openship 0.4.4 → 0.4.6

package/README.md

@@ -97,7 +97,8 @@ A self-hosted instance **always requires login** (the admin you create in setup)
 > **Preview an unreleased build (dev).** To run the CLI built straight from source — a branch, tag, or `main` ahead of the next release — install the from-source build:
 >
 > ```bash
-> curl -fsSL https://get.openship.io/dev | sh     # or: OPENSHIP_REF=my-branch curl ... | sh
+> curl -fsSL https://get.openship.io/dev | sh                  # main (default)
+> curl -fsSL https://get.openship.io/dev | OPENSHIP_REF=dev sh  # a branch/tag (var goes on sh, not curl)
 > openship-dev                                     # same CLI, built from source
 > openship-dev update                              # pull latest source + rebuild (no release needed)
 > ```
@@ -219,29 +220,6 @@ Good-faith security research is **authorized** under our
 [safe-harbor policy](SECURITY.md#safe-harbor), and we're happy to credit valid
 first reports.
 
----
-## ⭐ Star History
-
-<p align="center">
-  <a href="https://star-history.com/#oblien/openship&Date">
-    <picture>
-      <source
-        media="(prefers-color-scheme: dark)"
-        srcset="https://api.star-history.com/svg?repos=oblien/openship&type=Date&theme=dark"
-      />
-      <source
-        media="(prefers-color-scheme: light)"
-        srcset="https://api.star-history.com/svg?repos=oblien/openship&type=Date"
-      />
-      <img
-        alt="Star History Chart"
-        src="https://api.star-history.com/svg?repos=oblien/openship&type=Date"
-      />
-    </picture>
-  </a>
-</p>
-
----
 ## License
 
 Openship is **open-source** software, licensed under the [Apache License 2.0](LICENSE).

package/dist/bare-2HYDXQEH.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  BareRuntime,
+  STATIC_RELEASE_BASE
+} from "./chunk-VDMQJHPI.js";
+import "./chunk-MZ2WEHHY.js";
+import "./chunk-L2VOGB2X.js";
+import "./chunk-4Z5QO7N6.js";
+import "./chunk-4TJC4JZQ.js";
+import "./chunk-OXWDY22G.js";
+import "./chunk-RPHRPFEH.js";
+import "./chunk-TYVME3XD.js";
+import "./chunk-FPRHYBY2.js";
+import "./chunk-ILFETZOM.js";
+import "./chunk-6APULWSU.js";
+import "./chunk-KI2EY3WB.js";
+export {
+  BareRuntime,
+  STATIC_RELEASE_BASE
+};

package/dist/{bowser-MFQA6OS4.js → bowser-O3AEA6AN.js}

@@ -1,4 +1,8 @@
-import "./chunk-4VNS5WPM.js";
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import "./chunk-KI2EY3WB.js";
 
 // ../../node_modules/bowser/src/constants.js
 var BROWSER_ALIASES_MAP = {

package/dist/{chunk-KD7VO4LG.js → chunk-2ZLR7ULL.js}

@@ -1,10 +1,15 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
 import {
   createDockerBuildContext,
   generateDockerfile,
   prepareSourceTree,
   resolveDockerfileCandidates,
-  resolveServiceDockerfile
-} from "./chunk-HFYDYK4D.js";
+  resolveServiceDockerfile,
+  staticBuilderOutputPath
+} from "./chunk-V6AN6XLZ.js";
 import {
   BuildLogger,
   assembleGitClone,
@@ -13,20 +18,20 @@ import {
   shellGitSshWriter,
   sq,
   transferLocalDirectory
-} from "./chunk-YL67EWYZ.js";
+} from "./chunk-4Z5QO7N6.js";
 import {
   connectSshClient,
   execSshCommand,
   openSshExecChannel,
   openSshUnixSocket
-} from "./chunk-4MG3BVHE.js";
+} from "./chunk-OXWDY22G.js";
 import {
   isRuntimeNotFoundError
-} from "./chunk-4LEL3H2Z.js";
+} from "./chunk-RPHRPFEH.js";
 import {
   safeErrorMessage,
   withTimeout
-} from "./chunk-JZLNHGLW.js";
+} from "./chunk-6APULWSU.js";
 
