@hearsay-tools/squawk 0.0.0-stage → 0.17.0-pr3058.5683

package/dist/server-install/platforms/ubuntu-vps-redeploy.js

@@ -0,0 +1,127 @@
+import { productName } from '../../home/display.js';
+import { StepAborted, sudoStep } from '../steps.js';
+/**
+ * The `ubuntuVps.redeploy` helpers: resolve the systemd scope the recorded
+ * service runs in, restart it (user scope directly, system scope through
+ * `sudoStep`), and prove the restart actually happened.
+ */
+/** Read the unit's live `ExecStart` (read-only query; no sudo needed even for a
+ *  system unit). Empty string when it can't be read — callers then skip the
+ *  npx-cache refresh rather than guessing. */
+export async function readExecStart(ctx, scope, unit) {
+    const args = [...(scope === 'user' ? ['--user'] : []), 'show', unit, '-p', 'ExecStart'];
+    const { stdout } = await ctx.runner.capture('systemctl', args);
+    return stdout;
+}
+/** Read-only even for a system unit; no sudo prompt during diagnosis. */
+export async function serviceSnapshot(ctx, scope, unit) {
+    const args = [...(scope === 'user' ? ['--user'] : []), 'show', unit, '-p', 'ActiveState', '-p', 'ExecMainStartTimestampMonotonic'];
+    const result = await ctx.runner.capture('systemctl', args);
+    if (result.code !== 0)
+        return { active: null, started: null };
+    const fields = new Map(result.stdout.trim().split('\n').map((line) => {
+        const at = line.indexOf('=');
+        return [line.slice(0, at), line.slice(at + 1)];
+    }));
+    const raw = fields.get('ExecMainStartTimestampMonotonic');
+    return {
+        active: fields.get('ActiveState') ?? null,
+        started: raw && /^\d+$/.test(raw) ? BigInt(raw) : null,
+    };
+}
+export async function failedRestart(ctx, scope, unit, reason, sudoUsed = false) {
+    let recent = 'recent journal unavailable';
+    const args = [...(scope === 'user' ? ['--user'] : []), '-u', unit, '-n', '30', '--no-pager', '--output=short'];
+    try {
+        const ordinary = await ctx.runner.capture('journalctl', args);
+        if (ordinary.code === 0 && ordinary.stdout.trim())
+            recent = ordinary.stdout.trim().split('\n').slice(-30).join('\n').slice(-6000);
+    }
+    catch { /* Diagnostics must not hide the restart failure. */ }
+    // An unprivileged journalctl may exit 0 with "-- No entries --" and a
+    // permission hint on stderr. Once this deploy used sudo for the restart,
+    // prefer its noninteractive journal read; keep ordinary output on failure.
+    if (scope === 'system' && sudoUsed) {
+        try {
+            const privileged = await ctx.runner.capture('sudo', ['-n', 'journalctl', ...args]);
+            if (privileged.code === 0 && privileged.stdout.trim())
+                recent = privileged.stdout.trim().split('\n').slice(-30).join('\n').slice(-6000);
+        }
+        catch { /* Never let journal access hide the restart failure. */ }
+    }
+    throw new StepAborted(`${unit}: ${reason}\nRecent journal:\n${recent}`);
+}
+/** Resolve the systemd scope the recorded service artifact ran in. No recorded
+ *  artifact (older record, or the step was check()-satisfied): prefer the scope
+ *  whose unit file actually exists (`userUnitExists` — the caller reads it
+ *  beside its other OS-user unit paths) — the user unit is the install
+ *  default, so defaulting to `system` would sudo-restart a unit that was
+ *  never installed. */
+export function resolveRedeployScope(ctx, userUnitExists) {
+    const svc = (ctx.state.steps['autostart']?.created?.artifacts ?? []).find((a) => a.type === 'service');
+    return svc?.scope === 'user' || svc?.scope === 'system' ? svc.scope : userUnitExists ? 'user' : 'system';
+}
+/** User-scope restart: reload and restart without sudo, then snapshot. */
+export async function restartUserService(ctx, unit, fail) {
+    await ctx.runner.interactive('systemctl', ['--user', 'daemon-reload']);
+    const code = await ctx.runner.interactive('systemctl', ['--user', 'restart', unit]);
+    if (code !== 0)
+        await fail(`restart returned code ${code}`);
+    return await serviceSnapshot(ctx, 'user', unit);
+}
+/** System-scope restart through `sudoStep`: the verify callback snapshots the
+ *  unit while `sudo` records that the privileged command ran (a later journal
+ *  diagnosis may then read it with sudo), and a `StepAborted` from the step is
+ *  translated into the same failure report a manual restart would give. */
+export async function restartSystemService(ctx, unit, before, sudo, fail) {
+    const scope = 'system';
+    let verified;
+    let restartCode;
+    try {
+        await sudoStep(ctx, {
+            description: `Reload systemd and restart the ${productName('cezar')} service.`,
+            command: `systemctl daemon-reload && systemctl restart ${unit}`,
+            verify: async (c, commandCode) => {
+                restartCode = commandCode;
+                if (commandCode !== undefined)
+                    sudo.used = true;
+                verified = await serviceSnapshot(c, scope, unit);
+                return (commandCode === undefined || commandCode === 0) &&
+                    verified.active === 'active' && before.started !== null && verified.started !== null && verified.started > before.started;
+            },
+        });
+    }
+    catch (err) {
+        if (!(err instanceof StepAborted))
+            throw err;
+        const reason = restartCode !== undefined && restartCode !== 0
+            ? `restart returned code ${restartCode}`
+            : verified?.active !== 'active'
+                ? `service is ${verified?.active ?? 'inactive or unreadable'}`
+                : before.started === null || verified.started === null
+                    ? 'start timestamp unavailable; cannot verify a fresh restart'
+                    : 'start timestamp unchanged after restart';
+        await fail(reason);
+    }
+    return verified ?? await serviceSnapshot(ctx, scope, unit);
+}
+/** The restart proof: the unit must be active and its monotonic start stamp
+ *  must have moved past `before` (and not be a zero/unknown stamp). Any miss
+ *  reports through `fail` and never returns. */
+export async function freshRestartOrFail(before, snapshot, fail) {
+    if (snapshot.active !== 'active')
+        await fail(`service is ${snapshot.active ?? 'inactive or unreadable'}`);
+    if (before.started === null || snapshot.started === null || snapshot.started === 0n) {
+        await fail('start timestamp unavailable; cannot verify a fresh restart');
+    }
+    if (before.started !== null && snapshot.started !== null && snapshot.started <= before.started) {
+        await fail('start timestamp unchanged after restart');
+    }
+}
+/** The status and journal commands `confirmCezarRunning` runs for the scope. */
+export function serviceDiagnostics(scope, unit) {
+    return scope === 'user'
+        ? { statusCmd: `systemctl --user status ${unit}`, logsCmd: `journalctl --user -u ${unit} -n 50 --no-pager` }
+        : { statusCmd: `sudo systemctl status ${unit}`, logsCmd: `sudo journalctl -u ${unit} -n 50 --no-pager` };
+}
+//# sourceMappingURL=ubuntu-vps-redeploy.js.map

