@monster-orange/den 0.0.0-stage → 0.1.0

package/src/shared/stacks/runtime.ts

@@ -0,0 +1,334 @@
+/** Side effects for stacks: docker compose, link networks, edge routes. */
+import { randomBytes } from "crypto";
+import { spawnSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { getReposRoot } from "../den-config.js";
+import { edgeNames } from "../edge/render.js";
+import type { EdgeConfig } from "../edge/types.js";
+import {
+  containerName,
+  expandEnv,
+  linkNetwork,
+  projectName,
+  providerServices,
+  renderOverride,
+  renderStackRoutes,
+  routedNetworks,
+} from "./render.js";
+import type { ResolvedProject, StackConfig } from "./types.js";
+
+function run(
+  cmd: string,
+  args: string[],
+  opts: { cwd?: string; env?: NodeJS.ProcessEnv; inherit?: boolean } = {},
+) {
+  const r = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    encoding: "utf-8",
+    env: { ...process.env, ...opts.env },
+    stdio: opts.inherit ? "inherit" : "pipe",
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (r.error) throw new Error(`${cmd}: ${r.error.message}`);
+  return {
+    code: r.status ?? 1,
+    out: (r.stdout ?? "").trim(),
+    err: (r.stderr ?? "").trim(),
+  };
+}
+
+function must(
+  cmd: string,
+  args: string[],
+  opts: Parameters<typeof run>[2] = {},
+): string {
+  const r = run(cmd, args, opts);
+  if (r.code !== 0)
+    throw new Error(
+      `${cmd} ${args.slice(0, 6).join(" ")}… failed:\n${r.err || r.out}`,
+    );
+  return r.out;
+}
+
+export interface StackContext {
+  edge: EdgeConfig;
+  stacks: Record<string, StackConfig>;
+  workspace: string;
+}
+
+function stackDir(ctx: StackContext, s: StackConfig): string {
+  return path.join(
+    ctx.edge.stateDir,
+    "stacks",
+    projectName(s.name, ctx.workspace),
+  );
+}
+
+export function repoDir(s: StackConfig): string {
+  const dir = path.join(
+    s.repoPath ?? path.join(getReposRoot(), s.repo),
+    s.dir ?? "",
+  );
+  if (!fs.existsSync(dir))
+    throw new Error(
+      `stack ${s.name}: ${dir} does not exist (clone ${s.repo} first)`,
+    );
+  return dir;
+}
+
+/** Generated local-only secrets, created once per stack + workspace. */
+function generatedEnv(
+  ctx: StackContext,
+  s: StackConfig,
+): Record<string, string> {
+  const file = path.join(stackDir(ctx, s), "generated.env");
+  const have: Record<string, string> = {};
+  if (fs.existsSync(file))
+    for (const line of fs.readFileSync(file, "utf-8").split("\n")) {
+      const i = line.indexOf("=");
+      if (i > 0) have[line.slice(0, i)] = line.slice(i + 1);
+    }
+  let changed = false;
+  for (const k of s.generate)
+    if (!have[k]) {
+      have[k] = randomBytes(32).toString("base64url");
+      changed = true;
+    }
+  if (changed) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(
+      file,
+      Object.entries(have)
+        .map(([k, v]) => `${k}=${v}`)
+        .join("\n") + "\n",
+      { mode: 0o600 },
+    );
+  }
+  return have;
+}
+
+function composeEnv(ctx: StackContext, s: StackConfig): NodeJS.ProcessEnv {
+  return {
+    ...generatedEnv(ctx, s),
+    ...expandEnv(s.env, ctx.workspace, ctx.stacks),
+    COMPOSE_PROJECT_NAME: projectName(s.name, ctx.workspace),
+    ...(s.profiles.length ? { COMPOSE_PROFILES: s.profiles.join(",") } : {}),
+  };
+}
+
+function baseArgs(ctx: StackContext, s: StackConfig): string[] {
+  return [
+    "compose",
+    "-p",
+    projectName(s.name, ctx.workspace),
+    ...s.files.flatMap((f) => ["-f", f]),
+  ];
+}
+
+function resolve(ctx: StackContext, s: StackConfig): ResolvedProject {
+  const out = must(
+    "docker",
