@rashidee/co2 1.3.17 → 1.3.19

package/dist/index.js

@@ -6809,7 +6809,7 @@ var {
 // package.json
 var package_default = {
   name: "@rashidee/co2",
-  version: "1.3.17",
+  version: "1.3.19",
   description: "Compound Context Studio \u2014 self-hosted team context authoring for CO2 projects",
   type: "module",
   license: "MIT",
@@ -21875,6 +21875,7 @@ import { spawn as spawn2 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { request as httpRequest2 } from "http";
+import { createServer as createNetServer } from "net";
 import { join as join9 } from "path";
 function svcError6(code, status) {
   return Object.assign(new Error(code), { code, status });
@@ -21896,8 +21897,22 @@ process.once("SIGINT", () => {
   killSpawnedApps();
   process.exit(130);
 });
-function cicdGuardTokenValid(projectId, token) {
-  return !!token && guardTokens.get(projectId) === token;
+function persistGuardToken(db, projectId, token) {
+  try {
+    db.update(cicdSetups).set({ guardToken: token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
+  } catch {
+  }
+}
+function cicdGuardTokenValid(db, projectId, token) {
+  if (!token) return false;
+  const mem = guardTokens.get(projectId);
+  if (mem !== void 0) return mem === token;
+  const row = db.select({ t: cicdSetups.guardToken }).from(cicdSetups).where(eq(cicdSetups.projectId, projectId)).get();
+  if (row?.t) {
+    guardTokens.set(projectId, row.t);
+    return row.t === token;
+  }
+  return false;
 }
 function resolveCicdApp(db, workspacePath, projectId) {
   const project = db.select().from(projects).where(eq(projects.id, projectId)).get();
@@ -21930,6 +21945,49 @@ function probeApp(port, timeoutMs = 1e3) {
     req.end();
   });
 }
+function portFree(port) {
+  return new Promise((resolve5) => {
+    const srv = createNetServer();
+    srv.once("error", () => resolve5(false));
+    srv.once("listening", () => srv.close(() => resolve5(true)));
+    srv.listen(port, "127.0.0.1");
+  });
+}
+function ephemeralPort() {
+  return new Promise((resolve5) => {
+    const srv = createNetServer();
+    srv.once("error", () => resolve5(0));
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const p = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => resolve5(p));
+    });
+  });
+}
+async function pickFreePort(preferred, avoid) {
+  if (preferred && preferred !== avoid && await portFree(preferred)) return preferred;
+  for (let i = 0; i < 20; i++) {
+    const p = await ephemeralPort();
+    if (p && p !== avoid) return p;
+  }
+  return preferred || DEFAULT_CICD_APP_PORT;
+}
+function persistConfigPort(location, newPort) {
+  if (newPort === location.port) return;
+  const configPath = join9(location.appDir, "cicd.config.json");
+  let config = {};
+  try {
+    config = JSON.parse(readFileSync6(configPath, "utf8"));
+  } catch {
+  }
+  config.port = newPort;
+  try {
+    writeFileSync5(configPath, `${JSON.stringify(config, null, 2)}
+`);
+  } catch {
+  }
+  location.port = newPort;
+}
 function toStatus2(location, running, projectId) {
   return {
     present: location.present,
@@ -21948,26 +22006,13 @@ async function getCicdAppStatus(db, workspacePath, projectId) {
 async function startCicdApp(db, workspacePath, projectId, studioPort, port) {
   const location = resolveCicdApp(db, workspacePath, projectId);
   if (!location.present) throw svcError6("CICD_APP_MISSING", 404);
-  const targetPort = port ?? location.port;
-  if (targetPort !== location.port) {
-    const configPath = join9(location.appDir, "cicd.config.json");
-    let config = {};
-    try {
-      config = JSON.parse(readFileSync6(configPath, "utf8"));
-    } catch {
-    }
-    config.port = targetPort;
-    try {
-      writeFileSync5(configPath, `${JSON.stringify(config, null, 2)}
-`);
-    } catch {
-    }
-    location.port = targetPort;
-  }
-  if (await probeApp(targetPort)) {
-    location.port = targetPort;
+  const savedPort = port ?? location.port;
+  if (await probeApp(savedPort)) {
+    persistConfigPort(location, savedPort);
     return toStatus2(location, true, projectId);
   }
+  const targetPort = port !== void 0 ? port : await pickFreePort(savedPort, studioPort);
+  persistConfigPort(location, targetPort);
   const existing = spawnedApps.get(projectId);
   if (existing && existing.exitCode === null) {
     try {
@@ -21993,20 +22038,22 @@ async function startCicdApp(db, workspacePath, projectId, studioPort, port) {
   child.on("error", () => {
     spawnedApps.delete(projectId);
     guardTokens.delete(projectId);
+    persistGuardToken(db, projectId, null);
   });
   child.on("exit", () => {
     spawnedApps.delete(projectId);
     guardTokens.delete(projectId);
+    persistGuardToken(db, projectId, null);
   });
   spawnedApps.set(projectId, child);
-  db.update(cicdSetups).set({ appPort: location.port, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
+  db.update(cicdSetups).set({ appPort: location.port, guardToken: token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
   for (let attempt = 0; attempt < 20; attempt++) {
     if (await probeApp(location.port, 500)) return toStatus2(location, true, projectId);
     await new Promise((r) => setTimeout(r, 250));
   }
   return toStatus2(location, false, projectId);
 }
-function stopCicdApp(projectId) {
+function stopCicdApp(db, projectId) {
   const child = spawnedApps.get(projectId);
   if (!child) return false;
   try {
@@ -22015,6 +22062,7 @@ function stopCicdApp(projectId) {
   }
   spawnedApps.delete(projectId);
   guardTokens.delete(projectId);
+  persistGuardToken(db, projectId, null);
   return true;
 }
 