 // ../../packages/adapters/src/runtime/docker.ts
 import Dockerode from "dockerode";
@@ -77,8 +82,127 @@ function scopeVolumeBinds(slug, rawVolumes, enabled) {
   });
 }
 
-// ../../packages/adapters/src/runtime/docker-ssh-agent.ts
+// ../../packages/adapters/src/runtime/docker-exec-stream.ts
 import net from "net";
+import tls from "tls";
+import { Duplex } from "stream";
+var HEADER_END = "\r\n\r\n";
+var UPGRADE_TIMEOUT_MS = 2e4;
+function connect(conn) {
+  if (conn.socketPath) return net.connect({ path: conn.socketPath });
+  const port = Number(conn.port ?? (conn.protocol === "https" ? 443 : 80));
+  const host = conn.host ?? "127.0.0.1";
+  if (conn.protocol === "https") {
+    return tls.connect({ host, port, ca: conn.ca, cert: conn.cert, key: conn.key });
+  }
+  return net.connect({ port, host });
+}
+function bridgeSocket(socket, leftover) {
+  const out = new Duplex({
+    read() {
+      socket.resume();
+    },
+    write(chunk, _enc, cb) {
+      socket.write(chunk, (err) => cb(err ?? null));
+    },
+    final(cb) {
+      if (!socket.destroyed) socket.end();
+      cb();
+    },
+    destroy(err, cb) {
+      socket.destroy(err ?? void 0);
+      cb(err);
+    }
+  });
+  let readEnded = false;
+  const endRead = () => {
+    if (readEnded) return;
+    readEnded = true;
+    out.push(null);
+  };
+  if (leftover.length > 0) out.push(leftover);
+  socket.on("data", (chunk) => {
+    if (!out.push(chunk)) socket.pause();
+  });
+  socket.on("end", endRead);
+  socket.on("error", (err) => out.destroy(err));
+  socket.on("close", () => {
+    endRead();
+    if (!out.writableEnded) out.end();
+  });
+  return out;
+}
+function startExecStream(conn, execId, opts) {
+  return new Promise((resolve, reject) => {
+    const socket = connect(conn);
+    let settled = false;
+    let head = Buffer.alloc(0);
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      reject(err);
+    };
+    const timer = setTimeout(
+      () => fail(new Error(`docker exec upgrade timed out after ${UPGRADE_TIMEOUT_MS}ms`)),
+      UPGRADE_TIMEOUT_MS
+    );
+    const onData = (chunk) => {
+      if (settled) return;
+      head = head.length === 0 ? Buffer.from(chunk) : Buffer.concat([head, chunk]);
+      const text = head.toString("latin1");
+      const end = text.indexOf(HEADER_END);
+      if (end === -1) {
+        if (head.length > 64 * 1024) fail(new Error("docker exec upgrade: response head too large"));
+        return;
+      }
+      const statusLine = text.slice(0, text.indexOf("\r\n"));
+      if (!/ 101 /.test(statusLine)) {
+        const body2 = text.slice(end + HEADER_END.length).trim();
+        fail(new Error(`docker exec start failed: ${statusLine}${body2 ? ` \u2014 ${body2}` : ""}`));
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      socket.removeListener("data", onData);
+      socket.removeListener("error", fail);
+      socket.removeListener("close", onEarlyClose);
+      const headBytes = Buffer.byteLength(text.slice(0, end + HEADER_END.length), "latin1");
+      resolve(bridgeSocket(socket, head.subarray(headBytes)));
+    };
+    const onEarlyClose = () => fail(new Error("docker exec start: connection closed before upgrade"));
+    socket.on("data", onData);
+    socket.on("error", fail);
+    socket.on("close", onEarlyClose);
+    const body = JSON.stringify({ Detach: false, Tty: opts.tty });
+    socket.write(
+      `POST /exec/${execId}/start HTTP/1.1\r
+Host: ${conn.socketPath ? "localhost" : conn.host ?? "localhost"}\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: Upgrade\r
+Upgrade: tcp\r
+\r
+` + body
+    );
+  });
+}
+function daemonConnectionFrom(docker) {
+  const m = docker.modem ?? {};
+  return {
+    socketPath: typeof m.socketPath === "string" ? m.socketPath : void 0,
+    host: typeof m.host === "string" ? m.host : void 0,
