@esuyo/coding-container 1.0.2

package/src/utils/registry-api.js

@@ -0,0 +1,308 @@
+import http from "node:http";
+import https from "node:https";
+import net from "node:net";
+import tls from "node:tls";
+import { localRegistryAuth, credentialHelperAuth, registryHost } from "./registry.js";
+
+// Docker Registry HTTP API V2 client used by `gc` (list/delete tags).
+// Uses the same docker credentials as the pull-secret resolution
+// (config.json or credential helper) and follows the standard
+// WWW-Authenticate Bearer/Basic challenge, like the docker CLI does.
+//
+// Plain node:http/https with keepAlive disabled (not global fetch): the
+// sockets must not outlive the command, or the CLI would hang after gc.
+
+// Per-process state: the registry scheme (detected once), the last
+// Authorization header that worked, and bearer tokens cached per
+// (realm, service, scope).
+const state = { scheme: null, authHeader: null, tokens: new Map() };
+
+// Safety net so a hung registry cannot stall gc indefinitely.
+const REQUEST_TIMEOUT_MS = 30000;
+
+const agents = {
+  http: new http.Agent({ keepAlive: false }),
+  https: new https.Agent({ keepAlive: false }),
+};
+
+// Error codes meaning "host is unreachable", where the scheme cannot be
+// inferred. Anything else (a dropped TLS handshake, a protocol error) means
+// the port is not speaking TLS, i.e. a plain-http registry.
+const UNREACHABLE = new Set(["ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "ETIMEDOUT"]);
+
+function hostPort(registry) {
+  const host = registryHost(registry);
+  const m = host.match(/^(.*):(\d+)$/);
+  return m ? { host: m[1], port: Number(m[2]) } : { host, port: 443 };
+}
+
+/**
+ * Detect whether the registry speaks TLS by attempting a handshake (without
+ * verifying the certificate — the real requests do their own verification).
+ * Resolves to "https" or "http"; on an unreachable host it defaults to
+ * "https" so the subsequent request reports a proper "cannot reach" error.
+ */
+function detectScheme(registry) {
+  if (state.scheme) return Promise.resolve(state.scheme);
+  const { host, port } = hostPort(registry);
+  return new Promise((resolve) => {
+    let settled = false;
+    let handshakeOk = false;
+    // SNI (servername) must be a hostname, not an IP literal.
+    const options = { host, port, rejectUnauthorized: false };
+    if (!net.isIP(host)) options.servername = host;
+    const socket = tls.connect(options, () => {
+      handshakeOk = true;
+      finish("https");
+    });
+    function finish(scheme) {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      state.scheme = scheme;
+      resolve(scheme);
+    }
+    socket.setTimeout(5000, () => finish("http"));
+    socket.on("error", (err) => finish(UNREACHABLE.has(err.code) ? "https" : "http"));
+    socket.on("close", () => finish(handshakeOk ? "https" : "http"));
+  });
+}
+
+/**
+ * The V2 repository path for the configured image: the registry reference
+ * minus the host, plus the image name.
+ * "registry.example.com/you" + "coding-container" -> "you/coding-container"
+ */
+export function registryRepoName(cfg) {
+  const host = registryHost(cfg.image.registry);
+  const ns = cfg.image.registry.slice(host.length).replace(/^\/+/, "");
+  return ns ? `${ns}/${cfg.image.name}` : cfg.image.name;
+}
+
+function credentials(cfg) {
+  return localRegistryAuth(cfg.image.registry) || credentialHelperAuth(cfg.image.registry);
+}
+
+/**
+ * Parse the first challenge of a WWW-Authenticate header. A registry may
+ * send several challenges in one header (Gitea sends both Bearer and
+ * Basic); only the first is usable, and the second challenge's parameters
+ * must not leak into the first (its `realm` would overwrite the bearer
+ * token endpoint and break the token exchange).
+ */
+function parseChallenge(header) {
+  if (!header) return null;
+  // Split on commas outside quoted values (scopes may contain commas).