@@ -22701,6 +22749,7 @@ function pollCicdTracking(db, workspacePath, setupId, kind, notifyUserId) {
       relatedEntityType: "cicd_setup",
       relatedEntityId: setupId
     });
+    stopCicdApp(db, setup.projectId);
     try {
       runProjectGit(
         projectDir2,
@@ -22854,7 +22903,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
     const user = c.get("user");
     try {
       const result = requestPlan(db, workspacePath, projectId, user.id);
-      stopCicdApp(projectId);
+      stopCicdApp(db, projectId);
       return c.json(result, 201);
     } catch (e) {
       return errorResponse3(c, e);
@@ -22910,7 +22959,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
     const projectId = parseProjectId(c);
     if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);
     try {
-      stopCicdApp(projectId);
+      stopCicdApp(db, projectId);
       return c.json(await getCicdAppStatus(db, workspacePath, projectId));
     } catch (e) {
       return errorResponse3(c, e);
@@ -22943,7 +22992,7 @@ function cicdGuardRoutes(db, workspacePath) {
     if (Number.isNaN(projectId)) return c.json({ code: "INVALID_ID" }, 400);
     const bearer = c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
     const token = c.req.query("token") ?? bearer;
-    if (!cicdGuardTokenValid(projectId, token) && !c.get("user")) {
+    if (!cicdGuardTokenValid(db, projectId, token) && !c.get("user")) {
       return c.json({ code: "UNAUTHORIZED" }, 401);
     }
     const rawVersion = c.req.query("versionId");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rashidee/co2",
-  "version": "1.3.17",
+  "version": "1.3.19",
   "description": "Compound Context Studio — self-hosted team context authoring for CO2 projects",
   "type": "module",
   "license": "MIT",

package/plugin/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "co2-skills",
       "source": "./",
       "description": "Compound Context Skills — generates data models, HTML mockups, technical specifications, test specifications, and orchestrates full-stack development from Agile user stories.",
-      "version": "1.7.0",
+      "version": "1.8.2",
       "author": {
         "name": "Rashidee M.Rashid"
       },

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "co2-skills",
-  "version": "1.7.0",
+  "version": "1.8.2",
   "description": "Compound Context Skills — an opinionated context engineering methodology for AI-driven software development. Generates data models, HTML mockups, technical specifications, test specifications, and orchestrates full-stack development from Agile user stories.",
   "author": {
     "name": "Rashidee M.Rashid"

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -21,12 +21,12 @@ description: >
   copy, docker run or kubectl apply, or none). Controls are disabled for any application that
   has never completed a conductor-develop workflow run (checked against the studio's
   /api/cicd-guard endpoint using the spawn-env token). Health/port probing marks apps already
-  running — even ones started outside this app. There is NO version selector — every control
-  operates on the current working tree, and the {VERSION} token in commands auto-resolves to
-  the project's current version (studio guard's latest semver, fallback `latest`) — docker
-  images are tagged <repo>/<app>:<version> when the plan's Docker section is active (managed
-  Dockerfiles materialized before Build when missing; Build never pushes) — and Build All /
-  Start All / Stop All buttons operate every eligible application at once (sequential builds). When the approved plan declares an `## Infrastructure` list, the
+  running — even ones started outside this app. There is NO version selector and there are NO
+  Build All / Start All / Stop All buttons — every control operates per application on the
+  current working tree, and the plan's commands run verbatim (no {VERSION} or other token
+  substitution) — docker images are tagged <repo>/<app>:latest when the plan's Docker section
+  is active (managed Dockerfiles materialized before Build when missing; Build never
+  pushes). When the approved plan declares an `## Infrastructure` list, the
   main page shows an "Infrastructure" link that opens a separate status-only page listing every
   supporting 3rd-party service with a live TCP-reachability indicator and a console link. Writes cicd/CICD_GENERATION.md with `**Status**:` IN PROGRESS →
   COMPLETED so the studio watcher detects completion. Idempotent — re-running regenerates
@@ -66,18 +66,20 @@ Write `cicd/CICD_GENERATION.md`:
 Read `references/cicd-app-template.md` for the complete file templates. Produce:
 
