@flisk-sh/flisk-import 0.13.0 → 0.15.0

package/README.md

@@ -17,8 +17,10 @@ flisk import . --yes         # write service.json files and project setup
 - **Keeps:** `stop_grace_period` (`container.stopGracePeriod`, such as `30s`), the `aliases` of every network (`container.networkAliases`), `extra_hosts` in list or map form (`container.extraHosts`, such as `host.docker.internal:host-gateway`) and `ulimits` (`container.ulimits`). A service renamed to kebab-case (`lychee_api` becomes `lychee-api`) keeps its Compose name as a network alias, so `http://lychee_api:8000` in another service still resolves. `container_name` is dropped with a note: Flisk names containers itself. These fields, an image with variables and `on-failure:N` need the Flisk core release that reads them; an older core does not apply them.
 - **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
 - **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` or `${VAR-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
-- **Environment:** values that cannot be secrets go into the committed `service.json` `env`: numbers, `true`/`false`, another imported service's address without a user, password or query (`http://invidious:3000`, `redis:6379`), and pure `${VAR}` references. Every other name, and any name that looks like a credential (`PASSWORD`, `TOKEN`, `KEY`, ...), goes into `secrets.required`, with its literal value copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept.
-- **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command; a string is split into exec-form arguments as Compose splits it, with no shell, so `command: server /export` on `minio/minio` stays the arguments of its `ENTRYPOINT`; only a string with `$` variables or unbalanced quotes runs through `sh -c`, and the plan says so), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` with its retry limit (N from 1 to 100).
+- **Environment:** the committed `service.json` `env` gets every pure Compose expression as written, whatever its name (`${DB_PASSWORD:-password}`, `${PORT-8080}`, `${A:-${B:-file}}`), so a fresh clone keeps the defaults, and every literal (`sqlite`, `worker`, `lychee_db`, `http://invidious:3000`) unless its name looks like a credential (`PASSWORD`, `TOKEN`, `KEY`, ...) or the value holds one (a URL with a user or password, a token query parameter, a long random string, a PEM block). Those go into `secrets.required`, with its literal value copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept.
+- **Round trip:** a routed port that Compose also publishes (`"${APP_PORT:-8000}:8000"`) stays in `extraPorts` too, and a `healthcheck` stays as `healthCheck.command` (with `interval`, `timeout`, `retries` and `start_period` as `startPeriod`) even when an HTTP path was read, so `flisk-export compose` writes a file that `docker compose` starts the same way (LycheeOrg/Lychee round-trips with no difference but names and aliases). A service with no `restart` keeps none, so Flisk runs it with its default `unless-stopped` (unlike Compose, Flisk then restarts it after a crash or a reboot; the plan says so). `restart: "no"` is written only when Compose sets it or another service waits for this one with `condition: service_completed_successfully`, because Flisk runs a `restart: "no"` service as a one-shot job and waits for it to exit, `healthcheck: { disable: true }` or `test: ["NONE"]` becomes `healthCheck: false`, a value that mixes `${VAR}` with literal text (`${SERVER_NAME:-localhost}, php:80`) stays in `env` unless it could hold a credential, `*_FILE` paths (`POSTGRES_PASSWORD_FILE=/run/secrets/pg`) stay in `env`, and the Compose project name (`name:` or the folder's, such as `pl_mail`) is recorded as `composeProjectNames.<stack>` in `.flisk/project.json`, so `flisk-export compose` keeps the container names. A generated Dockerfile for an image with variables declares them as `ARG NAME=default` before `FROM`.
+- **A tracked `.env`:** a repo that commits its `.env` (Symfony) keeps it as it is, and it is not added to `.gitignore`; values that must stay local go to `.env.local` when git already ignores it, else to `.flisk/.env.import` (added to `.gitignore`), and each service that needs them reads that file as `envFile`.
+- **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command; a string is split into exec-form arguments as Compose splits it, with no shell, so `command: server /export` on `minio/minio` stays the arguments of its `ENTRYPOINT`; `$$` becomes `$` as Compose passes it to the container; only a string with Compose variables (`${VAR}`, filled from `.env` by Compose, by the container's shell here) or unbalanced quotes runs through `sh -c`, and the plan says so), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` with its retry limit (N from 1 to 100).
 - **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with invalid profile names, `extends`, an out-of-tree build, or an image with characters or variable forms other than `${NAME}`, `${NAME:-default}` and `${NAME-default}` (`postgres:${POSTGRES_VERSION:-18}-alpine` is written as it is).
