@askexenow/exe-os 0.9.384 → 0.9.387

package/dist/bin/stack-update.js

@@ -32,29 +32,29 @@ import {
   serviceSelectionPath,
   verifyManifestImagesAvailable,
   warnUnmanagedManifestServices
-} from "../chunk-ZBPZDADW.js";
+} from "../chunk-NHUI52BC.js";
 import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
-} from "../chunk-AGC2V7JS.js";
+} from "../chunk-B6CBN6EF.js";
 import {
   assertPreflightGate,
   runPreflightOnManifest
-} from "../chunk-PLII76NJ.js";
-import "../chunk-C5HUMAA7.js";
+} from "../chunk-JBUCA4OX.js";
+import "../chunk-B7WVYLAQ.js";
 import {
   preDeployBackup
 } from "../chunk-5DMAMQNU.js";
 import {
   logResult,
   runHealthGate
-} from "../chunk-AHESD3KW.js";
+} from "../chunk-AEEW4PCH.js";
 import "../chunk-L25OAFOU.js";
-import "../chunk-LFUBEHFW.js";
+import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
-import "../chunk-TNS63ATU.js";
+import "../chunk-5SPQBSKC.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-DZN7SDY2.js";
+import "../chunk-YBD3O77S.js";
 import {
   SYSTEMD_DAEMON_UNIT,
   SYSTEMD_WATCHDOG_UNIT
@@ -251,6 +251,27 @@ function checkGoTrueSecurity(envContent) {
   }
   return { check: "gotrue_security", status: "pass", message: "GoTrue auth settings are secure" };
 }
+function smtpConfigFindings({
+  smtpUser,
+  smtpPass,
+  smtpFrom,
+  smtpPortRaw,
+  credentialsAlreadyChecked = false
+}) {
+  const findings = [];
+  if (!credentialsAlreadyChecked) {
+    if (smtpUser === "") findings.push("SMTP_USER is empty \u2014 GoTrue cannot authenticate to the SMTP server");
+    if (smtpPass === "") findings.push("SMTP_PASS is empty \u2014 GoTrue cannot authenticate to the SMTP server");
+  }
+  if (smtpFrom === "") findings.push("SMTP_FROM is empty \u2014 GoTrue needs a sender address");
+  const portNum = Number(smtpPortRaw);
+  if (smtpPortRaw !== "" && (!Number.isInteger(portNum) || portNum <= 0 || portNum > 65535)) {
+    findings.push(`SMTP_PORT="${smtpPortRaw}" is not a valid port`);
+  } else if (![25, 465, 587, 2525].includes(portNum)) {
+    findings.push(`SMTP_PORT=${portNum} is unusual (typical: 587 STARTTLS / 465 implicit TLS / 25) \u2014 confirm the provider expects it`);
+  }
+  return findings;
+}
 function checkSmtpRecovery(envContent) {
   const env = parseEnvFile(envContent);
   const autoconfirm = env.get("GOTRUE_MAILER_AUTOCONFIRM");
@@ -260,7 +281,15 @@ function checkSmtpRecovery(envContent) {
   const smtpFrom = (env.get("SMTP_FROM") ?? env.get("GOTRUE_SMTP_ADMIN_EMAIL") ?? "").trim();
   const smtpPortRaw = (env.get("SMTP_PORT") ?? env.get("GOTRUE_SMTP_PORT") ?? "587").trim();
   if (autoconfirm === "true") {
-    return { check: "smtp_recovery", status: "pass", message: "GOTRUE_MAILER_AUTOCONFIRM=true \u2014 auth email flows disabled by design" };
+    if (smtpHost === "") {
+      return { check: "smtp_recovery", status: "pass", message: "GOTRUE_MAILER_AUTOCONFIRM=true and no SMTP host configured \u2014 auth email flows disabled by design" };
+    }
+    const findings = smtpConfigFindings({ smtpUser, smtpPass, smtpFrom, smtpPortRaw });
+    return {
+      check: "smtp_recovery",
+      status: "warn",
+      message: "GOTRUE_MAILER_AUTOCONFIRM=true while SMTP_HOST is set \u2014 these contradict: email flows are disabled, yet an SMTP server is configured. This is intentional on an invite-only stack; on a stack that was switched from --no-email to SMTP it means recovery mail is off and nobody was told. " + (findings.length > 0 ? `The SMTP config here is ALSO incomplete: ${findings.join("; ")}. Fix those before setting GOTRUE_MAILER_AUTOCONFIRM=false.` : "The SMTP config itself looks complete, so setting GOTRUE_MAILER_AUTOCONFIRM=false would enable recovery mail.")
