@mohou/host 1.0.20 → 1.0.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohou/host",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -49,11 +49,11 @@
     "react-dom": "^19.2.0",
     "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
-    "@mohou/app-view": "^1.0.20",
-    "@mohou/contract": "^1.0.20",
-    "@mohou/runtime-provider": "^1.0.20",
-    "@mohou/ui": "^1.0.20",
-    "@mohou/mcp-client": "^1.0.20"
+    "@mohou/app-view": "^1.0.22",
+    "@mohou/contract": "^1.0.22",
+    "@mohou/runtime-provider": "^1.0.22",
+    "@mohou/mcp-client": "^1.0.22",
+    "@mohou/ui": "^1.0.22"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",

package/src/host/config.ts

@@ -25,6 +25,12 @@ export interface HostPolicy {
   }
   /** Absent, or `default`, means the builtin library. Not required to boot. */
   defaultWorkbenchId?: string
+  /**
+   * Registry for this product's own update check and install, when the owner wants a mirror.
+   * Absent or empty follows the install prefix's build-time value. Our own npm children only:
+   * `~/.npmrc` and an app's own dependency installs are untouched.
+   */
+  updateRegistry?: string
 }
 
 /** Seed numbers and names. Host policy, not a locked product value. */

package/src/http/bind.ts

@@ -15,7 +15,7 @@ import { readVendorFile } from './ports.ts'
 import type { LoopbackPorts } from './ports.ts'
 import { authoringTokenMatches } from './guard.ts'
 import { probeBrain, type HostPolicy } from '../host/config.ts'
-import { checkPackageUpdate, discardUpdateResult, readUpdateResult, stagePackageUpdate } from './updates.ts'
+import { checkPackageUpdate, discardUpdateResult, readUpdateResult, readUpdateSource, stagePackageUpdate, updateEnv } from './updates.ts'
 import { McpError } from '@mohou/mcp-client'
 
 import { admitMcpText } from '../host/mcp-import.ts'
@@ -147,15 +147,16 @@ export function bindLoopback(input: {
     subscribeHost: listener => input.author.hostEvents.subscribe(listener),
     subscribeFrames: listener => forwardFrames(input.author.appEvents, listener),
     subscribeApp: (appId, since, listener) => input.author.appEvents.subscribe(appId, since, listener),
+    updateSource: () => Promise.resolve(readUpdateSource(updateEnv(input.policy()))),
     checkUpdate: async () => {
       const attempt = readUpdateResult(input.runtimeRoot)
       return {
-        ...await checkPackageUpdate(),
+        ...await checkPackageUpdate(undefined, updateEnv(input.policy())),
         ...attempt === undefined ? {} : { lastAttempt: attempt },
       }
     },
     installUpdate: (version) => {
-      stagePackageUpdate(version)
+      stagePackageUpdate(version, updateEnv(input.policy()))
       if (input.restart === undefined) return Promise.resolve()
       const restart = input.restart
       setTimeout(() => {

package/src/http/owner.ts

@@ -36,9 +36,10 @@ export function mountOwner(app: Hono<HostEnv>, ports: LoopbackPorts): void {
     if (denied !== undefined) return denied
     return writeConfig(c, ports)
   })
-  app.get(httpLayout.about, c => c.json({
+  app.get(httpLayout.about, async c => c.json({
     ok: true,
     ...aboutInfo(),
+    source: await ports.updateSource(),
     authoring: {
       url: `http://127.0.0.1:${ports.readPolicy().hostPort}${httpLayout.mcp}`,
       token: ports.authoringToken,

package/src/http/ports.ts

@@ -11,7 +11,7 @@ import type { CredentialListing } from '../credentials/provider.ts'
 import type { McpCheck, McpEditorServer } from '../host/mcp-editor.ts'
 import type { McpLoadFailure } from '../host/mcp.ts'
 import type { AppPin } from '../theme/pin.ts'
-import type { UpdateCheck } from './updates.ts'
+import type { UpdateCheck, UpdateSource } from './updates.ts'
 
 const require = createRequire(import.meta.url)
 
