Promote Alpha to Main

.env.example

@@ -75,6 +75,17 @@
 # HUABU_BASIC_AUTH_USER=
 # HUABU_BASIC_AUTH_PASS=
 
+# ── Personal Alpha Canary redeployment ──
+# Source-run `pnpm start:web` only. When enabled, the authenticated owner sees
+# Settings controls that persist an exact branch from fixed remote origin,
+# defaulting to alpha when unconfigured, and can run
+# `scripts/start-huabu.sh <branch> --non-interactive` on this host. The script
+# updates the checkout in place and may leave the service offline on failure.
+# This is a personal-development convenience, not a production deployer.
+# HUABU_CANARY_REDEPLOY_ENABLED=1
+# Non-interactive redeployment waits up to 300 seconds by default.
+# HUABU_CANARY_READINESS_TIMEOUT_SECONDS=300
+
 # ── Storage (restart required) ──
 # Structured records: disk (default), sqlite or postgres. The two axes are
 # independent, so every pairing of an implemented record backend with an

README.md

@@ -94,6 +94,8 @@ Then run `pnpm start:web`. Huabu rejects a non-loopback bind when allowed hosts
 
 Huabu currently serves HTTP. Use a trusted private network or terminate HTTPS with deployment infrastructure such as Caddy, Nginx, Tailscale Serve, or a cloud load balancer. Do not put a Basic Auth deployment on an untrusted network without transport encryption.
 
+For a personal Alpha Canary started from a repository checkout, set `HUABU_CANARY_REDEPLOY_ENABLED=1` before `pnpm start:web`. The authenticated owner can configure an exact branch from fixed remote `origin` in Settings, compare it with the running commit, and invoke the checked-in `scripts/start-huabu.sh <branch> --non-interactive` redeployment instead of connecting through SSH. An empty configuration uses `alpha`. This helper updates the checkout in place and does not provide rollback or service recovery; see [Alpha Canary deployment](docs/architecture/canary-deployment.md).
+
 ### Local quality checks (optional)
 
