mango-cms 0.3.28 → 0.3.30

package/lib/devProxyGateway.js

@@ -34,13 +34,31 @@ export const DEFAULT_STAGING_PREFIX = 'staging.'
 export const BRANCH_HEADER = 'x-vibe-branch'
 export const BRANCH_COOKIE = 'vibe_branch'
 
-// Pure: pull the selected branch out of a request's headers (header first, then
-// the `vibe_branch` cookie). Returns '' when none is present so the resolver can
-// fall back to the site's configured default branch.
+// Pure: pull the selected branch out of a request. Precedence (high → low):
+//   1. x-vibe-branch header (set by fetch/XHR after the picker)
+//   2. ?branch=<name> URL search param (deliberate URL navigation, HAP-1175)
+//   3. vibe_branch cookie (set by the picker after selection)
+// Returns '' when none is present so the resolver can fall back to the site's
+// configured default branch.
 export function parseBranchFromReq(req) {
     const headerVal = req?.headers?.[BRANCH_HEADER]
     if (headerVal) return String(Array.isArray(headerVal) ? headerVal[0] : headerVal).trim()
 
+    const url = req?.url || ''
+    const q = url.indexOf('?')
+    if (q !== -1) {
+        for (const pair of url.slice(q + 1).split('&')) {
+            const eq = pair.indexOf('=')
+            const key = eq === -1 ? pair : pair.slice(0, eq)
+            if (key === 'branch') {
+                const val = eq === -1 ? '' : pair.slice(eq + 1)
+                if (val) {
+                    try { return decodeURIComponent(val.trim()) } catch { return val.trim() }
+                }
+            }
+        }
+    }
+
     const cookieHeader = req?.headers?.cookie || ''
     for (const pair of String(cookieHeader).split(';')) {
         const idx = pair.indexOf('=')
@@ -56,6 +74,52 @@ export function parseBranchFromReq(req) {
     return ''
 }
 
+// Pure: does this request carry a DELIBERATE branch signal (HAP-1175)?
+//
+// The gateway uses this — not "is there any Cookie/Authorization header" — to
+// decide whether to attempt per-branch resolution. Random session cookies left
+// over from prior visits do NOT count; only signals the app sets on purpose:
+//
+//   1. the `x-vibe-branch` request header (set by fetch/XHR after the picker)
+//   2. a non-empty `?branch=` URL search param (deliberate URL navigation)
+//   3. a non-empty `vibe_branch` cookie (set by the picker after selection)
+//
+// Returns true iff at least one of those carries a non-empty value. A request
+// with only unrelated cookies (e.g. `foo=bar`, `connect.sid=...`) returns false
+// so the gateway defaults it to the shared fallback front, not the resolver.
+export function hasBranchSignal(req) {
+    const headerVal = req?.headers?.[BRANCH_HEADER]
+    if (headerVal && String(Array.isArray(headerVal) ? headerVal[0] : headerVal).trim()) {
+        return true
+    }
+
+    const url = req?.url || ''
+    const q = url.indexOf('?')
+    if (q !== -1) {
+        for (const pair of url.slice(q + 1).split('&')) {
+            const eq = pair.indexOf('=')
+            const key = eq === -1 ? pair : pair.slice(0, eq)
+            if (key === 'branch') {
+                const val = eq === -1 ? '' : pair.slice(eq + 1)
+                if (val) return true
+            }
+        }
+    }
+
+    const cookieHeader = req?.headers?.cookie || ''
+    if (cookieHeader) {
+        for (const pair of String(cookieHeader).split(';')) {
+            const idx = pair.indexOf('=')
+            if (idx === -1) continue
+            if (pair.slice(0, idx).trim() === BRANCH_COOKIE) {
+                if (pair.slice(idx + 1).trim()) return true
+            }
+        }
+    }
+
+    return false
+}
+
 // Pure: does this request's Host header look like a staging request, and what
 // site slug does it resolve to?
 //
@@ -285,14 +349,18 @@ export function createHttpResolver({
  *   - Resolver errors (403/404/502) → surfaced as the resolver's HTTP status.
  *   - Upgrade-time resolver failure → socket destroyed (Vite retries the WS).
  *
- * Page-load auth (HAP-1173): a top-level browser navigation (`GET /`) carries
- * neither Cookie nor Authorization — the Vibe front's session is a localStorage
- * token attached only to explicit fetch/XHR. If the gateway gated those on auth
- * the editing surface couldn't load at all. So when `fallbackPort` is configured
- * AND the request has no Cookie + no Authorization, the gateway proxies the
- * request to that port (the shared front) instead of 401-ing. Branch selection
- * happens client-side after the SPA loads; subsequent authenticated calls carry
- * `x-vibe-branch` and resolve to the per-branch workspace as before.
+ * Page-load auth (HAP-1175, supersedes HAP-1173): a top-level browser navigation
+ * MUST never 401, regardless of what cookies it carries. Real browsers attach
+ * stale session cookies from prior visits on every request, so a "has Cookie →
+ * try the resolver" gate locks out every returning user (the original HAP-1173
+ * fix only solved the cookie-less case). The new contract: the gateway defaults
+ * ALL requests to `fallbackPort` (the shared front) and only resolves a per-
+ * branch workspace when the request carries a DELIBERATE branch signal — the
+ * `vibe_branch` cookie the picker sets after selection, the `x-vibe-branch`
+ * header on fetch/XHR, or a `?branch=` URL search param. If a signaled resolve
+ * fails (no auth, no workspace, resolver error), the request STILL falls back
+ * to the shared front rather than 401-ing. Hard errors only surface in
+ * "lockdown" mode where no `fallbackPort` is configured.
  *
  * Returns { server, proxy, close() } — caller owns server.listen(port, host).
  */
@@ -323,9 +391,6 @@ export function createStagingGatewayServer({
     const resolve = createHttpResolver({ backendPort, resolverPath, timeoutMs, http })
     const proxy = httpProxy.createProxyServer({ ws: true, xfwd: true })
     const fallbackTarget = Number.isInteger(fallbackPort) ? `http://127.0.0.1:${fallbackPort}` : null
-    function isUnauthenticated(req) {
-        return !(req?.headers?.cookie) && !(req?.headers?.authorization)
-    }
 
