bod-cli 0.10.10 → 0.10.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.10.10",
+  "version": "0.10.12",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/commands/deploy.ts

@@ -6,14 +6,40 @@ import { formatSize } from '../utils/output'
 import { resolveExcludes, tarballOffenders } from '../utils/excludes'
 import { resolveAppId, resolveAppName, readInstanceFromYaml, readDeployModeFromYaml, readExcludesFromYaml, detectSiblingDeps, readYamlConfig, resolveRepoFromYaml } from '../utils/resolve'
 
-async function detectBranch(explicit?: string): Promise<string> {
+/**
+ * The branch to deploy — never the literal string `HEAD`.
+ *
+ * `git rev-parse --abbrev-ref HEAD` prints `HEAD` in a DETACHED checkout, which is what
+ * every GitHub Actions run and every detached worktree is. That string was then deployed
+ * as an ordinary branch name: a real deployment, a live `head--<app>` preview host, DNS
+ * and a Caddy route, for a branch that does not exist. Three of them existed on the blank
+ * app on 2026-09-05, and the server now refuses one outright (400), so resolving it here
+ * is what keeps CI deploying instead of failing.
+ *
+ * CI knows the answer even when git does not: Actions sets GITHUB_HEAD_REF on a
+ * pull_request run and GITHUB_REF_NAME on a push. Those are consulted before giving up.
+ * If nothing can name the branch we REFUSE rather than guessing `main` — silently
+ * promoting an arbitrary detached commit to production is far worse than stopping.
+ */
+export async function detectBranch(explicit?: string): Promise<string> {
   if (explicit) return explicit
   const proc = Bun.spawnSync(['git', 'rev-parse', '--abbrev-ref', 'HEAD'])
   const branch = proc.exitCode === 0 ? proc.stdout.toString().trim() : ''
-  return branch || 'main'
+  if (branch && branch.toUpperCase() !== 'HEAD') return branch
+
+  const fromCi = (process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || '').trim()
+  if (fromCi && fromCi.toUpperCase() !== 'HEAD') return fromCi
+
+  if (branch.toUpperCase() === 'HEAD') {
+    throw new Error(
+      'Detached HEAD: git reports no branch, and no CI branch variable is set. ' +
+      'Pass --branch explicitly (in GitHub Actions: --branch "${{ github.head_ref || github.ref_name }}").'
+    )
+  }
+  return 'main' // not a git repo at all — the historical default
 }
 
-export async function uploadDeploy(client: BodClient, appId: string, branch: string) {
+export async function uploadDeploy(client: BodClient, appId: string, branch: string): Promise<string | undefined> {
   const allExcludes = resolveExcludes(readExcludesFromYaml())
   const excludeFlags = allExcludes.map(e => `--exclude=${e}`)
 
@@ -121,7 +147,7 @@ export async function uploadDeploy(client: BodClient, appId: string, branch: str
   console.log(chalk.dim(`Uploading ${formatSize(size)}...`))
 
   const start = Date.now()
-  await client.upload<any>(
+  const res = await client.upload<any>(
     `/apps/${appId}/deploy/upload`,
     file.stream(),
     { 'x-branch': branch },
@@ -131,10 +157,12 @@ export async function uploadDeploy(client: BodClient, appId: string, branch: str
 
   // Cleanup temp file
   try { (await import('fs')).unlinkSync(tmpFile) } catch {}
+  return typeof res?.sha === 'string' ? res.sha : undefined
 }
 
-async function gitDeploy(client: BodClient, appId: string, branch: string) {
-  await client.post<any>(`/apps/${appId}/deploy`, { branch })
+async function gitDeploy(client: BodClient, appId: string, branch: string): Promise<string | undefined> {
+  const res = await client.post<any>(`/apps/${appId}/deploy`, { branch })
+  return typeof res?.sha === 'string' ? res.sha : undefined
 }
 
 function branchToSubdomain(branch: string, domain: string, productionBranch: string): string {
@@ -178,7 +206,29 @@ async function getWithRetry<T>(client: BodClient, path: string, attempts = 4): P
   throw lastErr
 }
 
