@mohou/host 1.0.21 → 1.0.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohou/host",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -49,11 +49,11 @@
     "react-dom": "^19.2.0",
     "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
-    "@mohou/app-view": "^1.0.21",
-    "@mohou/mcp-client": "^1.0.21",
-    "@mohou/runtime-provider": "^1.0.21",
-    "@mohou/contract": "^1.0.21",
-    "@mohou/ui": "^1.0.21"
+    "@mohou/contract": "^1.0.23",
+    "@mohou/app-view": "^1.0.23",
+    "@mohou/mcp-client": "^1.0.23",
+    "@mohou/ui": "^1.0.23",
+    "@mohou/runtime-provider": "^1.0.23"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",

package/src/host/config.ts

@@ -25,6 +25,12 @@ export interface HostPolicy {
   }
   /** Absent, or `default`, means the builtin library. Not required to boot. */
   defaultWorkbenchId?: string
+  /**
+   * Registry for this product's own update check and install, when the owner wants a mirror.
+   * Absent or empty follows the install prefix's build-time value. Our own npm children only:
+   * `~/.npmrc` and an app's own dependency installs are untouched.
+   */
+  updateRegistry?: string
 }
 
 /** Seed numbers and names. Host policy, not a locked product value. */
@@ -44,7 +50,7 @@ export interface PortBound {
 export const DEFAULT_PORT_BOUND: PortBound = { min: 1024, max: 65535 }
 
 const PUBLIC_KEYS = ['runtimeRoot', 'hostPort', 'theme', 'palette', 'locale', 'chatLanguage', 'llm', 'runtimeProvider'] as const
-const OPTIONAL_KEYS = ['defaultWorkbenchId'] as const
+const OPTIONAL_KEYS = ['defaultWorkbenchId', 'updateRegistry'] as const
 
 /**
  * Read `host.json`. A missing file writes a complete seed. A present bad file throws and is left as it was.
@@ -183,9 +189,18 @@ function admitPolicy(raw: unknown, runtimeRoot: string, ports: PortBound): HostP
     llm: admitLlm(raw.llm),
     runtimeProvider: admitProvider(raw.runtimeProvider),
     ...admitWorkbench(raw.defaultWorkbenchId),
+    ...admitUpdateRegistry(raw.updateRegistry),
   }
 }
 
+/** An empty value means the packaged default, so it is not written at all. */
+function admitUpdateRegistry(value: unknown): { updateRegistry: string } | Record<string, never> {
+  if (value === undefined) return {}
+  if (typeof value !== 'string') throw new ConfigError('config-invalid', 'host config updateRegistry is invalid')
+  const registry = value.trim()
+  return registry.length === 0 ? {} : { updateRegistry: registry }
+}
+
 function admitWorkbench(value: unknown): { defaultWorkbenchId: string } | Record<string, never> {
   if (value === undefined || value === 'default') return {}
   if (typeof value !== 'string' || value.length === 0) {

package/src/http/bind.ts

@@ -15,7 +15,7 @@ import { readVendorFile } from './ports.ts'
 import type { LoopbackPorts } from './ports.ts'
 import { authoringTokenMatches } from './guard.ts'
 import { probeBrain, type HostPolicy } from '../host/config.ts'
-import { checkPackageUpdate, discardUpdateResult, readUpdateResult, readUpdateSource, stagePackageUpdate } from './updates.ts'
+import { checkPackageUpdate, discardUpdateResult, readUpdateResult, readUpdateSource, stagePackageUpdate, updateEnv } from './updates.ts'
 import { McpError } from '@mohou/mcp-client'
 
 import { admitMcpText } from '../host/mcp-import.ts'
@@ -147,16 +147,16 @@ export function bindLoopback(input: {
     subscribeHost: listener => input.author.hostEvents.subscribe(listener),
     subscribeFrames: listener => forwardFrames(input.author.appEvents, listener),
     subscribeApp: (appId, since, listener) => input.author.appEvents.subscribe(appId, since, listener),
-    updateSource: () => Promise.resolve(readUpdateSource()),
+    updateSource: () => Promise.resolve(readUpdateSource(updateEnv(input.policy()))),
     checkUpdate: async () => {
       const attempt = readUpdateResult(input.runtimeRoot)
       return {
-        ...await checkPackageUpdate(),
+        ...await checkPackageUpdate(undefined, updateEnv(input.policy())),
         ...attempt === undefined ? {} : { lastAttempt: attempt },
       }
     },
     installUpdate: (version) => {
-      stagePackageUpdate(version)
+      stagePackageUpdate(version, updateEnv(input.policy()))
       if (input.restart === undefined) return Promise.resolve()
       const restart = input.restart
       setTimeout(() => {