+    };
   }
   if (smtpHost === "") {
     return {
@@ -280,14 +309,7 @@ function checkSmtpRecovery(envContent) {
       message: `SMTP_HOST is set but ${missingCreds.join(" and ")} ${isPlural ? "are" : "is"} empty \u2014 GoTrue cannot authenticate to the SMTP server, so recovery/signup emails will SILENTLY never send. Set ${missingCreds.join(", ")} in .env (or GOTRUE_MAILER_AUTOCONFIRM=true to disable email flows).`
     };
   }
-  const warns = [];
-  if (smtpFrom === "") warns.push("SMTP_FROM is empty \u2014 GoTrue needs a sender address");
-  const portNum = Number(smtpPortRaw);
-  if (smtpPortRaw !== "" && (!Number.isInteger(portNum) || portNum <= 0 || portNum > 65535)) {
-    warns.push(`SMTP_PORT="${smtpPortRaw}" is not a valid port`);
-  } else if (![25, 465, 587, 2525].includes(portNum)) {
-    warns.push(`SMTP_PORT=${portNum} is unusual (typical: 587 STARTTLS / 465 implicit TLS / 25) \u2014 confirm the provider expects it`);
-  }
+  const warns = smtpConfigFindings({ smtpUser, smtpPass, smtpFrom, smtpPortRaw, credentialsAlreadyChecked: true });
   if (warns.length > 0) {
     return { check: "smtp_recovery", status: "warn", message: `SMTP host + credentials are set, but: ${warns.join("; ")}.` };
   }
@@ -707,17 +729,101 @@ function collectPendingImageMovements(rendered, deployed, servicesToRecreate) {
   }
   return movements.sort((a, b) => a.service.localeCompare(b.service));
 }
-function collectRenderedEnvDrift(templateConfigJson, liveConfigJson) {
-  const template = parseComposeServiceEnvKeys(templateConfigJson);
-  const live = parseComposeServiceEnvKeys(liveConfigJson);
+function collectRenderedEnvDrift(intendedConfigJson, deployed) {
+  const intended = parseComposeServiceEnvKeys(intendedConfigJson);
   const drift = [];
-  for (const [service, keys] of template) {
-    const liveKeys = live.get(service);
-    if (!liveKeys) continue;
-    const missingKeys = [...keys].filter((k) => !liveKeys.has(k)).sort();
+  const unverified = [];
+  for (const [service, keys] of intended) {
+    if (!deployed.deployedServices.has(service)) continue;
+    const containerKeys = deployed.envKeys.get(service);
+    if (!containerKeys) {
+      unverified.push(service);
+      continue;
+    }
+    const missingKeys = [...keys].filter((k) => !containerKeys.has(k)).sort();
     if (missingKeys.length > 0) drift.push({ service, missingKeys });
   }
-  return drift.sort((a, b) => a.service.localeCompare(b.service));
+  return {
+    drift: drift.sort((a, b) => a.service.localeCompare(b.service)),
+    unverified: unverified.sort()
+  };
+}
+var DEPLOYED_ENV_INSPECT_FORMAT = '{{index .Config.Labels "com.docker.compose.service"}}	{{json .Config.Env}}';
+function deployedEnvInspectArgs(containerIds) {
+  return ["inspect", "--format", DEPLOYED_ENV_INSPECT_FORMAT, ...containerIds];
+}
+function parseDeployedContainerIds(stdout) {
+  const ids = /* @__PURE__ */ new Map();
+  for (const line of stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      for (const entry of Array.isArray(parsed) ? parsed : [parsed]) {
+        const row = entry;
+        if (row?.Service && row.ID) ids.set(row.Service, row.ID);
+      }
+    } catch {
+    }
+  }
+  return ids;
+}
+function parseDeployedServices(stdout) {
+  const services = /* @__PURE__ */ new Set();
+  for (const line of stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      for (const entry of Array.isArray(parsed) ? parsed : [parsed]) {
+        const row = entry;
+        if (row?.Service) services.add(row.Service);
+      }
+    } catch {
+    }
+  }
+  return services;
+}
