@devrouter/cli 0.0.49 → 0.0.50

package/dist/devrouter.js

@@ -2668,7 +2668,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.49" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.50" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -8986,7 +8986,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.49" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.50" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -9772,8 +9772,8 @@ function inspectRouterApi(protocol) {
     )
   };
 }
-function inspectExpectedRoutes(routes) {
-  const missing = [];
+function inspectExpectedRoutes(routes, expectation) {
+  const mismatched = [];
   const failures = [];
   for (const protocol of ["http", "tcp"]) {
     const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
@@ -9781,28 +9781,34 @@ function inspectExpectedRoutes(routes) {
     const result = inspectRouterApi(protocol);
     if (!result.ok) {
       failures.push(result.details);
-      missing.push(...expected);
+      mismatched.push(...expected);
       continue;
     }
-    const absent = expected.filter((name) => !result.names.has(name));
-    if (absent.length > 0 && result.reachedPageLimit) {
+    const unexpected = expected.filter(
+      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
+    );
+    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
+    if (boundedAbsenceIsUncertain) {
       failures.push(
         `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
       );
     }
-    missing.push(...absent);
+    mismatched.push(...unexpected);
+    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
+      mismatched.push(...expected);
+    }
   }
-  return missing.length === 0 ? { ok: true } : {
+  return mismatched.length === 0 ? { ok: true } : {
     ok: false,
-    missing,
-    details: failures.length > 0 ? failures.join("; ") : "router names are absent"
+    routes: mismatched,
+    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
   };
 }
-async function waitForExpectedRoutes(routes, timeoutMs, pollIntervalMs) {
+async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
   const deadline = Date.now() + timeoutMs;
   let result;
   do {
-    result = inspectExpectedRoutes(routes);
+    result = inspectExpectedRoutes(routes, expectation);
     if (result.ok) return result;
     if (Date.now() < deadline) {
       await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
@@ -9810,12 +9816,17 @@ async function waitForExpectedRoutes(routes, timeoutMs, pollIntervalMs) {
   } while (Date.now() < deadline);
   return result;
 }
-async function ensureTraefikRoutesLoaded(routes, options = {}) {
+async function ensureTraefikRouteExpectation(routes, expectation, options) {
   if (routes.length === 0) return { restarted: false };
   const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
   const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
   const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const initial = await waitForExpectedRoutes(routes, initialTimeoutMs, pollIntervalMs);
+  const initial = await waitForExpectedRoutes(
+    routes,
+    expectation,
+    initialTimeoutMs,
+    pollIntervalMs
+  );
   if (initial.ok) return { restarted: false };
   import_node_fs24.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
@@ -9827,17 +9838,29 @@ async function ensureTraefikRoutesLoaded(routes, options = {}) {
       onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
     },
     async () => {
-      const recheck = await waitForExpectedRoutes(routes, 0, pollIntervalMs);
+      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
       if (recheck.ok) return { restarted: false };
       restartRouterStack();
-      const recovered = await waitForExpectedRoutes(routes, recoveryTimeoutMs, pollIntervalMs);
+      const recovered = await waitForExpectedRoutes(
+        routes,
+        expectation,
+        recoveryTimeoutMs,
+        pollIntervalMs
+      );
       if (recovered.ok) return { restarted: true };
+      const action2 = expectation === "loaded" ? "load" : "remove";
       throw new Error(
-        `Traefik did not load file-provider routes after one restart: ${recovered.missing.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
+        `Traefik did not ${action2} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
       );
     }
   );
 }
+async function ensureTraefikRoutesLoaded(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "loaded", options);
+}
+async function ensureTraefikRoutesRemoved(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "removed", options);
+}
 var import_node_child_process20, import_node_fs24, import_node_path25, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
@@ -9995,6 +10018,13 @@ function routeInputFromState(route) {
     workspace: route.workspace
   };
 }
+function routeReferenceKey(route) {
+  return `${route.repoPath}\0${route.name}\0${route.protocol ?? "http"}`;
+}
+function removedRoutesForReplacement(previousRoutes, nextRoutes) {
+  const nextKeys = new Set(nextRoutes.map(routeReferenceKey));
+  return previousRoutes.filter((route) => !nextKeys.has(routeReferenceKey(route)));
+}
 function isWildcard2(values) {
   return values?.length === 1 && values[0] === "*";
 }
@@ -10306,6 +10336,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     let managedComposeProject;
     let managedContainer;
     let previousRoutes = [];
+    let candidateRoutes = [];
     let candidateRoutesPublished = false;
     let transitionPhase = "validation";
     let managedProcessRegistry = [];
@@ -10335,6 +10366,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         options.profile
       );
       const managedRuntime = runtime.config.managedRuntime;
+      previousRoutes = listHostRouteState().filter(
+        (route) => sameWorkspacePath(route.repoPath, repoPath)
+      );
       managedRuntimeConfig = managedRuntime ? runtime.config : void 0;
       managedProcessRegistry = managedRuntime?.processes ?? [];
       const desiredProcesses = managedRuntime ? desiredManagedProcesses(managedRuntime, runtime.resolvedProfile) : [];
@@ -10363,9 +10397,6 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         )) {