-async function pollDeploy(client: BodClient, appId: string, since: number, instanceCaps?: { baseDomain?: string | null }, localConfig?: { localDomain?: string; caddyPort?: number } | null) {
+/**
+ * THE deployment this command created — never merely "the newest one on the app".
+ *
+ * The poll used to take the first deployment newer than the command's start time. Apps are
+ * deployed CONCURRENTLY (a CI run on main while a developer pushes a branch preview), so that
+ * picked up a stranger's deployment and reported it as this command's result. On 2026-09-05 a
+ * `bod deploy --upload --branch feat/…` printed "✓ Deployment live! → https://blank.bod.ee"
+ * because a GitHub Actions deploy of main landed 3 seconds earlier — and the branch deploy was
+ * then blamed for a production release it never made, and prod was "rolled back" over it.
+ *
+ * The server answers every deploy with the `sha` it minted for that job, so match on that.
+ * Without a sha (an older server) fall back to the BRANCH, which at least cannot cross the
+ * preview/production line — and never to "whatever is newest".
+ */
+export function selectOwnDeployment(
+  deployments: any[],
+  own: { sha?: string; branch: string; since: number },
+): any | undefined {
+  if (own.sha) return deployments.find((d: any) => d.sha === own.sha)
+  return deployments.find((d: any) => d.branch === own.branch && (d.createdAt ?? 0) >= own.since)
+}
+
+async function pollDeploy(client: BodClient, appId: string, since: number, own: { sha?: string; branch: string }, instanceCaps?: { baseDomain?: string | null }, localConfig?: { localDomain?: string; caddyPort?: number } | null) {
   console.log(chalk.dim('Waiting for deployment...'))
   let lastStatus = ''
   let lastLogTs = since
@@ -198,7 +248,7 @@ async function pollDeploy(client: BodClient, appId: string, since: number, insta
       return
     }
     const deps = detail.deployments ?? []
-    const latest = deps.find((d: any) => (d.createdAt ?? 0) >= since)
+    const latest = selectOwnDeployment(deps, { sha: own.sha, branch: own.branch, since })
     if (!latest) continue
     const status = latest.status
     if (status !== lastStatus) {
@@ -270,6 +320,7 @@ export default defineCommand({
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     branch: { type: 'string', description: 'Branch to deploy (default: current git branch)' },
     upload: { type: 'boolean', description: 'Upload local source instead of git clone', default: false },
+    yes: { type: 'boolean', alias: 'y', description: 'Skip the confirmation for a production deploy that was not asked for by name', default: false },
   },
   async run({ args }) {
     const { url, apiKey, name: instanceName, instance } = getResolvedInstance(loadConfig(), readInstanceFromYaml())
@@ -294,6 +345,31 @@ export default defineCommand({
       await client.put(`/apps/${appId}`, yamlConfig).catch(() => {})
     }
 
+    // Publishing the LIVE SITE is never a side effect of forgetting a flag. Without `--branch`
+    // the branch comes from whatever this checkout happens to be on, so `bod deploy` in a main
+    // checkout silently ships production — the same one-word difference that put an unreviewed
+    // branch on blank.bod.ee on 2026-09-05. Naming the production branch (`--branch main`, which
+    // is what CI does) is an explicit act and passes straight through; guessing it is not.
+    const productionBranch = detail.productionBranch ?? 'main'
+    if (!args.branch && branch === productionBranch) {
+      const cmd = `bod deploy${args.app ? ` ${args.app}` : ''}${args.upload ? ' --upload' : ''} --branch ${productionBranch}`
+      if (!args.yes && !process.stdout.isTTY) {
+        console.error(chalk.red(`Refusing to deploy PRODUCTION (branch "${productionBranch}") without being asked to.`))
+        console.error(chalk.red(`This checkout is on "${branch}", which is ${appName}'s production branch, and no --branch was given.`))
+        console.error(`Run:  ${cmd}`)
+        console.error(`  or: deploy a preview instead, e.g. --branch <your-branch>`)
+        process.exit(1)
+      }
+      if (!args.yes) {
+        const { confirm } = await import('@inquirer/prompts')
+        const ok = await confirm({
+          message: `Deploy PRODUCTION for "${appName}" (branch ${productionBranch})? No --branch was given.`,
+          default: false,
+        })
+        if (!ok) { console.log(chalk.yellow('Aborted.')); return }
+      }
+    }
+
     const forceUpload = args.upload || readDeployModeFromYaml() === 'upload'
 
