@getmonoceros/workbench 1.37.13 → 1.38.0

package/bundled-components/features/atlassian/component.yml

@@ -40,19 +40,31 @@ options:
     description: "Optional Bitbucket app password; only needed for twg's Bitbucket commands."
     surface: env
 feature:
-  version: 1.2.0
+  version: 1.2.1
   persistentHomePaths: [.config/acli, .rovodev, .config/twg, .agents]
   vscodeExtensions: [Atlassian.atlascode]
-  # Forge is keychain-free in a container: instead of `forge login` (which
-  # needs libsecret), Atlassian's documented path is the FORGE_EMAIL /
-  # FORGE_API_TOKEN env vars, read at command time. We hand them to the
-  # workspace runtime env from the shared account options, gated on the
-  # `forge` toggle. Sibling of a service's connectionEnv (ADR 0021).
+  # Forge and twg are both keychain-free in a container: instead of a
+  # `login` step (which needs libsecret, or a TTY for twg's OAuth),
+  # Atlassian's documented path is env vars read at command time. We hand
+  # them to the workspace runtime env from the shared account options,
+  # each gated on its own toggle. Sibling of a service's connectionEnv
+  # (ADR 0021).
+  #   - Forge reads FORGE_EMAIL / FORGE_API_TOKEN.
+  #   - twg reads TWG_USER / TWG_SITE / TWG_TOKEN (+ optional
+  #     TWG_BBC_TOKEN for Bitbucket). Recent twg makes `twg login`
+  #     OAuth-only and it aborts without a TTY, so these env vars are the
+  #     only non-interactive auth path; there is no login hook.
   workspaceEnv:
     - whenOption: forge
       vars:
         FORGE_EMAIL: '${email}'
         FORGE_API_TOKEN: '${apiToken}'
+    - whenOption: twg
+      vars:
+        TWG_USER: '${email}'
+        TWG_SITE: '${instance}'
+        TWG_TOKEN: '${apiToken}'
+        TWG_BBC_TOKEN: '${bitbucketToken}'
 briefing:
   - whenOption: rovodev
     text: 'Atlassian Rovo Dev — invoke via `acli rovodev`. Pre-authenticated against the Atlassian account configured in the feature options (shared with twg).'

package/bundled-components/features/atlassian/install.sh

@@ -95,8 +95,9 @@ if [ "${TWG}" = "true" ]; then
   #     runtime — we re-record it as node in the post-create hook
   #     below.)
   #   - With --skip-login / --skip-skills we keep the install
-  #     non-interactive. Login + skills happen later as the node user
-  #     so they persist into the bind-mounted home.
+  #     non-interactive. Auth is env-var based (see the workspaceEnv
+  #     note below, no login step); skills install later as the node
+  #     user so they persist into the bind-mounted home.
   #
   # Heredoc (not `yes ... |`) deliberately: a long-lived `yes` left
   # writing into a closed pipe after the install script exits gets
@@ -128,49 +129,34 @@ TWG_INSTALL_INPUT
     exit 1
   }
 
