@mycadet/cli 0.12.9-dev.202610151822.dbac7cb → 0.12.9-dev.202610160107.b6eac7a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.9-dev.202610151822.dbac7cb",
+  "version": "0.12.9-dev.202610160107.b6eac7a",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {

package/src/__tests__/nginx-ingress.test.ts

@@ -51,6 +51,10 @@ mock.module("node:fs", () => ({
   readFileSync: readFileSyncMock,
 }));
 
+const fetchCurrentVersionMock = mock<typeof httpClient.fetchCurrentVersion>(
+  async () => "1.2.3",
+);
+
 const waitForDaemonReadyMock = mock<typeof httpClient.waitForDaemonReady>(
   async () => true,
 );
@@ -58,6 +62,7 @@ const waitForDaemonReadyMock = mock<typeof httpClient.waitForDaemonReady>(
 mock.module("../lib/http-client.js", () => ({
   ...httpClient,
   waitForDaemonReady: waitForDaemonReadyMock,
+  fetchCurrentVersion: fetchCurrentVersionMock,
 }));
 
 // Restore the real modules once this file finishes so the mocks do not leak
@@ -72,7 +77,6 @@ import {
   buildIngressNginxConfig,
   hasIpv6Loopback,
   buildRemoteWebIndexHtml,
-  cloudWebHubUrl,
   MAX_PRESERVED_MODULE_PRELOADS,
   ensureTunnelEdge,
   EDGE_TEMPLATE_VERSION,
@@ -124,6 +128,8 @@ afterEach(() => {
   existsSyncMock.mockImplementation(realFs.existsSync);
   readFileSyncMock.mockReset();
   readFileSyncMock.mockImplementation(realFs.readFileSync);
+  fetchCurrentVersionMock.mockReset();
+  fetchCurrentVersionMock.mockImplementation(async () => "1.2.3");
   waitForDaemonReadyMock.mockReset();
   waitForDaemonReadyMock.mockImplementation(async () => true);
   for (const dir of workspaces.splice(0)) {
@@ -524,18 +530,6 @@ describe("buildRemoteWebIndexHtml", () => {
   });
 });
 
-describe("cloudWebHubUrl", () => {
-  test("maps build environments to their cloud SPA base", () => {
-    expect(cloudWebHubUrl("production")).toBe("https://mycadet.ai/assistant");
-    expect(cloudWebHubUrl("staging")).toBe(
-      "https://staging.mycadet.ai/assistant",
-    );
-    expect(cloudWebHubUrl("dev")).toBe("https://dev.mycadet.ai/assistant");
-    expect(cloudWebHubUrl("local")).toBe("https://dev.mycadet.ai/assistant");
-    expect(cloudWebHubUrl(undefined)).toBe("https://dev.mycadet.ai/assistant");
-  });
-});
-
 describe("nginx ingress process state", () => {
   function writeIngressState(workspaceDir: string, listenPort: number): void {
     writeFileSync(
@@ -743,17 +737,19 @@ function mockWebDistMissing(): void {
 }
 
 /** Force findWebDistDir() to resolve a dist dir, regardless of checkout state. */
-function mockWebDistPresent(): void {
+function mockWebDistPresent(version: string | null = "1.2.3"): void {
   existsSyncMock.mockImplementation((path) =>
     String(path).endsWith(WEB_INDEX_SUFFIX) ? true : realFs.existsSync(path),
   );
   readFileSyncMock.mockImplementation(((path, options) =>
     String(path).endsWith(WEB_INDEX_SUFFIX)
       ? FAKE_INDEX_HTML
-      : realFs.readFileSync(
-          path as never,
-          options as never,
-        )) as typeof readFileSync);
+      : String(path).endsWith("release.json")
+        ? JSON.stringify(version === null ? {} : { version })
+        : realFs.readFileSync(
+            path as never,
+            options as never,
+          )) as typeof readFileSync);
 }
 