+    [...baseArgs(ctx, s), "config", "--format", "json"],
+    {
+      cwd: repoDir(s),
+      env: composeEnv(ctx, s),
+    },
+  );
+  return JSON.parse(out) as ResolvedProject;
+}
+
+function overrideArgs(ctx: StackContext, s: StackConfig): string[] {
+  return [
+    ...baseArgs(ctx, s),
+    "-f",
+    path.join(stackDir(ctx, s), "override.yml"),
+  ];
+}
+
+function ensureNetwork(name: string): void {
+  if (run("docker", ["network", "inspect", name]).code !== 0)
+    must("docker", ["network", "create", name]);
+}
+
+/** `docker network connect`, ignoring "already connected". Container-name alias only. */
+function connect(network: string, container: string): void {
+  const r = run("docker", ["network", "connect", network, container]);
+  if (r.code !== 0 && !/already exists|already connected/i.test(r.err))
+    throw new Error(`docker network connect ${network} ${container}: ${r.err}`);
+}
+
+function running(container: string): boolean {
+  return (
+    run("docker", ["inspect", "-f", "{{.State.Running}}", container]).out ===
+    "true"
+  );
+}
+
+export function stackUp(
+  ctx: StackContext,
+  s: StackConfig,
+  opts: { build?: boolean } = {},
+) {
+  const resolved = resolve(ctx, s);
+  // Provider side of each link: its referenced services join a private network.
+  const needs = providerServices(s);
+  for (const p of s.uses) {
+    const net = linkNetwork(s.name, p, ctx.workspace);
+    ensureNetwork(net);
+    for (const svc of needs[p] ?? []) {
+      const c = containerName(projectName(p, ctx.workspace), svc);
+      if (!running(c))
+        throw new Error(
+          `stack ${s.name} needs ${p}'s ${svc} (${c}), which is not running`,
+        );
+      connect(net, c);
+    }
+  }
+  const dir = stackDir(ctx, s);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(
+    path.join(dir, "override.yml"),
+    renderOverride(s, resolved, ctx.workspace),
+  );
+  must(
+    "docker",
+    [
+      ...overrideArgs(ctx, s),
+      "up",
+      "-d",
+      ...(opts.build ? ["--build"] : []),
+      "--remove-orphans",
+    ],
+    { cwd: repoDir(s), env: composeEnv(ctx, s), inherit: true },
+  );
+  // This stack as a provider: consumers already running keep their link
+  // network, but a restarted provider's new containers must rejoin it.
+  for (const c of Object.values(ctx.stacks)) {
+    if (!c.uses.includes(s.name)) continue;
+    const net = linkNetwork(c.name, s.name, ctx.workspace);
+    if (run("docker", ["network", "inspect", net]).code !== 0) continue;
+    for (const svc of providerServices(c)[s.name] ?? [])
+      connect(net, containerName(projectName(s.name, ctx.workspace), svc));
+  }
+  const edge = edgeNames(ctx.edge.org).container;
+  const nets = routedNetworks(s, resolved);
+  for (const n of nets) connect(n, edge);
+  fs.writeFileSync(
+    path.join(
+      ctx.edge.stateDir,
+      "dynamic",
+      `stack-${projectName(s.name, ctx.workspace)}.yml`,
+    ),
+    renderStackRoutes(ctx.edge, s, resolved),
+  );
+  return { project: resolved.name, networks: nets };
+}
+
+export function stackDown(ctx: StackContext, s: StackConfig): void {
+  fs.rmSync(
+    path.join(
+      ctx.edge.stateDir,
+      "dynamic",
+      `stack-${projectName(s.name, ctx.workspace)}.yml`,
+    ),
+    { force: true },
+  );
+  const edge = edgeNames(ctx.edge.org).container;
+  const dir = repoDir(s);
+  const override = path.join(stackDir(ctx, s), "override.yml");
+  const args = fs.existsSync(override)
+    ? overrideArgs(ctx, s)
+    : baseArgs(ctx, s);
+  // The edge holds a connection to the project network; let go so `down` can remove it.
