@getmonoceros/workbench 1.9.7 → 1.10.1

package/dist/bin.js

@@ -251,25 +251,25 @@ function detectHelpRequest(argv, main2) {
   const separatorIdx = argv.indexOf("--");
   if (helpIdx === -1) return null;
   if (separatorIdx !== -1 && separatorIdx < helpIdx) return null;
-  const path17 = [];
+  const path18 = [];
   const tokens = argv.slice(
     0,
     separatorIdx === -1 ? argv.length : separatorIdx
   );
   let cursor = main2;
   const mainName = (main2.meta ?? {}).name ?? "monoceros";
-  path17.push(mainName);
+  path18.push(mainName);
   for (const tok of tokens) {
     if (tok.startsWith("-")) continue;
     const subs = cursor.subCommands ?? {};
     if (tok in subs) {
       cursor = subs[tok];
-      path17.push(tok);
+      path18.push(tok);
       continue;
     }
     break;
   }
-  return { path: path17, cmd: cursor };
+  return { path: path18, cmd: cursor };
 }
 async function maybeRenderHelp(argv, main2) {
   const hit = detectHelpRequest(argv, main2);
@@ -301,7 +301,7 @@ function getInnerArgs() {
 }
 
 // src/main.ts
-import { defineCommand as defineCommand29 } from "citty";
+import { defineCommand as defineCommand30 } from "citty";
 
 // src/commands/add-apt-packages.ts
 import { defineCommand } from "citty";
@@ -1638,7 +1638,8 @@ var SERVICE_CATALOG = {
     // the recommended mount is the parent directory; pre-18 used
     // /var/lib/postgresql/data directly. See
     // https://github.com/docker-library/postgres/pull/1259.
-    dataMount: "/var/lib/postgresql"
+    dataMount: "/var/lib/postgresql",
+    defaultPort: 5432
   },
   mysql: {
     id: "mysql",
@@ -1647,12 +1648,14 @@ var SERVICE_CATALOG = {
       MYSQL_ROOT_PASSWORD: "monoceros",
       MYSQL_DATABASE: "monoceros"
     },
-    dataMount: "/var/lib/mysql"
+    dataMount: "/var/lib/mysql",
+    defaultPort: 3306
   },
   redis: {
     id: "redis",
     image: "redis:8",
-    dataMount: "/data"
+    dataMount: "/data",
+    defaultPort: 6379
   }
 };
 function knownLanguages() {
@@ -2746,8 +2749,8 @@ function removeRepoFromDoc(doc, urlOrPath) {
     if (!isMap2(item)) return false;
     const url = item.get("url");
     if (url === urlOrPath) return true;
-    const path17 = item.get("path");
-    const effectivePath = typeof path17 === "string" ? path17 : typeof url === "string" ? deriveRepoName(url) : void 0;
+    const path18 = item.get("path");
+    const effectivePath = typeof path18 === "string" ? path18 : typeof url === "string" ? deriveRepoName(url) : void 0;
     return effectivePath === urlOrPath;
   });
   if (idx < 0) return false;
@@ -2797,7 +2800,7 @@ async function runAddRepo(input) {
       "Missing repo URL. Usage: monoceros add-repo <containername> <url>."
