@catheadowl/ukp 0.2.2 → 0.2.4

package/src/commands/serve-task.ts

@@ -0,0 +1,198 @@
+/** Windows resident-door artifact generator (W12): `ukp serve --print-task`
+ * renders the process-manager artifacts for an https door on a Windows host
+ * — the start script, the hidden launcher (vbs), the Task Scheduler command,
+ * the firewall rule — as text the operator reviews and applies. Print-only
+ * by construction: UKP installs nothing, starts nothing, and never sees the
+ * real token (the script line carries a placeholder; the operator pastes the
+ * token into the file they save, under their own permission regime).
+ *
+ * The emitted shapes mirror the machine-verified liku recipe (deployment
+ * handbook, Windows section): a bare `ukp` resolves through the logged-on
+ * task's per-user PATH and the self-locating launcher finds bun itself, so
+ * no PATH export is emitted. The hidden launcher is the product default
+ * (owner ruling 2026-09-21: a visibly popping cmd window is not a correct
+ * product form): zero flash (hidden at process creation), door.log capture,
+ * exit-code propagation, bounded crash retry — Task Scheduler's own
+ * restart-on-failure does not fire on exit codes (disproven on liku). */
+
+export interface ServeTaskTlsSelfSigned {
+  mode: "self-signed";
+  sanEntries: string[];
+}
+
+export interface ServeTaskTlsCertificates {
+  mode: "certificates";
+  certPath: string;
+  keyPath: string;
+}
+
+export type ServeTaskTls = ServeTaskTlsSelfSigned | ServeTaskTlsCertificates;
+
+export interface ServeTaskInput {
+  /** Present = single-endpoint mode; absent = host door mode. */
+  endpoint?: string;
+  host: string;
+  port: number;
+  tls?: ServeTaskTls;
+}
+
+/** Door-shape guards the command layer runs before printing. Pure so both
+ * platforms are testable: `platform` is `process.platform` in production.
+ * These mirror what serve itself would refuse at task start — they never
+ * widen admission, and the TLS one stops a dead-end artifact before it is
+ * applied (clients refuse to register plain-http urls off loopback). */
+export function printTaskPreflightError(input: {
+  platform: string;
+  host: string;
+  hasTls: boolean;
+  allowAnonymous: boolean;
+}): string | undefined {
+  if (input.platform !== "win32") {
+    return "--print-task is Windows-only; on Linux prefer systemd socket activation (ukp serve --systemd-socket) - the deployment handbook carries that recipe";
+  }
+  const loopback =
+    input.host === "127.0.0.1" || input.host === "localhost" || input.host === "::1" || input.host === "[::1]";
+  if (!loopback && !input.hasTls) {
+    return "refusing to print an off-loopback door without TLS: clients refuse to register plain-http urls - pass --tls (self-signed, pinned at registration) or --tls-cert/--tls-key, or bind loopback behind a TLS-terminating proxy";
+  }
+  if (input.allowAnonymous && !loopback) {
+    return "refusing to print this shape: --allow-anonymous is loopback-only and serve would refuse it at task start - set the token in the generated script instead";
+  }
+  return undefined;
+}
+
+function serveCommandLine(input: ServeTaskInput): string {
+  const tls =
+    input.tls === undefined
+      ? []
+      : input.tls.mode === "self-signed"
+        ? ["--tls", ...input.tls.sanEntries.map((entry) => `--tls-san ${entry}`)]
+        : [`--tls-cert "${input.tls.certPath}"`, `--tls-key "${input.tls.keyPath}"`];
+  return [
+    "ukp serve",
+    ...(input.endpoint !== undefined ? [`--endpoint ${input.endpoint}`] : []),
+    `--host ${input.host}`,
+    `--port ${input.port}`,
+    ...tls,
+  ].join(" ");
+}
+
+/** Parent directory of a path string, or undefined for a bare filename. */
+function parentDirOf(path: string): string | undefined {
+  const cut = Math.max(path.lastIndexOf("\\"), path.lastIndexOf("/"));
+  return cut > 0 ? path.slice(0, cut) : undefined;
+}
+
+export function renderServeTaskArtifacts(input: ServeTaskInput): string {
+  const serveLine = serveCommandLine(input);
