ninedeploy 0.10.5 → 0.16.0

package/src/lib/format.ts

@@ -0,0 +1,182 @@
+/** CLI formatting utilities — colors, spinners, tables, banners. */
+
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+const BLUE = '\x1b[34m';
+const MAGENTA = '\x1b[35m';
+const CYAN = '\x1b[36m';
+const GRAY = '\x1b[90m';
+
+export const c = {
+  reset: (s: string) => `${RESET}${s}${RESET}`,
+  bold: (s: string) => `${BOLD}${s}${RESET}`,
+  dim: (s: string) => `${DIM}${s}${RESET}`,
+  red: (s: string) => `${RED}${s}${RESET}`,
+  green: (s: string) => `${GREEN}${s}${RESET}`,
+  yellow: (s: string) => `${YELLOW}${s}${RESET}`,
+  blue: (s: string) => `${BLUE}${s}${RESET}`,
+  magenta: (s: string) => `${MAGENTA}${s}${RESET}`,
+  cyan: (s: string) => `${CYAN}${s}${RESET}`,
+  gray: (s: string) => `${GRAY}${s}${RESET}`,
+};
+
+const STATUS_COLORS: Record<string, (s: string) => string> = {
+  running: c.green,
+  healthy: c.green,
+  active: c.green,
+  sent: c.green,
+  ok: c.green,
+  stopped: c.gray,
+  idle: c.gray,
+  deploying: c.yellow,
+  building: c.yellow,
+  queued: c.yellow,
+  pending: c.yellow,
+  creating: c.yellow,
+  error: c.red,
+  failed: c.red,
+  unhealthy: c.red,
+};
+
+export function statusColor(status: string): string {
+  const color = Object.hasOwn(STATUS_COLORS, status) ? STATUS_COLORS[status] : undefined;
+  return color ? color(status) : status;
+}
+
+export function banner(): void {
+  const gradient = `${MAGENTA}╔${'═'.repeat(44)}╗${RESET}
+${MAGENTA}║${RESET}  ${BOLD}   9 NineDeploy${RESET}  ${DIM}Self-hosted PaaS${RESET}        ${MAGENTA}║${RESET}
+${MAGENTA}║${RESET}  ${GRAY}Deploy from Git or Docker in one click${RESET}   ${MAGENTA}║${RESET}
+${MAGENTA}╚${'═'.repeat(44)}╝${RESET}`;
+  console.log(gradient);
+  console.log();
+}
+
+/** Simple spinner that shows a message while a promise resolves. */
+export async function spinner<T>(msg: string, fn: () => Promise<T>): Promise<T> {
+  // Piped/CI stdout is not a TTY: `\r`-frames would smear braille garbage
+  // through captured logs. Non-TTY output stays to a single plain line.
+  const isTTY = process.stdout.isTTY === true;
+  const frames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+  let i = 0;
+  const interval = isTTY
+    ? setInterval(() => {
+        process.stdout.write(`\r${CYAN}${frames[i % frames.length]}${RESET} ${msg}...`);
+        i++;
+      }, 80)
+    : null;
+  if (!isTTY) process.stdout.write(`${msg}... `);
+  try {
+    const result = await fn();
+    clearInterval(interval ?? undefined);
+    if (isTTY) {
+      process.stdout.write(`\r${GREEN}✓${RESET} ${msg}\n`);
+    } else {
+      process.stdout.write(`✓\n`);
+    }
+    return result;
+  } catch (err) {
+    clearInterval(interval ?? undefined);
+    if (isTTY) {
+      process.stdout.write(`\r${RED}✗${RESET} ${msg}\n`);
+    } else {
+      process.stdout.write(`✗\n`);
+    }
+    throw err;
+  }
+}
+
+/** ANSI SGR escape sequence — built from a fragment so the source carries no
+ *  literal control character and the regex stays a literal (biome-friendly). */
+const ANSI_SGR = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g');
+
+/** Visible length: ANSI SGR escapes render as zero width, so they must not
+ *  count toward column widths or padding budgets. */
+function visibleLength(s: string): number {
+  return s.replace(ANSI_SGR, '').length;
+}
+
+/** Pad a (possibly colored) cell to `width` VISIBLE characters — padding is
+ *  appended after any reset escape, so escape bytes never consume the budget. */
