agl 21.0.2 → 22.0.0

package/ts/classes.upgradetransaction.ts

@@ -6,7 +6,7 @@ import {
   controllerUpgradeManagementVersion,
   type IControllerStatus,
 } from '../ts_interfaces/index.js';
-import { controllerDataDirectory } from './classes.config.js';
+import { resolveAGLHomePaths } from './classes.aglhome.js';
 import {
   isLoopbackPortListening,
   queryControllerStatus,
@@ -33,9 +33,12 @@ import {
   upgradePackageTransitionTransactionVersion,
   upgradePackageTransitionSource,
   upgradePackageTransitionTarget,
-  upgradeTokenEnvironmentVariable,
   serializeUpgradeWorkerPayload,
 } from './classes.upgradecoordinator.js';
+import {
+  upgradeCoordinationRootEnvironmentVariable,
+  upgradeTokenEnvironmentVariable,
+} from './constants.upgradeenvironment.js';
 
 const npmRegistryUrl = 'https://registry.npmjs.org/';
 const commandOutputByteLimit = 1024 * 1024;
@@ -50,6 +53,11 @@ const upgradePreparationPollMs = 250;
 const upgradePreparationSourceCheckMs = 500;
 const upgradePreparationAcceptanceReconciliationMs = 5_000;
 const upgradePreparationCleanupAllowanceMs = 60_000;
+
+const scrubUpgradeCoordinationEnvironment = (): void => {
+  delete process.env[upgradeTokenEnvironmentVariable];
+  delete process.env[upgradeCoordinationRootEnvironmentVariable];
+};
 const upgradeLogPattern = /^upgrade-[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{6}\.[0-9]{3}Z-[A-Za-z0-9_-]{10}\.log$/;
 const semverPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 let upgradeWorkerCliPath: string | undefined;
@@ -1110,7 +1118,7 @@ const openUpgradeLog = async (tokenArg: string): Promise<{
   handle: plugins.fs.promises.FileHandle;
   path: string;
 }> => {
-  const directory = controllerDataDirectory();
+  const directory = resolveAGLHomePaths().logs;
   await plugins.fs.promises.mkdir(directory, { recursive: true, mode: 0o700 });
   const directoryStats = await plugins.fs.promises.lstat(directory);
   if (
@@ -1290,6 +1298,17 @@ const launchDetachedUpgradeWorkerProcess = async (optionsArg: {
   let child: plugins.childProcess.ChildProcess | undefined;
   let logClosed = false;
   try {
+    const workerEnvironment = { ...(optionsArg.environment ?? process.env) };
+    const inheritedToken = workerEnvironment[upgradeTokenEnvironmentVariable];
+    const useLegacyCoordination = workerEnvironment[upgradeCoordinationRootEnvironmentVariable] === undefined
+      && inheritedToken === optionsArg.payload.token;
+    if (useLegacyCoordination) {
+      delete workerEnvironment[upgradeCoordinationRootEnvironmentVariable];
+    } else if (workerEnvironment[upgradeCoordinationRootEnvironmentVariable] === undefined) {
+      workerEnvironment[upgradeCoordinationRootEnvironmentVariable] = new UpgradeCoordinator(
+        optionsArg.installation.globalRoot,
+      ).baseDirectory;
+    }
     const launchedChild = plugins.childProcess.spawn(
       process.execPath,
       [
@@ -1302,7 +1321,7 @@ const launchDetachedUpgradeWorkerProcess = async (optionsArg: {
         cwd: plugins.os.homedir(),
         detached: true,
         env: {
-          ...(optionsArg.environment ?? process.env),
+          ...workerEnvironment,
           [upgradeTokenEnvironmentVariable]: optionsArg.payload.token,
         },
         shell: false,
@@ -2185,8 +2204,14 @@ const runRecoveryUpgradeWorker = async (
   payloadArg: IUpgradeWorkerPayload,
   internalOptionsArg: IUpgradeWorkerInternalOptions,
 ): Promise<void> => {
-  const context = parseUpgradeRecoveryWorkerContext(internalOptionsArg.recoveryContext);
-  const coordinator = new UpgradeCoordinator(context.canonicalGlobalRoot);
+  const [context, coordinator] = (() => {
+    try {
+      const parsedContext = parseUpgradeRecoveryWorkerContext(internalOptionsArg.recoveryContext);
+      return [parsedContext, new UpgradeCoordinator(parsedContext.canonicalGlobalRoot)] as const;
+    } finally {
+      scrubUpgradeCoordinationEnvironment();
+    }
+  })();
   let lock: Awaited<ReturnType<UpgradeCoordinator['acquireUpgradeLock']>> | undefined;
   let releaseLock = true;
   try {
@@ -2252,16 +2277,26 @@ export async function runUpgradeWorker(
 ): Promise<void> {
   const environmentToken = process.env[upgradeTokenEnvironmentVariable];
   if (environmentToken !== payloadArg.token) {
+    scrubUpgradeCoordinationEnvironment();
     throw new Error(`The detached ${currentCliName} upgrade worker token binding is invalid.`);
   }
-  delete process.env[upgradeTokenEnvironmentVariable];
   if (internalOptionsArg.recoveryContext !== undefined) {
-    await runRecoveryUpgradeWorker(payloadArg, internalOptionsArg);
+    try {
+      await runRecoveryUpgradeWorker(payloadArg, internalOptionsArg);
+    } finally {
+      scrubUpgradeCoordinationEnvironment();
+    }
     return;
   }
-  const installation = await resolveCurrentPnpmGlobalInstallation();
-  upgradeWorkerCliPath = installation.cliPath;
-  const coordinator = new UpgradeCoordinator(installation.globalRoot);
+  let installation: IPnpmGlobalInstallation;
+  let coordinator: UpgradeCoordinator;
+  try {
+    installation = await resolveCurrentPnpmGlobalInstallation();
+    upgradeWorkerCliPath = installation.cliPath;
+    coordinator = new UpgradeCoordinator(installation.globalRoot);
+  } finally {
+    scrubUpgradeCoordinationEnvironment();
+  }
   let lock: Awaited<ReturnType<UpgradeCoordinator['acquireUpgradeLock']>> | undefined;
   let releaseLock = true;
   try {

