@norskvideo/ctl-test-harness 0.1.52 → 0.1.54

package/daemon.d.ts

@@ -42,6 +42,20 @@ export interface StartDaemonOptions {
     seedConfig?: boolean;
     readyTimeoutMs?: number;
 }
+/** Root the instance working directory under the store dir (itself under
+ *  TEST_TMP_BASE) rather than the daemon default ~/norsk-runtime. The launcher
+ *  bind-mounts the workdir as /data and then mounts the stored template's
+ *  workflow.yml (which lives under the store dir) *inside* it — Docker Desktop
+ *  rejects a nested bind mount whose inner source resolves to a different host
+ *  share-root than the outer, so both mounts must share the TEST_TMP_BASE root.
+ *  With NORSK_CTL_STORE_DIR set, config.yaml is read from <storeDir>/config.yaml.
+ *  networkMode is the one required config.yaml field — omitting it makes the
+ *  whole file fail to parse (ConfigParseError), silently dropping the workdir
+ *  override. Seed both.
+ *
+ *  A suite that writes its own config.yaml (to pick a networkMode, a proxy
+ *  port) still gets the working directory added, unless it states one. */
+export declare function seedDaemonConfig(storeDir: string): void;
 export declare function startDaemon(storeDir: string, options?: StartDaemonOptions): {
     daemon: DaemonProcess;
     ready: Promise<void>;

package/daemon.js

@@ -8,7 +8,7 @@
 // works under bun AND under Playwright's Node workers — so the doc-guide tier
 // consumes these same bodies instead of keeping a third fork.
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { join } from "node:path";
 import { cliCommand } from "./cli-command.js";
@@ -118,30 +118,47 @@ function daemonHandle(proc) {
         exited,
     };
 }
+/** Root the instance working directory under the store dir (itself under
+ *  TEST_TMP_BASE) rather than the daemon default ~/norsk-runtime. The launcher
+ *  bind-mounts the workdir as /data and then mounts the stored template's
+ *  workflow.yml (which lives under the store dir) *inside* it — Docker Desktop
+ *  rejects a nested bind mount whose inner source resolves to a different host
+ *  share-root than the outer, so both mounts must share the TEST_TMP_BASE root.
+ *  With NORSK_CTL_STORE_DIR set, config.yaml is read from <storeDir>/config.yaml.
+ *  networkMode is the one required config.yaml field — omitting it makes the
+ *  whole file fail to parse (ConfigParseError), silently dropping the workdir
+ *  override. Seed both.
+ *
+ *  A suite that writes its own config.yaml (to pick a networkMode, a proxy
+ *  port) still gets the working directory added, unless it states one. */
+export function seedDaemonConfig(storeDir) {
+    const configPath = join(storeDir, "config.yaml");
+    const workdirLine = `defaultWorkingDirectory: ${JSON.stringify(join(storeDir, "norsk-runtime"))}\n`;
+    if (!existsSync(configPath)) {
+        writeFileSync(configPath, `networkMode: docker\n${workdirLine}`);
+        return;
+    }
+    const existing = readFileSync(configPath, "utf-8");
+    if (/^defaultWorkingDirectory\s*:/m.test(existing))
+        return;
+    const separator = existing === "" || existing.endsWith("\n") ? "" : "\n";
+    writeFileSync(configPath, `${existing}${separator}${workdirLine}`);
+}
 export function startDaemon(storeDir, options) {
     const port = options?.port ?? 8333;
     killProcessOnPort(port);
-    if (options?.seedConfig !== false) {
-        // Root the instance working directory under the store dir (itself under
-        // TEST_TMP_BASE) rather than the daemon default ~/norsk-runtime. The launcher
-        // bind-mounts the workdir as /data and then mounts the stored template's
-        // workflow.yml (which lives under the store dir) *inside* it — Docker Desktop
-        // rejects a nested bind mount whose inner source resolves to a different host
-        // share-root than the outer, so both mounts must share the TEST_TMP_BASE root.
-        // With NORSK_CTL_STORE_DIR set, config.yaml is read from <storeDir>/config.yaml.
-        // networkMode is the one required config.yaml field — omitting it makes the
-        // whole file fail to parse (ConfigParseError), silently dropping the workdir
-        // override. Seed both.
-        const configPath = join(storeDir, "config.yaml");
-        if (!existsSync(configPath)) {
-            writeFileSync(configPath, `networkMode: docker\ndefaultWorkingDirectory: ${JSON.stringify(join(storeDir, "norsk-runtime"))}\n`);
-        }
-    }
+    if (options?.seedConfig !== false)
+        seedDaemonConfig(storeDir);
     const [cmd, ...cmdArgs] = cliCommand;
+    // A spawned daemon must boot GUARDED: exercising the real ingress secret is
+    // the point of the tiers that spawn one. The unit tier's marker would
+    // otherwise be inherited straight through this env spread and quietly open
+    // it (RFC 0003 D10b).
+    const { NORSK_CTL_UNGUARDED_TEST_DAEMON: _unguarded, ...inheritedEnv } = process.env;
     const proc = spawn(cmd, [...cmdArgs, "serve"], {
         stdio: "inherit",
         detached: options?.detached === true,
-        env: { ...process.env, NORSK_CTL_STORE_DIR: storeDir, NORSK_CTL_PORT: String(port), ...options?.env },
+        env: { ...inheritedEnv, NORSK_CTL_STORE_DIR: storeDir, NORSK_CTL_PORT: String(port), ...options?.env },
     });
     const spawnFailed = new Promise((_, reject) => {
         proc.once("error", (e) => reject(new Error(cliUnavailableMessage(cliCommand, e.message))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "type": "module",
   "exports": {
     ".": {
@@ -74,6 +74,13 @@
     "@norskvideo/norsk-studio": "*",
     "@norskvideo/norsk-studio-built-ins": "*"
   },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/node": "^22.10.0",
+    "@norskvideo/norsk-studio": "1.29.0-2026-09-10-b21d9013",
+    "@norskvideo/norsk-studio-built-ins": "1.29.0-2026-09-10-b21d9013",
+    "@norskvideo/norsk-sdk": "1.3.0-2026-09-17-3b73a790"
+  },
   "peerDependenciesMeta": {
     "@norskvideo/norsk-studio": {
       "optional": true

