hilos-agent 0.1.16 → 0.5.1

package/src/deploy.mjs

@@ -0,0 +1,234 @@
+// Local-folder deploys through the user's own Vercel or Netlify CLI session.
+// No OAuth or credentials are stored by hilos. Every captured string returned
+// to callers is redacted before it can reach a report, transcript, or log.
+
+import { constants as fsConstants } from "node:fs";
+import { accessSync, existsSync } from "node:fs";
+import { delimiter, join } from "node:path";
+
+import { runCli, scrubHilosEnv } from "./cli.mjs";
+import { redactSecrets } from "./redact.mjs";
+
+export const DEPLOY_PROVIDERS = ["vercel", "netlify"];
+export const DEFAULT_DEPLOY_TIMEOUT_MS = 5 * 60_000;
+
+function isProvider(value) {
+  return DEPLOY_PROVIDERS.includes(value);
+}
+
+export function findDeployCli(provider, env = process.env) {
+  if (!isProvider(provider)) return null;
+  for (const entry of String(env.PATH || "").split(delimiter)) {
+    if (!entry) continue;
+    const candidate = join(entry, provider);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+      // Continue through PATH.
+    }
+  }
+  return null;
+}
+
+/** Resolve explicit channel config first, then provider-owned project markers. */
+export function resolveDeployTarget({ cfg, channelId, folderPath, env = process.env, pathExists = existsSync }) {
+  const configured = cfg?.deploy?.[channelId];
+  let provider = isProvider(configured?.provider) ? configured.provider : null;
+  let prod = configured?.prod === true;
+  let source = provider ? "config" : null;
+
+  if (!provider) {
+    if (pathExists(join(folderPath, ".vercel")) || pathExists(join(folderPath, "vercel.json"))) {
+      provider = "vercel";
+      source = "detected";
+    } else if (pathExists(join(folderPath, ".netlify")) || pathExists(join(folderPath, "netlify.toml"))) {
+      provider = "netlify";
+      source = "detected";
+    }
+    prod = false;
+  }
+
+  if (!provider) return { enabled: false, reason: "not-configured" };
+  const cliPath = findDeployCli(provider, env);
+  return {
+    enabled: true,
+    available: Boolean(cliPath),
+    provider,
+    prod,
+    source,
+    cliPath,
+    reason: cliPath ? null : "cli-missing",
+  };
+}
+
+export function deployArgs(provider, prod) {
+  if (provider === "vercel") return prod ? ["--prod", "--yes"] : ["--yes"];
+  if (provider === "netlify") {
+    return prod ? ["deploy", "--prod", "--json"] : ["deploy", "--json"];
+  }
+  throw new Error("Unsupported deploy provider.");
+}
+
+function stripAnsi(value) {
+  return String(value || "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "");
+}
+
+function vercelUrlCandidates(stdout, stderr) {
+  const lines = `${stripAnsi(stdout)}\n${stripAnsi(stderr)}`.split(/\r?\n/);
+  const candidates = [];
+  for (const line of lines) {
+    for (const match of line.matchAll(/https:\/\/[^\s"'<>]+/gi)) {
+      // Vercel's aligned output has no colon and may have a gutter glyph:
+      // `▲ Aliased         https://example.com`. Older releases used colons.
+      const beforeUrl = line.slice(0, match.index ?? 0);
+      const label = /\b(preview|production|aliased)\b\s*:?\s*$/i
+        .exec(beforeUrl)?.[1]?.toLowerCase() ?? null;
+      const raw = match[0].replace(/[),.;\]]+$/g, "");
+      try {
+        const parsed = new URL(raw);
+        const host = parsed.hostname.toLowerCase();
+        // `Inspect: https://vercel.com/<team>/<project>/...` is a dashboard
+        // link, not the deployment. Never put it on a report card.
+        if (host === "vercel.com" || host.endsWith(".vercel.com")) continue;
+        candidates.push({ raw, host, label });
+      } catch {
+        // Ignore malformed URL-shaped CLI output.
+      }
+    }
+  }
+  return candidates;
+}
+
+export function parseDeployUrl(provider, stdout, stderr = "", prod = false) {
+  if (provider === "vercel") {
+    const candidates = vercelUrlCandidates(stdout, stderr);
+    if (prod) {
+      // Production deploys may finish by printing only a custom alias. Prefer
+      // the explicit alias, then the CLI's Production line, before falling back
+      // to the canonical *.vercel.app deployment URL.
