primo-cli 0.1.23 → 0.1.25

package/dist/commands/add.js

@@ -1,4 +1,5 @@
 import fs from 'fs/promises';
+import net from 'net';
 import path from 'path';
 import { randomInt } from 'crypto';
 import chalk from 'chalk';
@@ -60,6 +61,34 @@ export async function add_site(target, options) {
         process.exit(1);
     }
     let server_config = await read_server_config(base_dir);
+    const port = server_config.port ?? parseInt(options.port, 10);
+    // `primo add` and `primo dev`'s sites-root watcher both mint a site_id for a
+    // newly-appeared folder. If dev is up when we add, the two race: the watcher
+    // adopts the folder under its own id while add writes a different id to
+    // site.yaml, leaving disk pointing at an id the CMS doesn't have. Refuse
+    // while ANYTHING holds the port so there is exactly one minter — the headless
+    // import below. This check runs BEFORE ensure_site_config so we never stamp a
+    // site_id we'd then strand. `primo dev` picks the folder up on its next start
+    // (or its watcher, if it's already been given an id).
+    //
+    // The guard is TCP occupancy, not a healthy-Primo response: a server that's
+    // still starting, an unhealthy Primo, or any other listener all own the port
+    // and would make the headless CMS below fail to bind — after we'd already
+    // minted. So we only proceed on a confirmed connection refusal (port free);
+    // an accepted connection OR an inconclusive probe both count as occupied. A
+    // healthy Primo just gets a more specific hint.
+    if (await is_port_occupied(port)) {
+        if (await is_server_running(port)) {
+            console.log(chalk.red(`A Primo server is running on port ${port}.`));
+            console.log(chalk.dim(`  Stop it (Ctrl+C in its terminal), then re-run \`primo add ${target}\`.`));
+            console.log(chalk.dim('  `primo dev` imports the folder itself once it\'s restarted.'));
+        }
+        else {
+            console.log(chalk.red(`Port ${port} is in use, so \`primo add\` can't start a CMS to import into.`));
+            console.log(chalk.dim(`  Free the port (stop whatever is on it), then re-run \`primo add ${target}\`.`));
+        }
+        process.exit(1);
+    }
     const { config, created, minted } = await ensure_site_config(site_dir, folder_name);
     if (created) {
         console.log(chalk.dim(`  created site.yaml (site_id ${config.site_id})`));
@@ -80,62 +109,11 @@ export async function add_site(target, options) {
             await write_server_config(base_dir, server_config);
         }
     }
-    const port = server_config.port ?? parseInt(options.port, 10);
     const api_url = `http://127.0.0.1:${port}`;
-    if (await is_server_running(port)) {
-        // A dev server is up — ask it to discover and import the site, exactly
-        // like `primo new` does, so its watchers attach too.
-        const reload = await request_dev_reload(port);
-        if (reload.status === 'unreachable') {
-            // Older dev server or hot reload disabled (port+1 in use). Import
-            // directly against the running CMS — records land, but the dev
-            // server won't watch this site until it's restarted.
-            let timings = null;
-            try {
-                timings = await register_site(site_dir, api_url, config, port, server_config, base_dir);
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                console.log(chalk.red(`  ✗ ${config.name} could not be imported: ${message}`));
-                console.log(chalk.dim(`  Fix the problem, then re-run \`primo add ${target}\`.`));
-                process.exit(1);
-            }
-            report_import(config.name, timings);
-            console.log(chalk.yellow('  The running dev server couldn\'t be reloaded — restart `primo dev` to watch this site.'));
-            console.log('');
-            return;
-        }
-        // The health check only proves *a* Primo server is on this port — it
-        // could belong to a different workspace. The reload response's `known`
-        // list is the only reliable way to tell: PocketBase 404s record reads
-        // pre-setup even when the record exists, so we can't just probe the
-        // site_id. (Older dev servers don't send `known` — trust the reload.)