+  const challenges = [];
+  let current = "";
+  let inQuotes = false;
+  for (const ch of header) {
+    if (ch === '"') inQuotes = !inQuotes;
+    if (ch === "," && !inQuotes) {
+      challenges.push(current);
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  challenges.push(current);
+  for (const c of challenges) {
+    const m = c.match(/^\s*(Bearer|Basic)\s*(.*)$/i);
+    if (!m) continue;
+    const params = {};
+    for (const pm of m[2].matchAll(/([a-z]+)="([^"]*)"/gi)) params[pm[1].toLowerCase()] = pm[2];
+    return { type: m[1].toLowerCase(), ...params };
+  }
+  return null;
+}
+
+/**
+ * Minimal fetch-Response-like wrapper over a core http response.
+ */
+function makeResponse(status, statusText, headers, body) {
+  return {
+    status,
+    statusText,
+    ok: status >= 200 && status < 300,
+    headers: { get: (name) => headers[name.toLowerCase()] || null },
+    async json() {
+      return JSON.parse(body.toString("utf8"));
+    },
+    async text() {
+      return body.toString("utf8");
+    },
+  };
+}
+
+function request(url, method, headers = {}) {
+  const u = new URL(url);
+  const isHttps = u.protocol === "https:";
+  return new Promise((resolve, reject) => {
+    const req = (isHttps ? https : http).request(
+      {
+        protocol: u.protocol,
+        hostname: u.hostname,
+        port: u.port || (isHttps ? 443 : 80),
+        method,
+        path: u.pathname + u.search,
+        headers,
+        agent: isHttps ? agents.https : agents.http,
+        timeout: REQUEST_TIMEOUT_MS,
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () =>
+          resolve(makeResponse(res.statusCode, res.statusMessage, res.headers, Buffer.concat(chunks)))
+        );
+        res.on("error", reject);
+      }
+    );
+    req.on("timeout", () => {
+      req.destroy(new Error(`request to ${u.href} timed out after ${REQUEST_TIMEOUT_MS / 1000}s`));
+    });
+    req.on("error", reject);
+    req.end();
+  });
+}
+
+async function send(cfg, method, path, authHeader, extraHeaders = {}) {
+  const scheme = await detectScheme(cfg.image.registry);
+  const host = registryHost(cfg.image.registry);
+  const url = `${scheme}://${host}${path}`;
+  try {
+    return await request(url, method, {
+      ...(authHeader ? { authorization: authHeader } : {}),
+      ...extraHeaders,
+    });
+  } catch (err) {
+    const code = err.code ? ` (${err.code})` : "";
+    throw new Error(`cannot reach registry at ${url}${code}: ${err.message}`);
+  }
+}
+
+/**
+ * Request with the standard registry auth dance: try with the cached
+ * Authorization header, and on 401 follow the WWW-Authenticate challenge
+ * (Bearer token exchange or plain Basic) with the local docker credentials.
