@flisk-sh/flisk-import 0.12.0 → 0.14.0

package/README.md

@@ -14,11 +14,14 @@ flisk import . --yes         # write service.json files and project setup
 - **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
 - **Keeps the install's data:** each named volume gets `name`, the Docker volume `docker compose up` created (`<project>_<volume>`, its own `name:`, or an `external` volume), so `flisk up` mounts the same data with no copy (needs the Flisk release with flisk#2964).
 - **Keeps:** `profiles` (the service starts only with `flisk up --profile`), `env_file` as `envFile`, `tmpfs` and `deploy.resources.limits` (`container.tmpfs`, `cpus`, `memory`).
+- **Keeps:** `stop_grace_period` (`container.stopGracePeriod`, such as `30s`), the `aliases` of every network (`container.networkAliases`), `extra_hosts` in list or map form (`container.extraHosts`, such as `host.docker.internal:host-gateway`) and `ulimits` (`container.ulimits`). A service renamed to kebab-case (`lychee_api` becomes `lychee-api`) keeps its Compose name as a network alias, so `http://lychee_api:8000` in another service still resolves. `container_name` is dropped with a note: Flisk names containers itself. These fields, an image with variables and `on-failure:N` need the Flisk core release that reads them; an older core does not apply them.
 - **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
-- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
-- **Environment:** values that cannot be secrets go into the committed `service.json` `env`: numbers, `true`/`false`, another imported service's address without a user, password or query (`http://invidious:3000`, `redis:6379`), and pure `${VAR}` references. Every other name, and any name that looks like a credential (`PASSWORD`, `TOKEN`, `KEY`, ...), goes into `secrets.required`, with its literal value copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept.
-- **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` as `on-failure`.
-- **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with invalid profile names, `extends`, an out-of-tree build or a `${VAR}` image.
+- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` or `${VAR-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
+- **Environment:** the committed `service.json` `env` gets every pure Compose expression as written, whatever its name (`${DB_PASSWORD:-password}`, `${PORT-8080}`, `${A:-${B:-file}}`), so a fresh clone keeps the defaults, and every literal (`sqlite`, `worker`, `lychee_db`, `http://invidious:3000`) unless its name looks like a credential (`PASSWORD`, `TOKEN`, `KEY`, ...) or the value holds one (a URL with a user or password, a token query parameter, a long random string, a PEM block). Those go into `secrets.required`, with its literal value copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept.
+- **Round trip:** a routed port that Compose also publishes (`"${APP_PORT:-8000}:8000"`) stays in `extraPorts` too, and a `healthcheck` stays as `healthCheck.command` (with `interval`, `timeout`, `retries` and `start_period` as `startPeriod`) even when an HTTP path was read, so `flisk-export compose` writes a file that `docker compose` starts the same way (LycheeOrg/Lychee round-trips with no difference but names and aliases). A service with no `restart` gets `restart: "no"` (Compose restarts nothing unless asked; Flisk defaults to `unless-stopped`), `healthcheck: { disable: true }` or `test: ["NONE"]` becomes `healthCheck: false`, a value that mixes `${VAR}` with literal text (`${SERVER_NAME:-localhost}, php:80`) stays in `env` unless it could hold a credential, `*_FILE` paths (`POSTGRES_PASSWORD_FILE=/run/secrets/pg`) stay in `env`, and the Compose project name (`name:` or the folder's, such as `pl_mail`) is recorded as `composeProjectNames.<stack>` in `.flisk/project.json`, so `flisk-export compose` keeps the container names. A generated Dockerfile for an image with variables declares them as `ARG NAME=default` before `FROM`.
+- **A tracked `.env`:** a repo that commits its `.env` (Symfony) keeps it as it is, and it is not added to `.gitignore`; values that must stay local go to `.env.local` when git already ignores it, else to `.flisk/.env.import` (added to `.gitignore`), and each service that needs them reads that file as `envFile`.
+- **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command; a string is split into exec-form arguments as Compose splits it, with no shell, so `command: server /export` on `minio/minio` stays the arguments of its `ENTRYPOINT`; `$$` becomes `$` as Compose passes it to the container; only a string with Compose variables (`${VAR}`, filled from `.env` by Compose, by the container's shell here) or unbalanced quotes runs through `sh -c`, and the plan says so), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` with its retry limit (N from 1 to 100).
+- **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with invalid profile names, `extends`, an out-of-tree build, or an image with characters or variable forms other than `${NAME}`, `${NAME:-default}` and `${NAME-default}` (`postgres:${POSTGRES_VERSION:-18}-alpine` is written as it is).
 - **Does not start anything.** Run `flisk up` with Flisk core **1.4.26 or later** (`publish` needs it). The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { relative } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { Command } from "commander";
 import "./detectors/index.js";
@@ -59,11 +59,13 @@ const program = new Command("flisk-import")
         console.log(`  wrote ${relative(process.cwd(), item.path) || manifestRelPath(plan, item)}`);
     }
     console.log(`\nWrote ${written.length} service.json file(s)${writes.projectConfig ? " and created .flisk/project.json" : ""}.`);
-    const envFile = relative(process.cwd(), join(writes.projectRoot, ".env")) || ".env";
+    const envFile = relative(process.cwd(), writes.env.path) || ".env";
     console.log("\nNext:");
     const copied = Object.keys(writes.env.add);
     if (copied.length)
         console.log(`  - Copied ${copied.length} environment value(s) from docker-compose.yml to ${envFile} (gitignored).`);
+    if (writes.env.tracked && copied.length)
+        console.log(`  - ${writes.env.tracked} is tracked by git, so it was left as it is and not added to .gitignore; the values went to ${envFile}, which each service that needs them reads as envFile.`);
     if (writes.items.some((item) => item.notes.some((note) => note.startsWith("no literal value"))))
         console.log(`  - Add the values listed above as missing to ${envFile}.`);
     console.log(`  - Run \`flisk up\` with Flisk core ${MIN_CORE_VERSION} or later. The import did not start anything.`);

package/dist/detectors/compose.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, normalize } from "node:path/posix";
 import { isAlias, isMap, parseDocument, visit } from "yaml";
-import { HEALTH_CHECK_PATH_PATTERN } from "../flisk.js";
+import { HEALTH_CHECK_PATH_PATTERN, NETWORK_ALIAS } from "../flisk.js";
 import { registerDetector } from "../registry.js";
 const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 /** Container-side port of one `ports:` entry, in short or long syntax. */
@@ -51,9 +51,14 @@ const TRANSLATED_KEYS = new Set([
     "env_file",
     "tmpfs",
     "deploy",
-    // Flisk gives every service its own stack network and container name, so these change nothing it needs.