 - **Does not start anything.** Run `flisk up` with Flisk core **1.4.26 or later** (`publish` needs it). The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { relative } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { Command } from "commander";
 import "./detectors/index.js";
@@ -59,11 +59,13 @@ const program = new Command("flisk-import")
         console.log(`  wrote ${relative(process.cwd(), item.path) || manifestRelPath(plan, item)}`);
     }
     console.log(`\nWrote ${written.length} service.json file(s)${writes.projectConfig ? " and created .flisk/project.json" : ""}.`);
-    const envFile = relative(process.cwd(), join(writes.projectRoot, ".env")) || ".env";
+    const envFile = relative(process.cwd(), writes.env.path) || ".env";
     console.log("\nNext:");
     const copied = Object.keys(writes.env.add);
     if (copied.length)
         console.log(`  - Copied ${copied.length} environment value(s) from docker-compose.yml to ${envFile} (gitignored).`);
+    if (writes.env.tracked && copied.length)
+        console.log(`  - ${writes.env.tracked} is tracked by git, so it was left as it is and not added to .gitignore; the values went to ${envFile}, which each service that needs them reads as envFile.`);
     if (writes.items.some((item) => item.notes.some((note) => note.startsWith("no literal value"))))
         console.log(`  - Add the values listed above as missing to ${envFile}.`);
     console.log(`  - Run \`flisk up\` with Flisk core ${MIN_CORE_VERSION} or later. The import did not start anything.`);

package/dist/detectors/compose.js

@@ -271,6 +271,12 @@ function hostSideOf(port, hostIp, hostPort) {
     const publish = `${hostIp}:${hostNumber ?? port}`;
     return /^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(publish) ? { publish } : undefined;
 }
+/** Whether a `ports:` entry names a host port ("8000:8000", "127.0.0.1:8000:8000", `published:`), not only a container port. */
+function hasHostSide(entry) {
+    if (isObj(entry))
+        return entry.published !== undefined;
+    return typeof entry === "string" && (entry.split("/")[0] ?? "").includes(":");
+}
 function publishedPort(entry) {
     const port = containerPort(entry);
     if (port === undefined)
@@ -352,7 +358,7 @@ function volumeOf(entry, composeDir) {
     return { source: resolved, target, ...(readOnly ? { readOnly } : {}), bind };
 }
 /** Compose's project name: top-level `name`, else the directory name, lowercased with other characters dropped. */
-function projectNameOf(root, absPath) {
+export function projectNameOf(root, absPath) {
     const raw = isObj(root) && typeof root.name === "string" && !root.name.includes("$")
         ? root.name
         : basename(dirname(absPath));
@@ -399,9 +405,76 @@ function envValues(environment) {
     }
     return out;
 }
-/** A value that is nothing but Compose interpolation, such as `${URL}` or `${PORT:-80}`. Holds no secret itself. */
-const ONLY_REFERENCES = /^(\$\{[A-Za-z_][A-Za-z0-9_]*(?::?[-?+][^}\n]*)?\})+$/;
-/** Values that are only `${VAR}` references, which service.json `env` can keep as they are (Flisk 1.4.24). */
+/** The end of the `${...}` expression that starts at `start`, nested defaults included; undefined when it is not one. */
+function expressionEnd(text, start) {
+    if (!text.startsWith("${", start))
+        return undefined;
+    const name = /^[A-Za-z_][A-Za-z0-9_]*/.exec(text.slice(start + 2));
+    if (!name)
+        return undefined;
+    let i = start + 2 + name[0].length;
+    if (text[i] === "}")
+        return i + 1;
+    const op = /^:?[-?+]/.exec(text.slice(i));
+    if (!op)
+        return undefined;
+    i += op[0].length;
+    while (i < text.length) {
+        if (text.startsWith("${", i)) {
+            const end = expressionEnd(text, i);
+            if (end === undefined)
+                return undefined;
+            i = end;
+        }
+        else if (text[i] === "}")
+            return i + 1;
+        else if (text[i] === "\n" || text[i] === "$")
+            return undefined;
+        else
+            i++;
+    }
+    return undefined;
+}
+/**
+ * A value that is nothing but Compose interpolation: `${URL}`, `${PORT:-80}`, `${PORT-80}`, nested `${A:-${B:-file}}`.
+ * It holds no secret itself (a default is what the project's Compose file already commits), so it stays in `env`.
+ */
+export function isComposeExpression(value) {
+    let i = 0;
+    while (i < value.length) {
+        const end = expressionEnd(value, i);
+        if (end === undefined)
+            return false;
+        i = end;
+    }
+    return value.length > 0;
+}
+/**
+ * A value that mixes Compose expressions with literal text (`${SERVER_NAME:-localhost, :443}, php:80`), every `${`
+ * starting a valid expression. Undefined when it is not one; else the literal text with the expressions taken out.