           throw new Error("Managed runtime state contains an unregistered process marker.");
         }
-        previousRoutes = listHostRouteState().filter(
-          (route) => sameWorkspacePath(route.repoPath, repoPath)
-        );
         if (managedPostStart.kind !== "runtime") {
           throw new Error(
             "managedRuntime requires the runtime managed post-start adapter for exact process reconciliation."
@@ -10556,8 +10587,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         runtime.config,
         target.workspace
       );
+      candidateRoutes = publication.routes;
       candidateRoutesPublished = true;
       await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
+      await ensureTraefikRoutesRemoved(
+        removedRoutesForReplacement(previousRoutes.map(routeInputFromState), publication.routes),
+        routeLoadOptions
+      );
       try {
         await waitForHttpRoutes(
           repoPath,
@@ -10569,6 +10605,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           throw error;
         }
         replaceHostRoutesForRepo(repoPath, []);
+        await ensureTraefikRoutesRemoved(candidateRoutes, routeLoadOptions);
         if (!target.hadExactDevpod || recreated) {
           throw error;
         }
@@ -10758,6 +10795,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             const rollbackRoutes = previousRoutes.map(routeInputFromState);
             replaceHostRoutesForRepo(repoPath, rollbackRoutes);
             await ensureTraefikRoutesLoaded(rollbackRoutes, routeLoadOptions);
+            await ensureTraefikRoutesRemoved(
+              removedRoutesForReplacement(candidateRoutes, rollbackRoutes),
+              routeLoadOptions
+            );
           } catch (rollbackError) {
             rollbackErrors.push(
               `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -10803,6 +10844,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             const rollbackRoutes = previousRoutes.map(routeInputFromState);
             replaceHostRoutesForRepo(repoPath, rollbackRoutes);
             await ensureTraefikRoutesLoaded(rollbackRoutes, routeLoadOptions);
+            await ensureTraefikRoutesRemoved(
+              removedRoutesForReplacement(candidateRoutes, rollbackRoutes),
+              routeLoadOptions
+            );
           } catch (rollbackError) {
             rollbackErrors.push(
               `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -10821,6 +10866,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       if (environmentStarted) {
         try {
           replaceHostRoutesForRepo(repoPath, []);
+          await ensureTraefikRoutesRemoved(candidateRoutes, routeLoadOptions);
         } catch (cleanupError) {
           const original = error instanceof Error ? error.message : String(error);
           const cleanup = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
@@ -11189,12 +11235,13 @@ function workspaceLs(repoPath) {
     };
   });
 }
-function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = false) {
+async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = false) {
   const devpods = listDevpodWorkspaces(resolved.worktreePath);
   assertDevpodTargetSafe(resolved, worktrees, devpods);
   const devpodId = resolved.record?.devpodId ?? resolved.workspace;
   const mutation = action2 === "stop" ? stopOwnedDevpodWorkspace(devpodId, resolved.worktreePath) : deleteOwnedDevpodWorkspace(devpodId, resolved.worktreePath);
   const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
+  await ensureTraefikRoutesRemoved(routes);
   if (!quiet) {
     process.stdout.write(
       `Freed ${routes.length} route(s) for workspace '${resolved.workspace}'.
@@ -11218,7 +11265,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     if (removeWorktree) {
       assertFullDownPreflight(mainRepo, resolved);
     }
-    const result = mutateWorkspaceRuntime(
+    const result = await mutateWorkspaceRuntime(
       action2 === "stop" ? "stop" : "delete",
       resolved,
       worktrees,
@@ -11290,6 +11337,7 @@ var init_workspace_lifecycle = __esm({
     init_devpod_workspaces();
     init_repo_config();
     init_route_state();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_ensure();
     init_workspace_ownership();
@@ -11341,6 +11389,7 @@ async function environmentStop(repoPath, options = {}) {
     const removedRoutes = removeHostRoutesWhere(
       (route) => sameWorkspacePath(route.repoPath, repoPath)
     );
+    await ensureTraefikRoutesRemoved(removedRoutes);
     return {
       kind: linked ? "linked" : "primary",
       repoPath,
@@ -11358,6 +11407,7 @@ var init_environment_stop = __esm({
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_lifecycle();
     init_workspace_ownership();
@@ -15510,7 +15560,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.49" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.50" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.49",
+  "version": "0.0.50",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.50.md

@@ -0,0 +1,26 @@
+# Upgrade to devrouter 0.0.50
+
+Devrouter now proves that Traefik unloaded exact HTTP and TCP routers removed
+by stop, down, managed profile replacement, or rollback. A stale router gets
+the same serialized Traefik-only restart used for publication recovery.
+
+1. Install `@devrouter/cli@0.0.50` on the host and bump `.devrouter.yml` to
+   `devrouter.version: 0.0.50`.
+2. Keep using the existing `devrouter ensure`, `devrouter stop`, and managed
+   profile commands. Route naming and configuration are unchanged.
+3. Treat a cleanup error after one restart as fail-closed evidence that
+   Traefik's live router set did not match the canonical route generation.
+
+Verification:
+
+- Run `devrouter -V --repo <checkout>` and confirm the installed CLI and local
+  repository report `0.0.50`.
+- Start one safe representative managed profile, verify its exact routes, then
+  stop that exact checkout and require both canonical route count and matching
+  Traefik API routers to be zero.
+
+Report template:
+
+- CLI/config version: `0.0.50`
+- Representative route publication and removal proof: `<passed, deferred, or details>`
+- Remaining blockers: `<none or details>`