gcb-host 0.7.1 → 0.8.1

package/lib/commands/authorize.d.ts

@@ -2,9 +2,9 @@
  * `authorize` — get a user token for this app, once, from whoever runs it.
  *
  * Run on the host, beside the configuration. It prints a code, waits for that person to type it at
- * GitHub on whatever device has a browser, and stores the refresh token next to the configuration and
- * its key — outside every mount, never in the repository. From then on the broker renews the token by
- * itself and nothing here has to be run again.
+ * GitHub on whatever device has a browser, and stores the refresh token next to the configuration
+ * and its key — outside every mount, never in the repository. From then on the broker renews the
+ * token by itself and nothing here has to be run again.
  *
  * The token is what makes a pull request authored by a person rather than by the app. Only a person
  * can be the author of one that reviewers will not skip, and only the device flow reaches a person
@@ -13,26 +13,56 @@
  * Exit codes: 0 stored, 1 refused.
  */
 /** Usage text for `authorize`. */
-export declare const AUTHORIZE_USAGE = "Usage: gcb authorize [options]\n\nGet a user token for this app, by authorizing it once from a browser somewhere else. Run it on the host,\nbeside the configuration. It stores a refresh token and prints where; nothing else needs running after\nthat, because the broker renews the token itself.\n\n  --config <path>   The configuration (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)\n  --host <host>     The host block to authorize for (default: github.com)\n  --to <path>       Where to write the refresh token (default: beside the configuration)\n  --proxy <url>     Use this proxy for this command\n  --no-proxy        Reach GitHub directly for this command\n  -h, --help        Show this help\n\nThe app needs its client id configured (the App ID will not do), and \"Enable Device Flow\" selected in\nits settings. GitHub returns a refresh token only while \"Expire user authorization tokens\" is selected,\nwhich is its default and what this wants.\n";
+export declare const AUTHORIZE_USAGE = "Usage: gcb authorize [options]\n\nGet a user token for this app, by authorizing it once from a browser somewhere else. Run it on the host,\nbeside the configuration. It stores a refresh token and prints where; nothing else needs running after\nthat, because the broker renews the token itself.\n\n  --config <path>      The configuration (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)\n  --host <host>        The host block to authorize for (default: github.com)\n  --to <path>          Where to write the refresh token (default: beside the configuration)\n  --broker-container   Allow a target inside the broker container's mounts; only when it is not\n                       shared with the agent container\n  --proxy <url>        Use this proxy for this command\n  --no-proxy           Reach GitHub directly for this command\n  -h, --help           Show this help\n\nThe app needs its client id configured (the App ID will not do), and \"Enable Device Flow\" selected in\nits settings. GitHub returns a refresh token only while \"Expire user authorization tokens\" is selected,\nwhich is its default and what this wants.\n";
 /**
  * Where this command writes the refresh token.
  *
- * Beside the configuration, because the configuration is the path this process was *given*: the paths
- * inside it belong to whichever process runs the broker, and for a sidecar those are container paths
- * that do not exist out here. In the usual sidecar layout the configuration and the key sit in one
- * directory, so this lands in the same file the broker reads; where they differ, the difference is
- * printed rather than discovered later.
+ * Beside the configuration, because the configuration is the path this process was _given_: the
+ * paths inside it belong to whichever process runs the broker, and for a sidecar those are
+ * container paths that do not exist out here. In the usual sidecar layout the configuration and the
+ * key sit in one directory, so this lands in the same file the broker reads; where they differ, the
+ * difference is printed rather than discovered later.
  *
- * @param configPath - the resolved configuration path.
- * @returns the path to write the refresh token to.
+ * @param configPath - The resolved configuration path.
+ * @returns The path to write the refresh token to.
  */
 export declare function refreshTokenPath(configPath: string): string;
 /**
  * Where the broker will look for it, which is beside the key — from the key's own point of view.
  *
- * @param privateKeyPath - the path as the configuration records it.
- * @returns the path the broker reads, or `undefined` when the key is not a file.
+ * @param privateKeyPath - The path as the configuration records it.
+ * @returns The path the broker reads, or `undefined` when the key is not a file.
