unoverse 0.1.145 → 0.1.147

package/operator/ansible/ansible.cfg

@@ -17,3 +17,12 @@ become = True
 become_method = sudo
 become_user = root
 become_ask_pass = False
+
+[ssh_connection]
+# A transient TCP timeout must not kill a deploy: a single dropped SYN to a busy
+# or far-away VM read as UNREACHABLE on the very first task. Retry the connect
+# (ConnectionAttempts) and the connection (retries) before declaring the host gone.
+# The -C/ControlMaster/ControlPersist flags are ansible's defaults, restated
+# because ssh_args REPLACES them rather than appending.
+ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o ConnectionAttempts=5 -o ConnectTimeout=15 -o ServerAliveInterval=15 -o ServerAliveCountMax=4
+retries = 3

package/operator/infra/aws/main.tf

@@ -112,6 +112,19 @@ locals {
   # Where a person actually goes. Shared by the invitation email and the canvas_url output
   # so the address in the email can never drift from the address in the deploy summary.
   canvas_entry = var.domain != "" ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001"
+  # STUDIO IS A CALLBACK THIS GROUND OWNS, exactly like canvas_entry above.
+  #
+  # Studio signs in with `redirect_uri: window.location.origin` (packages/studio
+  # src/UniverseSession.tsx) and serves on a pinned 4108 (vite.config.ts, strictPort). On a
+  # BYO-OIDC ground the operator adds that to their own tenant; here the app client IS a
+  # resource of this module, so leaving it out means every developer who connects Studio to
+  # an AWS universe meets `redirect_mismatch` and has to discover a port number to put in a
+  # variable. The ground knows the address, so the ground allows it.
+  #
+  # Loopback only. It grants nothing on its own: the client is public, the flow is code with
+  # PKCE, and a code returned to 127.0.0.1 is redeemable only by the process that asked for
+  # it. The same reasoning already ships localhost:5173 in terraform.tfvars.example.
+  studio_entry = "http://localhost:4108"
   api_host   = "api.${var.domain}"
   dns_auto   = local.has_domain && var.route53_zone_id != ""
 }
@@ -592,8 +605,8 @@ resource "aws_cognito_user_pool_client" "spa" {
   # canvas_entry is the same expression the invitation email and the canvas_url output use,
   # so the address a person is sent to is by construction an address they may return to.
   # Anything else in the variable (localhost for dev, a second front end) is kept.
-  callback_urls                        = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
-  logout_urls                          = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
+  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
+  logout_urls                          = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
   supported_identity_providers         = ["COGNITO"]
 }
 

package/operator/infra/aws/terraform.tfvars.example

@@ -30,9 +30,12 @@ docr_token           = "dop_v1_..."   # registry token (pulls platform images)
 openai_api_key       = "sk-..."       # memory server + OpenAI nodes
 # hyperbrowser_api_key = ""           # optional — page intelligence
 
+# EXTRA sign-in callbacks only. Your Canvas (canvas.<domain>, or the ALB address when
+# there is no domain) and Studio (http://localhost:4108) are allowed automatically — the
+# ground provisions the app client, so it knows those two addresses and adds them itself.
+# List anything else here: a second front end, another dev port.
 oauth_callback_urls = [
-  "https://yourdomain.com",
-  "http://localhost:5173", # local Studio/Canvas dev against this universe
+  "http://localhost:5173", # Canvas dev server
 ]
 
 # RBAC roles (noun:verb — the grammar node manifests' requires.role matches).

package/operator/lib/deploy.sh

@@ -819,8 +819,20 @@ EOF
   # never been migrated, and reported success. The stamp is written only after install,
   # database and verify have all passed, so an interrupted setup resumes as a setup.
   if [ -z "$subcommand" ]; then
-    if ! ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
-         "$deploy_user@$deploy_host" 'test -f /opt/gravity/.setup-complete' >/dev/null 2>&1; then
+    # "COULD NOT ASK" IS NOT "NOT SET UP". ssh exits 255 on a connection failure and
+    # with the remote command's status otherwise — and a transient timeout here once
+    # reclassified a healthy, deployed server as first-time, pointing a full install at
+    # it. Retry the connect, and if the host still cannot be reached, stop and say so
+    # rather than guessing what it is.
+    local stamp_probe=0
+    ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
+        -o ConnectionAttempts=5 \
+        "$deploy_user@$deploy_host" 'test -f /opt/gravity/.setup-complete' >/dev/null 2>&1 || stamp_probe=$?
+    if [ "$stamp_probe" -eq 255 ]; then
+      rm -f "$tmp_inventory"
+      fail "Cannot reach $deploy_user@$deploy_host over SSH (tried 5 times). Check the network / security-group admin rule, then: unoverse deploy $cloud"
+      exit 1
+    elif [ "$stamp_probe" -ne 0 ]; then
       echo ""
       info "This server's setup has not finished. Running it ${DIM}(install, database, verify)${NC}"
       subcommand="first-time"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.145",
+  "version": "0.1.147",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",