+    port: typeof m.port === "number" || typeof m.port === "string" ? m.port : void 0,
+    protocol: typeof m.protocol === "string" ? m.protocol : void 0,
+    ca: m.ca,
+    cert: m.cert,
+    key: m.key
+  };
+}
+
+// ../../packages/adapters/src/runtime/docker-ssh-agent.ts
+import net2 from "net";
 var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var resolvedDockerSocketPathCache = /* @__PURE__ */ new WeakMap();
 var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
@@ -253,7 +377,7 @@ function createDockerSshBridge(opts) {
     const mode = await ensureMode();
     return mode === "dialstdio" ? openDialStdioUpstream() : openStreamlocalUpstream(opts);
   };
-  const server = net.createServer((client) => {
+  const server = net2.createServer((client) => {
     clients.add(client);
     client.setNoDelay(true);
     client.once("close", () => clients.delete(client));
@@ -555,16 +679,16 @@ function parseTimestampedLine(line) {
   };
 }
 function firstNetworkIp(networks) {
-  for (const net2 of Object.values(networks ?? {})) {
-    if (net2?.IPAddress) return net2.IPAddress;
+  for (const net3 of Object.values(networks ?? {})) {
+    if (net3?.IPAddress) return net3.IPAddress;
   }
   return void 0;
 }
 function extractNetworkInfo(data) {
   let ip;
-  for (const net2 of Object.values(data.NetworkSettings.Networks ?? {})) {
-    if (net2.IPAddress) {
-      ip = net2.IPAddress;
+  for (const net3 of Object.values(data.NetworkSettings.Networks ?? {})) {
+    if (net3.IPAddress) {
+      ip = net3.IPAddress;
       break;
     }
   }
@@ -1223,11 +1347,43 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   /**
-   * Build a STATIC app in a Docker sandbox, then extract its doc-root onto a
-   * host directory the edge serves via nginx `root`. Reuses `build()` — so
-   * Docker is auto-ensured (ensureDockerFeature) and the static nginx image is
-   * produced (`generateStaticDockerfile` COPYs the output to the fixed
-   * `/usr/share/nginx/html`) — then extracts those files and discards the image.
+   * Move an extract-only static build's files out of its builder image onto
+   * `hostOutDir`, then delete the image.
+   *
+   * The ONE place this happens, shared by the single-app path
+   * ({@link buildStaticToHost}) and the compose batch path ({@link buildImages}) —
+   * they used to be destined to diverge, and the source path is subtle enough
+   * (see `staticBuilderOutputPath`) that two copies would drift into extracting an
+   * empty directory.
+   */
+  async moveStaticBuildToHost(tag, config, hostOutDir, log) {
+    const docRoot = staticBuilderOutputPath(config);
+    const sshExecutor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
+    log.log("Moving built files out of the build container...\n");
+    try {
+      if (sshExecutor) {
+        await this.extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir);
+      } else {
+        await this.extractDocRootViaDaemon(tag, docRoot, hostOutDir);
+      }
+      log.log(`Static files ready at ${hostOutDir}
+`);
+    } finally {
+      await this.removeImage(tag).catch(() => {
+      });
+    }
+  }
+  /**
+   * Build a STATIC app in a Docker sandbox, then move the built files onto a host
+   * directory the edge serves via nginx `root`. Reuses `build()` so Docker is
+   * auto-ensured (ensureDockerFeature).
+   *
+   * NO RUNTIME IMAGE. `staticExtractOnly` stops the recipe at the builder stage and
+   * the files are copied straight out of it. This used to build a full
+   * `nginx:alpine` runtime stage — pulling that image, running six more steps, and
+   * writing an nginx config nothing reads — only to `docker cp` the doc-root out
+   * and delete the whole thing moments later. The edge already serves these files;
+   * a second web server was never going to run.
    * Returns the host dir as `imageRef`, matching BareRuntime.build's host-dir
