run402 4.83.0 → 4.84.0

package/sdk/dist/node/actions-node.js

@@ -1,3 +1,7 @@
+import { serializeDeployManifest, manifestExportUnsupported } from "./manifest-export.js";
+import { describeLocalPreflight } from "./preflight.js";
+import { resolveApplicationScope, materializeTemplates } from "./app-scope.js";
+import { scanDeploymentSources } from "./source-scan.js";
 import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { lstat, mkdir, mkdtemp, readdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
@@ -194,15 +198,20 @@ export class NodeActions {
         let workspaceDir = source.workspaceDir;
         const manifest = await this.#discoverAndValidateManifest(input, workspaceDir, source.metadata, run);
         workspaceDir = dirname(manifest.manifestPath);
-        if (!input.verifyOnly) {
-            await resolveDeploymentTarget({
-                appRoot: workspaceDir, manifestPath: manifest.manifestPath, projectId: input.projectId,
-                manifestProjectId: manifest.manifestProjectId ?? manifest.appSpec?.project.id, name: input.name,
-                targetKind: this.#targetKind(), apiBase: this.sdk.apiBase,
-                allowUnresolved: run.executionMode === "check" || run.executionMode === "printSpec" || run.dryRun,
-            });
+        const target = !input.verifyOnly ? await resolveDeploymentTarget({
+            appRoot: workspaceDir, manifestPath: manifest.manifestPath, projectId: input.projectId,
+            manifestProjectId: manifest.manifestProjectId ?? manifest.appSpec?.project.id, name: input.name,
+            targetKind: this.#targetKind(), apiBase: this.sdk.apiBase,
+            allowUnresolved: run.executionMode === "check" || (run.executionMode === "printSpec" || run.executionMode === "printManifest") || run.dryRun,
+        }) : null;
+        if (!input.verifyOnly && process.env.RUN402_DEPLOY_SKIP_SCAN !== "1") {
+            const scan = scanDeploymentSources(manifest.releaseSpec ?? {}, workspaceDir);
+            if (scan.errors.length)
+                throw run.error("Source scan blocked this application.", "R402_AUTH_PREFLIGHT_FAILED", scan);
         }
         if (manifest.manifestKind === "app") {
+            if (run.executionMode === "printManifest")
+                manifestExportUnsupported("app", "app resources and build intent cannot be faithfully represented as a release manifest");
             if (input.verifyOnly) {
                 return this.#verifyAppManifestOnly(input, manifest, workspaceDir, run, startedAt);
             }
@@ -211,22 +220,23 @@ export class NodeActions {
                 startedAt,
                 status: block ? "blocked" : "planned",
                 dryRun: run.dryRun || run.executionMode === "check" || run.executionMode === "printSpec",
-                projectId: input.projectId ?? (run.dryRun ? "prj_planned" : null),
+                projectId: target?.project_id ?? null,
                 diagnostics: block?.diagnostics,
                 nextActions: block?.nextActions,
                 blockedNodeId: block?.nodeId,
             });
             if (run.executionMode === "check" || run.executionMode === "printSpec" || run.dryRun) {
                 return run.result({
-                    project_id: input.projectId ?? "prj_planned",
+                    project_id: target?.project_id ?? null,
                     manifest_path: manifest.manifestPath,
                     app_graph: manifest.appGraph,
                     app_result: appResult,
+                    preflight: describeLocalPreflight({ appRoot: workspaceDir, manifestPath: manifest.manifestPath, target: target, authoring: manifest.appSpec?.release, spec: manifest.releaseSpec ?? undefined, buildDeferred: !!manifest.appSpec?.build?.commands?.length, apiBase: this.sdk.apiBase, profile: this.opts.profile }),
                 });
             }
             if (block) {
                 return run.result({
-                    project_id: input.projectId ?? "prj_planned",
+                    project_id: target?.project_id ?? null,
                     manifest_path: manifest.manifestPath,
                     app_graph: manifest.appGraph,
                     app_result: appResult,
@@ -237,14 +247,16 @@ export class NodeActions {
         if (input.verifyOnly) {
             return this.#verifyDeployManifestOnly(input, manifest, workspaceDir, run);