+    "stop_grace_period",
+    "extra_hosts",
+    "ulimits",
+    // Only `aliases` is read from networks: Flisk gives every service its own stack network.
     "networks",
     "expose",
+    // Flisk names every container itself; the plan says so.
+    "container_name",
 ]);
 const CAPABILITY = /^[A-Z_]+$/;
 const USER = /^[A-Za-z0-9_.:-]+$/;
@@ -62,6 +67,124 @@ const VOLUME_NAME = /^[a-z0-9][a-z0-9_-]*$/;
 const CONTAINER_PATH = /^\/[A-Za-z0-9_./-]*$/;
 const HOST_PATH = /^[A-Za-z0-9_./-]+$/;
 const RESTART = new Set(["no", "on-failure", "unless-stopped", "always"]);
+/** `on-failure:N` with a retry limit from 1 to 100. */
+const RESTART_LIMIT = /^on-failure:([1-9][0-9]?|100)$/;
+/** A Compose duration such as 30s, 1m30s or 500ms. */
+const DURATION = /^(?:[0-9]+(?:\.[0-9]+)?(?:h|ms|us|m|s))+$/;
+const EXTRA_HOST_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
+/** An extra_hosts address: host-gateway, IPv4, or IPv6 (optionally in brackets). */
+const EXTRA_HOST_ADDRESS = /^(?:host-gateway|[0-9]{1,3}(?:\.[0-9]{1,3}){3}|\[?[0-9A-Fa-f.]*:[0-9A-Fa-f.]*:[0-9A-Fa-f:.]*\]?)$/;
+const ULIMIT_NAME = /^[a-z]+$/;
+/** One extra_hosts entry as `name:address`; undefined when either side is not one Flisk accepts. */
+function extraHostOf(name, address) {
+    if (typeof name !== "string" || typeof address !== "string")
+        return undefined;
+    return EXTRA_HOST_NAME.test(name) && EXTRA_HOST_ADDRESS.test(address)
+        ? `${name}:${address}`
+        : undefined;
+}
+/** Compose extra_hosts in list form (`name:address` or `name=address`) or map form. */
+function extraHostsOf(value) {
+    const kept = [];
+    const bad = [];
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const at = typeof entry === "string" ? entry.search(/[:=]/) : -1;
+            const host = typeof entry === "string" && at > 0
+                ? extraHostOf(entry.slice(0, at), entry.slice(at + 1))
+                : undefined;
+            if (host)
+                kept.push(host);
+            else
+                bad.push(entry);
+        }
+    }
+    else if (isObj(value)) {
+        for (const [name, address] of Object.entries(value)) {
+            const host = extraHostOf(name, address);
+            if (host)
+                kept.push(host);
+            else
+                bad.push({ [name]: address });
+        }
+    }
+    else {
+        bad.push(value);
+    }
+    return { kept: [...new Set(kept)], bad };
+}
+/** Compose ulimits: each a whole number, or { soft, hard } whole numbers with soft no greater than hard. */
+function ulimitsOf(value) {
+    const kept = {};
+    const bad = [];
+    if (!isObj(value))
+        return { kept, bad: [JSON.stringify(value)] };
+    for (const [name, limit] of Object.entries(value)) {
+        if (!ULIMIT_NAME.test(name))
+            bad.push(name);
+        else if (typeof limit === "number" && Number.isInteger(limit))
+            kept[name] = limit;
+        else if (isObj(limit) &&
+            Number.isInteger(limit.soft) &&
+            Number.isInteger(limit.hard) &&
+            Object.keys(limit).every((k) => k === "soft" || k === "hard") &&
+            (limit.hard === -1 || limit.soft <= limit.hard))
+            kept[name] = { soft: limit.soft, hard: limit.hard };
+        else
+            bad.push(name);
+    }
+    return { kept, bad };
+}
+/** Aliases from every network in a `networks` map; the list form names networks only. */
+function networkAliasesOf(value) {
+    const kept = [];
+    const bad = [];
+    if (!isObj(value))
+        return { kept, bad };
+    for (const network of Object.values(value)) {
+        if (!isObj(network) || network.aliases === undefined)
+            continue;
+        const aliases = Array.isArray(network.aliases) ? network.aliases : [network.aliases];
+        for (const alias of aliases) {
+            if (typeof alias === "string" && NETWORK_ALIAS.test(alias))
+                kept.push(alias);
+            else
+                bad.push(alias);
+        }
+    }
+    return { kept: [...new Set(kept)], bad };
+}
+/** stop_grace_period, network aliases, extra_hosts and ulimits, and a line for each value that is not carried over. */
+function networkOptionsOf(raw) {
+    const options = {};
+    const dropped = [];
+    if (raw.stop_grace_period !== undefined) {
+        if (typeof raw.stop_grace_period === "string" && DURATION.test(raw.stop_grace_period))
+            options.stopGracePeriod = raw.stop_grace_period;
+        else
+            dropped.push(`stop_grace_period ${JSON.stringify(raw.stop_grace_period)} is not a duration such as 30s or 1m30s; not used`);
+    }
+    const aliases = networkAliasesOf(raw.networks);
+    if (aliases.kept.length)
+        options.networkAliases = aliases.kept;
+    if (aliases.bad.length)
+        dropped.push(`network aliases ${JSON.stringify(aliases.bad)} are not DNS names (letters, digits, '-', '_' and '.'); not used`);
+    if (raw.extra_hosts !== undefined) {
+        const hosts = extraHostsOf(raw.extra_hosts);
+        if (hosts.kept.length)
+            options.extraHosts = hosts.kept;
+        if (hosts.bad.length)
+            dropped.push(`extra_hosts ${JSON.stringify(hosts.bad)} are not name:address (an IP or host-gateway); not used`);
+    }
+    if (raw.ulimits !== undefined) {
+        const limits = ulimitsOf(raw.ulimits);
+        if (Object.keys(limits.kept).length)
+            options.ulimits = limits.kept;
+        if (limits.bad.length)
+            dropped.push(`ulimits ${limits.bad.join(", ")} are not a whole number or { soft, hard } with soft <= hard; not used`);
+    }
+    return { options, dropped };
+}
 /** Compose `shm_size` as a size string such as 256mb; a number is bytes. */
 function shmSizeOf(value) {
     if (typeof value === "number" && Number.isInteger(value) && value > 0)
@@ -124,8 +247,11 @@ function containerOf(raw) {
     return { ...(Object.keys(container).length ? { container } : {}), dropped };
 }
 /** One published port: container port, host port when Compose names a literal one, and protocol. */
-/** A `publish` value Flisk accepts: digits, dots, colons and `${NAME:-default}` with a port or IPv4 address:port default. */
-const PUBLISH = /^(?:[0-9.:]|\$\{[A-Za-z_][A-Za-z0-9_]*:-[0-9.:]+\})+$/;
+/**
+ * A `publish` value Flisk accepts: digits, dots, colons and `${NAME:-default}` or `${NAME-default}` with a port or IPv4
+ * address:port default.