+  const out: string[] = [
+    "ukp serve --print-task - Windows resident-door artifacts",
+    "",
+    "Print-only: review these, then apply them yourself. UKP installs nothing,",
+    "starts nothing, and supervises nothing - the door's lifecycle belongs to",
+    "you and your process manager.",
+    "",
+  ];
+
+  if (input.tls?.mode === "certificates") {
+    const certDir = parentDirOf(input.tls.certPath);
+    out.push(
+      "0) Certificate - generate ONCE (Git for Windows' openssl works; this",
+      "   avoids any runtime openssl dependency of --tls):",
+      "",
+      "   openssl req -x509 -newkey rsa:2048 -nodes -days 825 -keyout",
+      `   ${input.tls.keyPath} -out ${input.tls.certPath}`,
+      "   -subj \"/CN=ukp\" -addext \"subjectAltName=IP:<lan-ip>,DNS:localhost\"",
+      "",
+      "   The SAN must carry the address consumers dial (find <lan-ip> with",
+      "   ipconfig); a mismatch fails registration with a certificate name",
+      "   error. Renewing over the same key keeps client pins valid.",
+      "",
+    );
+    if (certDir !== undefined) {
+      out.push(`   (openssl will not create the directory: if not exist "${certDir}" mkdir "${certDir}" first)`, "");
+    }
+  }
+
+  out.push(
+    "1) Start script - save as %USERPROFILE%\\.ukp\\start-door.cmd",
+    "   (write it with a real editor and CRLF line endings; writing cmd",
+    "   files over ssh echo mangles % escaping)",
+    "",
+    "   @echo off",
+    "   rem UKP resident door (generated by ukp serve --print-task)",
+    "   rem The token line is the only secret: mint a long random string",
+    "   rem (e.g. openssl rand -hex 32), paste it in, keep this file private.",
+    "   set \"UKP_SERVE_TOKEN=<paste-your-token>\"",
+    "   rem ukp resolves through the logged-on task's per-user PATH; the",
+    "   rem launcher finds bun itself - no PATH export needed.",
+    "   if not exist \"%USERPROFILE%\\.ukp\" mkdir \"%USERPROFILE%\\.ukp\"",
+    `   ${serveLine} >> "%USERPROFILE%\\.ukp\\door.log" 2>&1`,
+    "",
+    "2) Hidden launcher - save as %USERPROFILE%\\.ukp\\start-door-hidden.vbs",
+    "   (CRLF and a real editor again: the vbs carries literal % signs that",
+    "   ssh echo would expand - copy the file instead)",
+    "",
+    "   ' UKP door hidden launcher: runs start-door.cmd with NO visible",
+    "   ' window (hidden at process creation - nothing flashes), captures",
+    "   ' everything to door.log, waits out the door's lifetime, propagates",
+    "   ' its exit code, and retries a crashed door 3 times, 30s apart.",
+    "   Dim shell : Set shell = CreateObject(\"WScript.Shell\")",
+    "   Dim q : q = Chr(34)",
+    "   Dim home : home = shell.ExpandEnvironmentStrings(\"%USERPROFILE%\")",
+    "   Dim cmdline : cmdline = \"cmd /c \" & q & q & home & \"\\.ukp\\start-door.cmd\" & q & \" >> \" & q & home & \"\\.ukp\\door.log\" & q & \" 2>&1\" & q",
+    "   Dim rc : rc = 0",
+    "   Dim attempt",
+    "   For attempt = 1 To 3",
+    "     rc = shell.Run(cmdline, 0, True)",
+    "     If rc = 0 Then Exit For",
+    "     If attempt < 3 Then WScript.Sleep 30000",
+    "   Next",
+    "   WScript.Quit rc",
+    "",
+    "3) Scheduled task - starts the door at LOGON, hidden",
+    "   (create it from an elevated shell: creating an ONLOGON task from a",
+    "    plain shell fails with Access denied)",
+    "",
+    "   schtasks /Create /TN ukp-door /TR \"wscript.exe \\\"%USERPROFILE%\\.ukp\\start-door-hidden.vbs\\\"\" /SC ONLOGON /F",
+    "   schtasks /Run /TN ukp-door",
+    "",
+    "4) Firewall rule for the port (from an elevated shell)",
+    "",
+    `   netsh advfirewall firewall add rule name="ukp-door" dir=in action=allow protocol=TCP localport=${input.port}`,
+    "",
+    "Notes:",
+    ...(input.tls?.mode === "self-signed"
+      ? [
+          "- --tls self-signs at first start using an openssl on PATH (Git",
+          "  for Windows' openssl qualifies). On a host with no openssl",
