@nanobpm/nano-workforce 0.186.2 → 0.186.3

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.186.3](https://github.com/nanobpm/nano-workforce/compare/v0.186.2...v0.186.3) (2026-09-12)
+
+### Bug Fixes
+
+* **app:** redirect standalone /console routes to the engine console ([#780](https://github.com/nanobpm/nano-workforce/issues/780)) ([103e967](https://github.com/nanobpm/nano-workforce/commit/103e967b95191bb04239b5c6a2195913e50b8b9b)), closes [#771](https://github.com/nanobpm/nano-workforce/issues/771)
+
 ## [0.186.2](https://github.com/nanobpm/nano-workforce/compare/v0.186.1...v0.186.2) (2026-09-11)
 
 ### Bug Fixes

package/app/consoleRedirect.test.ts

@@ -0,0 +1,127 @@
+// Tests for app/consoleRedirect.ts — the standalone `/console` → engine-console redirect (issue
+// #771). Covers the pure match/target derivation, origin resolution from NANOBPMN_BASE_URL, and the
+// live listener-rewiring mount over a real node:http server (redirect fires for `/console/*`,
+// passthrough for everything else, teardown restores the original handler).
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import {
+  consoleRedirectLocation,
+  mountConsoleRedirect,
+  resolveConsoleOrigin,
+} from "./consoleRedirect.ts";
+
+test("redirects a bare /console path to the console origin", () => {
+  assertEquals(consoleRedirectLocation("/console", "http://localhost:8080"), "http://localhost:8080/console");
+});
+
+test("preserves the full path and query under /console/", () => {
+  assertEquals(
+    consoleRedirectLocation("/console/app-view/Foo?tab=bar&x=1", "http://localhost:8080"),
+    "http://localhost:8080/console/app-view/Foo?tab=bar&x=1",
+  );
+});
+
+test("leaves /app/* and root routes unchanged (null)", () => {
+  assertEquals(consoleRedirectLocation("/app/api/agent", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/agentic", "http://localhost:8080"), null);
+});
+
+test("does not match a sibling route that merely starts with 'console'", () => {
+  assertEquals(consoleRedirectLocation("/console-x", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/consolexyz/app", "http://localhost:8080"), null);
+});
+
+test("matches /console immediately followed by a query", () => {
+  assertEquals(consoleRedirectLocation("/console?next=1", "http://localhost:8080"), "http://localhost:8080/console?next=1");
+});
+
+test("normalises a trailing slash on the console origin", () => {
+  assertEquals(consoleRedirectLocation("/console/x", "http://localhost:8080/"), "http://localhost:8080/console/x");
+});
+
+test("handles an absent url", () => {
+  assertEquals(consoleRedirectLocation(undefined, "http://localhost:8080"), null);
+});
+
+test("resolveConsoleOrigin gives CAMUNDA_REST_ADDRESS precedence over NANOBPMN_BASE_URL", () => {
+  const read = (name: string): string | null =>
+    name === "CAMUNDA_REST_ADDRESS"
+      ? "http://engine.example:8080/v2"
+      : name === "NANOBPMN_BASE_URL"
+        ? "http://localhost:9999"
+        : null;
+  assertEquals(resolveConsoleOrigin(read), "http://engine.example:8080");
+});
+
+test("resolveConsoleOrigin uses NANOBPMN_BASE_URL when CAMUNDA_REST_ADDRESS is unset", () => {
+  const read = (name: string): string | null =>
+    name === "NANOBPMN_BASE_URL" ? "https://engine.example.com:9000" : null;
+  assertEquals(resolveConsoleOrigin(read), "https://engine.example.com:9000");
+});
+
+test("resolveConsoleOrigin derives the origin from NANOBPMN_BASE_URL", () => {
+  const read = (name: string): string | null =>
+    name === "NANOBPMN_BASE_URL" ? "https://engine.example.com:9000" : null;
+  assertEquals(resolveConsoleOrigin(read), "https://engine.example.com:9000");
+});
+
+test("resolveConsoleOrigin strips any path from the base", () => {
+  assertEquals(resolveConsoleOrigin(() => "https://engine.example.com/v2/"), "https://engine.example.com");
+});
+
+test("resolveConsoleOrigin defaults to localhost:8080 when unset", () => {
+  assertEquals(resolveConsoleOrigin(() => null), "http://localhost:8080");
+});
+
+test("resolveConsoleOrigin falls back to the default on an unparseable value", () => {
+  assertEquals(resolveConsoleOrigin(() => "not a url"), "http://localhost:8080");
+});
+
+/** Spin up a real server with an app handler, mount the redirect, and return a fetch helper. */
+async function withServer(
+  run: (base: string, teardown: () => void) => Promise<void>,
+): Promise<void> {
+  const server: Server = createServer((_req, res) => {
+    res.statusCode = 200;
+    res.setHeader("content-type", "text/plain");
+    res.end("app-handled");
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const teardown = mountConsoleRedirect(server, "http://console.example:8080");
+  const { port } = server.address() as AddressInfo;
+  try {
+    await run(`http://127.0.0.1:${port}`, teardown);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}
+
+test("mount: /console/* is answered with a 302 to the console origin, not the app handler", async () => {
+  await withServer(async (base) => {
+    const res = await fetch(`${base}/console/app-view/Workforce?tab=x`, { redirect: "manual" });
+    assertEquals(res.status, 302);
+    assertEquals(res.headers.get("location"), "http://console.example:8080/console/app-view/Workforce?tab=x");
+    // 302 body is empty — the app handler must not have run.
+    assertEquals(await res.text(), "");
+  });
+});
+
+test("mount: a non-console request is delegated to the app handler unchanged", async () => {
+  await withServer(async (base) => {
+    const res = await fetch(`${base}/app/api/agent`, { redirect: "manual" });
+    assertEquals(res.status, 200);
+    assertEquals(await res.text(), "app-handled");
+  });
+});
+
+test("mount: teardown restores the original app handler for /console too", async () => {
+  await withServer(async (base, teardown) => {
+    teardown();
+    const res = await fetch(`${base}/console/x`, { redirect: "manual" });
+    assertEquals(res.status, 200);
+    assert((await res.text()) === "app-handled");
+  });
+});