+ */
+const PUBLISH = /^(?:[0-9.:]|\$\{[A-Za-z_][A-Za-z0-9_]*:?-[0-9.:]+\})+$/;
 /** The host address and port of a published port. Compose publishes on every interface unless an address is given. */
 function hostSideOf(port, hostIp, hostPort) {
     const hostNumber = hostPort && /^\d+$/.test(hostPort) ? Number.parseInt(hostPort, 10) : undefined;
@@ -145,6 +271,12 @@ function hostSideOf(port, hostIp, hostPort) {
     const publish = `${hostIp}:${hostNumber ?? port}`;
     return /^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(publish) ? { publish } : undefined;
 }
+/** Whether a `ports:` entry names a host port ("8000:8000", "127.0.0.1:8000:8000", `published:`), not only a container port. */
+function hasHostSide(entry) {
+    if (isObj(entry))
+        return entry.published !== undefined;
+    return typeof entry === "string" && (entry.split("/")[0] ?? "").includes(":");
+}
 function publishedPort(entry) {
     const port = containerPort(entry);
     if (port === undefined)
@@ -226,7 +358,7 @@ function volumeOf(entry, composeDir) {
     return { source: resolved, target, ...(readOnly ? { readOnly } : {}), bind };
 }
 /** Compose's project name: top-level `name`, else the directory name, lowercased with other characters dropped. */
-function projectNameOf(root, absPath) {
+export function projectNameOf(root, absPath) {
     const raw = isObj(root) && typeof root.name === "string" && !root.name.includes("$")
         ? root.name
         : basename(dirname(absPath));
@@ -273,9 +405,76 @@ function envValues(environment) {
     }
     return out;
 }
-/** A value that is nothing but Compose interpolation, such as `${URL}` or `${PORT:-80}`. Holds no secret itself. */
-const ONLY_REFERENCES = /^(\$\{[A-Za-z_][A-Za-z0-9_]*(?::?[-?+][^}\n]*)?\})+$/;
-/** Values that are only `${VAR}` references, which service.json `env` can keep as they are (Flisk 1.4.24). */
+/** The end of the `${...}` expression that starts at `start`, nested defaults included; undefined when it is not one. */
+function expressionEnd(text, start) {
+    if (!text.startsWith("${", start))
+        return undefined;
+    const name = /^[A-Za-z_][A-Za-z0-9_]*/.exec(text.slice(start + 2));
+    if (!name)
+        return undefined;
+    let i = start + 2 + name[0].length;
+    if (text[i] === "}")
+        return i + 1;
+    const op = /^:?[-?+]/.exec(text.slice(i));
+    if (!op)
+        return undefined;
+    i += op[0].length;
+    while (i < text.length) {
+        if (text.startsWith("${", i)) {
+            const end = expressionEnd(text, i);
+            if (end === undefined)
+                return undefined;
+            i = end;
+        }
+        else if (text[i] === "}")
+            return i + 1;
+        else if (text[i] === "\n" || text[i] === "$")
+            return undefined;
+        else
+            i++;
+    }
+    return undefined;
+}
+/**
+ * A value that is nothing but Compose interpolation: `${URL}`, `${PORT:-80}`, `${PORT-80}`, nested `${A:-${B:-file}}`.
+ * It holds no secret itself (a default is what the project's Compose file already commits), so it stays in `env`.
+ */
+export function isComposeExpression(value) {
+    let i = 0;
+    while (i < value.length) {
+        const end = expressionEnd(value, i);
+        if (end === undefined)
+            return false;
+        i = end;
+    }
+    return value.length > 0;
+}
+/**
+ * A value that mixes Compose expressions with literal text (`${SERVER_NAME:-localhost, :443}, php:80`), every `${`
+ * starting a valid expression. Undefined when it is not one; else the literal text with the expressions taken out.
+ */
+export function composeTemplateText(value) {
+    if (!value.includes("${") || value.includes("\n"))
+        return undefined;
+    let literal = "";
+    let i = 0;
+    while (i < value.length) {
+        if (value.startsWith("${", i)) {
+            const end = expressionEnd(value, i);
+            if (end === undefined)
+                return undefined;
+            i = end;
+        }
+        else {
+            if (value[i] === "$" && value[i + 1] !== "$")
+                return undefined;
+            literal += value[i];
+            i++;
+        }
+    }
+    return literal;
+}
+/** Values with `${VAR}` references (alone or in literal text), which service.json `env` can keep as they are (Flisk 1.4.24). */
 function envReferences(environment) {
     const pairs = Array.isArray(environment)
         ? environment
@@ -286,7 +485,7 @@ function envReferences(environment) {
             : [];
     const out = {};
     for (const [key, raw] of pairs) {
-        if (typeof raw === "string" && ONLY_REFERENCES.test(raw))
+        if (typeof raw === "string" && composeTemplateText(raw) !== undefined)
             out[key] = raw;
     }
     return out;
@@ -298,22 +497,135 @@ function commandOf(command) {
         return command.join(" ");
     return undefined;
 }
-/** Compose `command` as the argument vector the container runs; a string goes through a shell, as Compose runs it. */
+/**
+ * A Compose `command`/`entrypoint` string split into arguments the way Compose splits it (shell words: whitespace,
+ * '...' kept as it is, "..." with \" \\ \$ \` escapes, a backslash escaping the next character). Compose runs no shell.
+ * Undefined when the quotes or a trailing backslash do not balance.