  */
 export declare function brokerReadsPath(privateKeyPath: string | undefined): string | undefined;
+/** Inputs for the credential-placement decision. */
+export interface AuthorizationPlacementInput {
+    readonly configPath: string;
+    readonly to?: string;
+    readonly brokerContainer: boolean;
+    readonly isInsideContainer?: () => boolean;
+    readonly mountedPath?: (target: string) => string | null;
+}
+/** The writable target and the warning to print before starting the device flow. */
+export interface AuthorizationPlacement {
+    readonly target: string;
+    readonly warning?: string;
+}
+/**
+ * Open and secure the token target before authorization, so a later path swap cannot redirect the
+ * write and a permission failure surfaces before the device flow.
+ *
+ * @param target - The token path.
+ * @returns The open descriptor, already mode 0600.
+ */
+export declare function openTokenTarget(target: string): number;
+/**
+ * Decide where the refresh token goes, and whether that placement is allowed.
+ *
+ * @param input - The configuration path, target override and injectable guards.
+ * @returns The target and an optional warning.
+ * @throws {Error} When the placement would put the token inside a container mount without the
+ * explicit broker-container acknowledgement.
+ */
+export declare function resolveAuthorizationPlacement(input: AuthorizationPlacementInput): AuthorizationPlacement;
 export declare function runAuthorize(argv: readonly string[]): Promise<number>;
 //# sourceMappingURL=authorize.d.ts.map

package/lib/commands/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/commands/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,kCAAkC;AAClC,eAAO,MAAM,eAAe,w8BAgB3B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEtF;AAUD,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqE3E"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/commands/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoBH,kCAAkC;AAClC,eAAO,MAAM,eAAe,mnCAkB3B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEtF;AAED,oDAAoD;AACpD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAA;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;CACzD;AAED,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBtD;AAUD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,2BAA2B,GACjC,sBAAsB,CAsBxB;AAUD,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4G3E"}

package/lib/commands/authorize.js

@@ -2,9 +2,9 @@
  * `authorize` — get a user token for this app, once, from whoever runs it.
  *
  * Run on the host, beside the configuration. It prints a code, waits for that person to type it at
- * GitHub on whatever device has a browser, and stores the refresh token next to the configuration and
- * its key — outside every mount, never in the repository. From then on the broker renews the token by
- * itself and nothing here has to be run again.
+ * GitHub on whatever device has a browser, and stores the refresh token next to the configuration
+ * and its key — outside every mount, never in the repository. From then on the broker renews the
+ * token by itself and nothing here has to be run again.
  *
  * The token is what makes a pull request authored by a person rather than by the app. Only a person
  * can be the author of one that reviewers will not skip, and only the device flow reaches a person
@@ -12,11 +12,12 @@
  *
  * Exit codes: 0 stored, 1 refused.
  */
+import { closeSync, constants, fchmodSync, fstatSync, ftruncateSync, mkdirSync, openSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve as resolvePath } from 'node:path';
+import { fail, insideMountedPath, isInsideContainer, parseArgs, say, warn } from 'gcb-core';
 import { USER_TOKEN_FILE, userTokenPath, loadConfig, resolveConfigPath } from '../config.js';
 import { collectUserToken, startDeviceFlow } from '../device-flow.js';
 import { fetcherFor, parseProxy } from '../http.js';
-import { fail, insideMountedPath, isInsideContainer, parseArgs, say, writeSecretFile } from 'gcb-core';
 /** Usage text for `authorize`. */
 export const AUTHORIZE_USAGE = `Usage: gcb authorize [options]
 
@@ -24,12 +25,14 @@ Get a user token for this app, by authorizing it once from a browser somewhere e
 beside the configuration. It stores a refresh token and prints where; nothing else needs running after
 that, because the broker renews the token itself.
 
-  --config <path>   The configuration (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
-  --host <host>     The host block to authorize for (default: github.com)
-  --to <path>       Where to write the refresh token (default: beside the configuration)
-  --proxy <url>     Use this proxy for this command
-  --no-proxy        Reach GitHub directly for this command
-  -h, --help        Show this help
+  --config <path>      The configuration (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
+  --host <host>        The host block to authorize for (default: github.com)
+  --to <path>          Where to write the refresh token (default: beside the configuration)
+  --broker-container   Allow a target inside the broker container's mounts; only when it is not
+                       shared with the agent container
+  --proxy <url>        Use this proxy for this command
+  --no-proxy           Reach GitHub directly for this command
+  -h, --help           Show this help
 
 The app needs its client id configured (the App ID will not do), and "Enable Device Flow" selected in
 its settings. GitHub returns a refresh token only while "Expire user authorization tokens" is selected,
@@ -38,14 +41,14 @@ which is its default and what this wants.
