@arcote.tech/arc-cli 0.6.0 → 0.6.2

package/dist/index.js

@@ -26446,7 +26446,7 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname6, join as join12 } from "path";
 
 // src/builder/module-builder.ts
@@ -27254,7 +27254,7 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
 
 // src/builder/dependency-collector.ts
 import { createHash } from "crypto";
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { basename as basename3, join as join10 } from "path";
 var FRAMEWORK_PEERS = [
   "@arcote.tech/arc",
@@ -27276,16 +27276,22 @@ function collectFrameworkDeps(arcDir, rootDir, packages) {
   const manifestPath = join10(arcDir, "package.json");
   writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
 `);
-  const rootLock = join10(rootDir, "bun.lock");
   const targetLock = join10(arcDir, "bun.lock");
-  if (existsSync9(rootLock)) {
-    copyFileSync(rootLock, targetLock);
-  }
-  const hash = sha256OfFiles2([manifestPath, targetLock]);
+  writeFileSync8(targetLock, "");
+  const hash = sha256ConcatHex([manifestPath, targetLock]);
   writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
 `);
   return { hash, manifestPath };
 }
+function sha256ConcatHex(paths) {
+  const hash = createHash("sha256");
+  for (const p of paths) {
+    if (existsSync9(p)) {
+      hash.update(readFileSync9(p));
+    }
+  }
+  return hash.digest("hex");
+}
 function collectModuleDeps(arcDir, pkg) {
   const safeName = basename3(pkg.path);
   const moduleDir = join10(arcDir, "modules", safeName);
@@ -27452,7 +27458,7 @@ function resolveWorkspace() {
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
   ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
-  if (packages.length === 0) {
+  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
     err("No workspace packages found.");
     process.exit(1);
   }
@@ -27613,7 +27619,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
   for (const asset of assets) {
     const dest = join12(ws.assetsDir, asset.to);
     mkdirSync10(dirname6(dest), { recursive: true });
-    copyFileSync2(asset.src, dest);
+    copyFileSync(asset.src, dest);
     outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
@@ -27821,7 +27827,7 @@ async function platformBuild(opts = {}) {
 
 // src/commands/platform-deploy.ts
 import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { dirname as dirname7, join as join18 } from "path";
 
 // src/deploy/bootstrap.ts
 import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
@@ -28510,17 +28516,19 @@ async function streamToString(stream2) {
   return new Response(stream2).text();
 }
 function baseSshArgs(target) {
-  const args = [
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
+  return [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-p",
     String(target.port)
   ];
-  if (target.sshKey)
-    args.push("-i", target.sshKey);
-  return args;
 }
 async function sshExec(target, cmd, opts = {}) {
   const args = [
@@ -28574,16 +28582,19 @@ async function waitForSsh(target, opts = {}) {
   throw new Error(`Timed out waiting for SSH on ${target.user}@${target.host}`);
 }
 async function scpUpload(target, localPath, remotePath) {
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-P",
     String(target.port)
   ];
-  if (target.sshKey)
-    args.push("-i", target.sshKey);
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
   const proc2 = spawn3({ cmd: ["scp", ...args], stderr: "pipe" });
   const [stderr, exitCode] = await Promise.all([
@@ -28781,10 +28792,7 @@ async function syncEnv(inputs) {
       console.log("[arc] Pushing framework deps...");
       const form = new FormData;
       form.append("package.json", new Blob([readFileSync13(join17(ws.arcDir, "package.json"))]), "package.json");
-      const lockPath = join17(ws.arcDir, "bun.lock");
-      if (existsSync13(lockPath)) {
-        form.append("bun.lock", new Blob([readFileSync13(lockPath)]), "bun.lock");
-      }
+      form.append("bun.lock", new Blob([""]), "bun.lock");
       const res = await fetch(`${base2()}/api/deploy/framework`, {
         method: "POST",
         body: form
@@ -29666,13 +29674,23 @@ async function platformDeploy(envArg, options = {}) {
   }
 }
 function readCliVersion() {
+  const candidates = [];
+  const entry = process.argv[1];
+  if (entry) {
+    candidates.push(join18(dirname7(entry), "..", "package.json"));
+  }
   try {
-    const pkgPath = join18(import.meta.dir, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
-    return pkg.version ?? "unknown";
-  } catch {
-    return "unknown";
+    candidates.push(join18(import.meta.dir, "..", "..", "package.json"));
+  } catch {}
+  for (const path4 of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync14(path4, "utf-8"));
+      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
+        return pkg.version;
+      }
+    } catch {}
   }
+  return "unknown";
 }
 async function hashDeployConfig(rootDir) {
   const p2 = join18(rootDir, "deploy.arc.json");
@@ -31147,7 +31165,7 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync15
 } from "fs";
-import { dirname as dirname7, join as join19, normalize as normalize2, resolve } from "path";
+import { dirname as dirname8, join as join19, normalize as normalize2, resolve } from "path";
 function createDeployApiHandler(opts) {
   return async (req, url, ctx) => {
     const p3 = url.pathname;
@@ -31176,7 +31194,7 @@ function createDeployApiHandler(opts) {
       writeFileSync15(join19(opts.ws.arcDir, "package.json"), Buffer.from(await pkgFile.arrayBuffer()));
       writeFileSync15(join19(opts.ws.arcDir, "bun.lock"), Buffer.from(await lockFile.arrayBuffer()));
       const start = Date.now();
-      const installOk = await runBun(["install", "--production", "--frozen-lockfile"], opts.ws.arcDir);
+      const installOk = await runBun(["install", "--production"], opts.ws.arcDir);
       if (!installOk) {
         return Response.json({ error: "bun install failed" }, { status: 500, headers: cors });
       }
@@ -31290,7 +31308,7 @@ function createDeployApiHandler(opts) {
           if (existsSync15(dst)) {
             rmSync4(dst, { recursive: true, force: true });
           }
-          mkdirSync14(dirname7(dst), { recursive: true });
+          mkdirSync14(dirname8(dst), { recursive: true });
           cpSync(src2, dst, { recursive: true });
         }
       }
@@ -31328,7 +31346,7 @@ async function writeField(targetDir, name, file) {
   if (!full.startsWith(safeRoot + "/") && full !== safeRoot) {
     throw new Error(`Path traversal rejected: ${name}`);
   }
-  mkdirSync14(dirname7(full), { recursive: true });
+  mkdirSync14(dirname8(full), { recursive: true });
   writeFileSync15(full, Buffer.from(await file.arrayBuffer()));
 }
 function sanitizeName2(name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,12 +12,12 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.6.0",
-    "@arcote.tech/arc-ds": "^0.6.0",
-    "@arcote.tech/arc-react": "^0.6.0",
-    "@arcote.tech/arc-host": "^0.6.0",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.6.0",
-    "@arcote.tech/platform": "^0.6.0",
+    "@arcote.tech/arc": "^0.6.2",
+    "@arcote.tech/arc-ds": "^0.6.2",
+    "@arcote.tech/arc-react": "^0.6.2",
+    "@arcote.tech/arc-host": "^0.6.2",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.6.2",
+    "@arcote.tech/platform": "^0.6.2",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/runtime/entrypoint.sh