+          "  anywhere, pre-generate the certificate once instead: re-run with",
+          "  --tls-cert/--tls-key - the handbook's Windows section carries",
+          "  that recipe.",
+        ]
+      : []),
+    "- No visible window, by design: the hidden launcher starts the console",
+    "  hidden at process creation (nothing ever flashes on the desktop) and",
+    "  captures everything to door.log - that redirect is the paper trail (a",
+    "  silent EADDRINUSE exit leaves a line).",
+    "- Crash self-recovery is the launcher's bounded retry: a non-zero exit",
+    "  is retried up to 3 times, 30s apart; exhausted retries leave the",
+    "  failure visible (non-zero task result + door.log). Do not rely on",
+    "  Task Scheduler's restart-on-failure setting - it does not fire on",
+    "  exit codes.",
+    "- To restart the door by hand (new token, ukp upgrade, new cert):",
+    "  taskkill /PID <door-pid> /T /F, then schtasks /Run /TN ukp-door",
+    "  (schtasks /End does not reliably kill the process tree).",
+    "- LOGON, not boot: the door starts when someone logs on - nobody",
+    "  logged on means no door. Unattended-boot always-on needs a service",
+    "  wrapper (WinSW-class) - deliberately outside this recipe; prefer the",
+    "  ssh:// path or a Linux host (systemd socket activation) for that.",
+    "- Re-run ukp serve --print-task with different flags to regenerate;",
+    "  edits land by saving the files and re-running schtasks /Run.",
+    "- Full recipes and hardening: the deployment handbook -",
+    "  docs/remote-deployment.md in this package, or",
+    "  https://github.com/CatheadOwl/ukp/blob/main/docs/remote-deployment.md",
+    "",
+  );
+  return out.join("\n");
+}

package/src/commands/serve.ts

@@ -9,6 +9,7 @@ import {
 } from "./kit.ts";
 import { normalizeTlsSanEntry } from "../capabilities/tls-identity.ts";
 import { DISCOVERY_PATH, startUkpServer, type ServeInfo } from "../server.ts";
+import { printTaskPreflightError, renderServeTaskArtifacts, type ServeTaskTls } from "./serve-task.ts";
 
 export interface ServeCommandContext {
   currentDirectory: string;
@@ -33,22 +34,23 @@ function parseServeTokens(raw: string | undefined): string[] {
  * over `/e/<name>/` routing. */
 export const SERVE_SPEC: UkpCommandSpec = {
   name: "serve",
-  summary: "serve one endpoint — or the whole registry as a host door — over HTTP for remote UKP clients",
+  summary: "serve one endpoint - or the whole registry as a host door, one HTTP server for every endpoint - for remote UKP clients",
   group: "operations",
   description:
-    "Expose a registered endpoint over HTTP using the ukp-remote wire, or — without --endpoint — serve every local endpoint as one host door routed by name.",
-  usage: "[--endpoint <name>] [--host <addr>] [--port <n>] [--tls [--tls-san <ip|dns>]… | --tls-cert <pem> --tls-key <pem>] [--max-idle <seconds>] [--systemd-socket]",
+    "Expose a registered endpoint over HTTP using the ukp-remote wire, or - without --endpoint - serve every local endpoint as one host door routed by name.",
+  usage: "[--endpoint <name>] [--host <addr>] [--port <n>] [--tls [--tls-san <ip|dns>]... | --tls-cert <pem> --tls-key <pem>] [--max-idle <seconds>] [--systemd-socket] [--print-task]",
   options: [
     { flags: "--endpoint <name>", help: "the registered endpoint to expose; omit it to serve the whole registry as a host door (/e/<name>/ routing, all endpoints, one port)" },
     { flags: "--host <addr>", help: "listen address (default 127.0.0.1, loopback only without a token)" },
     { flags: "--port <n>", help: "listen port (default 8570)" },
     { flags: "--tls", help: "serve HTTPS with a self-signed identity (auto-generated under .ukp/tls/, SAN covers this host's addresses; clients pin it at registration)" },
     { flags: "--tls-san <ip|dns>", help: "extra SAN entry for the --tls self-signed identity (repeatable): a public/NAT IP or hostname no NIC of this host carries; a persisted certificate missing an entry is re-signed over the same key (pin unchanged, pinned clients re-anchor)", multi: true },