-        const known = reload.known?.find(site => site.site_id === config.site_id);
-        if (reload.known && !known) {
-            console.log(chalk.red(`  A Primo server is running on port ${port}, but it isn't serving this workspace.`));
-            console.log(chalk.dim('  Stop it (or start `primo dev` in this workspace) and re-run `primo add`.'));
-            process.exit(1);
-        }
-        if (known?.blocked || reload.quarantined.includes(config.name)) {
-            console.log(chalk.yellow(`  ${config.name} was found, but the dev server couldn't import it (e.g. duplicate IDs or a missing pages/index.yaml).`));
-            console.log(chalk.dim('  Check the `primo dev` logs, fix the problem, then re-run `primo add`.'));
-            process.exit(1);
-        }
-        console.log('');
-        if (reload.loaded === 0 && reload.known) {
-            console.log(`  ${chalk.cyan(config.name)} is already registered with the running dev server.`);
-        }
-        else {
-            console.log(chalk.green(`  ✓ ${config.name} registered`));
-        }
-        const host = local_dev_host(config.name, port);
-        console.log(`    ${chalk.dim('Edit:')}    http://${host}/admin/site`);
-        console.log(`    ${chalk.dim('Preview:')} http://${host}/`);
-        console.log('');
-        return;
-    }
-    // No dev server running: boot the CMS binary headlessly against the
-    // workspace database, import, and shut it back down.
+    // No server is running (guaranteed — we refused above if one held the port),
+    // so boot the CMS binary headlessly against the workspace database, import,
+    // and shut it back down. This is the single minter/import path, which is why
+    // `primo add` and the dev watcher can't double-mint the same folder.
     const spinner = ora('Starting CMS for one-time import...').start();
     const binary_path = await ensure_binary();
     const data_dir = await ensure_data_dir(base_dir);
@@ -202,14 +180,6 @@ async function register_site(site_dir, api_url, config, port, server_config, bas
     const use_bootstrap = !await site_exists(api_url, config.site_id);
     return await import_site_files(site_dir, api_url, config, port, server_config, use_bootstrap, base_dir);
 }
-function report_import(site_name, timings) {
-    if (timings === null || !timings.ok) {
-        console.log(chalk.red(`  ✗ ${site_name} could not be imported — see the errors above.`));
-        process.exit(1);
-    }
-    console.log(chalk.green(`  ✓ ${site_name} registered (${timings.mode})`));
-    report_warnings(timings);
-}
 function report_warnings(timings) {
     if (timings.warning_count > 0) {
         console.log(chalk.yellow(`  ⚠ imported with ${timings.warning_count} warning${timings.warning_count === 1 ? '' : 's'} (details above)`));
@@ -291,43 +261,29 @@ async function ensure_site_config(site_dir, folder_name) {
     }
     return { config, created, minted };
 }
-async function request_dev_reload(port) {
-    try {
-        // Bound the request: the reload handler runs discovery + import
-        // synchronously before responding.
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 30000);
-        let res;
-        try {
-            res = await fetch(`http://127.0.0.1:${port + 1}/reload`, {
-                method: 'POST',
-                signal: controller.signal
-            });
-        }
-        finally {
-            clearTimeout(timeout);
-        }
-        if (!res.ok)
-            return { status: 'unreachable' };
-        const result = await res.json().catch(() => null);
-        if (!result)
-            return { status: 'unreachable' };
-        return {
-            status: 'ok',
-            loaded: result.loaded ?? 0,
-            quarantined: result.quarantined ?? [],
-            known: Array.isArray(result.known) ? result.known : undefined
+// True when something is listening on the port — the guard the headless import
+// actually depends on (the CMS below can't bind an occupied port). Distinct from
+// is_server_running, which only reports whether a *healthy Primo* answered: a
+// starting/unhealthy server or a foreign listener returns false there but still
+// owns the port. Fail safe — an accepted connection means occupied, and any
+// inconclusive result (timeout, unexpected error) is treated as occupied too, so
+// we never mint a site_id ahead of a bind we can't actually make. Only an
+// explicit connection refusal (ECONNREFUSED) counts as free.
+async function is_port_occupied(port) {
+    return new Promise(resolve => {
+        const socket = new net.Socket();
+        const done = (occupied) => {
+            socket.destroy();
+            resolve(occupied);
         };
-    }
-    catch {
-        return { status: 'unreachable' };
-    }
-}
-// Mirror of dev.ts's local_dev_host so the links printed here match the ones
-// `primo dev` prints for the same site.