         }
-        if (run.executionMode === "check" || run.executionMode === "printSpec") {
+        if (run.executionMode === "check" || (run.executionMode === "printSpec" || run.executionMode === "printManifest")) {
             if (!manifest.releaseSpec) {
                 throw run.error("Internal error: release manifest did not produce a ReleaseSpec.", "RUN402_ACTION_INTERNAL");
             }
             return run.result({
-                project_id: manifest.releaseSpec.project,
+                project_id: target?.project_id ?? null,
                 manifest_path: manifest.manifestPath,
-                ...(run.executionMode === "printSpec" ? { spec: manifest.releaseSpec } : {}),
+                preflight: describeLocalPreflight({ appRoot: workspaceDir, manifestPath: manifest.manifestPath, target: target, authoring: manifest.loaded?.manifest, spec: manifest.releaseSpec, apiBase: this.sdk.apiBase, profile: this.opts.profile }),
+                ...(run.executionMode === "printManifest" ? { manifest: serializeDeployManifest(manifest.loaded, workspaceDir, input.projectId) } : {}),
+                ...(run.executionMode === "printSpec" ? { spec: { ...manifest.releaseSpec, project: target?.project_id ?? undefined } } : {}),
             });
         }
         if (run.executionMode === "plan") {
@@ -292,14 +304,14 @@ export class NodeActions {
             mutation: run.executionMode !== "plan",
             auto: false,
             details: {
-                project_id: resolved.projectId,
+                project_id: resolved.projectId === "prj_planned" ? null : resolved.projectId,
                 manifest_path: manifest.manifestPath,
             },
         });
         if (run.dryRun) {
             run.setState(deployStep, "planned");
             return run.result({
-                project_id: resolved.projectId,
+                project_id: resolved.projectId === "prj_planned" ? null : resolved.projectId,
                 manifest_path: manifest.manifestPath,
                 ...(resolved.shouldWriteLink ? { workspace_link_path: resolved.linkPath } : {}),
             });
@@ -410,7 +422,7 @@ export class NodeActions {
      * principal has a display name before the deploy that will be credited to
      * it, then join the project's room under that name. Explicit
      * `identityName` / `RUN402_AGENT_NAME` wins and may rename an already-named
-     * principal; otherwise a detected client name is set only when no name
+     * agent principal; human and unknown principals are preserved. Otherwise a detected client name is set only when no name
      * exists yet, and reported as `detected`. The detected client is always
      * reported (`detected` + `detection`), even when it was not applied, so an
      * agent whose principal is already named sees why. Best-effort end to
@@ -421,15 +433,23 @@ export class NodeActions {
         if (this.#targetKind() === "core") {
             return { display_name: null, source: "unavailable" };
         }
+        const explicitName = input.identityName?.trim() || declaredAgentName() || null;
+        const detectedName = detectClientName();
         let current = null;
+        let principalId = null;
+        let principalType = null;
         try {
             const me = await this.sdk.orgs.whoami();
+            principalId = me.principal?.id ?? null;
+            principalType = me.principal?.type ?? null;
             // The gateway never seeds display_name from a wallet subject (and
             // nulled the ones it once did), so null here means exactly "unset".
             current = me.principal?.display_name ?? null;
         }
         catch {
-            return { display_name: null, source: "unavailable" };
+            return { display_name: null, source: "unavailable", detected: detectedName,
+                principal: { id: null, type: null, display_name: null },
+                client: { detected: detectedName, declared_name: explicitName } };
         }
         let displayName = current;
         let source = "existing";
@@ -437,8 +457,13 @@ export class NodeActions {
         // (RUN402_AGENT_NAME), then a specifically detected client. A generic
         // guess is never persisted as a name. Detection always runs so the
         // result can say what was seen even when it was not applied.