+ */
+export function composeTemplateText(value) {
+    if (!value.includes("${") || value.includes("\n"))
+        return undefined;
+    let literal = "";
+    let i = 0;
+    while (i < value.length) {
+        if (value.startsWith("${", i)) {
+            const end = expressionEnd(value, i);
+            if (end === undefined)
+                return undefined;
+            i = end;
+        }
+        else {
+            if (value[i] === "$" && value[i + 1] !== "$")
+                return undefined;
+            literal += value[i];
+            i++;
+        }
+    }
+    return literal;
+}
+/** Values with `${VAR}` references (alone or in literal text), which service.json `env` can keep as they are (Flisk 1.4.24). */
 function envReferences(environment) {
     const pairs = Array.isArray(environment)
         ? environment
@@ -412,7 +485,7 @@ function envReferences(environment) {
             : [];
     const out = {};
     for (const [key, raw] of pairs) {
-        if (typeof raw === "string" && ONLY_REFERENCES.test(raw))
+        if (typeof raw === "string" && composeTemplateText(raw) !== undefined)
             out[key] = raw;
     }
     return out;
@@ -491,25 +564,68 @@ export function shellWords(text) {
  */
 function containerCommandOf(command) {
     if (typeof command === "string" && command.trim()) {
-        if (command.includes("$"))
-            return { argv: ["sh", "-c", command], shell: "uses $ variables" };
-        const words = shellWords(command);
+        const { text, interpolates } = unescapeDollars(command);
+        if (interpolates)
+            return {
+                argv: ["sh", "-c", text],
+                note: "uses Compose variables, which Compose filled from .env; in the generated Dockerfile it runs through sh -c, so the container's shell fills them from its own environment",
+            };
+        const words = shellWords(text);
         return words?.length
             ? { argv: words }
-            : { argv: ["sh", "-c", command], shell: "has unbalanced quotes" };
+            : {
+                argv: ["sh", "-c", text],
+                note: "has unbalanced quotes; it runs through sh -c, which Compose would not do",
+            };
+    }
+    if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string")) {
+        const parts = command.map(unescapeDollars);
+        return {
+            argv: parts.map((p) => p.text),
+            ...(parts.some((p) => p.interpolates)
+                ? {
+                    note: "uses Compose variables, which Compose filled from .env; the generated Dockerfile passes them as written (a sh -c argument fills them from the container's environment)",
+                }
+                : {}),
+        };
     }
-    if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string"))
-        return { argv: command };
     return undefined;
 }
-/** Seconds from a Compose duration such as `30s` or `2m`; undefined for anything it cannot read exactly. */
+/**
+ * A Compose command as the container sees it: `$$` is Compose's escape for a literal `$` (so `$$PASSWORD` reaches the
+ * container's shell as `$PASSWORD`). `interpolates` says whether a single `$` (`${VAR}`, `$VAR`) asks Compose to fill
+ * a value from .env, which a Dockerfile cannot do.
+ */
+function unescapeDollars(value) {
+    let text = "";
+    let interpolates = false;
+    for (let i = 0; i < value.length; i++) {
+        if (value[i] === "$" && value[i + 1] === "$") {
+            text += "$";
+            i++;
+            continue;
+        }
+        if (value[i] === "$" && /[{A-Za-z_]/.test(value[i + 1] ?? ""))
+            interpolates = true;
+        text += value[i];
+    }
+    return { text, interpolates };
+}
+const DURATION_UNIT = { h: 3600, m: 60, s: 1, ms: 0.001, us: 0.000001 };
+/** Seconds from a Compose duration such as `30s`, `2m` or `1m30s`; undefined for anything it cannot read exactly. */
 function secondsOf(value) {
     if (typeof value === "number" && value > 0)
         return value;
-    const match = typeof value === "string" ? value.match(/^(\d+)(s|m)?$/) : null;
-    if (!match)
+    if (typeof value !== "string")
+        return undefined;
+    if (/^\d+$/.test(value))
+        return Number(value) > 0 ? Number(value) : undefined;
+    if (!DURATION.test(value))
         return undefined;
-    const seconds = Number(match[1]) * (match[2] === "m" ? 60 : 1);
+    let seconds = 0;
+    for (const [, amount, unit] of value.matchAll(/([0-9]+(?:\.[0-9]+)?)(h|ms|us|m|s)/g))
+        seconds += Number(amount) * DURATION_UNIT[unit];
+    seconds = Math.round(seconds * 1000) / 1000;
     return seconds > 0 ? seconds : undefined;
 }
 /** Compose `healthcheck` as a probe command (exit 0 is ready). `NONE` and `disable` give no probe. */
@@ -531,6 +647,7 @@ function healthProbeOf(healthcheck) {
         return undefined;
     const interval = secondsOf(healthcheck.interval);
     const timeout = secondsOf(healthcheck.timeout);
+    const startPeriod = secondsOf(healthcheck.start_period);
     const retries = typeof healthcheck.retries === "number" &&
         Number.isInteger(healthcheck.retries) &&
         healthcheck.retries > 0
@@ -541,6 +658,7 @@ function healthProbeOf(healthcheck) {
         ...(interval ? { interval } : {}),
         ...(timeout ? { timeout } : {}),
         ...(retries ? { retries } : {}),
+        ...(startPeriod ? { startPeriod } : {}),
     };
 }
 /** The models a service uses, joined to their top-level definitions. A model without a literal `model` is skipped. */
@@ -672,6 +790,13 @@ registerDetector({
             return { candidates, skips: [...skips, { ...base, reason: "no `services:` map" }] };
         }
         const project = projectNameOf(root, absPath);
+        // Services another one waits for with `condition: service_completed_successfully`: one-shot jobs.
