openship 0.4.8 → 0.6.0

package/dist/chunk-I3DPMTSF.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+
+// ../../packages/adapters/src/system/edge-exec-error.ts
+var EDGE_DOWN_MARKER = "the edge container is not running";
+function isEdgeDownFailure(text) {
+  return /is restarting, wait until the container is running/i.test(text) || /container .* is not running/i.test(text) || /\bis not running\b/i.test(text) || /No such container/i.test(text) || /container .* is paused/i.test(text) || /invalid PID number/i.test(text);
+}
+function explainEdgeDown(opts) {
+  const { container, status, reason } = opts;
+  const state = status?.trim() ? ` (${status.trim()})` : "";
+  const crashLooping = status?.trim() === "restarting";
+  const consequence = crashLooping ? `it is crash-looping, so nothing that runs through the edge on this server can work \u2014 certificate issuance, config reloads and route changes all go through it` : `nothing that runs through the edge on this server can work until it is up \u2014 certificate issuance, config reloads and route changes all go through it`;
+  const cause = reason?.trim() ? `OpenResty is refusing to start: ${reason.trim().replace(/\s+/g, " ")}. Fix that, then \`docker start ${container}\` and retry.` : `Run \`docker logs --tail 40 ${container}\` on the server for the reason, then retry.`;
+  return `${EDGE_DOWN_MARKER} ("${container}")${state} \u2014 ${consequence}. ${cause}`;
+}
+function edgeDownExplanation(text) {
+  if (!text) return null;
+  const line = text.split("\n").map((l) => l.trim()).find((l) => l.includes(EDGE_DOWN_MARKER));
+  return line || null;
+}
+
+export {
+  isEdgeDownFailure,
+  explainEdgeDown,
+  edgeDownExplanation
+};

package/dist/{chunk-L2VOGB2X.js → chunk-IW2UKBVF.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   formatDuration,
   isRemoteConnectionError,
   systemDebug
-} from "./chunk-RPHRPFEH.js";
+} from "./chunk-ZCFVHA25.js";
 import {
   safeErrorMessage
-} from "./chunk-6APULWSU.js";
+} from "./chunk-OTLSJYAC.js";
 
 // ../../packages/adapters/src/system/environment.ts
 var profileCache = /* @__PURE__ */ new WeakMap();

package/dist/{chunk-VDMQJHPI.js → chunk-IXM5245F.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
@@ -7,10 +7,10 @@ import {
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-MZ2WEHHY.js";
+} from "./chunk-JIMUYEKN.js";
 import {
   resolveEnvironment
-} from "./chunk-L2VOGB2X.js";
+} from "./chunk-IW2UKBVF.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -19,32 +19,33 @@ import {
   runBuildPipeline,
   sq,
   transferLocalDirectory
-} from "./chunk-4Z5QO7N6.js";
+} from "./chunk-VDDMADOF.js";
 import {
   formatDuration,
   isRemoteConnectionError,
   isRetryableRemoteConnectionError,
   systemDebug
-} from "./chunk-RPHRPFEH.js";
+} from "./chunk-ZCFVHA25.js";
 import {
   LocalExecutor
-} from "./chunk-TYVME3XD.js";
+} from "./chunk-6FH4AXVY.js";
+import {
+  probeListeningPort
+} from "./chunk-3LDWWY7U.js";
 import {
   sq as sq2,
   wrapLocalBuildCommand
-} from "./chunk-FPRHYBY2.js";
-import {
-  probeListeningPort
-} from "./chunk-ILFETZOM.js";
+} from "./chunk-ZFJXPCQP.js";
 import {
   DeployError,
   LANGUAGES,
   STACKS,
+  appVolumeTargets,
   buildOutputTransferExcludes,
   missingOutputDirectoryMessage,
   packageManagerEnsureCommand,
   safeErrorMessage
-} from "./chunk-6APULWSU.js";
+} from "./chunk-OTLSJYAC.js";
 
 // ../../packages/adapters/src/system/remote-journal.ts
 var OPSH_RUN_VERSION = 1;
@@ -996,6 +997,101 @@ async function installTools(executor, toolNames, onLog, requiredVersions) {
   return results;
 }
 
