@devrouter/cli 0.0.76 → 0.0.78

package/dist/devrouter-lifecycle-worker.js

@@ -350,9 +350,25 @@ function acquireFileLock(lockPath, options) {
         }
         if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
           lastProgressAt = now;
+          let holder;
+          try {
+            const bytes2 = import_node_fs2.default.readFileSync(lockPath, "utf-8");
+            const record6 = parseLockRecord(bytes2);
+            if (record6.owner && isLockOwnerLive(record6.owner, livenessCache) && import_node_fs2.default.readFileSync(lockPath, "utf-8") === bytes2) {
+              holder = {
+                kind: "live",
+                pid: record6.owner.pid,
+                acquiredAtMs: record6.acquiredAtMs
+              };
+            }
+          } catch {
+          }
           options.onWait({
             waitingMs: now - waitStartedAt,
-            holderPid: queueState.leaderPid,
+            remainingWaitMs: Math.max(0, deadline - now),
+            queueLeaderPid: queueState.leaderPid,
+            holderPid: holder?.pid,
+            holderHeldMs: holder?.acquiredAtMs !== void 0 ? Math.max(0, now - holder.acquiredAtMs) : void 0,
             queuePosition: queueState.position,
             waitingOn: "queue"
           });
@@ -390,6 +406,7 @@ function acquireFileLock(lockPath, options) {
           lastProgressAt = now;
           options.onWait({
             waitingMs: now - waitStartedAt,
+            remainingWaitMs: Math.max(0, deadline - now),
             holderPid: state.pid,
             holderHeldMs: state.acquiredAtMs !== void 0 ? Math.max(0, now - state.acquiredAtMs) : void 0,
             queuePosition: queueState?.position,
@@ -444,9 +461,11 @@ async function withFileLock(lockPath, options, operation) {
 function createStderrWaitReporter(activity, target) {
   return (progress) => {
     const heldSeconds = progress.holderHeldMs !== void 0 ? `, held for ${Math.round(progress.holderHeldMs / 1e3)}s` : "";
-    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition} led by PID ${progress.holderPid}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
+    const holder = progress.holderPid !== void 0 ? `provider lock held by PID ${progress.holderPid}${heldSeconds}` : "provider lock holder unknown";
+    const remaining = progress.remainingWaitMs !== void 0 ? `; queue acquisition timeout in ${Math.ceil(progress.remainingWaitMs / 1e3)}s (does not stop the holder)` : "";
+    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition}; first waiter PID ${progress.queueLeaderPid}; ${holder}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
     process.stderr.write(
-      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far
+      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far${remaining}
 `
     );
   };
@@ -4683,7 +4702,7 @@ var ControllerStore = class {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.76" : "0.0.0-dev";
+  return true ? "0.0.78" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6383,7 +6402,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.76" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.78" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -13911,6 +13930,14 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             "Claimed network repair requires exact retained-network reconciliation; automatic repair is unavailable."
           );
       }
+      let earlyTlsRefreshed = false;
+      if (!options.repair) {
+        claimLifecycleEffect();
+        earlyTlsRefreshed = (await ensureTLSHostsCovered(
+          apps.map((app) => app.host),
+          { repoPath }
+        )).refreshed;
+      }
       if (managedPlan && !options.repair && !network) {
         if (!target.hadExactDevpod && devpodId && inspectLegacyNetworkCapacity({
           provider: resolveWorkspaceRuntimeOrDefault(repoPath),
@@ -14333,7 +14360,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         devpodId,
         urls,
         recreated,
-        tlsRefreshed: publication.tlsRefreshed,
+        tlsRefreshed: earlyTlsRefreshed || publication.tlsRefreshed,
         ...applicationReadiness ? { applicationReadiness } : {},
         ...managedRuntimeStatus ? { managedRuntime: managedRuntimeStatus } : {}
       };

