opencode-ruby-upgrader 0.1.8 → 0.1.10

package/src/services.js

@@ -0,0 +1,129 @@
+// Service adapters for isolated target runtime.
+//
+// Each adapter defines container lifecycle (image, start args, readiness probe)
+// and the environment variables the app container needs to reach the service
+// over the per-run private Docker network. Only allowlisted adapter images are
+// permitted; no user-supplied images or environment values.
+
+import fs from "node:fs";
+import path from "node:path";
+
+const NAME = /^[a-z0-9][a-z0-9-]{0,127}$/;
+
+function waitSecond() { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1000); }
+
+function readyLoop({ probe, attempts, label }) {
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    if (probe().status === 0) return;
+    waitSecond();
+  }
+  throw new Error(`Target ${label} did not become ready within ${attempts} seconds. Rerun prepare-target-runtime --ruby <x.y.z>.`);
+}
+
+export const services = Object.freeze({
+  redis: Object.freeze({
+    type: "redis",
+    label: "Redis",
+    image: "redis:7-alpine",
+    port: 6379,
+    // Start Redis in the foreground with default config; no authentication in
+    // the isolated test network.
+    startArgs: () => ["redis:7-alpine", "redis-server", "--appendonly", "no"],
+    // Probe readiness with redis-cli against localhost.
+    readyArgs: (container) => ["exec", container, "redis-cli", "ping"],
+    // Expose REDIS_URL so the app reaches Redis over the private network by
+    // container name. Use DB 0 for test isolation by convention.
+    env: ({ container }) => ({ REDIS_URL: `redis://${container}:6379/0` }),
+    ensureReady: ({ probe }) => readyLoop({ probe, attempts: 30, label: "Redis" })
+  }),
+  chrome: Object.freeze({
+    type: "chrome",
+    label: "Chrome",
+    image: "selenium/standalone-chrome:latest",
+    port: 4444,
+    startArgs: () => ["--shm-size=2g", "selenium/standalone-chrome:latest"],
+    readyArgs: (container) => ["exec", container, "curl", "-s", "--fail", "http://localhost:4444/wd/hub/status"],
+    env: ({ container }) => ({
+      SELENIUM_URL: "http://chrome:4444/wd/hub",
+      CHROME_REMOTE_URL: "http://chrome:4444",
+      CAPYBARA_SERVER_HOST: "0.0.0.0"
+    }),
+    ensureReady: ({ probe }) => readyLoop({ probe, attempts: 120, label: "Chrome" })
+  }),
+  selenium: Object.freeze({
+    type: "selenium",
+    label: "Selenium",
+    image: "selenium/standalone-chrome:latest",
+    port: 4444,
+    startArgs: () => ["--shm-size=2g", "selenium/standalone-chrome:latest"],
+    readyArgs: (container) => ["exec", container, "curl", "-s", "--fail", "http://localhost:4444/wd/hub/status"],
+    env: ({ container }) => ({
+      SELENIUM_URL: "http://selenium:4444/wd/hub",
+      CHROME_REMOTE_URL: "http://selenium:4444",
+      CAPYBARA_SERVER_HOST: "0.0.0.0"
+    }),
+    ensureReady: ({ probe }) => readyLoop({ probe, attempts: 120, label: "Selenium" })
+  })
+});
+
+export function resolveService(type) {
+  if (!type || !Object.hasOwn(services, type)) return undefined;
+  return services[type];
+}
+
+export function resolveServices(types = []) {
+  const result = [];
+  const seen = new Set();
+  for (const type of types) {
+    if (seen.has(type)) continue;
+    const svc = resolveService(type);
+    if (svc) { result.push({ type, adapter: svc }); seen.add(type); }
+  }
+  return result;
+}
+
+const REDIS_EVIDENCE = [
+  /\bgem\s*\(?\s*["']redis["']/i,