package/ts/classes.uploadmanager.ts

@@ -1,4 +1,6 @@
 import * as plugins from './plugins.js';
+import { resolveAGLHomePaths } from './classes.aglhome.js';
+import { readControllerProcessIdentity } from './classes.processinspection.js';
 import {
   controllerMaxAttachmentPromptSuffixBytes,
   controllerMaxDraftAttachmentBytes,
@@ -9,6 +11,40 @@ import {
 
 const maximumActiveUploads = 64;
 const maximumActiveUploadBytes = 64 * 1024 * 1024;
+const uploadOwnerFileName = '.controller-upload-owner.json';
+const uploadOwnerMaximumBytes = 8 * 1024;
+const uploadOrphanRetentionMs = 24 * 60 * 60 * 1000;
+const maximumStaleUploadNodes = 8_192;
+const maximumStaleUploadDepth = 32;
+
+interface IControllerUploadOwner {
+  version: 1;
+  pid: number;
+  fingerprint: string;
+  nonce: string;
+  createdAt: number;
+}
+
+const parseUploadOwner = (valueArg: unknown): IControllerUploadOwner => {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+    throw new Error('Controller upload owner metadata is malformed.');
+  }
+  const value = valueArg as Record<string, unknown>;
+  if (
+    Object.keys(value).sort().join('\0')
+      !== ['createdAt', 'fingerprint', 'nonce', 'pid', 'version'].sort().join('\0')
+    || value.version !== 1
+    || !Number.isSafeInteger(value.pid)
+    || (value.pid as number) < 2
+    || typeof value.fingerprint !== 'string'
+    || value.fingerprint.length === 0
+    || value.fingerprint.length > 512
+    || typeof value.nonce !== 'string'
+    || !/^[a-f0-9]{32}$/.test(value.nonce)
+    || !Number.isSafeInteger(value.createdAt)
+  ) throw new Error('Controller upload owner metadata is invalid.');
+  return value as unknown as IControllerUploadOwner;
+};
 
 export interface IControllerUploadHandle {
   id: string;
@@ -24,7 +60,13 @@ interface IActiveUpload {
   cleanupPromise?: Promise<void>;
 }
 
+export interface IControllerUploadManagerOptions {
+  rootDirectory?: string;
+  readProcessIdentity?: typeof readControllerProcessIdentity;
+}
+
 export class ControllerUploadManager {
+  private readonly readProcessIdentity: typeof readControllerProcessIdentity;
   private rootPromise?: Promise<string>;
   private readonly activeUploads = new Map<string, IActiveUpload>();
   private readonly pendingCreates = new Set<Promise<IControllerUploadHandle>>();
@@ -33,6 +75,10 @@ export class ControllerUploadManager {
   private closed = false;
   private closePromise?: Promise<void>;
 