     );
   }
-  const path17 = (input.path ?? deriveRepoName(url)).trim();
+  const path18 = (input.path ?? deriveRepoName(url)).trim();
   const hasName = typeof input.gitName === "string" && input.gitName.trim().length > 0;
   const hasEmail = typeof input.gitEmail === "string" && input.gitEmail.trim().length > 0;
   if (hasName !== hasEmail) {
@@ -2826,7 +2829,7 @@ async function runAddRepo(input) {
   const providerToWrite = !canonical && explicitProvider ? explicitProvider : void 0;
   const entry2 = {
     url,
-    path: path17,
+    path: path18,
     ...hasName && hasEmail ? {
       gitUser: {
         name: input.gitName.trim(),
@@ -4597,7 +4600,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "1.9.7" : "dev";
+var CLI_VERSION = true ? "1.10.1" : "dev";
 
 // src/commands/_dispatch.ts
 import { consola as consola12 } from "consola";
@@ -5004,6 +5007,7 @@ var ALL_COMMANDS = [
   "remove-repo",
   "remove-port",
   "port",
+  "tunnel",
   "completion"
 ];
 var containerName = (ctx) => listContainerNames(ctx);
@@ -5098,6 +5102,13 @@ var COMMAND_SPECS = {
     flags: { "--default": { type: "boolean" } },
     innerArgs: () => []
   },
+  tunnel: {
+    positionals: [containerName, () => listServiceNames()],
+    flags: {
+      "--local-port": { type: "value" },
+      "--local-address": { type: "value" }
+    }
+  },
   completion: {
     positionals: [() => listShellNames()]
   },
@@ -6089,7 +6100,30 @@ async function runRemove(opts) {
     await fs14.rm(ymlPath, { force: true });
   }
   if (hasContainer) {
-    await fs14.rm(containerPath, { recursive: true, force: true });
+    try {
+      await fs14.rm(containerPath, { recursive: true, force: true });
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EACCES" && code !== "EPERM") {
+        throw err;
+      }
+      logger.info(
+        `[remove] host-side rm hit ${code} on ${prettyPath(containerPath)}; using a throw-away alpine container to clean root-owned files\u2026`
+      );
+      const exit = await dockerSpawn(
+        [
+          "-c",
+          `docker run --rm -v "${containerPath}":/target alpine:3.21 find /target -mindepth 1 -delete`
+        ],
+        home
+      );
+      if (exit !== 0) {
+        throw new Error(
+          `docker-based cleanup of ${containerPath} exited ${exit}. Inspect with \`sudo ls -la ${containerPath}\` and clean manually.`
+        );
+      }
+      await fs14.rm(containerPath, { recursive: true, force: true });
+    }
   }
   logger.success(
     `Removed '${opts.name}': docker objects gone, container-configs entry deleted, container directory deleted.`
@@ -6728,8 +6762,400 @@ var stopCommand = defineCommand28({
   }
 });
 
+// src/commands/tunnel.ts
+import { defineCommand as defineCommand29 } from "citty";
+import { consola as consola33 } from "consola";
+
+// src/tunnel/run.ts
+import { spawn as spawn9 } from "child_process";
+import { consola as consola32 } from "consola";
+
+// src/tunnel/resolve.ts
+import { existsSync as existsSync12 } from "fs";
+import path17 from "path";
+async function resolveTunnelTarget(opts) {
+  const ymlPath = containerConfigPath(opts.name, opts.monocerosHome);
+  if (!existsSync12(ymlPath)) {
+    throw new Error(
+      `No yml profile for '${opts.name}' at ${ymlPath}. Run \`monoceros init ${opts.name}\` first.`
+    );
+  }
+  const parsed = await readConfig(ymlPath);
+  const config = parsed.config;
+  const containerRoot = containerDir(opts.name, opts.monocerosHome);
+  if (!existsSync12(containerRoot)) {
+    throw new Error(
+      `Container '${opts.name}' is not materialised at ${containerRoot}. Run \`monoceros apply ${opts.name}\` first.`
+    );
+  }
+  const composePath = path17.join(containerRoot, ".devcontainer", "compose.yaml");
+  const isCompose = existsSync12(composePath);
+  const parsedTarget = parseTargetArg(opts.target, config);
+  const docker = opts.docker ?? defaultDockerExec;