+  /\bgem\s*\(?\s*["']sidekiq["']/i,
+  /\bgem\s*\(?\s*["']resque["']/i,
+  /\bgem\s*\(?\s*["']redis-rails["']/i,
+  /\bredis\.yml\b/i,
+  /\bRedis\.new\b/i,
+  /\bSidekiq\.configure_server\b/i,
+  /\bREDIS_URL\b/i
+];
+const REDIS_LOCK = /^[ \t]*redis \(/m;
+const REDIS_LOCK_SIDEKIQ = /^[ \t]*sidekiq \(/m;
+const REDIS_LOCK_RESQUE = /^[ \t]*resque \(/m;
+
+export function detectServices(root = process.cwd()) {
+  const read = (file) => {
+    try { return fs.readFileSync(path.join(root, file), "utf8"); } catch { return ""; }
+  };
+  const uncommented = (contents) => contents.replace(/#.*$/gm, "");
+  const contents = [
+    "config/database.yml",
+    "Gemfile",
+    "Gemfile.lock",
+    "config/application.rb",
+    "config/environments/test.rb",
+    "config/environments/development.rb",
+    "config/initializers/sidekiq.rb",
+    "config/sidekiq.yml"
+  ].map(read).join("\n");
+  const text = uncommented(contents);
+  const lock = `${uncommented(read("Gemfile.lock"))}\n`;
+  const services = [];
+  const hasRedis = REDIS_EVIDENCE.some((re) => re.test(text)) ||
+    REDIS_LOCK.test(lock) ||
+    REDIS_LOCK_SIDEKIQ.test(lock) ||
+    REDIS_LOCK_RESQUE.test(lock);
+  if (hasRedis) services.push("redis");
+  const hasChrome = /driven_by\s*:\s*(?:selenium|cuprite|chrome)/i.test(text) ||
+    /selenium-webdriver|cuprite|capybara/i.test(text + lock);
+  if (hasChrome) services.push("chrome");
+  // De-duplicate while preserving order
+  return [...new Set(services)];
+}
+
+export { NAME };

package/src/target-runtime.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { RunStateError, readRun } from "./run-state.js";
 import { NAME, databases, detectDatabase, resolveDatabase } from "./databases.js";
+import { services as serviceAdapters, detectServices, resolveServices } from "./services.js";
 
 const RUNTIME_FILE = "runtime.json";
 const LABEL = "io.opencode-ruby-upgrader.run-id";
@@ -46,27 +47,36 @@ function preparationResult(result) {
   return { sha256: crypto.createHash("sha256").update(output).digest("hex"), bytes: Buffer.byteLength(output) };
 }
 function bootstrap(spawn, runtime, db, rails) {
-  const labels = ["Node.js setup", "Bundler installation", "dependency installation", ...(rails ? [`${db.label} test database initialization`] : []), "Ruby version attestation"];
+  const labels = ["Node.js setup", "Bundler installation", "dependency installation", ...(rails ? [`${db.label} test database initialization`] : []), "Ruby version attestation", "Bundler version attestation"];
   const commands = [
     ["exec", runtime.appContainer, "sh", "-c", NODE_INSTALL],
-    ["exec", runtime.appContainer, "gem", "install", "bundler", "-v", "2.4.22", "--no-document"],
-    ["exec", runtime.appContainer, "bundle", "_2.4.22_", "install"],
+    ["exec", runtime.appContainer, "gem", "install", "bundler", "-v", runtime.bundlerToInstall ?? "2.4.22", "--no-document"],
+    ["exec", runtime.appContainer, "bundle", `_${runtime.bundlerToInstall ?? "2.4.22"}_`, "install"],
     ...(rails ? [db.createArgs({ appContainer: runtime.appContainer, databaseContainer: runtime.databaseContainer })] : []),
-    ["exec", runtime.appContainer, "ruby", "--version"]
+    ["exec", runtime.appContainer, "ruby", "--version"],
+    // Attest the Bundler version actually installed, so the report can warn when
+    // CI/host bundler differs. `gem install` output is advisory; `--version` is
+    // authoritative for what `bundle exec` will actually resolve.