 /** Record a running edge: ingress state, live pidfile, matching ps output. */
@@ -860,6 +856,7 @@ function spaConfigHash(
           hubUrl: PRODUCTION_HUB_URL,
         },
         webDistDir: opts.webDistDir ?? findWebDistDir(),
+        version: "1.2.3",
         indexHtml: opts.indexHtml ?? FAKE_INDEX_HTML,
       }),
     )
@@ -885,6 +882,70 @@ function pinProductionEnvironment(): void {
 describe("startRemoteWebIngress", () => {
   pinProductionEnvironment();
 
+  for (const [webVersion, runtimeVersion, ready] of [
+    ["1.2.3", "1.2.3", true],
+    ["1.2.3", "v1.2.3", true],
+    ["1.2.2", "1.2.3", false],
+    ["1.2.3", undefined, false],
+    [null, "1.2.3", false],
+  ] as const) {
+    test(`release resolution: UI ${webVersion}, assistant ${runtimeVersion}`, async () => {
+      const ws = makeWorkspace();
+      mockNginxInstalled();
+      mockNginxSpawn();
+      mockWebDistPresent(webVersion);
+      fetchCurrentVersionMock.mockResolvedValue(runtimeVersion);
+      const result = await startRemoteWebIngress({
+        workspaceDir: ws,
+        gatewayPort: 7830,
+        listenPort: 7845,
+        assistantId: "assistant-1",
+      });
+      expect(result.status).toBe("started");
+      expect(fetchCurrentVersionMock).toHaveBeenCalledWith(
+        "http://127.0.0.1:7830",
+      );
+      const conf = realFs.readFileSync(ingressConfPath(ws), "utf8");
+      const detail = conf
+        .split('location = "/v1/assistants/assistant-1/" {')[1]
+        ?.split("\n    }")[0];
+      expect(detail).toContain(`return ${ready ? 200 : 409} `);
+      if (ready) {
+        expect(detail).toContain('\\"version\\":\\"1.2.3\\"');
+      } else {
+        expect(detail).not.toContain('\\"url\\"');
+      }
+    });
+  }
+
+  test("restarts an edge when its verified assistant/UI release changes", async () => {
+    const ws = makeWorkspace();
+    mockNginxInstalled();
+    mockNginxSpawn();
+    mockWebDistPresent("1.2.3");
+    fetchCurrentVersionMock.mockResolvedValue("1.2.4");
+    const pid = mockRunningEdge(ws, {
+      listenPort: 7845,
+      includeWebApp: true,
+      gatewayPort: 7830,
+      remoteWebConfigHash: spaConfigHash({ assistantId: "assistant-1" }),
+    });
+    const edge = mockKillableNginx(pid);
+    const result = await startRemoteWebIngress({
+      workspaceDir: ws,
+      gatewayPort: 7830,
+      listenPort: 7845,
+      assistantId: "assistant-1",
+    });
+    expect(result.status).toBe("started");
+    expect(edge.killed()).toBe(true);
+    const conf = realFs.readFileSync(ingressConfPath(ws), "utf8");
+    const detail = conf
+      .split('location = "/v1/assistants/assistant-1/" {')[1]
+      ?.split("\n    }")[0];
+    expect(detail).toContain("return 409 ");
+  });
+
   test("webhooks-only mode starts the denylist+proxy edge without a web dist", async () => {
     const ws = makeWorkspace();
     mockNginxInstalled();
@@ -2266,7 +2327,7 @@ describe("assistant metadata API", () => {
       listenPort: 7840,
       remoteWebIngress: {
         webDistDir: "/tmp/web",
-        uiVersion: "bundle-hash",
+        version: "1.2.3",
         assistantId: id,
         assistantName: "My assistant",
         config: { appAllowedOrigins: ["https://parent.example"] },
@@ -2294,7 +2355,7 @@ describe("assistant metadata API", () => {
       id: "assistant-1",
       name: "My assistant",
       status: "active",
-      version: "bundle-hash",
+      version: "1.2.3",
       url: "assistant/",
     });
     expect(conf).not.toContain('location = "/v1/assistants/other/"');

package/src/commands/upgrade.ts

@@ -57,7 +57,6 @@ import {
   buildUpgradeCommitMessage,
   captureReplayState,
   captureUpgradeFailureLogs,
-  fetchCurrentVersion,
   commitWorkspaceViaGateway,
   rollbackMigrations,
   UPGRADE_PROGRESS,
@@ -69,6 +68,7 @@ import {
   stripVersionPrefix,
   versionsEqual,
 } from "../lib/version-compat.js";
+import { fetchCurrentVersion } from "../lib/http-client.js";
 import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 import {
   generateLocalSigningKey,