+  # twg authenticates purely from the TWG_USER / TWG_SITE / TWG_TOKEN
+  # (+ optional TWG_BBC_TOKEN) env vars that the workbench injects into
+  # the workspace runtime env from the shared account options
+  # (feature.workspaceEnv, gated on the `twg` toggle): the same
+  # keychain-free path as Forge. There is deliberately no login step.
+  # Recent twg makes `twg login` OAuth-only, and it aborts without a TTY,
+  # which is unavailable during `monoceros apply`'s postCreate. So the
+  # post-create hook's only job is to (re-)install twg's agent skills as
+  # the node user, which needs no credentials, so it runs whenever twg is
+  # installed regardless of whether creds are set.
   HOOK="${POST_CREATE_DIR}/atlassian-twg.sh"
-  if [ -n "${INSTANCE}" ] && [ -n "${EMAIL}" ] && [ -n "${APITOKEN}" ]; then
-    cat >"${HOOK}" <<EOF
+  cat >"${HOOK}" <<EOF
 #!/usr/bin/env bash
 # Auto-generated by the Monoceros atlassian feature (twg).
-# Runs every container start. Always re-runs auth login so that
-# rotating the apiToken / bitbucketToken in the container yml
-# propagates through on the next \`monoceros apply\` without
-# needing to delete the previous credentials file by hand. twg's
-# login is a single API call; the cost is negligible compared to
-# the container build.
+# Runs every container start. twg auth comes from the TWG_* env vars
+# injected via feature.workspaceEnv; there is no login step here (recent
+# twg's \`twg login\` is OAuth-only and needs a TTY). This hook only
+# (re-)installs twg's agent skills as the node user.
 set -euo pipefail
-mkdir -p "\${HOME}/.config/twg"
-echo "[atlassian/twg] configuring twg non-interactively for ${EMAIL} @ ${INSTANCE}"
-# Notes on the non-interactive login dance:
-#   - We don't try to re-record consent here as the node user. twg's
-#     \`consent\` subcommand demands a TTY; the install-time consent
-#     (recorded as root during the feature build) appears to be
-#     enough for \`twg login\` itself.
-#   - \`twg login --force\` reads Atlassian creds from TWG_USER /
-#     TWG_SITE / TWG_TOKEN. If TWG_BBC_TOKEN is set, twg uses that
-#     directly and skips the Bitbucket prompt. If empty, twg prompts
-#     interactively — we feed two blank lines via heredoc so the
-#     "Enter = skip" branch fires and we don't hang. Future twg
-#     versions adding another optional prompt are also covered by
-#     the second blank line.
-TWG_USER='${EMAIL}' \\
-TWG_SITE='${INSTANCE}' \\
-TWG_TOKEN='${APITOKEN}' \\
-TWG_BBC_TOKEN='${BITBUCKETTOKEN}' \\
-  twg login --force <<'TWG_LOGIN_INPUT'
-
-
-TWG_LOGIN_INPUT
 
 # (Re-)install twg's agent skills. Canonical install lands in
 # /home/node/.agents/skills/twg (persisted via the feature's
 # persistentHomePaths); .agents/skills-native agents (codex, cursor,
 # gemini, copilot, …) read it directly. Agents with their own skills
-# dir (claude → .claude/skills, opencode → .opencode/skills) need an
+# dir (claude -> .claude/skills, opencode -> .opencode/skills) need an
 # explicit --agent flag, so we detect which AI CLIs are present in this
 # container and pass the matching flags. This keeps the atlassian
-# feature decoupled from the container's feature list — it reacts to
+# feature decoupled from the container's feature list: it reacts to
 # whatever is actually installed. Idempotent: re-running just refreshes
 # the wrappers.
 echo "[atlassian/twg] (re-)installing twg skills"
@@ -183,11 +169,10 @@ if command -v opencode >/dev/null 2>&1; then
 fi
 twg skills install --global --yes "\${TWG_SKILL_AGENTS[@]}"
 EOF
-    chmod 0755 "${HOOK}"
-    echo "[atlassian/twg] post-create login hook installed"
-  else
-    rm -f "${HOOK}"
-    echo "[atlassian/twg] missing instance/email/apiToken — login is manual (\`twg login\` once in the container)"
+  chmod 0755 "${HOOK}"
+  echo "[atlassian/twg] post-create skills hook installed; auth via TWG_* workspace env"
+  if [ -z "${INSTANCE}" ] || [ -z "${EMAIL}" ] || [ -z "${APITOKEN}" ]; then
+    echo "[atlassian/twg] instance/email/apiToken not all set; set them in the container yml so TWG_USER/TWG_SITE/TWG_TOKEN reach the shell (otherwise run \`twg login\` once in the container)"
   fi
 fi
 

