@devrouter/cli 0.0.74 → 0.0.76

package/dist/devrouter.js

@@ -4256,7 +4256,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.74" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.76" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5509,7 +5509,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.74" : "0.0.0-dev";
+  return true ? "0.0.76" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -8413,6 +8413,12 @@ function isWildcard(values) {
 function sha256(contents) {
   return (0, import_node_crypto11.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
+function safeComposeProject(value) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
+    throw new Error(`Docker Compose project '${value}' is not a safe exact identifier.`);
+  }
+  return value;
+}
 function inspectManagedDevcontainerConfig(options) {
   const managedRuntime = options.config.managedRuntime;
   if (!managedRuntime) {
@@ -8531,6 +8537,91 @@ function managedComposeEnvironment(workspace) {
   }
   return env;
 }
+function assertReadableComposeFile(file) {
+  try {
+    if (!import_node_fs18.default.statSync(file).isFile()) throw new Error("not a regular file");
+    import_node_fs18.default.accessSync(file, import_node_fs18.default.constants.R_OK);
+  } catch {
+    throw new Error("Managed container Compose configuration contains an unreadable file.");
+  }
+}
+function assertManagedContainerConfigUnchanged(options) {
+  if (options.containers.length === 0) {
+    throw new Error("Managed container configuration cannot be verified without containers.");
+  }
+  for (const container of options.containers) {
+    const project = container.labels["com.docker.compose.project"];
+    const service = container.labels["com.docker.compose.service"];
+    const workingDirectory = container.labels["com.docker.compose.project.working_dir"];
+    const recordedConfigFiles = container.labels["com.docker.compose.project.config_files"];
+    const expectedHash = container.labels["com.docker.compose.config-hash"];
+    if (!project || !service || !workingDirectory || !recordedConfigFiles || !expectedHash || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(service) || !/^[a-f0-9]{64}$/.test(expectedHash)) {
+      throw new Error("Managed container is missing valid Compose identity and hash labels.");
+    }
+    const composeProject = safeComposeProject(project);
+    const configFiles2 = recordedConfigFiles.split(",").map((file) => file.trim());
+    if (configFiles2.some((file) => file.length === 0)) {
+      throw new Error("Managed container has an invalid recorded Compose file list.");
+    }
+    if (options.plan.composeFiles.some(
+      (expected) => !configFiles2.some((actual) => sameWorkspacePath(actual, expected))
+    )) {
+      throw new Error("Managed container Compose files do not include the managed plan files.");
+    }
+    for (const file of configFiles2) assertReadableComposeFile(file);
+    const fileArgs = configFiles2.flatMap((file) => ["-f", file]);
+    const result = (() => {
+      try {
+        const composeArgs = [
+          "compose",
+          "--project-name",
+          composeProject,
+          "--project-directory",
+          workingDirectory
+        ];
+        const env = managedComposeEnvironment(options.workspace);
+        const rendered = (0, import_node_child_process8.spawnSync)(
+          "docker",
+          [...composeArgs, ...fileArgs, "config", "--format", "json"],
+          {
+            cwd: workingDirectory,
+            encoding: "utf-8",
+            env,
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: COMPOSE_HASH_TIMEOUT_MS,
+            maxBuffer: 1024 * 1024
+          }
+        );
+        if (rendered.status !== 0 || rendered.error || !rendered.stdout?.trim()) {
+          throw new Error("Compose configuration rendering failed.");
+        }
+        return (0, import_node_child_process8.spawnSync)(
+          "docker",
+          [...composeArgs, "-f", "-", "config", "--no-interpolate", "--hash", service],
+          {
+            cwd: workingDirectory,
+            encoding: "utf-8",
+            env,
+            input: rendered.stdout,
+            stdio: ["pipe", "pipe", "ignore"],
+            timeout: COMPOSE_HASH_TIMEOUT_MS,
+            maxBuffer: 1024 * 1024
+          }
+        );
+      } catch {
+        throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
+      }
+    })();
+    if (result.status !== 0 || result.error) {
+      throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
+    }
+    const output2 = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    const match = /^(\S+)\s+([a-f0-9]{64})$/.exec(output2);
+    if (!match || match[1] !== service || match[2] !== expectedHash) {
+      throw new Error(`Managed Compose configuration changed for service '${service}'.`);
+    }
+  }
+}