     let hasRepo = !!detail.repo
@@ -310,13 +386,11 @@ export default defineCommand({
     console.log(chalk.dim(`Deploying ${appName} (branch: ${branch})${useUpload ? ' via upload' : ''}...`))
 
     const since = Date.now() - 5000 // buffer for clock skew
-    if (useUpload) {
-      await uploadDeploy(client, appId, branch)
-    } else {
-      await gitDeploy(client, appId, branch)
-    }
+    const sha = useUpload
+      ? await uploadDeploy(client, appId, branch)
+      : await gitDeploy(client, appId, branch)
 
     console.log(chalk.green(`✓ Deployment queued`))
-    await pollDeploy(client, appId, since, instance.capabilities, localConfig)
+    await pollDeploy(client, appId, since, { sha, branch }, instance.capabilities, localConfig)
   },
 })

package/test/deploy-attribution.test.ts

@@ -0,0 +1,146 @@
+/**
+ * TWO WAYS `bod deploy` TOLD THE OPERATOR SOMETHING UNTRUE ABOUT PRODUCTION (2026-09-05).
+ *
+ * 1. ATTRIBUTION. The poll reported "the newest deployment on this app", not the one this
+ *    command created. A GitHub Actions deploy of `main` landed 3 seconds inside the window of a
+ *    `bod deploy --upload --branch feat/…`, so the branch deploy printed
+ *    "✓ Deployment live! → https://blank.bod.ee" — the production URL, for a deployment it had
+ *    not made. The branch flag was blamed for a production release, and prod was then "rolled
+ *    back" over CI's legitimate build. Nothing was wrong with the branch header at all.
+ *
+ * 2. AN UNASKED PRODUCTION TARGET. With no `--branch`, the branch is whatever the checkout is
+ *    on — so a bare `bod deploy` in a main checkout publishes the live site as a side effect of
+ *    a missing flag.
+ *
+ * Both are asserted through the REAL CLI against a stub control plane: the assertions are the
+ * bytes the operator reads and the requests the server actually receives.
+ */
+import { test, expect, afterAll } from 'bun:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { selectOwnDeployment } from '../src/commands/deploy'
+
+// ---------------------------------------------------------------- unit: the selector itself
+
+const OURS = { sha: 'upload-dc524d78', branch: 'feat/onboarding', createdAt: 2_000, status: 'live' }
+const STRANGER = { sha: 'upload-d95087b2', branch: 'main', createdAt: 3_000, status: 'live' } // CI, mid-flight
+
+test('the poll picks THIS deploy, not a concurrent production deploy that landed later', () => {
+  const deps = [STRANGER, OURS] // server returns newest-first
+  expect(selectOwnDeployment(deps, { sha: OURS.sha, branch: OURS.branch, since: 1_000 })?.branch)
+    .toBe('feat/onboarding')
+  // Non-vacuous: the rule this replaced ("first one newer than `since`") really did pick main.
+  expect(deps.find(d => d.createdAt >= 1_000)?.branch).toBe('main')
+})
+
+test('without a sha it still cannot cross the preview/production line', () => {
+  expect(selectOwnDeployment([STRANGER], { branch: 'feat/onboarding', since: 1_000 })).toBeUndefined()
+  expect(selectOwnDeployment([STRANGER, OURS], { branch: 'feat/onboarding', since: 1_000 })?.sha).toBe(OURS.sha)
+})
+
+// ------------------------------------------------------- end-to-end: the real CLI, real bytes
+
+const CLI = join(import.meta.dir, '../src/cli.ts')
+const roots: string[] = []
+afterAll(() => { for (const r of roots) rmSync(r, { recursive: true, force: true }) })
+
+/** A checkout on `branch`, with a HOME holding a bod config pointing at `url`. */
+function workspace(branch: string, url: string) {
+  const root = mkdtempSync(join(tmpdir(), 'bod-attr-'))
+  roots.push(root)
+  const app = join(root, 'app')
+  mkdirSync(app)
+  writeFileSync(join(app, 'package.json'), JSON.stringify({ name: 'stubapp' }))
+  writeFileSync(join(app, 'bodify.yaml'), 'name: stubapp\ndeploy: upload\n')
+  for (const a of [['init', '-q', '-b', branch], ['add', '-A'], ['-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'x']]) {
+    Bun.spawnSync(['git', ...a], { cwd: app })
+  }
+  mkdirSync(join(root, 'home', '.bod'), { recursive: true })
+  writeFileSync(join(root, 'home', '.bod', 'config.json'), JSON.stringify({