-function local_dev_host(name, port) {
-    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'site';
-    return `${slug}.localhost:${port}`;
+        socket.setTimeout(1000);
+        socket.once('connect', () => done(true));
+        socket.once('timeout', () => done(true));
+        socket.once('error', (err) => {
+            done(err.code !== 'ECONNREFUSED');
+        });
+        socket.connect(port, '127.0.0.1');
+    });
 }
 async function is_server_running(port) {
     try {

package/dist/commands/push.js

@@ -3,9 +3,11 @@ import path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import archiver from 'archiver';
+import { dump as dump_yaml, load as load_yaml } from 'js-yaml';
 import { get_auth_token } from '../utils/auth.js';
 import { read_site_config, get_site_config_path, SITE_CONFIG_FILE } from '../utils/site-config.js';
-import { get_server_config_path, read_server_config, normalize_server_url } from '../utils/server-config.js';
+import { get_server_config_path, read_server_config, resolve_format_options, normalize_server_url } from '../utils/server-config.js';
+import { format_file_contents } from '../utils/format.js';
 async function path_exists(p) {
     try {
         await fs.access(p);
@@ -39,6 +41,206 @@ async function resolve_group_name(site_dir, group_id) {
     }
     return undefined;
 }
+// Best-effort workspace root for a site dir, used to resolve the workspace
+// prettier install when formatting rewritten yaml. Walks up looking for a
+// server.yaml; falls back to the site dir if none is found (single-site checkout).
+async function root_dir_for(site_dir) {
+    const candidates = [path.dirname(path.dirname(site_dir)), path.dirname(site_dir), site_dir];
+    for (const dir of candidates) {
+        if (await path_exists(get_server_config_path(dir)))
+            return dir;
+    }
+    return site_dir;
+}
+// Converge the local site with the upload ids the server minted on push. The
+// server creates its own site_uploads record per file (it can't honor a foreign
+// CMS's id), renames files to a canonical suffixed name, and returns the
+// symbolic->{id,canonical} map. `primo dev` applies this writeback via its
+// watcher; `primo push` previously dropped it, so local refs stayed symbolic (or
+// worse, kept a stale id from another CMS) and drifted from the server forever.
+//
+// This mirrors write_upload_writeback in dev.ts but without the chokidar
+// bookkeeping (nothing is watching during a push). Best-effort throughout: a
+// push has already succeeded by the time we get here, so a writeback hiccup
+// should never fail the command.
+async function apply_upload_writeback(site_dir, workspace_dir, created_ids) {
+    const manifest = created_ids?.['uploads/.manifest.json'];
+    const uploads_map = manifest && typeof manifest._uploads === 'object' && manifest._uploads !== null
+        ? manifest._uploads
+        : null;
+    if (!uploads_map)
+        return;
+    // Build symbolic-filename -> record-id map and the rename list. Both
+    // symbolic and canonical are treated as untrusted (they come from the
+    // server response): reject anything that isn't a plain basename so a
+    // crafted `../` can't make a later path.join escape uploads/ (CWE-22).
+    const symbolic_to_id = new Map();
+    const rename_for = new Map();
+    for (const [symbolic, raw] of Object.entries(uploads_map)) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        if (!is_safe_basename(symbolic))
+            continue;
+        const entry = raw;
+        if (typeof entry.id !== 'string' || !entry.id)
+            continue;
+        symbolic_to_id.set(symbolic, entry.id);
+        const canonical = typeof entry.canonical === 'string' ? entry.canonical : '';
+        if (canonical && canonical !== symbolic && is_safe_basename(canonical)) {
+            rename_for.set(symbolic, canonical);
+        }
+    }
+    if (symbolic_to_id.size === 0)
+        return;
+    // Rewrite refs FIRST, renames second — and only rename files whose ref
+    // rewrite actually succeeded. Renaming before rewriting risks leaving a file
+    // at its canonical name while the yaml still points at the old symbolic path
+    // (if the rewrite is skipped/unreadable/unwritable), which the next push
+    // would resend as a stale ref. So we rewrite yaml, track which symbolic keys
+    // were applied, and rename only those — keeping disk and yaml consistent even
+    // when some files can't be processed.
