cyberia 3.1.3 → 3.2.5

package/src/server/backup.js

@@ -6,7 +6,6 @@
 
 import fs from 'fs-extra';
 import { loggerFactory } from './logger.js';
-import { shellExec } from './process.js';
 import Underpost from '../index.js';
 import { loadCronDeployEnv } from './conf.js';
 
@@ -21,16 +20,24 @@ class BackUp {
   /**
    * @method callback
    * @description Initiates a backup operation for the specified deployment list.
-   * @param {string} deployList - The list of deployments to backup.
+   * Orchestrates two backup phases per deployment:
+   *   1. Database export (MariaDB / MongoDB dump via `node bin db --export`).
+   *   2. Repository backup (git commit+push inside the deployment pod via `node bin db --repo-backup`).
+   *
+   * Commands are always forwarded to the host node via SSH because the CronJob
+   * container itself has no kubectl access. GITHUB_TOKEN and GITHUB_USERNAME
+   * are passed as ephemeral inline env vars so they never touch the host filesystem.
+   *
+   * @param {string} deployList - Comma-separated list of deployment IDs.
    * @param {Object} options - The options for the backup operation.
    * @param {boolean} options.git - Whether to backup data using Git.
    * @param {boolean} [options.k3s] - Use k3s cluster context.
    * @param {boolean} [options.kind] - Use kind cluster context.
    * @param {boolean} [options.kubeadm] - Use kubeadm cluster context.
-   * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node.
    * @memberof UnderpostBakcUp
    */
   static callback = async function (deployList, options = { git: false }) {
+    const firstDeployId = deployList && deployList !== 'dd' ? deployList.split(',')[0].trim() : '';
     loadCronDeployEnv();
     if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
       deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();
@@ -43,19 +50,40 @@ class BackUp {
     for (const _deployId of deployList.split(',')) {
       const deployId = _deployId.trim();
       if (!deployId) continue;
+      const dbCommand = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod --preserveUUID${clusterFlag} ${deployId}`;
+      const repoCommand = `node bin db --repo-backup${clusterFlag} ${deployId}`;
 
-      const command = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod${clusterFlag} ${deployId}`;
+      // Pass GITHUB_TOKEN and GITHUB_USERNAME ephemerally through the SSH command
+      // so git operations can push backups without relying on host env files.
+      const envPrefix = [
+        process.env.GITHUB_TOKEN ? `GITHUB_TOKEN=${process.env.GITHUB_TOKEN}` : '',
+        process.env.GITHUB_USERNAME ? `GITHUB_USERNAME=${process.env.GITHUB_USERNAME}` : '',
+      ]
+        .filter(Boolean)
+        .join(' ');
+      const prefixCmd = (cmd) => (envPrefix ? `${envPrefix} ${cmd}` : cmd);
 
-      if (options.ssh) {
+      try {
         logger.info('Executing database export via SSH for', deployId);
-        await Underpost.ssh.sshRemoteRunner(command, {
+        await Underpost.ssh.sshRemoteRunner(prefixCmd(dbCommand), {
           remote: true,
           useSudo: true,
           cd: '/home/dd/engine',
         });
-      } else {
-        logger.info('Executing database export for', deployId);
-        shellExec(command);
+      } catch (err) {
+        logger.error(`Error during database export for ${deployId}:`, err);
+      }
+
+      // Repository backup: Cron container → SSH to host → host finds pod → kubectl exec git backup
+      try {
+        logger.info('Executing repository backup via SSH for', deployId);
+        await Underpost.ssh.sshRemoteRunner(prefixCmd(repoCommand), {
+          remote: true,
+          useSudo: true,
+          cd: '/home/dd/engine',
+        });
+      } catch (err) {
+        logger.error(`Error during repository backup for ${deployId}:`, err);
       }
     }
   };