    * contract so the existing file-backed serve path (deployStatic /
    * resolveStaticRoot) consumes it unchanged. Never leaves a long-lived
@@ -1235,51 +1391,17 @@ var DockerRuntime = class _DockerRuntime {
    */
   async buildStaticToHost(config, hostOutDir, logger) {
     const log = logger ?? new BuildLogger();
-    const buildResult = await this.build({ ...config, isStatic: true }, log);
+    const buildResult = await this.build(
+      { ...config, isStatic: true, staticExtractOnly: true },
+      log
+    );
     if (buildResult.status !== "deploying" || !buildResult.imageRef) {
       return buildResult;
     }
     const tag = buildResult.imageRef;
     const extractStart = Date.now();
-    const DOC_ROOT = "/usr/share/nginx/html";
     try {
-      const sshExecutor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
-      log.log("Extracting static files from the build sandbox...\n");
-      if (sshExecutor) {
-        const cid = (await sshExecutor.exec(`docker create ${sq(tag)}`)).trim();
-        try {
-          await sshExecutor.exec(`mkdir -p ${sq(hostOutDir)}`);
-          await sshExecutor.exec(`docker cp ${sq(`${cid}:${DOC_ROOT}/.`)} ${sq(hostOutDir)}`);
-        } finally {
-          await sshExecutor.exec(`docker rm ${sq(cid)}`).catch(() => {
-          });
-        }
-      } else {
-        const { mkdir } = await import("fs/promises");
-        const { spawn } = await import("child_process");
-        await mkdir(hostOutDir, { recursive: true });
-        const container = await this.docker.createContainer({ Image: tag });
-        try {
-          const tarStream = await container.getArchive({ path: DOC_ROOT });
-          await new Promise((resolve, reject) => {
-            const extract = spawn("tar", ["-x", "--strip-components=1", "-C", hostOutDir]);
-            let errBuf = "";
-            extract.stderr.on("data", (d) => errBuf += d.toString());
-            extract.on("error", reject);
-            tarStream.on("error", reject);
-            tarStream.pipe(extract.stdin);
-            extract.on(
-              "close",
-              (code) => code === 0 ? resolve() : reject(new Error(`static extract failed (tar ${code}): ${errBuf.trim().slice(-500)}`))
-            );
-          });
-        } finally {
-          await container.remove({ force: true }).catch(() => {
-          });
-        }
-      }
-      log.log(`Static files ready at ${hostOutDir}
-`);
+      await this.moveStaticBuildToHost(tag, config, hostOutDir, log);
       return {
         sessionId: config.sessionId,
         status: "deploying",
@@ -1295,8 +1417,58 @@ var DockerRuntime = class _DockerRuntime {
         durationMs: (buildResult.durationMs ?? 0) + (Date.now() - extractStart),
         errorMessage: `Static extract failed: ${msg}`
       };
+    }
+  }
+  /**
+   * THE CONTRACT both extractors satisfy: after either one returns, `hostOutDir`
+   * holds the doc-root's CONTENTS directly — `index.html` at the top, no wrapping
+   * `html/` directory. OpenResty's `root` points straight at it, so a stray extra
+   * level is a silent 404 for the whole site.
+   *
+   * The two paths reach that same shape differently, which is why the rule is
+   * stated here once instead of in each branch:
+   *   - `docker cp <cid>:<root>/.` — the trailing `/.` means "contents of", so
+   *     there is nothing to strip.
+   *   - `getArchive({path: <root>})` — the tar IS rooted at `html/`, so exactly
+   *     one leading component must be stripped.
+   */
+  /** Remote host: disk-to-disk via the host's own docker CLI — never stream a
+   *  large tar over the SSH dockerode bridge (same rationale as saveImage/pullImage). */
+  async extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir) {
+    const cid = (await sshExecutor.exec(`docker create ${sq(tag)}`)).trim();