package/bundled-components/services/keycloak/component.yml

@@ -9,7 +9,14 @@ service:
   # Dev mode + realm import. The Keycloak image has no auto-start default,
   # so a command is mandatory. `--import-realm` reads every *.json from
   # /opt/keycloak/data/import at startup (a no-op if the dir is empty).
-  command: start-dev --import-realm
+  # `--proxy-headers=xforwarded` makes Keycloak derive the issuer host and
+  # scheme from X-Forwarded-Host / X-Forwarded-Proto, so the realm stamps a
+  # matching issuer whether it is reached over http via the Traefik proxy
+  # (`plantlove.localhost`) or over https via `monoceros share` on a phone.
+  # Without it Keycloak uses the raw connection scheme (always http behind a
+  # TLS-terminating proxy) and the OIDC token exchange fails on the https
+  # client. See ADR 0033.
+  command: start-dev --import-realm --proxy-headers=xforwarded
   # Starts in a host-side second wave AFTER the repo clone (ADR 0025), so a
   # mounted realm.json / theme from the project is present at boot. No
   # dataMount: the dev H2 database is ephemeral and re-seeds from the

package/dist/bin.js

@@ -4107,12 +4107,12 @@ async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
   const devcontainerDir = path11.join(targetDir, ".devcontainer");
   const monocerosDir = path11.join(targetDir, ".monoceros");
   const projectsDir = path11.join(targetDir, "projects");
-  const homeDir = path11.join(targetDir, "home");
+  const homeDir2 = path11.join(targetDir, "home");
   const dataDir = path11.join(targetDir, "data");
   await fs9.mkdir(devcontainerDir, { recursive: true });
   await fs9.mkdir(monocerosDir, { recursive: true });
   await fs9.mkdir(projectsDir, { recursive: true });
-  await fs9.mkdir(homeDir, { recursive: true });
+  await fs9.mkdir(homeDir2, { recursive: true });
   if (needsCompose(opts)) {
     await fs9.mkdir(dataDir, { recursive: true });
     for (const svc of opts.services) {
@@ -4176,10 +4176,10 @@ async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
   }
   for (const f of resolvedFeatures) {
     for (const sub of f.persistentHomePaths) {
-      await fs9.mkdir(path11.join(homeDir, sub), { recursive: true });
+      await fs9.mkdir(path11.join(homeDir2, sub), { recursive: true });
     }
     for (const entry2 of f.persistentHomeFiles) {
-      const filePath = path11.join(homeDir, entry2.path);
+      const filePath = path11.join(homeDir2, entry2.path);
       await fs9.mkdir(path11.dirname(filePath), { recursive: true });
       if (!existsSync8(filePath)) {
         await fs9.writeFile(filePath, entry2.initialContent);
@@ -5481,8 +5481,8 @@ function removeRepoFromDoc(doc, urlOrPath) {
     if (!isMap2(item)) return false;
     const url = item.get("url");
     if (url === urlOrPath) return true;
-    const path33 = item.get("path");
-    const effectivePath = typeof path33 === "string" ? path33 : typeof url === "string" ? deriveRepoName(url) : void 0;
+    const path35 = item.get("path");
+    const effectivePath = typeof path35 === "string" ? path35 : typeof url === "string" ? deriveRepoName(url) : void 0;
     return effectivePath === urlOrPath;
   });
   if (idx < 0) return false;
@@ -5625,7 +5625,7 @@ async function runAddRepo(input) {
       "Missing repo URL. Usage: monoceros add-repo <containername> <url>."
     );
   }
-  const path33 = (input.path ?? deriveRepoName(url)).trim();
+  const path35 = (input.path ?? deriveRepoName(url)).trim();
   const hasName = typeof input.gitName === "string" && input.gitName.trim().length > 0;
   const hasEmail = typeof input.gitEmail === "string" && input.gitEmail.trim().length > 0;
   if (hasName !== hasEmail) {
@@ -5662,7 +5662,7 @@ async function runAddRepo(input) {
   const providerToWrite = !canonical && explicitProvider ? explicitProvider : void 0;
   const entry2 = {
     url,
-    path: path33,
+    path: path35,
     ...hasName && hasEmail ? {
       gitUser: {
         name: input.gitName.trim(),
@@ -8974,7 +8974,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.37.13" : "dev";
+    CLI_VERSION = true ? "1.38.0" : "dev";
   }
 });
 