+        const awaitedJobs = new Set(Object.values(services).flatMap((svc) => isObj(svc) && isObj(svc.depends_on)
+            ? Object.entries(svc.depends_on)
+                .filter(([, dep]) => isObj(dep) && dep.condition === "service_completed_successfully")
+                .map(([dep]) => dep)
+            : []));
+        const restartedByFlisk = [];
         for (const [name, raw] of Object.entries(services)) {
             if (!isObj(raw)) {
                 skips.push({ ...base, reason: `service "${name}" is not a map` });
@@ -756,13 +881,17 @@ registerDetector({
                 ["command", commandArgs],
                 ["entrypoint", entrypointArgs],
             ]) {
-                if (args?.shell)
+                if (args?.note)
                     skips.push({
                         ...base,
-                        reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} ${args.shell}; it runs through sh -c, which Compose would not do`,
+                        reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} ${args.note}`,
                     });
             }
-            const healthProbe = healthProbeOf(raw.healthcheck);
+            // `disable: true` or `test: ["NONE"]` turns off the image's own HEALTHCHECK too, so it is kept as healthCheck: false.
+            const healthOff = isObj(raw.healthcheck) &&
+                (raw.healthcheck.disable === true ||
+                    (Array.isArray(raw.healthcheck.test) && raw.healthcheck.test[0] === "NONE"));
+            const healthProbe = healthOff ? false : healthProbeOf(raw.healthcheck);
             const envKeys = envNames(raw.environment);
             const env = envValues(raw.environment);
             const envRefs = envReferences(raw.environment);
@@ -807,11 +936,14 @@ registerDetector({
                     reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} has values Flisk does not accept; not used`,
                 });
             }
-            // Every published port Flisk does not route stays published on the same host address (service.json extraPorts).
+            // Every published port stays published on the same host address (service.json extraPorts). The routed port too,
+            // when Compose gives it a host side ("${APP_PORT:-8000}:8000"), so the app is still reachable without Traefik
+            // (and in an exported docker-compose.yml); a bare routed "8000" is reached through Traefik only.
             const proxied = selectedPort !== undefined && !NON_HTTP_PORTS.has(selectedPort);
             const extraPorts = (Array.isArray(raw.ports) ? raw.ports : [])
+                .filter((entry) => containerPort(entry) !== selectedPort || !proxied || hasHostSide(entry))
                 .map(publishedPort)
-                .filter((p) => p !== undefined && (p.port !== selectedPort || !proxied));
+                .filter((p) => p !== undefined);
             let sidecarOf;
             if (raw.network_mode !== undefined) {
                 const mode = typeof raw.network_mode === "string" ? raw.network_mode : "";
@@ -873,7 +1005,7 @@ registerDetector({
                 ...(models ? { models } : {}),
                 ...(profiles ? { profiles } : {}),
                 ...(envFile ? { envFile } : {}),
-                ...(healthProbe ? { healthCheck: healthProbe } : {}),
+                ...(healthProbe !== undefined ? { healthCheck: healthProbe } : {}),
                 ...(selectedPort !== undefined ? { port: selectedPort } : {}),
                 ...(healthCheckPath ? { healthCheckPath } : {}),
                 exposeViaProxy,
@@ -885,11 +1017,25 @@ registerDetector({
                 ...(extraPorts.length ? { extraPorts } : {}),
                 ...(sidecarOf ? { sidecarOf } : {}),
                 ...(volumes.length ? { volumes } : {}),
-                ...(restart ? { restart } : {}),
+                // Flisk runs a bring-your-own service with restart "no" as a one-shot job and waits for it to exit, so "no" is
+                // written only when Compose says so or another service waits for this one to complete. Otherwise restart is
+                // left out (Flisk's unless-stopped).