 The repository ships opt-in git hooks that give you fast feedback before

apps/server/src/app.ts

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-import { existsSync, unlinkSync } from 'node:fs';
+import { unlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -21,15 +21,14 @@ import {
   acpAgentletRoutes,
   acpProfilesRoutes,
   acpThreadsRoutes,
+  connectionTokenRoutes,
   externalAgentRuntimeConfigRoutes,
+  getExternalAgentRuntimeConfig,
   getAgentProfileRegistry,
-  getSupervisedAgentletId,
   installAcpProfileCachePort,
   mountAgenetes,
   resolveDaemonEntry,
 } from './modules/agent/acp/index.js';
-import { buildLegacyCommandProfiles } from './modules/agent/acp/legacy-profile-migration.js';
-import { listProfiles as listLegacyAcpProfiles } from './modules/agent/acp/profile-store.js';
 import { initializeAgentDefaults } from './modules/agent/agent-defaults.js';
 import agentDefaultsRoutes from './modules/agent/agent-defaults.route.js';
 import agentRoutes from './modules/agent/agent.route.js';
@@ -46,6 +45,7 @@ import integrationsRoutes from './modules/integrations/integrations.route.js';
 import interactiveViewRoutes from './modules/interactive-view/interactive-view.route.js';
 import { isPublicRfsSkillBootstrapRequest } from './modules/remote_fs/public-skill.js';
 import rfsRoutes from './modules/remote_fs/rfs.route.js';
+import canaryRedeployRoutes from './modules/security/canary-redeploy.route.js';
 import { createCorsOptions } from './modules/security/cors.js';
 import deploymentRoutes from './modules/security/deployment.route.js';
 import {
@@ -258,6 +258,9 @@ app.register(artifactRoute, { prefix: '/api/canvas' });
 app.register(llmRoutes, { prefix: '/api/llm' });
 app.register(integrationsRoutes, { prefix: '/api/integrations' });
 app.register(deploymentRoutes, { prefix: '/api/deployment' });
+app.register(canaryRedeployRoutes, {
+  prefix: '/api/deployment/canary',
+});
 app.register(interactiveViewRoutes, { prefix: '/api/interactive-views' });
 app.register(skillsRoutes, { prefix: '/api/skills' });
 app.register(workspaceRoutes, { prefix: '/api/workspace' });
@@ -297,6 +300,7 @@ const agentletGateway = mountAgenetes(app, {
   connectionToken: getConnectionToken(),
   dataDir: getDataDir(),
   daemonEntryPath: resolveDaemonEntry() ?? '',
+  getMaxAgents: () => getExternalAgentRuntimeConfig().maxAgents,
   // Host-namespaced env isolation: the agentlet daemon and every external
   // agent it spawns are host-agnostic and must receive their Huabu
   // coordinates only through explicit injection (per-agent reachback env),
@@ -310,15 +314,7 @@ const agentletGateway = mountAgenetes(app, {
   profiles: {
     storageDir: join(getDataDir(), 'agent-profiles'),
     legacyStorageDir: join(getDataDir(), 'agent-team'),
-    legacyCommandProfiles: existsSync(
-      join(getDataDir(), 'agent-profiles', 'registry.json'),
-    )
-      ? []
-      : buildLegacyCommandProfiles(
-          listLegacyAcpProfiles(),
-          getSupervisedAgentletId(),
-          process.cwd(),
-        ),
+    legacyCommandProfiles: [],
   },
 });
 let unregisterHarnessDiscovery: (() => void) | undefined;
@@ -363,6 +359,7 @@ app.register(acpAgentletRoutes, { prefix: '/api/acp' });
 app.register(acpAgentCliRoutes, { prefix: '/api/acp' });
 app.register(acpThreadsRoutes, { prefix: '/api/acp' });
 app.register(externalAgentRuntimeConfigRoutes, { prefix: '/api/acp' });
+app.register(connectionTokenRoutes, { prefix: '/api/acp' });
 app.log.info(
   '[acp] agentlet Gateway mounted — embedded agentlet will start on server ready',
 );