+  constructor(private readonly options: IControllerUploadManagerOptions = {}) {
+    this.readProcessIdentity = options.readProcessIdentity ?? readControllerProcessIdentity;
+  }
+
   public create(
     attachmentsArg: readonly IControllerDraftAttachment[],
   ): Promise<IControllerUploadHandle | undefined> {
@@ -193,10 +239,23 @@ export class ControllerUploadManager {
       this.rootPromise = (async () => {
         let root: string | undefined;
         try {
+          const baseRoot = this.options.rootDirectory ?? resolveAGLHomePaths().uploads;
+          await plugins.fs.promises.mkdir(baseRoot, { recursive: true, mode: 0o700 });
+          await plugins.fs.promises.chmod(baseRoot, 0o700);
+          await this.cleanupStaleRoots(baseRoot);
           root = await plugins.fs.promises.mkdtemp(
-            plugins.path.join(plugins.os.tmpdir(), 'harness-controller-uploads-'),
+            plugins.path.join(baseRoot, 'controller-'),
           );
           await plugins.fs.promises.chmod(root, 0o700);
+          const identity = await readControllerProcessIdentity(process.pid);
+          if (!identity) throw new Error('Unable to establish controller upload ownership.');
+          await this.writeOwnerMarker(root, {
+            version: 1,
+            pid: identity.pid,
+            fingerprint: identity.fingerprint,
+            nonce: plugins.crypto.randomBytes(16).toString('hex'),
+            createdAt: Date.now(),
+          });
           return await plugins.fs.promises.realpath(root);
         } catch (errorArg) {
           if (root) {
@@ -216,6 +275,177 @@ export class ControllerUploadManager {
     }
   }
 