+  try {
+    for (const n of routedNetworks(s, resolve(ctx, s)))
+      run("docker", ["network", "disconnect", n, edge]);
+  } catch {
+    /* compose config failed — nothing to disconnect */
+  }
+  must("docker", [...args, "down"], {
+    cwd: dir,
+    env: composeEnv(ctx, s),
+    inherit: true,
+  });
+  const needs = providerServices(s);
+  for (const p of s.uses) {
+    const net = linkNetwork(s.name, p, ctx.workspace);
+    for (const svc of needs[p] ?? [])
+      run("docker", [
+        "network",
+        "disconnect",
+        net,
+        containerName(projectName(p, ctx.workspace), svc),
+      ]);
+    run("docker", ["network", "rm", net]);
+  }
+}
+
+export function stackPs(ctx: StackContext, s: StackConfig): string {
+  return run(
+    "docker",
+    [
+      ...baseArgs(ctx, s),
+      "ps",
+      "--format",
+      "table {{.Service}}\t{{.State}}\t{{.Status}}",
+    ],
+    {
+      cwd: repoDir(s),
+      env: composeEnv(ctx, s),
+    },
+  ).out;
+}
+
+export function stackLogs(
+  ctx: StackContext,
+  s: StackConfig,
+  args: string[],
+): number {
+  return run("docker", [...baseArgs(ctx, s), "logs", ...args], {
+    cwd: repoDir(s),
+    env: composeEnv(ctx, s),
+    inherit: true,
+  }).code;
+}
+
+/**
+ * Health of a running stack: ok when it has containers, all are running, and
+ * none reports a failing or pending Docker healthcheck.
+ */
+export function stackHealth(
+  ctx: StackContext,
+  s: StackConfig,
+  service?: string,
+): { ok: boolean; detail: string } {
+  const project = projectName(s.name, ctx.workspace);
+  const r = run("docker", [
+    "ps",
+    "-a",
+    "--filter",
+    `label=com.docker.compose.project=${project}`,
+    ...(service
+      ? ["--filter", `label=com.docker.compose.service=${service}`]
+      : []),
+    "--format",
+    '{{.Label "com.docker.compose.service"}}\t{{.State}}\t{{.Status}}',
+  ]);
+  if (r.code !== 0) return { ok: false, detail: r.err || "docker ps failed" };
+  const rows = r.out.split("\n").filter(Boolean);
+  if (!rows.length)
+    return {
+      ok: false,
+      detail: `${project}${service ? `/${service}` : ""}: not running`,
+    };
+  const bad = rows.filter((row) => {
+    const [, state, status] = row.split("\t");
+    return (
+      state !== "running" || /\((unhealthy|health: starting)\)/.test(status)
+    );
+  });
+  return bad.length
+    ? { ok: false, detail: bad.join("; ") }
+    : { ok: true, detail: `${rows.length} container(s) running` };
+}

package/src/shared/stacks/types.ts

@@ -0,0 +1,53 @@
+/**
+ * A stack = one repo's Docker Compose project, run behind the edge.
+ *
+ *   stacks:
+ *     webapp:
+ *       repo: sample-webapp
+ *       files: [docker-compose.yml]          # relative to repo/dir
+ *       routes: { app: frontend:80 }         # https://app.webapp.<domain>
+ *       generate: [SECRET_KEY]               # random once, kept in local state
+ *       uses: [ragstack]                    # start first + private link network
+ *       env:                                 # compose ${VAR} substitution
+ *         RAG_PROXY_TARGET: "http://{ragstack.ragstack-server}:80"
+ *
+ * `{stack.service}` expands to that service's container name.