+ */
+export function shellWords(text) {
+    const words = [];
+    let word = "";
+    let inWord = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === "'") {
+            const end = text.indexOf("'", i + 1);
+            if (end === -1)
+                return undefined;
+            word += text.slice(i + 1, end);
+            inWord = true;
+            i = end;
+        }
+        else if (ch === '"') {
+            inWord = true;
+            let closed = false;
+            for (i++; i < text.length; i++) {
+                const c = text[i];
+                if (c === '"') {
+                    closed = true;
+                    break;
+                }
+                if (c === "\\" && i + 1 < text.length && '"\\$`'.includes(text[i + 1])) {
+                    word += text[i + 1];
+                    i++;
+                }
+                else
+                    word += c;
+            }
+            if (!closed)
+                return undefined;
+        }
+        else if (ch === "\\") {
+            if (i + 1 >= text.length)
+                return undefined;
+            word += text[i + 1];
+            inWord = true;
+            i++;
+        }
+        else if (/\s/.test(ch)) {
+            if (inWord)
+                words.push(word);
+            word = "";
+            inWord = false;
+        }
+        else {
+            word += ch;
+            inWord = true;
+        }
+    }
+    if (inWord)
+        words.push(word);
+    return words;
+}
+/**
+ * Compose `command`/`entrypoint` as the argument vector the container runs. A list is kept as it is; a string is split
+ * into words as Compose splits it, with no shell, so an image ENTRYPOINT (minio) gets `server /export` as its arguments.
+ * Only a string that cannot be split, or that reads `$VAR` at run time, runs through `sh -c`; `shell` says why.
+ */
 function containerCommandOf(command) {
-    if (typeof command === "string" && command.trim())
-        return ["sh", "-c", command];
-    if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string"))
-        return command;
+    if (typeof command === "string" && command.trim()) {
+        const { text, interpolates } = unescapeDollars(command);
+        if (interpolates)
+            return {
+                argv: ["sh", "-c", text],
+                note: "uses Compose variables, which Compose filled from .env; in the generated Dockerfile it runs through sh -c, so the container's shell fills them from its own environment",
+            };
+        const words = shellWords(text);
+        return words?.length
+            ? { argv: words }
+            : {
+                argv: ["sh", "-c", text],
+                note: "has unbalanced quotes; it runs through sh -c, which Compose would not do",
+            };
+    }
+    if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string")) {
+        const parts = command.map(unescapeDollars);
+        return {
+            argv: parts.map((p) => p.text),
+            ...(parts.some((p) => p.interpolates)
+                ? {
+                    note: "uses Compose variables, which Compose filled from .env; the generated Dockerfile passes them as written (a sh -c argument fills them from the container's environment)",
+                }
+                : {}),
+        };
+    }
     return undefined;
 }
-/** Seconds from a Compose duration such as `30s` or `2m`; undefined for anything it cannot read exactly. */
+/**
+ * A Compose command as the container sees it: `$$` is Compose's escape for a literal `$` (so `$$PASSWORD` reaches the
+ * container's shell as `$PASSWORD`). `interpolates` says whether a single `$` (`${VAR}`, `$VAR`) asks Compose to fill
+ * a value from .env, which a Dockerfile cannot do.
+ */
+function unescapeDollars(value) {
+    let text = "";
+    let interpolates = false;
+    for (let i = 0; i < value.length; i++) {
+        if (value[i] === "$" && value[i + 1] === "$") {
+            text += "$";
+            i++;
+            continue;
+        }
+        if (value[i] === "$" && /[{A-Za-z_]/.test(value[i + 1] ?? ""))
+            interpolates = true;
+        text += value[i];
+    }
+    return { text, interpolates };
+}
+const DURATION_UNIT = { h: 3600, m: 60, s: 1, ms: 0.001, us: 0.000001 };
+/** Seconds from a Compose duration such as `30s`, `2m` or `1m30s`; undefined for anything it cannot read exactly. */
 function secondsOf(value) {
     if (typeof value === "number" && value > 0)
         return value;
-    const match = typeof value === "string" ? value.match(/^(\d+)(s|m)?$/) : null;
-    if (!match)
+    if (typeof value !== "string")
+        return undefined;
+    if (/^\d+$/.test(value))
+        return Number(value) > 0 ? Number(value) : undefined;
+    if (!DURATION.test(value))
         return undefined;
-    const seconds = Number(match[1]) * (match[2] === "m" ? 60 : 1);
+    let seconds = 0;
+    for (const [, amount, unit] of value.matchAll(/([0-9]+(?:\.[0-9]+)?)(h|ms|us|m|s)/g))
+        seconds += Number(amount) * DURATION_UNIT[unit];
+    seconds = Math.round(seconds * 1000) / 1000;
     return seconds > 0 ? seconds : undefined;
 }
 /** Compose `healthcheck` as a probe command (exit 0 is ready). `NONE` and `disable` give no probe. */
@@ -335,6 +647,7 @@ function healthProbeOf(healthcheck) {
         return undefined;
     const interval = secondsOf(healthcheck.interval);
     const timeout = secondsOf(healthcheck.timeout);
+    const startPeriod = secondsOf(healthcheck.start_period);
     const retries = typeof healthcheck.retries === "number" &&
         Number.isInteger(healthcheck.retries) &&
         healthcheck.retries > 0
@@ -345,6 +658,7 @@ function healthProbeOf(healthcheck) {
         ...(interval ? { interval } : {}),
         ...(timeout ? { timeout } : {}),
         ...(retries ? { retries } : {}),
+        ...(startPeriod ? { startPeriod } : {}),
     };
 }
 /** The models a service uses, joined to their top-level definitions. A model without a literal `model` is skipped. */
@@ -552,9 +866,25 @@ registerDetector({
                     : [];
             const command = commandOf(raw.command);
             const models = modelsOf(raw.models, isObj(root) ? root.models : undefined);
-            const containerCommand = containerCommandOf(raw.command);
-            const containerEntrypoint = containerCommandOf(raw.entrypoint);
-            const healthProbe = healthProbeOf(raw.healthcheck);
+            const commandArgs = containerCommandOf(raw.command);
+            const entrypointArgs = containerCommandOf(raw.entrypoint);
+            const containerCommand = commandArgs?.argv;
+            const containerEntrypoint = entrypointArgs?.argv;
+            for (const [key, args] of [
+                ["command", commandArgs],
+                ["entrypoint", entrypointArgs],
+            ]) {
+                if (args?.note)
+                    skips.push({
+                        ...base,
+                        reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} ${args.note}`,
+                    });
+            }
+            // `disable: true` or `test: ["NONE"]` turns off the image's own HEALTHCHECK too, so it is kept as healthCheck: false.