+                ...(restart
+                    ? { restart }
+                    : raw.restart === undefined && awaitedJobs.has(name)
+                        ? { restart: "no" }
+                        : {}),
                 confidence: "high",
                 sources: [base],
             });
+            if (raw.restart === undefined && !awaitedJobs.has(name))
+                restartedByFlisk.push(name);
         }
+        if (restartedByFlisk.length)
+            skips.push({
+                ...base,
+                reason: `restart not set for ${restartedByFlisk.join(", ")}: Flisk restarts them (unless-stopped), where Compose would not restart them after a crash or a reboot`,
+            });
         return { candidates, skips };
     },
 });

package/dist/flisk.js

@@ -26,7 +26,7 @@ export const HEALTH_CHECK_PATH_PATTERN = /^\/[a-z0-9/-]*$/;
  * An image reference, which may hold Compose variables `${NAME}`, `${NAME:-default}` and `${NAME-default}` (postgres:${PG_VERSION:-18}-alpine);
  * Compose resolves them from the project .env. Nothing else: no quotes, spaces or newlines that could change generated YAML.
  */
-export const IMAGE_PATTERN = /^(?:[A-Za-z0-9._/:@-]|\$\{[A-Za-z_][A-Za-z0-9_]*(?::?-[A-Za-z0-9._/:@-]*)?\})+$/;
+export const IMAGE_PATTERN = /^(?:[A-Za-z0-9._/:@-]|\$\{[A-Za-z_][A-Za-z0-9_]*(?::?-[A-Za-z0-9._/:@-]+)?\})+$/;
 /** A DNS name for a network alias: letters, digits, '-', '_' and '.'. */
 export const NETWORK_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
 const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;

package/dist/format.js

@@ -11,6 +11,8 @@ export function formatPlan(plan, writes) {
     out.push(`Found ${plan.services.length - jobs} service(s) and ${jobs} job(s) in ${plan.root}`, `Read only: ${plan.files.join(", ")}. Lines below name what was not translated.`, "");
     if (writes.projectConfig)
         out.push(`  .flisk/project.json  [create Flisk project]`, "");
+    if (writes.projectConfigUpdate)
+        out.push(`  .flisk/project.json  [add composeProjectNames.${writes.stack}: "${writes.composeProjectName}", so an export keeps the Compose project name]`, "");
     for (const service of plan.services) {
         const item = writes.items.find((i) => i.service === service);
         out.push(`  ${service.name}  (${service.kind}${service.dir ? `, ${service.dir}/` : ""})`);

package/dist/write.js

@@ -1,5 +1,8 @@
+import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { composeTemplateText, isComposeExpression, projectNameOf } from "./detectors/compose.js";
 import { ImportError } from "./errors.js";
 import { BYO_PORT_RANGE, defaultProjectConfig, findProjectRoot, IMAGE_PATTERN, NETWORK_ALIAS, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
 import { toResourceName } from "./merge.js";
@@ -9,28 +12,47 @@ const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
 /** Names that may hold a credential whatever their value looks like; these always stay secrets. */
 const CREDENTIAL_NAME = /PASS|SECRET|TOKEN|KEY|PRIVATE|CREDENTIAL|AUTH|HMAC|SALT|CERT|SESSION|COOKIE/i;
 /**
- * Whether a literal Compose value cannot be a secret, so it may be committed in service.json `env`: a number, true or false,
- * or the address of another service in this import (a URL or host:port with no user, password, query or fragment).
+ * Whether a literal value may hold a credential although its name does not say so: a URL or `user:pass@host` with a
+ * user or password, a query parameter named like a credential, a PEM block, a long random-looking token, or a value
+ * that says it is one (SECRET, TOKEN, PASSWORD).
  */
-function isPlainValue(value, serviceHosts) {
-    if (/^-?\d+(\.\d+)?$/.test(value) || /^(true|false)$/i.test(value))
+/** Query parameters that carry a credential (`?token=`, `?api_key=`, `&sig=`); `authSource` and the like do not. */
+const CREDENTIAL_QUERY = /token|secret|pass(word|wd)?$|api[_-]?key|^key$|^sig(nature)?$|access[_-]?key/i;
+function looksSecret(value) {
+    if (/^[^\s:@/]+:[^\s@/]+@/.test(value) || value.includes("-----BEGIN"))
         return true;
-    const hostPort = value.match(/^([a-z0-9][a-z0-9._-]*):(\d{1,5})$/);
-    if (hostPort)
-        return serviceHosts.has(hostPort[1]);
+    if (/SECRET|TOKEN|PASSWORD|PASSWD/i.test(value))
+        return true;
+    if (/^[A-Za-z0-9+/_=.-]{32,}$/.test(value) && /[0-9]/.test(value) && /[A-Za-z]/.test(value))
+        return true;
+    if (!value.includes("://"))
+        return false;
     try {
         const url = new URL(value);
-        return (serviceHosts.has(url.hostname) &&
-            !url.username &&
-            !url.password &&
-            !url.search &&
-            !url.hash &&
-            /^[A-Za-z0-9._~/-]*$/.test(url.pathname));
+        return (Boolean(url.username || url.password) ||
+            [...url.searchParams.keys()].some((key) => CREDENTIAL_QUERY.test(key)));
     }
     catch {
-        return false;
+        return /:\/\/[^/\s]*@/.test(value);
     }
 }
+/**
+ * `ARG` lines for the Compose variables in an image, so `FROM postgres:${POSTGRES_VERSION:-18}-alpine` can use them:
+ * Docker substitutes only build arguments declared before FROM. The default is the expression's.
