiKey config dropped. Runtime path is
     // /settings/ai → ai_providers (KEK-encrypted).
     ...imageDigestConfig(provider, inputs.imageDigests),
+    ...(inputs.remoteMcpIdentity
+      ? {
+          [`${ns}:${REMOTE_MCP_IDENTITY_CONFIG}`]: {
+            value: serializeRemoteMcpIdentity(inputs.remoteMcpIdentity),
+          },
+        }
+      : {}),
   });
 
   // Read back only after the required keys are set: `pulumi config` refuses to

package/src/wizards/gcp.ts

@@ -51,6 +51,7 @@ import type { DnsRecord } from "../dns/types.js";
 import {
   activeAccount,
   type BillingAccount,
+  checkGcloudAuth,
   createProject,
   createServiceAccount,
   enableApis,
@@ -105,10 +106,20 @@ import {
 } from "../provisioner-identity.js";
 import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import { decideRegion, detectCliRegion, installableRegions, suggestRegion } from "../regions.js";
-import { ensureRemoteMcpEdge, ensureRemoteMcpIdentityEnv } from "../remote-mcp.js";
+import {
+  checkRemoteMcpIdentityEnv,
+  ensureRemoteMcpEdge,
+  findRemoteMcpTarget,
+  type RemoteMcpTarget,
+  resolveStackRemoteMcpIdentity,
+} from "../remote-mcp.js";
 import type { RunMode } from "../run-mode.js";
 import { selfCommand } from "../self-command.js";
-import { ABSENT_DEFAULT_FIREWALL_RULES } from "../stack-contract.js";
+import {
+  ABSENT_DEFAULT_FIREWALL_RULES,
+  type RemoteMcpIdentity,
+  sameRemoteMcpIdentity,
+} from "../stack-contract.js";
 import {
   chooseInstallBackend,
   describeBackend,
@@ -120,7 +131,6 @@ import {
   resolveBackend,
 } from "../state-backend.js";
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
-import { lookupFailure, resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
 import { createReleaseImageForms, platformDigestsOf } from "../upgrade/image-forms.js";
 import {
   releaseVersionForDigest,
@@ -379,12 +389,22 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // post-cleanup re-runs both pass through cleanly).
   await stepDrainLegacyCaeloAdminUser(projectId, region);
 
+  // === 9.8. The remote-MCP identity the stack declares (#1082) ===
+  // The stack owns the identity env vars (stack-contract.ts
+  // RemoteMcpIdentity) and declares them from config the CLI resolves from
+  // the live services, so this `up` keeps what they carry. A fresh install
+  // has no services yet: the identity is resolved after the first `up` and
+  // applied by a second one below.
+  const identityBefore = deployed
+    ? await stepResolveRemoteMcpIdentity(projectId, region, provider, domain, "before")
+    : null;
+
   // === 10. Pulumi up via Automation SDK ===
   // Pre-built signed images live at the Caelo-team public AR repo
   // (caelo-website/caelo-cms-images by default). Cloud Run reads them
   // directly with no operator-side IAM binding — anonymous public pull.
   phase("Provisioning the infrastructure (pulumi up, 8-15 min)");
-  await stepPulumiUp(installId, {
+  const upOpts: PulumiUpOpts = {
     projectId,
     domain,
     // #650 — the wizard recorded it (or the install predates the setting).
@@ -406,9 +426,24 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     // matching config namespace.
     provider,
     nonInteractive: opts.nonInteractive,
-  });
+  };
+  await stepPulumiUp(installId, { ...upOpts, remoteMcpIdentity: identityBefore?.identity ?? null });
   recordImageDigests(installId, imageDigests);
 
+  // === 10.05. The identity once the services exist (#1082) ===
+  // Read again after every `up`: on a fresh install (or one whose identity
+  // could not be read before) this is the first time it can be, and an `up`
+  // that replaced a service changed it. A second `up` then applies it
+  // through the stack — never through gcloud, which the next `up` would
+  // undo.
+  const identity = await stepResolveRemoteMcpIdentity(projectId, region, provider, domain, "after");
+  if (identity && !sameRemoteMcpIdentity(identity.identity, identityBefore?.identity ?? null)) {
+    log.info(
+      "Applying the remote-MCP URLs and IAP audience through the stack (second pulumi up)...",
+    );
+    await stepPulumiUp(installId, { ...upOpts, remoteMcpIdentity: identity.identity });
+  }
+
   // === 10.1. Remove the default network's pre-populated firewall rules ===
   // GCP creates them when Compute Engine is enabled (step 5). Run after
   // Pulumi rather than right after enabling the API: the default network
@@ -489,11 +524,9 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : [],
   );
 