+  if (isCompose) {
+    return resolveCompose2({
+      name: opts.name,
+      containerRoot,
+      parsedTarget
+    });
+  }
+  return resolveImageMode({
+    name: opts.name,
+    containerRoot,
+    parsedTarget,
+    config,
+    docker
+  });
+}
+function parseTargetArg(raw, config) {
+  const asNumber = Number(raw);
+  if (Number.isInteger(asNumber) && asNumber > 0 && asNumber < 65536) {
+    return { kind: "port", port: asNumber };
+  }
+  const entry2 = SERVICE_CATALOG[raw];
+  if (!entry2) {
+    const candidates = knownServices().join(", ");
+    throw new Error(
+      `Unknown service '${raw}'. Known services: ${candidates}. Or pass a port number (e.g. \`monoceros tunnel <name> 8080\`).`
+    );
+  }
+  if (!config.services.includes(raw)) {
+    throw new Error(
+      `Service '${raw}' is not declared in this container's yml. Add it with \`monoceros add-service ${config.services.length === 0 ? "<name>" : "\u2026"} ${raw}\` and re-apply.`
+    );
+  }
+  return { kind: "service", service: raw, port: entry2.defaultPort };
+}
+function resolveCompose2(args) {
+  const network = `${composeProjectName(args.containerRoot)}_default`;
+  if (args.parsedTarget.kind === "service") {
+    return {
+      network,
+      targetHost: args.parsedTarget.service,
+      internalPort: args.parsedTarget.port,
+      display: `${args.name}/${args.parsedTarget.service}`
+    };
+  }
+  return {
+    network,
+    targetHost: "workspace",
+    internalPort: args.parsedTarget.port,
+    display: `${args.name}:${args.parsedTarget.port}`
+  };
+}
+async function resolveImageMode(args) {
+  if (args.parsedTarget.kind === "service") {
+    throw new Error(
+      `Service '${args.parsedTarget.service}' is declared in the yml but '${args.name}' is image-mode (no compose.yaml). Services need compose mode \u2014 re-apply with at least one \`services:\` entry to get a compose setup.`
+    );
+  }
+  const ports = args.config.routing?.ports ?? [];
+  if (ports.length > 0) {
+    return {
+      network: PROXY_NETWORK_NAME,
+      targetHost: args.name,
+      internalPort: args.parsedTarget.port,
+      display: `${args.name}:${args.parsedTarget.port}`
+    };
+  }
+  const { network, ip } = await lookupContainerNetwork({
+    containerRoot: args.containerRoot,
+    docker: args.docker
+  });
+  return {
+    network,
+    targetHost: ip,
+    internalPort: args.parsedTarget.port,
+    display: `${args.name}:${args.parsedTarget.port}`
+  };
+}
+async function lookupContainerNetwork(args) {
+  const psResult = await args.docker([
+    "ps",
+    "-q",
+    "--filter",
+    `label=devcontainer.local_folder=${args.containerRoot}`
+  ]);
+  if (psResult.exitCode !== 0) {
+    throw new Error(
+      `docker ps failed: ${psResult.stderr.trim() || `exit ${psResult.exitCode}`}`
+    );
+  }
+  const containerId = psResult.stdout.trim().split("\n")[0]?.trim();
+  if (!containerId) {
+    throw new Error(
+      `No running container for '${args.containerRoot}'. Start it with \`monoceros start <name>\` (or open a shell with \`monoceros shell <name>\`) and retry.`
+    );
+  }
+  const inspect = await args.docker([
+    "inspect",
+    "--format",
+    "{{json .NetworkSettings.Networks}}",
+    containerId
+  ]);
+  if (inspect.exitCode !== 0) {
+    throw new Error(
+      `docker inspect failed: ${inspect.stderr.trim() || `exit ${inspect.exitCode}`}`
+    );
+  }
+  let networks = null;
+  try {
+    networks = JSON.parse(inspect.stdout);
+  } catch {
+    throw new Error(
+      `Unexpected docker inspect output: ${inspect.stdout.slice(0, 200)}`
+    );
+  }
+  if (!networks) {
+    throw new Error(
+      `Container ${containerId} reports no networks. Restart it and retry.`
+    );
+  }
+  for (const [name, settings] of Object.entries(networks)) {
+    if (settings.IPAddress && settings.IPAddress.length > 0) {
+      return { network: name, ip: settings.IPAddress };
