@descix/cli 1.0.19 → 1.0.21

package/bin/descix.js

@@ -14,6 +14,7 @@ import { requireAuth } from '../lib/auth-guard.js';
 import { WorkspaceConfig, unmappedAppMessage, resolveWorkspacePath } from '../lib/workspace-config.js';
 import { CLI_VERSION } from '../lib/cli-version.js';
 import { recordInvocationOrigin } from '../lib/origin.js';
+import { verifyDeployOutcome } from '../lib/deploy-outcome.js';
 // Chat session pointer + the ONE rule for when a dead pointer may be self-healed.
 import {
   getSessionInteractionId,
@@ -1641,35 +1642,41 @@ appCommand
 
 // ============ App: set-site (WS-SSGPOD — site.static workspace gap) ============
 //
-// Canonical write path for an app's site config in workspace.json — specifically site.static,
-// the relative path the dev gateway's staticSitePlugin serves at /p/{appId}/ (resolved against
-// the app's localPath; "." means the localPath itself). Optionally sets site.port for
-// dev-server sites. Parallel to `descix app set-port` (microservice.port); closes the
-// site.static gap so workspace.json never needs hand-editing (CEO-D-2026-06-02-SSGPOD-SITE-PREPROD).
-// Backed by WorkspaceConfig.setStaticSite (parallel to setMicroservicePort).
-// It writes ONLY the local workspace.json site.{} slot.
+// Canonical write path for an app's site.{} slot in workspace.json. TWO MODES, one active
+// per write:
+//   static mode (--static):      site.static — the relative dir (under the app's localPath;
+//                                "." = the localPath itself) the gateway's staticSitePlugin
+//                                serves at /p/{appId}/.
+//   dev-server mode (--port):    site.port [+ site.protocol] — the local dev server the
+//                                gateway proxies /p/{appId} to (vite-style hotserving).
+// Setting one mode CLEARS the other's fields; passing BOTH flags in one invocation is the
+// explicit combined write and keeps both (the gateway then serves the DEV SERVER — site.port
+// wins — and says so on the serve banner). Parallel to `descix app set-port`
+// (microservice.port); no hand-editing of workspace.json (CEO-D-2026-06-02-SSGPOD-SITE-PREPROD).
+// Backed by WorkspaceConfig.setStaticSite. It writes ONLY the local workspace.json site.{} slot.
 appCommand
   .command('set-site')
-  .description("Set a mapped app static-site config (writes env.products[<app>].site.static, the relative dir served at /p/<app>/). Optionally --port; --unset clears site.{}.")
+  .description("Set a mapped app's site config (env.products[<app>].site). One active mode per write: --static <dir> (built site served at /p/<app>/) or --port <n> [--protocol http|https] (dev server proxied at /p/<app>); setting one clears the other. Pass both flags together to keep both — the gateway then serves the dev server (site.port wins). --unset clears site.{} entirely.")
   .requiredOption('-a, --app <app_id>', 'App ID (must be mapped in workspace.json)')
-  .option('--static <path>', 'Relative static-site path under the app localPath (e.g. "site"; "." = the localPath itself)')
-  .option('--port <port>', 'Site dev-server port (1-65535) for framework dev sites; mutually optional with --static')
-  .option('--unset', 'Remove site.static (and site.port) for the app, clearing the site.{} slot')
+  .option('--static <path>', 'Static mode: relative dir under the app localPath (e.g. "site"; "." = the localPath itself). Alone, it clears site.port and site.protocol (one active mode per write).')
+  .option('--port <port>', 'Dev-server mode: proxy /p/<app> to your local dev server on this port (1-65535). Alone, it clears site.static. With --static in the same call, both are kept and the gateway serves the dev server.')
+  .option('--protocol <scheme>', 'Dev-server upstream scheme: "http" or "https" (default https when unset). Dev-server mode only — requires site.port. A wrong scheme fails loud at the gateway (502); there is no auto-detection.')
+  .option('--unset', 'Remove site.static, site.port and site.protocol for the app, clearing the site.{} slot')
   .action(async (options) => {
     try {
       const appId = options.app;
       const workspaceConfig = await WorkspaceConfig.load();
 
-      // --unset: remove both site.static and site.port (setStaticSite cleans up empty site.{})
+      // --unset: remove all site.{} fields (setStaticSite cleans up the empty slot)
       if (options.unset) {
-        await workspaceConfig.setStaticSite(appId, { static: null, port: null });
-        console.log(chalk.green(`\n✓ site config cleared for ${appId}\n`));
+        await workspaceConfig.setStaticSite(appId, { static: null, port: null, protocol: null });
+        console.log(chalk.green(`\n✓ site config cleared for ${appId} (site.static, site.port, site.protocol removed)\n`));
         return;
       }
 