+  private async writeOwnerMarker(
+    rootArg: string,
+    ownerArg: IControllerUploadOwner,
+  ): Promise<void> {
+    const markerPath = plugins.path.join(rootArg, uploadOwnerFileName);
+    const temporaryPath = `${markerPath}.tmp-${ownerArg.pid}-${ownerArg.nonce.slice(0, 16)}`;
+    let handle: plugins.fs.promises.FileHandle | undefined;
+    let temporaryCreated = false;
+    try {
+      handle = await plugins.fs.promises.open(
+        temporaryPath,
+        plugins.fs.constants.O_WRONLY
+        | plugins.fs.constants.O_CREAT
+        | plugins.fs.constants.O_EXCL
+        | (plugins.fs.constants.O_NOFOLLOW ?? 0),
+        0o600,
+      );
+      temporaryCreated = true;
+      await handle.writeFile(`${JSON.stringify(ownerArg)}\n`, 'utf8');
+      await handle.chmod(0o600);
+      await handle.sync();
+      await handle.close();
+      handle = undefined;
+      await plugins.fs.promises.rename(temporaryPath, markerPath);
+      await plugins.fs.promises.open(rootArg, plugins.fs.constants.O_RDONLY)
+        .then(async (directoryHandle) => {
+          try {
+            await directoryHandle.sync();
+          } finally {
+            await directoryHandle.close();
+          }
+        });
+      temporaryCreated = false;
+    } catch (errorArg) {
+      const cleanupErrors: unknown[] = [];
+      if (handle) {
+        try {
+          await handle.close();
+        } catch (cleanupErrorArg) {
+          cleanupErrors.push(cleanupErrorArg);
+        }
+      }
+      if (temporaryCreated) {
+        try {
+          await plugins.fs.promises.unlink(temporaryPath);
+        } catch (cleanupErrorArg) {
+          if ((cleanupErrorArg as NodeJS.ErrnoException).code !== 'ENOENT') {
+            cleanupErrors.push(cleanupErrorArg);
+          }
+        }
+      }
+      if (cleanupErrors.length > 0) {
+        throw new AggregateError(
+          [errorArg, ...cleanupErrors],
+          'Controller upload owner publication failed and cleanup was incomplete.',
+          { cause: errorArg },
+        );
+      }
+      throw errorArg;
+    }
+  }
+
+  private async cleanupStaleRoots(baseRootArg: string): Promise<void> {
+    const entries = await plugins.fs.promises.readdir(baseRootArg, { withFileTypes: true });
+    if (entries.length > 256) throw new Error('The controller upload root contains too many entries.');
+    for (const entry of entries) {
+      if (!entry.name.startsWith('controller-')) {
+        throw new Error(`Unexpected controller upload root entry: ${entry.name}`);
+      }
+      const root = plugins.path.join(baseRootArg, entry.name);
+      const stats = await plugins.fs.promises.lstat(root);
+      if (
+        !stats.isDirectory()
+        || stats.isSymbolicLink()
+        || (typeof process.getuid === 'function' && stats.uid !== process.getuid())
+        || (stats.mode & 0o077) !== 0
+      ) throw new Error(`Controller upload root is unsafe: ${root}`);
+      const markerPath = plugins.path.join(root, uploadOwnerFileName);
+      const markerStats = await plugins.fs.promises.lstat(markerPath).catch((errorArg) => {
+        if ((errorArg as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+        throw errorArg;
+      });
+      let stale = false;
+      if (!markerStats) {
+        stale = Date.now() - stats.mtimeMs > uploadOrphanRetentionMs;
+      } else {
+        if (
+          !markerStats.isFile()
+          || markerStats.isSymbolicLink()
+          || (typeof process.getuid === 'function' && markerStats.uid !== process.getuid())
+          || markerStats.nlink !== 1
+          || (markerStats.mode & 0o077) !== 0
+          || markerStats.size > uploadOwnerMaximumBytes
+        ) throw new Error(`Controller upload owner marker is unsafe: ${markerPath}`);
+        const owner = parseUploadOwner(JSON.parse(
+          await plugins.fs.promises.readFile(markerPath, 'utf8'),
+        ) as unknown);
+        let identity: Awaited<ReturnType<typeof readControllerProcessIdentity>>;
+        try {
+          identity = await this.readProcessIdentity(owner.pid);
+        } catch (errorArg) {
+          throw new Error(`Controller upload owner cannot be verified safely: ${root}`, {
+            cause: errorArg,
+          });
+        }
+        stale = !identity || identity.fingerprint !== owner.fingerprint;
+      }
+      if (!stale) continue;
+      await this.removeStaleRoot(root, stats);
+    }
+  }
+
+  private async removeStaleRoot(
+    rootArg: string,
+    identityArg: plugins.fs.Stats,
+  ): Promise<void> {
+    const current = await plugins.fs.promises.lstat(rootArg);
+    if (
+      !current.isDirectory()
+      || current.isSymbolicLink()
+      || current.dev !== identityArg.dev
+      || current.ino !== identityArg.ino
+    ) throw new Error(`Controller upload root changed before stale cleanup: ${rootArg}`);
+    const tombstone = `${rootArg}.stale-${process.pid}-${plugins.crypto.randomBytes(8).toString('hex')}`;
+    await plugins.fs.promises.rename(rootArg, tombstone);
+    try {
+      const moved = await plugins.fs.promises.lstat(tombstone);
+      if (moved.dev !== identityArg.dev || moved.ino !== identityArg.ino) {
+        throw new Error(`Controller upload stale root identity changed: ${rootArg}`);
+      }
+      await this.validateStaleTree(tombstone, identityArg.dev);
+      await plugins.fs.promises.rm(tombstone, { recursive: true, force: true });
+    } finally {
+      const parentHandle = await plugins.fs.promises.open(
+        plugins.path.dirname(rootArg),
+        plugins.fs.constants.O_RDONLY,
+      );
+      try {
+        await parentHandle.sync();
+      } finally {
+        await parentHandle.close();
+      }
+    }
+  }
+
+  private async validateStaleTree(rootArg: string, deviceArg: number): Promise<void> {
+    const pending = [{ path: rootArg, depth: 0 }];
+    let inspected = 0;
+    while (pending.length > 0) {
+      const current = pending.pop()!;
+      const entries = await plugins.fs.promises.readdir(current.path, { withFileTypes: true });
+      inspected += entries.length;
+      if (inspected > maximumStaleUploadNodes) {
+        throw new Error(`Controller upload stale tree contains too many entries: ${rootArg}`);
+      }
+      for (const entry of entries) {
+        const path = plugins.path.join(current.path, entry.name);
+        const stats = await plugins.fs.promises.lstat(path);
+        if (
+          stats.dev !== deviceArg
+          || (typeof process.getuid === 'function' && stats.uid !== process.getuid())
+        ) throw new Error(`Controller upload stale tree contains a foreign node: ${path}`);
+        if (!stats.isDirectory() || stats.isSymbolicLink()) continue;
+        if (current.depth >= maximumStaleUploadDepth) {
+          throw new Error(`Controller upload stale tree is too deep: ${path}`);
+        }
+        pending.push({ path, depth: current.depth + 1 });
+      }
+    }
+  }
+
   private async cleanup(idArg: string): Promise<void> {
     const active = this.activeUploads.get(idArg);
     if (!active) return;