+function padVisible(s: string, width: number): string {
+  return s + ' '.repeat(Math.max(0, width - visibleLength(s)));
+}
+
+/** Print a formatted table from an array of objects. */
+export function table(rows: Record<string, unknown>[], columns?: string[]): void {
+  if (rows.length === 0) { console.log(c.gray('  (empty)')); return; }
+  const cols = columns ?? Object.keys(rows[0] ?? {});
+  const widths = cols.map((col) => Math.max(col.length, ...rows.map((r) => visibleLength(String(r[col] ?? '')))));
+
+  // Header
+  const header = cols.map((col, i) => col.padEnd(widths[i]!)).join('  ');
+  console.log(`  ${c.bold(c.cyan(header))}`);
+  console.log(`  ${'─'.repeat(widths.reduce((a, b) => a + b + 2, -2))}`);
+
+  // Rows
+  for (const row of rows) {
+    const cells = cols.map((col, i) => {
+      const val = String(row[col] ?? '');
+      // statusColor AFTER padding would shift shorter cells; padVisible works
+      // for BOTH colored and pre-colored-by-the-caller values (call sites
+      // pass c.dim('—') / c.gray('never') straight into table()).
+      if (col === 'status' || col === 'health') return padVisible(statusColor(val), widths[i]!);
+      return padVisible(val, widths[i]!);
+    });
+    console.log(`  ${cells.join('  ')}`);
+  }
+  console.log();
+}
+
+/** Print a key-value pair with alignment. */
+export function kv(key: string, value: unknown, indent = 2): void {
+  const padded = ' '.repeat(indent);
+  const val = value === null || value === undefined ? c.gray('—') : String(value);
+  console.log(`${padded}${c.gray(key.padEnd(16))} ${val}`);
+}
+
+/** Print a section header. */
+export function header(title: string): void {
+  console.log();
+  console.log(`  ${c.bold(c.cyan(title))}`);
+  console.log(`  ${c.gray('─'.repeat(Math.max(title.length + 2, 30)))}`);
+}
+
+/** Print an error and mark the process as failed (exit code 1, no hard exit). */
+export function error(msg: string, code = 1): void {
+  console.error(`\n  ${c.red('✗')} ${msg}\n`);
+  process.exitCode = code;
+}
+
+/** Print a success message. */
+export function success(msg: string): void {
+  console.log(`  ${c.green('✓')} ${c.green(msg)}`);
+}
+
+/** Print an info message. */
+export function info(msg: string): void {
+  console.log(`  ${c.blue('ℹ')} ${c.dim(msg)}`);
+}
+
+/** Format bytes to human readable. */
+export function fmtBytes(b: number): string {
+  if (!b) return '0 B';
+  const mb = b / 1048576;
+  if (mb < 1) return `${(b / 1024).toFixed(0)} KB`;
+  if (mb >= 1024) return `${(mb / 1024).toFixed(2)} GB`;
+  return `${mb.toFixed(1)} MB`;
+}
+
+/** Format relative time. */
+export function fmtTime(ts: string | null | undefined): string {
+  if (!ts) return c.gray('never');
+  const diff = Date.now() - new Date(ts).getTime();
+  if (diff < 60000) return 'just now';
+  if (diff < 3600000) return `${Math.floor(diff / 60000)}m ago`;
+  if (diff < 86400000) return `${Math.floor(diff / 3600000)}h ago`;
+  return new Date(ts).toLocaleDateString();
+}

package/src/lib/panelBackupFile.ts

@@ -0,0 +1,67 @@
+import { createDecipheriv, scrypt as scryptCb } from 'node:crypto';
+import { createReadStream, createWriteStream, renameSync, unlinkSync } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+/**
+ * Offline reader for a sealed panel backup (`.ndpb`, format NDPB1) — the
+ * restore path that needs no running panel. Kept to node builtins only: it is
+ * the CLI twin of `decryptPanelBackupFile` in apps/server/src/lib/panelBackup.ts,
+ * and the server's tests open real server-written backups with this reader.