-    { flags: "--tls-cert <pem>", help: "TLS certificate (chain) PEM path — Let's Encrypt, mkcert, or a private CA; pair with --tls-key" },
+    { flags: "--tls-cert <pem>", help: "TLS certificate (chain) PEM path - Let's Encrypt, mkcert, or a private CA; pair with --tls-key" },
     { flags: "--tls-key <pem>", help: "TLS private key PEM path; pair with --tls-cert" },
     { flags: "--allow-anonymous", help: "permit tokenless access on loopback (local testing, or an ssh-forwarded host door where SSH carries encryption and auth; reverse-proxy deployments still require UKP_SERVE_TOKEN)" },
-    { flags: "--max-idle <seconds>", help: "exit after <seconds> without requests (self-reap; the orphan backstop for on-demand-woken doors — fractional values accepted for tests)" },
-    { flags: "--systemd-socket", help: "serve on the systemd socket-activation listener (LISTEN_FDS fd 3) instead of binding a port — the port belongs to your .socket unit; Linux-only" },
+    { flags: "--max-idle <seconds>", help: "exit after <seconds> without requests (self-reap; the orphan backstop for on-demand-woken doors - fractional values accepted for tests)" },
+    { flags: "--systemd-socket", help: "serve on the systemd socket-activation listener (LISTEN_FDS fd 3) instead of binding a port - the port belongs to your .socket unit; Linux-only" },
+    { flags: "--print-task", help: "Windows: print this door's process-manager artifacts (start script, hidden launcher, Task Scheduler command, firewall rule) instead of serving - review and apply them yourself; nothing is installed or started for you, and the token is yours to paste (never printed)" },
   ],
   helpSuffix: [
     "",
@@ -56,9 +58,9 @@ export const SERVE_SPEC: UkpCommandSpec = {
     `  GET  ${DISCOVERY_PATH}        discovery document (manifest projection,`,
     "                                protocol version, instance identity)",
     "  POST /v1/search              {query, limit} -> ukp.search.v1 envelope",
-    "  GET  /v1/read?ref=…|uri=…    endpoint-relative ref or ukp:// URI",
+    "  GET  /v1/read?ref=...|uri=...  endpoint-relative ref or ukp:// URI",
     "  GET  /v1/nav?path=&depth=    markdown route view (ukp.nav.v1)",
-    "  GET  /v1/rg?query=…          lexical search (ukp.rg.v1, ukp_uri handoff)",
+    "  GET  /v1/rg?query=...        lexical search (ukp.rg.v1, ukp_uri handoff)",
     "",
     "Wire (ukp-remote v1), host door (no --endpoint):",
     `  GET  ${DISCOVERY_PATH}        door document (scope:"host", endpoint roster)`,
@@ -73,26 +75,26 @@ export const SERVE_SPEC: UkpCommandSpec = {
     "  --allow-anonymous, loopback binds only. The discovery document stays",
     "  public. A reverse proxy on the same host forwards from the public side",
     "  to the loopback bind, so proxy deployments treat the token as",
-    "  mandatory — serve cannot see past its own bind address.",
+    "  mandatory - serve cannot see past its own bind address.",
     "",
     "  Loopback-without-token covers testing/dogfood AND the ssh door",
     "  deployment: bind the door on the remote host's loopback and let ssh",
     "  forwarding carry encryption and authentication (clients register",
-    "  'ukp register --url ssh://<host>' — zero tokens, docker",
+    "  'ukp register --url ssh://<host>' - zero tokens, docker",
     "  DOCKER_HOST=ssh:// posture). It is not the way to consume a",
-    "  same-machine endpoint — register its local path instead.",
-    "  TLS (W5'): pass --tls to serve HTTPS with a self-signed identity",
-    "  (generated under .ukp/tls/ — under the registry directory in door",
-    "  mode —, SAN covers this host's addresses; remote clients TOFU-pin it",
+    "  same-machine endpoint - register its local path instead.",
+    "  TLS: pass --tls to serve HTTPS with a self-signed identity",
+    "  (generated under .ukp/tls/ - under the registry directory in door",
