@rashidee/co2 1.3.10 → 1.3.12

package/plugin/skills/mockgen-tailwind/references/mockup-hub-template.md

@@ -19,6 +19,13 @@ they contain NO server of their own.
   `mockup.config.json` and re-listens on the new port. Compound Context Studio's Mockup
   page reads its own topbar port input and passes it via the `PORT` env when its
   **Start Hub** button spawns this server.
+- **Reverse-proxy aware** (v3): Compound Context Studio embeds the hub through its own
+  same-origin proxy (`/api/artifacts/mockup-proxy/<projectId>/`), which sends the mount
+  path in an `X-Forwarded-Prefix` header. The hub prefixes every redirect and rewrites
+  root-absolute URL attributes (`href`/`src`/`action`/`hx-*`) in the HTML it serves —
+  including per-app assets generated before v3 — so mockups work behind the studio (or
+  any prefix-forwarding reverse proxy) without exposing the hub's port separately.
+  Requests without the header behave exactly as before.
 
 The hub has **zero npm dependencies** — `npm start` (or `node server.js`) works with no
 `npm install`.
@@ -97,12 +104,15 @@ Example:
 #!/usr/bin/env node
 /*
  * CO2 Mockup Hub — one server for ALL application mockups.
- * HUB_VERSION: 2   (marker used by mockgen-* skills to decide upgrades — do not remove)
+ * HUB_VERSION: 3   (marker used by mockgen-* skills to decide upgrades — do not remove)
  *
  * Discovers every root-level application folder containing context/PRD.md.
  * Apps with a context/mockup/mockup-manifest.json are routable:
  *   - stack "tailwind": pages assembled from partials + content fragments
  *   - stack "shadcn":  served from the built dist/ folder (SPA fallback)
+ * Reverse proxy: when a request carries X-Forwarded-Prefix (Compound Context Studio's
+ *   same-origin proxy sends it), redirects are prefixed and root-absolute URL
+ *   attributes in served HTML are rewritten under the prefix.
  * Port: PORT env var > mockup.config.json "port" > first unused port from 4000.
  *   - A PORT env value is exact (Compound Context Studio's Start Hub passes it) — a busy
  *     port fails fast so the caller sees the error.
@@ -118,10 +128,11 @@ const net = require('net');
 const fs = require('fs');
 const path = require('path');
 
-const HUB_VERSION = 2;
+const HUB_VERSION = 3;
 const HUB_DIR = __dirname;
 const ROOT_DIR = path.resolve(HUB_DIR, '..');
 const SAFE_SEG = /^[A-Za-z0-9._-]+$/;
+const SAFE_PREFIX = /^\/[A-Za-z0-9/_-]*$/; // root-relative, no dots/query/fragment
 const PORT_SCAN_START = 4000; // default: first unused port starting here
 const PORT_SCAN_LIMIT = 100;
 
@@ -229,11 +240,39 @@ function findApp(slug) {
 
 // ── Response helpers ─────────────────────────────────────────────────────────
 
+/** The sanitized X-Forwarded-Prefix ('' when absent/unsafe), without trailing slash. */
+function requestPrefix(req) {
+  var raw = String(req.headers['x-forwarded-prefix'] || '');
+  if (raw.endsWith('/')) raw = raw.slice(0, -1);
+  return SAFE_PREFIX.test(raw) ? raw : '';
+}
+
+/**
+ * Rewrite root-absolute URL attributes so they stay under the proxy prefix. Covers hub
+ * pages AND per-app assets (tailwind partials/content with hx-* attributes, shadcn dist
+ * index.html, MOCKUP.html, reports) — including assets generated before hub v3.
+ */
+function applyPrefix(html, prefix) {
+  if (!prefix) return html;
+  return html.replace(
+    /(href|src|action|hx-get|hx-post|hx-put|hx-patch|hx-delete)="\//g,
+    '$1="' + prefix + '/'
+  );
+}
+
 function send(res, code, body, type) {
   res.writeHead(code, { 'Content-Type': type || 'text/html; charset=utf-8' });
   res.end(body);
 }
 