 function stopExactManagedService(containerId, service, options) {
   assertSafeContainerId(containerId);
   const result = (0, import_node_child_process8.spawnSync)("docker", ["stop", containerId], {
@@ -8543,7 +8634,7 @@ function stopExactManagedService(containerId, service, options) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process8, import_node_crypto11, import_node_fs18, import_node_path25, import_yaml3, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process8, import_node_crypto11, import_node_fs18, import_node_path25, import_yaml3, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER, COMPOSE_HASH_TIMEOUT_MS;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
@@ -8559,6 +8650,7 @@ var init_devcontainer_profile = __esm({
     init_workspace();
     MANAGED_DEVCONTAINER_PATH = ".devcontainer/devcontainer.devrouter.json";
     MANAGED_DEVCONTAINER_MARKER = "// devrouter:managed devcontainer profile";
+    COMPOSE_HASH_TIMEOUT_MS = 1e4;
   }
 });
 
@@ -10529,8 +10621,30 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
 }
 function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
   if (!import_node_fs25.default.existsSync(import_node_path33.default.join(repoPath, ".devrouter.yml"))) return false;
+  if (!loadRepoConfig(repoPath).managedRuntime) return false;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+  const identity2 = { repoPath, workspace: workspace ?? null, provider: "devsy" };
+  const readAuthority = () => {
+    const record5 = readReliabilityOperation(identity2);
+    const operation = record5?.state.operation;
+    const entries = record5?.state.operationHistory.filter((entry2) => entry2.id === operation?.id);
+    const entry = entries?.[0];
+    if (!record5 || !(0, import_node_util9.isDeepStrictEqual)(record5.identity, identity2) || record5.worker || !operation || operation.kind !== "ensure" || !operation.drained || !["COMPLETED", "INTERRUPTED", "COMPLETION_UNKNOWN"].includes(operation.status) || record5.state.phase !== "stopping" || record5.state.desired !== "stopped-by-user" || entries?.length !== 1 || !entry || entry.kind !== "ensure" || !entry.profile || !entry.drained || entry.status !== operation.status)
+      throw new Error("Initial managed stop requires the drained ensure's recorded profile.");
+    return {
+      identity: record5.identity,
+      fence: reliabilityFence(record5.state),
+      operation,
+      entry
+    };
+  };
+  const authority = readAuthority();
+  const gitCommonDir = linked ? resolveGitCommonDir(repoPath) : void 0;
+  const workspaceEnv = workspace && gitCommonDir ? { token: workspace, gitCommonDir } : void 0;
+  function canonicalProfile(recorded) {
+    return resolveProfile(loadRepoConfig(repoPath), recorded).name;
+  }
   const registration2 = () => {
     resetWorkspaceRuntimeCaches();
     if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy")
@@ -10540,14 +10654,21 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       throw new Error("Initial managed stop requires one exact Devsy registration.");
     if (linked) {
       const record5 = workspace ? readWorkspaceOwnership(repoPath, workspace) : void 0;
-      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace)
+      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present")
         throw new Error("Initial managed stop workspace ownership changed.");
     }
     return owner2.workspace;
   };
-  const runtime = loadRuntimeConfig(repoPath, workspace ?? "");
-  if (!runtime.config.managedRuntime) return false;
+  const canonicalName = canonicalProfile(authority.entry.profile);
+  const runtime = loadRuntimeConfig(repoPath, workspace ?? "", canonicalName);
+  if (!runtime.config.managedRuntime || runtime.profile !== canonicalName)
+    throw new Error("Initial managed stop requires the recorded managed profile.");
   const owner = registration2();
+  proveLocalDockerSelection(owner);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Initial managed stop requires a pinned local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
   if (!owner.context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId))
     throw new Error("Initial managed stop requires exact provider context.");
   const plan = inspectManagedDevcontainerConfig({
@@ -10567,27 +10688,53 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     ".docker-compose"
   );
   const observe = () => {
-    if (!(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace))
-      throw new Error("Initial managed stop ownership or runtime state changed.");
+    if (!(0, import_node_util9.isDeepStrictEqual)(readAuthority(), authority) || !(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace) || resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
+      throw new Error("Initial managed stop authority or runtime state changed.");
+    proveLocalDockerSelection(owner);