-  // === 11.6. Remote MCP (#806): LB rules (gcp) + the identity env ===
-  // After `pulumi up` on every pass: the identity env names services Pulumi
-  // generated, so the stack cannot declare it, and an `up` that changed a
-  // service's template dropped it (remote-mcp.ts).
-  const remoteMcpReady = await stepRemoteMcp(projectId, region, provider, domain);
+  // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
+  // The env itself came with `pulumi up` (step 10.05, #1082).
+  const remoteMcpReady = await stepRemoteMcp(projectId, provider, domain, identity);
 
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
@@ -607,19 +640,20 @@ async function resolveImageDigests(): Promise<ImageDigests> {
 // Per-step helpers
 // =========================================================================
 
+/**
+ * An active gcloud account that can mint a token now. `activeAccount` alone
+ * passes with an expired login (`auth list` reads local config), and the
+ * first real gcloud call of the run then failed with a reauth error deep in
+ * a later step (#630, #1078).
+ */
 async function stepActiveGcloud(): Promise<void> {
-  const stepName = "gcloud-active";
-  const account = await activeAccount();
-  if (!account) {
-    log.error(red("No active gcloud account."));
-    log.warn(
-      `Run ${bold("gcloud auth login")} in another terminal, then re-run ${bold(selfCommand())}.`,
-    );
-    cancel("Aborted — no gcloud auth.");
+  const auth = await checkGcloudAuth();
+  if (!auth.ok) {
+    log.error(red(auth.error));
+    cancel("Aborted — nothing was changed.");
     process.exit(2);
   }
-  log.success(`gcloud auth: ${bold(account)}`);
-  void stepName;
+  log.success(`gcloud auth: ${bold(auth.account)}`);
 }
 
 async function stepProjectId(opts: GcpWizardOpts): Promise<string> {
@@ -1166,74 +1200,104 @@ async function stepOperatorAccessSync(
   s.stop(green(`Operator-access sync job ready (${r.done.length} steps)`));
 }
 