+/** All HTML goes out through this so root-absolute links are prefix-rewritten. The
+ *  X-Hub-Prefix header tells the studio proxy the hub already rewrote its HTML, so the
+ *  proxy skips its own legacy-hub rewrite pass (no double-prefixing). */
+function sendHtml(res, code, html, prefix) {
+  if (prefix) res.setHeader('X-Hub-Prefix', prefix);
+  send(res, code, applyPrefix(html, prefix), 'text/html; charset=utf-8');
+}
+
 function redirect(res, location) {
   res.writeHead(302, { Location: location });
   res.end();
@@ -252,12 +291,18 @@ function safeJoin(baseDir, segments) {
   return target;
 }
 
-function serveFile(res, filePath) {
+function serveFile(res, filePath, prefix) {
   if (!filePath) return false;
   let stat;
   try { stat = fs.statSync(filePath); } catch (err) { return false; }
   if (!stat.isFile()) return false;
-  const type = MIME[path.extname(filePath).toLowerCase()] || 'application/octet-stream';
+  const ext = path.extname(filePath).toLowerCase();
+  const type = MIME[ext] || 'application/octet-stream';
+  // HTML files (MOCKUP.html, shadcn dist index.html, reports) get prefix-rewritten.
+  if (ext === '.html' && prefix) {
+    sendHtml(res, 200, fs.readFileSync(filePath, 'utf8'), prefix);
+    return true;
+  }
   send(res, 200, fs.readFileSync(filePath), type);
   return true;
 }
@@ -340,7 +385,9 @@ function renderAppCard(app) {
 
 // Port input (default: the current port — auto-picked as the first unused port from 4000
 // when nothing was configured). Apply persists to mockup.config.json via POST /api/port
-// and the hub re-listens on the new port; the page then follows it.
+// and the hub re-listens on the new port; the page then follows it. Behind a proxy
+// (HUB_PREFIX set) the page reloads the prefix root instead — the studio proxy reads
+// the new port from mockup.config.json, so the same URL keeps working.
 const PORT_SCRIPT = `
   function applyPort() {
     var msg = document.getElementById('port-msg');
@@ -349,25 +396,28 @@ const PORT_SCRIPT = `
       msg.style.color = '#dc2626'; msg.textContent = 'Port must be 1024-65535'; return;
     }
     msg.style.color = '#64748b'; msg.textContent = 'Applying\\u2026';
-    fetch('/api/port', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+    fetch(HUB_PREFIX + '/api/port', { method: 'POST', headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ port: port }) })
       .then(function (r) { return r.json(); })
       .then(function (res) {
         if (!res.ok) { msg.style.color = '#dc2626'; msg.textContent = res.error || 'Failed'; return; }
         msg.textContent = 'Restarting on port ' + res.port + '\\u2026';
         setTimeout(function () {
-          location.href = location.protocol + '//' + location.hostname + ':' + res.port + '/';
+          location.href = HUB_PREFIX
+            ? HUB_PREFIX + '/'
+            : location.protocol + '//' + location.hostname + ':' + res.port + '/';
         }, 700);
       })
       .catch(function () { msg.style.color = '#dc2626'; msg.textContent = 'Request failed'; });
   }
 `;
 
-function renderLanding(apps, currentPort) {
+function renderLanding(apps, currentPort, prefix) {
   return '<!DOCTYPE html>\n<html lang="en">\n<head>\n<meta charset="UTF-8">\n'
     + '<meta name="viewport" content="width=device-width, initial-scale=1.0">\n'
     + '<title>Mockup Hub</title>\n<style>' + LANDING_CSS + '</style>\n'
-    + '<script>' + PORT_SCRIPT + '</script>\n</head>\n<body>\n'
+    // prefix is SAFE_PREFIX-sanitized, so it embeds safely in the inline script.
+    + '<script>var HUB_PREFIX = "' + (prefix || '') + '";' + PORT_SCRIPT + '</script>\n</head>\n<body>\n'
     + '<div class="wrap">\n<h1>Mockup Hub</h1>\n'
     + '<p class="sub">All application mockups, served from one place. '
     + apps.length + ' application(s) discovered. Click a role to open its dashboard.</p>\n'
@@ -378,8 +428,8 @@ function renderLanding(apps, currentPort) {
     + '<span id="port-msg"></span></span></p>\n</div>\n</body>\n</html>';
 }
 
