create-windy 0.6.6 → 0.6.8

package/template/packages/delivery/src/pack.test.ts

@@ -0,0 +1,165 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { createDeterministicTar, listTarGzEntries } from "./archive.js";
+import { listArchiveFiles } from "./builder.js";
+import { sha256Bytes } from "./digest.js";
+import { readManifest } from "./manifest.js";
+import {
+  acquireDeliveryLock,
+  releaseDeliveryLock,
+  stageRelease,
+} from "./staging.js";
+
+const roots: string[] = [];
+
+afterEach(async () => {
+  await Promise.all(
+    roots.splice(0).map((root) => rm(root, { recursive: true, force: true })),
+  );
+});
+
+describe("release pack 实链", () => {
+  test("从完整 release 生成独立 V1 bundle、V2 OCI blob store 并重建完整 stage", async () => {
+    const root = await temporaryRoot();
+    const release = join(root, "release");
+    const oci = join(root, "oci");
+    const output = join(root, "output");
+    const imagesJson = join(root, "images.json");
+    await mkdir(join(release, "bin"), { recursive: true });
+    await mkdir(oci);
+    await writeFile(join(release, "compose.yml"), "services: {}\n");
+    await writeFile(join(release, "bin/delivery"), "#!/bin/sh\n", {
+      mode: 0o755,
+    });
+    const layerBytes = new TextEncoder().encode("oci-layer-content");
+    const layerDigest = sha256Bytes(layerBytes);
+    const layerPath = join(oci, "blobs/sha256", layerDigest.slice(7));
+    await mkdir(dirname(layerPath), { recursive: true });
+    await writeFile(layerPath, layerBytes);
+    const configBytes = new TextEncoder().encode('{"architecture":"amd64"}');
+    const configDigest = sha256Bytes(configBytes);
+    await writeFile(
+      join(oci, "blobs/sha256", configDigest.slice(7)),
+      configBytes,
+    );
+    const imageManifestBytes = new TextEncoder().encode(
+      '{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json"}',
+    );
+    const imageManifestDigest = sha256Bytes(imageManifestBytes);
+    await writeFile(
+      join(oci, "blobs/sha256", imageManifestDigest.slice(7)),
+      imageManifestBytes,
+    );
+    await writeFile(
+      join(oci, "oci-layout"),
+      '{"imageLayoutVersion":"1.0.0"}\n',
+    );
+    await writeFile(join(oci, "index.json"), '{"schemaVersion":2}\n');
+    const ociFiles = [
+      "oci-layout",
+      "index.json",
+      `blobs/sha256/${layerDigest.slice(7)}`,
+      `blobs/sha256/${configDigest.slice(7)}`,
+      `blobs/sha256/${imageManifestDigest.slice(7)}`,
+    ];
+    await createDeterministicTar(
+      join(release, "images.tar"),
+      ociFiles.map((path) => ({ source: join(oci, path), path })),
+    );
+    await writeFile(
+      imagesJson,
+      `${JSON.stringify([
+        {
+          role: "server",
+          platform: "linux/amd64",
+          configDigest,
+          registry: {
+            repository: "registry.example.com/windy/server",
+            digest: imageManifestDigest,
+            layers: [{ digest: layerDigest, size: layerBytes.byteLength }],
+          },
+        },
+      ])}\n`,
+    );
+    const child = Bun.spawn(
+      [
+        "bun",
+        "run",
+        join(import.meta.dir, "cli.ts"),
+        "pack",
+        "--release-dir",
+        release,
+        "--output-dir",
+        output,
+        "--product",
+        "windy",
+        "--release-id",
+        "release-1",
+        "--git-sha",
+        "a".repeat(40),
+        "--platform",
+        "linux/amd64",
+        "--created-at",
+        "2026-08-08T00:00:00.000Z",
+        "--images-json",
+        imagesJson,
+      ],
+      { stdout: "pipe", stderr: "pipe" },
+    );
+    const [exitCode, stdout, stderr] = await Promise.all([
+      child.exited,
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+    ]);
+    expect(exitCode, stderr).toBe(0);
+    const result = JSON.parse(stdout) as { manifestDigest: `sha256:${string}` };
+    const manifest = await readManifest(
+      join(output, "delivery-manifest.v2.json"),
+      result.manifestDigest,
+    );
+    expect(
+      (await readFile(join(output, "DELIVERY-MANIFEST.sha256"), "utf8")).trim(),
+    ).toBe(result.manifestDigest);
+    expect(manifest.releaseFiles.map(({ path }) => path)).toEqual([
+      "bin/delivery",
+      "CHECKSUMS.sha256",
+      "compose.yml",
+    ]);
+    expect(await listTarGzEntries(join(output, "full-bundle.tar.gz"))).toEqual([
+      "CHECKSUMS.sha256",
+      "bin/delivery",
+      "compose.yml",
+      "images.tar",
+    ]);
+    const install = join(root, "install");
+    await mkdir(install);
+    const lock = await acquireDeliveryLock(install);
+    const staged = await stageRelease({
+      installRoot: install,
+      storeRoot: output,
+      manifest,
+      expectedManifestDigest: result.manifestDigest,
+      lock,
+      reserveBytes: 0,
+    });
+    expect(await readFile(join(staged, "compose.yml"), "utf8")).toBe(
+      "services: {}\n",
+    );
+    expect(await Bun.file(join(staged, "images.tar")).exists()).toBeTrue();
+    expect(await listArchiveFiles(staged)).toEqual([
+      "CHECKSUMS.sha256",
+      "bin/delivery",
+      "compose.yml",
+      "images.tar",
+    ]);
+    await releaseDeliveryLock(lock);
+  });
+});
+
+async function temporaryRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "windy-pack-test-"));
+  roots.push(root);
+  return root;
+}

