@dotdrelle/wiki-manager 0.11.7 → 0.11.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.11.7",
+  "version": "0.11.9",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.11.7';
+const WIKI_MANAGER_VERSION = '0.11.9';
 
 function envValue(key) {
   const filePath = managerEnvFile();

package/src/runtime/lifecycle.js

@@ -1,7 +1,8 @@
 import { execFile, spawn } from 'node:child_process';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { checkRuntimeHealth, runtimeUrlFromEnv } from './client.js';
+import { activeCacertPath } from '../core/cacert.js';
+import { checkRuntimeHealth, postRuntimeShutdown, runtimeUrlFromEnv } from './client.js';
 import { defaultRuntimeStateDir } from '../core/env.js';
 import { resolveRuntimeAuthToken, runtimeTokenFromEnv } from './auth.js';
 
@@ -42,7 +43,15 @@ export async function ensureRuntime({
   const auth = resolveRuntimeAuthToken({ host, stateDir });
   if (auth.token) process.env.WIKI_MANAGER_RUNTIME_TOKEN = auth.token;
   const existing = await runtimeHealthOrNull(url, auth.token);
-  if (existing) return { url, started: false, health: existing, token: auth.token, tokenPath: auth.tokenPath };
+  if (existing) {
+    const expectedCacertPath = activeCacertPath();
+    const actualCacertPath = existing.cacertPath ? resolve(existing.cacertPath) : null;
+    if (actualCacertPath === expectedCacertPath) {
+      return { url, started: false, health: existing, token: auth.token, tokenPath: auth.tokenPath };
+    }
+    await postRuntimeShutdown({ url, token: auth.token });
+    await waitForRuntimeShutdown(url, auth.token, 2500);
+  }
 
   const runtimeNode = await assertRuntimeNode();
   const child = spawn(runtimeNode.executable, [
@@ -75,6 +84,14 @@ export async function ensureRuntime({
   throw new Error(`Runtime did not become healthy at ${url}`);
 }
 
+async function waitForRuntimeShutdown(url, token, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!await runtimeHealthOrNull(url, token)) return;
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 100));
+  }
+}
+
 export async function runtimeHealthOrNull(url = runtimeUrlFromEnv(), token = runtimeTokenFromEnv()) {
   try {
     return await checkRuntimeHealth({ url, token });

package/src/runtime/server.js

@@ -1,6 +1,7 @@
 import { createServer } from 'node:http';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
+import { activeCacertPath } from '../core/cacert.js';
 import { normalizePlanPatch, rebasePlanPatch } from '../core/planPatch.js';
 import { validateContractInDev } from '../contracts/schemas.js';
 import { runtimeTokenFromEnv } from './auth.js';
@@ -55,6 +56,8 @@ export function startRuntimeServer({
           status: context?.running ? 'running' : 'idle',
           workspace: context?.workspace ?? workspace ?? null,
           dbPath: store.dbPath,
+          cacertPath: activeCacertPath(),
+          nodeExtraCaCerts: process.env.NODE_EXTRA_CA_CERTS ?? null,
         });
         return;
       }

package/src/runtime/server.test.js

@@ -46,6 +46,50 @@ test('runtime server checks bearer and x-runtime-token credentials', async (t) =
   }
 });
 
+test('runtime health exposes active CA certificate environment', async (t) => {
+  const previousCacert = process.env.WIKI_MANAGER_CACERT_PATH;
+  const previousNodeExtraCaCerts = process.env.NODE_EXTRA_CA_CERTS;
+  process.env.WIKI_MANAGER_CACERT_PATH = '/tmp/wiki-manager-test-ca.pem';
+  process.env.NODE_EXTRA_CA_CERTS = '/tmp/wiki-manager-test-ca.pem';
+  let handle;
+  try {
+    handle = await startRuntimeServer({
+      host: '127.0.0.1',
+      port: 0,
+      token: 'runtime-secret',
+      store: {
+        dbPath: ':memory:',
+        getState: () => ({ status: 'idle' }),
+        listEvents: () => [],
+      },
+      session: {},
+      run: async () => {},
+    });
+  } catch (err) {
+    if (err?.code === 'EPERM') {
+      t.skip('network listen is not permitted in this sandbox');
+      return;
+    }
+    throw err;
+  }
+
+  try {
+    const response = await fetch(`http://127.0.0.1:${handle.port}/health`, {
+      headers: { authorization: 'Bearer runtime-secret' },
+    });
+    assert.equal(response.status, 200);
+    const body = await response.json();
+    assert.equal(body.cacertPath, '/tmp/wiki-manager-test-ca.pem');
+    assert.equal(body.nodeExtraCaCerts, '/tmp/wiki-manager-test-ca.pem');
+  } finally {
+    await handle.close();
+    if (previousCacert === undefined) delete process.env.WIKI_MANAGER_CACERT_PATH;
+    else process.env.WIKI_MANAGER_CACERT_PATH = previousCacert;
+    if (previousNodeExtraCaCerts === undefined) delete process.env.NODE_EXTRA_CA_CERTS;
+    else process.env.NODE_EXTRA_CA_CERTS = previousNodeExtraCaCerts;
+  }
+});
+
 test('runtime server shutdown endpoint closes the listener', async (t) => {
   let handle;
   try {