witnora 0.12.0 → 0.12.1

package/dist/onboard.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { access, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import { DEFAULT_WITNORA_SERVER } from "./credentials.js";
+import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
 import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
@@ -38,6 +38,7 @@ export async function runOnboard(options) {
     }
     const attemptId = `install-${Date.now()}-${randomSuffix()}`;
     const generatedFiles = [];
+    let gatewayMigration;
     await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
@@ -85,7 +86,21 @@ export async function runOnboard(options) {
             generatedFiles.push(...gateway.generatedFiles);
         }
         else {
-            output("\nExisting complete customer-owned Gateway found; verifying and reusing it.\n");
+            const binding = await inspectGatewayBinding(gatewayState.directory, token.projectId, server);
+            if (binding.matches) {
+                await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
+                output("\nExisting customer-owned Gateway matches this project; verifying and reusing it.\n");
+            }
+            else {
+                await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.projectId, token.projectId);
+                gatewayMigration = await archiveGateway(gatewayState.directory, repositoryPath, binding.projectId);
+                output(`\nExisting Gateway belongs to project ${binding.projectId}; archived it at ${gatewayMigration.archiveDirectory}.\n`);
+                const gateway = await initializeCustomerGateway({
+                    projectId: token.projectId, server, repository: repositoryPath, authorization: token,
+                    fetch: requestFetch, configHome: options.configHome, output,
+                });
+                generatedFiles.push(...gateway.generatedFiles);
+            }
         }
         generatedFiles.push(...await generateAutopilotFiles(repositoryPath, repository.name));
         const doctor = await doctorCustomerGateway({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
@@ -102,17 +117,70 @@ export async function runOnboard(options) {
         output("The self-test remains isolated. Start the generated Gateway and run the agent normally; the first source-signed, server-reconciled Gateway run completes onboarding.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
-            gatewayDirectory: join(repositoryPath, ".witnora", "gateway") };
+            gatewayDirectory: join(repositoryPath, ".witnora", "gateway"), gatewayArchiveDirectory: gatewayMigration?.archiveDirectory };
     }
     catch (error) {
         const diagnosis = error instanceof Error ? error.message : String(error);
         await rollbackGeneratedFiles(generatedFiles);
+        if (gatewayMigration)
+            await restoreGateway(gatewayMigration);
         await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
             status: "failed", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles), diagnosis, rolledBack: true,
         }).catch(() => undefined);
         throw new Error(`Witnora Setup Autopilot rolled back this install attempt: ${diagnosis}`);
     }
 }
+async function inspectGatewayBinding(directory, projectId, server) {
+    let value;
+    try {
+        value = JSON.parse(await readFile(join(directory, "gateway.json"), "utf8"));
+    }
+    catch {
+        throw new Error("Existing Gateway configuration is not valid JSON. Preserve it and repair the setup in Advanced mode.");
+    }
+    const existingProjectId = typeof value.projectId === "string" ? value.projectId.trim() : "";
+    const existingServer = typeof value.server === "string" ? normalizeServer(value.server) : "";
+    const connectionName = typeof value.connectionName === "string" ? value.connectionName.trim() : "";
+    const host = typeof value.host === "string" && value.host.trim() ? value.host.trim() : "127.0.0.1";
+    const port = Number(value.port);
+    if (!existingProjectId || !existingServer || !connectionName || !Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error("Existing Gateway configuration is missing a valid project, server, host, or port. Preserve it and repair the setup in Advanced mode.");
+    }
+    return { matches: existingProjectId === projectId && existingServer === server, projectId: existingProjectId, server: existingServer, connectionName, host, port };
+}
+async function assertGatewayStopped(requestFetch, host, port, oldProjectId, newProjectId) {
+    try {
+        const response = await requestFetch(`http://${host}:${port}/healthz`, { signal: AbortSignal.timeout(800) });
+        if (!response.ok)
+            return;
+    }
+    catch {
+        return;
+    }
+    throw new Error(`The running Gateway belongs to project ${oldProjectId}, not ${newProjectId}. Stop it with Ctrl+C, then run onboard again so Witnora can preserve the old evidence and bind this repository to the new project.`);
+}
+async function archiveGateway(gatewayDirectory, repositoryPath, projectId) {
+    const archiveRoot = join(repositoryPath, ".witnora", "gateway-archive");
+    const archiveDirectory = join(archiveRoot, `${Date.now()}-${safePathSegment(projectId)}-${randomSuffix()}`);
+    await mkdir(archiveRoot, { recursive: true });
+    const archiveIgnore = join(archiveRoot, ".gitignore");
+    if (!await exists(archiveIgnore))
+        await writeFile(archiveIgnore, "*\n!.gitignore\n");
+    try {
+        await rename(gatewayDirectory, archiveDirectory);
+    }
+    catch (error) {
+        throw new Error(`Could not archive the Gateway for project ${projectId}. Stop any running Gateway with Ctrl+C and retry. ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return { gatewayDirectory, archiveDirectory };
+}
+async function restoreGateway(migration) {
+    await rm(migration.gatewayDirectory, { recursive: true, force: true });
+    await rename(migration.archiveDirectory, migration.gatewayDirectory);
+}
+function safePathSegment(value) {
+    return (value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-|-$/g, "") || "unknown-project").slice(0, 80);
+}
 async function generateAutopilotFiles(repositoryPath, subject) {
     const files = new Map([
         [".witnora/setup/policy.json", `${JSON.stringify({ schemaVersion: "witnora.setup_policy.v0.1", subject, unknownCapabilities: "pending_confirmation", defaultDecision: "deny", environment: "sandbox" }, null, 2)}\n`],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",