+            const healthOff = isObj(raw.healthcheck) &&
+                (raw.healthcheck.disable === true ||
+                    (Array.isArray(raw.healthcheck.test) && raw.healthcheck.test[0] === "NONE"));
+            const healthProbe = healthOff ? false : healthProbeOf(raw.healthcheck);
             const envKeys = envNames(raw.environment);
             const env = envValues(raw.environment);
             const envRefs = envReferences(raw.environment);
@@ -571,9 +901,18 @@ registerDetector({
             const { container: options, dropped } = containerOf(raw);
             const limits = runtimeLimitsOf(raw);
             const { dropped: limitsDropped, ...limitValues } = limits;
-            const container = options || Object.keys(limitValues).length
-                ? { ...(options ?? {}), ...limitValues }
-                : undefined;
+            const network = networkOptionsOf(raw);
+            const merged = { ...(options ?? {}), ...limitValues, ...network.options };
+            const container = Object.keys(merged).length ? merged : undefined;
+            for (const reason of network.dropped) {
+                skips.push({ ...base, reason: `service "${name}" ${reason}` });
+            }
+            if (raw.container_name !== undefined) {
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" container_name ${JSON.stringify(raw.container_name)} is dropped: Flisk names containers itself; other services reach it by its service name`,
+                });
+            }
             for (const key of limitsDropped) {
                 skips.push({ ...base, reason: `service "${name}" ${key} is not carried over; not used` });
             }
@@ -590,11 +929,14 @@ registerDetector({
                     reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} has values Flisk does not accept; not used`,
                 });
             }
-            // Every published port Flisk does not route stays published on the same host address (service.json extraPorts).
+            // Every published port stays published on the same host address (service.json extraPorts). The routed port too,
+            // when Compose gives it a host side ("${APP_PORT:-8000}:8000"), so the app is still reachable without Traefik
+            // (and in an exported docker-compose.yml); a bare routed "8000" is reached through Traefik only.
             const proxied = selectedPort !== undefined && !NON_HTTP_PORTS.has(selectedPort);
             const extraPorts = (Array.isArray(raw.ports) ? raw.ports : [])
+                .filter((entry) => containerPort(entry) !== selectedPort || !proxied || hasHostSide(entry))
                 .map(publishedPort)
-                .filter((p) => p !== undefined && (p.port !== selectedPort || !proxied));
+                .filter((p) => p !== undefined);
             let sidecarOf;
             if (raw.network_mode !== undefined) {
                 const mode = typeof raw.network_mode === "string" ? raw.network_mode : "";
@@ -622,23 +964,15 @@ registerDetector({
                         reason: `service "${name}" volume ${JSON.stringify(entry)} is not translated (an anonymous volume, a path outside the imported directory, or Compose variables); not mounted`,
                     });
             }
-            // `on-failure:5` caps the retries; Flisk has the policy without the cap.
-            const restartName = typeof raw.restart === "string"
-                ? raw.restart.replace(/^(on-failure):\d+$/, "$1")
+            // `on-failure:5` caps the retries at 5; service.json keeps the cap (1 to 100).
+            const restart = typeof raw.restart === "string" &&
+                (RESTART.has(raw.restart) || RESTART_LIMIT.test(raw.restart))
+                ? raw.restart
                 : undefined;
-            const restart = restartName !== undefined && RESTART.has(restartName)
-                ? restartName
-                : undefined;
-            if (restart && restartName !== raw.restart) {
-                skips.push({
-                    ...base,
-                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} keeps "${restart}"; the retry limit is not carried over`,
-                });
-            }
             if (raw.restart !== undefined && !restart) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} is not a policy Flisk accepts; not used`,
+                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} is not a policy Flisk accepts (no, always, unless-stopped, on-failure, on-failure:1 to 100); not used`,
                 });
             }
             const untranslated = Object.keys(raw).filter((key) => !TRANSLATED_KEYS.has(key));
@@ -664,7 +998,7 @@ registerDetector({
                 ...(models ? { models } : {}),
                 ...(profiles ? { profiles } : {}),
                 ...(envFile ? { envFile } : {}),
-                ...(healthProbe ? { healthCheck: healthProbe } : {}),
+                ...(healthProbe !== undefined ? { healthCheck: healthProbe } : {}),
                 ...(selectedPort !== undefined ? { port: selectedPort } : {}),
                 ...(healthCheckPath ? { healthCheckPath } : {}),
                 exposeViaProxy,
@@ -676,7 +1010,8 @@ registerDetector({
                 ...(extraPorts.length ? { extraPorts } : {}),
                 ...(sidecarOf ? { sidecarOf } : {}),
                 ...(volumes.length ? { volumes } : {}),
-                ...(restart ? { restart } : {}),
+                // Compose restarts nothing unless asked; Flisk defaults to unless-stopped, so "no" is written.
+                ...(restart ? { restart } : raw.restart === undefined ? { restart: "no" } : {}),
                 confidence: "high",
                 sources: [base],
             });

package/dist/flisk.js

@@ -22,7 +22,13 @@ export const BYO_PORT_RANGE = { min: 4000, max: 5999, label: "4000-5999" };
  * the manifest (flisk `cli/src/utils/service-manifest.ts`, engine `manifest/parser.star`).
  */
 export const HEALTH_CHECK_PATH_PATTERN = /^\/[a-z0-9/-]*$/;
-export const IMAGE_PATTERN = /^[A-Za-z0-9._/:@-]+$/;
+/**
+ * An image reference, which may hold Compose variables `${NAME}`, `${NAME:-default}` and `${NAME-default}` (postgres:${PG_VERSION:-18}-alpine);
+ * Compose resolves them from the project .env. Nothing else: no quotes, spaces or newlines that could change generated YAML.
+ */
+export const IMAGE_PATTERN = /^(?:[A-Za-z0-9._/:@-]|\$\{[A-Za-z_][A-Za-z0-9_]*(?::?-[A-Za-z0-9._/:@-]*)?\})+$/;
+/** A DNS name for a network alias: letters, digits, '-', '_' and '.'. */
+export const NETWORK_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
 const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 export function validateName(label, name) {
     return KEBAB.test(name)

package/dist/format.js

@@ -11,6 +11,8 @@ export function formatPlan(plan, writes) {
     out.push(`Found ${plan.services.length - jobs} service(s) and ${jobs} job(s) in ${plan.root}`, `Read only: ${plan.files.join(", ")}. Lines below name what was not translated.`, "");
     if (writes.projectConfig)
         out.push(`  .flisk/project.json  [create Flisk project]`, "");
+    if (writes.projectConfigUpdate)
+        out.push(`  .flisk/project.json  [add composeProjectNames.${writes.stack}: "${writes.composeProjectName}", so an export keeps the Compose project name]`, "");
     for (const service of plan.services) {
         const item = writes.items.find((i) => i.service === service);
         out.push(`  ${service.name}  (${service.kind}${service.dir ? `, ${service.dir}/` : ""})`);

package/dist/write.js

@@ -1,7 +1,10 @@
+import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { composeTemplateText, isComposeExpression, projectNameOf } from "./detectors/compose.js";
 import { ImportError } from "./errors.js";
-import { BYO_PORT_RANGE, defaultProjectConfig, findProjectRoot, IMAGE_PATTERN, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
+import { BYO_PORT_RANGE, defaultProjectConfig, findProjectRoot, IMAGE_PATTERN, NETWORK_ALIAS, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
 import { toResourceName } from "./merge.js";
 import { usedManifestPorts } from "./plan.js";
 /** Secret names the service schema accepts (`secrets.required`). */
@@ -9,28 +12,47 @@ const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
 /** Names that may hold a credential whatever their value looks like; these always stay secrets. */
 const CREDENTIAL_NAME = /PASS|SECRET|TOKEN|KEY|PRIVATE|CREDENTIAL|AUTH|HMAC|SALT|CERT|SESSION|COOKIE/i;
 /**
- * Whether a literal Compose value cannot be a secret, so it may be committed in service.json `env`: a number, true or false,
- * or the address of another service in this import (a URL or host:port with no user, password, query or fragment).
