@mycadet/cli 0.12.11 → 0.13.0

package/src/lib/nginx-ingress.ts

@@ -17,6 +17,8 @@ import { createServer } from "node:net";
 import { networkInterfaces } from "node:os";
 import { join } from "node:path";
 
+import { z } from "zod";
+
 import { cloudAssistantHubUrl } from "@mycadet/environments";
 
 import {
@@ -28,7 +30,7 @@ import {
 } from "./assistant-config.js";
 import type { RemoteHost } from "./constants.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
-import { waitForDaemonReady } from "./http-client.js";
+import { fetchCurrentVersion, waitForDaemonReady } from "./http-client.js";
 import {
   getDefaultWorkspaceDir,
   isLocalContainerEntry,
@@ -36,7 +38,8 @@ import {
   parseGatewayPortFromEntryUrls,
   saveRawConfig,
 } from "./ingress-config.js";
-import { findWebDistDir } from "./web-dist.js";
+import { stripVersionPrefix } from "./version-compat.js";
+import { findWebDistDir, readWebReleaseVersion } from "./web-dist.js";
 
 export { findWebDistDir } from "./web-dist.js";
 
@@ -141,6 +144,8 @@ const DENYLIST_LOCATIONS = `    location = /auth/token { return 404; }
 export interface RemoteWebIngressOptions {
   webDistDir: string;
   indexHtmlPath?: string;
+  /** Assistant release verified against the served UI artifact. */
+  version?: string;
   config?: Record<string, unknown>;
   /** Serving assistant's display name, stamped into the served config so
    *  remote clients can label this origin. Absent in older served configs. */
@@ -150,19 +155,10 @@ export interface RemoteWebIngressOptions {
    *  configs. */
   assistantId?: string;
   /** Cloud web SPA base the remote client can hand this origin to (see
-   *  `cloudWebHubUrl`). Absent in older served configs. */
+   *  `cloudAssistantHubUrl`). Absent in older served configs. */
   hubUrl?: string;
 }
 
-/**
- * Cloud web SPA base URL for a build environment. The mapping lives in
- * `@mycadet/environments` (`cloudAssistantHubUrl`) and is shared with the
- * Capacitor shell's `server.url`, so the two consumers cannot drift.
- */
-export function cloudWebHubUrl(env: string | undefined): string {
-  return cloudAssistantHubUrl(env);
-}
-
 // The edge serves remote browsers, so the bundle's remote-gateway machinery
 // must always run: it is reached through this self-hosted edge however the
 // cadet itself is hosted. "cloud" is never stamped (the cloud serves its
@@ -208,7 +204,7 @@ function remoteWebIngressConfig(
  * fingerprint matches, so this must change whenever the generated index or
  * nginx template does.
  */
-export const EDGE_TEMPLATE_VERSION = 10;
+export const EDGE_TEMPLATE_VERSION = 12;
 
 /**
  * Stable fingerprint of the injected SPA config, its source bundle, and
@@ -219,6 +215,7 @@ export const EDGE_TEMPLATE_VERSION = 10;
 function remoteWebConfigFingerprint(
   config: Record<string, unknown>,
   webDistDir: string,
+  version?: string,
 ): string {
   return createHash("sha256")
     .update(
@@ -226,6 +223,7 @@ function remoteWebConfigFingerprint(
         template: EDGE_TEMPLATE_VERSION,
         config,
         webDistDir,
+        version,
         indexHtml: readFileSync(join(webDistDir, "index.html"), "utf-8"),
       }),
     )
@@ -345,9 +343,100 @@ export async function findAvailableIngressPort(
   return null;
 }
 