package/dist/server-install/platforms/ubuntu-vps-redeploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ubuntu-vps-redeploy.js","sourceRoot":"","sources":["../../../src/server-install/platforms/ubuntu-vps-redeploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;GAIG;AAEH;;8CAE8C;AAC9C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,KAAwB,EAAE,IAAY;IAC7F,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAID,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAmB,EAAE,KAAwB,EAAE,IAAY;IAC/F,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iCAAiC,CAAC,CAAC;IACnI,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,KAAwB,EAAE,IAAY,EAAE,MAAc,EAAE,QAAQ,GAAG,KAAK;IAC/H,IAAI,MAAM,GAAG,4BAA4B,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC/G,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACpI,CAAC;IAAC,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;IAChE,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,KAAK,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;gBAAE,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1I,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,KAAK,MAAM,sBAAsB,MAAM,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;uBAKuB;AACvB,MAAM,UAAU,oBAAoB,CAAC,GAAmB,EAAE,cAAuB;IAC/E,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACvG,OAAO,GAAG,EAAE,KAAK,KAAK,MAAM,IAAI,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3G,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAmB,EACnB,IAAY,EACZ,IAAwC;IAExC,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,IAAI,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;2EAG2E;AAC3E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAmB,EACnB,IAAY,EACZ,MAAuB,EACvB,IAAuB,EACvB,IAAwC;IAExC,MAAM,KAAK,GAAG,QAAiB,CAAC;IAChC,IAAI,QAAqC,CAAC;IAC1C,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,EAAE;YAClB,WAAW,EAAE,kCAAkC,WAAW,CAAC,OAAO,CAAC,WAAW;YAC9E,OAAO,EAAE,gDAAgD,IAAI,EAAE;YAC/D,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;gBAC/B,WAAW,GAAG,WAAW,CAAC;gBAC1B,IAAI,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChD,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBACjD,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,CAAC,CAAC;oBACrD,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC9H,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7C,MAAM,MAAM,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,CAAC;YAC3D,CAAC,CAAC,yBAAyB,WAAW,EAAE;YACxC,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ;gBAC/B,CAAC,CAAC,cAAc,QAAQ,EAAE,MAAM,IAAI,wBAAwB,EAAE;gBAC9D,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;oBACpD,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,yCAAyC,CAAC;QAChD,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;gDAEgD;AAChD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAuB,EACvB,QAAyB,EACzB,IAAwC;IAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,CAAC,cAAc,QAAQ,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC,CAAC;IAC1G,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACpF,MAAM,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/F,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAwB,EAAE,IAAY;IACvE,OAAO,KAAK,KAAK,MAAM;QACrB,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,IAAI,EAAE,EAAE,OAAO,EAAE,wBAAwB,IAAI,mBAAmB,EAAE;QAC5G,CAAC,CAAC,EAAE,SAAS,EAAE,yBAAyB,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,IAAI,mBAAmB,EAAE,CAAC;AAC7G,CAAC"}