 /**
  * Where this command writes the refresh token.
  *
- * Beside the configuration, because the configuration is the path this process was *given*: the paths
- * inside it belong to whichever process runs the broker, and for a sidecar those are container paths
- * that do not exist out here. In the usual sidecar layout the configuration and the key sit in one
- * directory, so this lands in the same file the broker reads; where they differ, the difference is
- * printed rather than discovered later.
+ * Beside the configuration, because the configuration is the path this process was _given_: the
+ * paths inside it belong to whichever process runs the broker, and for a sidecar those are
+ * container paths that do not exist out here. In the usual sidecar layout the configuration and the
+ * key sit in one directory, so this lands in the same file the broker reads; where they differ, the
+ * difference is printed rather than discovered later.
  *
- * @param configPath - the resolved configuration path.
- * @returns the path to write the refresh token to.
+ * @param configPath - The resolved configuration path.
+ * @returns The path to write the refresh token to.
  */
 export function refreshTokenPath(configPath) {
     return join(dirname(resolvePath(configPath)), USER_TOKEN_FILE);
@@ -53,67 +56,157 @@ export function refreshTokenPath(configPath) {
 /**
  * Where the broker will look for it, which is beside the key — from the key's own point of view.
  *
- * @param privateKeyPath - the path as the configuration records it.
- * @returns the path the broker reads, or `undefined` when the key is not a file.
+ * @param privateKeyPath - The path as the configuration records it.
+ * @returns The path the broker reads, or `undefined` when the key is not a file.
  */
 export function brokerReadsPath(privateKeyPath) {
     return privateKeyPath === undefined ? undefined : userTokenPath(privateKeyPath);
 }
+/**
+ * Open and secure the token target before authorization, so a later path swap cannot redirect the
+ * write and a permission failure surfaces before the device flow.
+ *
+ * @param target - The token path.
+ * @returns The open descriptor, already mode 0600.
+ */
+export function openTokenTarget(target) {
+    mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+    const flags = constants.O_WRONLY | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+    const fd = openSync(target, flags, 0o600);
+    try {
+        const info = fstatSync(fd);
+        if (!info.isFile()) {
+            throw new Error(`${target} is not a regular file`);
+        }
+        const uid = process.geteuid?.();
+        if (uid !== undefined && info.uid !== uid) {
+            throw new Error(`${target} is not owned by the current user`);
+        }
+        fchmodSync(fd, 0o600);
+        return fd;
+    }
+    catch (error) {
+        closeSync(fd);
+        throw error;
+    }
+}
+/** Write the refresh token through the descriptor opened before the device flow. */
+function writeToken(fd, token) {
+    ftruncateSync(fd, 0);
+    writeFileSync(fd, `${token}\n`);
+    // ACL-based shares can ignore the create/open mode; set it again after the write.
+    fchmodSync(fd, 0o600);
+}
+/**
+ * Decide where the refresh token goes, and whether that placement is allowed.
+ *
+ * @param input - The configuration path, target override and injectable guards.
+ * @returns The target and an optional warning.
+ * @throws {Error} When the placement would put the token inside a container mount without the
+ * explicit broker-container acknowledgement.
+ */
+export function resolveAuthorizationPlacement(input) {
+    const target = input.to ?? refreshTokenPath(input.configPath);
+    if ((input.isInsideContainer ?? isInsideContainer)()) {
+        throw new Error('run this on the host, not inside the container: the token must not land anywhere the container can read');
+    }
+    if (input.brokerContainer) {
+        return {
+            target,
+            warning: "writing inside the broker container's mounts; this is only safe when the target is not shared with the agent container",
+        };
+    }
+    const mounted = (input.mountedPath ?? insideMountedPath)(target);
+    if (mounted !== null) {
+        throw new Error(`${target} is inside ${mounted}, which is mounted into the container; the refresh token must live\n` +
+            '  outside every mount — the deployment directory beside the configuration is the usual place');
+    }
+    return { target };
+}
 /**
  * Run the `authorize` command.
  *
- * @param argv - arguments after the command name.
- * @returns the process exit code: 0 stored, 1 refused.
+ * @param argv - Arguments after the command name.
+ * @returns The process exit code: 0 stored, 1 refused.