-/**
- * Build the nginx config that forwards tunnel web traffic to the gateway.
- */
+const AssistantHostConfigSchema = z.object({
+  assistantId: z.string().min(1).optional(),
+  assistantName: z.string().optional(),
+  version: z.string().min(1).optional(),
+  hubUrl: z.string().url().optional(),
+  appAllowedOrigins: z.array(z.string().url()).default([]),
+});
+
+function assistantHostConfig(config: Record<string, unknown>) {
+  const result = AssistantHostConfigSchema.safeParse(config);
+  if (!result.success) {
+    throw new Error("Invalid assistant host configuration.");
+  }
+  return result.data;
+}
+
+function appOrigins(config: Record<string, unknown>): string[] {
+  const metadata = assistantHostConfig(config);
+  const origins = [
+    ...metadata.appAllowedOrigins,
+    ...(metadata.hubUrl ? [new URL(metadata.hubUrl).origin] : []),
+  ];
+  return [...new Set(origins)].map((origin) => {
+    const url = new URL(origin);
+    if (
+      (url.protocol !== "https:" &&
+        !(
+          url.protocol === "http:" &&
+          ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
+        )) ||
+      url.origin !== origin.replace(/\/$/, "")
+    ) {
+      throw new Error(
+        "App origins must be HTTPS origins or loopback HTTP origins.",
+      );
+    }
+    return url.origin;
+  });
+}
+
+function assistantMetadataLocations(config: Record<string, unknown>): string {
+  const metadata = assistantHostConfig(config);
+  const id = metadata.assistantId;
+  const choice = id
+    ? {
+        id,
+        ...(metadata.assistantName ? { name: metadata.assistantName } : {}),
+      }
+    : undefined;
+  const responses = [
+    {
+      path: "/v1/assistants",
+      status: 200,
+      body: { results: choice ? [choice] : [], next: null },
+    },
+    ...(choice && id
+      ? [
+          {
+            path: `/v1/assistants/${encodeURIComponent(id)}`,
+            status: metadata.version ? 200 : 409,
+            body: metadata.version
+              ? {
+                  ...choice,
+                  status: "active",
+                  version: metadata.version,
+                  url: "assistant/",
+                }
+              : { detail: "assistant is not ready" },
+          },
+        ]
+      : []),
+  ];
+  return responses
+    .flatMap(({ path, status, body }) =>
+      [path, `${path}/`].map(
+        (route) => `
+    location = ${nginxQuoted(route, "assistant API path")} {
+      default_type application/json;
+      add_header Cache-Control "no-store" always;
+      add_header Access-Control-Allow-Origin $cadet_app_origin always;
+      add_header Access-Control-Allow-Credentials "true" always;
+      add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+      add_header Access-Control-Allow-Headers "Accept, Cadet-Organization-Id" always;
+      add_header Vary "Origin" always;
+      if ($request_method = OPTIONS) { return 204; }
+      if ($request_method !~ ^(GET|HEAD)$) { return 405; }
+      return ${status} ${nginxQuoted(JSON.stringify(body), "assistant metadata")};
+    }`,
+      ),
+    )
+    .join("\n");
+}
+
+/** Build the nginx config for the tunnel edge and its public assistant metadata. */
 export function buildIngressNginxConfig(opts: {
   gatewayPort: number;
   listenPort: number;
@@ -363,12 +452,16 @@ export function buildIngressNginxConfig(opts: {
     ? `    listen [::1]:${opts.listenPort};\n`
     : "";
   const remoteWebIngress = opts.remoteWebIngress;
+  const allowedOrigins = remoteWebIngress
+    ? appOrigins(remoteWebIngressConfig(remoteWebIngress))
+    : [];
   const serverLocations = remoteWebIngress
     ? buildRemoteWebIngressLocations({
         gatewayPort: opts.gatewayPort,
         webDistDir: remoteWebIngress.webDistDir,
         indexHtmlPath: remoteWebIngress.indexHtmlPath,
         config: remoteWebIngressConfig(remoteWebIngress),
+        version: remoteWebIngress.version,
       })
     : `${DENYLIST_LOCATIONS}
 
@@ -417,6 +510,11 @@ http {
     text/plain txt;
   }
 
+  map $http_origin $cadet_app_origin {
+    default "";
+${allowedOrigins.map((origin) => `    ${nginxQuoted(origin, "app origin")} ${nginxQuoted(origin, "app origin")};`).join("\n")}
+  }
+
   map $http_upgrade $connection_upgrade {
     default upgrade;
     "" close;
@@ -457,6 +555,7 @@ function buildRemoteWebIngressLocations(opts: {
   webDistDir: string;
   indexHtmlPath?: string;
   config: Record<string, unknown>;
+  version?: string;
 }): string {
   const proxyBlock = gatewayProxyBlock(opts.gatewayPort);
   const webDistDir = nginxDirPath(opts.webDistDir);
@@ -467,6 +566,8 @@ function buildRemoteWebIngressLocations(opts: {
 
