openship 0.1.0 → 0.1.1

package/apps/api/src/modules/settings/settings.controller.ts

@@ -0,0 +1,55 @@
+import type { Context } from "hono";
+import { getUserId } from "../../lib/controller-helpers";
+import { repos } from "@repo/db";
+import { randomBytes } from "node:crypto";
+import { getBuildMode, type BuildMode } from "./settings.service";
+
+const VALID_MODES: BuildMode[] = ["auto", "server", "local"];
+
+function generateId() {
+  return "us_" + randomBytes(12).toString("base64url");
+}
+
+/** GET / — return platform settings for the authenticated user */
+export async function get(c: Context) {
+  const userId = getUserId(c);
+  return c.json({ buildMode: await getBuildMode(userId) });
+}
+
+/** PUT / — create or update platform settings */
+export async function upsert(c: Context) {
+  const userId = getUserId(c);
+  const body = await c.req.json();
+
+  const buildMode = body.buildMode || "auto";
+  if (!VALID_MODES.includes(buildMode)) {
+    return c.json({ error: "buildMode must be 'auto', 'server', or 'local'" }, 400);
+  }
+
+  const row = await repos.settings.upsert({
+    id: generateId(),
+    userId,
+    buildMode,
+  });
+
+  return c.json({ buildMode: row.buildMode });
+}
+
+/** PATCH /build-mode — update just the build mode preference */
+export async function updateBuildMode(c: Context) {
+  const userId = getUserId(c);
+  const { buildMode } = await c.req.json();
+
+  if (!VALID_MODES.includes(buildMode)) {
+    return c.json({ error: "buildMode must be 'auto', 'server', or 'local'" }, 400);
+  }
+
+  const existing = await repos.settings.findByUser(userId);
+  if (!existing) {
+    await repos.settings.upsert({ id: generateId(), userId, buildMode });
+  } else {
+    await repos.settings.update(userId, { buildMode });
+  }
+
+  return c.json({ buildMode });
+}

package/apps/api/src/modules/settings/settings.routes.ts

@@ -0,0 +1,25 @@
+/**
+ * Settings routes — mounted at /api/settings in app.ts.
+ *
+ * All routes require authentication. Manages user platform preferences
+ * (build mode, etc.) that sync across devices and to Openship Cloud.
+ *
+ * System-level settings (SSH creds, server connection) are stored locally
+ * in Electron's ConfigStore — they never touch this API.
+ */
+import { Hono } from "hono";
+import { authMiddleware } from "../../middleware/auth";
+import * as ctrl from "./settings.controller";
+
+export const settingsRoutes = new Hono();
+
+settingsRoutes.use("*", authMiddleware);
+
+/** GET  /            — get current user's workspace settings */
+settingsRoutes.get("/", ctrl.get);
+
+/** PUT  /            — create or update workspace settings */
+settingsRoutes.put("/", ctrl.upsert);
+
+/** PATCH /build-mode — update only build mode preference */
+settingsRoutes.patch("/build-mode", ctrl.updateBuildMode);