+ */
+async function apiRequest(cfg, method, path, extraHeaders = {}) {
+  let res = await send(cfg, method, path, state.authHeader, extraHeaders);
+  if (res.status !== 401) return res;
+
+  let challenge = parseChallenge(res.headers.get("www-authenticate"));
+  if (!challenge) {
+    const probe = await send(cfg, "GET", "/v2/", null);
+    challenge = parseChallenge(probe.headers.get("www-authenticate"));
+  }
+  if (!challenge) {
+    throw new Error(
+      `registry ${registryHost(cfg.image.registry)} returned 401 without a usable ` +
+        `WWW-Authenticate challenge (unsupported auth scheme)`
+    );
+  }
+  const creds = credentials(cfg);
+  if (!creds) {
+    throw new Error(
+      `registry ${registryHost(cfg.image.registry)} requires authentication but no ` +
+        `docker credentials for it were found. Run: docker login ${registryHost(cfg.image.registry)}`
+    );
+  }
+  const basic = `Basic ${Buffer.from(`${creds.username}:${creds.password}`, "utf8").toString("base64")}`;
+  let authHeader;
+  if (challenge.type === "basic") {
+    authHeader = basic;
+  } else if (challenge.type === "bearer") {
+    const repo = registryRepoName(cfg);
+    const scope = challenge.scope || `repository:${repo}:pull,push`;
+    const key = `${challenge.realm}|${challenge.service || ""}|${scope}`;
+    let token = state.tokens.get(key);
+    if (!token) {
+      const tokenUrl = new URL(challenge.realm);
+      if (challenge.service) tokenUrl.searchParams.set("service", challenge.service);
+      if (scope) tokenUrl.searchParams.set("scope", scope);
+      let tokenRes;
+      try {
+        tokenRes = await request(tokenUrl.href, "GET", { authorization: basic });
+      } catch (err) {
+        throw new Error(`cannot reach the registry token endpoint at ${tokenUrl.origin}: ${err.message}`);
+      }
+      if (!tokenRes.ok) {
+        throw new Error(
+          `registry token request failed with ${tokenRes.status} — check: docker login ${registryHost(cfg.image.registry)}`
+        );
+      }
+      const body = await tokenRes.json().catch(() => ({}));
+      token = body.token || body.access_token;
+      if (!token) throw new Error("registry token response did not contain a token");
+      state.tokens.set(key, token);
+    }
+    authHeader = `Bearer ${token}`;
+  } else {
+    throw new Error(`unsupported registry auth scheme: ${challenge.type}`);
+  }
+
+  res = await send(cfg, method, path, authHeader, extraHeaders);
+  if (res.status === 401) {
+    throw new Error(
+      `registry authentication failed for ${registryHost(cfg.image.registry)} — check: ` +
+        `docker login ${registryHost(cfg.image.registry)}`
+    );
+  }
+  if (res.status === 403) {
+    throw new Error(
+      `registry ${registryHost(cfg.image.registry)} denied access (403) — the credentials ` +
+        `lack permission for ${registryRepoName(cfg)}`
+    );
+  }
+  state.authHeader = authHeader;
+  return res;
+}
+
+/**
+ * All tags of the image, following the V2 pagination Link header.
+ */
+export async function listTags(cfg) {
+  const repo = registryRepoName(cfg);
+  const host = registryHost(cfg.image.registry);
+  const tags = new Set();
+  let path = `/v2/${repo}/tags/list`;
+  for (let page = 0; page < 1000; page++) {
+    const res = await apiRequest(cfg, "GET", path, { Accept: "application/json" });
+    if (res.status === 404) {
+      throw new Error(`repository ${cfg.image.registry}/${repo} was not found in the registry`);
+    }
+    if (!res.ok) {
+      throw new Error(`registry tag list failed with ${res.status} ${res.statusText}`.trim());
+    }
+    const body = await res.json().catch(() => ({}));
+    for (const tag of body.tags || []) tags.add(tag);
+    const link = res.headers.get("link");
+    const next = link && link.match(/<([^>]+)>;\s*rel="next"/);
+    if (!next) break;
+    const u = new URL(next[1], `${state.scheme}://${host}`);
+    path = u.pathname + u.search;
+  }
+  return [...tags].sort();
+}
+
+/**
+ * Delete one tag. Returns normally on success (2xx); throws otherwise.