+      return (
+        candidates.find((candidate) => candidate.label === "aliased")?.raw ??
+        candidates.find((candidate) => candidate.label === "production")?.raw ??
+        candidates.find((candidate) => candidate.host.endsWith(".vercel.app"))?.raw ??
+        null
+      );
+    }
+    // Preview output remains deliberately strict: an arbitrary URL printed by
+    // a build is not evidence that Vercel deployed there.
+    return candidates.find((candidate) => candidate.host.endsWith(".vercel.app"))?.raw ?? null;
+  }
+  if (provider === "netlify") {
+    const clean = stripAnsi(stdout).trim();
+    const candidates = [clean, clean.slice(clean.indexOf("{"), clean.lastIndexOf("}") + 1)];
+    for (const candidate of candidates) {
+      if (!candidate) continue;
+      try {
+        const parsed = JSON.parse(candidate);
+        const value = prod
+          ? parsed.url || parsed.deploy_url
+          : parsed.deploy_url || parsed.url;
+        if (typeof value === "string" && /^https?:\/\//i.test(value)) return value;
+      } catch {
+        // Netlify should emit one JSON object; try the bounded object fallback.
+      }
+    }
+  }
+  return null;
+}
+
+function loginCaveat(provider, output) {
+  const text = String(output || "").toLowerCase();
+  const authFailure =
+    /not (?:logged|signed) in|not authenticated|authentication required|unauthorized|no auth token|login required|token is not valid|invalid (?:auth )?token/.test(text);
+  if (!authFailure) return null;
+  return provider === "vercel"
+    ? "Vercel is not logged in on this Mac. Run `vercel login` in a terminal once, then try again."
+    : "Netlify is not logged in on this Mac. Run `netlify login` in a terminal once, then try again.";
+}
+
+function safeDeploymentUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return redactSecrets(parsed.toString());
+  } catch {
+    return null;
+  }
+}
+
+export async function deployFolder({
+  folderPath,
+  target,
+  timeoutMs = DEFAULT_DEPLOY_TIMEOUT_MS,
+  env = process.env,
+  signal = undefined,
+  run = runCli,
+}) {
+  const provider = target?.provider;
+  const prod = target?.prod === true;
+  if (!isProvider(provider)) {
+    return { ok: false, provider: null, prod, caveat: "Choose Vercel or Netlify before deploying." };
+  }
+  if (!target.available || !target.cliPath) {
+    const label = provider === "vercel" ? "Vercel" : "Netlify";
+    return {
+      ok: false,
+      provider,
+      prod,
+      caveat: `Install the ${label} CLI, sign in, then try again.`,
+    };
+  }
+
+  const result = await run({
+    cmd: target.cliPath,
+    args: deployArgs(provider, prod),
+    cwd: folderPath,
+    timeoutMs,
+    heartbeatMs: 0,
+    label: "deploying",
+    signal,
+    // Defense in depth: runCli strips HILOS_* too, but an injected runner sees
+    // the same scrubbed environment the real child receives.
+    env: scrubHilosEnv(env),
+  });
+  const stdout = redactSecrets(String(result?.stdout || ""));
+  const stderr = redactSecrets(String(result?.stderr || ""));
+  const error = redactSecrets(String(result?.error?.message || ""));
+  const combined = [stdout, stderr, error].filter(Boolean).join("\n");
+
+  if (result?.aborted) {
+    return { ok: false, provider, prod, aborted: true, stdout, stderr, caveat: "Deployment was stopped." };
+  }
+  if (result?.status !== 0) {
+    return {
+      ok: false,
+      provider,
+      prod,
+      stdout,
+      stderr,
+      caveat:
+        loginCaveat(provider, combined) ||
+        (error.includes("timed out")
+          ? `The ${provider === "vercel" ? "Vercel" : "Netlify"} deployment timed out after ${Math.round(timeoutMs / 1000)} seconds.`
+          : `${provider === "vercel" ? "Vercel" : "Netlify"} deployment failed: ${(stderr || error || "unknown error").slice(0, 240)}`),
+    };
+  }
+
+  const url = safeDeploymentUrl(parseDeployUrl(provider, result.stdout, result.stderr, prod));
+  if (!url) {
+    return {
+      ok: false,
+      provider,
+      prod,
+      stdout,
+      stderr,
+      caveat: `${provider === "vercel" ? "Vercel" : "Netlify"} finished without returning a deployment URL.`,
+    };
+  }
+  return { ok: true, provider, prod, url, stdout, stderr };
+}