+ */
+function buildArgLines(image) {
+    const args = new Map();
+    for (const m of image.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::?-([^}]*))?\}/g))
+        if (!args.has(m[1]))
+            args.set(m[1], m[2]);
+    return [...args]
+        .map(([name, value]) => (value === undefined ? `ARG ${name}\n` : `ARG ${name}=${value}\n`))
+        .join("");
+}
+/** `POSTGRES_PASSWORD_FILE=/run/secrets/pg`: the path of a mounted secret file, which is not a secret itself. */
+function isSecretFilePath(key, value) {
+    return /_FILE$/.test(key) && /^\/[A-Za-z0-9_./-]+$/.test(value);
+}
 function readEnvKeys(path) {
     if (!existsSync(path))
         return new Set();
@@ -71,16 +93,27 @@ export function planWrites(plan, force) {
     }
     const servicesDir = join(projectRoot, "services");
     const projectConfigPath = join(projectRoot, ".flisk", "project.json");
+    const composeProjectName = composeProjectNameOf(plan);
+    const composeNames = composeProjectName
+        ? { composeProjectNames: { [stack]: composeProjectName } }
+        : {};
     const projectConfig = existsSync(projectConfigPath)
         ? undefined
         : {
             path: projectConfigPath,
-            content: `${JSON.stringify(defaultProjectConfig(projectRoot, {
-                description: "Flisk proxy and imported Compose services",
-                enabledStacks: ["proxy", stack],
-            }), null, 2)}\n`,
+            content: `${JSON.stringify({
+                ...defaultProjectConfig(projectRoot, {
+                    description: "Flisk proxy and imported Compose services",
+                    enabledStacks: ["proxy", stack],
+                }),
+                ...composeNames,
+            }, null, 2)}\n`,
         };
-    const envPath = join(projectRoot, ".env");
+    const projectConfigUpdate = projectConfig
+        ? undefined
+        : withComposeProjectName(projectConfigPath, stack, composeProjectName);
+    const envTarget = localEnvFile(projectRoot);
+    const envPath = envTarget.path;
     const envKept = readEnvKeys(envPath);
     const envAdd = {};
     const used = usedManifestPorts(servicesDir);
@@ -103,8 +136,6 @@ export function planWrites(plan, force) {
         return !reason;
     });
     const names = new Set(accepted.map((s) => s.name));
-    // Hostnames other services use for these: the resource name, which stays the container hostname, and the Compose name.
-    const serviceHosts = new Set(plan.services.flatMap((s) => (s.originalName ? [s.name, s.originalName] : [s.name])));
     for (const service of accepted) {
         const path = resolve(servicesDir, stack, service.name, "service.json");
         const exists = existsSync(path);
@@ -155,28 +186,39 @@ export function planWrites(plan, force) {
         // Infrastructure images and one-shot jobs do not serve HTTP, so an assumed "/" would only
         // fail the probe. Leave the path out; the runtime then skips the HTTP probe.
         const nonHttp = service.kind === "job" || (service.image !== undefined && NON_HTTP_IMAGE.test(service.image));
-        const healthCheckPath = isPrivate || nonHttp ? undefined : (service.healthCheckPath ?? "/");
-        if (nonHttp && !isPrivate)
+        const healthOff = service.healthCheck === false;
+        const healthCheckPath = isPrivate || nonHttp || healthOff ? undefined : (service.healthCheckPath ?? "/");
+        if (healthOff)
+            notes.push("healthCheck: false: Compose turns the healthcheck off");
+        else if (nonHttp && !isPrivate)
             notes.push("no health path: the service does not serve HTTP (non-HTTP image or job)");
-        if (!isPrivate && !nonHttp && !service.healthCheckPath)
+        if (!isPrivate && !nonHttp && !healthOff && !service.healthCheckPath)
             notes.push("health path / is assumed: no HTTP health path could be read from Compose. Traefik routes only while it answers 2xx or 3xx");
-        // A probe command is the only way to describe a non-HTTP check; a routed service keeps its HTTP path.
-        const healthCheck = service.healthCheck && !(healthCheckPath && service.healthCheckPath)
-            ? service.healthCheck
-            : undefined;
-        // Values that cannot be secrets (numbers, booleans, another service's address, pure ${VAR} references) go into the
-        // committed service.json `env` (Flisk 1.4.24). Every other name is a secret: Flisk injects it from the gitignored .env.