  */
 import { assertProxyEnabled } from '../proxy.js';
 export async function runAuthorize(argv) {
-    const args = parseArgs(argv, { booleans: ['help', 'no-proxy'] });
-    if (args.has('no-proxy') && args.value('proxy') !== undefined)
+    const args = parseArgs(argv, { booleans: ['broker-container', 'help', 'no-proxy'] });
+    if (args.has('no-proxy') && args.value('proxy') !== undefined) {
         fail('--proxy and --no-proxy are mutually exclusive');
-    if (args.has('proxy') && args.value('proxy') === undefined)
+    }
+    if (args.has('proxy') && args.value('proxy') === undefined) {
         fail('--proxy needs a value');
+    }
     const proxy = args.has('no-proxy') ? null : args.value('proxy');
-    if (proxy !== undefined && parseProxy(proxy) === false)
+    if (proxy !== undefined && parseProxy(proxy) === false) {
         fail('--proxy must be an http(s) URL');
+    }
     if (args.has('help') || args.has('h')) {
         say(AUTHORIZE_USAGE);
         return 0;
     }
-    if (proxy === undefined)
+    if (proxy === undefined) {
         assertProxyEnabled();
+    }
     const configPath = resolveConfigPath(args.value('config'));
     const host = args.value('host') ?? 'github.com';
     const config = loadConfig(configPath);
     const block = config.hosts[host];
-    if (block === undefined)
+    if (block === undefined) {
         fail(`no host ${host} in ${configPath}`);
-    if (block.provider !== 'github-app')
+    }
+    if (block.provider !== 'github-app') {
         fail(`${host} is not a github-app host`);
+    }
     if (block.clientId === undefined) {
         fail(`${host} has no clientId — a device flow needs the app's client id, and the App ID will not do`);
     }
-    const fetcher = fetcherFor(proxy);
-    const code = await startDeviceFlow(block.clientId, fetcher);
-    say(`Open ${code.verificationUri} and enter: ${code.userCode}`);
-    say(`Waiting up to ${Math.round(code.expiresIn / 60)} minutes for that to be authorized…`);
-    const token = await collectUserToken(block.clientId, code, fetcher, (ms) => new Promise((done) => setTimeout(done, ms)));
-    if (token.refreshToken === undefined) {
-        fail('GitHub returned no refresh token, so the token would expire in eight hours with no way to renew.\n' +
-            '  Select "Expire user authorization tokens" in the app settings and authorize again.');
-    }
-    const target = args.value('to') ?? refreshTokenPath(configPath);
-    // The same two checks init and stage apply, for the same reason: this is a credential of a person, and
-    // the container that pushes must not be able to read it. It is written outside every mount or not at all.
-    if (isInsideContainer()) {
-        fail('run this on the host, not inside the container: the token must not land anywhere the container can read');
-    }
-    const mounted = insideMountedPath(target);
-    if (mounted !== null) {
-        fail(`${target} is inside ${mounted}, which is mounted into the container; the refresh token must live\n` +
-            '  outside every mount — the deployment directory beside the configuration is the usual place');
+    let placement;
+    try {
+        placement = resolveAuthorizationPlacement({
+            configPath,
+            to: args.value('to'),
+            brokerContainer: args.has('broker-container'),
+        });
+    }
+    catch (error) {
+        fail(error.message);
+    }
+    if (placement.warning !== undefined) {
+        warn(placement.warning);
+    }
+    say(`the refresh token will be written to ${placement.target}`);
+    let tokenFd;
+    try {
+        tokenFd = openTokenTarget(placement.target);
+    }
+    catch (error) {
+        fail(`could not open ${placement.target}: ${error.message}`);
+    }
+    let failure;
+    try {
+        const fetcher = fetcherFor(proxy);
+        const code = await startDeviceFlow(block.clientId, fetcher);
+        say(`Open ${code.verificationUri} and enter: ${code.userCode}`);
+        say(`Waiting up to ${Math.round(code.expiresIn / 60)} minutes for that to be authorized…`);
+        const token = await collectUserToken(block.clientId, code, fetcher, ms => new Promise(done => setTimeout(done, ms)));
+        if (token.refreshToken === undefined) {
+            throw new Error('GitHub returned no refresh token, so the token would expire in eight hours with no way to renew.\n' +
+                '  Select "Expire user authorization tokens" in the app settings and authorize again.');
+        }
+        writeToken(tokenFd, token.refreshToken);
     }
-    writeSecretFile(target, `${token.refreshToken}\n`);
-    say(`stored the refresh token in ${target} (mode 600)`);
+    catch (error) {
+        failure = error;
+    }
+    finally {
+        closeSync(tokenFd);
+    }
+    if (failure !== undefined) {
+        fail(failure.message);
+    }
+    say(`stored the refresh token in ${placement.target} (mode 600)`);
     const readByBroker = brokerReadsPath(block.privateKeyPath);