+ */
+export interface StackConfig {
+  name: string;
+  repo: string;
+  /** Absolute checkout path; when unset, `<repos_root>/<repo>`. */
+  repoPath?: string;
+  /** Subdirectory of the repo holding the compose files. */
+  dir?: string;
+  files: string[];
+  /** `<route>` → `<service>:<container port>`. */
+  routes: Record<string, string>;
+  generate: string[];
+  uses: string[];
+  env: Record<string, string>;
+  /** Compose profiles to enable. */
+  profiles: string[];
+  /** service → replacement healthcheck `test`, for a repo's broken check. */
+  healthchecks?: Record<string, string[]>;
+  /**
+   * service → environment variables set on that service (override wins by
+   * key). For values a repo's compose file hard-codes, which `env` (compose
+   * `${VAR}` substitution) cannot change.
+   */
+  serviceEnv?: Record<string, Record<string, string>>;
+}
+
+/** What `docker compose config --format json` tells us about a service. */
+export interface ResolvedService {
+  container_name?: string;
+  ports?: unknown[];
+  networks?: Record<string, unknown> | null;
+  environment?: Record<string, string | null> | null;
+}
+
+export interface ResolvedProject {
+  name: string;
+  services: Record<string, ResolvedService>;
+  networks?: Record<string, { name?: string }>;
+}

package/src/shared/terminal/tabs.ts

@@ -0,0 +1,212 @@
+import * as fs from "fs";
+import { execFileSync } from "child_process";
+
+import { product } from "../product.js";
+export type TerminalApp = "iterm2" | "terminal";
+
+export interface OpenTabOptions {
+  cmd: string;
+  cwd: string;
+  label?: string;
+  terminalApp?: TerminalApp;
+  /**
+   * Variables to export in the tab before running `cmd`. A tab is a fresh
+   * login shell, so den-resolved values (the org config's service_env) are only
+   * present if we put them there — without them a consumer repo silently falls
+   * back to its `../<repo>` sibling default and fails in a nested checkout.
+   *
+   * Keep this to non-secret values: it lands in the tab's shell history.
+   */
+  env?: Record<string, string>;
+}
+
+export interface OpenedTab {
+  terminalApp: TerminalApp;
+  tabId: string;
+}
+
+const APPLE_TERMINAL_APP = fs.existsSync(
+  "/System/Applications/Utilities/Terminal.app",
+)
+  ? "/System/Applications/Utilities/Terminal.app"
+  : "Terminal";
+
+export function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+function appleScriptString(value: string): string {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+function automationHelp(appName: string): string {
+  return (
+    `Could not automate ${appName}. ` +
+    `Allow ${product().title}/your terminal to control Terminal, iTerm, and System Events in ` +
+    "System Settings > Privacy & Security > Automation."
+  );
+}
+
+function runAppleScript(script: string, appName: string): string {
+  try {
+    return execFileSync("osascript", ["-e", script], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+    }).trim();
+  } catch (error) {
+    const stderr =
+      typeof (error as { stderr?: unknown }).stderr === "string"
+        ? ((error as { stderr: string }).stderr ?? "")
+        : "";
+    const message = stderr.trim() || (error as Error).message;
+    throw new Error(`${automationHelp(appName)} ${message}`.trim());
+  }
+}
+
+function buildTabCommand(opts: OpenTabOptions): string {
+  const exports = Object.entries(opts.env ?? {})
+    .filter(([key, value]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key) && value)
+    .map(([key, value]) => `export ${key}=${shellQuote(value)}`);
+  const prefix = exports.length > 0 ? `${exports.join(" ")} && ` : "";
+  return `${prefix}cd ${shellQuote(opts.cwd)} && ${opts.cmd}`;
+}
+
+function openITermTab(command: string): OpenedTab {
+  const script = `
+tell application "iTerm"
+  activate
+  if (count of windows) = 0 then