package/app/consoleRedirect.ts

@@ -0,0 +1,122 @@
+// Standalone `/console` → engine-console redirect (issue #771).
+//
+// When Nano Workforce runs **embedded** behind the nano console, the console origin serves
+// `/console/*` (its app-view host, `/console/app-view/Workforce/…`) and the reverse proxy strips the
+// `/console/app-view/Workforce` prefix before the app's own HTTP server ever sees the request — so
+// the app only ever handles `/app/*`, `/agentic`, and its page routes at the root.
+//
+// Run **standalone** (the default `npm start` on a bare port, no console proxy in front), links the
+// UI emits under `/console` — the engine console's own origin — hit this app's port instead, where
+// nothing serves them: the runtime answers a bare 503 because `/console/*` is not a registered
+// app-view route. This is a narrow Node request redirect that rewrites those `/console/*` requests to
+// the engine console origin, preserving the full path + query, and leaves every other route
+// (`/app/*`, `/agentic`, the Workforce page routes at the root) untouched — it only ever fires for a
+// path that is exactly `/console` or under `/console/`.
+//
+// The redirect is derived, not configured twice: the engine console shares the engine's origin, so
+// the target origin comes from the CANONICAL engine-address resolution (`resolveEngineAddress`,
+// `app/enginePreflight.ts`) — an explicit `CAMUNDA_REST_ADDRESS` wins over `NANOBPMN_BASE_URL`
+// (default `http://localhost:8080`), the same precedence and single source of truth the engine
+// client uses, so the redirect target can never drift from the engine the app actually talks to.
+// Mounting it when embedded is harmless: the proxy owns `/console` there, so the app's server never
+// sees such a path.
+
+import type { IncomingMessage, RequestListener, Server, ServerResponse } from "node:http";
+import { resolveEngineAddress } from "./enginePreflight.ts";
+import { envVar } from "./version.ts";
+
+/** A minimal logging surface (structurally a subset of `Logger`) the mount uses at boot. */
+export interface ConsoleRedirectLog {
+  info(msg: string): void;
+}
+
+/**
+ * The `Location` a `/console`-prefixed request should be redirected to, or `null` when the request
+ * is NOT a console route (and so must be left for the app's own handlers).
+ *
+ * Matches ONLY a path that is exactly `/console` or begins with `/console/` — a sibling route such
+ * as `/console-x` or `/app/console` is deliberately NOT matched, keeping the redirect narrow. The
+ * full original request target (path + query) is preserved by appending it verbatim to the console
+ * origin: because the request path already carries the `/console` prefix, the result is
+ * `<consoleOrigin>/console/<rest>?<query>`.
+ *
+ * @param url          the raw request target (`req.url`), e.g. `/console/app-view/Foo?tab=bar`.
+ * @param consoleOrigin the engine console origin (scheme + authority, no trailing slash), e.g.
+ *                      `http://localhost:8080`.
+ */
+export function consoleRedirectLocation(
+  url: string | undefined,
+  consoleOrigin: string,
+): string | null {
+  if (!url) return null;
+  const queryAt = url.indexOf("?");
+  const path = queryAt === -1 ? url : url.slice(0, queryAt);
+  if (path === "/console" || path.startsWith("/console/")) {
+    return `${consoleOrigin.replace(/\/+$/, "")}${url}`;
+  }
+  return null;
+}
+
+/**
+ * Resolve the engine console origin (scheme + authority) from the CANONICAL engine-address
+ * resolution (`resolveEngineAddress`, `app/enginePreflight.ts`). The engine console is served on the
+ * engine's own origin, so this reuses the single engine-base source of truth — including its
+ * precedence — rather than reading one input directly. That means an explicit `CAMUNDA_REST_ADDRESS`
+ * (already the `/v2` REST address) wins over `NANOBPMN_BASE_URL`, exactly as the engine client
+ * resolves it; the redirect target can never drift from the engine the app actually talks to. Only
+ * the origin is meaningful for the redirect, so any path/query on the resolved address (e.g. the
+ * `/v2` suffix) is discarded. Falls back to the localhost default when the resolved value is
+ * unparseable.
+ *
+ * `read` is injectable so resolution is testable without mutating `process.env`.
+ */
+export function resolveConsoleOrigin(read: (name: string) => string | null = envVar): string {
+  const { restAddress } = resolveEngineAddress(read);
+  try {
+    return new URL(restAddress).origin;
+  } catch {
+    return "http://localhost:8080";
+  }
+}
+
+/**
+ * Prepend a `/console` → engine-console redirect in front of `server`'s existing request handling.
+ *
+ * The runtime has already attached the app's own `request` listener(s) by the time this runs, so we
+ * capture them, remove them, and install a single wrapper that either answers a `/console/*` request
+ * with a `302` (preserving path + query) or delegates to every captured listener unchanged. This
+ * keeps the app's own routing (control API, pages, agentic upgrade) intact for every non-console
+ * request while giving the redirect first refusal on the console prefix.
+ *
+ * Returns a teardown that restores the original listener set.
+ */
+export function mountConsoleRedirect(
+  server: Server,
+  consoleOrigin: string,
+  log?: ConsoleRedirectLog,
+): () => void {
+  // `Server#listeners` is typed `Function[]` by Node; narrow to the request-listener signature so we
+  // can re-invoke and later restore them.
+  // biome-ignore lint/plugin: runtime/framework contract boundary for Node's untyped listeners()
+  const existing = server.listeners("request") as RequestListener[];
+  server.removeAllListeners("request");
+
+  const handler = (req: IncomingMessage, res: ServerResponse): void => {
+    const location = consoleRedirectLocation(req.url, consoleOrigin);
+    if (location !== null) {
+      res.statusCode = 302;
+      res.setHeader("Location", location);
+      res.end();
+      return;
+    }
+    for (const listener of existing) listener.call(server, req, res);
+  };
+
+  server.on("request", handler);
+  log?.info(`console redirect mounted: /console/* → ${consoleOrigin}/console/* (standalone links)`);
+
+  return () => {
+    server.removeListener("request", handler);
+    for (const listener of existing) server.on("request", listener);
+  };
+}

