@ddtcorex/dsh-maestro-supervisor 0.7.4 → 0.7.5

package/lib/dsh-session.d.ts

@@ -0,0 +1,26 @@
+export interface LaunchTarget {
+    port: number;
+    token: string;
+}
+/**
+ * Parse the newest `dsh web: http://127.0.0.1:<port>/?token=<tok>` boot line
+ * from the dsh web log. The launch token and the raw-webserver port (which is
+ * 3082 on the local-pin-gate topology, 3080 before it) both live there.
+ */
+export declare function parseLaunchTarget(logContent: string): LaunchTarget | undefined;
+export interface MintCookieOpts {
+    /** Path to the dsh web log holding the launch line; defaults to `~/.dsh/dsh-web.log`. */
+    logPath?: string;
+    /** Raw-webserver base URL; overrides the log-derived port (tests). */
+    upstreamUrl?: string;
+    /** Injectable file reader (tests). */
+    readFileImpl?: (path: string) => Promise<string>;
+}
+export declare function defaultLogPath(): string;
+/**
+ * Mint the `dsh-auth-*` session cookie by trading the boot launch token on the
+ * raw webserver (index fence: `?token=` -> 303 + Set-Cookie). Returns the
+ * `name=value` cookie pair, or undefined when the log is unreadable, no boot
+ * line exists, or the exchange does not mint a cookie (upstream 401 etc.).
+ */
+export declare function mintDshSessionCookie(fetchFn: (url: string, init: RequestInit) => Promise<Response>, opts?: MintCookieOpts): Promise<string | undefined>;

package/lib/dsh-session.js

@@ -0,0 +1,45 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Parse the newest `dsh web: http://127.0.0.1:<port>/?token=<tok>` boot line
+ * from the dsh web log. The launch token and the raw-webserver port (which is
+ * 3082 on the local-pin-gate topology, 3080 before it) both live there.
+ */
+export function parseLaunchTarget(logContent) {
+    const matches = [...logContent.matchAll(/dsh web: http:\/\/127\.0\.0\.1:(\d+)\/\?token=([A-Za-z0-9._-]+)/g)];
+    const last = matches.at(-1);
+    if (last === undefined)
+        return undefined;
+    return { port: Number(last[1]), token: last[2] };
+}
+export function defaultLogPath() {
+    return join(homedir(), '.dsh', 'dsh-web.log');
+}
+/**
+ * Mint the `dsh-auth-*` session cookie by trading the boot launch token on the
+ * raw webserver (index fence: `?token=` -> 303 + Set-Cookie). Returns the
+ * `name=value` cookie pair, or undefined when the log is unreadable, no boot
+ * line exists, or the exchange does not mint a cookie (upstream 401 etc.).
+ */
+export async function mintDshSessionCookie(fetchFn, opts = {}) {
+    const read = opts.readFileImpl ?? ((p) => readFile(p, 'utf8'));
+    let target;
+    try {
+        target = parseLaunchTarget(await read(opts.logPath ?? defaultLogPath()));
+    }
+    catch {
+        target = undefined;
+    }
+    if (target === undefined)
+        return undefined;
+    const upstream = opts.upstreamUrl ?? `http://127.0.0.1:${target.port}`;
+    const response = await fetchFn(`${upstream}/?token=${encodeURIComponent(target.token)}`, {
+        redirect: 'manual',
+        headers: { accept: 'text/html' },
+    });
+    if (response.status !== 303 && response.status !== 302)
+        return undefined;
+    const pair = (response.headers.get('set-cookie') ?? '').split(';')[0]?.trim() ?? '';
+    return pair.startsWith('dsh-auth-') ? pair : undefined;
+}

package/lib/supervisor.d.ts

@@ -1,5 +1,6 @@
 import type { HealthState } from './health-poller.js';
 import type { RestartRequest } from './restart-guards.js';
+import { type MintCookieOpts } from './dsh-session.js';
 export interface SupervisorDeps {
     pollHealth: () => Promise<HealthState>;
     writeLKG: () => Promise<{
@@ -45,7 +46,17 @@ export interface SupervisorDeps {
     readRestartRequest?: () => RestartRequest | undefined;
     onRestartRequestHandled?: (req: RestartRequest) => void;
 }
-export declare function resumeViaRpc(ids: string[], fetchFn?: (url: string, init: RequestInit) => Promise<Response>): Promise<{
+export declare function resumeViaRpc(ids: string[], fetchFn?: (url: string, init: RequestInit) => Promise<Response>, extraHeaders?: Record<string, string>): Promise<{
+    resumed: string[];
+}>;
+/**
+ * Daemon default resume path: mint the `dsh-auth-*` session cookie first (the
+ * `/resume` RPC sits behind the raw webserver's browser-trust fence, which 401s
+ * cookie-less loopback calls since the local-pin-gate topology moved the
+ * webserver behind the PIN proxies) and attach it to the POST. Falls back to an
+ * unauthenticated POST when no boot token is readable — old behavior preserved.
+ */
+export declare function resumeViaRpcWithSession(ids: string[], fetchFn?: (url: string, init: RequestInit) => Promise<Response>, opts?: MintCookieOpts): Promise<{
     resumed: string[];
 }>;
 export declare class Supervisor {

