@devrouter/cli 0.5.4 → 0.5.6

package/README.md

@@ -82,6 +82,14 @@ Dev Container clients still see the full source configuration. Check
 `devrouter status` or `devrouter doctor` when you need the desired, active, and
 drift state.
 
+Managed repositories can also declare a separate runtime variant in
+`managedRuntime.variants` and select it with
+`devrouter ensure . --variant <name>`. A profile continues to select resources;
+the variant changes the managed process startup input. Declared
+loopback-only service ports are available through `devrouter env . --json`. See
+the [managed devcontainer contract](./docs/DEVCONTAINER.md) for ownership,
+Compose, recovery, and capacity rules.
+
 Automation can inspect the same profile contract without touching a workspace,
 Docker, DevPod, Devsy, Traefik, Git, or global state:
 

package/bin/devrouter-process

@@ -9,8 +9,9 @@ Usage:
   devrouter-process status --name <name>
 
 Options:
-  --fingerprint <value>  Runtime identity. Defaults to command, workspace, adapter, and safe allowlisted environment identity.
-                        An explicit fingerprint is caller-owned, including preparation identity.
+  --fingerprint <value>  Runtime identity. Defaults to command, workspace, adapter, non-default
+                        managed variant, and safe allowlisted environment identity.
+                        An explicit fingerprint remains caller-owned for preparation identity.
   --prepare-command <shell command>
                         Ensure only: run a nonempty command with bash before a changed/new runtime.
                         Included byte-for-byte in the default fingerprint; skipped on runtime reuse.
@@ -22,6 +23,7 @@ Options:
 Environment:
   DEVROUTER_PROCESS_ADAPTER_SHA256   Exact managed-adapter SHA-256 supplied by devrouter.
   DEVROUTER_PROCESS_FINGERPRINT_ENV  Comma-separated non-secret environment names to fingerprint.
+  DEVROUTER_RUNTIME_VARIANT          Managed runtime variant; defaults to 'default'. Non-default values are part of identity.
 EOF
 }
 
@@ -141,6 +143,18 @@ if [[ -v DEVROUTER_PROCESS_ADAPTER_SHA256 ]] &&
   die "DEVROUTER_PROCESS_ADAPTER_SHA256 must be a SHA-256 digest."
 fi
 
+runtime_variant="${DEVROUTER_RUNTIME_VARIANT-default}"
+if [ "${#runtime_variant}" -gt 64 ] ||
+  ! [[ "$runtime_variant" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+  die "DEVROUTER_RUNTIME_VARIANT must use lowercase alphanumeric segments separated by hyphens and be at most 64 characters."
+fi
+managed_variant_identity=0
+[ "$runtime_variant" = "default" ] || managed_variant_identity=1
+host_ports_identity="${DEVROUTER_PROCESS_HOST_PORTS_SHA256:-}"
+if [ -n "$host_ports_identity" ] && ! [[ "$host_ports_identity" =~ ^[a-f0-9]{64}$ ]]; then
+  die "DEVROUTER_PROCESS_HOST_PORTS_SHA256 must be a SHA-256 digest."
+fi
+
 if [ "$action" != "ensure" ] && [ "$#" -gt 0 ]; then
   die "Unexpected arguments for $action."
 fi
@@ -163,6 +177,12 @@ if [ -z "$fingerprint" ]; then
     emit_environment_field workspace WORKSPACE
     emit_environment_field devrouter-workspace DEVROUTER_WORKSPACE
     emit_environment_field adapter-sha256 DEVROUTER_PROCESS_ADAPTER_SHA256
+    if [ "$managed_variant_identity" -eq 1 ]; then
+      printf 'runtime-variant\0%s\0' "$runtime_variant"
+    fi
+    if [ -n "$host_ports_identity" ]; then
+      printf 'host-ports\0%s\0' "$host_ports_identity"
+    fi
     for argument in "$@"; do
       printf 'argv\0%s\0' "$argument"
     done
@@ -174,6 +194,13 @@ if [ -z "$fingerprint" ]; then
       emit_environment_field environment-value "$env_name"
     done
   } | LC_ALL=C sha256sum | awk '{print $1}')"
+elif [ "$managed_variant_identity" -eq 1 ] || [ -n "$host_ports_identity" ]; then
+  fingerprint="$({
+    printf 'format\0devrouter-process-managed-variant-v1\0'
+    printf 'explicit-fingerprint\0%s\0' "$fingerprint"
+    printf 'runtime-variant\0%s\0' "$runtime_variant"
+    printf 'host-ports\0%s\0' "$host_ports_identity"
+  } | LC_ALL=C sha256sum | awk '{print $1}')"
 fi
 [[ "$fingerprint" =~ ^[a-zA-Z0-9][a-zA-Z0-9._:-]*$ ]] || die "--fingerprint must be a safe identifier."