   return `${DENYLIST_LOCATIONS}
 
+${assistantMetadataLocations({ ...opts.config, version: opts.version })}
+
     location = /healthz {
 ${proxyBlock}
     }
@@ -756,6 +857,7 @@ export function startIngressNginx(opts: {
           remoteWebConfigHash: remoteWebConfigFingerprint(
             remoteWebIngress.config,
             remoteWebIngress.webDistDir,
+            remoteWebIngress.version,
           ),
         }
       : {}),
@@ -947,7 +1049,7 @@ export async function startRemoteWebIngress(opts: {
   // reuse decision and the actual spawn share one value and cannot drift.
   const spaOptions = includeWebApp
     ? {
-        hubUrl: cloudWebHubUrl(getCurrentEnvironment().name),
+        hubUrl: cloudAssistantHubUrl(getCurrentEnvironment().name),
         ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
         ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
       }
@@ -956,11 +1058,23 @@ export async function startRemoteWebIngress(opts: {
   if (includeWebApp && !webDistDir) {
     return { status: "web-dist-missing" };
   }
+  const runtimeVersion = webDistDir
+    ? await fetchCurrentVersion(`http://127.0.0.1:${opts.gatewayPort}`)
+    : undefined;
+  const webVersion = webDistDir ? readWebReleaseVersion(webDistDir) : undefined;
+  const assistantVersion = runtimeVersion
+    ? stripVersionPrefix(runtimeVersion)
+    : undefined;
+  const matchedVersion =
+    assistantVersion && webVersion === assistantVersion
+      ? assistantVersion
+      : undefined;
   const requestedConfigHash =
     spaOptions && webDistDir
       ? remoteWebConfigFingerprint(
           remoteWebIngressConfig(spaOptions),
           webDistDir,
+          matchedVersion,
         )
       : undefined;
   // Both sides are undefined in webhooks-only mode; an SPA record without a
@@ -1024,7 +1138,9 @@ export async function startRemoteWebIngress(opts: {
     workspaceDir: opts.workspaceDir,
     gatewayPort: opts.gatewayPort,
     listenPort,
-    remoteWebIngress: webDistDir ? { webDistDir, ...spaOptions } : undefined,
+    remoteWebIngress: webDistDir
+      ? { webDistDir, ...spaOptions, version: matchedVersion }
+      : undefined,
   });
   let exited = false;
   child.once("exit", () => {

package/src/lib/process.ts

@@ -1,3 +1,4 @@
+import { DAEMON_STOP_TIMEOUT_MS } from "@mycadet/local-mode";
 import { execFileSync } from "child_process";
 import { existsSync, readFileSync, unlinkSync } from "fs";
 import { platform } from "os";
@@ -324,6 +325,7 @@ export async function stopProcess(
     });
   },
   readIdentity: (pid: number) => string | null = readPosixCommandLine,
+  gracefulOnly = false,
 ): Promise<boolean> {
   try {
     process.kill(pid, 0);
@@ -339,6 +341,9 @@ export async function stopProcess(
   console.log(`Stopping ${label} (pid ${pid})...`);
   let waitForGracefulExit = true;
   if (hostPlatform === "win32") {
+    if (gracefulOnly) {
+      throw new Error("Graceful-only shutdown is not supported for Windows local services.");
+    }
     try {
       runTaskkill(["/PID", String(pid), "/T"], timeoutMs);
     } catch {
@@ -363,6 +368,7 @@ export async function stopProcess(
   } catch {
     return true;
   }
+  if (gracefulOnly) return false;
   if (hostPlatform === "win32") {
     console.log(`${label} did not exit, terminating its process tree...`);
     try {
@@ -415,6 +421,13 @@ export async function stopProcess(
   }
 }
 
+/** Stop a service without escalation. Failure preserves PID tracking and aborts capture/replacement. */
+export async function stopProcessGracefully(pid: number, label: string, timeoutMs = DAEMON_STOP_TIMEOUT_MS): Promise<boolean> {
+  const stopped = await stopProcess(pid, label, timeoutMs, undefined, undefined, undefined, true);
+  if (!stopped) throw new Error(`${label} did not stop gracefully.`);
+  return stopped;
+}
+
 /** Remove one or more files, ignoring missing-file errors. */
 function removeFiles(...files: (string | string[] | undefined)[]): void {
   for (const entry of files) {