@devrouter/cli 0.0.43 → 0.0.44

package/dist/devrouter.js

@@ -2509,7 +2509,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.43" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.44" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5964,6 +5964,9 @@ function parseCertificateDnsHosts(pem) {
 function isHostCoveredByCertificateHost(host, certificateHost) {
   const normalizedHost = normalizeHost(host);
   const normalizedCertificateHost = normalizeHost(certificateHost);
+  if (normalizedHost === normalizedCertificateHost) {
+    return true;
+  }
   if (normalizedCertificateHost.startsWith("*.")) {
     if (normalizedCertificateHost === "*.localhost") {
       return false;
@@ -5975,7 +5978,7 @@ function isHostCoveredByCertificateHost(host, certificateHost) {
     const wildcardPart = normalizedHost.slice(0, normalizedHost.length - suffix.length);
     return wildcardPart.length > 0 && !wildcardPart.includes(".");
   }
-  return normalizedHost === normalizedCertificateHost;
+  return false;
 }
 function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
   const normalizedRequired = normalizeUniqueHosts(requiredHosts);
@@ -5986,22 +5989,54 @@ function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
     )
   );
 }
-function readCurrentCertificateHosts() {
+function compactTLSCertificateHosts(hosts) {
+  const normalizedHosts = normalizeUniqueHosts(hosts);
+  const wildcardHosts = new Set(normalizedHosts.filter((host) => host.startsWith("*.")));
+  const siblingGroups = /* @__PURE__ */ new Map();
+  const compacted = new Set(wildcardHosts);
+  for (const host of normalizedHosts) {
+    if (host.startsWith("*.")) {
+      continue;
+    }
+    const labels = host.split(".");
+    if (labels.length < 3 || labels.at(-1) !== "localhost") {
+      compacted.add(host);
+      continue;
+    }
+    const suffix = labels.slice(1).join(".");
+    const siblings = siblingGroups.get(suffix) ?? [];
+    siblings.push(host);
+    siblingGroups.set(suffix, siblings);
+  }
+  for (const [suffix, siblings] of siblingGroups) {
+    const wildcard = `*.${suffix}`;
+    if (siblings.length > 1 || wildcardHosts.has(wildcard)) {
+      compacted.add(wildcard);
+      continue;
+    }
+    compacted.add(siblings[0]);
+  }
+  const selectedWildcards = Array.from(compacted).filter((host) => host.startsWith("*."));
+  return normalizeUniqueHosts(Array.from(compacted)).filter(
+    (host) => host.startsWith("*.") || !selectedWildcards.some((wildcard) => isHostCoveredByCertificateHost(host, wildcard))
+  );
+}
+function readCurrentCertificateHosts(options = {}) {
   if (!import_node_fs16.default.existsSync(CERT_FILE)) {
     return [];
   }
-  const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
-  return parseCertificateDnsHosts(pem);
-}
-function currentCertificateHostsOrEmpty() {
   try {
-    return readCurrentCertificateHosts();
-  } catch {
-    return [];
+    const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
+    return parseCertificateDnsHosts(pem);
+  } catch (error) {
+    if (options.replaceMalformed) {
+      return [];
+    }
+    throw error;
   }
 }
 function buildDesiredTLSCertificateHosts(requestedHosts, existingCertificateHosts) {
-  return normalizeUniqueHosts([
+  return compactTLSCertificateHosts([
     ...DEFAULT_TLS_CERT_HOSTS,
     ...existingCertificateHosts,
     ...requestedHosts
@@ -6009,35 +6044,75 @@ function buildDesiredTLSCertificateHosts(requestedHosts, existingCertificateHost
 }
 function getTLSHostCoverage(hosts) {
   const requiredHosts = normalizeUniqueHosts([...DEFAULT_TLS_CERT_HOSTS, ...hosts]);
-  const certificateHosts = readCurrentCertificateHosts();
-  const uncoveredHosts = findUncoveredCertificateHosts(requiredHosts, certificateHosts);
-  return {
-    requiredHosts,
-    certificateHosts,
-    uncoveredHosts
-  };
+  return withFileLockSync(
+    TLS_CERTIFICATE_LOCK_FILE,
+    { activity: "TLS certificate inspection", waitMs: TLS_CERTIFICATE_LOCK_WAIT_MS },
+    () => {
+      const certificateHosts = readCurrentCertificateHosts();
+      const uncoveredHosts = findUncoveredCertificateHosts(requiredHosts, certificateHosts);
+      return {
+        requiredHosts,
+        certificateHosts,
+        uncoveredHosts
+      };
+    }
+  );
 }
 async function applyTLSCertificate(options, installTrust) {
   ensureRouterFiles();
-  const alreadyEnabled = isTLSEnabled();
-  const desiredHosts = buildDesiredTLSCertificateHosts(
-    options.hosts ?? [],
-    currentCertificateHostsOrEmpty()
+  const result = withFileLockSync(
+    TLS_CERTIFICATE_LOCK_FILE,
+    {
+      activity: "TLS certificate refresh",
+      target: options.repoPath,
+      waitMs: TLS_CERTIFICATE_LOCK_WAIT_MS
+    },
+    () => {
+      const alreadyEnabled = isTLSEnabled();
+      if (installTrust) {
+        ensureMkcert();
+        runOrThrow("mkcert", ["-install"]);
+      } else {
+        getMkcertRootCAPath({ repoPath: options.repoPath });
+      }
+      const existingCertificateHosts = readCurrentCertificateHosts({
+        replaceMalformed: installTrust
+      });
+      const desiredHosts = buildDesiredTLSCertificateHosts(
+        options.hosts ?? [],
+        existingCertificateHosts
+      );
+      let certificateHosts = [];
+      let uncoveredHosts = [];
+      for (let attempt = 1; attempt <= TLS_CERTIFICATE_WRITE_ATTEMPTS; attempt += 1) {
+        runOrThrow("mkcert", [
+          "-cert-file",
+          CERT_FILE,
+          "-key-file",
+          CERT_KEY_FILE,
+          ...desiredHosts
+        ]);
+        certificateHosts = readCurrentCertificateHosts();
+        uncoveredHosts = findUncoveredCertificateHosts(desiredHosts, certificateHosts);
+        if (uncoveredHosts.length === 0) {
+          break;
+        }
+      }
+      if (uncoveredHosts.length > 0) {
+        throw new Error(
+          `mkcert did not produce certificate coverage for host(s): ${uncoveredHosts.join(", ")} after ${TLS_CERTIFICATE_WRITE_ATTEMPTS} attempts`
+        );
+      }
+      setTLSEnabled(true);
+      refreshHostRoutesDynamicFile();
+      return { alreadyEnabled, hosts: certificateHosts };
+    }
   );
-  if (installTrust) {
-    ensureMkcert();
-    runOrThrow("mkcert", ["-install"]);
-  } else {
-    getMkcertRootCAPath({ repoPath: options.repoPath });
-  }
-  runOrThrow("mkcert", ["-cert-file", CERT_FILE, "-key-file", CERT_KEY_FILE, ...desiredHosts]);
-  setTLSEnabled(true);
-  refreshHostRoutesDynamicFile();
   const routerContainer = await findContainerByName("devrouter-traefik");
   if (routerContainer && await isContainerRunning("devrouter-traefik")) {
     startRouterStack();
   }
-  return { alreadyEnabled, hosts: desiredHosts };
+  return result;
 }
 async function installTLS(options = {}) {
   return applyTLSCertificate(options, true);
@@ -6079,7 +6154,7 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto6, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS;
+var import_node_child_process8, import_node_crypto6, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
@@ -6088,9 +6163,13 @@ var init_tls = __esm({
     import_node_fs16 = __toESM(require("fs"));
     import_node_path15 = __toESM(require("path"));
     init_docker();
+    init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path15.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
+    TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
 });
 