package/src/lib/__tests__/http-client-version.test.ts

@@ -0,0 +1,29 @@
+import { afterAll, afterEach, expect, spyOn, test } from "bun:test";
+import { fetchCurrentVersion } from "../http-client.js";
+
+const request = spyOn(globalThis, "fetch");
+afterEach(() => request.mockReset());
+afterAll(() => request.mockRestore());
+
+test("reads the gateway's version through the public health endpoint", async () => {
+  request.mockResolvedValueOnce(
+    Response.json({ version: "1.2.3", status: "ok" }),
+  );
+  expect(await fetchCurrentVersion("http://127.0.0.1:7830")).toBe("1.2.3");
+  expect(request.mock.calls[0][0]).toBe("http://127.0.0.1:7830/healthz");
+});
+
+test("an unverified gateway response never supplies a release version", async () => {
+  for (const value of [{}, null, { version: "" }, { version: 123 }]) {
+    request.mockResolvedValueOnce(Response.json(value));
+    expect(await fetchCurrentVersion("http://127.0.0.1:7830")).toBeUndefined();
+  }
+  request.mockResolvedValueOnce(new Response("not JSON"));
+  expect(await fetchCurrentVersion("http://127.0.0.1:7830")).toBeUndefined();
+  request.mockResolvedValueOnce(
+    Response.json({ version: "1.2.3" }, { status: 503 }),
+  );
+  expect(await fetchCurrentVersion("http://127.0.0.1:7830")).toBeUndefined();
+  request.mockRejectedValueOnce(new Error("offline"));
+  expect(await fetchCurrentVersion("http://127.0.0.1:7830")).toBeUndefined();
+});

package/src/lib/__tests__/web-dist.test.ts

@@ -3,7 +3,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { findWebDistDir } from "../web-dist.js";
+import { findWebDistDir, readWebReleaseVersion } from "../web-dist.js";
 
 const tempDirs: string[] = [];
 
@@ -84,3 +84,29 @@ test("preserves installed package and source checkout resolution", () => {
     }),
   ).toBe(sourceDist);
 });
+
+test("reads the built UI release, including a normalized version prefix", () => {
+  const root = makeTempDir();
+  writeFileSync(
+    join(root, "release.json"),
+    JSON.stringify({ version: "v1.2.3-dev.5" }),
+  );
+  expect(readWebReleaseVersion(root)).toBe("1.2.3-dev.5");
+});
+
+test("missing or malformed release metadata cannot stand in for a release", () => {
+  const root = makeTempDir();
+  expect(readWebReleaseVersion(root)).toBeUndefined();
+  for (const value of [
+    "not JSON",
+    "null",
+    "{}",
+    '{"version":null}',
+    '{"version":"latest"}',
+    '{"version":""}',
+    '{"version":"bundle-hash"}',
+  ]) {
+    writeFileSync(join(root, "release.json"), value);
+    expect(readWebReleaseVersion(root)).toBeUndefined();
+  }
+});

package/src/lib/cloud-login.ts

@@ -28,7 +28,8 @@ import {
   readCloudToken,
   saveCloudToken,
 } from "./cloud-client.js";
-import { fetchAssistantIngressUrl, fetchCurrentVersion } from "./upgrade-lifecycle.js";
+import { fetchAssistantIngressUrl } from "./upgrade-lifecycle.js";
+import { fetchCurrentVersion } from "./http-client.js";
 import {
   CALLBACK_PATH,
   buildAuthorizeUrl,

package/src/lib/host-teleport.ts

@@ -27,7 +27,8 @@ import {
 } from "./root-backup.js";
 import { DOCKER_STATEFUL_SET_SPEC } from "./statefulset.js";
 import { execOutput } from "./step-runner.js";
-import { buildReplayState, fetchCurrentVersion } from "./upgrade-lifecycle.js";
+import { buildReplayState } from "./upgrade-lifecycle.js";
+import { fetchCurrentVersion } from "./http-client.js";
 import { compareVersions } from "./version-compat.js";
 import { sleepAssistant } from "../commands/sleep.js";
 import { generateInstanceName } from "./random-name.js";