+ *
+ * Layout: "NDPB1:scrypt:<N>:<r>:<p>:<b64 salt>:<b64 iv>\n", AES-256-GCM
+ * ciphertext, 16-byte GCM tag. The header line is the GCM AAD; the key is
+ * scrypt(passphrase, salt, 32 bytes, N, r, p).
+ */
+const HEADER_RE = /^NDPB1:scrypt:(\d+):(\d+):(\d+):([A-Za-z0-9+/=]+):([A-Za-z0-9+/=]+)\n$/;
+const TAG_BYTES = 16;
+
+export const PANEL_BACKUP_DECRYPT_ERROR =
+  'Could not decrypt the panel backup: the recovery passphrase is wrong, or the file is damaged';
+
+export async function decryptPanelBackup(input: string, output: string, passphrase: string): Promise<void> {
+  const handle = await open(input, 'r');
+  let header = '';
+  const tag = Buffer.alloc(TAG_BYTES);
+  let size: number;
+  try {
+    size = (await handle.stat()).size;
+    const prefix = Buffer.alloc(Math.min(256, size));
+    await handle.read(prefix, 0, prefix.length, 0);
+    const nl = prefix.indexOf(0x0a);
+    if (nl >= 0) header = prefix.subarray(0, nl + 1).toString('utf8');
+    if (size >= TAG_BYTES) await handle.read(tag, 0, TAG_BYTES, size - TAG_BYTES);
+  } finally {
+    await handle.close();
+  }
+  const m = HEADER_RE.exec(header);
+  if (!m) throw new Error('Not a NineDeploy panel backup (missing NDPB1 header)');
+  const [N, r, p] = [Number(m[1]), Number(m[2]), Number(m[3])];
+  if (!(N >= 1 << 14 && N <= 1 << 20 && (N & (N - 1)) === 0) || r < 1 || r > 32 || p < 1 || p > 16) {
+    throw new Error('Unsupported panel backup key-derivation parameters');
+  }
+  const salt = Buffer.from(m[4]!, 'base64');
+  const iv = Buffer.from(m[5]!, 'base64');
+  const headerBytes = Buffer.byteLength(header);
+  if (iv.length !== 12 || salt.length < 16 || size < headerBytes + TAG_BYTES) throw new Error(PANEL_BACKUP_DECRYPT_ERROR);
+  const key = await new Promise<Buffer>((resolve, reject) =>
+    scryptCb(passphrase, salt, 32, { N, r, p, maxmem: 256 * N * r + 1024 * 1024 }, (err, k) => (err ? reject(err) : resolve(k))),
+  );
+  const decipher = createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAAD(Buffer.from(header));
+  decipher.setAuthTag(tag);
+  const dataEnd = size - TAG_BYTES - 1;
+  // The plaintext goes to a sibling file and replaces `output` only once the tag has verified: a wrong
+  // passphrase must not destroy a file already at `output` (or the sealed input, when it is the same path).
+  const partial = `${output}.${process.pid}.partial`;
+  try {
+    const source = dataEnd < headerBytes ? Readable.from([]) : createReadStream(input, { start: headerBytes, end: dataEnd });
+    await pipeline(source, decipher, createWriteStream(partial, { mode: 0o600, flags: 'wx' }));
+    renameSync(partial, output);
+  } catch {
+    // Nothing unauthenticated may be left behind for someone to import.
