@launchsecure/launch-kit 0.0.44 → 0.0.46

package/dist/server/init-entry.js

@@ -519,14 +519,14 @@ function coerceEntry(raw, index) {
   if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
     throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
   }
-  const skipSpawn = r.skipSpawn === true || r.bin === "";
-  return {
+  const spec = {
     name: r.name,
     port: r.port,
     bin: r.bin,
-    args: r.args ?? [],
-    skipSpawn
+    args: r.args ?? []
   };
+  if (r.skipSpawn === true || r.bin === "") spec.skipSpawn = true;
+  return spec;
 }
 function validate(services) {
   if (services.length === 0) {
@@ -973,6 +973,27 @@ var init_cf_access = __esm({
   }
 });
 
+// src/server/rover/runtime/hostnames.ts
+function slugLabel(projectSlug) {
+  return projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function roverToken(roverId) {
+  let h = 2166136261;
+  for (let i = 0; i < roverId.length; i++) {
+    h ^= roverId.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return ((h >>> 0) % 2176782336).toString(36).padStart(6, "0");
+}
+function serviceLabel2(projectSlug, serviceName, roverId) {
+  return `${serviceName}-${slugLabel(projectSlug)}-${roverToken(roverId)}`;
+}
+var init_hostnames = __esm({
+  "src/server/rover/runtime/hostnames.ts"() {
+    "use strict";
+  }
+});
+
 // src/server/radar/registration.ts
 var RECEIVER_PATH;
 var init_registration = __esm({
@@ -1097,10 +1118,16 @@ function setupClaudeCredentials() {
   const claudeDir = (0, import_node_path4.join)(home, ".claude");
   (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
   const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
-  if (hasUsableCredentials(credsPath)) {
+  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
+    console.log("[entrypoint] CLAUDE_CODE_OAUTH_TOKEN present \u2014 using long-lived token; skipping ~/.claude/.credentials.json seed");
+  } else if (hasUsableCredentials(credsPath)) {
     console.log("[entrypoint] ~/.claude/.credentials.json already present \u2014 leaving Claude Code's own (refreshed) credentials intact");
   } else {
-    const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+    const blob = process.env.CLAUDE_CREDENTIALS_B64;
+    if (!blob) {
+      fail2("ERROR: no Claude credential \u2014 set CLAUDE_CODE_OAUTH_TOKEN (preferred, from `claude setup-token`) or CLAUDE_CREDENTIALS_B64");
+    }
+    const decoded = Buffer.from(blob, "base64").toString("utf8");
     (0, import_node_fs4.writeFileSync)(credsPath, decoded);
     (0, import_node_fs4.chmodSync)(credsPath, 384);
     console.log("[entrypoint] seeded ~/.claude/.credentials.json from CLAUDE_CREDENTIALS_B64");
@@ -1207,21 +1234,22 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
     fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
   const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-tunnel.json");
-  const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const roverId = requireEnv("LS_ROVER_ID");
   const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
   for (const s of services) {
-    const label = `${slugLabel}-${s.name}`;
+    const label = serviceLabel2(projectSlug, s.name, roverId);
     if (!DNS_LABEL_RE.test(label)) {
       fail2(`[entrypoint] hostname label "${label}" (${label.length} chars) is not a valid DNS label \u2014 must be 1\u201363 chars of [a-z0-9-] with no leading/trailing hyphen. Shorten the project slug ("${projectSlug}") or the service name ("${s.name}").`);
     }
   }
-  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => `${slugLabel}-${s.name}`).join(",")}`);
+  const tunnelName = `launch-kit-${projectSlug}-${roverToken(roverId)}`;
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=${tunnelName} zone=${chosen.name} services=${services.map((s) => serviceLabel2(projectSlug, s.name, roverId)).join(",")}`);
   const result = await provisionIngress({
     apiToken: token,
     accountId,
     zone: chosen,
-    tunnelName: `launch-kit-${projectSlug}`,
-    services: services.map((s) => ({ name: s.name, label: `${slugLabel}-${s.name}`, port: s.port })),
+    tunnelName,
+    services: services.map((s) => ({ name: s.name, label: serviceLabel2(projectSlug, s.name, roverId), port: s.port })),
     stateFile
   });
   for (const [name, fqdn] of Object.entries(result.hostnames)) {
@@ -1438,6 +1466,7 @@ var init_radar_docker_init_entry = __esm({
     init_launch_kit_services();
     init_cf_ingress();
     init_cf_access();
+    init_hostnames();
     init_registration();
     REQUIRED_ENV = [
       "LS_PAT",