package/apps/api/src/modules/settings/settings.service.ts

@@ -0,0 +1,49 @@
+/**
+ * Settings service — business logic for user platform preferences.
+ *
+ * Used by:
+ *   - settings.controller.ts (HTTP layer)
+ *   - build.service.ts (build strategy resolution)
+ */
+
+import { repos } from "@repo/db";
+import { STACKS, type StackId, type StackDefinition } from "@repo/core";
+import type { BuildStrategy } from "@repo/adapters";
+
+export type BuildMode = "auto" | "server" | "local";
+
+/** Get the user's build mode preference (defaults to "auto" if no row exists) */
+export async function getBuildMode(userId: string): Promise<BuildMode> {
+  const settings = await repos.settings.findByUser(userId);
+  return (settings?.buildMode as BuildMode) ?? "auto";
+}
+
+/**
+ * Resolve the effective build strategy for a deployment.
+ *
+ * The per-deploy value sent by the UI is the source of truth.
+ * The global user preference is only used as an initial default
+ * in the dashboard when preparing a new deploy — it should NOT
+ * override an explicit per-deploy choice here.
+ *
+ * Priority chain:
+ *   1. Explicit per-deploy value (always sent by the dashboard)
+ *   2. Stack default (STACKS[framework].defaultBuildStrategy)
+ *   3. Fallback: "server"
+ */
+export async function resolveStrategy(
+  _userId: string,
+  framework: string | undefined,
+  explicit?: BuildStrategy,
+): Promise<BuildStrategy> {
+  // 1. Per-deploy explicit value (source of truth)
+  if (explicit) return explicit;
+
+  // 2. Stack default → 3. Fallback
+  const stackId = framework as StackId;
+  const stackDef: StackDefinition | undefined =
+    stackId && stackId in STACKS
+      ? (STACKS[stackId] as StackDefinition)
+      : undefined;
+  return stackDef?.defaultBuildStrategy ?? "server";
+}

package/apps/api/src/modules/system/filesystem.controller.ts

@@ -0,0 +1,66 @@
+/**
+ * Filesystem controller — browse local directories.
+ *
+ * Self-hosted only. Provides directory listing with project detection
+ * so the UI can let users pick a folder to deploy.
+ *
+ * Security: This module is only loaded via dynamic import in self-hosted
+ * mode. The handler also checks CLOUD_MODE as defense-in-depth.
+ */
+
+import type { Context } from "hono";
+import { readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { MANIFEST_FILES } from "../../lib/stack-detector";
+import { env } from "../../config";
+
+/** package.json + compose files aren't in MANIFEST_FILES (handled separately in stack detector) */
+const PROJECT_MARKERS = new Set([
+  "package.json",
+  "docker-compose.yml",
+  "docker-compose.yaml",
+  ...MANIFEST_FILES,
+]);
+
+/** GET /system/browse?path=/some/dir — list child directories */
+export async function browse(c: Context) {
+  if (env.CLOUD_MODE) return c.notFound();
+
+  const raw = c.req.query("path") || homedir();
+  const dirPath = resolve(raw);
+
+  try {
+    const st = await stat(dirPath);
+    if (!st.isDirectory()) return c.json({ error: "Not a directory" }, 400);
+  } catch {
+    return c.json({ error: "Directory not found" }, 404);
+  }
+
+  const entries = await readdir(dirPath, { withFileTypes: true });
+  const dirs: { name: string; path: string; isProject: boolean }[] = [];
+
+  await Promise.all(
+    entries
+      .filter((e) => e.isDirectory() && !e.name.startsWith("."))
+      .map(async (e) => {
+        const childPath = join(dirPath, e.name);
+        let isProject = false;
+        try {
+          const children = await readdir(childPath);
+          isProject = children.some((m) => PROJECT_MARKERS.has(m));
+        } catch {
+          /* unreadable dir — skip marker check */
+        }
+        dirs.push({ name: e.name, path: childPath, isProject });
+      }),
+  );
+
+  // Projects first, then alphabetical
+  dirs.sort((a, b) => {
+    if (a.isProject !== b.isProject) return a.isProject ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+
+  return c.json({ path: dirPath, directories: dirs });
+}

package/apps/api/src/modules/system/index.ts

@@ -0,0 +1 @@
+export { systemRoutes } from "./system.routes";