@@ -8074,7 +8153,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.43" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.44" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -14280,7 +14359,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.43" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.44" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.43",
+  "version": "0.0.44",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.44.md

@@ -0,0 +1,30 @@
+# Upgrade to devrouter 0.0.44
+
+Shared local TLS certificate refresh now serializes inspection, generation,
+verification, and route-configuration refresh across parallel worktrees.
+
+1. Install `@devrouter/cli@0.0.44` on the host and bump `.devrouter.yml` to
+   `devrouter.version: 0.0.44`.
+2. Keep using `devrouter ensure <checkout>` for primary and linked checkouts.
+   Do not run `mkcert` manually for individual worktree hosts; Devrouter now
+   preserves and compacts shared certificate coverage under its own lock.
+3. Do not remove the shared certificate or lock as routine cleanup. Routine
+   refresh still fails closed on a malformed certificate; the explicit
+   repository-scoped setup command printed by Devrouter replaces that generated
+   certificate while holding the same machine-global lock.
+
+Verification:
+
+- Run `devrouter -V --repo <checkout>` and confirm the installed CLI and local
+  repository report `0.0.44`.
+- Start two linked checkouts concurrently with `devrouter ensure`; require both
+  namespaced HTTPS routes to pass readiness and remain covered afterward.
+- Run `devrouter doctor --repo <checkout>` and confirm no TLS host-coverage
+  warning remains.
+
+Report template:
+
+- CLI/config version: `0.0.44`
+- Parallel worktree routes: `<passed or details>`
+- TLS host coverage: `<passed or details>`
+- Remaining blockers: `<none or details>`