+    ["exec", runtime.appContainer, "bundle", `_${runtime.bundlerToInstall ?? "2.4.22"}_`, "--version"]
   ];
   const results = commands.map((args, index) => {
     const result = docker(spawn, args);
     if (result.status !== 0) throw new Error(`Target runtime bootstrap failed during ${labels[index]}. Rerun prepare-target-runtime --ruby <x.y.z>.`);
     return result;
   });
-  const rubyOutput = `${results.at(-1).stdout ?? ""}${results.at(-1).stderr ?? ""}`;
+  // Index the attestations explicitly rather than from the end of the array:
+  // `ruby --version` is no longer the final command, and an off-by-one here would
+  // validate the Bundler banner against the Ruby regex.
+  const rubyIndex = 3 + (rails ? 1 : 0);
+  const rubyOutput = `${results[rubyIndex].stdout ?? ""}${results[rubyIndex].stderr ?? ""}`;
   if (!new RegExp(`^ruby ${runtime.ruby.replaceAll(".", "\\.")}(?:p\\d+|\\s|$)`).test(rubyOutput.trim())) throw new Error("Target runtime did not execute the requested Ruby version.");
   return {
     node: preparationResult(results[0]),
     bundler: preparationResult(results[1]),
     bundleInstall: preparationResult(results[2]),
     ...(rails ? { databaseCreate: preparationResult(results[3]) } : {}),
-    rubyVersion: preparationResult(results.at(-1))
+    rubyVersion: preparationResult(results[rubyIndex]),
+    bundlerVersion: `${results.at(-1).stdout ?? ""}${results.at(-1).stderr ?? ""}`.trim()
   };
 }
 function railsProject(root) {
@@ -108,7 +118,11 @@ function appMatches(container, root, runtime, db) {
   const env = environment(container);
   const mounts = container?.Mounts ?? [];
   const command = container?.Config?.Cmd ?? [];
-  return container?.State?.Running && container?.Config?.Image === `ruby:${runtime.ruby}` && container?.Config?.WorkingDir === "/app" && mounts.length === 1 && mountedFromRoot(container, root) && command.length === 2 && command[0] === "sleep" && command[1] === "infinity" && onlyNetwork(container, runtime.network) && isolatedContainer(container) && env.RAILS_ENV === "test" && env.DATABASE_URL === db.databaseUrl(runtime.databaseContainer);
+    const servicesMatch = !runtime.services || runtime.services.every((svc) => {
+    const expected = serviceAdapters[svc.type]?.env?.({ container: svc.container }) || {};
+    return Object.entries(expected).every(([k, v]) => env[k] === v);
+  });
+  return container?.State?.Running && container?.Config?.Image === `ruby:${runtime.ruby}` && container?.Config?.WorkingDir === "/app" && mounts.length === 1 && mountedFromRoot(container, root) && command.length === 2 && command[0] === "sleep" && command[1] === "infinity" && onlyNetwork(container, runtime.network) && isolatedContainer(container) && env.RAILS_ENV === "test" && env.DATABASE_URL === db.databaseUrl(runtime.databaseContainer) && servicesMatch;
 }
 function databaseMatches(container, runtime, db) {
   const env = environment(container);
@@ -133,9 +147,13 @@ function selectedRun(root, reportPath) {
   if (!["in_progress", "paused"].includes(run.status)) throw new RunStateError("Target runtime preparation requires an active or paused upgrade run.", "run-not-resumable");
   return { reportPath, run };
 }
-function names(runId, db) {
+function names(runId, db, serviceList = []) {
   const prefix = `ruby-upgrader-${runId}`;
-  return { appContainer: `${prefix}-app`, databaseContainer: `${prefix}-${db.adapter}`, network: `${prefix}-network` };
+  const out = { appContainer: `${prefix}-app`, databaseContainer: `${prefix}-${db.adapter}`, network: `${prefix}-network` };
+  for (const svc of serviceList) {