+function parseContainerEnvKeys(stdout) {
+  const out = /* @__PURE__ */ new Map();
+  for (const line of stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const tab = trimmed.indexOf("	");
+    if (tab === -1) continue;
+    const service = trimmed.slice(0, tab).trim();
+    if (!service) continue;
+    let entries;
+    try {
+      entries = JSON.parse(trimmed.slice(tab + 1));
+    } catch {
+      continue;
+    }
+    if (!Array.isArray(entries)) continue;
+    const keys = /* @__PURE__ */ new Set();
+    for (const entry of entries) keys.add(String(entry).split("=")[0]);
+    out.set(service, keys);
+  }
+  return out;
+}
+function readDeployedServiceEnv(capture, psStdout) {
+  const deployedServices = parseDeployedServices(psStdout);
+  const ids = parseDeployedContainerIds(psStdout);
+  if (ids.size === 0) return { deployedServices, envKeys: /* @__PURE__ */ new Map() };
+  let inspected = /* @__PURE__ */ new Map();
+  try {
+    inspected = parseContainerEnvKeys(capture(deployedEnvInspectArgs([...ids.values()])));
+  } catch (err) {
+    console.warn(
+      `[stack-config-update] \u26A0 Could not read container environments (${err instanceof Error ? err.message : String(err)}) \u2014 the rendered-env check is UNVERIFIED this run.`
+    );
+  }
+  const envKeys = /* @__PURE__ */ new Map();
+  for (const service of deployedServices) {
+    const keys = inspected.get(service);
+    if (keys) envKeys.set(service, keys);
+  }
+  return { deployedServices, envKeys };
 }
 function parseComposeServiceEnvKeys(configJson) {
   const out = /* @__PURE__ */ new Map();
@@ -831,6 +937,12 @@ Set them in ${envFile}, then re-run.`
     );
   }
 }
+var STACK_VERSION_SOURCE_LABEL = {
+  "target-flag": "--target (operator-supplied)",
+  "lock-file": ".exe-stack-lock.json (what the updater last committed)",
+  "env-file": "STACK_VERSION in the stack .env",
+  "manifest-latest": "the manifest's LATEST release \u2014 no deployed version resolved"
+};
 function defaultComposeCapture(args) {
   const result = spawnSync2("docker", args, { encoding: "utf8", timeout: 12e4 });
   if (result.status !== 0) {
@@ -851,7 +963,7 @@ async function runStackConfigUpdate(options) {
       `Config-only delivery aborted: this mode UPDATES an existing install, and ${!existsSync2(options.composeFile) ? options.composeFile : options.envFile} does not exist. Run a normal stack update to install.`
     );
   }
-  const { release, stackVersion } = await resolveSignedRelease(options);
+  const { release, stackVersion, stackVersionSource } = await resolveSignedRelease(options);
   const stagedComposeRaw = readFileSync2(templatePath, "utf8");
   const stagedAssetDigests = collectConfigAssetDigests(path2.dirname(templatePath));
   assertStagedConfigMatchesManifest({
@@ -893,8 +1005,34 @@ async function runStackConfigUpdate(options) {
   });
   const composeChanged = stagedComposeRaw !== currentComposeRaw;
   if (!composeChanged && assetChanges.length === 0) {
-    console.log("[stack-config-update] Host compose template and config assets already match the packaged config \u2014 nothing to deliver.");
-    return { status: "no-change", stackVersion, changed: [], added: [], removed: [], envDrift: [], assets: [] };
+    const envVerdict = collectRenderedEnvDrift(
+      beforeConfigJson,
+      readDeployedServiceEnv(capture, capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]))
+    );
+    console.log(
+      "[stack-config-update] Host compose template and config assets already match the packaged config \u2014 nothing to DELIVER. That is a statement about FILES ON DISK."
