@devrouter/cli 0.0.59 → 0.0.60

package/dist/devrouter-lifecycle-worker.js

@@ -1272,18 +1272,18 @@ function setTLSEnabled(enabled) {
   ensureRouterFiles();
   import_node_fs4.default.writeFileSync(TRAEFIK_DYNAMIC_BASE_FILE, renderTraefikBaseDynamicYml(enabled), "utf-8");
 }
-function isTLSConfigured() {
+function isTLSConfigured(read = (file) => import_node_fs4.default.readFileSync(file, "utf-8")) {
   if (!import_node_fs4.default.existsSync(TRAEFIK_DYNAMIC_BASE_FILE)) {
     return false;
   }
-  const content = import_node_fs4.default.readFileSync(TRAEFIK_DYNAMIC_BASE_FILE, "utf-8");
+  const content = read(TRAEFIK_DYNAMIC_BASE_FILE);
   return content.includes("certificates:") && content.includes("/certs/localhost.pem");
 }
 function areTLSCertsPresent() {
   return import_node_fs4.default.existsSync(CERT_FILE) && import_node_fs4.default.existsSync(CERT_KEY_FILE);
 }
-function isTLSEnabled() {
-  return areTLSCertsPresent() && isTLSConfigured();
+function isTLSEnabled(read) {
+  return areTLSCertsPresent() && isTLSConfigured(read);
 }
 function runDockerCompose(args) {
   const result = (0, import_node_child_process6.spawnSync)("docker", ["compose", "-f", COMPOSE_FILE, ...args], {
@@ -1717,10 +1717,10 @@ function writeRouteGeneration(routes, tlsEnabled) {
   writeFileAtomically(HOST_ROUTES_STATE_FILE, renderCompatibilityState(routes));
   writeFileAtomically(TRAEFIK_HOST_ROUTES_FILE, renderCanonicalState(routes, tlsEnabled));
 }
-function readCompatibilityState() {
+function readCompatibilityState(read = (file) => import_node_fs6.default.readFileSync(file, "utf-8")) {
   let raw;
   try {
-    raw = import_node_fs6.default.readFileSync(HOST_ROUTES_STATE_FILE, "utf-8");
+    raw = read(HOST_ROUTES_STATE_FILE);
   } catch (error) {
     throw new Error(
       `Could not read the compatibility host-route state: ${error.message}`
@@ -1963,12 +1963,12 @@ function validateState(value, repoPath, workspace) {
     updatedAt: candidate.updatedAt
   };
 }
-function readManagedRuntimeState(repoPath, workspace) {
+function readManagedRuntimeState(repoPath, workspace, read = (file) => import_node_fs7.default.readFileSync(file, "utf-8")) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
   if (!import_node_fs7.default.existsSync(statePath)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs7.default.readFileSync(statePath, "utf-8"));
+    parsed = JSON.parse(read(statePath));
   } catch (error) {
     throw new Error(`Could not parse managed runtime state: ${String(error)}`);
   }
@@ -2785,7 +2785,10 @@ function readReliabilityOperation(identity) {
   const file = reliabilityOperationPath(identity);
   let descriptor;
   try {
-    descriptor = import_node_fs8.default.openSync(file, import_node_fs8.default.constants.O_RDONLY | import_node_fs8.default.constants.O_NOFOLLOW);
+    descriptor = import_node_fs8.default.openSync(
+      file,
+      import_node_fs8.default.constants.O_RDONLY | import_node_fs8.default.constants.O_NOFOLLOW | import_node_fs8.default.constants.O_NONBLOCK
+    );
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -2795,7 +2798,12 @@ function readReliabilityOperation(identity) {
     if (!stat.isFile() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
       throw new Error("Reliability record is not a bounded private file.");
     }
-    const record3 = JSON.parse(import_node_fs8.default.readFileSync(descriptor, "utf8"));
+    const bytes = Buffer.alloc(MAX_RECORD_BYTES + 1);
+    const count = import_node_fs8.default.readSync(descriptor, bytes, 0, bytes.length, 0);
+    if (count > MAX_RECORD_BYTES) throw new Error("Reliability record exceeds its byte limit.");
+    const record3 = JSON.parse(
+      bytes.subarray(0, count).toString("utf8")
+    );
     validate(record3, identity);
     return record3;
   } finally {
@@ -4492,7 +4500,7 @@ function resolveRepoPath(repoPath) {
 function getRepoConfigPath(repoPath) {
   return import_node_path15.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
-function loadRepoConfig(repoPath) {
+function loadRepoConfig(repoPath, read = (file) => import_node_fs13.default.readFileSync(file, "utf-8")) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   if (!import_node_fs13.default.existsSync(configPath)) {
@@ -4500,12 +4508,12 @@ function loadRepoConfig(repoPath) {
       `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
     );
   }
-  const raw = import_node_fs13.default.readFileSync(configPath, "utf-8");