-        const explicitName = input.identityName?.trim() || declaredAgentName() || null;
-        const detectedName = detectClientName();
+        if (principalType !== "agent") {
+            run.skipStep({ action: "identity.name.set", description: "Preserve authenticated human or unknown principal identity; client detection does not rename it.", mutation: false, auto: true, details: { principal_type: principalType } });
+            return { display_name: current, source: "existing",
+                principal: { id: principalId, type: principalType, display_name: current },
+                client: { detected: detectedName, declared_name: explicitName },
+                detected: detectedName, detection: { applied: false, reason: "principal_identity_preserved" } };
+        }
         const detectionReport = (applied) => {
             const reason = applied
                 ? "applied"
@@ -447,7 +472,9 @@ export class NodeActions {
                     : explicitName
                         ? "explicit_name_wins"
                         : "name_already_set";
-            return { detected: detectedName, detection: { applied, reason } };
+            return { detected: detectedName, detection: { applied, reason },
+                principal: { id: principalId, type: principalType, display_name: displayName },
+                client: { detected: detectedName, declared_name: explicitName } };
         };
         if (!displayName || (explicitName && explicitName !== displayName)) {
             const desired = explicitName ?? detectedName;
@@ -693,9 +720,7 @@ export class NodeActions {
                 // output-dir field to narrow by), so the pre-build check is skipped
                 // then and the post-build normalization performs it instead.
                 const buildProducesFiles = (appSpec.build?.commands ?? []).length > 0;
-                if (!buildProducesFiles) {
-                    await this.#assertAppReleaseFileReferences(appSpec, manifestPath, run);
-                }
+                const checkedRelease = !buildProducesFiles ? await this.#assertAppReleaseFileReferences(appSpec, manifestPath, run) : undefined;
                 run.setState(step, "succeeded", {
                     manifest_kind: "app",
                     manifest_path: manifestPath,
@@ -707,16 +732,17 @@ export class NodeActions {
                     manifestKind: "app",
                     manifestProjectId: appSpec.project.id,
                     manifestPath,
-                    releaseSpec: null,
+                    releaseSpec: checkedRelease ?? null,
                     appGraph,
                     appSpec,
                     source,
                 };
             }
         }
-        const loaded = await loadDeployManifest(manifestPath, {
+        const loaded = await this.#normalizeWithTypedFileErrors(() => loadDeployManifest(manifestPath, {
             defaultProject: "prj_up_preflight_placeholder",
-        });
+            validateFiles: true,
+        }), run);
         if (!hasDeployableContent(loaded.spec)) {
             throw run.error("Deploy manifest contains no deployable sections.", "MANIFEST_EMPTY", { manifest_path: manifestPath });
         }
@@ -724,13 +750,14 @@ export class NodeActions {
         run.setState(step, "succeeded", {
             manifest_kind: "release",
             manifest_path: manifestPath,
-            project_id: loaded.spec.project,
+            project_id: loaded.spec.project === "prj_up_preflight_placeholder" ? null : loaded.spec.project,
             idempotency_key: loaded.idempotencyKey ?? null,
         });
         return {
             manifestKind: "release",
             manifestPath,
             releaseSpec: loaded.spec,
+            loaded,
             idempotencyKey: loaded.idempotencyKey,
             manifestProjectId: loaded.spec.project === "prj_up_preflight_placeholder"
                 ? undefined
@@ -807,6 +834,11 @@ export class NodeActions {
     async #assertManifestFileReferences(spec, manifestPath, run) {
         try {
             await assertLocalFileReferencesExist(spec, { manifestPath });
+            if (process.env.RUN402_DEPLOY_SKIP_SCAN !== "1") {
+                const scan = scanDeploymentSources(spec, dirname(manifestPath));
+                if (scan.errors.length)
+                    throw run.error("Source scan blocked this application. Fix the reported findings, or explicitly override with RUN402_DEPLOY_SKIP_SCAN=1.", "R402_AUTH_PREFLIGHT_FAILED", scan);
+            }
         }
         catch (err) {
             throw this.#retypeManifestFileError(err, run);
@@ -854,6 +886,8 @@ export class NodeActions {
         try {