package/src/server/client-build-docs.js

@@ -394,6 +394,7 @@ const buildCoverage = async ({ host, path, docs }) => {
   const jsDocSourcePath = docs.jsJsonPath;
   const jsDocsConfig = JSON.parse(fs.readFileSync(jsDocSourcePath, 'utf8'));
   const coveragePath = docs.coveragePath;
+  const coverageOutputDir = docs.coverageOutputDir || 'coverage';
 
   const coverageOutputPath = `${coveragePath}/coverage`;
   if (!fs.existsSync(coverageOutputPath)) {
@@ -411,9 +412,15 @@ const buildCoverage = async ({ host, path, docs }) => {
   }
 
   if (fs.existsSync(coverageOutputPath) && fs.readdirSync(coverageOutputPath).length > 0) {
-    const coverageBuildPath = `${jsDocsConfig.opts.destination}coverage`;
+    const coverageBuildPath = `${jsDocsConfig.opts.destination}${coverageOutputDir}`;
     fs.mkdirSync(coverageBuildPath, { recursive: true });
-    fs.copySync(coverageOutputPath, coverageBuildPath);
+    // Hardhat 3 outputs HTML to coverage/html/; Hardhat 2 / c8 output directly to coverage/
+    const coverageHtmlSubdir = `${coverageOutputPath}/html`;
+    if (fs.existsSync(coverageHtmlSubdir) && fs.existsSync(`${coverageHtmlSubdir}/index.html`)) {
+      fs.copySync(coverageHtmlSubdir, coverageBuildPath);
+    } else {
+      fs.copySync(coverageOutputPath, coverageBuildPath);
+    }
     logger.warn('build coverage', coverageBuildPath);
   } else {
     logger.warn('no coverage output found, skipping', coverageOutputPath);

package/src/server/client-build.js

@@ -7,7 +7,7 @@
 'use strict';
 
 import fs from 'fs-extra';
-import { srcFormatted, componentFormatted, viewFormatted, JSONweb } from './client-formatted.js';
+import { transformClientJs, JSONweb } from './client-formatted.js';
 import { loggerFactory } from './logger.js';
 import {
   getCapVariableName,
@@ -16,7 +16,6 @@ import {
   uniqueArray,
 } from '../client/components/core/CommonJs.js';
 import { readConfJson } from './conf.js';
-import UglifyJS from 'uglify-js';
 import { minify } from 'html-minifier-terser';
 import AdmZip from 'adm-zip';
 import * as dir from 'path';
@@ -317,7 +316,8 @@ const buildClient = async (
         shellExec(`cd /home/dd && git clone https://github.com/designmodo/html-website-templates.git`);
       if (!fs.existsSync(`${rootClientPath}/index.php`)) {
         fs.copySync(`/home/dd/html-website-templates/${publicClientId.split('-publicClientId-')[1]}`, rootClientPath);
-        shellExec(`cd ${rootClientPath} && git init && git add . && git commit -m "Base template implementation"`);
+        Underpost.repo.initLocalRepo({ path: rootClientPath });
+        shellExec(`cd ${rootClientPath} && git add . && git commit -m "Base template implementation"`);
         // git remote add origin git@github.com:<username>/<repo>.git
         fs.writeFileSync(`${rootClientPath}/.git/.htaccess`, `Deny from all`, 'utf8');
       }
@@ -447,15 +447,15 @@ const buildClient = async (
 
             if (enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath)) continue;
 
-            const jsSrc = componentFormatted(
-              await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')),
-              module,
+            const jsSrc = await transformClientJs(jsSrcPath, {
               dists,
-              path,
-              'components',
+              proxyPath: path,
+              basePath: 'components',
+              module,
               baseHost,
-            );
-            fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+              minify: minifyBuild,
+            });
+            fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
           }
         }
 
@@ -469,15 +469,15 @@ const buildClient = async (
             const jsPublicPath = `${rootClientPath}/services/${module}/${module}.service.js`;
             if (enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath)) continue;
 