package/dist/server/radar-docker-init-entry.js

@@ -190,14 +190,14 @@ function coerceEntry(raw, index) {
   if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
     throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
   }
-  const skipSpawn = r.skipSpawn === true || r.bin === "";
-  return {
+  const spec = {
     name: r.name,
     port: r.port,
     bin: r.bin,
-    args: r.args ?? [],
-    skipSpawn
+    args: r.args ?? []
   };
+  if (r.skipSpawn === true || r.bin === "") spec.skipSpawn = true;
+  return spec;
 }
 function validate(services) {
   if (services.length === 0) {
@@ -613,6 +613,22 @@ async function provisionAccess(input) {
   return { idpId, authDomain, appIds };
 }
 
+// src/server/rover/runtime/hostnames.ts
+function slugLabel(projectSlug) {
+  return projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function roverToken(roverId) {
+  let h = 2166136261;
+  for (let i = 0; i < roverId.length; i++) {
+    h ^= roverId.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return ((h >>> 0) % 2176782336).toString(36).padStart(6, "0");
+}
+function serviceLabel2(projectSlug, serviceName, roverId) {
+  return `${serviceName}-${slugLabel(projectSlug)}-${roverToken(roverId)}`;
+}
+
 // src/server/radar/registration.ts
 var RECEIVER_PATH = "/api/radar/ingest";
 
@@ -737,10 +753,16 @@ function setupClaudeCredentials() {
   const claudeDir = (0, import_node_path4.join)(home, ".claude");
   (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
   const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
-  if (hasUsableCredentials(credsPath)) {
+  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
+    console.log("[entrypoint] CLAUDE_CODE_OAUTH_TOKEN present \u2014 using long-lived token; skipping ~/.claude/.credentials.json seed");
+  } else if (hasUsableCredentials(credsPath)) {
     console.log("[entrypoint] ~/.claude/.credentials.json already present \u2014 leaving Claude Code's own (refreshed) credentials intact");
   } else {
-    const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+    const blob = process.env.CLAUDE_CREDENTIALS_B64;
+    if (!blob) {
+      fail2("ERROR: no Claude credential \u2014 set CLAUDE_CODE_OAUTH_TOKEN (preferred, from `claude setup-token`) or CLAUDE_CREDENTIALS_B64");
+    }
+    const decoded = Buffer.from(blob, "base64").toString("utf8");
     (0, import_node_fs4.writeFileSync)(credsPath, decoded);
     (0, import_node_fs4.chmodSync)(credsPath, 384);
     console.log("[entrypoint] seeded ~/.claude/.credentials.json from CLAUDE_CREDENTIALS_B64");
@@ -847,21 +869,22 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
     fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
   const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-tunnel.json");
-  const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const roverId = requireEnv("LS_ROVER_ID");
   const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
   for (const s of services) {
-    const label = `${slugLabel}-${s.name}`;
+    const label = serviceLabel2(projectSlug, s.name, roverId);
     if (!DNS_LABEL_RE.test(label)) {
       fail2(`[entrypoint] hostname label "${label}" (${label.length} chars) is not a valid DNS label \u2014 must be 1\u201363 chars of [a-z0-9-] with no leading/trailing hyphen. Shorten the project slug ("${projectSlug}") or the service name ("${s.name}").`);
     }
   }
-  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => `${slugLabel}-${s.name}`).join(",")}`);
+  const tunnelName = `launch-kit-${projectSlug}-${roverToken(roverId)}`;
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=${tunnelName} zone=${chosen.name} services=${services.map((s) => serviceLabel2(projectSlug, s.name, roverId)).join(",")}`);
   const result = await provisionIngress({
     apiToken: token,
     accountId,
     zone: chosen,
-    tunnelName: `launch-kit-${projectSlug}`,
-    services: services.map((s) => ({ name: s.name, label: `${slugLabel}-${s.name}`, port: s.port })),
+    tunnelName,
+    services: services.map((s) => ({ name: s.name, label: serviceLabel2(projectSlug, s.name, roverId), port: s.port })),
     stateFile
   });
   for (const [name, fqdn] of Object.entries(result.hostnames)) {