package/lib/supervisor.js

@@ -6,12 +6,13 @@ import * as os from 'node:os';
 import { resolveHarnessRoot } from './paths.js';
 import { readSupervisorConfig } from './config.js';
 import { writePlannedRestart as defaultWritePlannedRestart, checkPlannedRestart as defaultCheckPlannedRestart, clearPlannedRestart, PLANNED_RESTART_TTL_MS } from './restart-guards.js';
+import { mintDshSessionCookie } from './dsh-session.js';
 import { buildKillStalePortsCommand } from './restart-guards.js';
-export async function resumeViaRpc(ids, fetchFn = globalThis.fetch) {
+export async function resumeViaRpc(ids, fetchFn = globalThis.fetch, extraHeaders = {}) {
     const rpcId = crypto.randomUUID();
     const response = await fetchFn('http://127.0.0.1:3080/dsh-maestro-supervisor-resume/resume', {
         method: 'POST',
-        headers: { 'content-type': 'application/json' },
+        headers: { 'content-type': 'application/json', ...extraHeaders },
         body: JSON.stringify({ type: 'client-request', rpcId, method: 'resume', payload: { ids } }),
     });
     if (!response.ok)
@@ -27,6 +28,23 @@ export async function resumeViaRpc(ids, fetchFn = globalThis.fetch) {
         throw new Error('resume RPC returned an invalid result');
     return { resumed };
 }
+/**
+ * Daemon default resume path: mint the `dsh-auth-*` session cookie first (the
+ * `/resume` RPC sits behind the raw webserver's browser-trust fence, which 401s
+ * cookie-less loopback calls since the local-pin-gate topology moved the
+ * webserver behind the PIN proxies) and attach it to the POST. Falls back to an
+ * unauthenticated POST when no boot token is readable — old behavior preserved.
+ */
+export async function resumeViaRpcWithSession(ids, fetchFn = globalThis.fetch, opts = {}) {
+    let cookie;
+    try {
+        cookie = await mintDshSessionCookie(fetchFn, opts);
+    }
+    catch {
+        cookie = undefined;
+    }
+    return resumeViaRpc(ids, fetchFn, cookie === undefined ? {} : { cookie });
+}
 export class Supervisor {
     deps;
     lastRollback = 0;
@@ -86,7 +104,7 @@ export class Supervisor {
         return this.deps.findInterrupted ?? defaultFindInterrupted;
     }
     getResumeSessions() {
-        return this.deps.resumeSessions ?? resumeViaRpc;
+        return this.deps.resumeSessions ?? resumeViaRpcWithSession;
     }
     getAutoResumeEnabled() {
         // Priority: env > supervisor config.json > maestro settings.json > default true (enabled)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ddtcorex/dsh-maestro-supervisor",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Supervisor daemon for DSH Web resilience — auto-detect crashes, rollback to LKG, report",
   "type": "module",
   "main": "./lib/index.js",

package/skills/dsh-safe-restart/SKILL.md

@@ -8,11 +8,14 @@ compatibility: dsh
 
 ## Purpose
 
-One `dsh web` process serves both the live Web UI on port 3080 and the
-GitLab-webhook service on port 3000. A host restart drops the live socket and
-the in-flight turn, although sessions rehydrate from the append-only log when
-the browser reconnects. Treat a restart as disruptive: validate first and get
-explicit user consent before a real swap.
+One `dsh web` process owns the whole Web surface: the raw webserver on
+`127.0.0.1:3082` (launch-token fence) plus the two Maestro proxies created by
+`dsh-maestro-remote` — the LAN PIN gate on `:3080` (canonical local/LAN URL)
+and the public tunnel proxy on `:3081` — and the `/hooks/gitlab-mr*` webhook
+intake (port 3000 is deprecated/unbound). A host restart drops the live
+socket and the in-flight turn, although sessions rehydrate from the
+append-only log when the browser reconnects. Treat a restart as disruptive:
+validate first and get explicit user consent before a real swap.
 
 ## Classify the change before touching the live process
 
@@ -30,8 +33,8 @@ explicit user consent before a real swap.
    carries the expected marker.
 2. Dry-boot the candidate on an ephemeral port with an isolated `DSH_HOME`.
    Keep the live process and its sessions/settings untouched. If the review
-   webhook conflicts on port 3000, exclude that provider for the candidate or
-   run a no-server composition check instead.
+   webhook conflicts on a bound port, exclude that provider for the candidate
+   or run a no-server composition check instead.
 3. Verify HTTP 200 and the new marker on the candidate. Retain last-known-good
    assets until the real swap has passed post-swap checks.
 4. Ask for explicit consent and timing. “restart đi” is consent; silence is
@@ -63,9 +66,10 @@ and refuses to launch if ports are still occupied. `--dry-run` never runs
 
 Do not read the top of an old append-only log as liveness evidence. Instead:
 
-1. Confirm exactly one healthy listener tree owns ports 3000 and 3080 with
-   `ss -tlnp`.
-2. Confirm HTTP 200 from port 3080.
+1. Confirm exactly one healthy process owns the listener tree 3080/3081 +
+   127.0.0.1:3082 with `ss -tlnp` (port 3000 is no longer bound).
+2. Confirm HTTP 200 from port 3080 (the Maestro PIN login page is 200; the
+   app itself loads after the PIN).
 3. Check served bytes contain the **new**, unique marker; or make a fresh
    browser/Playwright probe for the changed UI. Shared third-party markers are
    not sufficient proof.