feat: add resource-only projects - #311

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/cli/src/commands/php.rs (1)

668-677: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated project_display_name helper in two command modules. Both files define a byte-identical mode-aware display helper; the shared root cause is a missing single crate-local definition, so future changes to display rules must be made twice.

• crates/cli/src/commands/php.rs#L668-L677: delete this copy and import the shared helper instead.
• crates/cli/src/commands/project.rs#L577-L586: promote this definition to pub(crate) (or move it to a shared commands helper module) as the single source of truth.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/cli/src/commands/php.rs` around lines 668 - 677, Remove the duplicate
project_display_name helper from crates/cli/src/commands/php.rs:668-677 and
import the shared implementation. In crates/cli/src/commands/project.rs:577-586,
expose project_display_name as pub(crate) so it is the single source of truth
for both command modules.

it/cli.rs (1)

716-725: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Add an explicit mode assertion alongside the snapshot.

The test name promises mode visibility, but verification is snapshot-only, so an accidental snapshot re-accept could silently drop the Mode column. A direct assert!(list.stdout.contains("resource-only")) / contains("served") pins the contract.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@it/cli.rs` around lines 716 - 725, Add explicit assertions near the existing
snapshot in the mode visibility test, checking that list.stdout contains both
"resource-only" and "served". Keep the snapshot assertion unchanged so the test
directly verifies the Mode column contract.

crates/cli/src/commands/project.rs (2)

757-760: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Second config read per Project.

project_list_status already parsed ProjectConfigFile for this project; reading it again here doubles the config I/O for every project in pv list. Consider returning the parsed config (or the env_file) from project_list_status instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/cli/src/commands/project.rs` around lines 757 - 760, Update
project_list_status and its caller so the existing ProjectConfigFile parse is
reused to obtain env_file, rather than calling ProjectConfigFile::read_from_root
again for each project. Return the parsed configuration or env_file from
project_list_status while preserving the current status behavior and optional
env_file handling.

---

402-429: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Collapse the repeated serves_http branches.

Four separate if serves_http { … } else { String::new() } arms restate the same condition. A single branch that builds the serving fields (or returns early with empty strings) reads better.

♻️ Suggested shape

-    ProjectEnvContext {
-        primary_hostname: if serves_http {
-            context.primary_hostname.unwrap_or_default()
-        } else {
-            String::new()
-        },
-        tls_ca_path: if serves_http {
-            paths.ca_certificate().to_string()
-        } else {
-            String::new()
-        },
-        tls_cert_path: if serves_http {
-            paths.project_tls_certificate(&project_id).to_string()
-        } else {
-            String::new()
-        },
-        tls_key_path: if serves_http {
-            paths.project_tls_private_key(&project_id).to_string()
-        } else {
-            String::new()
-        },
+    let (primary_hostname, tls_ca_path, tls_cert_path, tls_key_path) = if serves_http {
+        (
+            context.primary_hostname.unwrap_or_default(),
+            paths.ca_certificate().to_string(),
+            paths.project_tls_certificate(&project_id).to_string(),
+            paths.project_tls_private_key(&project_id).to_string(),
+        )
+    } else {
+        Default::default()
+    };
+
+    ProjectEnvContext {
+        primary_hostname,
+        tls_ca_path,
+        tls_cert_path,
+        tls_key_path,

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/cli/src/commands/project.rs` around lines 402 - 429, Refactor
project_env_context so the repeated serves_http condition is evaluated once when
constructing the serving-related fields. Build primary_hostname, tls_ca_path,
tls_cert_path, and tls_key_path together in the HTTP-serving branch, while
preserving empty-string values for all four fields when serves_http is false.

crates/cli/src/commands/status.rs (1)

307-325: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Avoid the magic "resource-only" string comparison.

display_name compares a serialized label, so any change to ProjectMode::as_str() silently degrades this to the hostname branch instead of failing to compile. Store the ProjectMode (serializing it via serde) or at minimum compare against ProjectMode::ResourceOnly.as_str().