+    if (listDevpodWorkspacesRaw({ readLocalWhenMissing: true }).some(
+      (entry) => entry.id === devsyId || entry.source.localFolder !== "" && sameWorkspacePath(entry.source.localFolder, repoPath)
+    ))
+      throw new Error("Initial managed stop found conflicting provider ownership.");
+    if (canonicalProfile(authority.entry.profile) !== canonicalName)
+      throw new Error("Initial managed stop configuration changed.");
+    const currentRuntime = loadRuntimeConfig(repoPath, workspace ?? "", canonicalName);
+    const currentPlan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: currentRuntime.config,
+      profile: currentRuntime.resolvedProfile,
+      linked
+    });
+    if (currentRuntime.profile !== canonicalName || !(0, import_node_util9.isDeepStrictEqual)(currentRuntime.resolvedProfile, runtime.resolvedProfile) || !(0, import_node_util9.isDeepStrictEqual)(currentPlan, plan) || inspectManagedDevcontainerGeneratedConfig(currentPlan).status !== "valid")
+      throw new Error("Initial managed stop configuration changed.");
     const matches = inspectWorkspaceContainers().filter(
       (c) => sameWorkspacePath(
         c.labels["com.docker.compose.project.working_dir"] ?? "",
         plan.composeDirectory
       )
     );
-    if (!matches.length) return [];
+    if (!matches.length)
+      throw new Error("Initial managed stop requires its complete selected population.");
     const projects = new Set(matches.map((c) => c.labels["com.docker.compose.project"]));
     if (projects.size !== 1 || !matches[0]?.labels["com.docker.compose.project"])
       throw new Error("Initial managed stop requires one exact Compose project.");
     const population = inspectManagedStopContainers(
-      matches[0].labels["com.docker.compose.project"]
+      matches[0].labels["com.docker.compose.project"],
+      endpoint
     );
     if (!sameSet(
+      inspectManagedStopWorkspaceIds(endpoint, plan.composeDirectory),
+      population.map((c) => c.id)
+    ) || !sameSet(
       matches.map((c) => c.id),
       population.map((c) => c.id)
     ))
       throw new Error("Initial managed stop population changed.");
-    proveManagedComposePopulation({
+    if (!sameSet(
+      population.map((c) => c.labels["com.docker.compose.service"] ?? ""),
+      plan.desiredServices
+    ))
+      throw new Error("Initial managed stop requires its complete selected population.");
+    const primary = proveManagedComposePopulation({
       plan,
       repoPath,
       composeProject: matches[0].labels["com.docker.compose.project"],
@@ -10595,9 +10742,23 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       featureDirectory,
       containers: population
     });
+    const uidBytes = Buffer.byteLength(owner.uid ?? "");
+    const runnerId = (uidBytes === 16 || uidBytes === 40 ? owner.uid : void 0) ?? devsyId;
+    if (owner.source.container && owner.source.container !== primary.id || !owner.source.container && inspectManagedStopRunnerId(endpoint, primary.id) !== runnerId)
+      throw new Error("Initial managed stop provider-to-container binding changed.");
+    if (!owner.source.container && !sameSet(inspectProviderRunnerContainers(endpoint, runnerId), [primary.id]))
+      throw new Error("Initial managed stop provider runner population changed.");
+    assertManagedContainerConfigUnchanged({
+      plan,
+      containers: population,
+      workspace: workspaceEnv
+    });
+    if (!(0, import_node_util9.isDeepStrictEqual)(readAuthority(), authority) || !(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
+      throw new Error("Initial managed stop authority changed during inspection.");
     return population;
   };
   const initial = observe();
+  const stopped = new Set(initial.filter((c) => !c.state.Running).map((c) => c.id));
   const stable = () => {
     const current = observe();
     if (!sameSet(
@@ -10605,19 +10766,21 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       current.map((c) => c.id)
     ) || current.some((c) => {
       const prior = initial.find((p) => p.id === c.id);
-      return !prior || containerIdentity(prior) !== containerIdentity(c) || !prior.state.Running && c.state.Running;
+      return !prior || containerIdentity(prior) !== containerIdentity(c) || stopped.has(c.id) && c.state.Running;
     }))
       throw new Error("Initial managed stop population or identity changed.");
+    for (const c of current) if (!c.state.Running) stopped.add(c.id);
     return current;
   };
   stable();
-  if (!initial.length) return false;
   for (const container of initial) {
     const current = stable().find((c) => c.id === container.id);
-    if (current?.state.Running)
-      stopExactManagedService(current.id, current.labels["com.docker.compose.service"] ?? "", {
-        timeoutMs: 3e4
-      });
+    if (current?.state.Running) {
+      claimLifecycleEffect();
+      stopPinnedManagedContainer(endpoint, current.id);