+/** The install's identity for the stack, with the deployed services it was read from. */
+interface ResolvedRemoteMcpIdentity {
+  readonly target: RemoteMcpTarget;
+  readonly identity: RemoteMcpIdentity;
+}
+
 /**
- * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
- * balancer's discovery routes and Cloud Armor rule, on both providers the
- * env vars naming the admin URL, the broker's public URL and the IAP
- * audience. Remote MCP stays off until the Owner sets it up under Settings →
- * MCP, so a failure does not stop the install: it warns, and the next pass
- * or `upgrade` retries. Idempotent.
+ * #1082 — resolve the remote-MCP identity (remote-mcp.ts
+ * resolveStackRemoteMcpIdentity) for the stack config: the deployed
+ * services' names, then their URLs / the IAP backend and the organisation.
+ * Read-only. Not fatal: remote MCP stays off until the Owner sets it up, so
+ * a failure warns and the `up` keeps the identity the config last recorded.
  *
- * @returns whether every part is in place
+ * @param when `before` the `up` (the services exist), or `after` it
+ * @returns the identity, or null when it could not be read
  */
-async function stepRemoteMcp(
+async function stepResolveRemoteMcpIdentity(
   projectId: string,
   region: string,
   provider: "gcp" | "gcp-firebase",
   domain: string,
-): Promise<boolean> {
+  when: "before" | "after",
+): Promise<ResolvedRemoteMcpIdentity | null> {
   const s = spinner();
   s.start(
-    "Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...",
+    "Reading the remote-MCP URLs and IAP audience (Google sign-in, ChatGPT / claude.ai connectors)...",
   );
-  const name = (slug: "admin" | "gateway") =>
-    resolveGcpResourceName(
-      gcloud,
-      "run-service",
-      `caelo-${GCP_STACK_ENV}-${slug}`,
-      projectId,
-      region,
-    );
-  const [adminLookup, gatewayLookup] = [await name("admin"), await name("gateway")];
   const failed = (error: string) => {
-    s.stop(yellow(`Remote MCP not prepared: ${error}`));
+    s.stop(yellow(`Remote-MCP URLs not read: ${error}`));
     log.warn(
-      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
+      when === "before"
+        ? "pulumi up keeps the remote-MCP env the stack recorded last; the installer reads it again after the update."
+        : "The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until a re-run of the installer reads them.",
     );
-    return false;
+    return null;
   };
-  if (adminLookup.status !== "found") {
-    return failed(
-      lookupFailure(adminLookup, `caelo-${GCP_STACK_ENV}-admin* Cloud Run service`, "operator"),
-    );
-  }
-  if (gatewayLookup.status !== "found") {
-    return failed(
-      lookupFailure(gatewayLookup, `caelo-${GCP_STACK_ENV}-gateway* Cloud Run service`, "operator"),
-    );
-  }
-  const [admin, gateway] = [adminLookup.name, gatewayLookup.name];
-  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
-  if (!edge.ok) return failed(edge.error);
-  const env = await ensureRemoteMcpIdentityEnv({
+  const found = await findRemoteMcpTarget({
     provider,
     projectId,
     region,
     env: GCP_STACK_ENV,
     domain,
-    services: { admin, gateway },
   });
-  if (!env.ok) return failed(env.error);
-  s.stop(green(`Remote MCP and Google sign-in prepared (${env.identity.mcpPublicUrl})`));
-  if (env.orgDomainError) {
+  if (!found.ok) return failed(found.error);
+  const { target } = found;
+  const resolved = await resolveStackRemoteMcpIdentity(target);
+  if (!resolved.ok) return failed(resolved.error);
+  s.stop(green(`Remote-MCP URLs read (${resolved.identity.mcpPublicUrl})`));
+  if (resolved.orgDomainError && when === "after") {
     // #914 — without the organisation's domain the admin cannot tell who
     // IAP's built-in sign-in admits, so it refuses new users until the
     // Owner sets up Google sign-in. Say so now rather than at the first
     // invite.
     log.warn(
-      `Could not read this project's Google organisation (${env.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
+      `Could not read this project's Google organisation (${resolved.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
+    );
+  }
+  return { target, identity: resolved.identity };
+}
+
+/**
+ * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
+ * balancer's discovery routes and Cloud Armor rule. The identity env vars
+ * (admin URL, the broker's public URL, the IAP audience) come with `pulumi
+ * up` from the stack config (#1082); this only checks that the services
+ * carry them. Remote MCP stays off until the Owner sets it up under
+ * Settings → MCP, so a failure does not stop the install: it warns, and the
+ * next pass or `upgrade` retries. Idempotent.
+ *
+ * @returns whether every part is in place
+ */
+async function stepRemoteMcp(
+  projectId: string,
+  provider: "gcp" | "gcp-firebase",
+  domain: string,
+  identity: ResolvedRemoteMcpIdentity | null,
+): Promise<boolean> {
+  const s = spinner();
+  s.start(
+    "Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...",
+  );
+  const failed = (error: string) => {
+    s.stop(yellow(`Remote MCP not prepared: ${error}`));
+    log.warn(
+      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
     );
+    return false;
+  };
+  if (!identity) return failed("its URLs and IAP audience could not be read (see above)");
+  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
+  if (!edge.ok) return failed(edge.error);
+  const check = await checkRemoteMcpIdentityEnv(identity.target, identity.identity);
+  if (!check.ok) return failed(check.error);
+  const missing = [...check.drift.admin, ...check.drift.gateway].map((c) => c.name);
+  if (missing.length > 0) {
+    return failed(`pulumi up left ${[...new Set(missing)].join(", ")} out of the services' env`);
   }
+  s.stop(green(`Remote MCP and Google sign-in prepared (${identity.identity.mcpPublicUrl})`));
   return true;
 }
 
@@ -1323,8 +1387,18 @@ async function stepKeylessProvisioner(
   const sAdc = spinner();
   sAdc.start("Checking that your Application Default Credentials can impersonate it...");
   let adc = await check();
-  if (!adc.ok && adc.reason === "no-adc" && !opts.nonInteractive) {
-    sAdc.stop(yellow("No Application Default Credentials yet"));
+  if (
+    !adc.ok &&
+    (adc.reason === "no-adc" || adc.reason === "expired-adc") &&
+    !opts.nonInteractive
+  ) {
+    sAdc.stop(
+      yellow(
+        adc.reason === "expired-adc"
+          ? "Your Application Default Credentials have expired"
+          : "No Application Default Credentials yet",
+      ),
+    );
     const login = await confirm({
       message: `Run ${bold("gcloud auth application-default login")} now (opens your browser; sign in as ${account})?`,
       initialValue: true,
@@ -1341,7 +1415,7 @@ async function stepKeylessProvisioner(
   }
   if (!adc.ok) {
     sAdc.stop(red("Infrastructure credentials not ready"));
-    log.error(adc.error);
+    log.error(`${adc.error}\nPulumi was not started.`);
     cancel("Aborted.");
     process.exit(1);
   }
@@ -1481,6 +1555,8 @@ interface PulumiUpOpts {
   provider?: "gcp" | "gcp-firebase";
   /** No terminal to ask (the install job, `--non-interactive`): see planGate. */
   nonInteractive: boolean;
+  /** #1082 — the remote-MCP identity the stack declares (gcp-pulumi.ts PulumiUpInputs). */
+  remoteMcpIdentity?: RemoteMcpIdentity | null;
 }
 