+    let format_options;
+    try {
+        format_options = resolve_format_options(await read_server_config(workspace_dir));
+    }
+    catch {
+        format_options = resolve_format_options({});
+    }
+    // Track, per symbolic name, whether it was successfully rewritten in at least
+    // one file (`applied`) and whether ANY file that references it could not be
+    // persisted (`failed`). The same `upload: uploads/<name>` ref can appear in
+    // multiple files, so a name is only safe to rename once EVERY file bearing it
+    // is written — otherwise a skipped/failed file keeps the old symbolic ref
+    // while the file has already moved to its canonical name.
+    const applied = new Set();
+    const failed = new Set();
+    // Note which symbolic names a raw file mentions, so a file that fails before
+    // (or during) parse still marks its refs failed rather than silently passing.
+    const referenced_names = (raw) => [...symbolic_to_id.keys()].filter(name => raw.includes(`uploads/${name}`));
+    for (const subdir of UPLOAD_REF_DIRS) {
+        const files = await walk_yaml_files(path.join(site_dir, subdir));
+        for (const file_path of files) {
+            let content;
+            try {
+                content = await fs.readFile(file_path, 'utf-8');
+            }
+            catch {
+                continue; // unreadable file references nothing we can see; skip
+            }
+            if (!content.includes('uploads/'))
+                continue;
+            const names_here = referenced_names(content);
+            if (names_here.length === 0)
+                continue;
+            try {
+                const parsed = load_yaml(content);
+                if (!parsed || typeof parsed !== 'object') {
+                    names_here.forEach(n => failed.add(n));
+                    continue;
+                }
+                const { value: rewritten, applied: file_applied } = rewrite_symbolic_upload_refs(parsed, symbolic_to_id);
+                if (file_applied.size === 0)
+                    continue;
+                const raw = dump_yaml(rewritten, { lineWidth: -1 });
+                const formatted = await format_file_contents(file_path, raw, workspace_dir, format_options);
+                await fs.writeFile(file_path, formatted, 'utf-8');
+                for (const key of file_applied)
+                    applied.add(key);
+            }
+            catch {
+                // parse/marshal/write failure — this file keeps its symbolic ref,
+                // so its name(s) must NOT be renamed even if another file succeeded.
+                names_here.forEach(n => failed.add(n));
+            }
+        }
+    }
+    // Rename on-disk upload files to their canonical (server-suffixed) names,
+    // but only for names that were rewritten somewhere AND had no unpersisted
+    // reference anywhere. Missing source = already renamed or user-removed; skip.
+    const uploads_dir = path.join(site_dir, 'uploads');
+    for (const [symbolic, canonical] of rename_for) {
+        if (!applied.has(symbolic) || failed.has(symbolic))
+            continue;
+        try {
+            await fs.rename(path.join(uploads_dir, symbolic), path.join(uploads_dir, canonical));
+        }
+        catch {
+            // missing source or permission issue — skip
+        }
+    }
+}
+// Guard against path traversal / absolute paths in server-supplied upload
+// names. Only accept a plain filename (no separators, no `..`, no leading dot-dot).
+function is_safe_basename(name) {
+    if (!name || name === '.' || name === '..')
+        return false;
+    if (name.includes('/') || name.includes('\\') || name.includes('\0'))
+        return false;
+    if (path.isAbsolute(name))
+        return false;
+    return path.basename(name) === name;
+}
+// Recursively collect .yaml files under a directory (dotfiles/dirs skipped).
+async function walk_yaml_files(root) {
+    const out = [];
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.name.startsWith('.'))
+                continue;
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                stack.push(full);
+            else if (entry.isFile() && entry.name.endsWith('.yaml'))
+                out.push(full);
+        }
+    }
+    return out;
+}
+// Rewrite `upload: "uploads/<file>"` values to the server record id. Mirrors the
+// server's rewriteUploadRefs (and dev.ts's copy). Returns the set of symbolic
+// filenames it actually remapped so the caller can rename exactly those files
+// (and only after the yaml write succeeds). Note this only remaps symbolic
+// paths — a bare id that matches no entry is left as-is (see PR notes on the
+// separate stale-cross-CMS-id repair still needed for already-broken refs).