-function notReadyPage(app) {
-  return renderLanding([app], CURRENT_PORT);
+function notReadyPage(app, prefix) {
+  return renderLanding([app], CURRENT_PORT, prefix);
 }
 
 function notFoundPage(what) {
@@ -410,45 +460,46 @@ function assemblePage(app, role, page) {
 
 // ── Routing ──────────────────────────────────────────────────────────────────
 
-function routeTailwind(app, segs, res) {
+function routeTailwind(app, segs, res, prefix) {
   if (segs.length === 1) {
-    if (serveFile(res, path.join(app.mockupDir, 'MOCKUP.html'))) return;
+    if (serveFile(res, path.join(app.mockupDir, 'MOCKUP.html'), prefix)) return;
     const first = app.roles.find((r) => r.slug);
-    if (first) return redirect(res, '/' + app.slug + '/' + first.slug + '/home');
-    return send(res, 404, notFoundPage(app.slug));
+    if (first) return redirect(res, prefix + '/' + app.slug + '/' + first.slug + '/home');
+    return sendHtml(res, 404, notFoundPage(app.slug), prefix);
   }
   if (segs[1] === 'static' || segs[1] === 'reports') {
     const file = safeJoin(path.join(app.mockupDir, segs[1]), segs.slice(2));
-    if (serveFile(res, file)) return;
-    return send(res, 404, notFoundPage());
+    if (serveFile(res, file, prefix)) return;
+    return sendHtml(res, 404, notFoundPage(), prefix);
   }
-  if (!SAFE_SEG.test(segs[1])) return send(res, 400, notFoundPage());
-  if (segs.length === 2) return redirect(res, '/' + app.slug + '/' + segs[1] + '/home');
+  if (!SAFE_SEG.test(segs[1])) return sendHtml(res, 400, notFoundPage(), prefix);
+  if (segs.length === 2) return redirect(res, prefix + '/' + app.slug + '/' + segs[1] + '/home');
   if (segs.length === 3 && SAFE_SEG.test(segs[2])) {
     const html = assemblePage(app, segs[1], segs[2]);
     if (html === null) {
       return send(res, 500, '<h1>Missing partials. Re-run the mockup generator.</h1>');
     }
-    return send(res, 200, html);
+    return sendHtml(res, 200, html, prefix);
   }
-  return send(res, 404, notFoundPage());
+  return sendHtml(res, 404, notFoundPage(), prefix);
 }
 
-function routeShadcn(app, segs, res) {
-  if (segs.length === 1 && serveFile(res, path.join(app.mockupDir, 'MOCKUP.html'))) return;
+function routeShadcn(app, segs, res, prefix) {
+  if (segs.length === 1 && serveFile(res, path.join(app.mockupDir, 'MOCKUP.html'), prefix)) return;
   if (segs[1] === 'reports') {
     const file = safeJoin(path.join(app.mockupDir, 'public', 'reports'), segs.slice(2));
-    if (serveFile(res, file)) return;
-    return send(res, 404, notFoundPage());
+    if (serveFile(res, file, prefix)) return;
+    return sendHtml(res, 404, notFoundPage(), prefix);
   }
   const distDir = path.join(app.mockupDir, 'dist');
   if (segs.length > 1) {
     const file = safeJoin(distDir, segs.slice(1));
-    if (serveFile(res, file)) return;
+    if (serveFile(res, file, prefix)) return;
   }
-  // SPA fallback — React Router (basename /{app_slug}) handles the path client-side
-  if (serveFile(res, path.join(distDir, 'index.html'))) return;
-  return send(res, 404, notFoundPage(app.slug));
+  // SPA fallback — React Router handles the path client-side (the app derives its
+  // basename from the current URL, so it also works under a proxy prefix)
+  if (serveFile(res, path.join(distDir, 'index.html'), prefix)) return;
+  return sendHtml(res, 404, notFoundPage(app.slug), prefix);
 }
 
 // POST /api/port — persist a new port (from the landing page's port input) and re-listen.
@@ -473,8 +524,11 @@ function handlePortUpdate(req, res) {
 function route(req, res) {
   const urlPath = decodeURIComponent((req.url || '/').split('?')[0]);
   const segs = urlPath.split('/').filter(Boolean);
+  const prefix = requestPrefix(req); // '' unless behind a prefix-forwarding proxy
 