+    out[`${svc.type}Container`] = `${prefix}-${svc.type}`;
+  }
+  return out;
 }
 function writeRuntime(root, runtime) {
   const file = runtimePath(root, true);
@@ -155,6 +173,7 @@ export function readTargetRuntime(root = process.cwd()) {
       runtime = { ...legacy, database: "postgres", databaseContainer: postgresContainer };
     }
     if (runtime?.version !== 2 || typeof runtime.runId !== "string" || !rubyVersion.test(runtime.ruby ?? "") || !/^sha256:[a-f0-9]{64}$/i.test(runtime.resolvedImageId ?? "") || (runtime.databaseImageId !== undefined && !/^sha256:[a-f0-9]{64}$/i.test(runtime.databaseImageId)) || !runtime.preparation || !Object.hasOwn(databases, runtime.database) || ![runtime.appContainer, runtime.databaseContainer, runtime.network].every((name) => NAME.test(name ?? ""))) throw new Error();
+    if (runtime.services && !Array.isArray(runtime.services)) throw new Error();
     return runtime;
   } catch { throw new Error("Target runtime metadata is invalid. Rerun prepare-target-runtime --ruby <x.y.z>."); }
 }
@@ -163,8 +182,13 @@ export function prepareTargetRuntime({ root = process.cwd(), reportPath, ruby, d
   if (!rubyVersion.test(ruby ?? "")) throw new Error("--ruby must be an exact numeric Ruby version such as 3.4.1.");
   const canonical = canonicalRoot(root);
   const db = resolveDatabase(database ?? detectDatabase(canonical));
+  const detectedServices = detectServices(canonical);
+  const serviceList = resolveServices(detectedServices);
   const selected = selectedRun(canonical, reportPath);
-  const runtime = { version: 2, runId: selected.run.runId, reportPath: selected.reportPath, ruby, database: db.adapter, ...names(selected.run.runId, db) };
+  const run = readRun(canonical, selected.reportPath);
+  const bundlerToInstall = run.reportType === "bundler_bridge" ? run.targetBundler : (run.bundlerBridge ? run.bundlerBridge.bundlerTo : undefined) || "2.4.22";
+  const runtimeNames = names(selected.run.runId, db, serviceList);
+  const runtime = { version: 2, runId: selected.run.runId, reportPath: selected.reportPath, ruby, database: db.adapter, bundlerToInstall, services: [], ...runtimeNames };
   const owner = identity(runtime.runId, canonical);
   const existing = readTargetRuntime(canonical);
   if (existing && existing.runId !== runtime.runId) {
@@ -176,7 +200,9 @@ export function prepareTargetRuntime({ root = process.cwd(), reportPath, ruby, d
   let app = docker(spawn, ["inspect", runtime.appContainer]);
   let network = docker(spawn, ["network", "inspect", runtime.network]);
   const databaseInspections = new Map(databaseNames.map((name) => [name, docker(spawn, ["inspect", name])]));
-  const resources = [app.status === 0 && parseInspection(app), network.status === 0 && parseInspection(network), ...[...databaseInspections.values()].filter((result) => result.status === 0).map(parseInspection)].filter(Boolean);
+  const serviceNames = serviceList.map((svc) => runtimeNames[`${svc.type}Container`]).filter(Boolean);
+  const serviceInspections = new Map(serviceNames.map((name) => [name, docker(spawn, ["inspect", name])]));
+  const resources = [app.status === 0 && parseInspection(app), network.status === 0 && parseInspection(network), ...[...databaseInspections.values()].filter((result) => result.status === 0).map(parseInspection), ...[...serviceInspections.values()].filter((result) => result.status === 0).map(parseInspection)].filter(Boolean);
 for (const resource of resources) {
     const resourceLabels = labels(resource);