package/dist/server-install/platforms/ubuntu-vps.d.ts

@@ -0,0 +1,57 @@
+import { type InstallContext, type PlatformStrategy } from '../types.ts';
+import { isForeignNpxExecStart, isNpxExecStart, refreshNpxCacheForRedeploy } from '../npx-cache.ts';
+export { isForeignNpxExecStart, isNpxExecStart, refreshNpxCacheForRedeploy };
+/**
+ * Name of the process listening on `port`, or null when nothing is. Best effort
+ * (`ss` output varies, and without root the process name may be hidden) — used
+ * only to make a port collision explainable, never to gate the install.
+ */
+export declare function portListener(ctx: InstallContext, port: number): Promise<string | null>;
+/** The interface the cockpit listens on — loopback unless an external-proxy
+ *  install bound it somewhere the proxy can reach (e.g. the docker bridge). */
+export declare function upstreamHost(ctx: InstallContext): string;
+/** Add HTTP/2 only to Certbot's TLS listeners, preserving its trailing comments. */
+export declare function enableHttp2OnTlsListenerSed(vhostPath: string): string;
+/** Roll back the file if validation or reload fails; mark only a completed edit. */
+export declare function enableHttp2OnTlsCommand(vhostPath: string, marker: string): string;
+/**
+ * The nginx server block: auth_basic identity + SSE-safe proxy to loopback.
+ * `serverName` defaults to the catch-all `_`; the SSL step rewrites it to the
+ * real domain so the `certbot --nginx` plugin can find this vhost to edit.
+ */
+export declare function nginxVhost(port: number, serverName?: string, htpasswd?: string, nginxVersion?: string | null): string;
+/**
+ * systemd unit that runs cezar loopback-bound with CEZ_REMOTE=1.
+ *
+ * `execStart` must be an ABSOLUTE command — systemd resolves the ExecStart
+ * executable against its OWN compiled-in PATH (/usr/local/bin:/usr/bin:…), NOT
+ * the unit's `Environment=PATH`, so a bare `cezar` gives status=203/EXEC
+ * ("Unable to locate executable"). `resolveExecStart` therefore returns an
+ * absolute `"<node> <entry.js>"`. We still set `Environment=PATH` (with the
+ * installer's node dir) for any child process the app spawns.
+ */
+export declare function systemdUnit(repoRoot: string, port: number, scope: 'user' | 'system', execStart: string, bindHost?: string, _rebrand?: boolean): string;
+/**
+ * Decide the absolute ExecStart command for the service, mirroring how the
+ * installer itself was launched so the box keeps running the same cezar:
+ *
+ *  - Launched via `npx <alias>` (the CLI package lives in npm's ephemeral
+ *    `_npx` cache, which gets cleaned): the service can't point there, so it
+ *    reinstalls-and-runs the same way — `<abs npx> --yes cezarion` (bare `npx`
+ *    would 203/EXEC, so npx is made absolute).
+ *  - A stable install (a checkout, or a global `cezarion`/`cez`): run the
+ *    CLI's own built entry `<node> <pkg>/dist/index.js`, or a resolved global
+ *    bin. Absolute node + absolute script → systemd never resolves off PATH.
+ */
+export declare function serviceExecStart(opts: {
+    node: string;
+    pkgRoot: string;
+    entry: string;
+    entryExists: boolean;
+    npxPath: string;
+    globalBin?: string | undefined;
+}, rebrand?: boolean): string;
+export declare function createUbuntuVps({ rebrand }?: {
+    rebrand?: boolean | undefined;
+}): PlatformStrategy;
+export declare const ubuntuVps: PlatformStrategy;