+    try { unlinkSync(partial); } catch { /* absent */ }
+    throw new Error(PANEL_BACKUP_DECRYPT_ERROR);
+  }
+}

package/src/lib/serverRunner.ts

@@ -0,0 +1,223 @@
+import { execFile } from 'node:child_process';
+import crypto from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const randomBytes = crypto.randomBytes.bind(crypto);
+
+export interface ServerRunnerOptions {
+  port?: number | string;
+  image?: string;
+  secret?: string;
+  containerName?: string;
+  /** Group id owning the host docker socket; resolved when omitted. */
+  dockerGid?: number | null;
+}
+
+/**
+ * r247: the group that owns the host's docker socket, on Linux. The image
+ * runs as the non-root `ninedeploy` user and the socket is typically
+ * root:docker 0660, so without `--group-add <gid>` every `docker` call the
+ * panel makes fails with "permission denied" (the compose file and the
+ * Dockerfile both document this; the CLI's own `docker run` skipped it).
+ * Docker Desktop (macOS/Windows) proxies the socket and needs nothing.
+ */
+export async function dockerSocketGid(platform: NodeJS.Platform = process.platform): Promise<number | null> {
+  if (platform !== 'linux') return null;
+  try {
+    return (await fs.stat('/var/run/docker.sock')).gid;
+  } catch {
+    return null;
+  }
+}
+
+export interface ContainerState {
+  exists: boolean;
+  running: boolean;
+  status: string;
+  id?: string;
+}
+
+/** Normalize server URLs (e.g. "localhost:3000" -> "http://localhost:3000"). */
+export function normalizeServerUrl(rawUrl: string): string {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) return 'http://localhost:3000';
+  // Scheme-less input defaults to http for localhost, https elsewhere — a
+  // bare "panel.example.com" is almost certainly TLS-terminated, and the
+  // bearer token must not ride plaintext HTTP to a remote host.
+  const withProtocol = /^https?:\/\//i.test(trimmed)
+    ? trimmed
+    : /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.test(trimmed)
+      ? `http://${trimmed}`
+      : `https://${trimmed}`;
+  return withProtocol.replace(/\/+$/, '');
+}
+
+/** Diagnoses common Docker errors and returns actionable recommendations. */
+export function formatDockerError(err: unknown): string {
+  const msg = err instanceof Error ? err.message : String(err);
+  if (/permission denied/i.test(msg) || /EACCES/i.test(msg)) {
+    return 'Docker socket permission denied. On Linux, run: `sudo usermod -aG docker $USER` and log back in, or run with sudo.';
+  }
+  if (/port is already allocated|address already in use/i.test(msg)) {
+    return 'Port conflict: The host port is already allocated. Use `--port <number>` to select another port.';
+  }
+  if (/already in use/i.test(msg) || /Conflict/i.test(msg)) {
+    return "Container conflict: A 'ninedeploy' container already exists. Run `ninedeploy server stop` or `docker rm -f ninedeploy`.";
+  }
+  return msg;
+}
+
+/** Check whether the Docker CLI is available on the current machine. */
+export async function isDockerAvailable(): Promise<boolean> {
+  try {
+    await execFileAsync('docker', ['--version']);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Probe if a NineDeploy server is responding on the given base URL. */
+export async function isServerReachable(baseUrl: string, timeoutMs = 1500): Promise<boolean> {
+  try {
+    const cleanUrl = normalizeServerUrl(baseUrl);
+    const url = new URL('/health', cleanUrl);
+    const res = await fetch(url.toString(), { signal: AbortSignal.timeout(timeoutMs) }).catch(() => null);
+    return res?.status === 200;
+  } catch {
+    return false;
+  }
+}
+
+/** Get Docker container status for the NineDeploy daemon. */
+export async function getContainerState(containerName = 'ninedeploy'): Promise<ContainerState> {
+  try {
+    const { stdout } = await execFileAsync('docker', [
+      'inspect',
+      '--format',
+      '{{.Id}}|{{.State.Running}}|{{.State.Status}}',
+      containerName,
+    ]);
+    const [id, runningStr, status] = stdout.trim().split('|');
+    return {
+      exists: true,
+      running: runningStr === 'true',
+      status: status || 'unknown',
+      id: id ? id.slice(0, 12) : undefined,
+    };
+  } catch {
+    return { exists: false, running: false, status: 'not found' };
+  }
+}
+
+/** Start or run the NineDeploy server Docker container. */
+/**
+ * The setup token a local panel container generated (0.16: a production
+ * panel without NINEDEPLOY_SETUP_TOKEN writes it to /data/setup-token).