-            let jsSrc = componentFormatted(
-              await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')),
-              module,
+            const jsSrc = await transformClientJs(jsSrcPath, {
               dists,
-              path,
-              'services',
+              proxyPath: path,
+              basePath: 'services',
+              module,
               baseHost,
-            );
-            fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+              minify: minifyBuild,
+            });
+            fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
           }
         }
 
@@ -487,15 +487,15 @@ const buildClient = async (
             const jsPublicPath = `${rootClientPath}/services/${module}/${module}.management.js`;
             if (enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath)) continue;
 
-            const jsSrc = componentFormatted(
-              await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')),
-              module,
+            const jsSrc = await transformClientJs(jsSrcPath, {
               dists,
-              path,
-              'services',
+              proxyPath: path,
+              basePath: 'services',
+              module,
               baseHost,
-            );
-            fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+              minify: minifyBuild,
+            });
+            fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
           }
         }
       }
@@ -513,9 +513,9 @@ const buildClient = async (
         const jsPublicPath = `${rootClientPath}/sw.js`;
 
         if (!(enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath))) {
-          const jsSrc = viewFormatted(await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')), dists, path, baseHost);
+          const jsSrc = await transformClientJs(jsSrcPath, { dists, proxyPath: path, baseHost, minify: minifyBuild });
 
-          fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+          fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
         }
 
         if (
@@ -535,14 +535,14 @@ const buildClient = async (
 
             logger.info('View build', buildPath);
 
-            const jsSrc = viewFormatted(
-              await srcFormatted(fs.readFileSync(`./src/client/${view.client}.index.js`, 'utf8')),
+            const jsSrc = await transformClientJs(`./src/client/${view.client}.index.js`, {
               dists,
-              path,
+              proxyPath: path,
               baseHost,
-            );
+              minify: minifyBuild,
+            });
 
-            fs.writeFileSync(`${buildPath}${buildId}.js`, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+            fs.writeFileSync(`${buildPath}${buildId}.js`, jsSrc, 'utf8');
             const title = metadata.title ? metadata.title : title;
 
             const canonicalURL = `https://${host}${path}${

package/src/server/client-formatted.js

@@ -1,87 +1,139 @@
 /**
- * Module for formatting client-side code
+ * Module for formatting client-side code using esbuild for import rewriting and minification.
  * @module src/server/client-formatted.js
  * @namespace clientFormatted
  */
 
 'use strict';
 
+import * as esbuild from 'esbuild';
+import fs from 'fs-extra';
+import * as path from 'path';
+
+/**
+ * Escapes a string for safe use inside a RegExp.
+ * @param {string} s - The string to escape.
+ * @returns {string} The escaped string.
+ * @memberof clientFormatted
+ */
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
 /**
- * Formats a source code string by removing 'html`' and 'css`' tags from template literals.
+ * Formats a source code string by removing 'html`' and 'css`' tagged template prefixes.
+ * Used for SSR VM execution where the full esbuild pipeline is not needed.
  * @param {string} src - The source code string.
  * @returns {string} The formatted source code.
  * @memberof clientFormatted
  */
-const srcFormatted = (src) =>
-  src
-    .replaceAll(' html`', '`')
-    .replaceAll(' css`', '`')
-    .replaceAll('{html`', '{`')
-    .replaceAll('{css`', '{`')
-    .replaceAll('(html`', '(`')
-    .replaceAll('(css`', '(`')
-    .replaceAll('[html`', '[`')
-    .replaceAll('[css`', '[`');
+const srcFormatted = (src) => src.replace(/(?<=[\s({[,;=+!?:^])(html|css)`/g, '`');
 