     if (readByBroker === undefined) {
         // An inline privateKeyPem deployment: the broker has no directory to derive a path from, so it never
@@ -121,12 +214,12 @@ export async function runAuthorize(argv) {
         say('note: this host block keeps its key inline, so the broker has nowhere to look for this file:');
         say('      pull requests will stay app-authored until the key is a file (privateKeyPath)');
     }
-    else if (resolvePath(readByBroker) !== resolvePath(target)) {
-        say(`note: the broker will look in ${readByBroker} — make sure that is this file, and that it is`);
-        say('      writable, because GitHub rotates the token on every exchange');
+    else if (resolvePath(readByBroker) === resolvePath(placement.target)) {
+        say('which is where the broker looks for it — keep it writable, since the token is rotated on every use');
     }
     else {
-        say('which is where the broker looks for it — keep it writable, since the token is rotated on every use');
+        say(`note: the broker will look in ${readByBroker} — make sure that is this file, and that it is`);
+        say('      writable, because GitHub rotates the token on every exchange');
     }
     say('the broker will use it for pull requests authored by that person; nothing else needs running');
     return 0;

package/lib/commands/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/commands/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEvG,kCAAkC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;CAgB9B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,cAAkC;IAChE,OAAO,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,KAAK,SAAS;QAAE,kBAAkB,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,IAAI,OAAO,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,wFAAwF,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,OAAO,GAAY,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,GAAG,CAAC,QAAQ,IAAI,CAAC,eAAe,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,KAAK,CAAC,QAAQ,EACd,IAAI,EACJ,OAAO,EACP,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACpD,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CACF,oGAAoG;YAClG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAChE,uGAAuG;IACvG,0GAA0G;IAC1G,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,CACF,GAAG,MAAM,cAAc,OAAO,sEAAsE;YAClG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,+BAA+B,MAAM,aAAa,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,qGAAqG;QACrG,qFAAqF;QACrF,GAAG,CAAC,8FAA8F,CAAC,CAAC;QACpG,GAAG,CAAC,qFAAqF,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,WAAW,CAAC,YAAY,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,iCAAiC,YAAY,gDAAgD,CAAC,CAAC;QACnG,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,oGAAoG,CAAC,CAAC;IAC5G,CAAC;IACD,GAAG,CAAC,8FAA8F,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/commands/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAEjE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE3F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAA;AACnF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEnD,kCAAkC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;CAkB9B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe,CAAC,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,cAAkC;IAChE,OAAO,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAA;AACjF,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAA;IAChH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAA;QAC/D,CAAC;QACD,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,EAAU,EAAE,KAAa;IAC3C,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,aAAa,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,CAAA;IAC/B,kFAAkF;IAClF,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAkC;IAElC,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM;YACN,OAAO,EACL,wHAAwH;SAC3H,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;IAChE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,cAAc,OAAO,sEAAsE;YAClG,8FAA8F,CACjG,CAAA;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;IACpF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9D,IAAI,CAAC,+CAA+C,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3D,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACvD,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,eAAe,CAAC,CAAA;QACpB,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,kBAAkB,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,YAAY,CAAA;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,IAAI,OAAO,UAAU,EAAE,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CACF,GAAG,IAAI,wFAAwF,CAChG,CAAA;IACH,CAAC;IAED,IAAI,SAAiC,CAAA;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,6BAA6B,CAAC;YACxC,UAAU;YACV,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACpB,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;SAC9C,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACzB,CAAC;IACD,GAAG,CAAC,wCAAwC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IAE