package/dist/devrouter.js

@@ -474,9 +474,25 @@ function acquireFileLock(lockPath, options) {
         }
         if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
           lastProgressAt = now;
+          let holder;
+          try {
+            const bytes2 = import_node_fs2.default.readFileSync(lockPath, "utf-8");
+            const record6 = parseLockRecord(bytes2);
+            if (record6.owner && isLockOwnerLive(record6.owner, livenessCache) && import_node_fs2.default.readFileSync(lockPath, "utf-8") === bytes2) {
+              holder = {
+                kind: "live",
+                pid: record6.owner.pid,
+                acquiredAtMs: record6.acquiredAtMs
+              };
+            }
+          } catch {
+          }
           options.onWait({
             waitingMs: now - waitStartedAt,
-            holderPid: queueState.leaderPid,
+            remainingWaitMs: Math.max(0, deadline - now),
+            queueLeaderPid: queueState.leaderPid,
+            holderPid: holder?.pid,
+            holderHeldMs: holder?.acquiredAtMs !== void 0 ? Math.max(0, now - holder.acquiredAtMs) : void 0,
             queuePosition: queueState.position,
             waitingOn: "queue"
           });
@@ -514,6 +530,7 @@ function acquireFileLock(lockPath, options) {
           lastProgressAt = now;
           options.onWait({
             waitingMs: now - waitStartedAt,
+            remainingWaitMs: Math.max(0, deadline - now),
             holderPid: state.pid,
             holderHeldMs: state.acquiredAtMs !== void 0 ? Math.max(0, now - state.acquiredAtMs) : void 0,
             queuePosition: queueState?.position,
@@ -568,9 +585,11 @@ async function withFileLock(lockPath, options, operation) {
 function createStderrWaitReporter(activity, target) {
   return (progress) => {
     const heldSeconds = progress.holderHeldMs !== void 0 ? `, held for ${Math.round(progress.holderHeldMs / 1e3)}s` : "";
-    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition} led by PID ${progress.holderPid}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
+    const holder = progress.holderPid !== void 0 ? `provider lock held by PID ${progress.holderPid}${heldSeconds}` : "provider lock holder unknown";
+    const remaining = progress.remainingWaitMs !== void 0 ? `; queue acquisition timeout in ${Math.ceil(progress.remainingWaitMs / 1e3)}s (does not stop the holder)` : "";
+    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition}; first waiter PID ${progress.queueLeaderPid}; ${holder}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
     process.stderr.write(
-      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far
+      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far${remaining}
 `
     );
   };
@@ -4256,7 +4275,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.76" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.78" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5509,7 +5528,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.76" : "0.0.0-dev";
+  return true ? "0.0.78" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -15261,6 +15280,7 @@ var init_workspace_ensure = __esm({
     init_repo_config();
     init_route_publication();
     init_router();
+    init_tls();
     init_traefik_route_health();
     init_workspace();
     init_workspace_ownership();
@@ -21122,7 +21142,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.76" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.78" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -26563,7 +26583,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.76" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.78" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.76",
+  "version": "0.0.78",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.77.md

@@ -0,0 +1,35 @@
+# Upgrade to devrouter 0.0.77
+
+Ordinary ensure now prepares TLS coverage for resolved HTTP and TCP proxy hosts
+before provider startup and container-side repository hooks. The existing
+certificate lock preserves coverage for other checkouts. Late publication checks
+remain, and retained-runtime repair keeps its infrastructure-free behavior.
+No schema, command, flag, or environment-variable migration is needed.
+
+## Task
+
+Use the published 0.0.77 CLI. Update `.devrouter.yml` devrouter.version only when
+consumer source changes are authorized. Preserve staged work owned by another
+task. Refresh generated agent guidance only with the repository owner's authority.
+No generated runtime configuration or journal rewrite is needed.
+
+For an affected checkout, retain one owner for its supported ensure/check/stop
+sequence. Historical degraded state can select retained-runtime repair, which
+skips shared infrastructure. If certificate coverage is missing, reconcile it
+through the supported TLS setup or refresh path with the relevant machine-change
+authority; do not bypass TLS verification or repeat lifecycle mutations blindly.
+
+## Validation
+
+Verify the installed version and exact checkout ownership. Check that the served
+certificate validates the resolved hostname using the trusted local CA; certificate
+file coverage alone does not prove live serving. Verify application readiness
+separately. Finish with canonical stop and exact provider-stopped/zero-route proof
+unless the owner explicitly retains the runtime. Preserve live-worker, ownership,
+configuration and surviving-resource refusals.
+
+## Report
+
+Report release revision, installed executable, exact checkout and producing-run
+results. Separate source/CI and TLS proof from application readiness and runtime
+shutdown. A trusted TLS handshake or an HTTP404 is not successful app recovery.

package/upgrade-prompts/0.0.78.md

@@ -0,0 +1,35 @@
+# Upgrade to devrouter 0.0.78
+
+Provider queue diagnostics now distinguish the first waiter from the observed
+lock holder. They report held duration and remaining acquisition time, including
+that acquisition timeout does not stop the holder. Missing or changing evidence
+reports an unknown holder. Acquisition, ownership, cancellation and startup
+behavior remain unchanged. No schema, command, flag or environment migration is
+needed.
+
+## Task
+
+Use the published 0.0.78 CLI. Update the repository devrouter.version metadata
+only when consumer source changes are authorized. Preserve staged work and the
+existing runtime owner. Refresh generated agent guidance only with its owner's
+authority. No generated runtime configuration or journal rewrite is needed.
+
+For a queued operation, distinguish its queue leader from the observed provider
+lock holder. An acquisition timeout describes the waiting operation; it does not
+cancel the holder. Unknown holder evidence requires inspection, not lock removal.
+Historical configuration-drift repair remains subject to its existing proof gates.
+
+## Validation
+
+Verify the resolved executable and installed version. Use existing captured or
+synthetic queue evidence to check holder attribution and timeout semantics; do
+not start an unrelated workspace to exercise diagnostics. Require independent
+terminal evidence for any already-authorized lifecycle operation. Preserve
+live-worker, exact ownership, configuration and surviving-resource checks.
+
+## Report
+
+Report release revision, executable, installed version, queue versus holder
+evidence, and terminal operation result where available. Keep source and package
+validation separate from consumer readiness or recovery. Record unknowns without
+interpreting diagnostic messages as permission to cancel or remove resources.