+ */
+export async function deleteTag(cfg, tag) {
+  const repo = registryRepoName(cfg);
+  const host = registryHost(cfg.image.registry);
+  const res = await apiRequest(cfg, "DELETE", `/v2/${repo}/tags/${encodeURIComponent(tag)}`);
+  if (res.status === 404) {
+    throw new Error(`tag ${tag} not found (already deleted?)`);
+  }
+  if (res.status === 405) {
+    throw new Error(
+      `registry ${host} does not support deleting tags through the registry API (405) — ` +
+        `e.g. AWS ECR requires the AWS BatchDeleteImage API instead`
+    );
+  }
+  if (!res.ok) {
+    throw new Error(`deleting tag ${tag} failed with ${res.status} ${res.statusText}`.trim());
+  }
+}

package/src/utils/registry.js

@@ -0,0 +1,204 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { exec, runWithInput } from "./exec.js";
+
+function dockerConfigPath() {
+  return path.join(os.homedir(), ".docker", "config.json");
+}
+
+function readDockerConfig() {
+  try {
+    const file = dockerConfigPath();
+    if (!fs.existsSync(file)) return null;
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract the registry host from a registry reference that may include a
+ * namespace path, e.g. "registry.example.com/you" -> "registry.example.com".
+ */
+export function registryHost(registry) {
+  return registry.split("/")[0];
+}
+
+/**
+ * Read registry credentials stored inline in ~/.docker/config.json.
+ * Docker stores auths keyed by host only, so the host is derived here.
+ * Returns { server, username, password } or null.
+ */
+export function localRegistryAuth(registry) {
+  const cfg = readDockerConfig();
+  if (!cfg) return null;
+  const host = registryHost(registry);
+  const auth = (cfg.auths || {})[host];
+  if (!auth) return null;
+  let username = auth.username;
+  let password = auth.password;
+  if (!username && auth.auth) {
+    const decoded = Buffer.from(auth.auth, "base64").toString("utf8");
+    const idx = decoded.indexOf(":");
+    username = decoded.slice(0, idx);
+    password = decoded.slice(idx + 1);
+  }
+  if (!username || !password) return null;
+  return { server: host, username, password };
+}
+
+/**
+ * Query the docker credential helper (e.g. docker-credential-desktop) for the
+ * registry host. Covers setups where credentials live in the OS keychain
+ * instead of config.json.
+ */
+export function credentialHelperAuth(registry, spawn = spawnSync) {
+  const cfg = readDockerConfig();
+  if (!cfg) return null;
+  const host = registryHost(registry);
+  const store =
+    (cfg.credHelpers && cfg.credHelpers[host]) || cfg.credsStore || null;
+  if (!store) return null;
+  return queryCredentialHelper(store, host, spawn);
+}
+
+/**
+ * Ask each docker-credential-<store> candidate for the host's credentials.
+ * `spawn` is injectable for tests.
+ */
+export function queryCredentialHelper(store, host, spawn = spawnSync) {
+  const candidates = [
+    `docker-credential-${store}`,
+    `docker-credential-${store}.exe`,
+    path.join("C:/Program Files/Docker/Docker/resources/bin", `docker-credential-${store}.exe`),
+    path.join("C:/Program Files/Docker/Docker", `credentialHelper${store[0].toUpperCase()}${store.slice(1)}.exe`),
+  ];
+
+  for (const bin of candidates) {
+    for (const serverURL of [host, `https://${host}`]) {
+      try {
+        // The credential-helper protocol passes the server URL as a plain
+        // string on stdin for `get` (JSON is only used for `store`); a JSON
+        // payload makes the helper look up a credential literally named
+        // after that JSON string and always report "not found".
+        const res = spawn(bin, ["get"], {
+          input: serverURL,
+          encoding: "utf8",
+          stdio: ["pipe", "pipe", "pipe"],
+          timeout: 15000,
+        });
+        if (res.error || res.status !== 0 || !res.stdout) continue;
+        const parsed = JSON.parse(res.stdout.trim());
+        if (parsed.Username && parsed.Secret) {
+          return { server: host, username: parsed.Username, password: parsed.Secret };
+        }
+      } catch {
+        /* try the next candidate */
+      }
+    }
+  }
+  return null;
+}
+
+export function pullSecretName(registry) {
+  return `coding-${registryHost(registry).replace(/[^a-z0-9]/gi, "-").toLowerCase()}`;
+}
+
+/**
+ * Find an existing kubernetes.io/dockerconfigjson secret in the namespace
+ * whose dockerconfigjson contains an auth entry for the registry host.