+  const raw = read(configPath);
   const parsed = import_yaml3.default.parse(raw);
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.59" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.60" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6067,7 +6075,7 @@ function probeHttpRoute(host, options = {}) {
     throw new Error("maxTimeSeconds must be a positive finite number.");
   }
   if (options.readiness !== void 0) {
-    return probeHttpReadiness(host, options.readiness, maxTimeSeconds, options.repoPath);
+    return probeHttpReadinessSync(host, options.readiness, maxTimeSeconds, options.repoPath);
   }
   const tlsEnabled = isTLSEnabled();
   const url = `${tlsEnabled ? "https" : "http"}://${host}`;
@@ -6093,33 +6101,16 @@ function probeHttpRoute(host, options = {}) {
   const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
   return { ok, status, details };
 }
-function probeHttpReadiness(host, readiness, maxTimeSeconds, repoPath) {
+function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   const parentTimeoutMs = maxTimeSeconds * 1e3 + PARENT_TIMEOUT_PADDING_MS;
   if (!Number.isFinite(parentTimeoutMs)) {
     throw new Error("maxTimeSeconds is too large for a bounded probe timeout.");
   }
   const tlsEnabled = isTLSEnabled();
-  const url = `${tlsEnabled ? "https" : "http"}://${host}${readiness.path}`;
-  const args = [
-    "--disable",
-    "--globoff",
-    "--silent",
-    "--show-error",
-    "--no-location",
-    "--noproxy",
-    "*",
-    "--output",
-    "/dev/null",
-    "--write-out",
-    "%{http_code}	%{content_type}",
-    "--max-time",
-    String(maxTimeSeconds)
-  ];
+  const args = buildHttpReadinessCurlArgs(host, readiness, maxTimeSeconds, tlsEnabled);
   if (tlsEnabled) {
     getMkcertRootCAPath({ repoPath });
-    args.push("--cacert", CERT_FILE);
   }
-  args.push(url);
   let result;
   try {
     result = (0, import_node_child_process17.spawnSync)("curl", args, {
@@ -6134,6 +6125,30 @@ function probeHttpReadiness(host, readiness, maxTimeSeconds, repoPath) {
     return transportFailure();
   }
   const metadata = typeof result.stdout === "string" ? result.stdout : "";
+  return parseHttpReadinessMetadata(metadata, readiness);
+}
+function buildHttpReadinessCurlArgs(host, readiness, maxTimeSeconds, tlsEnabled) {
+  const url = `${tlsEnabled ? "https" : "http"}://${host}${readiness.path}`;
+  const args = [
+    "--disable",
+    "--globoff",
+    "--silent",
+    "--show-error",
+    "--no-location",
+    "--noproxy",
+    "*",
+    "--output",
+    "/dev/null",
+    "--write-out",
+    "%{http_code}	%{content_type}",
+    "--max-time",
+    String(maxTimeSeconds)
+  ];
+  if (tlsEnabled) args.push("--cacert", CERT_FILE);
+  args.push(url);
+  return args;
+}
+function parseHttpReadinessMetadata(metadata, readiness) {
   if (metadata.length > CONTRACT_MAX_BUFFER) {
     return transportFailure();
   }
@@ -7845,6 +7860,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     let managedConfigWritten = false;
     let managedWorkspaceEnv;
     let firstTransitionBaseline;
+    let detachedState;
+    let resetCandidateState;
     const routeLoadOptions = {
       initialTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 3e3),
       recoveryTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 1e4),
@@ -7880,6 +7897,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       if (managedRuntime) {
         previousManagedState = readManagedRuntimeState(repoPath, target.workspace);
         if (!options.repair && previousManagedState && !hasExactManagedComposeProject(repoPath, previousManagedState)) {
+          detachedState = previousManagedState;
           previousManagedState = void 0;
         }
         if (previousManagedState && previousManagedState.devpodId !== target.devpodId) {
@@ -8097,6 +8115,25 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         );
         container = await preflight(options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS);
         managedContainer = container;
+        if (detachedState && devpodId) {
+          resetCandidateState = {
+            version: 1,
+            repoPath,
+            ...target.workspace !== void 0 ? { workspace: target.workspace } : {},
+            devpodId,
+            composeProject: managedComposeProject,
+            profile: runtime.profile,
+            desired: {
+              apps: apps.map((app) => app.name).sort(),