+    "  mode -, SAN covers this host's addresses; remote clients TOFU-pin it",
     "  at registration and refresh by re-registering), or --tls-cert/--tls-key",
-    "  for your own certificate (Let's Encrypt — IP certs available since",
-    "  2026-01 —, mkcert, a private CA). Plain HTTP remains loopback-only by",
+    "  for your own certificate (Let's Encrypt - IP certs available since",
+    "  2026-01 -, mkcert, a private CA). Plain HTTP remains loopback-only by",
     "  admission; public exposure needs TLS or the ssh:// transport.",
     "",
     "  A cloud NAT/EIP host's public IP is on no NIC (--tls alone cannot",
     "  cover it): add --tls-san <public-ip> next to --tls. Repeatable; DNS",
     "  names accepted. The persisted certificate re-signs over the same key",
-    "  when a new entry appears — the pin is unchanged and pinned clients",
+    "  when a new entry appears - the pin is unchanged and pinned clients",
     "  re-anchor transparently; dropping entries never re-signs.",
     "",
   ].join("\n"),
@@ -107,6 +109,9 @@ export interface ParsedServe {
   maxIdleSeconds?: number;
   /** Present = the systemd-passed listener (W10, Linux-only). */
   systemdSocket?: boolean;
+  /** Present = render the Windows process-manager artifacts instead of
+   * serving (W12; Windows-only, print-only, never starts a listener). */
+  printTask?: boolean;
   /** `--tls-san` values, normalized to `IP:x`/`DNS:y` SAN form (repeatable);
    * valid only next to `--tls` — the execute layer enforces the pairing.
    * Absent when the flag is not passed (parse output stays byte-identical
@@ -115,7 +120,7 @@ export interface ParsedServe {
 }
 
 function toParsedServe(parsed: KitParsed): ParsedServe {
-  const options = parsed.options as { host?: string; port?: string; endpoint?: string; maxIdle?: string; systemdSocket?: boolean; tlsSan?: string[] };
+  const options = parsed.options as { host?: string; port?: string; endpoint?: string; maxIdle?: string; systemdSocket?: boolean; printTask?: boolean; tlsSan?: string[] };
   const endpoint = options.endpoint;
   if (endpoint !== undefined && endpoint.length === 0) {
     throw new KitUsageError("--endpoint <name> must not be empty (omit it to serve a host door)");
@@ -129,12 +134,19 @@ function toParsedServe(parsed: KitParsed): ParsedServe {
   if (systemdSocket && options.port !== undefined) {
     throw new KitUsageError("--systemd-socket and --port are mutually exclusive (the socket unit owns the port)");
   }
+  const printTask = options.printTask === true;
+  if (printTask && systemdSocket) {
+    throw new KitUsageError("--print-task is the Windows resident form; --systemd-socket is the Linux one (systemd holds the port - see the deployment handbook)");
+  }
   let maxIdleSeconds: number | undefined;
   if (options.maxIdle !== undefined) {
     maxIdleSeconds = Number(options.maxIdle);
     if (!Number.isFinite(maxIdleSeconds) || maxIdleSeconds <= 0 || maxIdleSeconds > 86400) {
       throw new KitUsageError("--max-idle must be a positive number of seconds (at most 86400)");
     }
+    if (printTask) {
+      throw new KitUsageError("--print-task is for a resident door; --max-idle self-reaps (it is the on-demand backstop) and would leave the door down until the next logon");
+    }
   }
   let tlsSan: string[] = [];
   if (options.tlsSan !== undefined) {
@@ -152,6 +164,7 @@ function toParsedServe(parsed: KitParsed): ParsedServe {
     port,
     ...(maxIdleSeconds !== undefined ? { maxIdleSeconds } : {}),
     ...(systemdSocket ? { systemdSocket } : {}),
+    ...(printTask ? { printTask } : {}),
     ...(tlsSan.length > 0 ? { tlsSan } : {}),
   };
 }
@@ -170,10 +183,10 @@ export function renderServeBanner(info: ServeInfo): string {
       `serving host door (ukp-remote v1)`,
       `  listening: ${info.url}`,
       `  discovery: ${info.url.startsWith("http") ? `${info.url}${DISCOVERY_PATH}` : info.url} (host door)`,
-      `  endpoints: ${info.door!.endpoints.length > 0 ? info.door!.endpoints.join(", ") : "(none — register endpoints on this host)"}`,
