fix: switch monitor root via sentinel yaml

scripts/src/hwlab-node-web-sentinel-resolver.ts

@@ -18,18 +18,57 @@ export interface WebProbeSentinelRegistryRow {
   readonly id: string;
   readonly enabled: boolean;
   readonly configRef: string;
+  readonly monitorRoot: boolean;
+  readonly publicBaseUrl?: string;
+  readonly routePrefix?: string;
 }
 
 export function webProbeSentinelRegistryRows(spec: HwlabRuntimeLaneSpec): readonly WebProbeSentinelRegistryRow[] {
   const registry = spec.observability.webProbe?.sentinels;
-  if (registry !== undefined) return registry.map((item) => ({ id: item.id, enabled: item.enabled, configRef: item.configRef }));
+  if (registry !== undefined) return registry.map((item) => sentinelRegistryRow(spec, item.id, item.enabled, item.configRef));
   const legacy = spec.observability.webProbe?.sentinel;
   if (legacy === undefined) return [];
-  return [{
-    id: "workbench-dsflash-go-tool-call-10x",
-    enabled: legacy.enabled,
-    configRef: `config/hwlab-node-lanes.yaml#lanes.${spec.lane}.targets.${spec.nodeId}.observability.webProbe.sentinel`,
-  }];
+  return [sentinelRegistryRow(
+    spec,
+    "workbench-dsflash-go-tool-call-10x",
+    legacy.enabled,
+    `config/hwlab-node-lanes.yaml#lanes.${spec.lane}.targets.${spec.nodeId}.observability.webProbe.sentinel`,
+  )];
+}
+
+export function effectiveWebProbeSentinelPublicExposure(spec: HwlabRuntimeLaneSpec, sentinelId: string, publicExposure: Record<string, unknown>): Record<string, unknown> {
+  const monitorRoot = spec.observability.webProbe?.monitorRoot;
+  if (monitorRoot === undefined || monitorRoot.sentinelId !== sentinelId) return publicExposure;
+  if (!monitorRoot.enabled) {
+    return {
+      ...publicExposure,
+      monitorRoot: {
+        enabled: false,
+        sentinelId,
+        caddyManagedBlockOwner: monitorRoot.caddyManagedBlockOwner,
+        valuesRedacted: true,
+      },
+    };
+  }
+  const caddy = isRecord(publicExposure.caddy) ? publicExposure.caddy : {};
+  return {
+    ...publicExposure,
+    publicBaseUrl: monitorRoot.publicBaseUrl,
+    routePrefix: monitorRoot.routePrefix,
+    caddy: {
+      ...caddy,
+      managedBlockOwner: monitorRoot.caddyManagedBlockOwner,
+      rootOrder: "active",
+    },
+    monitorRoot: {
+      enabled: true,
+      sentinelId,
+      publicBaseUrl: monitorRoot.publicBaseUrl,
+      routePrefix: monitorRoot.routePrefix,
+      caddyManagedBlockOwner: monitorRoot.caddyManagedBlockOwner,
+      valuesRedacted: true,
+    },
+  };
 }
 
 export function resolveWebProbeSentinel(spec: HwlabRuntimeLaneSpec, sentinelId: string | null | undefined): ResolvedWebProbeSentinel {
@@ -87,6 +126,18 @@ function resolveRegistrySentinel(spec: HwlabRuntimeLaneSpec, registry: readonly
   };
 }
 
+function sentinelRegistryRow(spec: HwlabRuntimeLaneSpec, id: string, enabled: boolean, configRef: string): WebProbeSentinelRegistryRow {
+  const monitorRoot = spec.observability.webProbe?.monitorRoot;
+  const isMonitorRoot = monitorRoot?.enabled === true && monitorRoot.sentinelId === id;
+  return {
+    id,
+    enabled,
+    configRef,
+    monitorRoot: isMonitorRoot,
+    ...(isMonitorRoot ? { publicBaseUrl: monitorRoot.publicBaseUrl, routePrefix: monitorRoot.routePrefix } : {}),
+  };
+}
+
 function normalizeSentinelConfigRefs(target: Record<string, unknown>, ref: string): Record<HwlabRuntimeWebProbeSentinelConfigRefKey, string> {
   const rawRefs = recordAt(target, "configRefs");
   const normalized: Record<string, string> = {};