package/ts/constants.upgradeenvironment.ts

@@ -0,0 +1,2 @@
+export const upgradeTokenEnvironmentVariable = 'HARNESS_CONTROLLER_UPGRADE_TOKEN';
+export const upgradeCoordinationRootEnvironmentVariable = 'AGL_UPGRADE_COORDINATION_ROOT';

package/ts/functions.controllerdataroot.ts

@@ -1,55 +1,19 @@
-import * as plugins from './plugins.js';
 import {
-  controllerDataRootPaths,
-  readDatabaseConfig,
-  type IControllerDataDirectoryOptions,
-} from './classes.config.js';
-import {
-  listControllerDataWriterProcessesForCliPaths,
-} from './classes.processinspection.js';
-import { embeddedDatabaseSocketPath } from './functions.embeddeddb.js';
-import {
-  ControllerDataRootMigrationRunner,
-  type IControllerDataRootMigrationResult,
-  type IControllerDataWriterProcessRecord,
-} from '../ts_migration/v2_controllerdataroot.js';
+  ensureAGLHomeDataRoot,
+  preflightAGLHomeDataRootMigration,
+  type IAGLHomeDataRootMigrationOptions,
+} from '../ts_migration/v23_aglhome.js';
+import type { IControllerDataRootMigrationResult } from '../ts_migration/v2_controllerdataroot.js';
 
-export interface IEnsureControllerDataRootOptions extends IControllerDataDirectoryOptions {
-  listDataWriterProcesses?: () => Promise<readonly IControllerDataWriterProcessRecord[]>;
-  signal?: AbortSignal;
-}
+export interface IEnsureControllerDataRootOptions extends IAGLHomeDataRootMigrationOptions {}
+
+export const preflightAGLHomeMigration = async (
+  optionsArg: IEnsureControllerDataRootOptions = {},
+): Promise<void> => await preflightAGLHomeDataRootMigration(optionsArg);
 
 export const ensureControllerDataRoot = async (
   optionsArg: IEnsureControllerDataRootOptions = {},
-): Promise<IControllerDataRootMigrationResult> => {
-  const roots = controllerDataRootPaths(optionsArg);
-  const databaseConfig = readDatabaseConfig(optionsArg);
-  if (!roots.migrationRequired) {
-    return { directoryPath: roots.targetRoot, databaseConfig };
-  }
-  const listDataWriterProcesses = optionsArg.listDataWriterProcesses ?? (async () => {
-    const cliPath = await plugins.fs.promises.realpath(
-      plugins.url.fileURLToPath(new URL('../cli.js', import.meta.url)),
-    );
-    return await listControllerDataWriterProcessesForCliPaths([cliPath], {
-      includeInstalledPackagePaths: true,
-    });
-  });
-  return await new ControllerDataRootMigrationRunner({
-    oldRoot: roots.legacyRoot,
-    newRoot: roots.targetRoot,
-    databaseConfig,
-    oldEmbeddedSocketPath: embeddedDatabaseSocketPath(
-      plugins.path.join(roots.legacyRoot, 'smartdb'),
-    ),
-    newEmbeddedSocketPath: embeddedDatabaseSocketPath(
-      plugins.path.join(roots.targetRoot, 'smartdb'),
-    ),
-    invokerPid: process.pid,
-    listDataWriterProcesses,
-    ...(optionsArg.signal ? { signal: optionsArg.signal } : {}),
-  }).run();
-};
+): Promise<IControllerDataRootMigrationResult> => await ensureAGLHomeDataRoot(optionsArg);
 
 export interface IEnsureControllerDataRootForStartupOptions
   extends IEnsureControllerDataRootOptions {

package/ts/functions.embeddeddb.ts

@@ -1,12 +1,23 @@
 import * as plugins from './plugins.js';
+import { resolveAGLHomePaths } from './classes.aglhome.js';
 