 /**
  * Converts a JavaScript object into a string that can be embedded in client-side code
  * and parsed back into an object (e.g., 'JSON.parse(`{...}`)').
+ * Escapes backticks and template expression markers for safe template literal embedding.
  * @param {*} data - The data to be stringified.
  * @returns {string} A string representing the code to parse the JSON data.
  * @memberof clientFormatted
  */
-const JSONweb = (data) => 'JSON.parse(`' + JSON.stringify(data) + '`)';
+const JSONweb = (data) => {
+  const json = JSON.stringify(data).replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+  return 'JSON.parse(`' + json + '`)';
+};
 
 /**
- * Formats a component's source code by rewriting its import paths to be absolute for browser consumption.
- * @param {string} src - The source code of the component.
- * @param {string} module - The name of the module/component.
- * @param {Array<object>} dists - An array of distribution objects with import names.
- * @param {string} proxyPath - The proxy path for the application.
- * @param {string} [componentBasePath=''] - The base path for components.
- * @param {string} [baseHost=''] - The base host URL.
- * @returns {string} The formatted source code with updated import paths.
+ * Creates an esbuild plugin that rewrites import paths for browser consumption.
+ * Handles dist library imports, relative imports, and marks all remaining imports as external.
+ * @param {object} options
+ * @param {Array<object>} [options.dists=[]] - Distribution objects with import_name and import_name_build.
+ * @param {string} options.proxyPath - The proxy path for the application.
+ * @param {string} [options.basePath=''] - The base path for the module type (e.g., 'components', 'services').
+ * @param {string} [options.module=''] - The module/component name for relative import resolution.
+ * @param {string} [options.baseHost=''] - The base host URL.
+ * @returns {import('esbuild').Plugin}
  * @memberof clientFormatted
  */
-const componentFormatted = (src, module, dists, proxyPath, componentBasePath = '', baseHost = '') => {
-  dists.map(
-    (dist) =>
-      (src = src.replaceAll(
-        `from '${dist.import_name}'`,
-        `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}` : ''}${dist.import_name_build}'`,
-      )),
-  );
-  return src
-    .replaceAll(
-      `from '../`,
-      `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}${
-        componentBasePath === '' ? `` : `${componentBasePath}/`
-      }`,
-    )
-    .replaceAll(
-      `from './`,
-      `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}${
-        componentBasePath === '' ? `` : `${componentBasePath}/`
-      }${module}/`,
-    );
-};
+const importRewritePlugin = ({ dists = [], proxyPath, basePath = '', module = '', baseHost = '' }) => ({
+  name: 'import-rewrite',
+  setup(build) {
+    const prefix = `${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}`;
+
+    // Rewrite dist library imports (e.g., '@neodrag/vanilla' → '/proxyPath/dist/@neodrag-vanilla/index.js')
+    if (dists) {
+      for (const dist of dists) {
+        if (!dist.import_name) continue;
+        const filter = new RegExp(`^${escapeRegExp(dist.import_name)}$`);
+        build.onResolve({ filter }, () => ({
+          path: `${baseHost}${proxyPath !== '/' ? proxyPath : ''}${dist.import_name_build}`,
+          external: true,
+        }));
+      }
+    }
+
+    // Rewrite relative imports to absolute paths based on proxy path and module
+    build.onResolve({ filter: /^\.\.?\// }, (args) => {
+      const basePrefix = `${prefix}${basePath ? `${basePath}/` : ''}`;
+      if (args.path.startsWith('./')) {
+        return {
+          path: `${basePrefix}${module ? `${module}/` : ''}${args.path.slice(2)}`,
+          external: true,
+        };
+      }
+      if (args.path.startsWith('../')) {
+        return {
+          path: `${basePrefix}${args.path.slice(3)}`,
+          external: true,
+        };
+      }
+    });
+
+    // Mark any remaining imports as external
+    build.onResolve({ filter: /.*/ }, (args) => {
+      if (args.kind === 'entry-point') return;
+      return { path: args.path, external: true };
+    });
+  },
+});
 