+ * Null when the container is not there or has no token file.
+ */
+export async function readLocalSetupToken(containerName = 'ninedeploy'): Promise<string | null> {
+  try {
+    const { stdout } = await execFileAsync('docker', ['exec', containerName, 'cat', '/data/setup-token']);
+    const token = String(stdout).trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+
+export async function startServerContainer(
+  opts: ServerRunnerOptions = {},
+): Promise<{ port: number; newlyCreated: boolean }> {
+  const containerName = opts.containerName ?? 'ninedeploy';
+  const port = Number(opts.port ?? 3000);
+  const image = opts.image ?? 'ghcr.io/ninedeploy/ninedeploy:latest';
+  const secret = opts.secret ?? crypto.randomBytes(32).toString('hex');
+
+  const state = await getContainerState(containerName);
+  if (state.running) {
+    return { port, newlyCreated: false };
+  }
+
+  if (state.exists) {
+    try {
+      await execFileAsync('docker', ['start', containerName]);
+      return { port, newlyCreated: false };
+    } catch (err) {
+      throw new Error(formatDockerError(err));
+    }
+  }
+
+  // The JWT secret travels via --env-file (0600 temp file), NOT `-e` argv:
+  // values passed as `-e NAME=value` stay visible in `ps` and `docker inspect`
+  // forever, while the env file exists only for the duration of `docker run`.
+  const gid = opts.dockerGid !== undefined ? opts.dockerGid : await dockerSocketGid();
+  const envFile = join(tmpdir(), `nd_env_${randomBytes(8).toString('hex')}`);
+  await fs.writeFile(envFile, `NINEDEPLOY_JWT_SECRET=${secret}\n`, { mode: 0o600 });
+  const args = [
+    'run',
+    '-d',
+    '--name',
+    containerName,
+    '-v',
+    '/var/run/docker.sock:/var/run/docker.sock',
+    ...(gid != null ? ['--group-add', String(gid)] : []),
+    '-v',
+    'ninedeploy-data:/data',
+    '-p',
+    `${port}:3000`,
+    '--env-file',
+    envFile,
+    '-e',
+    'NINEDEPLOY_PORT=3000',
+    image,
+  ];
+
+  try {
+    await execFileAsync('docker', args);
+    return { port, newlyCreated: true };
+  } catch (err) {
+    throw new Error(formatDockerError(err));
+  } finally {
+    await fs.unlink(envFile).catch(() => undefined);
+  }
+}
+
+/** Stop the running NineDeploy server Docker container. */
+export async function stopServerContainer(containerName = 'ninedeploy'): Promise<void> {
+  try {
+    await execFileAsync('docker', ['stop', containerName]);
+  } catch (err) {
+    throw new Error(formatDockerError(err));
+  }
+}
+
+/** Get stdout logs from the NineDeploy server container. */
+export async function getServerLogs(containerName = 'ninedeploy', lines = 50): Promise<string> {
+  try {
+    const { stdout, stderr } = await execFileAsync('docker', ['logs', '--tail', String(lines), containerName]);
+    return stdout || stderr || '';
+  } catch (err) {
+    throw new Error(formatDockerError(err));
+  }
+}
+
+/** Polling loop waiting for the server to report reachable. */
+export async function waitForServerReady(
+  baseUrl: string,
+  maxAttempts = 30,
+  intervalMs = 1000,
+): Promise<boolean> {
+  const cleanUrl = normalizeServerUrl(baseUrl);
+  for (let i = 0; i < maxAttempts; i++) {
+    if (await isServerReachable(cleanUrl, 1000)) {
+      return true;
+    }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+  return false;
+}