@@ -67,6 +67,8 @@ export interface LoopbackPorts {
   subscribeFrames(listener: (event: unknown) => void): () => void
   subscribeApp(appId: string, since: number, listener: (event: unknown) => void): () => void
   checkUpdate(): Promise<UpdateCheck>
+  /** Where an update would come from. Reads the prefix; no network. */
+  updateSource(): Promise<UpdateSource>
   installUpdate?(version: string): Promise<void>
   /** The panel showed the launcher's last attempt. The record is dropped, not shown twice. */
   ackUpdate?(at: number): Promise<void>

package/src/http/reply.ts

@@ -30,11 +30,15 @@ export function isRecord(value: unknown): value is Record<string, unknown> {
 export function mergePolicy(current: unknown, body: Record<string, unknown>): Record<string, unknown> {
   const base = isRecord(current) ? current : {}
   const runtimeRoot = typeof base.runtimeRoot === 'string' ? base.runtimeRoot : undefined
+  const { updateRegistry: rawRegistry, ...rest } = body
+  const updateRegistry = typeof rawRegistry === 'string' ? rawRegistry.trim() : undefined
   const provider = isRecord(body.runtimeProvider) ? body.runtimeProvider : undefined
   const previous = isRecord(base.runtimeProvider) ? base.runtimeProvider : undefined
   return {
     ...base,
-    ...body,
+    ...rest,
+    // An empty string means "the packaged default". A non-string never clobbers the stored value.
+    ...updateRegistry === undefined ? {} : { updateRegistry },
     ...runtimeRoot === undefined ? {} : { runtimeRoot },
     ...provider === undefined || previous === undefined ? {} : {
       runtimeProvider: {

package/src/http/updates.ts

@@ -5,6 +5,12 @@ import path from 'node:path'
 import { homePackagesDir, hostUpdateResultPath } from '../host/layout.ts'
 import { aboutInfo } from './ports.ts'
 
+/**
+ * Ask the install channel once. A dev tree with no prefix still asks the registry and cannot install.
+ * The budget is host policy, not a locked number: a mirror's first response is often slow.
+ */
+export const updateCheckTimeoutMs = 8_000
+
 /** Why an install did not finish. The panel owns the wording of each code. */
 export const updateFailureCodes = ['timeout', 'exit', 'prepare', 'closed', 'leftover', 'verify', 'boot'] as const
 