@@ -12370,9 +12370,212 @@ var init_run3 = __esm({
   }
 });
 
+// src/tls/ca.ts
+import { promises as fs21 } from "fs";
+import path33 from "path";
+import forge from "node-forge";
+function homeDir(monocerosHome2) {
+  return monocerosHome2 ?? monocerosHome();
+}
+function randomSerial() {
+  return "00" + forge.util.bytesToHex(forge.random.getBytesSync(16));
+}
+async function fileExists(p) {
+  try {
+    await fs21.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadOrCreateCa(monocerosHome2) {
+  const dir = path33.join(homeDir(monocerosHome2), CA_DIR);
+  const certPath = path33.join(dir, CA_CERT_FILE);
+  const keyPath = path33.join(dir, CA_KEY_FILE);
+  if (await fileExists(certPath) && await fileExists(keyPath)) {
+    const cert2 = forge.pki.certificateFromPem(
+      await fs21.readFile(certPath, "utf8")
+    );
+    const key = forge.pki.privateKeyFromPem(
+      await fs21.readFile(keyPath, "utf8")
+    );
+    return { cert: cert2, key, certPath, keyPath };
+  }
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = randomSerial();
+  cert.validity.notBefore = /* @__PURE__ */ new Date();
+  cert.validity.notAfter = new Date(
+    cert.validity.notBefore.getTime() + CA_DAYS * 24 * 60 * 60 * 1e3
+  );
+  const attrs = [{ name: "commonName", value: "Monoceros Local CA" }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.setExtensions([
+    { name: "basicConstraints", cA: true, critical: true },
+    { name: "keyUsage", keyCertSign: true, cRLSign: true, critical: true },
+    { name: "subjectKeyIdentifier" }
+  ]);
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+  await fs21.mkdir(dir, { recursive: true });
+  await fs21.writeFile(certPath, forge.pki.certificateToPem(cert), {
+    mode: 420
+  });
+  await fs21.writeFile(keyPath, forge.pki.privateKeyToPem(keys.privateKey), {
+    mode: 384
+  });
+  return { cert, key: keys.privateKey, certPath, keyPath };
+}
+function normalizeSans(sans) {
+  return [...new Set(sans.filter((s) => s.length > 0))].sort();
+}
+async function readLeafMeta(metaPath) {
+  try {
+    return JSON.parse(await fs21.readFile(metaPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function leafStillGood(meta, sans) {
+  if (!meta) return false;
+  if (meta.sans.join(",") !== sans.join(",")) return false;
+  const notAfter = new Date(meta.notAfter).getTime();
+  if (Number.isNaN(notAfter)) return false;
+  return notAfter - Date.now() > LEAF_RENEW_BEFORE_MS;
+}
+async function ensureLeafCert(opts) {
+  const sans = normalizeSans(opts.sans);
+  const dir = path33.join(homeDir(opts.monocerosHome), CERTS_DIR);
+  const certPath = path33.join(dir, LEAF_CERT_FILE);
+  const keyPath = path33.join(dir, LEAF_KEY_FILE);
+  const metaPath = path33.join(dir, LEAF_META_FILE);
+  const ca = await loadOrCreateCa(opts.monocerosHome);
+  const haveFiles = await fileExists(certPath) && await fileExists(keyPath);
+  if (haveFiles && leafStillGood(await readLeafMeta(metaPath), sans)) {
+    return {
+      caCertPath: ca.certPath,
+      certDir: dir,
+      certFile: LEAF_CERT_FILE,
+      keyFile: LEAF_KEY_FILE
+    };
+  }
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = randomSerial();
+  cert.validity.notBefore = /* @__PURE__ */ new Date();
+  cert.validity.notAfter = new Date(
+    cert.validity.notBefore.getTime() + LEAF_DAYS * 24 * 60 * 60 * 1e3
+  );
+  cert.setSubject([{ name: "commonName", value: "monoceros share" }]);
+  cert.setIssuer(ca.cert.subject.attributes);
+  cert.setExtensions([
+    { name: "basicConstraints", cA: false },
+    {
+      name: "keyUsage",