+    );
+    for (const d of envVerdict.drift) {
+      console.warn(
+        `[stack-config-update] \u26A0 CONTAINER DRIFT: ${d.service} is RUNNING without env key(s) the current config renders: ${d.missingKeys.join(", ")}. The files are current; the container is not. Recreate that service \u2014 config-only delivery has nothing to write here.`
+      );
+    }
+    if (envVerdict.unverified.length > 0) {
+      console.warn(
+        `[stack-config-update] \u26A0 UNVERIFIED: the container environment could not be read for ${envVerdict.unverified.join(", ")}, so "already current" is asserted about files alone for them.`
+      );
+    }
+    return {
+      status: "no-change",
+      stackVersion,
+      stackVersionSource,
+      changed: [],
+      added: [],
+      removed: [],
+      envDrift: envVerdict.drift,
+      envUnverified: envVerdict.unverified,
+      assets: []
+    };
   }
   console.log(`[stack-config-update] Compose template: ${composeChanged ? "REFRESH" : "already current"}`);
   if (assetChanges.length > 0) {
@@ -925,12 +1063,13 @@ async function runStackConfigUpdate(options) {
         beforeHashes,
         parseComposeConfigHashes(capture([...scratchArgs, "config", "--hash=*"]))
       );
-      const envDrift = collectRenderedEnvDrift(afterConfigJson, beforeConfigJson);
+      const psJson = capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS]);
+      const envVerdict = collectRenderedEnvDrift(afterConfigJson, readDeployedServiceEnv(capture, psJson));
       const assetServices = assetChanges.length > 0 ? servicesMountingPaths(afterConfigJson, configDir, assetChanges.map((a) => a.rel)) : [];
       const wouldRecreate = [.../* @__PURE__ */ new Set([...changeSet.changed, ...assetServices])].sort();
       const pending = collectPendingImageMovements(
         parseComposeImages(afterConfigJson),
-        parseDeployedImages(capture([...composeArgs, ...DEPLOYED_IMAGE_PS_ARGS])),
+        parseDeployedImages(psJson),
         wouldRecreate
       );
       console.log("[stack-config-update] DRY RUN \u2014 nothing written, no container touched.");
@@ -940,7 +1079,16 @@ async function runStackConfigUpdate(options) {
       console.log(`  services added by the template: ${changeSet.added.join(", ") || "none"}`);
       console.log(`  services no longer in the template: ${changeSet.removed.join(", ") || "none"}`);
       console.log(`  services recreated for a changed asset: ${assetServices.join(", ") || "none"}`);
-      for (const d of envDrift) console.log(`  rendered env keys added to ${d.service}: ${d.missingKeys.join(", ")}`);
+      for (const d of envVerdict.drift) {
+        console.log(
+          `  env keys the ${d.service} CONTAINER is missing and this config renders: ${d.missingKeys.join(", ")}`
+        );
+      }
+      if (envVerdict.unverified.length > 0) {
+        console.log(
+          `  \u26A0 UNVERIFIED \u2014 container environment unreadable for: ${envVerdict.unverified.join(", ")}. No rendered-env verdict was reached for those services; this is NOT "no drift".`
+        );
+      }
       if (assetChanges.length > 0 && assetServices.length === 0) {
         console.log("  \u26A0 assets would be delivered that NO service mounts \u2014 they would not be served.");
       }
@@ -956,10 +1104,12 @@ async function runStackConfigUpdate(options) {
         // for a PENDING movement exactly as it does for a rendered one.
         status: movements.length > 0 || pending.length > 0 ? "aborted" : "no-change",
         stackVersion,
+        stackVersionSource,
         changed: wouldRecreate,
         added: changeSet.added,
         removed: changeSet.removed,
-        envDrift,
+        envDrift: envVerdict.drift,
+        envUnverified: envVerdict.unverified,
         assets: assetChanges
       };
     } finally {
@@ -990,20 +1140,26 @@ async function resolveSignedRelease(options) {
   );
   reportStackManifestSource(loaded);
   const lockFile = options.lockFile ?? path2.join(path2.dirname(options.envFile), ".exe-stack-lock.json");
-  const deployedVersion = readCurrentStackVersion(lockFile) ?? readEnvValue(readFileSync2(options.envFile, "utf8"), "STACK_VERSION");
+  const lockVersion = readCurrentStackVersion(lockFile);
+  const envVersion = lockVersion ? void 0 : readEnvValue(readFileSync2(options.envFile, "utf8"), "STACK_VERSION");
+  const deployedVersion = lockVersion ?? envVersion;
   if (!options.targetVersion && !deployedVersion) {
     console.warn(
       `[stack-config-update] \u26A0 Could not determine the DEPLOYED stack version: ${lockFile} records none and ${options.envFile} carries no STACK_VERSION. Falling back to the manifest's latest release (${loaded.manifest.latest}) \u2014 its config digests and the deploy audit will describe THAT release, not necessarily what this host runs. Pass --target to name the deployed version.`
     );
   }
   const stackVersion = options.targetVersion ?? deployedVersion ?? loaded.manifest.latest;
+  const stackVersionSource = options.targetVersion ? "target-flag" : lockVersion ? "lock-file" : envVersion ? "env-file" : "manifest-latest";
+  console.log(
+    `[stack-config-update] Deployed stack version ${stackVersion} \u2014 source: ${STACK_VERSION_SOURCE_LABEL[stackVersionSource]}` + (stackVersionSource === "target-flag" ? "." : ". UNVERIFIED against the running containers: nothing stamps a deployed stack version on a container, so this is a claim about a FILE.")