@@ -32,6 +38,15 @@ export type UpdateAttempt =
     readonly at: number
   }
 
+/**
+ * Where this install updates from. `none` is a source tree with no install prefix,
+ * which cannot install anything.
+ */
+export type UpdateSource =
+  | { readonly channel: 'registry'; readonly registry: string }
+  | { readonly channel: 'tarball'; readonly tarballDir: string }
+  | { readonly channel: 'none' }
+
 export interface UpdateCheck {
   readonly name: string
   readonly current: string
@@ -39,6 +54,9 @@ export interface UpdateCheck {
   readonly updateAvailable: boolean
   readonly channel?: 'registry' | 'tarball'
   readonly installable?: boolean
+  /** Set when the install prefix names one, so a panel can say where an update comes from. */
+  readonly registry?: string
+  readonly tarballDir?: string
   readonly error?: string
   /** The last install this machine recorded, when one is on disk. */
   readonly lastAttempt?: UpdateAttempt
@@ -62,12 +80,14 @@ export async function checkPackageUpdate(
   if (about.name.length === 0) return { ...empty, error: 'package name is missing' }
   const prefix = readPrefixUpdate(cwd, env)
   if (prefix?.channel === 'tarball') {
-    const latest = newestTarball(prefix.tarballDir ?? homePackagesDir(homedir()), 'shell')
+    const tarballDir = prefix.tarballDir ?? homePackagesDir(homedir())
+    const latest = newestTarball(tarballDir, 'shell')
     return {
       name: '@mohou/shell',
       current: about.current,
       latest,
       channel: 'tarball',
+      tarballDir,
       installable: true,
       updateAvailable: latest !== null && compareVersion(latest, about.current) > 0,
     }
@@ -77,9 +97,15 @@ export async function checkPackageUpdate(
   const name = prefix === undefined ? about.name : '@mohou/shell'
   try {
     const response = await fetch(`${registry.replace(/\/$/, '')}/${name}/latest`, {
-      signal: AbortSignal.timeout(3_000),
+      signal: AbortSignal.timeout(updateCheckTimeoutMs),
     })
-    if (!response.ok) return { ...empty, name, ...prefix === undefined ? {} : { channel: prefix.channel }, installable: prefix !== undefined, error: `package registry returned ${response.status}` }
+    if (!response.ok) return {
+      ...empty,
+      name,
+      ...prefix === undefined ? {} : { channel: prefix.channel, registry: prefix.registry ?? 'https://registry.npmjs.org' },
+      installable: prefix !== undefined,
+      error: `package registry returned ${response.status}`,
+    }
     const body = await response.json() as { version?: unknown }
     const latest = typeof body.version === 'string' ? body.version : null
     return {
@@ -87,14 +113,41 @@ export async function checkPackageUpdate(
       current: about.current,
       latest,
       channel: prefix?.channel ?? 'registry',
+      ...prefix === undefined ? {} : { registry: prefix.registry ?? 'https://registry.npmjs.org' },
       installable: prefix !== undefined,
-      updateAvailable: latest !== null && latest !== about.current,
+      // Newer only. A mirror syncs late, and an older `latest` is not an update.
+      updateAvailable: latest !== null && compareVersion(latest, about.current) > 0,
     }
   } catch (error) {
-    return { ...empty, name, ...prefix === undefined ? {} : { channel: prefix.channel }, installable: prefix !== undefined, error: error instanceof Error ? error.message : 'update check failed' }
+    return {
+      ...empty,
+      name,
+      ...prefix === undefined ? {} : { channel: prefix.channel, registry: prefix.registry ?? 'https://registry.npmjs.org' },
+      installable: prefix !== undefined,
+      error: error instanceof Error ? error.message : 'update check failed',
+    }
   }
 }
 
+export function updateEnv(policy: { readonly updateRegistry?: string }, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const registry = policy.updateRegistry?.trim()
+  return registry === undefined || registry.length === 0 ? env : { ...env, MINI_APP_NPM_REGISTRY: registry }
+}
+
+/**
+ * Where this install would update from. Reads the install prefix; asks no registry, so a
+ * panel can show the source while the network is slow or down.
+ * @param env - process environment; `MINI_APP_TARBALL_DIR` overrides the package folder, and
+ *   `MINI_APP_NPM_REGISTRY` overrides the prefix's registry (that is how the policy reaches us)
+ * @param cwd - directory the sidecar runs in
+ */
+export function readUpdateSource(env: NodeJS.ProcessEnv = process.env, cwd = process.cwd()): UpdateSource {
+  const prefix = readPrefixUpdate(cwd, env)
+  if (prefix === undefined) return { channel: 'none' }
+  if (prefix.channel === 'tarball') return { channel: 'tarball', tarballDir: prefix.tarballDir ?? homePackagesDir(homedir()) }
+  return { channel: 'registry', registry: prefix.registry ?? 'https://registry.npmjs.org' }
+}
+
 /**
  * Read the launcher's record of the last install. A missing, unreadable, or malformed file reads as
  * no attempt: the panel shows nothing rather than a guessed outcome.
@@ -232,10 +285,13 @@ function readPrefixUpdate(cwd: string, env: NodeJS.ProcessEnv): PrefixUpdate | u
   const packages = Object.keys(parsed.dependencies ?? {}).filter(name => name.startsWith('@mohou/'))
   const override = env.MINI_APP_TARBALL_DIR
   const tarballDir = override !== undefined && override.length > 0 ? override : parsed.mohou?.tarballDir
+  const registry = env.MINI_APP_NPM_REGISTRY?.trim()
   return {
     dir,
     channel,
-    ...typeof parsed.mohou?.registry === 'string' ? { registry: parsed.mohou.registry } : {},
+    ...registry !== undefined && registry.length > 0
+      ? { registry }
+      : typeof parsed.mohou?.registry === 'string' ? { registry: parsed.mohou.registry } : {},
     ...tarballDir === undefined ? {} : { tarballDir },
     packages: packages.length === 0 ? ['@mohou/shell'] : packages,
   }