+    try {
+      await sshExecutor.exec(`mkdir -p ${sq(hostOutDir)}`);
+      await sshExecutor.exec(`docker cp ${sq(`${cid}:${docRoot}/.`)} ${sq(hostOutDir)}`);
     } finally {
-      await this.removeImage(tag).catch(() => {
+      await sshExecutor.exec(`docker rm ${sq(cid)}`).catch(() => {
+      });
+    }
+  }
+  /** Local socket / remote TCP: pull the tar through dockerode (portable to a TCP
+   *  daemon where a local `docker` CLI wouldn't apply) and extract onto THIS
+   *  process's filesystem — in docker-edge mode that's /opt/openship/static,
+   *  bind-mounted into both the api and the edge at the same path. */
+  async extractDocRootViaDaemon(tag, docRoot, hostOutDir) {
+    const { mkdir } = await import("fs/promises");
+    const { spawn } = await import("child_process");
+    await mkdir(hostOutDir, { recursive: true });
+    const container = await this.docker.createContainer({ Image: tag });
+    try {
+      const tarStream = await container.getArchive({ path: docRoot });
+      await new Promise((resolve, reject) => {
+        const extract = spawn("tar", ["-x", "--strip-components=1", "-C", hostOutDir]);
+        let errBuf = "";
+        extract.stderr.on("data", (d) => errBuf += d.toString());
+        extract.on("error", reject);
+        tarStream.on("error", reject);
+        tarStream.pipe(extract.stdin);
+        extract.on(
+          "close",
+          (code) => code === 0 ? resolve() : reject(new Error(`static extract failed (tar ${code}): ${errBuf.trim().slice(-500)}`))
+        );
+      });
+    } finally {
+      await container.remove({ force: true }).catch(() => {
       });
     }
   }
@@ -1427,6 +1599,23 @@ var DockerRuntime = class _DockerRuntime {
             await this.streamDockerodeBuild(stream, spec.logger);
           }
           await this.verifyImageBuilt(tag);
+          if (spec.config.staticExtractOnly && spec.config.staticOutDir) {
+            await this.moveStaticBuildToHost(
+              tag,
+              spec.config,
+              spec.config.staticOutDir,
+              spec.logger
+            );
+            const result2 = {
+              sessionId: spec.config.sessionId,
+              status: "deploying",
+              imageRef: spec.config.staticOutDir,
+              durationMs: Date.now() - startedAt
+            };
+            spec.onResult?.(result2);
+            results.push({ serviceName: spec.serviceName, result: result2 });
+            continue;
+          }
           spec.logger.log(`Image ${tag} is ready.
 `);
           const result = {
@@ -2105,8 +2294,8 @@ var DockerRuntime = class _DockerRuntime {
   async getContainerIp(containerId) {
     const container = this.docker.getContainer(containerId);
     const data = await container.inspect();
-    for (const net2 of Object.values(data.NetworkSettings.Networks ?? {})) {
-      if (net2.IPAddress) return net2.IPAddress;
+    for (const net3 of Object.values(data.NetworkSettings.Networks ?? {})) {
+      if (net3.IPAddress) return net3.IPAddress;
     }
     return null;
   }
@@ -2143,11 +2332,11 @@ var DockerRuntime = class _DockerRuntime {
       Cmd: ["/bin/sh", "-lc", "exec $(command -v bash || echo /bin/sh)"],
       Env: [`TERM=${term}`]
     });
-    const duplex = await exec.start({
-      hijack: true,
-      stdin: true,
-      Tty: true
-    });
+    const duplex = await startExecStream(
+      daemonConnectionFrom(this.docker),
+      exec.id,
+      { tty: true, stdin: true }
+    );
     try {
       await exec.resize({ h: rows, w: cols });
     } catch {
@@ -2155,6 +2344,7 @@ var DockerRuntime = class _DockerRuntime {
     const stdout = new PassThrough();
     const stderr = new PassThrough();
     duplex.on("data", (chunk) => stdout.write(chunk));
+    duplex.resume();
     duplex.on("end", () => {
       stdout.end();
       stderr.end();