     const log = (where, err, req) => {
         if (typeof onError === 'function') onError(where, err, req)
@@ -359,17 +424,28 @@ export function createStagingGatewayServer({
             sendError(res, 404, `Unknown host: ${req?.headers?.host || '(missing Host header)'}`)
             return
         }
-        // HAP-1173: a raw browser navigation carries no Cookie + no Authorization
-        // (the front's session is a localStorage token attached only to fetch/XHR).
-        // Without a fallback the SPA shell can't load → editing surface is dead.
-        // With one configured, serve page + assets from the shared front; the
-        // branch picker fires client-side and later authenticated calls demux.
-        if (fallbackTarget && isUnauthenticated(req)) {
-            proxy.web(req, res, { target: fallbackTarget })
+        // HAP-1175: default route is the shared fallback front. Only requests
+        // that carry a deliberate branch signal (vibe_branch cookie, x-vibe-branch
+        // header, or ?branch= URL param) attempt per-branch resolution. A returning
+        // browser with stale session cookies but no branch signal — the case that
+        // re-broke staging in HAP-1175 — passes straight through here.
+        if (!hasBranchSignal(req)) {
+            if (fallbackTarget) {
+                proxy.web(req, res, { target: fallbackTarget })
+                return
+            }
+            sendError(res, 401, 'Vibe staging: no branch signal and no fallback configured')
             return
         }
         const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve })
         if (outcome.error) {
+            // HAP-1175: even with a branch signal, a failed resolve falls back
+            // to the shared front rather than 401-ing the page load. Hard errors
+            // surface only in lockdown mode (no fallback configured).
+            if (fallbackTarget) {
+                proxy.web(req, res, { target: fallbackTarget })
+                return
+            }
             sendError(res, outcome.status || 502, outcome.message || outcome.error)
             return
         }
@@ -382,17 +458,26 @@ export function createStagingGatewayServer({
             try { socket.destroy() } catch { /* noop */ }
             return
         }
-        // Page-load HMR upgrade rides without auth on the very first connect
-        // (same reason as handleRequest above). Send it to the fallback front so
-        // Vite HMR works for the un-routed shell; once the user picks a branch,
-        // the next upgrade carries `x-vibe-branch` and routes per-branch.
-        if (fallbackTarget && isUnauthenticated(req)) {
-            proxy.ws(req, socket, head, { target: fallbackTarget })
+        // HAP-1175: same default-to-fallback rule as handleRequest. The Vite
+        // HMR upgrade for the shared shell rides without a branch signal; only
+        // after the picker fires does the next upgrade carry x-vibe-branch and
+        // resolve per-branch.
+        if (!hasBranchSignal(req)) {
+            if (fallbackTarget) {
+                proxy.ws(req, socket, head, { target: fallbackTarget })
+                return
+            }
+            try { socket.destroy() } catch { /* noop */ }
             return
         }
         const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve })
         if (outcome.error) {
-            // Don't write an HTTP response onto an upgrade socket — Vite retries.
+            // Failed resolve on an upgrade: prefer the fallback over destroying
+            // the socket so HMR keeps working through the shared front.
+            if (fallbackTarget) {
+                proxy.ws(req, socket, head, { target: fallbackTarget })
+                return
+            }
             try { socket.destroy() } catch { /* noop */ }
             return
         }