+      `  endpoints: ${info.door!.endpoints.length > 0 ? info.door!.endpoints.join(", ") : "(none - register endpoints on this host)"}`,
       `  write: ${info.door!.write.length > 0 ? info.door!.write.join(", ") + " (propose via PUT /e/<name>/v1/propose/<id>)" : "(no endpoint declares propose)"}`,
       `  auth: ${info.authRequired ? "bearer token required" : "no token (loopback bind; ssh-forwarded clients authenticate by SSH key)"}`,
-      `  rg: ${info.rg === "ok" ? "ok" : "missing (rg calls skip with a warning — install ripgrep on this door's PATH)"}`,
+      `  rg: ${info.rg === "ok" ? "ok" : "missing (rg calls skip with a warning - install ripgrep on this door's PATH)"}`,
       ...(info.maxIdleSeconds !== undefined
         ? [`  idle: exits after ${info.maxIdleSeconds}s without requests (--max-idle)`]
         : []),
@@ -188,7 +201,7 @@ export function renderServeBanner(info: ServeInfo): string {
     `  listening: ${info.url}`,
     `  discovery: ${info.url.startsWith("http") ? `${info.url}${DISCOVERY_PATH}` : info.url}`,
     `  auth: ${info.authRequired ? "bearer token required" : "no token (loopback only)"}`,
-    `  rg: ${info.rg === "ok" ? "ok" : "missing (rg calls skip with a warning — install ripgrep on this door's PATH)"}`,
+    `  rg: ${info.rg === "ok" ? "ok" : "missing (rg calls skip with a warning - install ripgrep on this door's PATH)"}`,
     ...(info.maxIdleSeconds !== undefined
       ? [`  idle: exits after ${info.maxIdleSeconds}s without requests (--max-idle)`]
       : []),
@@ -230,6 +243,7 @@ export function executeServeCommand(
   return executeKitCommand(SERVE_SPEC, args, (parsed) => {
     const { endpoint, host, port, maxIdleSeconds, systemdSocket, tlsSan = [] } = toParsedServe(parsed);
     const allowAnonymous = (parsed.options as { allowAnonymous?: boolean }).allowAnonymous === true;
+    const printTask = (parsed.options as { printTask?: boolean }).printTask === true;
     const options = parsed.options as { tls?: boolean; tlsCert?: string; tlsKey?: string };
     // TLS flag family (W5'): --tls and --tls-cert/--tls-key are mutually
     // exclusive; the explicit pair must arrive complete. --tls-san only
@@ -244,13 +258,44 @@ export function executeServeCommand(
     if (tlsSan.length > 0 && options.tls !== true) {
       throw new KitUsageError("--tls-san is only used with --tls (an explicit --tls-cert certificate carries its own SAN)");
     }
+    // W12 print-only branch: render the Windows artifacts and stop. No
+    // listener, no admission token check (the token is pasted into the
+    // generated script later), and the env token is deliberately not read
+    // — the output is secret-free by construction.
+    if (printTask) {
+      const preflight = printTaskPreflightError({
+        platform: process.platform,
+        host,
+        hasTls: options.tls === true || options.tlsCert !== undefined,
+        allowAnonymous,
+      });
+      if (preflight !== undefined) {
+        throw new Error(preflight);
+      }
+      const tls: ServeTaskTls | undefined =
+        options.tls === true
+          ? { mode: "self-signed", sanEntries: tlsSan }
+          : options.tlsCert !== undefined && options.tlsKey !== undefined
+            ? { mode: "certificates", certPath: options.tlsCert, keyPath: options.tlsKey }
+            : undefined;
+      return {
+        exitCode: 0,
+        stdout: renderServeTaskArtifacts({
+          host,
+          port,
+          ...(endpoint !== undefined ? { endpoint } : {}),
+          ...(tls !== undefined ? { tls } : {}),
+        }),
+        stderr: "",
+      };
+    }
     const tokens = context.tokens ?? parseServeTokens(process.env.UKP_SERVE_TOKEN);
     // W10: socket activation must not admit tokenless serving — the bind
     // address belongs to the socket unit (possibly public), so the loopback
     // premise of --allow-anonymous is unverifiable here (RQ-18 review P1).