package/main.ts

@@ -21,6 +21,7 @@ import { Server } from "node:http";
 import { createNanoSdkEngineClient, runFromEnv, selectHost } from "@nanobpm/urban";
 import { type AgenticChannelHandle, mountAgenticChannel } from "./app/agentic/channel.ts";
 import { makeElementInstanceResolver } from "./app/agentic/element-instance.ts";
+import { mountConsoleRedirect, resolveConsoleOrigin } from "./app/consoleRedirect.ts";
 import { announceEngine, resolveEngineAddress } from "./app/enginePreflight.ts";
 import { runEngineReconcile } from "./app/reconcile.ts";
 import { MAX_ROUNDS, pollOnce } from "./app/service.ts";
@@ -103,6 +104,20 @@ if (httpServer instanceof Server) {
   app.log.warn("agentic channel not mounted: app.httpServer is not a node:http Server on this host");
 }
 
+// Standalone `/console` redirect (issue #771). Running behind the nano console, the console origin
+// serves `/console/*` and the reverse proxy strips its app-view prefix before the app ever sees a
+// request — but STANDALONE, the UI's `/console` links land on this app's own port, where nothing
+// serves them, so the runtime answers a bare 503. Mount a narrow request redirect that rewrites
+// `/console/*` to the engine console origin (derived from the CANONICAL engine-address resolution,
+// `resolveEngineAddress`, so an explicit `CAMUNDA_REST_ADDRESS` wins over `NANOBPMN_BASE_URL`),
+// preserving path + query, and leaves `/app/*`, `/agentic`, and the Workforce page routes untouched.
+// Mounted last so it captures every request listener the runtime + agentic channel attached, and
+// delegates each non-console request to them unchanged.
+let consoleRedirectTeardown: (() => void) | undefined;
+if (httpServer instanceof Server) {
+  consoleRedirectTeardown = mountConsoleRedirect(httpServer, resolveConsoleOrigin(), app.log);
+}
+
 // Engine-reset reconciliation (issues #622, #630). On boot, compare the engine's incarnation epoch
 // against the last-seen value; on a REGRESSION (the engine was reset/restored/rewound and re-minted
 // its keys, Magikcraft/nano-bpm#1065) drive every dangling engine-backed inflight row to the defined
@@ -153,6 +168,12 @@ async function drainAndExit(): Promise<void> {
   if (shuttingDown) return;
   shuttingDown = true;
   if (pollTimer) clearTimeout(pollTimer);
+  // Restore the original request listener set (drops the /console redirect wrapper).
+  if (consoleRedirectTeardown) {
+    try {
+      consoleRedirectTeardown();
+    } catch { /* best-effort redirect teardown */ }
+  }
   // Tear the agentic families + hub down (releases the WS clients) before the app stops its HTTP
   // server, which the channel shares.
   if (agentic) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.186.2",
+  "version": "0.186.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",