+ * Whether a literal value may hold a credential although its name does not say so: a URL or `user:pass@host` with a
+ * user or password, a query parameter named like a credential, a PEM block, a long random-looking token, or a value
+ * that says it is one (SECRET, TOKEN, PASSWORD).
  */
-function isPlainValue(value, serviceHosts) {
-    if (/^-?\d+(\.\d+)?$/.test(value) || /^(true|false)$/i.test(value))
+/** Query parameters that carry a credential (`?token=`, `?api_key=`, `&sig=`); `authSource` and the like do not. */
+const CREDENTIAL_QUERY = /token|secret|pass(word|wd)?$|api[_-]?key|^key$|^sig(nature)?$|access[_-]?key/i;
+function looksSecret(value) {
+    if (/^[^\s:@/]+:[^\s@/]+@/.test(value) || value.includes("-----BEGIN"))
         return true;
-    const hostPort = value.match(/^([a-z0-9][a-z0-9._-]*):(\d{1,5})$/);
-    if (hostPort)
-        return serviceHosts.has(hostPort[1]);
+    if (/SECRET|TOKEN|PASSWORD|PASSWD/i.test(value))
+        return true;
+    if (/^[A-Za-z0-9+/_=.-]{32,}$/.test(value) && /[0-9]/.test(value) && /[A-Za-z]/.test(value))
+        return true;
+    if (!value.includes("://"))
+        return false;
     try {
         const url = new URL(value);
-        return (serviceHosts.has(url.hostname) &&
-            !url.username &&
-            !url.password &&
-            !url.search &&
-            !url.hash &&
-            /^[A-Za-z0-9._~/-]*$/.test(url.pathname));
+        return (Boolean(url.username || url.password) ||
+            [...url.searchParams.keys()].some((key) => CREDENTIAL_QUERY.test(key)));
     }
     catch {
-        return false;
+        return /:\/\/[^/\s]*@/.test(value);
     }
 }
+/**
+ * `ARG` lines for the Compose variables in an image, so `FROM postgres:${POSTGRES_VERSION:-18}-alpine` can use them:
+ * Docker substitutes only build arguments declared before FROM. The default is the expression's.
+ */
+function buildArgLines(image) {
+    const args = new Map();
+    for (const m of image.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::?-([^}]*))?\}/g))
+        if (!args.has(m[1]))
+            args.set(m[1], m[2]);
+    return [...args]
+        .map(([name, value]) => (value === undefined ? `ARG ${name}\n` : `ARG ${name}=${value}\n`))
+        .join("");
+}
+/** `POSTGRES_PASSWORD_FILE=/run/secrets/pg`: the path of a mounted secret file, which is not a secret itself. */
+function isSecretFilePath(key, value) {
+    return /_FILE$/.test(key) && /^\/[A-Za-z0-9_./-]+$/.test(value);
+}
 function readEnvKeys(path) {
     if (!existsSync(path))
         return new Set();
@@ -71,16 +93,27 @@ export function planWrites(plan, force) {
     }
     const servicesDir = join(projectRoot, "services");
     const projectConfigPath = join(projectRoot, ".flisk", "project.json");
+    const composeProjectName = composeProjectNameOf(plan);
+    const composeNames = composeProjectName
+        ? { composeProjectNames: { [stack]: composeProjectName } }
+        : {};
     const projectConfig = existsSync(projectConfigPath)
         ? undefined
         : {
             path: projectConfigPath,
-            content: `${JSON.stringify(defaultProjectConfig(projectRoot, {
-                description: "Flisk proxy and imported Compose services",
-                enabledStacks: ["proxy", stack],
-            }), null, 2)}\n`,
+            content: `${JSON.stringify({
+                ...defaultProjectConfig(projectRoot, {
+                    description: "Flisk proxy and imported Compose services",
+                    enabledStacks: ["proxy", stack],
+                }),
+                ...composeNames,
+            }, null, 2)}\n`,
         };
-    const envPath = join(projectRoot, ".env");
+    const projectConfigUpdate = projectConfig
+        ? undefined
+        : withComposeProjectName(projectConfigPath, stack, composeProjectName);
+    const envTarget = localEnvFile(projectRoot);
+    const envPath = envTarget.path;
     const envKept = readEnvKeys(envPath);
     const envAdd = {};
     const used = usedManifestPorts(servicesDir);
@@ -96,15 +129,13 @@ export function planWrites(plan, force) {
                 : !service.image
                     ? "Compose gives it neither `image` nor a usable `build`"
                     : !IMAGE_PATTERN.test(service.image)
-                        ? `image "${service.image}" uses Compose variables or characters Flisk does not accept; set a literal image in docker-compose.yml, or write this service.json by hand`
+                        ? `image "${service.image}" has characters Flisk does not accept (Compose variables may only be \${NAME}, \${NAME:-default} or \${NAME-default}); fix it in docker-compose.yml, or write this service.json by hand`
                         : undefined;
         if (reason)
             rejected.push({ name: service.name, reason });
         return !reason;
     });
     const names = new Set(accepted.map((s) => s.name));
-    // Hostnames other services use for these: the resource name, which stays the container hostname, and the Compose name.