             normalized = await normalizeDeployManifest(releaseInput, {
                 project: "prj_up_preflight_placeholder",
+                validateFiles: true,
+                manifestPath,
                 baseDir: dirname(manifestPath),
             });
         }
@@ -864,6 +898,7 @@ export class NodeActions {
             return;
         }
         await this.#assertManifestFileReferences(normalized.spec, manifestPath, run);
+        return normalized.spec;
     }
     #planAppUpResult(input, manifest, run, opts) {
         if (!manifest.appGraph) {
@@ -1007,7 +1042,7 @@ export class NodeActions {
                 })),
             };
         }
-        if (run.executionMode !== "check" && run.executionMode !== "printSpec" && !run.dryRun) {
+        if (run.executionMode !== "check" && run.executionMode !== "printSpec" && run.executionMode !== "printManifest" && !run.dryRun) {
             const spendBlock = spendApprovalBlock(input, run);
             if (spendBlock)
                 return spendBlock;
@@ -1033,7 +1068,7 @@ export class NodeActions {
                 blockedNodeId: block.nodeId,
             });
             return run.result({
-                project_id: input.projectId ?? "prj_planned",
+                project_id: input.projectId ?? null,
                 manifest_path: manifest.manifestPath,
                 app_graph: manifest.appGraph,
                 app_result: blocked,
@@ -1061,7 +1096,7 @@ export class NodeActions {
                 blockedNodeId: "project.ensure",
             });
             return run.result({
-                project_id: input.projectId ?? "prj_planned",
+                project_id: input.projectId ?? null,
                 manifest_path: manifest.manifestPath,
                 app_graph: manifest.appGraph,
                 app_result: blocked,
@@ -1981,7 +2016,7 @@ export class NodeActions {
             description: "Write workspace project link",
             mutation: true,
             auto: true,
-            details: { path, project_id: link.project_id, name: link.name ?? null },
+            details: { path, project_id: run.dryRun && link.project_id === "prj_planned" ? null : link.project_id, name: link.name ?? null },
         });
         await run.approve(step, ["workspace.link.write"], `Write ${shortPath(path)}.`);
         if (run.dryRun) {
@@ -2117,7 +2152,7 @@ class ActionRun {
         return {
             action: this.input.type,
             mode: this.executionMode,
-            dry_run: this.dryRun || this.executionMode === "check" || this.executionMode === "printSpec" || this.executionMode === "plan",
+            dry_run: this.dryRun || this.executionMode === "check" || (this.executionMode === "printSpec" || this.executionMode === "printManifest") || this.executionMode === "plan",
             target: this.target,
             steps: this.steps,
             result,
@@ -2175,20 +2210,6 @@ function appPublicOrigin(input, spec) {
         return null;
     return `https://${subdomain}.run402.com`;
 }
-function materializeTemplates(value, values) {
-    if (typeof value === "string") {
-        return value.replace(/\$\{([^}]+)\}/g, (_match, key) => values[key] ?? "");
-    }
-    if (Array.isArray(value))
-        return value.map((item) => materializeTemplates(item, values));
-    if (value && typeof value === "object") {
-        return Object.fromEntries(Object.entries(value).map(([key, nested]) => [
-            key,
-            materializeTemplates(nested, values),
-        ]));
-    }
-    return value;
-}
 function appMailboxSlug(logicalName, spec) {
     return spec.slug ?? logicalName.replace(/_/g, "-");
 }
@@ -2310,6 +2331,9 @@ async function classifyAppVerifyAttempt(input) {
     if (input.attempt.status === input.check.expect.status) {
         return { kind: "success" };
     }
+    if ((input.attempt.status === 400 || input.attempt.status === 429) && input.attempt.edgeCode === null && !input.attempt.edgeHeader) {
+        return { kind: "failed" };
+    }
     const host = hostnameFromUrl(input.url);
     const freshness = host ? freshnessForHost(input.context, host) : { fresh: false, ageSeconds: null };
     if (freshness.fresh &&
@@ -2604,17 +2628,7 @@ function appBuildBlock(input, manifest) {
     return null;
 }
 async function findManifest(workspaceDir) {
-    for (const candidate of MANIFEST_CANDIDATES) {
-        const path = join(workspaceDir, candidate);
-        try {
-            await lstat(path);
-            return path;
-        }
-        catch {
-            // try next candidate
-        }
-    }
-    return null;
+    return (await resolveApplicationScope({ dir: workspaceDir })).manifest_path;
 }
 const NEARBY_MANIFEST_SCAN_LIMIT = 200;
 /**