-export const embeddedDatabaseSocketPath = (dataDirectoryArg: string): string => {
+export const embeddedDatabaseSocketPath = (
+  dataDirectoryArg: string,
+  socketDirectoryArg = resolveAGLHomePaths().sockets,
+): string => {
   const directoryHash = plugins.crypto
     .createHash('sha256')
     .update(dataDirectoryArg)
     .digest('hex')
     .slice(0, 16);
-  return plugins.path.join(plugins.os.tmpdir(), `harness-controller-${directoryHash}.sock`);
+  const socketPath = plugins.path.join(
+    socketDirectoryArg,
+    `smartdb-${directoryHash}.sock`,
+  );
+  if (Buffer.byteLength(socketPath, 'utf8') > 100) {
+    throw new Error('AGL_HOME is too long for the embedded database Unix socket path.');
+  }
+  return socketPath;
 };
 
 export const isSocketListening = (socketPathArg: string): Promise<boolean> => new Promise((resolve) => {

package/ts/functions.runtimeenvironment.ts

@@ -1,6 +1,7 @@
 const controllerEnvironmentPrefix = 'HARNESS_CONTROLLER_';
 const forwardedEnvironmentVariable = 'HARNESS_CONTROLLER_FORWARD_ENV';
 const runtimeEnvironmentAllowlist = new Set([
+  'AGL_HOME',
   'APPDATA', 'COLORTERM', 'COMSPEC', 'FORCE_COLOR', 'HOME', 'HOMEDRIVE',
   'HOMEPATH', 'HTTP_PROXY', 'HTTPS_PROXY', 'LANG', 'LOCALAPPDATA', 'LOGNAME',
   'NODE_EXTRA_CA_CERTS', 'NO_PROXY', 'PATH', 'PATHEXT', 'SHELL', 'SSL_CERT_DIR',

package/ts/index.ts

@@ -4,6 +4,7 @@ export * from './00_commitinfo_data.js';
 export * from './interfaces.auth.js';
 export * from './interfaces.config.js';
 export * from './interfaces.lifecycle.js';
+export * from './classes.aglhome.js';
 export {
   openCodeExpectedVersion,
   openCodeUsername,

package/ts/interfaces.config.ts

@@ -4,14 +4,11 @@ export interface IControllerRuntimeConfig {
   controllerPort: number;
   publicOrigin: string;
   rpId: string;
-  workspaceDirectory: string;
   /**
-   * Root directory that bounds all registered projects. Absent only in
-   * documents persisted before v2; config resolution adopts a value exactly
-   * once (from --projects-root, else the workspace directory), after which it
-   * is immutable like every other boundary.
+   * Default base for relative project paths and suggestions. Absolute projects
+   * remain independently identity-bound and may live outside this directory.
    */
-  projectsRoot?: string;
+  projectsRoot: string;
   opencodePort: number;
   tlsMode: TControllerTlsMode;
 }
@@ -20,7 +17,8 @@ export interface IControllerRuntimeOverrides {
   controllerPort: number;
   publicOrigin?: string;
   rpId?: string;
-  workspaceDirectory?: string;
+  /** Explicit one-time project registration; never persisted as runtime config. */
+  initialProjectDirectory?: string;
   projectsRoot?: string;
   opencodePort?: number;
   behindTlsProxy?: boolean;

package/ts_migration/classes.documentmigrationrunner.ts

@@ -2,6 +2,7 @@ import * as plugins from '../ts/plugins.js';
 import { ProtocolV6DocumentMigration } from './v6_protocoldocumentmigration.js';
 import { ProtocolV18ResourceLayoutMigration } from './v18_resourcelayoutmigration.js';
 import { ProtocolV22ProjectFilesystemIdentityMigration } from './v22_projectfilesystemidentitymigration.js';
+import { RuntimeConfigV23Migration } from './v23_runtimeconfig.js';
 
 interface IDocumentMigration {
   run(): Promise<void>;
@@ -12,6 +13,7 @@ export class PostDatabaseDocumentMigrationRunner {
 
   constructor(private readonly database: plugins.smartdata.SmartdataDb | undefined) {
     this.migrations = [
+      new RuntimeConfigV23Migration(this.database),
       new ProtocolV6DocumentMigration(this.database),
       new ProtocolV18ResourceLayoutMigration(this.database),
     ];

package/ts_migration/index.ts

@@ -10,3 +10,5 @@ export * from './v18_resourcelayoutmigration.js';
 export * from './classes.flexpostharnessmigrationrunner.js';
 export * from './v19_flexprojectmanagement.js';
 export * from './v22_projectfilesystemidentitymigration.js';
+export * from './v23_runtimeconfig.js';
+export * from './v23_aglhome.js';