-  if (segs.length === 0) return send(res, 200, renderLanding(discoverApps(), CURRENT_PORT));
+  if (segs.length === 0) {
+    return sendHtml(res, 200, renderLanding(discoverApps(), CURRENT_PORT, prefix), prefix);
+  }
   if (urlPath === '/favicon.ico') { res.writeHead(204); return res.end(); }
 
   if (segs[0] === 'api' && segs[1] === 'port' && segs.length === 2 && req.method === 'POST') {
@@ -483,26 +537,28 @@ function route(req, res) {
 
   // HTMX fragment endpoint (tailwind): /api/content/:app/:role/:page
   if (segs[0] === 'api' && segs[1] === 'content') {
-    if (segs.length !== 5) return send(res, 404, notFoundPage());
+    if (segs.length !== 5) return sendHtml(res, 404, notFoundPage(), prefix);
     const app = findApp(segs[2]);
     if (!app || app.status !== 'ready' || app.stack !== 'tailwind') {
-      return send(res, 404, notFoundPage(segs[2]));
+      return sendHtml(res, 404, notFoundPage(segs[2]), prefix);
+    }
+    if (!SAFE_SEG.test(segs[3]) || !SAFE_SEG.test(segs[4])) {
+      return sendHtml(res, 400, notFoundPage(), prefix);
     }
-    if (!SAFE_SEG.test(segs[3]) || !SAFE_SEG.test(segs[4])) return send(res, 400, notFoundPage());
     const content = readText(path.join(app.mockupDir, segs[3], 'content', segs[4] + '.html'));
     if (content === null) {
       return send(res, 404, '<div class="p-6 text-red-500">Content not found.</div>');
     }
-    return send(res, 200, content);
+    return sendHtml(res, 200, content, prefix);
   }
 
-  if (!SAFE_SEG.test(segs[0])) return send(res, 400, notFoundPage());
+  if (!SAFE_SEG.test(segs[0])) return sendHtml(res, 400, notFoundPage(), prefix);
   const app = findApp(segs[0]);
-  if (!app) return send(res, 404, notFoundPage(segs[0]));
-  if (app.status !== 'ready') return send(res, 200, notReadyPage(app));
+  if (!app) return sendHtml(res, 404, notFoundPage(segs[0]), prefix);
+  if (app.status !== 'ready') return sendHtml(res, 200, notReadyPage(app, prefix), prefix);
 
-  if (app.stack === 'shadcn') return routeShadcn(app, segs, res);
-  return routeTailwind(app, segs, res);
+  if (app.stack === 'shadcn') return routeShadcn(app, segs, res, prefix);
+  return routeTailwind(app, segs, res, prefix);
 }
 