package/src/lib/http-client.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 export type HttpProbeEndpoint = "healthz" | "readyz";
@@ -141,3 +142,27 @@ export async function waitForDaemonMigrationsReady(
     await new Promise((r) => setTimeout(r, 250));
   }
 }
+
+const GatewayHealthSchema = z.object({ version: z.string().min(1).optional() });
+
+/**
+ * Best-effort fetch of the running service group version from the gateway
+ * `/healthz` endpoint.  Returns `undefined` when the endpoint is
+ * unreachable or does not include a version field.
+ */
+export async function fetchCurrentVersion(
+  runtimeUrl: string,
+): Promise<string | undefined> {
+  try {
+    const resp = await loopbackSafeFetch(`${runtimeUrl}/healthz`, {
+      signal: AbortSignal.timeout(5000),
+    });
+    if (resp.ok) {
+      const parsed = GatewayHealthSchema.safeParse(await resp.json());
+      return parsed.success ? parsed.data.version : undefined;
+    }
+  } catch {
+    // Best-effort
+  }
+  return undefined;
+}

package/src/lib/nginx-ingress.ts

@@ -30,7 +30,7 @@ import {
 } from "./assistant-config.js";
 import type { RemoteHost } from "./constants.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
-import { waitForDaemonReady } from "./http-client.js";
+import { fetchCurrentVersion, waitForDaemonReady } from "./http-client.js";
 import {
   getDefaultWorkspaceDir,
   isLocalContainerEntry,
@@ -38,7 +38,8 @@ import {
   parseGatewayPortFromEntryUrls,
   saveRawConfig,
 } from "./ingress-config.js";
-import { findWebDistDir } from "./web-dist.js";
+import { stripVersionPrefix } from "./version-compat.js";
+import { findWebDistDir, readWebReleaseVersion } from "./web-dist.js";
 
 export { findWebDistDir } from "./web-dist.js";
 
@@ -143,7 +144,8 @@ const DENYLIST_LOCATIONS = `    location = /auth/token { return 404; }
 export interface RemoteWebIngressOptions {
   webDistDir: string;
   indexHtmlPath?: string;
-  uiVersion?: string;
+  /** Assistant release verified against the served UI artifact. */
+  version?: string;
   config?: Record<string, unknown>;
   /** Serving assistant's display name, stamped into the served config so
    *  remote clients can label this origin. Absent in older served configs. */
@@ -153,19 +155,10 @@ export interface RemoteWebIngressOptions {
    *  configs. */
   assistantId?: string;
   /** Cloud web SPA base the remote client can hand this origin to (see
-   *  `cloudWebHubUrl`). Absent in older served configs. */
+   *  `cloudAssistantHubUrl`). Absent in older served configs. */
   hubUrl?: string;
 }
 
-/**
- * Cloud web SPA base URL for a build environment. The mapping lives in
- * `@mycadet/environments` (`cloudAssistantHubUrl`) and is shared with the
- * Capacitor shell's `server.url`, so the two consumers cannot drift.
- */
-export function cloudWebHubUrl(env: string | undefined): string {
-  return cloudAssistantHubUrl(env);
-}
-
 // The edge serves remote browsers, so the bundle's remote-gateway machinery
 // must always run: it is reached through this self-hosted edge however the
 // cadet itself is hosted. "cloud" is never stamped (the cloud serves its
@@ -199,13 +192,6 @@ function remoteWebIngressConfig(
       opts.assistantId ? lockfileAssistantRemote(opts.assistantId) : undefined,
     ),
     apiBaseUrl: "/v1",
-    ...(process.env.CADET_APP_ALLOWED_ORIGINS
-      ? {
-          appAllowedOrigins: process.env.CADET_APP_ALLOWED_ORIGINS.split(",")
-            .map((origin) => origin.trim())
-            .filter(Boolean),
-        }
-      : {}),
     ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
     ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
     ...(opts.hubUrl ? { hubUrl: opts.hubUrl } : {}),
@@ -218,7 +204,7 @@ function remoteWebIngressConfig(
  * fingerprint matches, so this must change whenever the generated index or
  * nginx template does.
  */
-export const EDGE_TEMPLATE_VERSION = 11;
+export const EDGE_TEMPLATE_VERSION = 12;
 