/D,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,SAAS,CAAC,MAAM,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,OAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,UAAU,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC3D,GAAG,CAAC,QAAQ,IAAI,CAAC,eAAe,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/D,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAA;QAE1F,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,KAAK,CAAC,QAAQ,EACd,IAAI,EACJ,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAChD,CAAA;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,oGAAoG;gBAClG,sFAAsF,CACzF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,KAAc,CAAA;IAC1B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,CAAC,CAAA;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IACD,GAAG,CAAC,+BAA+B,SAAS,CAAC,MAAM,aAAa,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,qGAAqG;QACrG,qFAAqF;QACrF,GAAG,CACD,8FAA8F,CAC/F,CAAA;QACD,GAAG,CAAC,qFAAqF,CAAC,CAAA;IAC5F,CAAC;SAAM,IAAI,WAAW,CAAC,YAAY,CAAC,KAAK,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,GAAG,CACD,oGAAoG,CACrG,CAAA;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CACD,iCAAiC,YAAY,gDAAgD,CAC9F,CAAA;QACD,GAAG,CAAC,oEAAoE,CAAC,CAAA;IAC3E,CAAC;IACD,GAAG,CACD,8FAA8F,CAC/F,CAAA;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/lib/commands/compose.d.ts

@@ -8,16 +8,14 @@ export interface ComposeInput {
     readonly socketDir: string;
     /** `uid:gid` the sidecar runs as; must match the container that needs the socket. */
     readonly user: string;
-    /** Base image. */
+    /** Base image; the released host image contains the `gcb` binary. */
     readonly image: string;
-    /** npm spec to run, e.g. `gcb@0.0.0`. */
-    readonly packageSpec: string;
     /** Compose service and container name. */
     readonly name: string;
     /**
      * Host directory holding the broker's code, as `stage` exports it. When given, the sidecar runs
-     * that code with the image's Node instead of fetching the package at start: no registry access
-     * at boot, and the commit that runs is the one you reviewed.
+     * that code with the image's Node instead of running the image's installed binary: no registry
+     * access at boot, and the commit that runs is the one you reviewed.
      */
     readonly code?: string;
 }
@@ -26,17 +24,17 @@ export declare const CODE_DIR = "/opt/gcb";
 /**
  * Render the compose file.
  *
- * @param input - the resolved options.
- * @returns the YAML, newline-terminated.
+ * @param input - The resolved options.
+ * @returns The YAML, newline-terminated.
  */
 export declare function renderCompose(input: ComposeInput): string;
 /** Usage text for `compose`. */
-export declare const COMPOSE_USAGE = "Usage: gcb compose [options]\n\nPrint a Docker sidecar definition for the broker (to stdout). Pair it with a config written by\n`init --mode sidecar`, whose paths this file fixes.\n\n  --dir <path>        Host directory holding broker.config.yml, app.pem and log/ (default: the config's directory)\n  --config <path>     The sidecar's config, checked before anything is printed\n                      (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)\n  --socket-dir <path> Host directory the pushing container already mounts\n  --code <path>       Run code mounted from this host directory instead of fetching the package\n                      at start (as `stage` exports it); nothing is fetched or built at boot\n  --user <uid:gid>    UID the sidecar runs as (default: this user)\n  --image <name>      Base image (default: node:24-slim)\n  --package <spec>    npm spec to run (default: gcb-host@<version>)\n  --name <name>       Service and container name (default: gcb)\n  -h, --help          Show this help\n";
+export declare const COMPOSE_USAGE = "Usage: gcb compose [options]\n\nPrint a Docker sidecar definition for the broker (to stdout). Pair it with a config written by\n`init --mode sidecar`, whose paths this file fixes.\n\n  --dir <path>        Host directory holding broker.config.yml, app.pem and log/ (default: the config's directory)\n  --config <path>     The sidecar's config, checked before anything is printed\n                      (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)\n  --socket-dir <path> Host directory the pushing container already mounts\n  --code <path>       Run code mounted from this host directory instead of the installed binary\n                      (as `stage` exports it); nothing is fetched or built at boot\n  --user <uid:gid>    UID the sidecar runs as (default: this user)\n  --image <name>      Base image (default: ghcr.io/code-vaults/gcb-host:<version>)\n  --name <name>       Service and container name (default: gcb)\n  -h, --help          Show this help\n";
 /**
  * Run the `compose` command.
  *
- * @param argv - arguments after the command name.
- * @returns the process exit code.
+ * @param argv - Arguments after the command name.
+ * @returns The process exit code.
