@tikoci/quickchr 0.4.4 → 0.4.5

package/DESIGN.md

@@ -154,10 +154,11 @@ with a layered design:
   dispatches. `test-filter` narrows; `run-examples` defaults ON. Each runner boots its
   native CHR arch — `detectAccel()` picks KVM/HVF/TCG. Agents dispatch this to ground
   platform hypotheses without waiting for a PR cycle.
-- **`release.yml`** — one-click release: freshness gate (no suite re-run — main is kept
-  continuously release-able) + non-empty CHANGELOG `[Unreleased]` →
-  `scripts/release-prep.ts` bump/rollover → tag + GitHub Release + `npm publish
-  --provenance` (odd minor → `next`, even → `latest`).
+- **`release.yml`** — one-click publish from committed release state: freshness gate
+  (no suite re-run — main is kept continuously release-able) + `package.json` version
+  with a matching non-empty CHANGELOG section → tag + GitHub Release + `npm publish
+  --provenance` (odd minor → `next`, even → `latest`). CI never bumps versions or pushes
+  to protected `main`.
 - **`ros-versions.yml`** — daily: new RouterOS versions (per channel) with no linux-x86
   record in `ci-data/tested-versions.json` ride the `routeros-targets` matrix of a
   single integration dispatch.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tikoci/quickchr",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "CLI and library to download, launch, and manage MikroTik CHR virtual machines via QEMU",
   "module": "src/index.ts",
   "main": "src/index.ts",

package/src/lib/quickchr.ts

@@ -286,7 +286,14 @@ function createInstance(state: MachineState): ChrInstance {
 			authObj: { username: string; password?: string; basic?: string; header?: string },
 			urlSuffix = "",
 		): ServiceEndpoint => {
-			const chosen = securePM ?? plainPM;
+			// Plain-first (#95): on a stock CHR the TLS services are not dialable —
+			// `www-ssl` is disabled and `api-ssl` is certificate-less (TLS alert 40) —
+			// so preferring the secure forward advertised dead endpoints. Prefer the
+			// plain forward for each service; the secure forward remains the fallback
+			// so excluded plain ports still resolve when a secure forward is available
+			// (with `tls: true`). Secure preference can return once boot provisioning
+			// installs a certificate and enables www-ssl.
+			const chosen = plainPM ?? securePM;
 			if (!chosen) {
 				return { available: false, unavailableReason: `no forwarded port for ${serviceLabel}` };
 			}
@@ -306,11 +313,10 @@ function createInstance(state: MachineState): ChrInstance {
 			return { available: true, ...echo, auth: authObj };
 		};
 
-		// TLS preference is new logic (no pre-existing REST-URL preference to "keep" —
-		// see docs/centrs-interface.md's TLS section): prefer the secure port when its
-		// forward exists, fall back to plain, `available:false` only if neither does.
-		// This also closes a latent bug where excluding "http" while keeping "https"
-		// left restUrl pointing at a port that doesn't exist.
+		// Preference order lives in buildHttpService (plain-first, #95); this also
+		// keeps the excludePorts fix: excluding "http" while keeping "https" now
+		// resolves rest-api onto the surviving secure port instead of a port that
+		// doesn't exist.
 		const restApi = buildHttpService(
 			state.ports.https,
 			state.ports.http,