     if (resourceLabels[LABEL] !== owner.runId || (resourceLabels[WORKTREE_LABEL] !== undefined && resourceLabels[WORKTREE_LABEL] !== owner.worktreeHash)) throw new Error("Refusing to use or replace a Docker resource not owned by this run and worktree.");
@@ -184,7 +210,7 @@ for (const resource of resources) {
   const legacy = resources.some((resource) => labels(resource)[WORKTREE_LABEL] === undefined);
   if (legacy && resources.length) {
     if (app.status !== 0 || !mountedFromRoot(parseInspection(app), canonical)) throw new Error("Refusing to migrate legacy Docker resources because ownership by this worktree cannot be established.");
-    for (const [name, result] of [[runtime.appContainer, app], ...databaseInspections]) {
+    for (const [name, result] of [[runtime.appContainer, app], ...databaseInspections, ...serviceInspections]) {
       if (result.status === 0 && docker(spawn, ["rm", "--force", name]).status !== 0) throw new Error("Could not remove a legacy target-runtime container.");
     }
     if (network.status !== 0 && docker(spawn, ["network", "rm", runtime.network]).status !== 0) throw new Error("Could not remove the legacy target-runtime Docker network.");
@@ -216,6 +242,37 @@ for (const resource of resources) {
     try { docker(spawn, ["rm", "--force", runtime.databaseContainer]); } catch {}
     throw error;
   }
+  // Provision additional service containers (evidence-based)
+  const serviceStates = [];
+  for (const svc of serviceList) {
+    const svcContainer = runtimeNames[`${svc.type}Container`];
+    let svcResult = serviceInspections.get(svcContainer) ?? { status: 1 };
+    if (svcResult.status === 0) {
+      const c = parseInspection(svcResult);
+      const expectedEnv = (serviceAdapters[svc.type]?.env?.({ container: svcContainer }) || {});
+      const env = environment(c);
+      const hasBindMount = (c?.Mounts ?? []).some((mount) => mount.Type === "bind");
+      const owned = hasOwnership(c, owner);
+      const matches = c?.State?.Running && c?.Config?.Image === svc.adapter.image && onlyNetwork(c, runtime.network) && isolatedContainer(c) && !hasBindMount && owned && Object.entries(expectedEnv).every(([k, v]) => env[k] === v);
+      if (!matches) {
+        if (docker(spawn, ["rm", "--force", svcContainer]).status !== 0) throw new Error(`Could not replace the prior target-runtime ${svc.adapter.label} container.`);
+        svcResult = docker(spawn, ["inspect", svcContainer]);
+      }
+    }
+    if (svcResult.status !== 0) {
+      if (docker(spawn, ["run", "--detach", "--name", svcContainer, ...ownershipArgs, "--network", runtime.network, ...svc.adapter.startArgs()]).status !== 0) throw new Error(`Could not start the isolated target-runtime ${svc.adapter.label} container.`);
+    }
+    try {
+      svc.adapter.ensureReady({ probe: () => docker(spawn, svc.adapter.readyArgs(svcContainer)) });
+    } catch (error) {
+      try { docker(spawn, ["rm", "--force", svcContainer]); } catch {}
+      throw error;
+    }
+    const svcInspection = inspect(spawn, svcContainer, `Target ${svc.adapter.label} container is unavailable. Rerun prepare-target-runtime --ruby <x.y.z>.`);
+    if (!/^sha256:[a-f0-9]{64}$/i.test(svcInspection?.Image ?? "")) throw new Error(`Target ${svc.adapter.label} image ID is unavailable.`);
+    serviceStates.push({ type: svc.type, container: svcContainer, imageId: svcInspection.Image });
+    runtime.services = serviceStates;
+  }
   if (app.status === 0) {
     const container = parseInspection(app);
     if (!appMatches(container, canonical, runtime, db)) {
@@ -223,7 +280,13 @@ for (const resource of resources) {
       app = docker(spawn, ["inspect", runtime.appContainer]);
     }
   }