       // Require at least one field to set — do not silently no-op.
-      if (options.static === undefined && options.port === undefined) {
-        console.error(chalk.red('\n❌ Nothing to set. Provide --static <path> and/or --port <n>, or --unset to clear.\n'));
+      if (options.static === undefined && options.port === undefined && options.protocol === undefined) {
+        console.error(chalk.red('\n❌ Nothing to set. Provide --static <path> (static mode), --port <n> [--protocol http|https] (dev-server mode), or --unset to clear.\n'));
         process.exit(1);
       }
 
@@ -1692,15 +1699,34 @@ appCommand
         fields.port = portNum;
       }
 
-      // setStaticSite mutates the live env entry and saves — and hard-fails (canonical
-      // "not mapped in workspace.json" error) for an unmapped app, surfaced in the catch below.
+      if (options.protocol !== undefined) {
+        if (options.protocol !== 'http' && options.protocol !== 'https') {
+          console.error(chalk.red(`\n❌ Invalid --protocol ${JSON.stringify(options.protocol)}. Only "http" or "https" are valid (it names the scheme of your app's own dev server behind /p/${appId}).\n`));
+          process.exit(1);
+        }
+        fields.protocol = options.protocol;
+      }
+
+      // setStaticSite applies ONE-ACTIVE-MODE-PER-WRITE and saves — it hard-fails (canonical
+      // "not mapped in workspace.json" error, or protocol-without-port) in the catch below.
       await workspaceConfig.setStaticSite(appId, fields);
 
       console.log(chalk.green(`\n✓ site config set for ${appId}`));
-      if (fields.static !== undefined) console.log(chalk.cyan(`  site.static: ${fields.static}`));
-      if (fields.port !== undefined)   console.log(chalk.cyan(`  site.port:   ${fields.port}`));
-      console.log(chalk.gray(`  Written to env.products[${appId}].site in workspace.json.`));
-      console.log(chalk.gray(`  The gateway serves site.static at /p/${appId}/ (staticSitePlugin); \`descix serve\` picks it up.\n`));
+      // Print the RESULTING slot, not just the fields passed: a dev-server write keeps a
+      // previously declared site.protocol (same mode, new port), and a retained field the
+      // output does not show is invisible state — the whole defect class this command fixes.
+      const entryNow = workspaceConfig.env?.platform?.appId === appId
+        ? workspaceConfig.env.platform
+        : (workspaceConfig.env?.products || []).find(p => p.appId === appId);
+      console.log(chalk.cyan(`  site is now:   ${JSON.stringify(entryNow?.site)}`));
+      if (fields.static !== undefined && fields.port === undefined) {
+        console.log(chalk.gray(`  site.port and site.protocol cleared (one active mode per write) — /p/${appId}/ now serves the static dir.`));
+      } else if (fields.port !== undefined && fields.static === undefined) {
+        console.log(chalk.gray(`  site.static cleared (one active mode per write) — /p/${appId} now proxies to your dev server.`));
+      } else if (fields.static !== undefined && fields.port !== undefined) {
+        console.log(chalk.yellow(`  Combined write: BOTH modes kept. The gateway serves the DEV SERVER (site.port wins); site.static is used only after you clear site.port (--static alone, or --unset).`));
+      }
+      console.log(chalk.gray(`  Written to env.products[${appId}].site in workspace.json; \`descix serve\` picks it up.\n`));
     } catch (error) {
       console.error(chalk.red(error.message));
       process.exit(1);
@@ -2564,6 +2590,28 @@ siteCommand
           branch: gitStatus.branch
         } : null,
         preview: options.preview || false
+      }).catch(async (confirmErr) => {
+        // ws-prune-504: a lost confirm RESPONSE is not a failed DEPLOY. Re-read the served
+        // manifest keyed on THIS upload's token and say which it actually is — never "failed"
+        // when the truth is knowable.
+        console.log(chalk.yellow(`\n  Confirm response lost (${confirmErr.message}) — reading the deploy record back...`));
+        const verdict = await verifyDeployOutcome(apiClient, {
+          communityId, appId, tokenId: token_id, preview: options.preview || false
+        });
+        if (verdict.outcome === 'confirmed') {
+          console.log(chalk.green(`\n  Deploy CONFIRMED — ${verdict.detail}.`));
+          console.log(chalk.gray(`  The server may still be finishing the stale-file prune; ` +
+            `'descix site status -c ${communityId} -a ${appId}' shows the deploy, 'descix site list' what is served.`));
+          process.exit(0);
+        }
+        if (verdict.outcome === 'unconfirmed') {
+          console.error(chalk.red(`\n  Deploy UNCONFIRMED — ${verdict.detail}.`));
+          console.error(chalk.red(`  Nothing was removed from the server. Re-run the upload.`));
+          process.exit(1);
+        }
+        console.error(chalk.red(`\n  Deploy outcome UNKNOWN — ${verdict.detail}.`));
+        console.error(chalk.red(`  Check 'descix site status -c ${communityId} -a ${appId}' before re-running.`));
+        process.exit(1);
       });
 