+    instances: { stub: { url, apiKey: 'k', capabilities: { registryEnabled: false, baseDomain: 'stub.test', githubConfigured: false } } },
+    defaultInstance: 'stub',
+  }))
+  return { app, home: join(root, 'home') }
+}
+
+/** Async on purpose: `spawnSync` would block this process's event loop, and the stub control
+ *  plane lives in it — a synchronous spawn deadlocks against its own server. */
+async function runCli(args: string[], ws: { app: string; home: string }) {
+  const p = Bun.spawn(['bun', CLI, ...args], {
+    cwd: ws.app,
+    env: { ...process.env, HOME: ws.home, NO_COLOR: '1', FORCE_COLOR: '0' },
+    stdout: 'pipe', stderr: 'pipe',
+  })
+  const [out, err] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()])
+  return { code: await p.exited, out: out + err }
+}
+
+test('a branch deploy reports ITS OWN deployment while a production deploy lands beside it', async () => {
+  const received: { branch: string | null }[] = []
+  // The stub answers every poll with BOTH deployments live: ours (feat) and a stranger's (main,
+  // created later) — the exact shape of the 2026-09-05 race.
+  const server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const path = new URL(req.url).pathname
+      if (path === '/api/apps') return Response.json([{ id: 'a1', name: 'stubapp' }])
+      if (path === '/api/apps/a1/deploy/upload') {
+        received.push({ branch: req.headers.get('x-branch') })
+        await req.arrayBuffer()
+        return Response.json({ queued: true, sha: OURS.sha }, { status: 202 })
+      }
+      if (path === '/api/apps/a1') {
+        return Response.json({
+          id: 'a1', name: 'stubapp', domain: 'stubapp.stub.test', productionBranch: 'main',
+          deployments: [
+            { ...STRANGER, createdAt: Date.now() },
+            { ...OURS, createdAt: Date.now() - 1000 },
+          ],
+        })
+      }
+      return Response.json([])
+    },
+  })
+  try {
+    const ws = workspace('feat/onboarding', `http://localhost:${server.port}`)
+    const { code, out } = await runCli(['deploy', '--upload', '--branch', 'feat/onboarding'], ws)
+    expect(received).toEqual([{ branch: 'feat/onboarding' }])
+    expect(code).toBe(0)
+    expect(out).toContain('Deployment live!')
+    // The operator must read the PREVIEW host, never the production domain of someone else's deploy.
+    expect(out).toContain('feat-onboarding--stubapp.stub.test')
+    expect(out).toContain('Preview deployment (branch: feat/onboarding)')
+    expect(out).not.toContain('https://stubapp.stub.test')
+  } finally { server.stop(true) }
+}, 60_000)
+
+test('a bare deploy from a production checkout refuses instead of publishing the live site', async () => {
+  const uploads: unknown[] = []
+  const server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const path = new URL(req.url).pathname
+      if (path === '/api/apps') return Response.json([{ id: 'a1', name: 'stubapp' }])
+      if (path.endsWith('/deploy/upload')) { uploads.push(1); return Response.json({ queued: true, sha: 'x' }, { status: 202 }) }
+      if (path === '/api/apps/a1') return Response.json({
+        id: 'a1', name: 'stubapp', domain: 'stubapp.stub.test', productionBranch: 'main',
+        deployments: uploads.length ? [{ sha: 'x', branch: 'main', createdAt: Date.now(), status: 'live' }] : [],
+      })
+      return Response.json([])
+    },
+  })
+  try {
+    const ws = workspace('main', `http://localhost:${server.port}`)
+    const { code, out } = await runCli(['deploy', '--upload'], ws)
+    expect(code).toBe(1)
+    expect(out).toContain('Refusing to deploy PRODUCTION')
+    expect(out).toContain('--branch main') // the resolved command, not an instruction to go think
+    expect(uploads).toEqual([]) // nothing was published
+
+    // Naming it is an explicit act and still deploys — the guard is not a blanket refusal.
+    const named = await runCli(['deploy', '--upload', '--branch', 'main'], ws)
+    expect(uploads.length).toBe(1)
+    expect(named.out).toContain('Deployment queued')
+  } finally { server.stop(true) }
+}, 60_000)