  */
 export declare function runCompose(argv: readonly string[]): number;
 //# sourceMappingURL=compose.d.ts.map

package/lib/commands/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/commands/compose.ts"],"names":[],"mappings":"AAmBA,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kBAAkB;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,uDAAuD;AACvD,eAAO,MAAM,QAAQ,aAAa,CAAC;AAoBnC;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAwHzD;AAED,gCAAgC;AAChC,eAAO,MAAM,aAAa,kgCAgBzB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA2D1D"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/commands/compose.ts"],"names":[],"mappings":"AAyBA,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,eAAO,MAAM,QAAQ,aAAa,CAAA;AAsBlC;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmHzD;AAED,gCAAgC;AAChC,eAAO,MAAM,aAAa,88BAezB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6D1D"}

package/lib/commands/compose.js

@@ -1,20 +1,18 @@
 /**
  * `compose` — print a Docker sidecar definition for the broker.
  *
- * The broker runs in its own container with the private key mounted read-only, no published
- * ports, no capabilities and a read-only root filesystem; the only surface it shares with
- * anything else is the socket directory. The container fetches the published package, so there
- * is no checkout to copy and nothing to build on the host.
+ * The broker runs in its own container with the private key mounted read-only, no published ports,
+ * no capabilities and a read-only root filesystem; the only surface it shares with anything else is
+ * the socket directory. The released image contains the package, so there is no checkout to copy and
+ * nothing to build on the host.
  *
- * The mount targets are constants from `deployment.ts`, shared with `init --mode sidecar`, so
- * the paths recorded in `broker.config.yml` and the paths this file mounts cannot drift apart.
+ * The mount targets are constants from `deployment.ts`, shared with `init --mode sidecar`, so the
+ * paths recorded in `broker.config.yml` and the paths this file mounts cannot drift apart.
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { inferMode, loadConfig, resolveConfigPath, deploymentDir, SIDECAR } from '../config.js';
-import { PACKAGE_VERSION } from 'gcb-core';
-import { fail, parseArgs, say, warn } from 'gcb-core';
-import { USER_TOKEN_FILE } from '../config.js';
+import { PACKAGE_VERSION, fail, parseArgs, say, warn } from 'gcb-core';
+import { inferMode, loadConfig, resolveConfigPath, deploymentDir, SIDECAR, USER_TOKEN_FILE, } from '../config.js';
 /** Where a code-mounted sidecar expects the broker. */
 export const CODE_DIR = '/opt/gcb';
 /** A volume scalar as YAML, with compose's dollar escaping applied first. */
@@ -30,16 +28,17 @@ function selectedConfigFile(configPath) {
         return fs.realpathSync(configPath);
     }
     catch (error) {
-        if (error.code === 'ENOENT')
+        if (error.code === 'ENOENT') {
             return configPath;
+        }
         throw error;
     }
 }
 /**
  * Render the compose file.
  *
- * @param input - the resolved options.
- * @returns the YAML, newline-terminated.
+ * @param input - The resolved options.
+ * @returns The YAML, newline-terminated.
  */
 export function renderCompose(input) {
     const socketDir = input.socketDir.replace(/\/+$/, '');
@@ -54,14 +53,8 @@ export function renderCompose(input) {
         ? `# It runs the code mounted read-only from ${input.code}, which is whatever \`stage\` put there —
 # see the STAGED.json beside it for the commit. stage does not install dependencies or build:
 # run \`corepack yarn install\` in that directory first, then the source entry point runs here.`
-        : `# The image fetches the published package at start:
-#
-#   npx --yes --package '${input.packageSpec}' gcb daemon
-#
-# To avoid depending on the registry at boot, either render this file with --code <directory> to
-# run staged code from a mount, or point --image at an image of your own that already has the
-# package installed, and change \`command\` to the binary in it:
-#   ["gcb", "daemon", "--config", "${mountedConfigPath}"]`;
+        : `# The image contains gcb-host and the command below runs its installed \`gcb\` binary.
+# To pin a reviewed commit instead, render this file with --code <directory>.`;
     // The egress lines belong to both renders: a --code deployment is a sidecar too, and without them it
     // would carry no proxy variables at all, so the daemon would go direct and hang rather than refuse.
     const egress = `
@@ -73,13 +66,8 @@ export function renderCompose(input) {
       - NODE_USE_ENV_PROXY=1
       # Runtime override: a URL pins a proxy, an empty value goes direct, unset keeps the above.
       - GCB_PROXY=\${GCB_PROXY-default}`;
-    const environment = fromCode
-        ? `
-    environment:${egress}`
-        : `
-    environment:
-      # npx needs somewhere writable for its cache; /tmp is a tmpfs above.