 /**
  * Stable fingerprint of the injected SPA config, its source bundle, and
@@ -229,6 +215,7 @@ export const EDGE_TEMPLATE_VERSION = 11;
 function remoteWebConfigFingerprint(
   config: Record<string, unknown>,
   webDistDir: string,
+  version?: string,
 ): string {
   return createHash("sha256")
     .update(
@@ -236,6 +223,7 @@ function remoteWebConfigFingerprint(
         template: EDGE_TEMPLATE_VERSION,
         config,
         webDistDir,
+        version,
         indexHtml: readFileSync(join(webDistDir, "index.html"), "utf-8"),
       }),
     )
@@ -358,7 +346,7 @@ export async function findAvailableIngressPort(
 const AssistantHostConfigSchema = z.object({
   assistantId: z.string().min(1).optional(),
   assistantName: z.string().optional(),
-  uiVersion: z.string().min(1).optional(),
+  version: z.string().min(1).optional(),
   hubUrl: z.string().url().optional(),
   appAllowedOrigins: z.array(z.string().url()).default([]),
 });
@@ -414,12 +402,12 @@ function assistantMetadataLocations(config: Record<string, unknown>): string {
       ? [
           {
             path: `/v1/assistants/${encodeURIComponent(id)}`,
-            status: metadata.uiVersion ? 200 : 409,
-            body: metadata.uiVersion
+            status: metadata.version ? 200 : 409,
+            body: metadata.version
               ? {
                   ...choice,
                   status: "active",
-                  version: metadata.uiVersion,
+                  version: metadata.version,
                   url: "assistant/",
                 }
               : { detail: "assistant is not ready" },
@@ -473,7 +461,7 @@ export function buildIngressNginxConfig(opts: {
         webDistDir: remoteWebIngress.webDistDir,
         indexHtmlPath: remoteWebIngress.indexHtmlPath,
         config: remoteWebIngressConfig(remoteWebIngress),
-        uiVersion: remoteWebIngress.uiVersion,
+        version: remoteWebIngress.version,
       })
     : `${DENYLIST_LOCATIONS}
 
@@ -567,7 +555,7 @@ function buildRemoteWebIngressLocations(opts: {
   webDistDir: string;
   indexHtmlPath?: string;
   config: Record<string, unknown>;
-  uiVersion?: string;
+  version?: string;
 }): string {
   const proxyBlock = gatewayProxyBlock(opts.gatewayPort);
   const webDistDir = nginxDirPath(opts.webDistDir);
@@ -578,7 +566,7 @@ function buildRemoteWebIngressLocations(opts: {
 
   return `${DENYLIST_LOCATIONS}
 
-${assistantMetadataLocations({ ...opts.config, uiVersion: opts.uiVersion })}
+${assistantMetadataLocations({ ...opts.config, version: opts.version })}
 