+    }
+  }
+  throw new Error(
+    `Container ${containerId} has no network with a reachable IP. Restart it and retry.`
+  );
+}
+
+// src/tunnel/port-check.ts
+import { Socket as Socket2 } from "net";
+var CONNECT_TIMEOUT_MS2 = 750;
+var realPortProbe2 = (port, address) => {
+  const probeHost = address === "0.0.0.0" ? "127.0.0.1" : address;
+  return new Promise((resolve) => {
+    const socket = new Socket2();
+    let settled = false;
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(result);
+    };
+    socket.setTimeout(CONNECT_TIMEOUT_MS2);
+    socket.once("connect", () => {
+      settle({
+        ok: false,
+        code: "EADDRINUSE",
+        message: `another process is listening on ${port}`
+      });
+    });
+    socket.once("timeout", () => {
+      settle({ ok: true });
+    });
+    socket.once("error", (err) => {
+      const code = err.code ?? "UNKNOWN";
+      if (code === "ECONNREFUSED") {
+        settle({ ok: true });
+      } else {
+        settle({ ok: false, code, message: err.message });
+      }
+    });
+    socket.connect(port, probeHost);
+  });
+};
+async function preflightLocalPort(opts) {
+  const probe = opts.probe ?? realPortProbe2;
+  const result = await probe(opts.port, opts.address);
+  if (result.ok) return;
+  throw new Error(formatLocalPortHeldError(opts.port, opts.address, result));
+}
+function formatLocalPortHeldError(port, address, result) {
+  const lines = [];
+  if (result.code === "EADDRINUSE") {
+    lines.push(`Local port ${port} on ${address} is already in use.`);
+    lines.push("");
+    lines.push("Identify the holder, then either stop it or pick a different");
+    lines.push("port for the tunnel:");
+    lines.push("");
+    lines.push(`  sudo lsof -iTCP:${port} -sTCP:LISTEN -n -P`);
+    lines.push(`  # or:   sudo ss -tlnp | grep ":${port}\\b"`);
+    lines.push("");
+    lines.push("Re-run with an explicit local port:");
+    lines.push(`  monoceros tunnel \u2026 --local-port=${port + 1}`);
+  } else {
+    lines.push(
+      `Cannot probe local port ${port} on ${address}: ${result.message}`
+    );
+    lines.push("");
+    lines.push(
+      "Most likely the host network stack (firewall, namespace) is interfering."
+    );
+    lines.push("Try a different local port via `--local-port=<n>`.");
+  }
+  return lines.join("\n");
+}
+
+// src/tunnel/run.ts
+var SOCAT_IMAGE = "alpine/socat:1.8.0.3";
+var defaultDockerSpawn = (args) => {
+  const child = spawn9("docker", args, {
+    stdio: "inherit"
+  });
+  const exited = new Promise((resolve, reject) => {
+    child.on("error", reject);
+    child.on("exit", (code, signal) => {
+      if (typeof code === "number") resolve(code);
+      else if (signal) resolve(128 + signalNumber(signal));
+      else resolve(0);
+    });
+  });
+  return {
+    exited,
+    kill: (signal) => {
+      try {
+        child.kill(signal);
+      } catch {
+      }
+    }
+  };
+};
+function signalNumber(signal) {
+  switch (signal) {
+    case "SIGINT":
+      return 2;
+    case "SIGTERM":
+      return 15;
+    default:
+      return 1;
+  }
+}
+var installSigintDefault = (handler) => {
+  process.on("SIGINT", handler);
+  return () => process.off("SIGINT", handler);
+};
+var DEFAULT_LOCAL_ADDRESS = "127.0.0.1";
+async function runTunnel(opts) {
+  const log = opts.logger ?? {
+    info: (m) => consola32.info(m),
+    warn: (m) => consola32.warn(m)
+  };
+  const resolve = opts.resolve ?? resolveTunnelTarget;
+  const resolveArgs2 = {
+    name: opts.name,
+    target: opts.target,
+    ...opts.monocerosHome !== void 0 ? { monocerosHome: opts.monocerosHome } : {}
+  };
+  const resolved = await resolve(resolveArgs2);
+  const localPort = opts.localPort ?? resolved.internalPort;
+  const localAddress = opts.localAddress ?? DEFAULT_LOCAL_ADDRESS;
+  validateLocalAddress(localAddress);
+  const preflight = opts.preflight ?? preflightLocalPort;