package/lib/staging-gateway.js

@@ -18,10 +18,12 @@
  *   STAGING_HOST_PREFIX  (default "staging.")  Prefix fallback for slug demux.
  *   RESOLVER_PATH   (default /system/vibe/staging-resolve)
  *   RESOLVER_TIMEOUT_MS (default 2000, int)
- *   FALLBACK_PORT   (default 7121, int)  Where to send requests with no Cookie
- *                                        and no Authorization header — i.e. a
- *                                        browser page-load (HAP-1173). Usually
- *                                        the site's shared front. Set to 0 to
+ *   FALLBACK_PORT   (default 7121, int)  Where to send any request without a
+ *                                        deliberate branch signal (vibe_branch
+ *                                        cookie, x-vibe-branch header, or
+ *                                        ?branch= URL param), or any signaled
+ *                                        request whose resolution fails. The
+ *                                        shared front (HAP-1175). Set to 0 to
  *                                        disable and 401 those requests instead.
  *
  * Usage (typical droplet pm2):
@@ -91,9 +93,9 @@ server.listen(LISTEN_PORT, LISTEN_HOST, () => {
     console.log(`[staging-gateway] listening on ${LISTEN_HOST}:${LISTEN_PORT}`)
     console.log(`[staging-gateway]   ${target}  ->  per-branch Vibe workspace (resolved via 127.0.0.1:${BACKEND_PORT})`)
     if (FALLBACK_PORT) {
-        console.log(`[staging-gateway]   page-load (no Cookie + no Authorization)  ->  127.0.0.1:${FALLBACK_PORT}`)
+        console.log(`[staging-gateway]   no branch signal / failed resolve  ->  127.0.0.1:${FALLBACK_PORT}`)
     } else {
-        console.log('[staging-gateway]   page-load fallback disabled (no Cookie + no Authorization → 401)')
+        console.log('[staging-gateway]   fallback disabled (no branch signal → 401, failed resolve → resolver status)')
     }
 })
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mango-cms",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "type": "module",
   "main": "./index.js",
   "exports": {

package/vite.config.js

@@ -34,6 +34,17 @@ export default defineConfig(({ mode }) => {
 
   const buildPath = legacyMode ? mangoRoot : userProjectRoot
 
+  // HAP-1180: honour an explicit per-worktree Vite cache dir. Every per-branch
+  // vibe dev watcher (`vite build --watch`) is spawned with cwd = the SHARED
+  // node_modules/mango-cms, so without an override they all share one default
+  // `.vite` optimize cache and contend — the cross-branch half of the
+  // leaked-watcher → white-screen failure (HAP-1179). The dev-server wrapper
+  // (generations-vibe mango/helpers/vibeDevServer.mjs) exports
+  // MANGO_VITE_CACHE_DIR=<worktree>/.vite-cache (absolute); read it here so each
+  // worktree's build keeps an isolated cache. No-op when the env var is unset.
+  const cacheDir = process.env.MANGO_VITE_CACHE_DIR || process.env.VITE_CACHE_DIR || undefined
+  if (cacheDir) console.log('Vite cacheDir (per-worktree):', cacheDir)
+
   // Auto-detect dependencies to externalize (avoids bundling native modules, etc.)
   const getDeps = (pkgPath) => {
     if (!fs.existsSync(pkgPath)) return []
@@ -59,6 +70,7 @@ export default defineConfig(({ mode }) => {
   })
 
   return {
+    ...(cacheDir ? { cacheDir } : {}),
     build: {
       ssr: path.resolve(mangoRoot, 'src/main.js'),
       outDir: path.resolve(buildPath, 'build'),