fix(integrations): pick up changed backend code on reload without an app-api restart

reloadIntegrations() fully tears down and re-imports every integration, but
backendEntryImportSpecifier only cache-busted the dynamic import in dev — in
prod it returned the process-lifetime-cached ESM module, so a store update of an
integration whose bundle path is unchanged silently kept running the old code
until app-api restarted (the same silent-staleness class as the GHCR pull bug).

Cache-bust on the entry file's mtime+size in prod too. Keying on mtime+size
means an unchanged file reuses its URL (cached module, no leak); only a changed
file mints a new URL, so the unavoidable (ESM modules are never GC'd) per-import
leak is bounded to one tiny module per actual code change — not per reload — and
credential-rotation reloads (no code change) leak nothing. The dev-only
/api/integrations/reload endpoint stays dev-gated.

Adds a NODE_ENV=production regression test (mutates a community bundle between
init and reload, asserts the new code loads).

Author: Medformatik

apps/api/src/integration-host.test.ts

@@ -6,6 +6,8 @@
  * All tests exercise only the public API; no internals are imported or patched.
  */
 
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import Fastify, { type FastifyInstance } from "fastify";
@@ -339,3 +341,58 @@ describe("shutdownIntegrations", () => {
     expect(getAllIntegrations()).toHaveLength(0);
   });
 });
+
+// Regression guard for the prod cache-bust: a store update of a community
+// integration whose bundle path is unchanged must take effect on reload WITHOUT
+// restarting app-api. Runs under NODE_ENV=production specifically — the old
+// behavior skipped cache-busting in prod, so the re-import returned the stale
+// module and this test would fail.
+describe("reloadIntegrations — re-imports changed backend code in production", () => {
+  it("picks up a rewritten community bundle on reload (no restart)", async () => {
+    const prevEnv = process.env.NODE_ENV;
+    const parent = mkdtempSync(join(tmpdir(), "omx-reload-probe-"));
+    const intgDir = join(parent, "reload-probe");
+    const bundleDir = join(intgDir, "dist", "backend");
+    mkdirSync(bundleDir, { recursive: true });
+    writeFileSync(
+      join(intgDir, "manifest.json"),
+      JSON.stringify({
+        id: "reload-probe",
+        version: "1.0.0",
+        license: "MIT",
+        domains: ["knowledge"],
+        backend: { routes: false },
+        quality: "community-verified",
+      }),
+    );
+    const bundleFile = join(bundleDir, "index.mjs");
+    // Marker is set at MODULE EVALUATION time, so it only changes if the module
+    // is actually re-imported (a fresh URL) — not merely re-`setup()`-ed.
+    const writeBundle = (marker: string) =>
+      writeFileSync(
+        bundleFile,
+        `globalThis.__reloadProbeVersion = ${JSON.stringify(marker)};\nexport function setup() {}\n`,
+      );
+
+    const app = makeApp();
+    const g = globalThis as Record<string, unknown>;
+    try {
+      process.env.NODE_ENV = "production";
+
+      writeBundle("v1");
+      await initIntegrations(app, [{ directory: parent, isBuiltIn: false }]);
+      expect(g.__reloadProbeVersion).toBe("v1");
+
+      // Rewrite the bundle. Different content AND length so the mtime+size key
+      // changes even on a coarse-mtime filesystem.
+      writeBundle("v2-rewritten-and-longer");
+      await reloadIntegrations();
+      expect(g.__reloadProbeVersion).toBe("v2-rewritten-and-longer");
+    } finally {
+      if (prevEnv === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = prevEnv;
+      rmSync(parent, { recursive: true, force: true });
+      delete g.__reloadProbeVersion;
+    }
+  });
+});

apps/api/src/integration-host.ts

@@ -228,21 +228,29 @@ function resolveBackendEntryPoint(directory: string, isBuiltIn: boolean): string
   return existsSync(jsModulePath) ? jsModulePath : null;
 }
 
-// In dev we mtime-bust so editing `index.ts` and hitting `/api/integrations/reload`
-// picks up the change. In prod we never cache-bust — ESM `import()` is
-// process-lifetime cached, so re-importing the same file URL would return the
-// old module *and* leak nothing. Production updates require restarting app-api
-// to load fresh backend code; the install/update job handlers say so in their
-// logs.
+// Cache-bust the dynamic import by the entry file's mtime+size so a reload
+// (`reloadIntegrations` — fired by extension install/update and credential
+// set/delete) picks up CHANGED backend code WITHOUT restarting app-api. ESM
+// `import()` is keyed by URL and process-lifetime cached, so re-importing the
+// same file URL returns the stale module — which is why a store update of an
+// integration whose bundle path is unchanged otherwise silently keeps running
+// the old code until a restart.
+//
+// Keying the bust on mtime+size (in dev AND prod) means an UNCHANGED file
+// reuses the same URL → the cached module is returned, no new module is created;
+// only a CHANGED file mints a new URL → a fresh import. The cost is that ESM
+// modules are never garbage-collected, so each new URL leaks its (tiny,
+// self-contained) module graph for the process lifetime — but the leak is now
+// bounded to one module per actual code change (reloads with no code change,
+// e.g. a credential rotation, reuse the cached URL and leak nothing), which over
+// a process lifetime is negligible and well worth not requiring a restart.
 function backendEntryImportSpecifier(entryPoint: string): string {
   const url = pathToFileURL(entryPoint);
-  if (process.env.NODE_ENV !== "production") {
-    try {
-      const stats = statSync(entryPoint);
-      url.searchParams.set("v", `${stats.mtimeMs}-${stats.size}`);
-    } catch {
-      url.searchParams.set("v", Date.now().toString());
-    }
+  try {
+    const stats = statSync(entryPoint);
+    url.searchParams.set("v", `${stats.mtimeMs}-${stats.size}`);
+  } catch {
+    url.searchParams.set("v", Date.now().toString());
   }
   return url.href;
 }