+        // The Compose healthcheck stays as healthCheck.command (with its interval, timeout, retries and start period) even
+        // when an HTTP path was read too, so an exported docker-compose.yml keeps it and `condition: service_healthy` holds.
+        const healthCheck = service.healthCheck;
+        if (healthCheck && healthCheckPath && service.healthCheckPath)
+            notes.push(`healthCheck.command ${JSON.stringify(healthCheck.command)} is kept as Compose wrote it; Flisk probes with it instead of ${healthCheckPath}`);
+        // What goes into the committed service.json `env` (Flisk 1.4.24): a pure Compose expression (`${X}`, `${X:-default}`,
+        // `${A:-${B:-file}}`) as it is, whatever its name, since its default is already committed in the Compose file; and
+        // a literal whose name does not look like a credential and whose value does not hold one. Every other name is a
+        // secret: Flisk injects it from the gitignored .env, which gets the literal value.
         const validNames = service.envKeys.filter((key) => ENV_NAME.test(key));
         const env = {};
         for (const key of validNames) {
-            if (CREDENTIAL_NAME.test(key))
-                continue;
             const literal = service.env[key];
             const reference = service.envRefs[key];
-            if (literal !== undefined && isPlainValue(literal, serviceHosts))
+            if (literal === undefined && reference !== undefined) {
+                // A pure expression is committed whatever its name; one mixed with literal text only when that text, with
+                // the expressions taken out, could not be a credential (`mongodb://${USER}:${PASSWORD:-x}@db/app` can).
+                const text = composeTemplateText(reference) ?? "";
+                if (isComposeExpression(reference) || (!CREDENTIAL_NAME.test(key) && !looksSecret(text)))
+                    env[key] = reference;
+            }
+            else if (literal !== undefined && isSecretFilePath(key, literal))
+                env[key] = literal;
+            else if (literal !== undefined && !CREDENTIAL_NAME.test(key) && !looksSecret(literal))
                 env[key] = literal;
-            else if (literal === undefined && reference !== undefined)
-                env[key] = reference;
         }
         const referenced = [
             ...new Set(Object.values(env).flatMap((value) => [...value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?-)?/g)]
@@ -213,7 +255,7 @@ export function planWrites(plan, force) {
         if (wrapWithCommand) {
             files.push({
                 path: resolve(dirname(path), "Dockerfile"),
-                content: `# From the Compose \`command\` of this service (flisk import). Flisk sets no container command, so it lives here.\nFROM ${service.image}\n${service.containerEntrypoint ? `ENTRYPOINT ${JSON.stringify(service.containerEntrypoint)}\n` : ""}${service.containerCommand ? `CMD ${JSON.stringify(service.containerCommand)}\n` : ""}`,
+                content: `# From the Compose \`command\` of this service (flisk import). Flisk sets no container command, so it lives here.\n${buildArgLines(service.image)}FROM ${service.image}\n${service.containerEntrypoint ? `ENTRYPOINT ${JSON.stringify(service.containerEntrypoint)}\n` : ""}${service.containerCommand ? `CMD ${JSON.stringify(service.containerCommand)}\n` : ""}`,
             });
             notes.push(`${service.containerEntrypoint ? "entrypoint" : "command"} ${JSON.stringify(service.containerEntrypoint ?? service.containerCommand)} is written to a Dockerfile on ${service.image}`);
         }
@@ -287,6 +329,10 @@ export function planWrites(plan, force) {
             return [{ ...volume, source: rel.startsWith(".") ? rel : `./${rel}` }];
         });
         // env_file paths are relative to the service directory in service.json, and must stay inside the project.
+        // With the project .env tracked by git, secrets live in another local file, which Flisk then reads as envFile.