+  );
   const release = loaded.manifest.stacks[stackVersion];
   if (!release) {
     console.warn(
       `[stack-config-update] The signed manifest has no release entry for the deployed version ${stackVersion}; config provenance cannot be checked against it.`
     );
   }
-  return { manifest: loaded.manifest, release, stackVersion };
+  return { manifest: loaded.manifest, release, stackVersion, stackVersionSource };
 }
 function readEnvValue(envRaw, key) {
   for (const line of envRaw.split("\n")) {
@@ -1474,6 +1630,19 @@ async function main(args = process.argv.slice(2)) {
     }
     const result2 = await runStackConfigUpdate(configOnlyOptionsFromCli(opts, readOnly));
     console.log(`[stack-config-update] ${result2.status} \u2014 ${result2.changed.length} service(s) recreated, ${result2.assets.length} asset(s) delivered.`);
+    for (const d of result2.envDrift) {
+      console.log(
+        `[stack-config-update] \u26A0 CONTAINER DRIFT \u2014 ${d.service} is running without env key(s) this config renders: ${d.missingKeys.join(", ")}`
+      );
+    }
+    if (result2.envUnverified.length > 0) {
+      console.log(
+        `[stack-config-update] \u26A0 UNVERIFIED \u2014 no container env verdict for ${result2.envUnverified.join(", ")}. This is NOT "no drift".`
+      );
+    }
+    console.log(
+      `[stack-config-update] Deployed version ${result2.stackVersion} claimed from ${STACK_VERSION_SOURCE_LABEL[result2.stackVersionSource]}.`
+    );
     return;
   }
   let usingPackagedCheckTemplates = false;

package/dist/bin/verify-stack.js

@@ -7,8 +7,8 @@ import {
   checkSsoSessionContract,
   parseComposeServiceNames,
   runVerifyStack
-} from "../chunk-AGC2V7JS.js";
-import "../chunk-LFUBEHFW.js";
+} from "../chunk-B6CBN6EF.js";
+import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
 import "../chunk-6Y4B3QF6.js";
 import "../chunk-MLKGABMK.js";

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-AHESD3KW.js";
+} from "../chunk-AEEW4PCH.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/{boot-generation-Q7LGQ3AO.js → boot-generation-VOFY43WG.js}

@@ -3,12 +3,12 @@ import {
   bumpBootGeneration,
   getBootGeneration,
   getCachedBootGeneration
-} from "./chunk-JFTUAV4J.js";
-import "./chunk-GL47M7NY.js";
+} from "./chunk-6EUXAOZQ.js";
+import "./chunk-2GUT5CWI.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-QSYY4R6R.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-QH5ZQ5SJ.js";

package/dist/{boot-review-sections-G5774FR5.js → boot-review-sections-WLYE6NUR.js}

@@ -1,25 +1,25 @@
 import {
   queryTaskRows
-} from "./chunk-7UHZBVP3.js";
-import "./chunk-6BJCDWSM.js";
-import "./chunk-JDDM6C57.js";
+} from "./chunk-TU63ZMMS.js";
+import "./chunk-OH6B7ICF.js";
+import "./chunk-ORHX5E7L.js";
 import "./chunk-ZKGWHT56.js";
-import "./chunk-QNZ4562V.js";
+import "./chunk-VA47XBUX.js";
 import "./chunk-WT4RI36X.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-TDF2XKLK.js";
 import "./chunk-EIKATSE4.js";
 import "./chunk-MJCSEIFI.js";
-import "./chunk-ALRHGEAJ.js";
-import "./chunk-PUBA5B4M.js";
+import "./chunk-CI5R7QV7.js";
+import "./chunk-OKQCTYLW.js";
 import "./chunk-VI4ATC6I.js";
 import "./chunk-A27Q27CT.js";
-import "./chunk-LSNBTGW4.js";
+import "./chunk-N5STNP44.js";
 import "./chunk-T5SM4RXY.js";
-import "./chunk-VJEJ7JNB.js";
+import "./chunk-OFCTRALK.js";
 import "./chunk-L5EPGGDP.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-BPVFZ6Q4.js";
+import "./chunk-IOIBJY5D.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-ANVHWV2X.js";
 import "./chunk-HME6ITKV.js";
@@ -31,25 +31,25 @@ import "./chunk-NLEW62VC.js";
 import "./chunk-IMYGYIAI.js";
 import "./chunk-3DAEZILW.js";
 import "./chunk-DRTJCG6B.js";
-import "./chunk-UX2EO653.js";
+import "./chunk-Z2RU4QH5.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import "./chunk-YRUZK2QA.js";
-import "./chunk-GL47M7NY.js";
+import "./chunk-2GUT5CWI.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-QSYY4R6R.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-TNS63ATU.js";
+import "./chunk-5SPQBSKC.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-DZN7SDY2.js";
+import "./chunk-YBD3O77S.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import "./chunk-MMS2HBRT.js";