package/test/detect-branch.test.ts

@@ -0,0 +1,76 @@
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test'
+import { mkdtempSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { detectBranch } from '../src/commands/deploy'
+
+/**
+ * A DETACHED HEAD IS NOT A BRANCH CALLED "HEAD".
+ *
+ * `git rev-parse --abbrev-ref HEAD` prints the literal string `HEAD` in a detached
+ * checkout — every GitHub Actions run, and any detached worktree. `bod deploy` used to
+ * send that as the branch, and the platform obligingly created a real deployment, a live
+ * `head--<app>` host, DNS and a Caddy route for it. Three existed on the blank app on
+ * 2026-09-05.
+ *
+ * This uses a REAL git repo in a real detached state, not a stubbed `git` — the whole bug
+ * lives in what git actually prints.
+ */
+
+let dir: string
+let origCwd: string
+const git = (...args: string[]) => Bun.spawnSync(['git', ...args], { cwd: dir })
+
+beforeAll(() => {
+  origCwd = process.cwd()
+  dir = mkdtempSync(join(tmpdir(), 'bod-detect-branch-'))
+  git('init', '-q', '-b', 'feature-x')
+  git('config', 'user.email', 't@t.t'); git('config', 'user.name', 't')
+  Bun.spawnSync(['touch', join(dir, 'f')])
+  git('add', '.'); git('commit', '-qm', 'c1')
+})
+
+afterAll(() => { process.chdir(origCwd); rmSync(dir, { recursive: true, force: true }) })
+
+const withEnv = async (env: Record<string, string | undefined>, fn: () => Promise<unknown>) => {
+  const saved: Record<string, string | undefined> = {}
+  for (const k of Object.keys(env)) { saved[k] = process.env[k]; if (env[k] === undefined) delete process.env[k]; else process.env[k] = env[k]! }
+  try { return await fn() } finally {
+    for (const k of Object.keys(saved)) { if (saved[k] === undefined) delete process.env[k]; else process.env[k] = saved[k]! }
+  }
+}
+const noCi = { GITHUB_HEAD_REF: undefined, GITHUB_REF_NAME: undefined }
+
+describe('detectBranch', () => {
+  test('an attached checkout reports its real branch', async () => {
+    process.chdir(dir)
+    expect(await withEnv(noCi, () => detectBranch())).toBe('feature-x')
+  })
+
+  test('an explicit branch always wins', async () => {
+    process.chdir(dir)
+    expect(await withEnv(noCi, () => detectBranch('release'))).toBe('release')
+  })
+
+  test('a DETACHED checkout refuses instead of deploying a branch named HEAD', async () => {
+    process.chdir(dir)
+    const sha = Bun.spawnSync(['git', 'rev-parse', 'HEAD'], { cwd: dir }).stdout.toString().trim()
+    git('checkout', '-q', sha)
+    // Prove the rig: git really does print the literal string here.
+    expect(Bun.spawnSync(['git', 'rev-parse', '--abbrev-ref', 'HEAD'], { cwd: dir }).stdout.toString().trim()).toBe('HEAD')
+
+    await expect(withEnv(noCi, () => detectBranch())).rejects.toThrow(/Detached HEAD/)
+  })
+
+  test('...but a GitHub Actions run resolves from its own env instead of failing', async () => {
+    process.chdir(dir) // still detached from the previous test
+    expect(await withEnv({ ...noCi, GITHUB_REF_NAME: 'main' }, () => detectBranch())).toBe('main')
+    // A pull_request run: head_ref is the source branch and wins over the merge ref.
+    expect(await withEnv({ GITHUB_HEAD_REF: 'feat/pr', GITHUB_REF_NAME: '123/merge' }, () => detectBranch())).toBe('feat/pr')
+  })
+
+  test('a CI variable that is itself HEAD is not accepted either', async () => {
+    process.chdir(dir)
+    await expect(withEnv({ ...noCi, GITHUB_REF_NAME: 'HEAD' }, () => detectBranch())).rejects.toThrow(/Detached HEAD/)
+  })
+})