+        const localEnv = envTarget.git.tracked && secretNames.length
+            ? [relative(dirname(path), envPath).split("\\").join("/")]
+            : [];
         const envFile = (service.envFile ?? []).flatMap((file) => {
             const absolute = resolve(plan.root, file);
             const fromProject = relative(projectRoot, absolute).split("\\").join("/");
@@ -304,7 +350,7 @@ export function planWrites(plan, force) {
             stack,
             port,
             ...(healthCheckPath ? { healthCheckPath } : {}),
-            ...(healthCheck ? { healthCheck } : {}),
+            ...(healthCheck !== undefined ? { healthCheck } : {}),
             ...source,
             ...(isPrivate ? { exposeViaProxy: false } : {}),
             ...(dependsOn.length ? { dependsOn } : {}),
@@ -316,7 +362,9 @@ export function planWrites(plan, force) {
             ...(container ? { container } : {}),
             ...(service.models ? { models: service.models } : {}),
             ...(service.profiles ? { profiles: service.profiles } : {}),
-            ...(envFile.length ? { envFile } : {}),
+            ...(envFile.length || localEnv.length
+                ? { envFile: [...new Set([...envFile, ...localEnv])] }
+                : {}),
             ...(extraPorts.length ? { extraPorts } : {}),
             ...(sidecarOf ? { sidecarOf } : {}),
             ...(volumes.length
@@ -338,8 +386,10 @@ export function planWrites(plan, force) {
         stack,
         items,
         projectConfig,
+        ...(projectConfigUpdate ? { projectConfigUpdate } : {}),
+        ...(composeProjectName ? { composeProjectName } : {}),
         rejected,
-        env: { path: envPath, add: envAdd },
+        env: { path: envPath, add: envAdd, ...envTarget.git },
     };
 }
 export function applyWrites(writes) {
@@ -348,6 +398,8 @@ export function applyWrites(writes) {
         mkdirSync(dirname(writes.projectConfig.path), { recursive: true });
         writeFileSync(writes.projectConfig.path, writes.projectConfig.content, { flag: "wx" });
     }
+    if (writes.projectConfigUpdate)
+        writeFileSync(writes.projectConfigUpdate.path, writes.projectConfigUpdate.content);
     for (const item of writes.items) {
         if (item.status === "exists")
             continue;
@@ -363,14 +415,88 @@ export function applyWrites(writes) {
         const lines = keys.map((key) => envLine(key, writes.env.add[key]));
         const block = `${existing && !existing.endsWith("\n") ? "\n" : ""}# From docker-compose.yml (flisk import)\n${lines.join("\n")}\n`;
         writeFileSync(writes.env.path, existing + block);
-        ensureGitignored(writes.projectRoot, ".env");
+        mkdirSync(dirname(writes.env.path), { recursive: true });
+        if (writes.env.gitignore)
+            ensureGitignored(writes.projectRoot, writes.env.gitignore);
     }
     return written;
 }
 export function manifestRelPath(plan, item) {
     return relative(plan.root, item.path).split("\\").join("/");
 }
-/** Keeps the project .env out of git: it now holds values copied from docker-compose.yml. */
+/** The project name `docker compose` gives the imported Compose file: its `name:`, else its folder's name. */
+function composeProjectNameOf(plan) {
+    const file = plan.files.find((f) => /^(docker-)?compose\.ya?ml$/.test(f));
+    if (!file)
+        return undefined;
+    const absPath = join(plan.root, file);
+    try {
+        return projectNameOf(parseYaml(readFileSync(absPath, "utf8"), { merge: true }), absPath);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** An existing project.json with `composeProjectNames.<stack>` set, or undefined when it has it already or is unreadable. */
+function withComposeProjectName(path, stack, name) {
+    if (!name)
+        return undefined;
+    try {
+        const config = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof config !== "object" || config === null || Array.isArray(config))
+            return undefined;
+        const names = typeof config.composeProjectNames === "object" && config.composeProjectNames !== null
+            ? config.composeProjectNames
+            : {};
+        if (names[stack] === name)
+            return undefined;
+        return {
+            path,
+            content: `${JSON.stringify({ ...config, composeProjectNames: { ...names, [stack]: name } }, null, 2)}\n`,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether git in `root` tracks `file` (false outside a git repo, or without git). */
+function gitTracks(root, file) {
+    try {
+        execFileSync("git", ["-C", root, "ls-files", "--error-unmatch", file], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether git in `root` ignores `file` (false outside a git repo, or without git). */
+function gitIgnores(root, file) {
+    try {
+        execFileSync("git", ["-C", root, "check-ignore", "-q", file], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The local file that gets values copied from docker-compose.yml: the project .env, never one git tracks. A tracked
+ * .env is left as it is, and not added to .gitignore.
+ */
+function localEnvFile(projectRoot) {
+    if (!gitTracks(projectRoot, ".env"))
+        return { path: join(projectRoot, ".env"), git: { gitignore: ".env" } };
+    if (gitIgnores(projectRoot, ".env.local") && !gitTracks(projectRoot, ".env.local"))
+        return { path: join(projectRoot, ".env.local"), git: { tracked: ".env" } };
+    return {
+        path: join(projectRoot, ".flisk", ".env.import"),
+        git: {
+            tracked: ".env",
+            ...(gitIgnores(projectRoot, ".flisk/.env.import") ? {} : { gitignore: ".flisk/.env.import" }),
+        },
+    };
+}
+/** Keeps the local env file out of git: it now holds values copied from docker-compose.yml. */
 function ensureGitignored(projectRoot, entry) {
     const path = join(projectRoot, ".gitignore");
     const content = existsSync(path) ? readFileSync(path, "utf8") : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",