+      digitalSignature: true,
+      keyEncipherment: true,
+      critical: true
+    },
+    { name: "extKeyUsage", serverAuth: true },
+    {
+      name: "subjectAltName",
+      altNames: sans.map(
+        (s) => IPV4_RE2.test(s) ? { type: 7, ip: s } : { type: 2, value: s }
+      )
+    }
+  ]);
+  cert.sign(ca.key, forge.md.sha256.create());
+  await fs21.mkdir(dir, { recursive: true });
+  await fs21.writeFile(certPath, forge.pki.certificateToPem(cert), {
+    mode: 420
+  });
+  await fs21.writeFile(keyPath, forge.pki.privateKeyToPem(keys.privateKey), {
+    mode: 384
+  });
+  const meta = {
+    sans,
+    notAfter: cert.validity.notAfter.toISOString()
+  };
+  await fs21.writeFile(metaPath, JSON.stringify(meta), { mode: 420 });
+  return {
+    caCertPath: ca.certPath,
+    certDir: dir,
+    certFile: LEAF_CERT_FILE,
+    keyFile: LEAF_KEY_FILE
+  };
+}
+async function provisionShareTls(opts) {
+  return ensureLeafCert(opts);
+}
+var CA_DIR, CA_CERT_FILE, CA_KEY_FILE, CERTS_DIR, LEAF_CERT_FILE, LEAF_KEY_FILE, LEAF_META_FILE, CA_DAYS, LEAF_DAYS, LEAF_RENEW_BEFORE_MS, IPV4_RE2;
+var init_ca = __esm({
+  "src/tls/ca.ts"() {
+    "use strict";
+    init_paths();
+    CA_DIR = "ca";
+    CA_CERT_FILE = "rootCA.pem";
+    CA_KEY_FILE = "rootCA-key.pem";
+    CERTS_DIR = "certs";
+    LEAF_CERT_FILE = "leaf.pem";
+    LEAF_KEY_FILE = "leaf-key.pem";
+    LEAF_META_FILE = "leaf.json";
+    CA_DAYS = 3650;
+    LEAF_DAYS = 397;
+    LEAF_RENEW_BEFORE_MS = 7 * 24 * 60 * 60 * 1e3;
+    IPV4_RE2 = /^(\d{1,3}\.){3}\d{1,3}$/;
+  }
+});
+
+// src/share/caddy.ts
+function renderCaddyfile(sites, certFile, keyFile) {
+  const blocks = sites.map(
+    (s) => `:${s.port} {
+	tls /certs/${certFile} /certs/${keyFile}
+	reverse_proxy http://${s.targetHost}:${s.port}
+}`
+  );
+  return [
+    "{",
+    "	auto_https off",
+    "	admin off",
+    "	servers {",
+    "		protocols h1 h2",
+    "	}",
+    "}",
+    ...blocks,
+    ""
+  ].join("\n");
+}
+function buildCaddyDockerArgs(input) {
+  const args = ["run", "--rm", "-i", `--network=${input.network}`];
+  for (const port of input.ports) {
+    args.push("-p", `${input.localAddress}:${port}:${port}`);
+  }
+  args.push(
+    "-v",
+    `${input.certDir}:/certs:ro`,
+    "-v",
+    `${input.caddyfilePath}:/etc/caddy/Caddyfile:ro`,
+    CADDY_IMAGE
+  );
+  return args;
+}
+var CADDY_IMAGE;
+var init_caddy = __esm({
+  "src/share/caddy.ts"() {
+    "use strict";
+    CADDY_IMAGE = "caddy:2.11.4";
+  }
+});
+
 // src/share/run.ts
 import os3 from "os";
+import { spawnSync as spawnSync2 } from "child_process";
 import { consola as consola35 } from "consola";
+import { promises as fs22 } from "fs";
+import path34 from "path";
 function realHostAddresses() {
   let ip;
   for (const list of Object.values(os3.networkInterfaces())) {
@@ -12384,9 +12587,18 @@ function realHostAddresses() {
     }
     if (ip) break;
   }
+  return { ...ip ? { ip } : {}, mdnsName: mdnsHostName() };
+}
+function mdnsHostName() {
+  if (process.platform === "darwin") {
+    const res = spawnSync2("scutil", ["--get", "LocalHostName"], {
+      encoding: "utf8"
+    });
+    const name = res.status === 0 ? res.stdout.trim() : "";
+    if (name) return `${name}.local`;
+  }
   const hn = os3.hostname();
-  const mdnsName = hn.endsWith(".local") ? hn : `${hn}.local`;
-  return { ...ip ? { ip } : {}, mdnsName };
+  return hn.endsWith(".local") ? hn : `${hn}.local`;
 }
 async function runShare(opts) {
   const log = opts.logger ?? {
@@ -12418,31 +12630,62 @@ async function runShare(opts) {
   for (const port of ports) {