package/template/packages/delivery/src/paths.ts

@@ -0,0 +1,27 @@
+import { isAbsolute, posix } from "node:path";
+
+export function assertRelativePortablePath(value: string): string {
+  if (
+    !value ||
+    value.includes("\\") ||
+    isAbsolute(value) ||
+    value.startsWith("/") ||
+    value.split("/").some((part) => !part || part === "." || part === "..") ||
+    value
+      .split("/")
+      .some(
+        (part) =>
+          part.startsWith("._") || part === ".DS_Store" || part === "__MACOSX",
+      )
+  ) {
+    throw new Error(`不安全或不可移植的相对路径：${value}`);
+  }
+  return posix.normalize(value);
+}
+
+export function assertSafeName(value: string, label: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value)) {
+    throw new Error(`${label} 格式无效`);
+  }
+  return value;
+}

package/template/packages/delivery/src/process-command.ts

@@ -0,0 +1,49 @@
+import { redactSensitiveText } from "./redact.js";
+
+export interface ProcessCommandResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+export async function runProcessCommand(
+  command: readonly string[],
+  options: {
+    allowFailure?: boolean;
+    stdin?: string;
+    errorLabel: string;
+  },
+): Promise<ProcessCommandResult> {
+  const child = Bun.spawn([...command], {
+    stdin: options.stdin === undefined ? "ignore" : "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const feed =
+    options.stdin === undefined
+      ? Promise.resolve()
+      : feedStdin(child, options.stdin);
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    feed,
+  ]);
+  if (exitCode !== 0 && !options.allowFailure) {
+    throw new Error(
+      `${options.errorLabel} (${exitCode})：${redactSensitiveText(stderr)}`,
+    );
+  }
+  return { exitCode, stdout, stderr };
+}
+
+async function feedStdin(
+  process: ReturnType<typeof Bun.spawn>,
+  input: string,
+): Promise<void> {
+  if (process.stdin === undefined || typeof process.stdin === "number") {
+    throw new Error("SSH 子进程 stdin 不可写");
+  }
+  process.stdin.write(input);
+  await process.stdin.end();
+}

