witnora 0.20.16 → 0.20.17

package/dist/credentials.js

@@ -23,8 +23,9 @@ export async function saveConnection(name, input, options = {}) {
     return path;
 }
 export async function loadConnection(name, options = {}) {
+    const explicitConfigHome = options.configHome ?? process.env.WITNORA_CONFIG_HOME ?? process.env.AGENTCERT_CONFIG_HOME;
     const file = await readCredentialFile(credentialsPath(options))
-        ?? (options.configHome ? undefined : await readCredentialFile(legacyCredentialsPath()));
+        ?? (explicitConfigHome !== undefined ? undefined : await readCredentialFile(legacyCredentialsPath()));
     if (!file)
         return undefined;
     const connectionName = name ? validateConnectionName(name) : file.defaultConnection;

package/dist/onboard.js

@@ -59,6 +59,9 @@ export async function runOnboard(options) {
     if (!setupPlan || (token.approvedSetupPlanId && setupPlan.id !== token.approvedSetupPlanId) || !setupPlan.authorizedOperations.some((item) => item.kind === "authorize_install")) {
         throw new Error("Confirm the Setup Plan and authorize installation in the Witnora Workspace before running onboard.");
     }
+    const attemptId = `install-${Date.now()}-${randomSuffix()}`;
+    // Resume an authorized failed install before requesting fresh Runtime authority.
+    await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     let localRuntime = await discoverRuntimeReferences({
         repository: repositoryPath, configHome: options.configHome, projectId: token.projectId, setupPlanId: setupPlan.id, server, env: options.env ?? process.env,
     });
@@ -97,7 +100,6 @@ export async function runOnboard(options) {
             runtimeLimitation = `Hosted Runtime bootstrap did not complete: ${detail.slice(0, 500)} The existing Gateway was preserved and setup remains RECORDED_ONLY.`;
         }
     }
-    const attemptId = `install-${Date.now()}-${randomSuffix()}`;
     const generatedFiles = [];
     const gatewayLifecycle = options.gatewayLifecycle ?? {
         start: startManagedCustomerGateway,
@@ -146,7 +148,6 @@ export async function runOnboard(options) {
         }
         throw lastError;
     };
-    await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
         const selfTestDir = join(repositoryPath, ".witnora", "onboarding", "self-test", attemptId);
@@ -204,8 +205,12 @@ export async function runOnboard(options) {
             generatedFiles.push(...gateway.generatedFiles);
         }
         else {
-            const binding = await inspectGatewayBinding(gatewayState.directory, token.projectId, server);
-            if (binding.matches) {
+            const binding = await inspectGatewayBinding(gatewayState.directory, token.projectId, server, setupPlan.id);
+            if (binding.projectId === token.projectId && binding.server === server) {
+                const planRepairRequired = !binding.matches && Boolean(binding.runtimeSetupPlanId);
+                if (planRepairRequired && !localRuntime.references) {
+                    throw new RuntimeSetupNotReadyError(`The existing Gateway belongs to a different Setup Plan and could not be restored. ${runtimeLimitation ?? "Runtime references are unavailable."} Run onboard again to retry; the existing Gateway is preserved.`);
+                }
                 await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey, approvedSetupPlanId: setupPlan.id }, { configHome: options.configHome });
                 if (localRuntime.references) {
                     try {
@@ -223,6 +228,8 @@ export async function runOnboard(options) {
                     catch (error) {
                         if (!(error instanceof RuntimeSetupNotReadyError))
                             throw error;
+                        if (planRepairRequired)
+                            throw error;
                         runtimeLimitation = `Local sandbox Runtime references were found but did not establish readiness: ${error.message}`;
                         output(`\nExisting customer-owned Gateway remains RECORDED_ONLY because its Runtime references did not pass readiness checks: ${error.message}\n`);
                     }
@@ -598,7 +605,7 @@ function configuredGatewayPorts(environment) {
     const port = Number(value);
     return Number.isInteger(port) && port > 0 && port <= 65_535 ? new Set([port]) : new Set();
 }
-async function inspectGatewayBinding(directory, projectId, server) {
+async function inspectGatewayBinding(directory, projectId, server, setupPlanId) {
     let value;
     try {
         value = JSON.parse(await readFile(join(directory, "gateway.json"), "utf8"));
@@ -612,10 +619,12 @@ async function inspectGatewayBinding(directory, projectId, server) {
     const collectorId = typeof value.collectorId === "string" ? value.collectorId.trim() : "";
     const host = typeof value.host === "string" && value.host.trim() ? value.host.trim() : "127.0.0.1";
     const port = Number(value.port);
+    const worker = value.runtimeWorker;
+    const runtimeSetupPlanId = typeof worker?.runtimeSetupPlanId === "string" ? worker.runtimeSetupPlanId : undefined;
     if (!existingProjectId || !existingServer || !connectionName || !collectorId || !Number.isInteger(port) || port < 1 || port > 65_535) {
         throw new Error("Existing Gateway configuration is missing a valid project, server, connection, collector, host, or port. Preserve it and repair the setup in Advanced mode.");
     }
-    return { matches: existingProjectId === projectId && existingServer === server, projectId: existingProjectId, server: existingServer, connectionName, collectorId, host, port };
+    return { matches: existingProjectId === projectId && existingServer === server && runtimeSetupPlanId === setupPlanId, runtimeSetupPlanId, projectId: existingProjectId, server: existingServer, connectionName, collectorId, host, port };
 }
 async function assertGatewayStopped(requestFetch, host, port, oldCollectorId, oldProjectId, newProjectId) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.16",
+  "version": "0.20.17",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",