+function rewrite_symbolic_upload_refs(value, map) {
+    const applied = new Set();
+    const walk = (v) => {
+        if (v && typeof v === 'object' && !Array.isArray(v)) {
+            const obj = v;
+            const result = {};
+            for (const [k, val] of Object.entries(obj)) {
+                if (k === 'upload' && typeof val === 'string' && val.startsWith('uploads/')) {
+                    const symbolic = val.substring('uploads/'.length);
+                    const id = map.get(symbolic);
+                    if (id) {
+                        result[k] = id;
+                        applied.add(symbolic);
+                        continue;
+                    }
+                }
+                result[k] = walk(val);
+            }
+            return result;
+        }
+        if (Array.isArray(v))
+            return v.map(walk);
+        return v;
+    };
+    const rewritten = walk(value);
+    return { value: rewritten, applied };
+}
+// Subdirs whose yaml may carry `upload: uploads/...` refs. Mirrors the server's
+// import scope (uploads/ itself holds binaries, not refs, so it's excluded).
+const UPLOAD_REF_DIRS = ['blocks', 'page-types', 'pages', 'site'];
 // Returns the labels (site slugs / 'library') that failed to push so callers
 // like `primo deploy` can tell a clean run from a partial one. Empty = success.
 export async function push_site(options) {
@@ -291,6 +493,9 @@ async function push_single_site(site_dir, options, spinner) {
             console.log('');
             console.log(chalk.dim('  Site created on server and content uploaded.'));
             console.log(chalk.dim('  Run `primo login` and re-push to update content later.'));
+            // Converge local upload refs/filenames with the ids the server minted,
+            // same as the other push paths.
+            await apply_upload_writeback(site_dir, await root_dir_for(site_dir), bootstrap_result.created_ids);
             return;
         }
         throw new Error(bootstrap_result.error);
@@ -321,6 +526,9 @@ async function push_single_site(site_dir, options, spinner) {
             console.log('');
             console.log(chalk.dim('  Site created on server and content uploaded.'));
             console.log(chalk.dim('  Subsequent pushes will use the import endpoint.'));
+            // Converge local upload refs/filenames with the ids the server minted
+            // (see the import path below for why).
+            await apply_upload_writeback(site_dir, await root_dir_for(site_dir), bootstrap_result.created_ids);
             return;
         }
         throw new Error(bootstrap_result.error);
@@ -341,6 +549,17 @@ async function push_single_site(site_dir, options, spinner) {
         spinner.succeed(`Pushed ${label}`);
         console.log('');
         print_diff(result.diff);
+        // The server mints its own record id for each uploaded file and returns
+        // the symbolic->id map in created_ids. Converge the local copy so refs
+        // point at the server's id and files carry their canonical names — the
+        // same writeback `primo dev` does. Without this, local and server drift,
+        // and a symbolic ref baked to a *different* CMS's id dangles forever.
+        await apply_upload_writeback(site_dir, await root_dir_for(site_dir), result.created_ids);
+        // NOTE: push intentionally does NOT republish the served site. It syncs
+        // content into the CMS; regenerating the published output stays a
+        // separate, deliberate step (the editor's Publish action / the
+        // /api/primo/generate endpoint), so pushing content and choosing when it
+        // goes live remain decoupled.
     }
 }
 async function try_bootstrap_site(server, token, zip_buffer, config, site_id, group_name) {
@@ -367,8 +586,10 @@ async function try_bootstrap_site(server, token, zip_buffer, config, site_id, gr
         headers,
         body: form
     });
-    if (response.ok)
-        return { ok: true };
+    if (response.ok) {
+        const body = await response.json().catch(() => ({}));
+        return { ok: true, created_ids: body.created_ids };
+    }
     if (response.status === 403) {
         return {
             ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primo-cli",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Local development CLI for Primo",
   "type": "module",
   "bin": {