package/template/packages/delivery/src/redact.ts

@@ -0,0 +1,14 @@
+export function redactSensitiveText(value: string): string {
+  return value
+    .replace(/(authorization\s*:\s*(?:bearer|basic)\s+)\S+/gi, "$1<redacted>")
+    .replace(
+      /((?:token|password|secret|key|signature|sig|x-amz-signature)=)[^&\s]+/gi,
+      "$1<redacted>",
+    )
+    .replace(/(https?:\/\/)[^/@\s]+@/gi, "$1<redacted>@")
+    .replace(
+      /("(?:auth|identitytoken|registrytoken)"\s*:\s*")[^"]+/gi,
+      "$1<redacted>",
+    )
+    .slice(0, 2000);
+}

package/template/packages/delivery/src/registry.test.ts

@@ -0,0 +1,166 @@
+import { describe, expect, test } from "bun:test";
+import { sha256Bytes } from "./digest.js";
+import {
+  pullRegistryRelease,
+  type RegistryCommandResult,
+  type RegistryCommandRunner,
+} from "./registry.js";
+import type {
+  ContentBlob,
+  DeliveryManifestV2,
+  ReleaseImageV2,
+  Sha256Digest,
+} from "./types.js";
+
+describe("OCI Registry digest 拉取", () => {
+  test("首次拉取统计全部 layer 实际下载", async () => {
+    const base = layer("base", 100);
+    const app = layer("app", 200);
+    const image = registryImage("server", "server-config", [base, app]);
+    const runner = scriptedRunner([
+      missing(),
+      pull([downloaded(base), downloaded(app)]),
+      inspect(image.configDigest),
+    ]);
+    expect(await pullRegistryRelease(manifest([image]), runner)).toEqual({
+      totalBytes: 300,
+      reusedBytes: 0,
+      uploadedBytes: null,
+      descriptorPulledBytes: 300,
+      totalBlobs: 2,
+      reusedBlobs: 0,
+      uploadedBlobs: null,
+      descriptorPulledBlobs: 2,
+      measurement: "docker-layer-status",
+    });
+  });
+
+  test("Server 已存在且 Web 变化时只统计 Web 新 layer", async () => {
+    const base = layer("base", 100);
+    const serverLayer = layer("server", 200);
+    const webLayer = layer("web-v2", 50);
+    const server = registryImage("server", "server-config", [
+      base,
+      serverLayer,
+    ]);
+    const web = registryImage("web", "web-config", [base, webLayer]);
+    const runner = scriptedRunner([
+      inspect(server.configDigest),
+      missing(),
+      pull([reused(base), downloaded(webLayer)]),
+      inspect(web.configDigest),
+    ]);
+    expect(await pullRegistryRelease(manifest([server, web]), runner)).toEqual({
+      totalBytes: 350,
+      reusedBytes: 300,
+      uploadedBytes: null,
+      descriptorPulledBytes: 50,
+      totalBlobs: 3,
+      reusedBlobs: 2,
+      uploadedBlobs: null,
+      descriptorPulledBlobs: 1,
+      measurement: "docker-layer-status",
+    });
+  });
+
+  test("pull 后 config digest 不一致时 fail closed", async () => {
+    const app = layer("app", 200);
