@arcote.tech/arc-cli 0.6.0 → 0.6.1

package/dist/index.js

@@ -27452,7 +27452,7 @@ function resolveWorkspace() {
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
   ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
-  if (packages.length === 0) {
+  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
     err("No workspace packages found.");
     process.exit(1);
   }
@@ -27821,7 +27821,7 @@ async function platformBuild(opts = {}) {
 
 // src/commands/platform-deploy.ts
 import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { dirname as dirname7, join as join18 } from "path";
 
 // src/deploy/bootstrap.ts
 import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
@@ -28510,17 +28510,19 @@ async function streamToString(stream2) {
   return new Response(stream2).text();
 }
 function baseSshArgs(target) {
-  const args = [
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
+  return [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-p",
     String(target.port)
   ];
-  if (target.sshKey)
-    args.push("-i", target.sshKey);
-  return args;
 }
 async function sshExec(target, cmd, opts = {}) {
   const args = [
@@ -28574,16 +28576,19 @@ async function waitForSsh(target, opts = {}) {
   throw new Error(`Timed out waiting for SSH on ${target.user}@${target.host}`);
 }
 async function scpUpload(target, localPath, remotePath) {
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-P",
     String(target.port)
   ];
-  if (target.sshKey)
-    args.push("-i", target.sshKey);
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
   const proc2 = spawn3({ cmd: ["scp", ...args], stderr: "pipe" });
   const [stderr, exitCode] = await Promise.all([
@@ -29666,13 +29671,23 @@ async function platformDeploy(envArg, options = {}) {
   }
 }
 function readCliVersion() {
+  const candidates = [];
+  const entry = process.argv[1];
+  if (entry) {
+    candidates.push(join18(dirname7(entry), "..", "package.json"));
+  }
   try {
-    const pkgPath = join18(import.meta.dir, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
-    return pkg.version ?? "unknown";
-  } catch {
-    return "unknown";
+    candidates.push(join18(import.meta.dir, "..", "..", "package.json"));
+  } catch {}
+  for (const path4 of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync14(path4, "utf-8"));
+      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
+        return pkg.version;
+      }
+    } catch {}
   }
+  return "unknown";
 }
 async function hashDeployConfig(rootDir) {
   const p2 = join18(rootDir, "deploy.arc.json");
@@ -31147,7 +31162,7 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync15
 } from "fs";
-import { dirname as dirname7, join as join19, normalize as normalize2, resolve } from "path";
+import { dirname as dirname8, join as join19, normalize as normalize2, resolve } from "path";
 function createDeployApiHandler(opts) {
   return async (req, url, ctx) => {
     const p3 = url.pathname;
@@ -31290,7 +31305,7 @@ function createDeployApiHandler(opts) {
           if (existsSync15(dst)) {
             rmSync4(dst, { recursive: true, force: true });
           }
-          mkdirSync14(dirname7(dst), { recursive: true });
+          mkdirSync14(dirname8(dst), { recursive: true });
           cpSync(src2, dst, { recursive: true });
         }
       }
@@ -31328,7 +31343,7 @@ async function writeField(targetDir, name, file) {
   if (!full.startsWith(safeRoot + "/") && full !== safeRoot) {
     throw new Error(`Path traversal rejected: ${name}`);
   }
-  mkdirSync14(dirname7(full), { recursive: true });
+  mkdirSync14(dirname8(full), { recursive: true });
   writeFileSync15(full, Buffer.from(await file.arrayBuffer()));
 }
 function sanitizeName2(name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,12 +12,12 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.6.0",
-    "@arcote.tech/arc-ds": "^0.6.0",
-    "@arcote.tech/arc-react": "^0.6.0",
-    "@arcote.tech/arc-host": "^0.6.0",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.6.0",
-    "@arcote.tech/platform": "^0.6.0",
+    "@arcote.tech/arc": "^0.6.1",
+    "@arcote.tech/arc-ds": "^0.6.1",
+    "@arcote.tech/arc-react": "^0.6.1",
+    "@arcote.tech/arc-host": "^0.6.1",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.6.1",
+    "@arcote.tech/platform": "^0.6.1",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/runtime/entrypoint.sh