package/apps/api/src/modules/system/server-check.controller.ts

@@ -0,0 +1,475 @@
+/**
+ * Server check & install controller — runs system health checks and
+ * component installation against the configured remote server.
+ *
+ * Uses the shared SSH connection manager so all server interactions go
+ * through one cached executor handler with idle TTL + optional
+ * persistent mode.
+ *
+ * Security:
+ *   - Gated behind localOnly + authMiddleware (no cloud, no unauthenticated)
+ *   - SSH credentials are read from DB, never from request body
+ *   - Component names are validated against a known allowlist
+ */
+
+import type { Context } from "hono";
+import { streamSSE } from "hono/streaming";
+import { env } from "../../config";
+import {
+  checkAllComponents,
+  checkComponents,
+  COMPONENT_INSTALLERS,
+  isSshAuthError,
+  SYSTEM_COMPONENTS,
+  getSystemComponentDefinition,
+} from "@repo/adapters";
+import { formatDuration, systemDebug } from "@/lib/system-debug";
+import { sshManager } from "../../lib/ssh-manager";
+import {
+  createSetupSession,
+  getSetupSession,
+  getActiveSetupSession,
+  updateComponentProgress,
+  appendSetupLog,
+  finishSetupSession,
+  subscribeSetupSession,
+} from "./setup-session";
+
+function debugSystemRequest(message: string): void {
+  systemDebug("system-check", message);
+}
+
+// ─── Allowlisted components ──────────────────────────────────────────────────
+
+const ALLOWED_COMPONENTS = new Set(
+  SYSTEM_COMPONENTS.filter((component) => component.installable).map(
+    (component) => component.name,
+  ),
+);
+
+// ─── Handlers ────────────────────────────────────────────────────────────────
+
+/**
+ * POST /system/check
+ *
+ * Run system health checks against the configured remote server.
+ * Optionally accepts { components: ["docker", "git"] } to check a subset.
+ *
+ * Returns: { components: ComponentStatus[], ready: boolean, missing: string[] }
+ */
+export async function checkServer(c: Context) {
+  if (env.CLOUD_MODE) return c.json({ error: "Not available" }, 404);
+
+  const startedAt = Date.now();
+
+  try {
+    const body = await c.req.json().catch(() => ({}));
+    const requestedComponents = body.components as string[] | undefined;
+    debugSystemRequest(
+      `check:start ${requestedComponents?.length ? requestedComponents.join(",") : "all"}`,
+    );
+
+    let components;
+    if (requestedComponents?.length) {
+      // Validate against allowlist
+      const valid = requestedComponents.filter((n) => ALLOWED_COMPONENTS.has(n));
+      if (valid.length === 0) {
+        return c.json({ error: "Invalid component names" }, 400);
+      }
+      components = await sshManager.withExecutor((executor) =>
+        checkComponents(executor, valid),
+      );
+    } else {
+      components = await sshManager.withExecutor((executor) =>
+        checkAllComponents(executor),
+      );
+    }
+
+    const missing = components
+      .filter((c) => !c.healthy)
+      .map((c) => c.name);
+
+    debugSystemRequest(
+      `check:done ready=${missing.length === 0} missing=${missing.join(",") || "none"} (${formatDuration(startedAt)})`,
+    );
+    return c.json({
+      components,
+      ready: missing.length === 0,
+      missing,
+    });
+  } catch (err) {
+    const message =
+      err instanceof Error ? err.message : "Failed to connect to server";
+    debugSystemRequest(`check:failed ${message} (${formatDuration(startedAt)})`);
+    if (
+      message === "No server configured" ||
+      message === "Invalid SSH auth configuration"
+    ) {
+      return c.json({ error: "no_server", message }, 400);
+    }
+    if (isSshAuthError(err)) {
+      return c.json({ error: "auth_failed", message }, 400);
+    }
+    return c.json({ error: "connection_failed", message }, 502);
+  }
+}
+
+/**