       const result = confirmResponse.message;
@@ -2577,6 +2625,10 @@ siteCommand
       }
       console.log(chalk.gray(`  Removed from the server: ${pruned.length}`));
       pruned.forEach(f => console.log(chalk.gray(`    - ${f}`)));
+      if (result.prune_status === 'partial') {
+        console.log(chalk.yellow(`  Prune PARTIAL: ${result.prune_remaining_count} stale file(s) not yet removed (soft budget).`));
+        console.log(chalk.yellow(`  ${result.prune_remedy}`));
+      }
       console.log(chalk.gray(`  Deployed: ${result.deployed_at}`));
       if (result.preview) {
         console.log(chalk.yellow(`  Mode: PREVIEW`));

package/lib/deploy-outcome.js

@@ -0,0 +1,45 @@
+/**
+ * verifyDeployOutcome — the honest answer when a confirm_site_deploy response is LOST.
+ *
+ * ws-prune-504 (measured on prod 2026-10-10): a large prune held the confirm past the
+ * gateway's patience; the client saw "Upload failed: HTTP 504" while the deploy had in fact
+ * confirmed and the prune was finishing server-side. A lost RESPONSE is not a failed DEPLOY —
+ * and a tool that says "failed" when it does not know is lying in one direction.
+ *
+ * The read-back is keyed on the deploy TOKEN: get_site_deploy_token minted token_id for THIS
+ * upload, and confirm_site_deploy stamps it into the served manifest's deploy.token_id. If the
+ * served manifest carries our token, OUR deploy confirmed — no weaker signal (git sha, file
+ * count) can be forged by a concurrent deploy into a false positive the token cannot.
+ *
+ * @param {{invoke: (cmd: string, params: object) => Promise<any>}} apiClient
+ * @param {{communityId: string, appId: string, tokenId: string, preview?: boolean}} sent
+ * @returns {Promise<{outcome: 'confirmed'|'unconfirmed'|'unknown', detail: string, deploy?: object}>}
+ */
+export async function verifyDeployOutcome(apiClient, { communityId, appId, tokenId, preview = false }) {
+    if (!tokenId) {
+        return { outcome: 'unknown', detail: 'no token_id in hand — cannot key the read-back' };
+    }
+    let response;
+    try {
+        response = await apiClient.invoke('get_site_manifest', {
+            community_id: communityId,
+            app_id: appId,
+            preview,
+        });
+    } catch (err) {
+        return { outcome: 'unknown', detail: `read-back failed too: ${err.message}` };
+    }
+    const payload = response?.message ?? response;
+    const deploy = payload?.manifest?.deploy;
+    if (!payload?.exists || !deploy) {
+        return { outcome: 'unconfirmed', detail: 'no deploy manifest is served for this app' };
+    }
+    if (deploy.token_id === tokenId) {
+        return { outcome: 'confirmed', detail: `served manifest carries this upload's token (deployed_at ${deploy.deployed_at})`, deploy };
+    }
+    return {
+        outcome: 'unconfirmed',
+        detail: `served manifest is a DIFFERENT deploy (token ${deploy.token_id || 'none'}, deployed_at ${deploy.deployed_at || 'unknown'})`,
+        deploy,
+    };
+}