-      - npm_config_cache=/tmp/npm-cache${egress}`;
+    const environment = `
+    environment:${egress}`;
     // A bind mount for a path that does not exist becomes a directory, and the broker would then read a
     // directory instead of a token — for every action, not only the personal ones. Emit it once `authorize`
     // has written the file, and say what to run until then.
@@ -89,14 +77,14 @@ export function renderCompose(input) {
             '\n      # for a path that does not exist would become a directory, and the broker would read that.';
     const start = fromCode
         ? `exec node --conditions=development ${CODE_DIR}/packages/host/bin/gcb.js daemon --config ${mountedConfigArg}`
-        : `exec npx --yes --package '${input.packageSpec}' gcb daemon --config ${mountedConfigArg}`;
+        : `exec gcb daemon --config ${mountedConfigArg}`;
     const command = `      - sh
       - -c
       - |
-        case "\$\${GCB_PROXY-default}" in
+        case "$\${GCB_PROXY-default}" in
           default) ;;
           "") unset http_proxy https_proxy all_proxy no_proxy HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY NODE_USE_ENV_PROXY ;;
-          *) export http_proxy="\$\$GCB_PROXY" https_proxy="\$\$GCB_PROXY" no_proxy=localhost,127.0.0.1 NODE_USE_ENV_PROXY=1 ;;
+          *) export http_proxy="$$GCB_PROXY" https_proxy="$$GCB_PROXY" no_proxy=localhost,127.0.0.1 NODE_USE_ENV_PROXY=1 ;;
         esac
         ${start}`;
     const codeMount = fromCode
@@ -166,19 +154,18 @@ Print a Docker sidecar definition for the broker (to stdout). Pair it with a con
   --config <path>     The sidecar's config, checked before anything is printed
                       (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
   --socket-dir <path> Host directory the pushing container already mounts
-  --code <path>       Run code mounted from this host directory instead of fetching the package
-                      at start (as \`stage\` exports it); nothing is fetched or built at boot
+  --code <path>       Run code mounted from this host directory instead of the installed binary
+                      (as \`stage\` exports it); nothing is fetched or built at boot
   --user <uid:gid>    UID the sidecar runs as (default: this user)
-  --image <name>      Base image (default: node:24-slim)
-  --package <spec>    npm spec to run (default: gcb-host@<version>)
+  --image <name>      Base image (default: ghcr.io/code-vaults/gcb-host:<version>)
   --name <name>       Service and container name (default: gcb)
   -h, --help          Show this help
 `;
 /**
  * Run the `compose` command.
  *
- * @param argv - arguments after the command name.
- * @returns the process exit code.
+ * @param argv - Arguments after the command name.
+ * @returns The process exit code.
  */
 export function runCompose(argv) {
     const args = parseArgs(argv, { booleans: ['help'] });
@@ -186,13 +173,16 @@ export function runCompose(argv) {
         say(COMPOSE_USAGE);
         return 0;
     }
+    if (argv.some(argument => argument === '--package' || argument.startsWith('--package='))) {
+        fail('--package is not supported; pin the released image with --image instead');
+    }
     const explicitConfig = args.value('config');
     const dirArg = args.value('dir');
-    const configPath = path.resolve(explicitConfig !== undefined
-        ? resolveConfigPath(explicitConfig)
-        : dirArg !== undefined
-            ? path.join(dirArg, 'broker.config.yml')
-            : resolveConfigPath());
+    const configPath = path.resolve(explicitConfig === undefined
+        ? dirArg === undefined
+            ? resolveConfigPath()
+            : path.join(dirArg, 'broker.config.yml')
+        : resolveConfigPath(explicitConfig));
     const configFile = selectedConfigFile(configPath);
     const dir = path.resolve(dirArg ?? deploymentDir(configFile));
     const socketDir = args.value('socket-dir');
@@ -225,8 +215,7 @@ export function runCompose(argv) {
         configPath: configFile,
         socketDir,
         user,
-        image: args.value('image') ?? 'node:24-slim',
-        packageSpec: args.value('package') ?? `gcb-host@${PACKAGE_VERSION}`,
+        image: args.value('image') ?? `ghcr.io/code-vaults/gcb-host:${PACKAGE_VERSION}`,
         name: args.value('name') ?? 'gcb',
         code: args.value('code'),
     }));