+ */
+async function discoverExistingSecret(cfg) {
+  let items = [];
+  try {
+    const out = exec("kubectl", ["get", "secret", "-n", cfg.k8s.namespace, "-o", "json"]);
+    items = JSON.parse(out).items || [];
+  } catch {
+    return null;
+  }
+  const host = registryHost(cfg.image.registry);
+  for (const s of items) {
+    if (s.type !== "kubernetes.io/dockerconfigjson") continue;
+    try {
+      const dcj = JSON.parse(
+        Buffer.from(s.data[".dockerconfigjson"], "base64").toString("utf8")
+      );
+      const auths = dcj.auths || {};
+      if (Object.keys(auths).some((key) => registryHost(key) === host)) {
+        return s.metadata.name;
+      }
+    } catch {
+      /* not parseable, skip */
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve a pull secret for the image registry, in priority order:
+ *   1. k8s.imagePullSecret from config (must exist in the namespace)
+ *   2. a previously created "coding-<host>" managed secret
+ *   3. a new managed secret built from local docker credentials
+ *   4. an existing dockerconfigjson secret in the namespace matching the host
+ *   5. null (with a warning) if the registry is expected to be public
+ */
+export async function ensurePullSecret(cfg) {
+  const ns = cfg.k8s.namespace;
+  const name = pullSecretName(cfg.image.registry);
+
+  if (cfg.k8s.imagePullSecret) {
+    try {
+      exec("kubectl", ["get", "secret", cfg.k8s.imagePullSecret, "-n", ns]);
+      return cfg.k8s.imagePullSecret;
+    } catch {
+      throw new Error(
+        `config: k8s.imagePullSecret "${cfg.k8s.imagePullSecret}" not found in namespace ${ns}`
+      );
+    }
+  }
+
+  try {
+    exec("kubectl", ["get", "secret", name, "-n", ns]);
+    return name;
+  } catch {
+    /* not created yet */
+  }
+
+  const auth = localRegistryAuth(cfg.image.registry) || credentialHelperAuth(cfg.image.registry);
+  if (auth) {
+    const dockerConfig = JSON.stringify({
+      auths: {
+        [auth.server]: {
+          username: auth.username,
+          password: auth.password,
+          auth: Buffer.from(`${auth.username}:${auth.password}`, "utf8").toString("base64"),
+        },
+      },
+    });
+    const secret = {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: { name, namespace: ns },
+      type: "kubernetes.io/dockerconfigjson",
+      data: { ".dockerconfigjson": Buffer.from(dockerConfig, "utf8").toString("base64") },
+    };
+    await runWithInput("kubectl", ["apply", "-f", "-"], JSON.stringify(secret));
+    console.log(`Created pull secret ${name} in ${ns}`);
+    return name;
+  }
+
+  const discovered = await discoverExistingSecret(cfg);
+  if (discovered) {
+    console.log(`Using existing pull secret ${discovered} in ${ns}`);
+    return discovered;
+  }
+
+  console.log(
+    `No local docker credentials for ${cfg.image.registry} found and no matching ` +
+      `pull secret in ${ns}. The cluster must already be able to pull the image, ` +
+      `or set k8s.imagePullSecret in the config.`
+  );
+  return null;
+}

package/src/utils/semver.js

@@ -0,0 +1,42 @@
+// Strict vMAJOR.MINOR.PATCH semver (with a leading 'v'). No pre-release or
+// build metadata: the global image's versions are human-picked and immutable.
+const SEMVER_RE = /^v(\d+)\.(\d+)\.(\d+)$/;
+
+export function isSemver(tag) {
+  return typeof tag === "string" && SEMVER_RE.test(tag);
+}
+
+/**
+ * Numeric comparison of two semver tags (assumes both are semver).
+ * Returns -1, 0 or 1. Orders numerically, so v1.10.0 > v1.9.9.