+ * POST /system/install
+ *
+ * Install a specific component on the configured remote server.
+ * Body: { component: "docker" | "traefik" | "git" | "node" | "bun", config?: InstallerConfig }
+ *
+ * Returns: { success: boolean, component: string, version?: string, error?: string }
+ */
+export async function installComponent(c: Context) {
+  if (env.CLOUD_MODE) return c.json({ error: "Not available" }, 404);
+
+  const body = await c.req.json().catch(() => ({}));
+  const componentName = body.component as string;
+
+  if (!componentName || !ALLOWED_COMPONENTS.has(componentName)) {
+    return c.json({ error: "Invalid or missing component name" }, 400);
+  }
+
+  const installerFn =
+    COMPONENT_INSTALLERS[componentName as keyof typeof COMPONENT_INSTALLERS];
+  if (!installerFn) {
+    return c.json({ error: `No installer for ${componentName}` }, 400);
+  }
+
+  try {
+    const logs: string[] = [];
+    const installResult = await sshManager.withExecutor((executor) =>
+      installerFn(
+        executor,
+        (log) => logs.push(log.message),
+        body.config ?? {},
+      ),
+    );
+
+    return c.json({
+      ...installResult,
+      logs,
+    });
+  } catch (err) {
+    const message =
+      err instanceof Error ? err.message : "Installation failed";
+    if (
+      message === "No server configured" ||
+      message === "Invalid SSH auth configuration"
+    ) {
+      return c.json({ error: "no_server", message }, 400);
+    }
+    if (isSshAuthError(err)) {
+      return c.json({ error: "auth_failed", message }, 400);
+    }
+    return c.json({ error: "install_failed", message }, 502);
+  }
+}
+
+/**
+ * POST /system/install/stream
+ *
+ * Install multiple components with real-time SSE log streaming.
+ * Body: { components: ["docker", "traefik", ...], config?: InstallerConfig }
+ *
+ * Returns an SSE stream with events:
+ *   - progress: component status updates
+ *   - log: real-time log lines from installers
+ *   - complete: final result when all installs finish
+ *   - end: stream terminated
+ */
+export async function installStream(c: Context) {
+  if (env.CLOUD_MODE) return c.json({ error: "Not available" }, 404);
+
+  const body = await c.req.json().catch(() => ({}));
+  const requestedComponents = body.components as string[] | undefined;
+  const config = body.config ?? {};
+
+  if (!requestedComponents?.length) {
+    return c.json({ error: "No components specified" }, 400);
+  }
+
+  // Validate all component names
+  const validNames = requestedComponents.filter((n) => ALLOWED_COMPONENTS.has(n));
+  if (validNames.length === 0) {
+    return c.json({ error: "Invalid component names" }, 400);
+  }
+
+  // Check for already running session
+  const existing = getActiveSetupSession();
+  if (existing) {
+    return c.json({ error: "install_in_progress", sessionId: existing.id }, 409);
+  }
+
+  // Create session
+  const componentMeta = validNames.map((name) => {
+    const def = getSystemComponentDefinition(name);
+    return { name, label: def.label };
+  });
+  const session = createSetupSession(componentMeta);
+
+  return streamSSE(c, async (sseStream) => {
+    let closed = false;
+
+    const writer = (event: string, data: string): boolean => {
+      if (closed) return false;
+      try {
+        void sseStream.writeSSE({ event, data });
+        return true;
+      } catch {
+        return false;
+      }
+    };
+
+    // Subscribe this connection as the first listener
+    const { unsubscribe } = subscribeSetupSession(session.id, writer);
+
+    // Run installs in background — don't await inline,
+    // the SSE stream stays open via the promise below
+    const installPromise = (async () => {
+      let hasFailure = false;
+
+      for (const name of validNames) {
+        if (closed) break;
+