+  await preflight({ port: localPort, address: localAddress });
+  const dockerSpawn = opts.dockerSpawn ?? defaultDockerSpawn;
+  const installSignalHandler = opts.installSignalHandler ?? installSigintDefault;
+  const dockerArgs = buildDockerArgs({
+    localAddress,
+    localPort,
+    internalPort: resolved.internalPort,
+    network: resolved.network,
+    targetHost: resolved.targetHost
+  });
+  log.info(
+    `Tunnel: ${localAddress}:${localPort} \u2192 ${resolved.display}:${resolved.internalPort} (Ctrl+C to stop)`
+  );
+  const handle = dockerSpawn(dockerArgs);
+  const uninstall = installSignalHandler(() => {
+  });
+  try {
+    const exitCode = await handle.exited;
+    if (exitCode === 130) return 0;
+    return exitCode;
+  } finally {
+    uninstall();
+  }
+}
+function buildDockerArgs(input) {
+  return [
+    "run",
+    "--rm",
+    "-i",
+    `--network=${input.network}`,
+    "-p",
+    `${input.localAddress}:${input.localPort}:${input.internalPort}`,
+    SOCAT_IMAGE,
+    `TCP-LISTEN:${input.internalPort},fork,reuseaddr`,
+    `TCP:${input.targetHost}:${input.internalPort}`
+  ];
+}
+var IPV4_RE = /^(\d{1,3}\.){3}\d{1,3}$/;
+function validateLocalAddress(addr) {
+  if (addr === "localhost") return;
+  if (IPV4_RE.test(addr)) {
+    for (const part of addr.split(".")) {
+      const n = Number(part);
+      if (n < 0 || n > 255) {
+        throw new Error(
+          `Invalid --local-address '${addr}': each dotted-quad octet must be 0-255.`
+        );
+      }
+    }
+    return;
+  }
+  throw new Error(
+    `Invalid --local-address '${addr}'. Use 127.0.0.1 (default), 0.0.0.0, or a specific IPv4 address.`
+  );
+}
+
+// src/commands/tunnel.ts
+var tunnelCommand = defineCommand29({
+  meta: {
+    name: "tunnel",
+    group: "discovery",
+    description: "Open a TCP tunnel from the host to a service or port inside the container. Foreground process \u2014 Ctrl+C closes the tunnel. Pass a service name (e.g. `postgres`, `mysql`, `redis`) from the container yml or a bare in-container port number. See ADR 0009."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    target: {
+      type: "positional",
+      description: "Service name from the container yml (e.g. `postgres`) or an in-container port number (e.g. `8080`).",
+      required: true
+    },
+    "local-port": {
+      type: "string",
+      description: "Host port the tunnel listens on. Default: same as the internal port (e.g. postgres \u2192 5432). Pass a different value when the default is busy."
+    },
+    "local-address": {
+      type: "string",
+      description: "Host interface the tunnel binds to. Default: 127.0.0.1 (loopback only \u2014 same machine). Pass 0.0.0.0 to expose on all interfaces (LAN, other devices on the same network)."
+    }
+  },
+  async run({ args }) {
+    try {
+      const localPort = parseLocalPort(args["local-port"]);
+      const exitCode = await runTunnel({
+        name: args.name,
+        target: args.target,
+        ...localPort !== void 0 ? { localPort } : {},
+        ...args["local-address"] ? { localAddress: args["local-address"] } : {}
+      });
+      process.exit(exitCode);
+    } catch (err) {
+      consola33.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+function parseLocalPort(raw) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0 || n >= 65536) {
+    throw new Error(
+      `Invalid --local-port '${raw}': must be an integer between 1 and 65535.`
+    );
+  }
+  return n;
+}
+
 // src/main.ts
-var main = defineCommand29({
+var main = defineCommand30({
   meta: {
     name: "monoceros",
     version: CLI_VERSION,
@@ -6762,6 +7188,7 @@ var main = defineCommand29({
     "remove-repo": removeRepoCommand,
     "remove-port": removePortCommand,
     port: portCommand,
+    tunnel: tunnelCommand,
     completion: completionCommand,
     __complete: __completeCommand
   }