     await preflight({ port, address: SHARE_ADDRESS });
   }
+  const { ip, mdnsName } = (opts.hostAddresses ?? realHostAddresses)();
+  const sans = [mdnsName, ip, "localhost", "127.0.0.1"].filter(
+    (s) => typeof s === "string" && s.length > 0
+  );
+  const provisionTls = opts.provisionTls ?? provisionShareTls;
+  const tls = await provisionTls({
+    sans,
+    ...opts.monocerosHome !== void 0 ? { monocerosHome: opts.monocerosHome } : {}
+  });
+  const sites = ports.map((port) => ({
+    port,
+    targetHost: base.targetHost
+  }));
+  const home = opts.monocerosHome ?? monocerosHome();
+  const shareDir = path34.join(home, "share");
+  await fs22.mkdir(shareDir, { recursive: true });
+  const caddyfilePath = path34.join(
+    shareDir,
+    `${opts.name}__${opts.app}.Caddyfile`
+  );
+  await fs22.rm(caddyfilePath, { force: true });
+  await fs22.writeFile(
+    caddyfilePath,
+    renderCaddyfile(sites, tls.certFile, tls.keyFile)
+  );
   const dockerSpawn = opts.dockerSpawn ?? defaultDockerSpawn;
-  const handles = ports.map(
-    (port) => dockerSpawn(
-      buildDockerArgs({
+  const handles = [
+    dockerSpawn(
+      buildCaddyDockerArgs({
         localAddress: SHARE_ADDRESS,
-        localPort: port,
-        internalPort: port,
+        ports,
         network: base.network,
-        targetHost: base.targetHost
+        certDir: tls.certDir,
+        caddyfilePath
       })
     )
-  );
-  const { ip, mdnsName } = (opts.hostAddresses ?? realHostAddresses)();
-  const host = ip ?? mdnsName ?? "<host-ip>";
+  ];
+  const host = mdnsName ?? ip ?? "<host-ip>";
   log.info(
     `Sharing ${opts.name}/${opts.app} on the local network (Ctrl+C to stop):`
   );
   for (const t of ported) {
-    log.info(`  ${cyan2(t.name)}  http://${host}:${t.port}`);
+    log.info(`  ${cyan2(t.name)}  https://${host}:${t.port}`);
   }
   if (mdnsName && ip) {
     log.info(
-      dim(`  also reachable as http://${mdnsName}:<port> where mDNS resolves`)
+      dim(
+        `  also reachable as https://${ip}:<port> if .local does not resolve`
+      )
     );
   }
+  log.info(
+    dim(
+      `  First device? Trust the local CA once so HTTPS is warning-free: ${tls.caCertPath}`
+    )
+  );
   const installSignalHandler = opts.installSignalHandler ?? installSigintDefault;
   let stopping = false;
   const uninstall = installSignalHandler(() => {
@@ -12466,6 +12709,9 @@ var init_run4 = __esm({
     init_resolve2();
     init_port_check2();
     init_run3();
+    init_ca();
+    init_caddy();
+    init_paths();
     init_format();
     SHARE_ADDRESS = "0.0.0.0";
   }
@@ -12483,7 +12729,7 @@ var init_share = __esm({
       meta: {
         name: "share",
         group: "discovery",
-        description: "Expose an app's ports to the local network (phone, tablet, other devices) so any device can open it - reached via the host's LAN IP (or `.local` name). Every target in the app's launch.json that declares a port is shared. Foreground: Ctrl+C stops sharing. See ADR 0030."
+        description: "Expose an app's ports to the local network (phone, tablet, other devices) over HTTPS so any device can open it - reached via the host's LAN IP (or `.local` name). TLS is served with a machine-local CA; trust the printed rootCA.pem once per device for warning-free HTTPS (and a working PWA secure context). Every target in the app's launch.json that declares a port is shared. Foreground: Ctrl+C stops sharing. See ADR 0030 and 0033."
       },
       args: {
         name: {
@@ -13267,7 +13513,7 @@ var init_prune = __esm({
 });
 