-    const serviceHosts = new Set(plan.services.flatMap((s) => (s.originalName ? [s.name, s.originalName] : [s.name])));
     for (const service of accepted) {
         const path = resolve(servicesDir, stack, service.name, "service.json");
         const exists = existsSync(path);
@@ -155,28 +186,39 @@ export function planWrites(plan, force) {
         // Infrastructure images and one-shot jobs do not serve HTTP, so an assumed "/" would only
         // fail the probe. Leave the path out; the runtime then skips the HTTP probe.
         const nonHttp = service.kind === "job" || (service.image !== undefined && NON_HTTP_IMAGE.test(service.image));
-        const healthCheckPath = isPrivate || nonHttp ? undefined : (service.healthCheckPath ?? "/");
-        if (nonHttp && !isPrivate)
+        const healthOff = service.healthCheck === false;
+        const healthCheckPath = isPrivate || nonHttp || healthOff ? undefined : (service.healthCheckPath ?? "/");
+        if (healthOff)
+            notes.push("healthCheck: false: Compose turns the healthcheck off");
+        else if (nonHttp && !isPrivate)
             notes.push("no health path: the service does not serve HTTP (non-HTTP image or job)");
-        if (!isPrivate && !nonHttp && !service.healthCheckPath)
+        if (!isPrivate && !nonHttp && !healthOff && !service.healthCheckPath)
             notes.push("health path / is assumed: no HTTP health path could be read from Compose. Traefik routes only while it answers 2xx or 3xx");
-        // A probe command is the only way to describe a non-HTTP check; a routed service keeps its HTTP path.
-        const healthCheck = service.healthCheck && !(healthCheckPath && service.healthCheckPath)
-            ? service.healthCheck
-            : undefined;
-        // Values that cannot be secrets (numbers, booleans, another service's address, pure ${VAR} references) go into the
-        // committed service.json `env` (Flisk 1.4.24). Every other name is a secret: Flisk injects it from the gitignored .env.
+        // The Compose healthcheck stays as healthCheck.command (with its interval, timeout, retries and start period) even
+        // when an HTTP path was read too, so an exported docker-compose.yml keeps it and `condition: service_healthy` holds.
+        const healthCheck = service.healthCheck;
+        if (healthCheck && healthCheckPath && service.healthCheckPath)
+            notes.push(`healthCheck.command ${JSON.stringify(healthCheck.command)} is kept as Compose wrote it; Flisk probes with it instead of ${healthCheckPath}`);
+        // What goes into the committed service.json `env` (Flisk 1.4.24): a pure Compose expression (`${X}`, `${X:-default}`,
+        // `${A:-${B:-file}}`) as it is, whatever its name, since its default is already committed in the Compose file; and
+        // a literal whose name does not look like a credential and whose value does not hold one. Every other name is a
+        // secret: Flisk injects it from the gitignored .env, which gets the literal value.
         const validNames = service.envKeys.filter((key) => ENV_NAME.test(key));
         const env = {};
         for (const key of validNames) {
-            if (CREDENTIAL_NAME.test(key))
-                continue;
             const literal = service.env[key];
             const reference = service.envRefs[key];
-            if (literal !== undefined && isPlainValue(literal, serviceHosts))
+            if (literal === undefined && reference !== undefined) {
+                // A pure expression is committed whatever its name; one mixed with literal text only when that text, with
+                // the expressions taken out, could not be a credential (`mongodb://${USER}:${PASSWORD:-x}@db/app` can).
+                const text = composeTemplateText(reference) ?? "";
+                if (isComposeExpression(reference) || (!CREDENTIAL_NAME.test(key) && !looksSecret(text)))
+                    env[key] = reference;
+            }
+            else if (literal !== undefined && isSecretFilePath(key, literal))
+                env[key] = literal;
+            else if (literal !== undefined && !CREDENTIAL_NAME.test(key) && !looksSecret(literal))
                 env[key] = literal;
-            else if (literal === undefined && reference !== undefined)
-                env[key] = reference;
         }
         const referenced = [
             ...new Set(Object.values(env).flatMap((value) => [...value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?-)?/g)]
@@ -213,7 +255,7 @@ export function planWrites(plan, force) {
         if (wrapWithCommand) {
             files.push({
                 path: resolve(dirname(path), "Dockerfile"),
-                content: `# From the Compose \`command\` of this service (flisk import). Flisk sets no container command, so it lives here.\nFROM ${service.image}\n${service.containerEntrypoint ? `ENTRYPOINT ${JSON.stringify(service.containerEntrypoint)}\n` : ""}${service.containerCommand ? `CMD ${JSON.stringify(service.containerCommand)}\n` : ""}`,
+                content: `# From the Compose \`command\` of this service (flisk import). Flisk sets no container command, so it lives here.\n${buildArgLines(service.image)}FROM ${service.image}\n${service.containerEntrypoint ? `ENTRYPOINT ${JSON.stringify(service.containerEntrypoint)}\n` : ""}${service.containerCommand ? `CMD ${JSON.stringify(service.containerCommand)}\n` : ""}`,
             });
             notes.push(`${service.containerEntrypoint ? "entrypoint" : "command"} ${JSON.stringify(service.containerEntrypoint ?? service.containerCommand)} is written to a Dockerfile on ${service.image}`);
         }
@@ -234,6 +276,31 @@ export function planWrites(plan, force) {
             : undefined;
         if (service.sidecarOf && !sidecarOf)
             notes.push(`network_mode not written: "${service.sidecarOf}" is not in this import`);
+        // A renamed service keeps its Compose name as a network alias, so `http://lychee_api:8000` or `DB_HOST=lychee_db`
+        // in another service still resolves. A sidecar has no network of its own, so it gets no aliases.
+        const renamed = service.originalName && service.originalName !== service.name
+            ? service.originalName
+            : undefined;
+        const keepRenamed = renamed !== undefined && NETWORK_ALIAS.test(renamed);
+        if (renamed && !keepRenamed)
+            notes.push(`"${renamed}" is not kept as a network alias: it is not a DNS name`);
+        const aliases = [
+            ...new Set([...(service.container?.networkAliases ?? []), ...(keepRenamed ? [renamed] : [])]),
+        ].filter((alias) => alias !== service.name);
+        let container = service.container;
+        if (sidecarOf) {
+            if (aliases.length)
+                notes.push(`network aliases not written (${aliases.join(", ")}): a sidecar shares "${sidecarOf}"'s network`);
+            if (container?.networkAliases) {
+                const { networkAliases: _aliases, ...rest } = container;
+                container = Object.keys(rest).length ? rest : undefined;
+            }
+        }
+        else if (aliases.length) {
+            container = { ...(container ?? {}), networkAliases: aliases };
+            if (keepRenamed)
+                notes.push(`network alias "${renamed}" keeps the Compose name, so other services that call it by that name still reach it`);
+        }
         const extraPorts = sidecarOf ? [] : (service.extraPorts ?? []);
         if (sidecarOf && service.extraPorts?.length)
             notes.push(`ports not written: a sidecar has none of its own; publish them on "${sidecarOf}"`);
@@ -262,6 +329,10 @@ export function planWrites(plan, force) {
             return [{ ...volume, source: rel.startsWith(".") ? rel : `./${rel}` }];
         });
         // env_file paths are relative to the service directory in service.json, and must stay inside the project.