@@ -23,5 +23,36 @@ if [ ! -f "$CLI_BIN" ]; then
   bun add "@arcote.tech/arc-cli@${ARC_CLI_VERSION}"
 fi
 
+# resolveWorkspace() in arc platform start exits hard if /app has no
+# package.json. In runtime mode the workspace lives in /app/.arc/platform/
+# but the CLI still walks up from cwd. Drop a stub manifest here so the
+# walk-up resolves to /app/.arc/platform (or to a stable "no workspace"
+# state in pre-deploy).
+if [ ! -f /app/package.json ]; then
+  cat > /app/package.json <<'EOF'
+{
+  "name": "arc-runtime",
+  "private": true,
+  "type": "module",
+  "workspaces": []
+}
+EOF
+fi
+
+# Make /app/.arc/platform the working directory — that's where deployed user
+# code, deps and node_modules live (volume mount).
+mkdir -p /app/.arc/platform
+cd /app/.arc/platform
+if [ ! -f package.json ]; then
+  cat > package.json <<'EOF'
+{
+  "name": "arc-platform-runtime",
+  "private": true,
+  "type": "module",
+  "workspaces": []
+}
+EOF
+fi
+
 echo "[entrypoint] starting arc platform (cli=${ARC_CLI_VERSION})"
 exec bun run "$CLI_BIN" platform start

package/src/builder/dependency-collector.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { basename, join } from "path";
 import type { WorkspacePackage } from "./module-builder";
 
@@ -59,20 +59,32 @@ export function collectFrameworkDeps(
   const manifestPath = join(arcDir, "package.json");
   writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
 
-  // Copy workspace bun.lock so the container can use --frozen-lockfile for
-  // deterministic framework installs. Per-module installs run without it (no
-  // per-module lockfile in MVP).
-  const rootLock = join(rootDir, "bun.lock");
+  // Empty bun.lock placeholder. We CAN'T copy the workspace bun.lock — it
+  // contains the full dep graph (workspaces, dev deps) but our framework
+  // manifest is just the singleton peers. `bun install --frozen-lockfile`
+  // would reject as "lockfile had changes". An empty lockfile is harmless
+  // when server runs `bun install --production` without freeze.
   const targetLock = join(arcDir, "bun.lock");
-  if (existsSync(rootLock)) {
-    copyFileSync(rootLock, targetLock);
-  }
+  writeFileSync(targetLock, "");
 