+ */
+export function compareSemver(a, b) {
+  const pa = a.match(SEMVER_RE).slice(1).map(Number);
+  const pb = b.match(SEMVER_RE).slice(1).map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] < pb[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * The semver tags of a list, sorted ascending (oldest first). Non-semver
+ * tags (e.g. legacy timestamp tags) are excluded.
+ */
+export function semverSortAsc(tags) {
+  return [...tags].filter(isSemver).sort(compareSemver);
+}
+
+/**
+ * All tags oldest-first: semver tags numerically ascending, non-semver tags
+ * after them (lexicographically). Display order for kept tags.
+ */
+export function allTagsSortAsc(tags) {
+  return [...tags].sort((a, b) => {
+    const as = isSemver(a);
+    const bs = isSemver(b);
+    if (as && bs) return compareSemver(a, b);
+    if (as !== bs) return as ? -1 : 1;
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}

package/src/utils/ssh-config.js

@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// The CLI owns the block between these markers in the user's ~/.ssh/config.
+// Everything outside the markers is never touched.
+const BEGIN = "# BEGIN coding-container (managed - do not edit between markers)";
+const END = "# END coding-container";
+
+export function sshConfigPath() {
+  return path.join(os.homedir(), ".ssh", "config");
+}
+
+/**
+ * Alias convention for container hosts: coding-<project>.
+ */
+export function sshAlias(project) {
+  return `coding-${project}`;
+}
+
+function readManaged(file) {
+  if (!fs.existsSync(file)) return { before: "", entries: {}, after: "" };
+  const lines = fs.readFileSync(file, "utf8").split(/\r?\n/);
+  const bi = lines.findIndex((l) => l.trim() === BEGIN);
+  if (bi === -1) return { before: lines.join("\n"), entries: {}, after: "" };
+  let ei = lines.findIndex((l, i) => i > bi && l.trim() === END);
+  if (ei === -1) ei = lines.length;
+  const before = lines.slice(0, bi).join("\n");
+  const after = lines.slice(ei + 1).join("\n");
+  const entries = {};
+  let current = null;
+  for (const line of lines.slice(bi + 1, ei)) {
+    const m = line.match(/^Host (coding-[a-z0-9-]+)\s*$/);
+    if (m) {
+      current = m[1];
+      entries[current] = [line];
+    } else if (current && line.trim() !== "") {
+      entries[current].push(line);
+    } else {
+      current = null;
+    }
+  }
+  return { before, entries, after };
+}
+
+function writeManaged(file, before, entries, after) {
+  const parts = [];
+  if (before.trim() !== "") parts.push(before.replace(/\n+$/, ""));
+  parts.push(
+    [BEGIN, ...Object.values(entries).flat(), END].join("\n")
+  );
+  if (after.trim() !== "") parts.push(after.replace(/^\n+/, "").replace(/\n+$/, ""));
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, parts.join("\n") + "\n");
+}
+
+/**
+ * Add or update a container host entry in the managed section.
+ */
+export function addHostEntry(entry, file = sshConfigPath()) {
+  const { before, entries, after } = readManaged(file);
+  entries[entry.alias] = [
+    `Host ${entry.alias}`,
+    `    HostName ${entry.hostName}`,
+    `    Port ${entry.port}`,
+    `    User ${entry.user}`,
+    `    IdentityFile ${entry.identityFile}`,
+    `    StrictHostKeyChecking no`,
+    `    UserKnownHostsFile ${entry.knownHostsFile}`,
+  ];
+  writeManaged(file, before, entries, after);
+}
+
+/**
+ * Remove a container host entry. Returns true if an entry was removed.
+ */
+export function removeHostEntry(alias, file = sshConfigPath()) {
+  const { before, entries, after } = readManaged(file);
+  if (!(alias in entries)) return false;
+  delete entries[alias];
+  writeManaged(file, before, entries, after);
+  return true;
+}