 /**
- * Formats a view's source code by rewriting its import paths.
- * @param {string} src - The source code of the view.
- * @param {Array<object>} dists - An array of distribution objects with import names.
- * @param {string} proxyPath - The proxy path for the application.
- * @param {string} [baseHost=''] - The base host URL.
- * @returns {string} The formatted source code with updated import paths.
+ * Transforms a JavaScript source file using esbuild with import path rewriting,
+ * tagged template stripping, and optional minification.
+ * Replaces the previous srcFormatted + componentFormatted/viewFormatted + UglifyJS pipeline.
+ * @param {string} srcPath - Path to the source file.
+ * @param {object} options
+ * @param {Array<object>} [options.dists=[]] - Distribution objects with import names.
+ * @param {string} options.proxyPath - The proxy path for the application.
+ * @param {string} [options.basePath=''] - Base path for the module type (e.g., 'components', 'services').
+ * @param {string} [options.module=''] - Module name for relative import resolution.
+ * @param {string} [options.baseHost=''] - Base host URL.
+ * @param {boolean} [options.minify=false] - Whether to minify the output.
+ * @returns {Promise<string>} The transformed source code.
  * @memberof clientFormatted
  */
-const viewFormatted = (src, dists, proxyPath, baseHost = '') => {
-  dists.map(
-    (dist) =>
-      (src = src.replaceAll(dist.import_name, `${proxyPath !== '/' ? `${proxyPath}` : ''}${dist.import_name_build}`)),
-  );
-  const componentFromFormatted = `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}`;
-  return src.replaceAll(`from './`, componentFromFormatted).replaceAll(`from '../`, componentFromFormatted);
+const transformClientJs = async (
+  srcPath,
+  { dists = [], proxyPath, basePath = '', module = '', baseHost = '', minify: shouldMinify = false } = {},
+) => {
+  const src = fs.readFileSync(srcPath, 'utf8');
+  const stripped = srcFormatted(src);
+
+  const result = await esbuild.build({
+    stdin: {
+      contents: stripped,
+      loader: 'js',
+      resolveDir: path.dirname(path.resolve(srcPath)),
+      sourcefile: srcPath,
+    },
+    bundle: true,
+    write: false,
+    format: 'esm',
+    platform: 'browser',
+    target: 'esnext',
+    minify: shouldMinify,
+    logLevel: 'warning',
+    plugins: [importRewritePlugin({ dists, proxyPath, basePath, module, baseHost })],
+  });
+
+  return result.outputFiles[0].text;
 };
 
-export { srcFormatted, JSONweb, componentFormatted, viewFormatted };
+export { srcFormatted, JSONweb, transformClientJs };

package/src/server/conf.js

@@ -148,6 +148,23 @@ const getConfFolder = (deployId) => {
     : `./engine-private/conf/${deployId}`;
 };
 
+/**
+ * Reads `engine-private/deploy/dd.cron` and returns the deploy-id string,
+ * or `null` if the file does not exist or is empty.
+ *
+ * @method cronDeployIdResolve
+ * @returns {string|null} The deploy-id from dd.cron, or null.
+ * @memberof ServerConfBuilder
+ */
+const cronDeployIdResolve = () => {
+  const cronDeployFile = './engine-private/deploy/dd.cron';
+  if (fs.existsSync(cronDeployFile)) {
+    const id = fs.readFileSync(cronDeployFile, 'utf8').trim();
+    return id || null;
+  }
+  return null;
+};
+
 /**
  * Loads the deployment-specific `.env` file referenced by `engine-private/deploy/dd.cron`
  * into `process.env`. Uses `NODE_ENV` to select the environment variant
@@ -162,15 +179,12 @@ function loadCronDeployEnv() {
   const envName = process.env.NODE_ENV || 'production';
 