-  const hash = sha256OfFiles([manifestPath, targetLock]);
+  // Hash MUST match the server-side computation in deploy-api.ts
+  // (sha256 over concat of raw bytes) — otherwise every deploy would think
+  // framework changed and re-install in a loop.
+  const hash = sha256ConcatHex([manifestPath, targetLock]);
   writeFileSync(join(arcDir, ".deps-hash"), hash + "\n");
   return { hash, manifestPath };
 }
 
+function sha256ConcatHex(paths: string[]): string {
+  const hash = createHash("sha256");
+  for (const p of paths) {
+    if (existsSync(p)) {
+      hash.update(readFileSync(p));
+    }
+  }
+  return hash.digest("hex");
+}
+
 // ---------------------------------------------------------------------------
 // Per-module deps
 // ---------------------------------------------------------------------------

package/src/commands/platform-deploy.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { dirname, join } from "path";
 import { bootstrap } from "../deploy/bootstrap";
 import {
   deployConfigExists,
@@ -125,13 +125,29 @@ export async function platformDeploy(
 // ---------------------------------------------------------------------------
 
 function readCliVersion(): string {
+  // import.meta.dir gets mangled by `bun build` — derive from process.argv[1]
+  // (the bundled dist/index.js path) which is stable across run modes.
+  const candidates: string[] = [];
+  const entry = process.argv[1];
+  if (entry) {
+    candidates.push(join(dirname(entry), "..", "package.json"));
+  }
   try {
-    const pkgPath = join(import.meta.dir, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    return pkg.version ?? "unknown";
+    candidates.push(join(import.meta.dir, "..", "..", "package.json"));
   } catch {
-    return "unknown";
+    // import.meta.dir unavailable
+  }
+  for (const path of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync(path, "utf-8"));
+      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
+        return pkg.version as string;
+      }
+    } catch {
+      // Try next
+    }
   }
+  return "unknown";
 }
 
 async function hashDeployConfig(rootDir: string): Promise<string> {

package/src/deploy/remote-sync.ts

@@ -116,14 +116,12 @@ export async function syncEnv(inputs: SyncInputs): Promise<SyncOutcome> {
         new Blob([readFileSync(join(ws.arcDir, "package.json"))]),
         "package.json",
       );
-      const lockPath = join(ws.arcDir, "bun.lock");
-      if (existsSync(lockPath)) {
-        form.append(
-          "bun.lock",
-          new Blob([readFileSync(lockPath)]),
-          "bun.lock",
-        );
-      }
+      // Ship a placeholder bun.lock (server validates its presence) but
+      // intentionally empty — workspace bun.lock has the full dep graph and
+      // would trip --frozen-lockfile against our slim framework package.json.
+      // The server side runs `bun install --production` without freeze, so an
+      // empty lock is harmless: bun re-resolves against package.json.
+      form.append("bun.lock", new Blob([""]), "bun.lock");
       const res = await fetch(`${base()}/api/deploy/framework`, {
         method: "POST",
         body: form,

package/src/deploy/ssh.ts

@@ -21,16 +21,22 @@ export interface SshExecResult {
 }
 
 function baseSshArgs(target: DeployTarget): string[] {
-  const args = [
+  // IdentitiesOnly=yes pins auth to the explicit key. Without it ssh-agent
+  // offers every loaded identity and trips MaxAuthTries on hardened sshd
+  // (ansible's sshd hardening + fail2ban lowers the threshold).
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
+  return [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-p",
     String(target.port),
   ];
-  if (target.sshKey) args.push("-i", target.sshKey);
-  return args;
 }
 
 /**
@@ -115,15 +121,19 @@ export async function scpUpload(
   localPath: string,
   remotePath: string,
 ): Promise<void> {
+  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-i",
+    key,
     "-P",
     String(target.port),
   ];
-  if (target.sshKey) args.push("-i", target.sshKey);
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
 
   const proc = spawn({ cmd: ["scp", ...args], stderr: "pipe" });

package/src/platform/deploy-api.ts

@@ -98,8 +98,12 @@ export function createDeployApiHandler(opts: DeployApiOptions): ArcHttpHandler {
       );
 
       const start = Date.now();
+      // No --frozen-lockfile: workspace bun.lock from the source project
+      // contains the full dep graph, but our framework manifest is a subset.
+      // Bun would reject as "lockfile had changes". Let bun re-resolve against
+      // the framework-only package.json.
       const installOk = await runBun(
-        ["install", "--production", "--frozen-lockfile"],
+        ["install", "--production"],
         opts.ws.arcDir,
       );
       if (!installOk) {

package/src/platform/shared.ts

@@ -97,7 +97,10 @@ export function resolveWorkspace(): WorkspaceInfo {
     `Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`,
   );
 
-  if (packages.length === 0) {
+  // Empty package list is allowed in pre-deploy runtime mode (container with
+  // freshly-mounted volume, no user code pushed yet). The CLI entry that
+  // forbids this (arc platform build/dev) checks explicitly.
+  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
     err("No workspace packages found.");
     process.exit(1);
   }