apps/server/src/connection-token.test.ts

@@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  persisted: null as string | null,
+  writable: true,
+  setSecret: vi.fn(),
+  setDaemonToken: vi.fn(),
+  restart: vi.fn(),
+  disconnect: vi.fn(),
+  maxAgents: 7,
+}));
+
+vi.mock('./security/secret-store.js', () => ({
+  getPersistedSecret: () => mocks.persisted,
+  isSecretStoreWritable: () => mocks.writable,
+  setSecret: mocks.setSecret,
+}));
+
+vi.mock('./modules/agent/acp/runtime-config.js', () => ({
+  getExternalAgentRuntimeConfig: () => ({
+    idleTimeoutSecs: 600,
+    maxAgents: mocks.maxAgents,
+  }),
+}));
+
+vi.mock('@agenetes/agentlet-host', () => ({
+  getDaemonAuth: () => ({ setDaemonToken: mocks.setDaemonToken }),
+  getDaemonSupervisor: () => ({ restart: mocks.restart }),
+  getAgentletGateway: () => ({
+    getAgentlets: () => [{ disconnect: mocks.disconnect }],
+  }),
+}));
+
+import {
+  _resetConnectionTokenForTests,
+  buildAgentletConnectionCommand,
+  getConnectionToken,
+  initializeConnectionToken,
+  setConnectionToken,
+} from './connection-token.js';
+
+beforeEach(() => {
+  _resetConnectionTokenForTests();
+  mocks.persisted = null;
+  mocks.writable = true;
+  mocks.setSecret.mockResolvedValue(undefined);
+  vi.clearAllMocks();
+  delete process.env.HUABU_CONNECTION_TOKEN;
+});
+
+afterEach(() => {
+  delete process.env.HUABU_CONNECTION_TOKEN;
+});
+
+describe('connection token resolution', () => {
+  it('prefers persisted, environment, then one generated fallback', () => {
+    mocks.persisted = 'stored-token';
+    expect(initializeConnectionToken()).toEqual({
+      source: 'stored',
+      writable: true,
+    });
+    expect(getConnectionToken()).toBe('stored-token');
+
+    _resetConnectionTokenForTests();
+    mocks.persisted = null;
+    process.env.HUABU_CONNECTION_TOKEN = 'environment-token';
+    expect(initializeConnectionToken().source).toBe('environment');
+    expect(getConnectionToken()).toBe('environment-token');
+
+    _resetConnectionTokenForTests();
+    delete process.env.HUABU_CONNECTION_TOKEN;
+    expect(initializeConnectionToken().source).toBe('generated');
+    const generated = getConnectionToken();
+    expect(generated).toMatch(/^[0-9a-f]{64}$/);
+    expect(getConnectionToken()).toBe(generated);
+  });
+
+  it('persists before switching auth and restarting connected agentlets', async () => {
+    initializeConnectionToken();
+    await setConnectionToken('new-token');
+
+    expect(mocks.setSecret).toHaveBeenCalledWith(
+      'integration:agentlet:connection-token',
+      'new-token',
+    );
+    expect(mocks.setDaemonToken).toHaveBeenLastCalledWith('new-token');
+    expect(mocks.disconnect).toHaveBeenCalledWith('connection_token_changed');
+    expect(mocks.restart).toHaveBeenCalledOnce();
+    expect(getConnectionToken()).toBe('new-token');
+  });
+
+  it('keeps the active token when persistence fails', async () => {
+    process.env.HUABU_CONNECTION_TOKEN = 'old-token';
+    initializeConnectionToken();
+    mocks.setSecret.mockRejectedValueOnce(new Error('write failed'));
+
+    await expect(setConnectionToken('new-token')).rejects.toThrow(
+      'write failed',
+    );
+    expect(getConnectionToken()).toBe('old-token');
+    expect(mocks.disconnect).not.toHaveBeenCalled();
+    expect(mocks.restart).not.toHaveBeenCalled();
+  });
+
+  it('clears to the environment fallback', async () => {
+    mocks.persisted = 'stored-token';
+    process.env.HUABU_CONNECTION_TOKEN = 'environment-token';
+    initializeConnectionToken();
+
+    await setConnectionToken(null);
+
+    expect(getConnectionToken()).toBe('environment-token');
+    expect(mocks.setDaemonToken).toHaveBeenLastCalledWith('environment-token');
+  });
+});
+
+describe('Agentlet connection command', () => {
+  it('derives secure and insecure endpoints and reports warnings', () => {
+    process.env.HUABU_CONNECTION_TOKEN = "token'quoted";
+    initializeConnectionToken();
+
+    expect(buildAgentletConnectionCommand('https://huabu.example.com')).toEqual(
+      {
+        command:
+          "agentlet daemon --server 'wss://huabu.example.com/api/acp/agent' --max-agents 7 --token 'token'\"'\"'quoted'",
+        warnings: [],
+      },
+    );
+    expect(buildAgentletConnectionCommand('http://localhost:3001')).toEqual({
+      command:
+        "agentlet daemon --server 'ws://localhost:3001/api/acp/agent' --max-agents 7 --token 'token'\"'\"'quoted' --allow-insecure",
+      warnings: ['loopback', 'insecure'],
+    });
+  });
+
+  it('rejects origins with paths or unsupported protocols', () => {
+    expect(() =>
+      buildAgentletConnectionCommand('https://example.com/path'),
+    ).toThrow('Origin must be an HTTP(S) origin without a path');
+    expect(() => buildAgentletConnectionCommand('file:///tmp/huabu')).toThrow(
+      'Origin must be an HTTP(S) origin without a path',
+    );
+  });
+});