+        const installerFn = COMPONENT_INSTALLERS[name as keyof typeof COMPONENT_INSTALLERS];
+        if (!installerFn) {
+          updateComponentProgress(session.id, name, "failed", `No installer for ${name}`);
+          hasFailure = true;
+          continue;
+        }
+
+        updateComponentProgress(session.id, name, "installing");
+
+        try {
+          const result = await sshManager.withExecutor((executor) =>
+            installerFn(
+              executor,
+              (log) => appendSetupLog(session.id, name, log.message, log.level),
+              config,
+            ),
+          );
+
+          if (result.success) {
+            appendSetupLog(session.id, name, `${name} installed successfully${result.version ? ` (${result.version})` : ""}`);
+            updateComponentProgress(session.id, name, "installed");
+          } else {
+            appendSetupLog(session.id, name, result.error ?? `${name} installation failed`, "error");
+            updateComponentProgress(session.id, name, "failed", result.error);
+            hasFailure = true;
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          appendSetupLog(session.id, name, msg, "error");
+          updateComponentProgress(session.id, name, "failed", msg);
+          hasFailure = true;
+        }
+      }
+
+      finishSetupSession(session.id, hasFailure ? "failed" : "completed");
+    })();
+
+    // Keep the SSE connection open until install finishes or client disconnects
+    await new Promise<void>((resolve) => {
+      installPromise.then(() => {
+        // Give a brief delay for final events to flush
+        setTimeout(() => {
+          closed = true;
+          resolve();
+        }, 500);
+      });
+
+      sseStream.onAbort(() => {
+        closed = true;
+        unsubscribe();
+        resolve();
+      });
+    });
+  });
+}
+
+/**
+ * GET /system/install/session
+ *
+ * Get the active setup session or a specific session by ID.
+ * Query: ?id=setup_xxx (optional — returns active session if omitted)
+ *
+ * Returns: session state or 404
+ */
+export async function getInstallSession(c: Context) {
+  if (env.CLOUD_MODE) return c.json({ error: "Not available" }, 404);
+
+  const sessionId = c.req.query("id");
+
+  const session = sessionId
+    ? getSetupSession(sessionId)
+    : getActiveSetupSession();
+
+  if (!session) {
+    return c.json({ active: false }, 200);
+  }
+
+  return c.json({
+    active: true,
+    sessionId: session.id,
+    status: session.status,
+    components: session.components,
+    startedAt: session.startedAt,
+    finishedAt: session.finishedAt,
+  });
+}
+
+/**
+ * GET /system/install/stream
+ *
+ * Attach to an existing setup session's SSE stream (for page reloads).
+ * Query: ?id=setup_xxx
+ */
+export async function attachInstallStream(c: Context) {
+  if (env.CLOUD_MODE) return c.json({ error: "Not available" }, 404);
+
+  const sessionId = c.req.query("id");
+  const session = sessionId
+    ? getSetupSession(sessionId)
+    : getActiveSetupSession();
+
+  if (!session) {
+    return c.json({ error: "No active session" }, 404);
+  }
+
+  return streamSSE(c, async (sseStream) => {
+    let closed = false;
+
+    const writer = (event: string, data: string): boolean => {
+      if (closed) return false;
+      try {
+        void sseStream.writeSSE({ event, data });
+        return true;
+      } catch {
+        return false;
+      }
+    };
+
+    const { success, unsubscribe } = subscribeSetupSession(session.id, writer);
+
+    if (!success) {
+      await sseStream.writeSSE({ event: "error", data: JSON.stringify({ error: "Session not found" }) });
+      return;
+    }
+
+    // If session is already done, subscribe will have replayed + sent end; just close
+    if (session.status !== "running") {
+      return;
+    }
+