+    const image = registryImage("server", "expected", [app]);
+    const runner = scriptedRunner([
+      missing(),
+      pull([downloaded(app)]),
+      inspect(sha256Bytes("tampered")),
+    ]);
+    await expect(
+      pullRegistryRelease(manifest([image]), runner),
+    ).rejects.toThrow("config digest 不匹配");
+  });
+});
+
+function registryImage(
+  role: string,
+  configSeed: string,
+  layers: ContentBlob[],
+): ReleaseImageV2 {
+  return {
+    role,
+    platform: "linux/amd64",
+    configDigest: sha256Bytes(configSeed),
+    registry: {
+      repository: `registry.example.com/windy/${role}`,
+      digest: sha256Bytes(`${role}-manifest`),
+      layers,
+    },
+  };
+}
+
+function manifest(images: ReleaseImageV2[]): DeliveryManifestV2 {
+  const content = new Map<Sha256Digest, ContentBlob>();
+  for (const image of images) {
+    content.set(image.configDigest, { digest: image.configDigest, size: 1 });
+    if (!image.registry) continue;
+    content.set(image.registry.digest, {
+      digest: image.registry.digest,
+      size: 1,
+    });
+    for (const item of image.registry.layers) content.set(item.digest, item);
+  }
+  const archiveBlobs = [...content.values()];
+  return {
+    schemaVersion: 2,
+    minimumReaderVersion: 2,
+    product: "windy",
+    releaseId: "release-1",
+    gitSha: "a".repeat(40),
+    platform: "linux/amd64",
+    createdAt: "2026-08-08T00:00:00.000Z",
+    images,
+    dockerArchive: {
+      format: "oci-image-layout-v1",
+      entries: archiveBlobs.map((blob) => ({
+        path: `blobs/sha256/${blob.digest.slice(7)}`,
+        ...blob,
+        mode: 0o644,
+      })),
+    },
+    releaseFiles: [],
+    blobs: archiveBlobs,
+    compatibility: {},
+  };
+}
+
+function layer(seed: string, size: number): ContentBlob {
+  return { digest: sha256Bytes(seed), size };
+}
+
+function inspect(digest: Sha256Digest): RegistryCommandResult {
+  return { exitCode: 0, stdout: `${digest}\n`, stderr: "" };
+}
+
+function missing(): RegistryCommandResult {
+  return { exitCode: 1, stdout: "", stderr: "No such image" };
+}
+
+function pull(lines: string[]): RegistryCommandResult {
+  return { exitCode: 0, stdout: lines.join("\n"), stderr: "" };
+}
+
+function downloaded(blob: ContentBlob): string {
+  return `${blob.digest.slice(7, 19)}: Pull complete`;
+}
+
+function reused(blob: ContentBlob): string {
+  return `${blob.digest.slice(7, 19)}: Already exists`;
+}
+
+function scriptedRunner(
+  results: RegistryCommandResult[],
+): RegistryCommandRunner {
+  let index = 0;
+  return async () => {
+    const result = results[index];
+    index += 1;
+    if (!result) throw new Error("unexpected registry command");
+    return result;
+  };
+}