+              services: [...managedPlan.desiredProfileServices].sort(),
+              processes: [...desiredProcesses].sort()
+            },
+            sourceConfigSha256: managedPlan.sourceConfigSha256,
+            effectiveConfigSha256: managedPlan.effectiveConfigSha256,
+            status: "degraded",
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+        }
       }
       if (options.repair && managedPlan)
         assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
@@ -8272,6 +8309,83 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         ...managedRuntimeStatus ? { managedRuntime: managedRuntimeStatus } : {}
       };
     } catch (error) {
+      if (detachedState) {
+        const failures = [];
+        const resetWorkspace = detachedState.workspace;
+        try {
+          const routes = listHostRouteState().filter(
+            (route) => sameWorkspacePath(route.repoPath, repoPath)
+          );
+          if (routes.some((route) => route.workspace !== resetWorkspace)) {
+            throw new Error("Reset recovery found a foreign workspace route.");
+          }
+          claimLifecycleEffect();
+          replaceHostRoutesForRepo(repoPath, []);
+          await ensureTraefikRoutesRemoved([...routes, ...candidateRoutes], {
+            ...routeLoadOptions,
+            allowRestart: false
+          });
+        } catch (cleanupError) {
+          failures.push(
+            `routes: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`
+          );
+        }
+        if (managedContainer) {
+          for (const name of managedProcessRegistry) {
+            try {
+              claimLifecycleEffect();
+              runManagedProcessAction({
+                container: managedContainer,
+                name,
+                action: "stop",
+                quiet: options.quiet
+              });
+            } catch (cleanupError) {
+              failures.push(
+                `process '${name}': ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`
+              );
+            }
+          }
+        }
+        if (resetCandidateState && managedPlan && managedContainer && managedComposeProject) {
+          try {
+            await waitForManagedServices(
+              managedPlan,
+              repoPath,
+              managedComposeProject,
+              managedPlan.desiredServices,
+              managedContainer.id,
+              0
+            );
+            assertManagedContainerConfigUnchanged({
+              plan: managedPlan,
+              containers: inspectWorkspaceContainers({ composeProject: managedComposeProject }),
+              workspace: managedWorkspaceEnv
+            });
+            if (inspectManagedDevcontainerGeneratedConfig(managedPlan).status !== "valid") {
+              throw new Error("Reset candidate configuration changed before recovery persistence.");
+            }
+            claimLifecycleEffect();
+            writeManagedRuntimeState({
+              ...resetCandidateState,
+              transitionPhase,
+              updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+          } catch (stateError) {
+            failures.push(
+              `state: ${stateError instanceof Error ? stateError.message : String(stateError)}`
+            );
+          }
+        } else {
+          failures.push(
+            "candidate ownership and complete service population were not proved; recovery state was not replaced"
+          );
+        }
+        const original = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${original} Reset candidate retained for recovery.${failures.length ? ` Recovery incomplete: ${failures.join("; ")}.` : " State is degraded."}`
+        );
+      }
       if (options.repair && !repairMutationStarted) throw error;
       if (options.repair && repairMutationStarted && previousManagedState && managedPlan) {
         const failures = [];
@@ -8368,7 +8482,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           if (!managedPostStartPlan) {
             throw new Error("Managed post-start plan disappeared during rollback.");
           }
-          if (previousManagedState?.status !== "degraded") {
+          if (previousProcesses.length > 0 && previousManagedState?.status !== "degraded") {
             claimLifecycleEffect();
             runManagedPostStart({
               plan: managedPostStartPlan,