 // src/upgrade/index.ts
-import { existsSync as existsSync21, promises as fs21 } from "fs";
+import { existsSync as existsSync21, promises as fs23 } from "fs";
 import { consola as consola41 } from "consola";
 async function fetchRuntimeVersions() {
   const tokenUrl = `https://ghcr.io/token?service=ghcr.io&scope=repository:${RUNTIME_REPO}:pull`;
@@ -13384,10 +13630,10 @@ async function runUpgrade(opts) {
   for (const name of targets) {
     const ymlPath = containerConfigPath(name, home);
     if (!existsSync21(ymlPath)) continue;
-    const raw = await fs21.readFile(ymlPath, "utf8");
+    const raw = await fs23.readFile(ymlPath, "utf8");
     const updated = setRuntimeVersion(raw, pinVersion);
     if (updated !== raw) {
-      await fs21.writeFile(ymlPath, updated);
+      await fs23.writeFile(ymlPath, updated);
       bumped += 1;
       logger.info(`Pinned '${name}' to runtime ${pinVersion}.`);
     }
@@ -13429,7 +13675,7 @@ function formatPruneLine(prune) {
 }
 async function listContainerNames2(home) {
   try {
-    const entries = await fs21.readdir(containerConfigsDir(home));
+    const entries = await fs23.readdir(containerConfigsDir(home));
     return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length));
   } catch {
     return [];
@@ -13844,25 +14090,25 @@ function detectHelpRequest(argv, main2) {
   const separatorIdx = argv.indexOf("--");
   if (helpIdx === -1) return null;
   if (separatorIdx !== -1 && separatorIdx < helpIdx) return null;
-  const path33 = [];
+  const path35 = [];
   const tokens = argv.slice(
     0,
     separatorIdx === -1 ? argv.length : separatorIdx
   );
   let cursor = main2;
   const mainName = (main2.meta ?? {}).name ?? "monoceros";
-  path33.push(mainName);
+  path35.push(mainName);
   for (const tok of tokens) {
     if (tok.startsWith("-")) continue;
     const subs = cursor.subCommands ?? {};
     if (tok in subs) {
       cursor = subs[tok];
-      path33.push(tok);
+      path35.push(tok);
       continue;
     }
     break;
   }
-  return { path: path33, cmd: cursor };
+  return { path: path35, cmd: cursor };
 }
 async function maybeRenderHelp(argv, main2) {
   const hit = detectHelpRequest(argv, main2);