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/cli/src/commands/status.rs` around lines 307 - 325, Update
ProjectStatus::display_name to avoid comparing mode against the hardcoded
"resource-only" literal; use the canonical ProjectMode::ResourceOnly.as_str()
value, or store ProjectMode directly with serde serialization and compare the
enum variant. Preserve the existing slug selection for resource-only projects
and hostname fallback for all others.

crates/cli/src/error.rs (1)

24-27: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Message repeats the selector and only offers one disambiguation path.

selector is interpolated twice ("selector acme matches slug acme"), and the hint only tells the user how to reach the hostname-matched Project — there is no stated way to target the slug-matched one. Consider tightening to something like: "{selector} matches a Project slug and the hostname {hostname} on different Projects; pass {hostname} for the served Project, or rename to disambiguate." (crates/cli/tests/project_env.rs Line 269 asserts on this text.)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/cli/src/error.rs` around lines 24 - 27, Update the
AmbiguousProjectSelector error message to avoid repeating selector and
explicitly describe both resolution paths: passing hostname `{hostname}` selects
the served Project, while renaming disambiguates the slug match. Preserve the
wording expected by the assertion in project_env.rs.

crates/cli/src/args.rs (1)

484-503: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider renaming the field to match its new meaning.

All three positionals now accept a slug or hostname, and crates/cli/src/commands/project.rs already binds them to selector locals (Line 162, Line 499). Keeping the field named hostname is misleading for future readers; renaming to project (or selector) would align the struct with the CLI contract.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/cli/src/args.rs` around lines 484 - 503, Rename the positional field
hostname to selector (or project) in the relevant argument structs, including
the unlink, open, and ProjectEnvArgs definitions, and update all command
consumers to use the new field name. Preserve the existing slug-or-hostname CLI
behavior and selector bindings in project command handling.

crates/config/src/parser.rs (1)

269-280: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Import Utf8Component at the top level instead of fully qualifying it.

As per coding guidelines, "PREFER top-level imports over local imports or fully qualified names in Rust".

♻️ Proposed change

-    for component in env_file.components() {
-        match component {
-            camino::Utf8Component::Normal(_) => depth += 1,
-            camino::Utf8Component::ParentDir if depth == 0 => {
-                return Err(ConfigError::EnvFileEscapesProject { env_file });
-            }
-            camino::Utf8Component::ParentDir => depth -= 1,
-            camino::Utf8Component::CurDir => {}
-            camino::Utf8Component::RootDir | camino::Utf8Component::Prefix(_) => {
-                return Err(ConfigError::AbsoluteEnvFile { env_file });
-            }
+    for component in env_file.components() {
+        match component {
+            Utf8Component::Normal(_) => depth += 1,
+            Utf8Component::ParentDir if depth == 0 => {
+                return Err(ConfigError::EnvFileEscapesProject { env_file });
+            }
+            Utf8Component::ParentDir => depth -= 1,
+            Utf8Component::CurDir => {}
+            Utf8Component::RootDir | Utf8Component::Prefix(_) => {
+                return Err(ConfigError::AbsoluteEnvFile { env_file });
+            }
         }
     }

with use camino::{Utf8Component, Utf8PathBuf}; at the top of the file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/config/src/parser.rs` around lines 269 - 280, Update the imports in
parser.rs to include Utf8Component alongside Utf8PathBuf, then replace the fully
qualified camino::Utf8Component references in the env_file component match with
Utf8Component.

Source: Coding guidelines

crates/state/src/database.rs (1)

3431-3502: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Slug generation looks correct; one note on the .invalid sentinel check.

base[..base_length] is byte-slicing, which is safe here only because project_slug_base emits ASCII alphanumerics and hyphens — worth a short comment so a future change to the character set doesn't introduce a char-boundary panic. is_internal_project_hostname matching any .invalid suffix is safe given hostnames are validated as .test.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/state/src/database.rs` around lines 3431 - 3502, Add a brief comment
at the byte-slice in generate_project_slug explaining that base is ASCII-only
because project_slug_base restricts generated characters to alphanumerics and
hyphens, making byte indexing safe. Do not alter slug generation or the
is_internal_project_hostname behavior.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/config/src/parser.rs (1)

267-277: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Import Utf8Component at module scope.