 1. `cicd/app/cicd.config.json` — from the plan's tables:
-   `{ "port": <CI/CD app port>, "docker": { "registry" } | null, "apps": [{ "name", "folder",
+   `{ "port": <CI/CD app port>, "generatedAt": "<current ISO-8601 UTC>", "docker": { "registry" } | null, "apps": [{ "name", "folder",
    "method", "port", "build", "start", "stop", "deployMethod", "deploy", "health", "image",
    "dockerfile", "configs" }], "infra": [{ "id", "name",
-   "host", "port", "url", "description" }] }` — `docker.registry` comes from the plan's
+   "host", "port", "url", "description" }] }` — `generatedAt` MUST be the actual time you generate
+   this file (a fresh value on EVERY run — never copy a previous one): the running server pins the
+   value it booted with and shows a "restart required" banner when a later regeneration moves it
+   forward, so an in-place-replaced-but-still-running app is self-diagnosing. `docker.registry` comes from the plan's
    `## Docker` section (`null` when the plan says not dockerized); per-app `image` is that
    section's Image column (`null` for non-dockerized apps) and `dockerfile` is
    `{ "path": "Dockerfile", "content": "<body>" }` for a `managed` Dockerfile from the plan's
    `## Dockerfiles` section, or `{ "path": "Dockerfile", "content": null }` for an `existing`
    one (`null` entirely when the app has no image). Copy managed Dockerfile bodies verbatim.
-   Commands may carry the literal `{VERSION}` token — copy it verbatim; the generated app
-   substitutes it at execution with the project's CURRENT version (studio guard's latest
-   semver, `v` prefix stripped, fallback `latest`) — never via any user-facing selector. `deployMethod` is the plan's Deploy Method column
+   Commands are copied verbatim from the plan and run as-is — there is NO `{VERSION}` token
+   or any other placeholder substitution. `deployMethod` is the plan's Deploy Method column
    (`none|web-server|docker|kubernetes`) and `deploy` its command (`null` when the method is
    `none`). The `infra` array comes from the plan's `## Infrastructure` table (one entry per
    row); `url` is `null` when the Console URL cell is `-`. Emit `"infra": []` when the plan's
@@ -164,22 +166,15 @@ port, application count) and STOP — the studio starts/embeds the app.
   (`<project>/<folder>`) as working directory — command paths are relative to the application
   folder (e.g. `java -jar target\app.jar`), never to the project root. Deploy renders only
   when the plan assigned a deploy method other than `none`.
-- **NO version selector — current codebase only**: the page carries NO version dropdown or
-  any other version choice. Build/Start/Stop/Deploy (and the All buttons) always operate on
-  the CURRENT working tree — there is nothing else they could build. The literal `{VERSION}`
-  token in commands is resolved AUTOMATICALLY at execution time to the project's current
-  version: the FIRST entry of the studio guard response's `versions` array (already polled
-  every 30 s; latest first), minus its `v` prefix, falling back to `latest` when the studio
-  is unreachable. Never render a UI control for it and never check out code.
+- **NO version UI, NO All-apps buttons, NO command substitution**: the page carries NO
+  version dropdown or any other version choice, and NO Build All / Start All / Stop All
+  buttons — Build/Start/Stop/Deploy are per-application only and always operate on the
+  CURRENT working tree, running the plan's commands verbatim (no `{VERSION}` or other token
+  substitution). Never render a version control and never check out code.
 - **Dockerfile materialization**: before Build, when an app's `dockerfile.content` is set and
   no file exists at its path in the application folder, the server writes it (never
   overwriting an existing Dockerfile — mirror of the managed-config rule). Build never
   pushes an image; pushing belongs to a `docker` deploy command.
-- **All-apps controls**: the top bar carries **Build All**, **Start All** and **Stop All**
-  buttons. Build All builds eligible apps SEQUENTIALLY (one at a time — honest logs, no CPU
-  storm); Start All starts every eligible stopped app; Stop All stops every running app.
-  Eligible = develop-gate not failed, not busy, and (for build/start) not already running;
-  ineligible apps are skipped silently — per-tab badges show progress.
 - Develop gate: controls stay disabled for an application that never completed a
   conductor-develop run — checked via `${CO2_STUDIO_URL}/api/cicd-guard/${CO2_PROJECT_ID}`
   with the CO2_GUARD_TOKEN from the spawn env (refreshed every 30 s, last answer cached).