+        // With the project .env tracked by git, secrets live in another local file, which Flisk then reads as envFile.
+        const localEnv = envTarget.git.tracked && secretNames.length
+            ? [relative(dirname(path), envPath).split("\\").join("/")]
+            : [];
         const envFile = (service.envFile ?? []).flatMap((file) => {
             const absolute = resolve(plan.root, file);
             const fromProject = relative(projectRoot, absolute).split("\\").join("/");
@@ -279,7 +350,7 @@ export function planWrites(plan, force) {
             stack,
             port,
             ...(healthCheckPath ? { healthCheckPath } : {}),
-            ...(healthCheck ? { healthCheck } : {}),
+            ...(healthCheck !== undefined ? { healthCheck } : {}),
             ...source,
             ...(isPrivate ? { exposeViaProxy: false } : {}),
             ...(dependsOn.length ? { dependsOn } : {}),
@@ -288,10 +359,12 @@ export function planWrites(plan, force) {
                 : {}),
             ...(secretNames.length ? { secrets: { required: secretNames } } : {}),
             ...(service.restart ? { restart: service.restart } : {}),
-            ...(service.container ? { container: service.container } : {}),
+            ...(container ? { container } : {}),
             ...(service.models ? { models: service.models } : {}),
             ...(service.profiles ? { profiles: service.profiles } : {}),
-            ...(envFile.length ? { envFile } : {}),
+            ...(envFile.length || localEnv.length
+                ? { envFile: [...new Set([...envFile, ...localEnv])] }
+                : {}),
             ...(extraPorts.length ? { extraPorts } : {}),
             ...(sidecarOf ? { sidecarOf } : {}),
             ...(volumes.length
@@ -313,8 +386,10 @@ export function planWrites(plan, force) {
         stack,
         items,
         projectConfig,
+        ...(projectConfigUpdate ? { projectConfigUpdate } : {}),
+        ...(composeProjectName ? { composeProjectName } : {}),
         rejected,
-        env: { path: envPath, add: envAdd },
+        env: { path: envPath, add: envAdd, ...envTarget.git },
     };
 }
 export function applyWrites(writes) {
@@ -323,6 +398,8 @@ export function applyWrites(writes) {
         mkdirSync(dirname(writes.projectConfig.path), { recursive: true });
         writeFileSync(writes.projectConfig.path, writes.projectConfig.content, { flag: "wx" });
     }
+    if (writes.projectConfigUpdate)
+        writeFileSync(writes.projectConfigUpdate.path, writes.projectConfigUpdate.content);
     for (const item of writes.items) {
         if (item.status === "exists")
             continue;
@@ -338,14 +415,88 @@ export function applyWrites(writes) {
         const lines = keys.map((key) => envLine(key, writes.env.add[key]));
         const block = `${existing && !existing.endsWith("\n") ? "\n" : ""}# From docker-compose.yml (flisk import)\n${lines.join("\n")}\n`;
         writeFileSync(writes.env.path, existing + block);
-        ensureGitignored(writes.projectRoot, ".env");
+        mkdirSync(dirname(writes.env.path), { recursive: true });
+        if (writes.env.gitignore)
+            ensureGitignored(writes.projectRoot, writes.env.gitignore);
     }
     return written;
 }
 export function manifestRelPath(plan, item) {
     return relative(plan.root, item.path).split("\\").join("/");
 }
-/** Keeps the project .env out of git: it now holds values copied from docker-compose.yml. */
+/** The project name `docker compose` gives the imported Compose file: its `name:`, else its folder's name. */
+function composeProjectNameOf(plan) {
+    const file = plan.files.find((f) => /^(docker-)?compose\.ya?ml$/.test(f));
+    if (!file)
+        return undefined;
+    const absPath = join(plan.root, file);
+    try {
+        return projectNameOf(parseYaml(readFileSync(absPath, "utf8"), { merge: true }), absPath);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** An existing project.json with `composeProjectNames.<stack>` set, or undefined when it has it already or is unreadable. */
+function withComposeProjectName(path, stack, name) {
+    if (!name)
+        return undefined;
+    try {
+        const config = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof config !== "object" || config === null || Array.isArray(config))
+            return undefined;
+        const names = typeof config.composeProjectNames === "object" && config.composeProjectNames !== null
+            ? config.composeProjectNames
+            : {};
+        if (names[stack] === name)
+            return undefined;
+        return {
+            path,
+            content: `${JSON.stringify({ ...config, composeProjectNames: { ...names, [stack]: name } }, null, 2)}\n`,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether git in `root` tracks `file` (false outside a git repo, or without git). */
+function gitTracks(root, file) {
+    try {
+        execFileSync("git", ["-C", root, "ls-files", "--error-unmatch", file], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether git in `root` ignores `file` (false outside a git repo, or without git). */
+function gitIgnores(root, file) {
+    try {
+        execFileSync("git", ["-C", root, "check-ignore", "-q", file], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The local file that gets values copied from docker-compose.yml: the project .env, never one git tracks. A tracked
+ * .env is left as it is, and not added to .gitignore.
+ */
+function localEnvFile(projectRoot) {
+    if (!gitTracks(projectRoot, ".env"))
+        return { path: join(projectRoot, ".env"), git: { gitignore: ".env" } };
+    if (gitIgnores(projectRoot, ".env.local") && !gitTracks(projectRoot, ".env.local"))
+        return { path: join(projectRoot, ".env.local"), git: { tracked: ".env" } };
+    return {
+        path: join(projectRoot, ".flisk", ".env.import"),
+        git: {
+            tracked: ".env",
+            ...(gitIgnores(projectRoot, ".flisk/.env.import") ? {} : { gitignore: ".flisk/.env.import" }),
+        },
+    };
+}
+/** Keeps the local env file out of git: it now holds values copied from docker-compose.yml. */
 function ensureGitignored(projectRoot, entry) {
     const path = join(projectRoot, ".gitignore");
     const content = existsSync(path) ? readFileSync(path, "utf8") : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",