     if (systemdSocket && tokens.length === 0) {
       throw new Error(
-        "refusing to serve on --systemd-socket without a token: the listener's bind address belongs to the socket unit and may be public — tokenless loopback serving cannot be verified here; set UKP_SERVE_TOKEN",
+        "refusing to serve on --systemd-socket without a token: the listener's bind address belongs to the socket unit and may be public - tokenless loopback serving cannot be verified here; set UKP_SERVE_TOKEN",
       );
     }
     const decision = serveAuthDecision(host, tokens, allowAnonymous);

package/src/registry.ts

@@ -230,7 +230,7 @@ export function assertRegistrableRemoteUrl(raw: string): void {
       + `${parts.endpointName !== undefined ? `/${parts.endpointName}` : ""}`;
     throw new RegistryError(
       `ssh:// urls take no port: the woken door listens on a client-chosen loopback port and the url port selects nothing`
-        + ` — register '${portless}' instead`
+        + ` - register '${portless}' instead`
         + ` (for a non-standard sshd port, use an ssh config Host alias)`,
     );
   }
@@ -240,7 +240,7 @@ export class RegistryBusyError extends RegistryError {
   constructor(path: string) {
     super(
       `registry_busy: ${path} (another ukp process holds the registry lock; ` +
-        `stale locks are reclaimed automatically — close other ukp commands or retry shortly)`,
+        `stale locks are reclaimed automatically - close other ukp commands or retry shortly)`,
     );
     this.name = "RegistryBusyError";
   }

package/src/server.ts

@@ -407,7 +407,7 @@ function parseReadParams(
   pin: string | null,
 ): { request: ReadRequest } | { error: string; class?: string } {
   if ((ref === null) === (uri === null)) {
-    return { error: "exactly one of 'ref' (endpoint-relative) or 'uri' (ukp://…) is required" };
+    return { error: "exactly one of 'ref' (endpoint-relative) or 'uri' (ukp://...) is required" };
   }
   const args = uri !== null
     ? [
@@ -546,14 +546,14 @@ export function parseListenFds(env: NodeJS.ProcessEnv): { fd: number } | { error
     };
   }
   if (Number(env.LISTEN_PID) !== process.pid) {
-    return { error: `LISTEN_PID ${env.LISTEN_PID} does not match this process (${process.pid}) — inherited activation variables belong to another process` };
+    return { error: `LISTEN_PID ${env.LISTEN_PID} does not match this process (${process.pid}) - inherited activation variables belong to another process` };
   }
   const count = Number(env.LISTEN_FDS);
   if (!Number.isSafeInteger(count) || count < 1) {
     return { error: `LISTEN_FDS=${String(env.LISTEN_FDS)} is not a positive integer` };
   }
   if (count !== 1) {
-    return { error: `expected exactly one listening fd (LISTEN_FDS=1), got ${count} — run one socket unit per serve instance` };
+    return { error: `expected exactly one listening fd (LISTEN_FDS=1), got ${count} - run one socket unit per serve instance` };
   }
   delete env.LISTEN_FDS;
   delete env.LISTEN_PID;
@@ -645,7 +645,7 @@ function startServeListener(
     isSocket = false;
   }
   if (!isSocket) {
-    throw new ServeSetupError(`fd ${parsed.fd} is not an open socket — socket activation must pass a bound listening socket`);
+    throw new ServeSetupError(`fd ${parsed.fd} is not an open socket - socket activation must pass a bound listening socket`);
   }
   const server = Bun.serve({ hostname: "127.0.0.1", port: 0, ...tls, fetch });
   const acceptor = netCreateServer();