Replace the fully qualified match patterns with a top-level use camino::Utf8Component;.

As per coding guidelines, **/*.rs: “PREFER top-level imports over local imports or fully qualified names in Rust”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/config/src/parser.rs` around lines 267 - 277, Update the parser module
imports to add a top-level use of camino::Utf8Component, then replace the fully
qualified camino::Utf8Component variants in the env_file component match with
Utf8Component variants. Preserve the existing path validation behavior and error
handling.

Source: Coding guidelines

crates/daemon/src/project_env.rs (1)

197-217: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer top-level imports over fully-qualified paths.

crate::managed_resources::reconcile_project_resources_with_catalog_and_progress / ..._with_progress are called with fully-qualified paths here rather than imported at the top of the file.

As per coding guidelines, "PREFER top-level imports over local imports or fully qualified names in Rust."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/daemon/src/project_env.rs` around lines 197 - 217, Import
reconcile_project_resources_with_catalog_and_progress and
reconcile_project_resources_with_progress at the module level, then call both
functions directly in the resource_result branch instead of using fully
qualified crate::managed_resources paths.

Source: Coding guidelines

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crates/daemon/src/project_env.rs (1)

578-578: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

desired_php_track: None is silently overwritten by the state layer.

Database::finalize_project_reconciliation sets input.link.desired_php_track from php_runtime (crates/state/src/database.rs:868-871), so this None never reaches the database. A brief comment would prevent a reader from concluding the track is cleared here.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/daemon/src/project_env.rs` at line 578, Add a brief explanatory
comment directly above desired_php_track: None in the relevant project
reconciliation input, noting that the state layer’s
Database::finalize_project_reconciliation overwrites it from php_runtime, so
this value does not clear the persisted track.

crates/state/src/database.rs (1)

1986-1990: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Naming reads as "outside a transaction" while it is also used inside one.

replace_project_php_runtime_in_connection is called with &transaction at Line 903 (via Deref<Target = Connection>), which is correct, but the _in_connection suffix conflicts with the _in_transaction convention used everywhere else in this module and obscures that the write joins the caller's transaction. Consider replace_project_php_runtime_in(...) or a short doc comment stating it participates in any active transaction.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/state/src/database.rs` around lines 1986 - 1990, Rename
replace_project_php_runtime_in_connection to replace_project_php_runtime_in to
reflect that it operates on the caller-provided database handle and can
participate in an active transaction. Update all call sites, including the
invocation through the transaction at Line 903, while preserving the existing
behavior.

crates/daemon/tests/project_env_reconciliation.rs (1)

213-214: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Permission restore is skipped if reconciliation returns Err.

run_project_reconciliation(...)? on Line 213 propagates before set_file_mode(&locked_directory, 0o700), leaving a 0o500 directory behind and potentially failing tempdir cleanup. Capturing the result first and restoring the mode before unwrapping keeps failures readable.

♻️ Restore before propagating

-    let lines = run_project_reconciliation(&paths, &project).await?;
-    set_file_mode(&locked_directory, 0o700)?;
+    let reconciliation = run_project_reconciliation(&paths, &project).await;
+    set_file_mode(&locked_directory, 0o700)?;
+    let lines = reconciliation?;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/daemon/tests/project_env_reconciliation.rs` around lines 213 - 214,
Update the test flow around run_project_reconciliation to capture its result
instead of propagating immediately, restore locked_directory permissions with
set_file_mode(..., 0o700), then unwrap or propagate the captured reconciliation
result. Preserve the existing successful lines handling and ensure permission
restoration occurs on both success and error paths.