@@ -23,5 +23,36 @@ if [ ! -f "$CLI_BIN" ]; then
   bun add "@arcote.tech/arc-cli@${ARC_CLI_VERSION}"
 fi
 
+# resolveWorkspace() in arc platform start exits hard if /app has no
+# package.json. In runtime mode the workspace lives in /app/.arc/platform/
+# but the CLI still walks up from cwd. Drop a stub manifest here so the
+# walk-up resolves to /app/.arc/platform (or to a stable "no workspace"
+# state in pre-deploy).
+if [ ! -f /app/package.json ]; then
+  cat > /app/package.json <<'EOF'
+{
+  "name": "arc-runtime",
+  "private": true,
+  "type": "module",
+  "workspaces": []
+}
+EOF
+fi
+
+# Make /app/.arc/platform the working directory — that's where deployed user
+# code, deps and node_modules live (volume mount).
+mkdir -p /app/.arc/platform
+cd /app/.arc/platform
+if [ ! -f package.json ]; then
+  cat > package.json <<'EOF'
+{
+  "name": "arc-platform-runtime",
+  "private": true,
+  "type": "module",
+  "workspaces": []
+}
+EOF
+fi
+
 echo "[entrypoint] starting arc platform (cli=${ARC_CLI_VERSION})"
 exec bun run "$CLI_BIN" platform start

package/src/commands/platform-deploy.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { dirname, join } from "path";
 import { bootstrap } from "../deploy/bootstrap";
 import {
   deployConfigExists,
@@ -125,13 +125,29 @@ export async function platformDeploy(
 // ---------------------------------------------------------------------------
 
 function readCliVersion(): string {
+  // import.meta.dir gets mangled by `bun build` — derive from process.argv[1]
+  // (the bundled dist/index.js path) which is stable across run modes.
+  const candidates: string[] = [];
+  const entry = process.argv[1];
+  if (entry) {
+    candidates.push(join(dirname(entry), "..", "package.json"));
+  }
   try {
-    const pkgPath = join(import.meta.dir, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    return pkg.version ?? "unknown";
+    candidates.push(join(import.meta.dir, "..", "..", "package.json"));
   } catch {
-    return "unknown";
+    // import.meta.dir unavailable
+  }
+  for (const path of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync(path, "utf-8"));
+      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
+        return pkg.version as string;
+      }
+    } catch {
+      // Try next
+    }
   }
+  return "unknown";
 }
 
 async function hashDeployConfig(rootDir: string): Promise<string> {

package/src/deploy/ssh.ts

@@ -21,16 +21,22 @@ export interface SshExecResult {
 }
 
 function baseSshArgs(target: DeployTarget): string[] {
-  const args = [
+  // IdentitiesOnly=yes pins auth to the explicit key. Without it ssh-agent
+  // offers every loaded identity and trips MaxAuthTries on hardened sshd
+  // (ansible's sshd hardening + fail2ban lowers the threshold).
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
+  return [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-p",
     String(target.port),
   ];
-  if (target.sshKey) args.push("-i", target.sshKey);
-  return args;
 }
 
 /**
@@ -115,15 +121,19 @@ export async function scpUpload(
   localPath: string,
   remotePath: string,
 ): Promise<void> {
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-P",
     String(target.port),
   ];
-  if (target.sshKey) args.push("-i", target.sshKey);
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
 
   const proc = spawn({ cmd: ["scp", ...args], stderr: "pipe" });

package/src/platform/shared.ts

@@ -97,7 +97,10 @@ export function resolveWorkspace(): WorkspaceInfo {
     `Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`,
   );
 
-  if (packages.length === 0) {
+  // Empty package list is allowed in pre-deploy runtime mode (container with
+  // freshly-mounted volume, no user code pushed yet). The CLI entry that
+  // forbids this (arc platform build/dev) checks explicitly.
+  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
     err("No workspace packages found.");
     process.exit(1);
   }