+      if (stable().find((c) => c.id === current.id)?.state.Running)
+        throw new Error("Initial managed stop container cessation is not proven.");
+    }
   }
   if (stable().some((c) => c.state.Running))
     throw new Error("Initial managed stop left a workload running.");
@@ -10837,11 +11000,15 @@ var init_managed_devsy_stop = __esm({
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_registry();
+    init_devsy_exec_proof();
     init_devsy_workspaces();
     init_host_routes();
     init_managed_compose_population();
     init_managed_runtime_state();
     init_managed_stop_recovery();
+    init_reliability_context();
+    init_reliability_contract();
+    init_reliability_operation_store();
     init_repo_config();
     init_route_publication();
     init_traefik_route_health();
@@ -20955,7 +21122,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.74" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.76" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -26396,7 +26563,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.74" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.76" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.74",
+  "version": "0.0.76",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.75.md

@@ -0,0 +1,35 @@
+# Upgrade to devrouter 0.0.75
+
+This patch fixes canonical stop after initial managed Devsy startup is cancelled
+before managed runtime state is saved. Stop uses the exact drained ensure's
+recorded profile and validates complete live ownership and Compose configuration
+hashes. No configuration schema, command, flag or runtime-provider migration is
+required.
+
+## Task
+
+Use the published 0.0.75 CLI. Update `.devrouter.yml` devrouter.version to 0.0.75
+only when consumer source changes are authorized. Preserve staged work owned by
+another task. Refresh generated agent guidance only with the repository owner's
+authority. No DevPod installation is needed.
+
+For an affected exact checkout, use `devrouter stop <path> --json` with the same
+non-secret Compose inputs used at startup. Existing interrupted workspaces can
+recover when the exact operation history and all live configuration and ownership
+proofs remain available. Missing, unreadable, conflicting or changed evidence
+remains a refusal; never fabricate journal state or replace the selected profile
+with the default to bypass it. Stop is non-destructive and retains volumes.
+
+## Validation
+
+Verify the released CLI revision and exact checkout ownership. Let the checkout's
+runtime owner perform the canonical stop, require provider cessation and route
+removal proof, then verify stopped lifecycle state. Revalidate port conflicts
+before a new ensure and require its own provider, application and route proof.
+A successful stop or source test does not prove successful application startup.
+
+## Report
+
+Report release version/revision, exact checkout, producing stop result and
+lifecycle state, subsequent ensure evidence or precise refusal, and source/index
+preservation. Separate released source from live consumer acceptance.

package/upgrade-prompts/0.0.76.md

@@ -0,0 +1,33 @@
+# Upgrade to devrouter 0.0.76
+
+This patch accepts canonical-equivalent historical profile selections during
+initial managed stop and prevents first-transition rollback from contradicting
+captured degraded configuration. No schema, command or flag migration is needed.
+
+## Task
+
+Use the published 0.0.76 CLI. Update `.devrouter.yml` devrouter.version only when
+consumer source changes are authorized. Preserve another task's staged work.
+Refresh generated agent guidance only with the repository owner's authority.
+No generated runtime configuration or journal rewrite is required or authorized.
+
+For an affected exact checkout, its runtime owner uses `devrouter stop <path>
+--json` with the original Compose inputs. Canonical-equivalent selections pass
+the profile check; every ownership and configuration proof still applies. A
+Compose hash refusal must be investigated rather than bypassed. Historical
+contradictory generated configuration remains unproved without writer evidence;
+a valid retained stop baseline can support containment, not automatic resume.
+
+## Validation
+
+Verify the installed version and exact checkout ownership. Require live provider,
+container and route cessation proof for stop. A later ensure needs its own runtime
+and readiness proof. New compatible failed-first-transition retries retain matching
+configuration; extra resources and manual drift remain refusals. Source tests or a
+passed profile check do not establish full consumer recovery.
+
+## Report
+
+Report release revision, installed executable, exact checkout, stop/ensure result
+or precise refusal, and source/index preservation. Separate release/install proof
+from live consumer acceptance.