package/template/packages/delivery/src/registry.ts

@@ -0,0 +1,148 @@
+import { planBlobTransfer } from "./transfer.js";
+import { validateManifest } from "./manifest.js";
+import { redactSensitiveText } from "./redact.js";
+import type {
+  ContentBlob,
+  DeliveryManifestV2,
+  RegistryTransferStatistics,
+  Sha256Digest,
+} from "./types.js";
+
+export interface RegistryCommandResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+export type RegistryCommandRunner = (
+  command: readonly string[],
+) => Promise<RegistryCommandResult>;
+
+export async function pullRegistryRelease(
+  manifest: DeliveryManifestV2,
+  runner: RegistryCommandRunner = runCommand,
+): Promise<RegistryTransferStatistics> {
+  const validated = validateManifest(manifest);
+  const layers = uniqueLayers(validated);
+  const present = new Set<Sha256Digest>();
+  const downloaded = new Set<Sha256Digest>();
+  for (const image of validated.images) {
+    if (!image.registry)
+      throw new Error(`镜像缺少 registry digest：${image.role}`);
+    const reference = `${image.registry.repository}@${image.registry.digest}`;
+    const before = await inspectImage(reference, runner);
+    if (before !== undefined) {
+      assertConfigDigest(image.role, before, image.configDigest);
+      for (const layer of image.registry.layers) {
+        if (!downloaded.has(layer.digest)) present.add(layer.digest);
+      }
+      continue;
+    }
+    const pull = await runner(["docker", "pull", reference]);
+    if (pull.exitCode !== 0) {
+      throw new Error(
+        `registry pull 失败：${image.role} ${redactSensitiveText(pull.stderr)}`,
+      );
+    }
+    classifyLayers(
+      image.registry.layers,
+      `${pull.stdout}\n${pull.stderr}`,
+      present,
+      downloaded,
+    );
+    const after = await inspectImage(reference, runner);
+    if (after === undefined)
+      throw new Error(`pull 后镜像不存在：${image.role}`);
+    assertConfigDigest(image.role, after, image.configDigest);
+  }
+  const descriptors = planBlobTransfer(layers, present).statistics;
+  return {
+    totalBytes: descriptors.totalBytes,
+    reusedBytes: descriptors.reusedBytes,
+    uploadedBytes: null,
+    descriptorPulledBytes: descriptors.uploadedBytes,
+    totalBlobs: descriptors.totalBlobs,
+    reusedBlobs: descriptors.reusedBlobs,
+    uploadedBlobs: null,
+    descriptorPulledBlobs: descriptors.uploadedBlobs,
+    measurement: "docker-layer-status",
+  };
+}
+
+function uniqueLayers(manifest: DeliveryManifestV2): ContentBlob[] {
+  const layers = new Map<Sha256Digest, ContentBlob>();
+  for (const image of manifest.images) {
+    for (const layer of image.registry?.layers ?? []) {
+      const current = layers.get(layer.digest);
+      if (current && current.size !== layer.size) {
+        throw new Error(`registry layer 尺寸漂移：${layer.digest}`);
+      }
+      layers.set(layer.digest, layer);
+    }
+  }
+  return [...layers.values()];
+}
+
+function classifyLayers(
+  layers: readonly ContentBlob[],
+  output: string,
+  present: Set<Sha256Digest>,
+  downloaded: Set<Sha256Digest>,
+): void {
+  for (const layer of layers) {
+    if (present.has(layer.digest) || downloaded.has(layer.digest)) continue;
+    const prefix = layer.digest.slice("sha256:".length, "sha256:".length + 12);
+    const lines = output
+      .split(/\r?\n/)
+      .filter((line) => line.startsWith(`${prefix}:`));
+    if (lines.some((line) => /Already exists/i.test(line))) {
+      present.add(layer.digest);
+    } else if (lines.some((line) => /Pull complete/i.test(line))) {
+      downloaded.add(layer.digest);
+    } else {
+      throw new Error(`registry 未返回 layer 传输状态：${layer.digest}`);
+    }
+  }
+}
+
+async function inspectImage(
+  reference: string,
+  runner: RegistryCommandRunner,
+): Promise<Sha256Digest | undefined> {
+  const result = await runner([
+    "docker",
+    "image",
+    "inspect",
+    "--format",
+    "{{.Id}}",
+    reference,
+  ]);
+  if (result.exitCode !== 0) return undefined;
+  const digest = result.stdout.trim();
+  if (!/^sha256:[a-f0-9]{64}$/.test(digest)) {
+    throw new Error("docker inspect 返回无效 config digest");
+  }
+  return digest as Sha256Digest;
+}
+
+function assertConfigDigest(
+  role: string,
+  actual: Sha256Digest,
+  expected: Sha256Digest,
+): void {
+  if (actual !== expected) {
+    throw new Error(`镜像 config digest 不匹配：${role}`);
+  }
+}
+
+async function runCommand(
+  command: readonly string[],
+): Promise<RegistryCommandResult> {
+  const child = Bun.spawn([...command], { stdout: "pipe", stderr: "pipe" });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+  ]);
+  return { exitCode, stdout, stderr };
+}