package/src/http/reply.ts

@@ -30,11 +30,15 @@ export function isRecord(value: unknown): value is Record<string, unknown> {
 export function mergePolicy(current: unknown, body: Record<string, unknown>): Record<string, unknown> {
   const base = isRecord(current) ? current : {}
   const runtimeRoot = typeof base.runtimeRoot === 'string' ? base.runtimeRoot : undefined
+  const { updateRegistry: rawRegistry, ...rest } = body
+  const updateRegistry = typeof rawRegistry === 'string' ? rawRegistry.trim() : undefined
   const provider = isRecord(body.runtimeProvider) ? body.runtimeProvider : undefined
   const previous = isRecord(base.runtimeProvider) ? base.runtimeProvider : undefined
   return {
     ...base,
-    ...body,
+    ...rest,
+    // An empty string means "the packaged default". A non-string never clobbers the stored value.
+    ...updateRegistry === undefined ? {} : { updateRegistry },
     ...runtimeRoot === undefined ? {} : { runtimeRoot },
     ...provider === undefined || previous === undefined ? {} : {
       runtimeProvider: {

package/src/http/updates.ts

@@ -5,6 +5,12 @@ import path from 'node:path'
 import { homePackagesDir, hostUpdateResultPath } from '../host/layout.ts'
 import { aboutInfo } from './ports.ts'
 
+/**
+ * Ask the install channel once. A dev tree with no prefix still asks the registry and cannot install.
+ * The budget is host policy, not a locked number: a mirror's first response is often slow.
+ */
+export const updateCheckTimeoutMs = 8_000
+
 /** Why an install did not finish. The panel owns the wording of each code. */
 export const updateFailureCodes = ['timeout', 'exit', 'prepare', 'closed', 'leftover', 'verify', 'boot'] as const
 
@@ -91,7 +97,7 @@ export async function checkPackageUpdate(
   const name = prefix === undefined ? about.name : '@mohou/shell'
   try {
     const response = await fetch(`${registry.replace(/\/$/, '')}/${name}/latest`, {
-      signal: AbortSignal.timeout(3_000),
+      signal: AbortSignal.timeout(updateCheckTimeoutMs),
     })
     if (!response.ok) return {
       ...empty,
@@ -109,7 +115,8 @@ export async function checkPackageUpdate(
       channel: prefix?.channel ?? 'registry',
       ...prefix === undefined ? {} : { registry: prefix.registry ?? 'https://registry.npmjs.org' },
       installable: prefix !== undefined,
-      updateAvailable: latest !== null && latest !== about.current,
+      // Newer only. A mirror syncs late, and an older `latest` is not an update.
+      updateAvailable: latest !== null && compareVersion(latest, about.current) > 0,
     }
   } catch (error) {
     return {
@@ -122,10 +129,16 @@ export async function checkPackageUpdate(
   }
 }
 
+export function updateEnv(policy: { readonly updateRegistry?: string }, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const registry = policy.updateRegistry?.trim()
+  return registry === undefined || registry.length === 0 ? env : { ...env, MINI_APP_NPM_REGISTRY: registry }
+}
+
 /**
  * Where this install would update from. Reads the install prefix; asks no registry, so a
  * panel can show the source while the network is slow or down.
- * @param env - process environment; `MINI_APP_TARBALL_DIR` overrides the package folder
+ * @param env - process environment; `MINI_APP_TARBALL_DIR` overrides the package folder, and
+ *   `MINI_APP_NPM_REGISTRY` overrides the prefix's registry (that is how the policy reaches us)
  * @param cwd - directory the sidecar runs in
  */
 export function readUpdateSource(env: NodeJS.ProcessEnv = process.env, cwd = process.cwd()): UpdateSource {
@@ -272,10 +285,13 @@ function readPrefixUpdate(cwd: string, env: NodeJS.ProcessEnv): PrefixUpdate | u
   const packages = Object.keys(parsed.dependencies ?? {}).filter(name => name.startsWith('@mohou/'))
   const override = env.MINI_APP_TARBALL_DIR
   const tarballDir = override !== undefined && override.length > 0 ? override : parsed.mohou?.tarballDir
+  const registry = env.MINI_APP_NPM_REGISTRY?.trim()
   return {
     dir,
     channel,
-    ...typeof parsed.mohou?.registry === 'string' ? { registry: parsed.mohou.registry } : {},
+    ...registry !== undefined && registry.length > 0
+      ? { registry }
+      : typeof parsed.mohou?.registry === 'string' ? { registry: parsed.mohou.registry } : {},
     ...tarballDir === undefined ? {} : { tarballDir },
     packages: packages.length === 0 ? ['@mohou/shell'] : packages,
   }