   // 1) Load dd.cron env (takes full precedence)
-  const cronDeployFile = './engine-private/deploy/dd.cron';
-  if (fs.existsSync(cronDeployFile)) {
-    const cronDeployId = fs.readFileSync(cronDeployFile, 'utf8').trim();
-    if (cronDeployId) {
-      const cronEnvPath = `./engine-private/conf/${cronDeployId}/.env.${envName}`;
-      if (fs.existsSync(cronEnvPath)) {
-        const cronEnv = dotenv.parse(fs.readFileSync(cronEnvPath, 'utf8'));
-        process.env = { ...process.env, ...cronEnv };
-      }
+  const cronDeployId = cronDeployIdResolve();
+  if (cronDeployId) {
+    const cronEnvPath = `./engine-private/conf/${cronDeployId}/.env.${envName}`;
+    if (fs.existsSync(cronEnvPath)) {
+      const cronEnv = dotenv.parse(fs.readFileSync(cronEnvPath, 'utf8'));
+      process.env = { ...process.env, ...cronEnv };
     }
   }
 
@@ -1776,4 +1790,5 @@ export {
   readConfJson,
   DEFAULT_DEPLOY_ID,
   loadCronDeployEnv,
+  cronDeployIdResolve,
 };

package/src/server/cron.js

@@ -16,7 +16,7 @@ const volumeHostPath = '/home/dd';
 const enginePath = '/home/dd/engine';
 const cronVolumeName = 'underpost-cron-container-volume';
 const shareEnvVolumeName = 'underpost-share-env';
-const underpostContainerEnvPath = '/usr/lib/node_modules/underpost/.env';
+const underpostContainerEnvDir = '/usr/lib/node_modules/underpost';
 
 /**
  * Generates a Kubernetes CronJob YAML manifest string.
@@ -33,7 +33,9 @@ const underpostContainerEnvPath = '/usr/lib/node_modules/underpost/.env';
  * @param {string} [params.cmd] - Optional pre-script commands to run before cron execution
  * @param {boolean} [params.suspend=false] - Whether the CronJob is suspended
  * @param {boolean} [params.dryRun=false] - Pass --dry-run flag to the cron command inside the container
- * @param {boolean} [params.ssh=false] - Execute backup commands via SSH on the remote node
+ * @param {boolean} [params.k3s=false] - Pass --k3s flag to the cron command inside the container
+ * @param {boolean} [params.kind=false] - Pass --kind flag to the cron command inside the container
+ * @param {boolean} [params.kubeadm=false] - Pass --kubeadm flag to the cron command inside the container
  * @returns {string} Kubernetes CronJob YAML manifest
  * @memberof UnderpostCron
  */
@@ -49,7 +51,9 @@ const cronJobYamlFactory = ({
   cmd,
   suspend = false,
   dryRun = false,
-  ssh = false,
+  k3s = false,
+  kind = false,
+  kubeadm = false,
 }) => {
   const containerImage = image || `underpost/underpost-engine:${Underpost.version}`;
 
@@ -60,10 +64,12 @@ const cronJobYamlFactory = ({
     .replace(/^-|-$/g, '')
     .substring(0, 52);
 
-  const cmdPart = cmd ? `${cmd} && ` : '';
-  const cronBin = dev ? 'node bin' : 'underpost';
-  const flags = `${git ? '--git ' : ''}${dev ? '--dev ' : ''}${dryRun ? '--dry-run ' : ''}${ssh ? '--ssh ' : ''}`;
-  const cronCommand = `${cmdPart}${cronBin} cron ${flags}${deployList} ${jobList}`;
+  const cronBin = 'node bin'; // dev ? 'node bin' : 'underpost';
+  const flags = `${git ? '--git ' : ''}${dev ? '--dev ' : ''}${dryRun ? '--dry-run ' : ''}${k3s ? '--k3s ' : ''}${kind ? '--kind ' : ''}${kubeadm ? '--kubeadm ' : ''}`;
+  const commands = [`cd ${enginePath}`]; // `node bin run secret`
+  if (cmd) commands.push(cmd);
+  commands.push(`${cronBin} cron ${deployList} ${jobList} ${flags}`);
+  const fullCommand = commands.join(' &&\n                  ');
 