package/template/packages/delivery/src/security.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from "bun:test";
+import { redactSensitiveText } from "./redact.js";
+import {
+  isExplicitLegacyCapabilityResponse,
+  parseCapabilities,
+} from "./ssh-capabilities.js";
+
+describe("交付协议安全边界", () => {
+  test("脱敏 header、URL userinfo、签名 query 和 Docker auth JSON", () => {
+    const output = redactSensitiveText(
+      'Authorization: Bearer abc https://user:pass@example.test/a?X-Amz-Signature=deadbeef&token=xyz {"auth":"base64-secret"}',
+    );
+    expect(output).not.toContain("abc");
+    expect(output).not.toContain("user:pass");
+    expect(output).not.toContain("deadbeef");
+    expect(output).not.toContain("xyz");
+    expect(output).not.toContain("base64-secret");
+    expect(output.match(/<redacted>/g)?.length).toBe(5);
+  });
+
+  test("只有明确旧端响应可降级，鉴权和畸形 JSON fail closed", () => {
+    expect(
+      isExplicitLegacyCapabilityResponse({
+        exitCode: 127,
+        stdout: "",
+        stderr: "windy-delivery: command not found",
+      }),
+    ).toBeTrue();
+    expect(
+      isExplicitLegacyCapabilityResponse({
+        exitCode: 255,
+        stdout: "",
+        stderr: "Permission denied (publickey)",
+      }),
+    ).toBeFalse();
+    expect(() => parseCapabilities("not-json")).toThrow("不是合法 JSON");
+    expect(() =>
+      parseCapabilities('{"schemaVersions":[2],"blobDelta":true}'),
+    ).toThrow("字段无效");
+  });
+});

package/template/packages/delivery/src/ssh-capabilities.ts

@@ -0,0 +1,65 @@
+import type { DeliveryCapabilities } from "./types.js";
+
+export function parseCapabilities(value: string): DeliveryCapabilities {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("SSH capability 响应不是合法 JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("SSH capability 响应格式无效");
+  }
+  const record = parsed as Record<string, unknown>;
+  if (
+    !Array.isArray(record.schemaVersions) ||
+    !record.schemaVersions.every((item) => Number.isSafeInteger(item)) ||
+    typeof record.registryByDigest !== "boolean" ||
+    typeof record.blobDelta !== "boolean" ||
+    typeof record.resumableBlobTransfer !== "boolean"
+  ) {
+    throw new Error("SSH capability 响应字段无效");
+  }
+  return {
+    schemaVersions: record.schemaVersions as number[],
+    registryByDigest: record.registryByDigest,
+    blobDelta: record.blobDelta,
+    resumableBlobTransfer: record.resumableBlobTransfer,
+  };
+}
+
+export function isExplicitLegacyCapabilityResponse(result: {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}): boolean {
+  const text = `${result.stdout}\n${result.stderr}`;
+  return (
+    result.exitCode === 127 ||
+    /unknown command|unsupported command|不支持[^\n]*capabilities/i.test(
+      text,
+    ) ||
+    (/用法：windy-delivery/.test(text) && !text.includes("capabilities"))
+  );
+}
+
+export function safeSshTarget(value: string): string {
+  if (!/^[A-Za-z0-9._-]+@[A-Za-z0-9._:-]+$/.test(value)) {
+    throw new Error("SSH target 格式无效");
+  }
+  return value;
+}
+
+export function safeRemotePath(value: string, label: string): string {
+  if (
+    !/^\/?[A-Za-z0-9._/-]+$/.test(value) ||
+    value.split("/").some((part) => part === "..")
+  ) {
+    throw new Error(`${label} 路径无效`);
+  }
+  return value;
+}
+
+export function assertOwnerToken(value: string): void {
+  if (!/^[a-f0-9]{48}$/.test(value)) throw new Error("ownerToken 无效");
+}