package/lib/workspace-config.js

@@ -845,15 +845,27 @@ export class WorkspaceConfig {
   /**
    * Update an app's site config in env.products[] (or env.platform if it is the platform app).
    *
-   * Parallel to setMicroservicePort(), but operates on the entry's site.{} slot's
-   * static-site fields. This is the canonical write path for site.static — the relative path the
-   * dev gateway's staticSitePlugin serves at /p/{appId}/ (see createViteProxyConfig:
-   * site.static is resolved against the app's localPath; "." means the localPath itself).
+   * Parallel to setMicroservicePort(), but operates on the entry's site.{} slot. This is the
+   * canonical write path for site.static — the relative path the dev gateway's
+   * staticSitePlugin serves at /p/{appId}/ (see createViteProxyConfig: site.static is
+   * resolved against the app's localPath; "." means the localPath itself) — and for
+   * site.port / site.protocol, the dev-server upstream the gateway proxies /p/{appId} to.
    * Backs the `descix app set-site` command, closing the site.static workspace gap without
    * hand-editing workspace.json (the org rule forbids hand edits — CEO-D-2026-06-02-SSGPOD-SITE-PREPROD).
    *
-   * Mutates site.static and/or site.port. Pass static === null to remove site.static; pass
-   * port === null to remove site.port. If site.{} becomes empty after removals it is deleted.
+   * ONE ACTIVE MODE PER WRITE (measured 2026-10-02, EGPT-Evidence: `set-site --port` then
+   * `set-site --static` left BOTH fields, and the gateway silently served the dead dev-server
+   * port). Setting `static` without `port` in the same call CLEARS site.port and
+   * site.protocol; setting `port` without `static` CLEARS site.static. Passing BOTH in one
+   * call is the explicit combined write and keeps both — the gateway then serves the dev
+   * server (site.port wins; createViteProxyConfig), stated on the serve banner.
+   *
+   * site.protocol ("http" | "https", default https when absent) names the scheme of the
+   * dev-server upstream. It is meaningless without site.port, and a write that would leave
+   * protocol without port is refused loud — no auto-detection, no try-both fallback.
+   *
+   * Pass null for a field to remove it (what `--unset` does for all three). Removals clear
+   * only the named field. If site.{} becomes empty after removals it is deleted.
    * Persists via save() at the end — same auto-save pattern as setMicroservicePort().
    * Hard-fails if appId is not mapped in env.platform or env.products.
    *
@@ -861,37 +873,64 @@ export class WorkspaceConfig {
    * @param {Object} fields - Fields to set on site.{}
    * @param {string|null} [fields.static] - Relative static-site path to set, or null to remove site.static
    * @param {number|string|null} [fields.port] - Site dev-server port to set, or null to remove site.port
+   * @param {string|null} [fields.protocol] - Dev-server upstream scheme "http"|"https", or null to remove site.protocol
    * @returns {Promise<string>} Path to saved config (from save())
    */
   async setStaticSite(appId, fields = {}) {
     if (!appId) throw new Error('appId is required');
     if (!fields || typeof fields !== 'object') throw new Error('fields object is required');
 
+    const settingStatic = 'static' in fields && fields.static !== null && fields.static !== undefined;
+    const settingPort = 'port' in fields && fields.port !== null && fields.port !== undefined;
+    const settingProtocol = 'protocol' in fields && fields.protocol !== null && fields.protocol !== undefined;
+
+    if (settingProtocol && fields.protocol !== 'http' && fields.protocol !== 'https') {
+      throw new Error(
+        `site.protocol must be "http" or "https" (got ${JSON.stringify(fields.protocol)}). ` +
+        `It names the scheme of the app's own dev server behind the gateway's /p/${appId} proxy.`
+      );
+    }
+
     const entry = this._liveEnvEntry(appId);
 
-    if (!entry.site) entry.site = {};
+    // Compute the resulting site.{} first, so validation failures write NOTHING.
+    const site = { ...(entry.site || {}) };
 
-    // site.static — set or remove
-    if ('static' in fields) {
-      if (fields.static === null || fields.static === undefined) {
-        delete entry.site.static;
-      } else {
-        entry.site.static = fields.static;
-      }
+    // One active mode per write (see doc comment above).
+    if (settingStatic && !settingPort) {
+      delete site.port;
+      delete site.protocol;
+    }
+    if (settingPort && !settingStatic) {
+      delete site.static;
     }
 
-    // site.port — set or remove (for static+devCommand sites)
+    if ('static' in fields) {
+      if (fields.static === null || fields.static === undefined) delete site.static;
+      else site.static = fields.static;
+    }
     if ('port' in fields) {
-      if (fields.port === null || fields.port === undefined) {
-        delete entry.site.port;
-      } else {
-        entry.site.port = fields.port;
-      }
+      if (fields.port === null || fields.port === undefined) delete site.port;
+      else site.port = fields.port;
+    }
+    if ('protocol' in fields) {
+      if (fields.protocol === null || fields.protocol === undefined) delete site.protocol;
+      else site.protocol = fields.protocol;
     }
 
-    // Clean up an empty site.{} so we never leave a bare {} behind
-    if (Object.keys(entry.site).length === 0) {
+    // protocol describes the dev-server upstream — without a port it describes nothing.
+    if ('protocol' in site && !('port' in site)) {
+      throw new Error(
+        `site.protocol is only valid in dev-server mode: set it together with --port ` +
+        `(or on an app whose site.port is already set). Nothing was written for ${appId}.`
+      );
+    }
+
+    if (Object.keys(site).length === 0) {
+      // Clean up an empty site.{} so we never leave a bare {} behind
       delete entry.site;
+    } else {
+      entry.site = site;
     }
 
     return this.save();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descix/cli",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "DeSciX CLI and MCP Server - Unified command-line interface for DeSciX platform",
   "repository": {
     "type": "git",