     location = /healthz {
 ${proxyBlock}
@@ -837,9 +825,6 @@ export function startIngressNginx(opts: {
       join(remoteWebIngress.webDistDir, "index.html"),
       "utf-8",
     );
-    remoteWebIngress.uiVersion = createHash("sha256")
-      .update(rawIndexHtml)
-      .digest("hex");
     writeFileSync(
       remoteWebIngress.indexHtmlPath,
       buildRemoteWebIndexHtml(rawIndexHtml, remoteWebIngress.config),
@@ -872,6 +857,7 @@ export function startIngressNginx(opts: {
           remoteWebConfigHash: remoteWebConfigFingerprint(
             remoteWebIngress.config,
             remoteWebIngress.webDistDir,
+            remoteWebIngress.version,
           ),
         }
       : {}),
@@ -1063,7 +1049,7 @@ export async function startRemoteWebIngress(opts: {
   // reuse decision and the actual spawn share one value and cannot drift.
   const spaOptions = includeWebApp
     ? {
-        hubUrl: cloudWebHubUrl(getCurrentEnvironment().name),
+        hubUrl: cloudAssistantHubUrl(getCurrentEnvironment().name),
         ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
         ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
       }
@@ -1072,11 +1058,23 @@ export async function startRemoteWebIngress(opts: {
   if (includeWebApp && !webDistDir) {
     return { status: "web-dist-missing" };
   }
+  const runtimeVersion = webDistDir
+    ? await fetchCurrentVersion(`http://127.0.0.1:${opts.gatewayPort}`)
+    : undefined;
+  const webVersion = webDistDir ? readWebReleaseVersion(webDistDir) : undefined;
+  const assistantVersion = runtimeVersion
+    ? stripVersionPrefix(runtimeVersion)
+    : undefined;
+  const matchedVersion =
+    assistantVersion && webVersion === assistantVersion
+      ? assistantVersion
+      : undefined;
   const requestedConfigHash =
     spaOptions && webDistDir
       ? remoteWebConfigFingerprint(
           remoteWebIngressConfig(spaOptions),
           webDistDir,
+          matchedVersion,
         )
       : undefined;
   // Both sides are undefined in webhooks-only mode; an SPA record without a
@@ -1140,7 +1138,9 @@ export async function startRemoteWebIngress(opts: {
     workspaceDir: opts.workspaceDir,
     gatewayPort: opts.gatewayPort,
     listenPort,
-    remoteWebIngress: webDistDir ? { webDistDir, ...spaOptions } : undefined,
+    remoteWebIngress: webDistDir
+      ? { webDistDir, ...spaOptions, version: matchedVersion }
+      : undefined,
   });
   let exited = false;
   child.once("exit", () => {

package/src/lib/upgrade-lifecycle.ts

@@ -30,10 +30,6 @@ import { classifyReadyzResponse } from "./http-client.js";
 import { resolveImageRefs } from "./cloud-releases.js";
 import { z } from "zod";
 
-const GatewayHealthSchema = z.object({
-  version: z.string().optional(),
-});
-
 const MigrationGateBodySchema = z.object({
   status: z.string().optional(),
   reason: z.string().optional(),
@@ -291,28 +287,6 @@ export async function captureReplayState(
   return buildReplayState(capturedEnv, gatewayEnv);
 }
 
-/**
- * Best-effort fetch of the running service group version from the gateway
- * `/healthz` endpoint.  Returns `undefined` when the endpoint is
- * unreachable or does not include a version field.
- */
-export async function fetchCurrentVersion(
-  runtimeUrl: string,
-): Promise<string | undefined> {
-  try {
-    const resp = await loopbackSafeFetch(`${runtimeUrl}/healthz`, {
-      signal: AbortSignal.timeout(5000),
-    });
-    if (resp.ok) {
-      const parsed = GatewayHealthSchema.safeParse(await resp.json());
-      return parsed.success ? parsed.data.version : undefined;
-    }
-  } catch {
-    // Best-effort
-  }
-  return undefined;
-}
-
 /**
  * Best-effort fetch of the assistant's configured public ingress URL from the
  * gateway `integrations/ingress/config` endpoint.  Returns `undefined` when

package/src/lib/web-dist.ts

@@ -1,4 +1,7 @@
-import { existsSync } from "node:fs";
+import { stripVersionPrefix } from "./version-compat.js";
+import { z } from "zod";
+import { isValidReleaseVersion } from "@mycadet/local-mode";
+import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 
@@ -46,3 +49,22 @@ export function findWebDistDir(options: WebDistOptions = {}): string | null {
   }
   return null;
 }
+
+const WebReleaseSchema = z.object({
+  version: z
+    .string()
+    .min(1)
+    .refine((value) => value !== "latest" && isValidReleaseVersion(value)),
+});
+
+export function readWebReleaseVersion(distDir: string): string | undefined {
+  try {
+    const payload: unknown = JSON.parse(
+      readFileSync(join(distDir, "release.json"), "utf8"),
+    );
+    const parsed = WebReleaseSchema.safeParse(payload);
+    return parsed.success ? stripVersionPrefix(parsed.data.version) : undefined;
+  } catch {
+    return undefined;
+  }
+}