@devrouter/cli 0.0.33 → 0.0.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.33",
+  "version": "0.0.35",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -49,6 +49,7 @@
     "check": "biome check .",
     "check:fix": "biome check --write .",
     "check:docs-policy": "./scripts/check-docs-policy.sh",
+    "check:knowledge": "node --import tsx scripts/check-knowledge.ts",
     "format": "biome format --write .",
     "knip": "knip",
     "lint": "biome lint .",

package/upgrade-prompts/0.0.34.md

@@ -0,0 +1,28 @@
+# Upgrade to devrouter 0.0.34
+
+Devrouter now supplies its managed process helper at reconciliation time. Consumer images must not download, install, extract, or version-pin devrouter; `.devrouter.yml` is the only consumer-side devrouter version pin.
+
+1. Install `@devrouter/cli@0.0.34` on the host and bump `.devrouter.yml` to `devrouter.version: 0.0.34`.
+2. In a devrouter-managed `.devcontainer/post-start.sh`, keep the repository-owned environment and application command, require `DEVROUTER_PROCESS_HELPER`, and replace direct `devrouter-process ensure` with `"$DEVROUTER_PROCESS_HELPER" ensure`.
+3. Remove `postStartCommand` from `.devcontainer/devcontainer.json`. Canonical `devrouter ensure` delivers the helper and invokes the managed adapter after exact-container proof.
+4. Remove any `@devrouter/cli` download or `devrouter-process` installation/extraction from the consumer Dockerfile. Retain `procps` and `util-linux`; remove `tar` if the application does not otherwise need it.
+5. Run `devrouter repo agents --repo <checkout>` to refresh generated guidance.
+
+Apply the adapter, devcontainer JSON, and Dockerfile migration atomically. A fully legacy image-plus-hook scaffold remains temporarily supported, but a legacy adapter paired with a helper-free image fails before DevPod startup with migration guidance.
+
+Verification:
+
+- Run `devrouter repo devcontainer verify --repo <checkout> --json` and confirm `repo.devcontainer.no-devrouter-image-install` is `ok`.
+- Recreate from the helper-free Dockerfile, then run `devrouter ensure <checkout> --json` twice and confirm cold startup plus warm reuse succeed.
+- Run `devrouter exec <checkout> -- sh -c 'test ! -e /usr/local/bin/devrouter-process'` to prove the helper is absent from the image.
+- Run `devrouter exec <checkout> -- sh -c 'test -x /tmp/devrouter/bin/devrouter-process'` to prove the matching helper was delivered only at runtime.
+
+Report template:
+
+- CLI/config version: `0.0.34`
+- Adapter migration: `<file changed or not applicable>`
+- Image coupling diagnostic: `<ok or details>`
+- Cold/warm ensure: `<DevPod id and route evidence>`
+- Image helper absent: `<passed or failure details>`
+- Runtime helper present: `<passed or failure details>`
+- Remaining blockers: `<none or details>`

package/upgrade-prompts/0.0.35.md

@@ -0,0 +1,29 @@
+# Upgrade to devrouter 0.0.35
+
+Devrouter now binds provider mutations, managed processes, proxy upstreams, and published routes to one exact checkout and runtime generation. Configuration and ownership schemas are unchanged.
+
+1. Install `@devrouter/cli@0.0.35` on the host and bump `.devrouter.yml` to `devrouter.version: 0.0.35`.
+2. Replace raw `devpod up`, `devpod stop`, or `devpod delete` calls for managed environments with `devrouter ensure <checkout>`, `devrouter stop <checkout>`, `devrouter stop <checkout> --delete`, or the matching `devrouter workspace` command. Raw DevPod mutations bypass devrouter's machine-wide ownership lock.
+3. For every proxy app started through managed `ensure`, use the resolved checkout alias namespace. Prefer `${WORKSPACE}-<service>:<port>` in `.devrouter.yml` with matching `${WORKSPACE:-<project>}-<service>` Compose aliases for both HTTP and TCP routes.
+4. Keep the managed adapter contract from `0.0.34`: require `DEVROUTER_PROCESS_HELPER` and call `"$DEVROUTER_PROCESS_HELPER" ensure`. If reuse depends on non-secret runtime values beyond command and workspace identity, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to their comma-separated environment names before calling the helper. Secret-like names are rejected and raw values are never written to process state.
+5. Run `devrouter repo agents --repo <checkout>` to refresh generated guidance.
+
+No manual route-state migration is required. The first `0.0.35` route read migrates a valid headerless `0.0.34` generation; invalid canonical metadata fails closed instead of discarding routes.
+
+Verification:
+
+- Run `devrouter doctor --repo <checkout>` and `devrouter repo devcontainer verify --repo <checkout> --json`; confirm the managed post-start and upstream-alias checks are `ok`.
+- Run `devrouter ensure <checkout> --json` twice. Confirm the cold run starts the exact checkout and the warm run preserves the same DevPod and owned process group.
+- For a linked worktree, confirm every published HTTP/TCP upstream begins with its workspace token and every routed endpoint reaches that worktree.
+- Run `devrouter workspace ls --repo <repo> --json` and confirm each owner has one exact worktree path and DevPod ID.
+- If explicit DevPod cleanup is needed, use `devrouter stop <checkout> --delete --json` and confirm the Git checkout remains present.
+
+Report template:
+
+- CLI/config version: `0.0.35`
+- Raw DevPod lifecycle calls removed: `<yes or not applicable>`
+- Proxy alias namespace: `<workspace/project token and upstreams>`
+- Managed adapter and optional environment identity: `<ok or details>`
+- Cold/warm exact-checkout ensure: `<DevPod id and process evidence>`
+- Route and browser evidence: `<URLs and result>`
+- Remaining blockers: `<none or details>`