 /**

package/stacks/gcp/index.ts

@@ -37,13 +37,16 @@ import {
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
+  CLOUD_RUN_IGNORE_CHANGES,
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
   defaultStagingHost,
   GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
+  REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
+  remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   STATIC_CDN_POLICY,
   secretFileVolumesTemplate,
@@ -685,6 +688,12 @@ const envContractInputs = {
   },
 } as const;
 
+// #1082 — the remote-MCP identity env (stack-contract.ts RemoteMcpIdentity):
+// names generated identities no resource here can take as input, so the CLI
+// resolves them from the live install and writes them as config before `up`.
+// Declared here so the stack is their one owner and `up` keeps them.
+const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -740,6 +749,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
     },
     {
       ...opts,
+      // #1082 — which tool deployed last; see CLOUD_RUN_IGNORE_CHANGES.
+      ignoreChanges: [...CLOUD_RUN_IGNORE_CHANGES],
       dependsOn: [
         pgAdminUser,
         cmsAdminDb,
@@ -771,7 +782,7 @@ const adminSvc = cloudRunService({
   // in Cloud Run logs. 3600s is the platform max; no cost penalty for
   // unused timeout (Cloud Run bills running time, not allocated time).
   timeout: "3600s",
-  contractEnv: adminEnvContract(envContractInputs),
+  contractEnv: [...adminEnvContract(envContractInputs), ...remoteMcpEnv.admin],
   mediaVolume: adminMediaVolumeTemplate(adminMediaVolume(project, env)),
 });
 const gatewaySvc = cloudRunService({
@@ -786,7 +797,7 @@ const gatewaySvc = cloudRunService({
   timeout: `${GATEWAY_TIMEOUT_SECONDS}s`,
   // public_role on cms_public only: no cms_admin login of any role
   // (#613, #635, CLAUDE.md §2).
-  contractEnv: gatewayEnvContract(envContractInputs),
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...remoteMcpEnv.gateway],
 });
 
 // =========================================================================

package/stacks/gcp-firebase/index.ts

@@ -42,13 +42,16 @@ import {
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
+  CLOUD_RUN_IGNORE_CHANGES,
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
   defaultStagingHost,
   GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
+  REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
+  remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   secretFileVolumesTemplate,
 } from "../../dist/stack-contract.js";
@@ -552,6 +555,12 @@ function imageRef(service: string): string {
   return digest ? `${base}@${digest}` : `${base}:${cfg.get("image-tag") ?? "latest"}`;
 }
 
+// #1082 — the remote-MCP identity env (stack-contract.ts RemoteMcpIdentity):
+// names generated identities no resource here can take as input, so the CLI
+// resolves them from the live install and writes them as config before `up`.
+// Declared here so the stack is their one owner and `up` keeps them.
+const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -600,6 +609,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
     },
     {
       ...opts,
+      // #1082 — which tool deployed last; see CLOUD_RUN_IGNORE_CHANGES.
+      ignoreChanges: [...CLOUD_RUN_IGNORE_CHANGES],
       dependsOn: [
         pgAdminUser,
         cmsAdminDb,
@@ -654,7 +665,7 @@ const gatewaySvc = cloudRunService({
   // request passes its rate limits, captcha and honeypot; staging requests
   // pass the staging access gate.
   ingress: "INGRESS_TRAFFIC_ALL",
-  contractEnv: gatewayEnvContract(envContractInputs),
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...remoteMcpEnv.gateway],
 });
 
 const adminSvc = cloudRunService({
@@ -670,11 +681,14 @@ const adminSvc = cloudRunService({
   // Use the input string (known at config time) for the site — the
   // resource output is Output<string | undefined>, which Input<string>
   // rejects.
-  contractEnv: adminEnvContract({
-    ...envContractInputs,
-    firebaseSiteId,
-    gatewayService: gatewaySvc.name,
-  }),
+  contractEnv: [
+    ...adminEnvContract({
+      ...envContractInputs,
+      firebaseSiteId,
+      gatewayService: gatewaySvc.name,
+    }),
+    ...remoteMcpEnv.admin,
+  ],
   mediaVolume: adminMediaVolumeTemplate(adminMediaVolume(project, env)),
 });