-  if (app.status !== 0 && docker(spawn, ["run", "--detach", "--name", runtime.appContainer, ...ownershipArgs, "--network", runtime.network, "--mount", `type=bind,src=${canonical},dst=/app`, "--workdir", "/app", "--env", "RAILS_ENV=test", "--env", `DATABASE_URL=${db.databaseUrl(runtime.databaseContainer)}`, `ruby:${ruby}`, "sleep", "infinity"]).status !== 0) throw new Error("Could not start the target Ruby app container.");
+  const appEnv = ["--env", "RAILS_ENV=test", "--env", `DATABASE_URL=${db.databaseUrl(runtime.databaseContainer)}`];
+  for (const svc of serviceList) {
+    const svcContainer = runtimeNames[`${svc.type}Container`];
+    const envs = serviceAdapters[svc.type]?.env?.({ container: svcContainer }) || {};
+    for (const [k, v] of Object.entries(envs)) appEnv.push("--env", `${k}=${v}`);
+  }
+  if (app.status !== 0 && docker(spawn, ["run", "--detach", "--name", runtime.appContainer, ...ownershipArgs, "--network", runtime.network, "--mount", `type=bind,src=${canonical},dst=/app`, "--workdir", "/app", ...appEnv, `ruby:${ruby}`, "sleep", "infinity"]).status !== 0) throw new Error("Could not start the target Ruby app container.");
   const prepared = bootstrap(spawn, runtime, db, railsProject(canonical));
   const appInspection = inspect(spawn, runtime.appContainer, "Target Ruby app container is unavailable. Rerun prepare-target-runtime --ruby <x.y.z>.");
   const databaseInspection = inspect(spawn, runtime.databaseContainer, `Target ${db.label} container is unavailable. Rerun prepare-target-runtime --ruby <x.y.z>.`);
@@ -250,5 +313,10 @@ export function validateTargetRuntime({ root = process.cwd(), runtime = readTarg
   const expectedIds = [app?.Id, database?.Id].sort();
   const valid = appMatches(app, canonical, runtime, db) && databaseMatches(database, runtime, db) && hasOwnership(network, owner) && hasOwnership(app, owner) && hasOwnership(database, owner) && connectedIds.length === 2 && connectedIds.every((id, index) => id === expectedIds[index]) && app?.Image === runtime.resolvedImageId && (!runtime.databaseImageId || database?.Image === runtime.databaseImageId) && env.RAILS_ENV === "test" && env.DATABASE_URL === db.databaseUrl(runtime.databaseContainer);
   if (!valid) throw new Error("Target runtime no longer matches its prepared run. Rerun prepare-target-runtime --ruby <x.y.z>.");
-  return { runId: runtime.runId, reportPath: runtime.reportPath, name: runtime.appContainer, id: app.Id, imageId: app.Image, imageRef: app.Config.Image, ruby: runtime.ruby, database: runtime.database, databaseContainer: runtime.databaseContainer, databaseContainerId: database.Id, databaseImageId: database.Image, databaseImageRef: database.Config.Image, network: runtime.network, networkId: network.Id };
+  // bundlerVersion is surfaced so the generated report can warn that the deploy
+  // host and CI may resolve a different Bundler than this container pinned. It
+  // comes from `bundle --version` in the prepared container, not from the
+  // bootstrap log, so it reflects what `bundle exec` actually resolved.
+  const bundlerVersion = /Bundler version (\d+(?:\.\d+)+)/.exec(runtime.preparation?.bundlerVersion ?? "")?.[1] ?? undefined;
+  return { runId: runtime.runId, reportPath: runtime.reportPath, name: runtime.appContainer, id: app.Id, imageId: app.Image, imageRef: app.Config.Image, ruby: runtime.ruby, ...(bundlerVersion ? { bundlerVersion } : {}), database: runtime.database, databaseContainer: runtime.databaseContainer, databaseContainerId: database.Id, databaseImageId: database.Image, databaseImageRef: database.Config.Image, network: runtime.network, networkId: network.Id };
 }