package/source-pump.d.ts

@@ -36,10 +36,15 @@ export interface StartCameraSourceOptions {
      *  (kept even when the fallback is used, so the handle is stable). Required
      *  when the same asset must run multiple times within an instance. */
     name?: string;
-    /** Sent as `x-norsk-proxy`; needed when the daemon sits behind the oauth2
-     *  proxy, which 307s `/api/*` without it. The daemon writes it to
-     *  `<stateDir>/proxy-secret` (`<storeDir>/proxy-secret` under
-     *  NORSK_CTL_STORE_DIR). */
+    /** Sent as `x-norsk-proxy`. **Effectively required.** The daemon writes it
+     *  to `<stateDir>/proxy-secret` (`<storeDir>/proxy-secret` under
+     *  NORSK_CTL_STORE_DIR); read it from there and pass it.
+     *
+     *  BREAKING for callers that omitted it (RFC 0003 D10b, ctl >= this
+     *  release): the daemon used to admit any loopback caller without a secret
+     *  while TLS was off, and that bypass is gone — a loopback caller is a host
+     *  admin, and a host admin can read the secret file. A harness or guide that
+     *  relied on it now fails with `POST /api/sources failed (307)`. */
     proxySecret?: string;
     timeoutMs?: number;
     /** Test seams. */

package/source-pump.js

@@ -10,6 +10,10 @@
 // `name` overrides the source identity (container name + management key) so
 // multiple sources on the same asset can co-exist within one instance. See
 // `startSrtSources` for the multi-port fan-out helper that uses it.
+//
+// PASS `proxySecret`. RFC 0003 D10b removed the daemon's loopback bypass, so
+// a call without it now 307s where it used to be admitted. See the field's
+// docblock for where to read the secret from.
 import { existsSync } from "node:fs";
 import { basename, extname } from "node:path";
 import { pollUntil } from "./poll.js";