+    set newWindow to (create window with default profile)
+    set newTab to current tab of newWindow
+  else
+    tell current window
+      set newTab to (create tab with default profile)
+    end tell
+  end if
+  tell current session of newTab
+    write text ${appleScriptString(command)}
+  end tell
+  return (id of current session of newTab as text)
+end tell
+`;
+  return { terminalApp: "iterm2", tabId: runAppleScript(script, "iTerm2") };
+}
+
+function openAppleTerminalTab(command: string): OpenedTab {
+  const script = `
+tell application ${appleScriptString(APPLE_TERMINAL_APP)}
+  activate
+  if not (exists front window) then
+    do script ""
+  end if
+end tell
+delay 0.1
+tell application "System Events"
+  tell process "Terminal"
+    keystroke "t" using command down
+  end tell
+end tell
+delay 0.1
+tell application ${appleScriptString(APPLE_TERMINAL_APP)}
+  do script ${appleScriptString(command)} in selected tab of front window
+  return tty of selected tab of front window
+end tell
+`;
+  return {
+    terminalApp: "terminal",
+    tabId: runAppleScript(script, "Apple Terminal"),
+  };
+}
+
+export function openTab(opts: OpenTabOptions): OpenedTab {
+  const terminalApp = opts.terminalApp ?? detectDefaultTerminalApp();
+  const command = buildTabCommand(opts);
+  if (terminalApp === "iterm2") return openITermTab(command);
+  return openAppleTerminalTab(command);
+}
+
+export function closeTab(tabId: string, terminalApp: TerminalApp): void {
+  if (terminalApp === "iterm2") {
+    const script = `
+tell application "iTerm"
+  repeat with w in windows
+    repeat with t in tabs of w
+      if (id of current session of t as text) is ${appleScriptString(tabId)} then
+        close t
+        return "closed"
+      end if
+    end repeat
+  end repeat
+end tell
+return "missing"
+`;
+    runAppleScript(script, "iTerm2");
+    return;
+  }
+
+  const script = `
+tell application ${appleScriptString(APPLE_TERMINAL_APP)}
+  repeat with w in windows
+    repeat with t in tabs of w
+      try
+        if (tty of t) is ${appleScriptString(tabId)} then
+          close t
+          return "closed"
+        end if
+      end try
+    end repeat
+  end repeat
+end tell
+return "missing"
+`;
+  runAppleScript(script, "Apple Terminal");
+}
+
+export function tabExists(tabId: string, terminalApp: TerminalApp): boolean {
+  if (terminalApp === "iterm2") {
+    const script = `
+tell application "iTerm"
+  repeat with w in windows
+    repeat with t in tabs of w
+      if (id of current session of t as text) is ${appleScriptString(tabId)} then return "yes"
+    end repeat
+  end repeat
+end tell
+return "no"
+`;
+    return runAppleScript(script, "iTerm2") === "yes";
+  }
+
+  const script = `
+tell application ${appleScriptString(APPLE_TERMINAL_APP)}
+  repeat with w in windows
+    repeat with t in tabs of w
+      try
+        if (tty of t) is ${appleScriptString(tabId)} then return "yes"
+      end try
+    end repeat
+  end repeat
+end tell
+return "no"
+`;
+  return runAppleScript(script, "Apple Terminal") === "yes";
+}
+
+export function resolveTerminalApp(key: string | undefined): TerminalApp {
+  if (!key) return detectDefaultTerminalApp();
+  if (key === "iterm2") return "iterm2";
+  if (key === "terminal") return "terminal";
+  if (key === "ghostty") {
+    throw new Error(
+      `Tab mode does not support Ghostty yet. Set \`${product().cli} config terminal=iterm2\`, \`${product().cli} config terminal=terminal\`, or run with \`--no-tabs\`.`,
+    );
+  }
+  throw new Error(
+    `Tab mode only supports iTerm2 and Apple Terminal. Configured terminal "${key}" is not supported; run with --no-tabs to use daemon mode.`,
+  );
+}
+
+function detectDefaultTerminalApp(): TerminalApp {
+  if (fs.existsSync("/Applications/iTerm.app")) return "iterm2";
+  return "terminal";
+}