 // ── Start ────────────────────────────────────────────────────────────────────
@@ -627,5 +683,7 @@ Mockup Hub
 3. Open http://localhost:4000 in your browser
    (the hub picks the first unused port from 4000; the exact URL is printed on start.
     Change port: the landing page's Port input, PORT=4100 npm start, or edit
-    mockup.config.json — or use Compound Context Studio's Mockup page Start/Stop Hub.)
+    mockup.config.json — or use Compound Context Studio's Mockup page Start/Stop Hub.
+    Inside the studio the hub is embedded through its same-origin proxy — no need to
+    expose this port when the studio itself is reachable.)
 ```

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -21,8 +21,12 @@ description: >
   copy, docker run or kubectl apply, or none). Controls are disabled for any application that
   has never completed a conductor-develop workflow run (checked against the studio's
   /api/cicd-guard endpoint using the spawn-env token). Health/port probing marks apps already
-  running — even ones started outside this app. No version selector: only the latest built
-  applications are operated. When the approved plan declares an `## Infrastructure` list, the
+  running — even ones started outside this app. The top bar carries a version selector (fed by
+  the studio guard's versions, latest preselected) whose choice replaces the {VERSION} token in
+  commands — docker images are tagged <repo>/<app>:<version> when the plan's Docker section is
+  active (managed Dockerfiles materialized before Build when missing; Build never pushes) — and
+  Build All / Start All / Stop All buttons operating every eligible application at once
+  (sequential builds). When the approved plan declares an `## Infrastructure` list, the
   main page shows an "Infrastructure" link that opens a separate status-only page listing every
   supporting 3rd-party service with a live TCP-reachability indicator and a console link. Writes cicd/CICD_GENERATION.md with `**Status**:` IN PROGRESS →
   COMPLETED so the studio watcher detects completion. Idempotent — re-running regenerates
@@ -62,9 +66,17 @@ Write `cicd/CICD_GENERATION.md`:
 Read `references/cicd-app-template.md` for the complete file templates. Produce:
 
 1. `cicd/app/cicd.config.json` — from the plan's tables:
-   `{ "port": <CI/CD app port>, "apps": [{ "name", "folder", "method", "port", "build",
-   "start", "stop", "deployMethod", "deploy", "health", "configs" }], "infra": [{ "id", "name",
-   "host", "port", "url", "description" }] }` — `deployMethod` is the plan's Deploy Method column
+   `{ "port": <CI/CD app port>, "docker": { "registry" } | null, "apps": [{ "name", "folder",
+   "method", "port", "build", "start", "stop", "deployMethod", "deploy", "health", "image",
+   "dockerfile", "configs" }], "infra": [{ "id", "name",
+   "host", "port", "url", "description" }] }` — `docker.registry` comes from the plan's
+   `## Docker` section (`null` when the plan says not dockerized); per-app `image` is that
+   section's Image column (`null` for non-dockerized apps) and `dockerfile` is
+   `{ "path": "Dockerfile", "content": "<body>" }` for a `managed` Dockerfile from the plan's
+   `## Dockerfiles` section, or `{ "path": "Dockerfile", "content": null }` for an `existing`
+   one (`null` entirely when the app has no image). Copy managed Dockerfile bodies verbatim.
+   Commands may carry the literal `{VERSION}` token — copy it verbatim; the generated app
+   substitutes it at execution. `deployMethod` is the plan's Deploy Method column
    (`none|web-server|docker|kubernetes`) and `deploy` its command (`null` when the method is
    `none`). The `infra` array comes from the plan's `## Infrastructure` table (one entry per
    row); `url` is `null` when the Console URL cell is `-`. Emit `"infra": []` when the plan's
@@ -104,11 +116,25 @@ port, application count) and STOP — the studio starts/embeds the app.
   3rd-party services, each with a live TCP-reachability dot (polled) and a console link when a
   `url` is set. Infrastructure is never built/started/stopped/deployed (no lifecycle controls,
   no develop gate); the link is hidden when `infra` is empty.
-- Build/Start/Stop/Deploy run the plan's commands verbatim, each with the APPLICATION FOLDER
+- Build/Start/Stop/Deploy run the plan's commands, each with the APPLICATION FOLDER
   (`<project>/<folder>`) as working directory — command paths are relative to the application
   folder (e.g. `java -jar target\app.jar`), never to the project root. Deploy renders only
-  when the plan assigned a deploy method other than `none`. No version selector — only the
-  latest built applications are operated.
+  when the plan assigned a deploy method other than `none`.
+- **Version selector (topbar)**: the page's top bar carries a version dropdown fed by the
+  studio guard response's `versions` array (already polled every 30 s; latest first —
+  preselected). When the studio is unreachable the selector holds a single `latest` entry.
+  The selected semver, minus its `v` prefix, replaces every literal `{VERSION}` in
+  build/start/stop/deploy commands at execution time (fallback `latest`). Tag-only
+  semantics: the code built is always the working tree — the selector never checks out code.
+- **Dockerfile materialization**: before Build, when an app's `dockerfile.content` is set and
+  no file exists at its path in the application folder, the server writes it (never
+  overwriting an existing Dockerfile — mirror of the managed-config rule). Build never
+  pushes an image; pushing belongs to a `docker` deploy command.
+- **All-apps controls**: the top bar carries **Build All**, **Start All** and **Stop All**
+  buttons. Build All builds eligible apps SEQUENTIALLY (one at a time — honest logs, no CPU
+  storm); Start All starts every eligible stopped app; Stop All stops every running app.
+  Eligible = develop-gate not failed, not busy, and (for build/start) not already running;
+  ineligible apps are skipped silently — per-tab badges show progress.
 - Develop gate: controls stay disabled for an application that never completed a
   conductor-develop run — checked via `${CO2_STUDIO_URL}/api/cicd-guard/${CO2_PROJECT_ID}`
   with the CO2_GUARD_TOKEN from the spawn env (refreshed every 30 s, last answer cached).