   return `apiVersion: batch/v1
 kind: CronJob
@@ -95,13 +101,12 @@ spec:
                 - /bin/sh
                 - -c
                 - >
-                  ${cronCommand}
+                  ${fullCommand}
               volumeMounts:
                 - mountPath: ${enginePath}
                   name: ${cronVolumeName}
-                - mountPath: ${underpostContainerEnvPath}
+                - mountPath: ${underpostContainerEnvDir}
                   name: ${shareEnvVolumeName}
-                  subPath: .env
           volumes:
             - hostPath:
                 path: ${enginePath}
@@ -183,7 +188,6 @@ class UnderpostCron {
      * @param {boolean} [options.kubeadm] - Use kubeadm cluster context (apply directly on host)
      * @param {boolean} [options.dryRun] - Preview cron jobs without executing them
      * @param {boolean} [options.createJobNow] - After applying, immediately create a Job from each CronJob (requires --apply)
-     * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node
      * @memberof UnderpostCron
      */
     callback: async function (
@@ -227,7 +231,6 @@ class UnderpostCron {
      * @param {boolean} [options.k3s] - k3s cluster context (apply directly on host)
      * @param {boolean} [options.kind] - kind cluster context (apply via kind-worker container)
      * @param {boolean} [options.kubeadm] - kubeadm cluster context (apply directly on host)
-     * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node
      * @memberof UnderpostCron
      */
     setupDeployStart: async function (deployId, options = {}) {
@@ -269,21 +272,19 @@ class UnderpostCron {
         logger.warn(`package.json not found for deploy-id: ${deployId}`, { path: packageJsonPath });
       }
 
-      // Generate and apply cron job manifests for this deploy-id
       await Underpost.cron.generateK8sCronJobs({
         deployId,
         namespace: options.namespace,
         image: options.image,
         apply: options.apply,
         createJobNow: options.createJobNow,
-        git: true,
-        dev: true,
-        kubeadm: true,
-        ssh: true,
-        cmd: ` cd ${enginePath} && node bin env ${deployId} production`,
-        k3s: false,
-        kind: false,
-        dryRun: false,
+        git: !!options.git,
+        dev: !!options.dev,
+        kubeadm: !!options.kubeadm,
+        cmd: options.cmd || `node bin env ${deployId} production`,
+        k3s: !!options.k3s,
+        kind: !!options.kind,
+        dryRun: !!options.dryRun,
       });
     },
 
@@ -305,7 +306,6 @@ class UnderpostCron {
      * @param {boolean} [options.kubeadm=false] - kubeadm cluster context (apply directly on host)
      * @param {boolean} [options.createJobNow=false] - After applying, create a Job from each CronJob immediately
      * @param {boolean} [options.dryRun=false] - Pass --dry-run=client to kubectl commands
-     * @param {boolean} [options.ssh=false] - Execute backup commands via SSH on the remote node
      * @memberof UnderpostCron
      */
     generateK8sCronJobs: async function (options = {}) {
@@ -362,7 +362,9 @@ class UnderpostCron {
           cmd: options.cmd,
           suspend: false,
           dryRun: !!options.dryRun,
-          ssh: !!options.ssh,
+          k3s: !!options.k3s,
+          kind: !!options.kind,
+          kubeadm: !!options.kubeadm,
         });
 
         const yamlFilePath = `${outputDir}/${cronJobName}.yaml`;

package/src/server/dns.js

@@ -265,7 +265,8 @@ class Dns {
    * @returns {Promise<void>}
    */
   static async callback(deployList) {
-    loadCronDeployEnv();
+    // loadCronDeployEnv();
+
     const isOnline = await Dns.isInternetConnection();
 
     if (!isOnline) return;