+    await new Promise<void>((resolve) => {
+      const checkInterval = setInterval(() => {
+        if (closed) {
+          clearInterval(checkInterval);
+          resolve();
+        }
+      }, 1000);
+
+      sseStream.onAbort(() => {
+        closed = true;
+        unsubscribe();
+        clearInterval(checkInterval);
+        resolve();
+      });
+    });
+  });
+}
+
+// ─── Monitoring ──────────────────────────────────────────────────────────────
+
+/**
+ * Shell one-liner that gathers CPU, memory, disk, uptime, and load average.
+ * Outputs a single JSON line. Designed for Linux servers.
+ *
+ * Fields:
+ *   cpu      - usage % (100 - idle from /proc/stat snapshot)
+ *   memTotal - total RAM bytes
+ *   memUsed  - used RAM bytes (total - available)
+ *   memAvail - available RAM bytes
+ *   diskTotal - root partition total bytes
+ *   diskUsed  - root partition used bytes
+ *   diskAvail - root partition available bytes
+ *   uptime   - seconds since boot
+ *   load1    - 1-min load average
+ *   load5    - 5-min load average
+ *   load15   - 15-min load average
+ */
+const STATS_COMMAND = [
+  // CPU: sample /proc/stat twice (200ms apart) for accurate usage
+  'read cpu0_u cpu0_n cpu0_s cpu0_i cpu0_rest <<< $(head -1 /proc/stat | awk \'{print $2,$3,$4,$5}\');',
+  'sleep 0.2;',
+  'read cpu1_u cpu1_n cpu1_s cpu1_i cpu1_rest <<< $(head -1 /proc/stat | awk \'{print $2,$3,$4,$5}\');',
+  'cpu_d=$(( (cpu1_u-cpu0_u)+(cpu1_n-cpu0_n)+(cpu1_s-cpu0_s)+(cpu1_i-cpu0_i) ));',
+  'cpu_idle=$(( cpu1_i - cpu0_i ));',
+  '[ "$cpu_d" -gt 0 ] && cpu_pct=$(( 100 - (cpu_idle * 100 / cpu_d) )) || cpu_pct=0;',
+  // Memory
+  'read mem_t mem_a <<< $(awk \'/MemTotal/{t=$2} /MemAvailable/{a=$2} END{print t*1024, a*1024}\' /proc/meminfo);',
+  'mem_u=$((mem_t - mem_a));',
+  // Disk
+  'read disk_t disk_u disk_a <<< $(df -B1 / | awk \'NR==2{print $2,$3,$4}\');',
+  // Uptime + load
+  'read up_s _ <<< $(cat /proc/uptime);',
+  'read l1 l5 l15 _ _ <<< $(cat /proc/loadavg);',
+  // Output JSON
+  'printf \'{"cpu":%d,"memTotal":%s,"memUsed":%s,"memAvail":%s,"diskTotal":%s,"diskUsed":%s,"diskAvail":%s,"uptime":"%s","load1":"%s","load5":"%s","load15":"%s"}\\n\' "$cpu_pct" "$mem_t" "$mem_u" "$mem_a" "$disk_t" "$disk_u" "$disk_a" "$up_s" "$l1" "$l5" "$l15"',
+].join(" ");
+
+/**
+ * GET /system/monitor/stream
+ *
+ * SSE stream that emits system stats every few seconds.
+ * Runs a lightweight stats command via SSH on an interval.
+ * Stops when the client disconnects.
+ */
+export async function monitorStream(c: Context) {
+  if (env.CLOUD_MODE) return c.json({ error: "Not available" }, 404);
+
+  const POLL_INTERVAL = 3_000;
+
+  return streamSSE(c, async (sseStream) => {
+    let closed = false;
+    let pollTimer: ReturnType<typeof setInterval> | null = null;
+
+    const poll = async () => {
+      if (closed) return;
+      try {
+        const raw = await sshManager.withExecutor((executor) =>
+          executor.exec(STATS_COMMAND, { timeout: 5_000 }),
+        );
+        if (closed) return;
+        // Validate it's parseable JSON before sending
+        JSON.parse(raw);
+        await sseStream.writeSSE({ event: "stats", data: raw });
+      } catch (err) {
+        if (closed) return;
+        const msg = err instanceof Error ? err.message : String(err);
+        await sseStream.writeSSE({
+          event: "error",
+          data: JSON.stringify({ error: msg }),
+        });
+      }
+    };
+
+    // First poll immediately
+    await poll();
+
+    // Then poll on interval
+    pollTimer = setInterval(() => void poll(), POLL_INTERVAL);
+
+    // Wait until client disconnects
+    await new Promise<void>((resolve) => {
+      sseStream.onAbort(() => {
+        closed = true;
+        if (pollTimer) clearInterval(pollTimer);
+        resolve();
+      });
+    });
+  });
+}