+// ../../packages/adapters/src/runtime/supervisor/usage.ts
+var SAMPLE_MS = 250;
+var ZERO_USAGE = {
+  cpuPercent: 0,
+  memoryMb: 0,
+  diskMb: 0,
+  networkRxBytes: 0,
+  networkTxBytes: 0
+};
+function buildProbe(pid, cgroupCandidates) {
+  const p = sq(String(pid));
+  const cgList = cgroupCandidates.map(sq).join(" ");
+  return [
+    `P=${p}`,
+    // Locate a readable cgroup v2 dir for this unit, if any.
+    `CG=""`,
+    `for c in ${cgList}; do if [ -r "$c/cpu.stat" ]; then CG="$c"; break; fi; done`,
+    // ── cgroup v2 ──
+    `if [ -n "$CG" ]; then`,
+    `  C1=$(awk '/^usage_usec/{print $2}' "$CG/cpu.stat" 2>/dev/null)`,
+    `  sleep ${(SAMPLE_MS / 1e3).toFixed(3)}`,
+    `  C2=$(awk '/^usage_usec/{print $2}' "$CG/cpu.stat" 2>/dev/null)`,
+    `  M=$(cat "$CG/memory.current" 2>/dev/null)`,
+    // io.stat is "<maj:min> rbytes=N wbytes=N rios=N wios=N" per device — summed
+    // across devices. Read and write are kept apart so the parser adds each once.
+    `  R=$(awk '{for(i=1;i<=NF;i++){split($i,kv,"=");if(kv[1]=="rbytes")r+=kv[2]}}END{print r+0}' "$CG/io.stat" 2>/dev/null)`,
+    `  W=$(awk '{for(i=1;i<=NF;i++){split($i,kv,"=");if(kv[1]=="wbytes")w+=kv[2]}}END{print w+0}' "$CG/io.stat" 2>/dev/null)`,
+    `  echo "cgroup \${C1:-0} \${C2:-0} \${M:-0} \${R:-0} \${W:-0}"`,
+    // ── /proc/<pid> ──
+    `elif [ -r "/proc/$P/stat" ]; then`,
+    // utime (14) + stime (15) in clock ticks. comm can contain spaces, so cut
+    // everything up to the closing paren before counting fields.
+    `  T=$(getconf CLK_TCK 2>/dev/null || echo 100)`,
+    `  C1=$(sed 's/.*) //' "/proc/$P/stat" 2>/dev/null | awk -v t="$T" '{print int((($12+$13)/t)*1000000)}')`,
+    `  sleep ${(SAMPLE_MS / 1e3).toFixed(3)}`,
+    `  C2=$(sed 's/.*) //' "/proc/$P/stat" 2>/dev/null | awk -v t="$T" '{print int((($12+$13)/t)*1000000)}')`,
+    `  M=$(awk '/^VmRSS:/{print $2*1024}' "/proc/$P/status" 2>/dev/null)`,
+    `  R=$(awk '/^read_bytes:/{print $2}' "/proc/$P/io" 2>/dev/null)`,
+    `  W=$(awk '/^write_bytes:/{print $2}' "/proc/$P/io" 2>/dev/null)`,
+    `  echo "proc \${C1:-0} \${C2:-0} \${M:-0} \${R:-0} \${W:-0}"`,
+    // ── ps (macOS / no procfs) ──
+    `else`,
+    // ps %cpu is a LIFETIME average, not a rate — reported as-is and flagged by the
+    // `ps` source so the parser doesn't pretend it's an instantaneous sample.
+    `  X=$(ps -o rss=,%cpu= -p "$P" 2>/dev/null | awk '{print ($1*1024)" "$2}')`,
+    `  echo "ps \${X:-0 0}"`,
+    `fi`
+  ].join("; ");
+}
+function parseProbe(out) {
+  const parts = out.trim().split(/\s+/);
+  const source = parts[0];
+  const n = (i) => {
+    const v = Number(parts[i]);
+    return Number.isFinite(v) && v >= 0 ? v : 0;
+  };
+  let cpuPercent;
+  let memoryMb;
+  let diskMb = 0;
+  if (source === "ps") {
+    if (parts.length < 3) return { ...ZERO_USAGE, source: "none" };
+    memoryMb = n(1) / (1024 * 1024);
+    cpuPercent = n(2);
+  } else if (source === "cgroup" || source === "proc") {
+    if (parts.length < 6) return { ...ZERO_USAGE, source: "none" };
+    const deltaUsec = Math.max(0, n(2) - n(1));
+    cpuPercent = deltaUsec / (SAMPLE_MS * 1e3) * 100;
+    memoryMb = n(3) / (1024 * 1024);
+    diskMb = (n(4) + n(5)) / (1024 * 1024);
+  } else {
+    return { ...ZERO_USAGE, source: "none" };
+  }
+  return {
+    cpuPercent: Math.round(cpuPercent * 100) / 100,
+    memoryMb: Math.round(memoryMb * 100) / 100,
+    diskMb: Math.round(diskMb * 100) / 100,
+    // Per-process network accounting needs eBPF or a per-unit netns, neither of
+    // which a bare deploy has. Zero here means "not measured", and the dashboard
+    // shows network only for container runtimes.
+    networkRxBytes: 0,
+    networkTxBytes: 0,
+    source
+  };
+}
+async function sampleBareUsage(executor, pid, cgroupCandidates = []) {
+  if (!Number.isInteger(pid) || pid <= 0) return { ...ZERO_USAGE };
+  try {
+    const out = await executor.exec(buildProbe(pid, cgroupCandidates));
+    const { source: _source, ...usage } = parseProbe(out);
+    return usage;
+  } catch {
+    return { ...ZERO_USAGE };
+  }
+}
+
 // ../../packages/adapters/src/runtime/supervisor/systemd.ts
 var UNIT_PREFIX = "openship";
 function escapeSystemdEnvValue(value) {
@@ -1146,6 +1242,33 @@ ${hint}` : "Process exited immediately after start (no output captured)";
       return false;
     }
   }
+  /**
+   * Usage for the unit. Prefers the unit's cgroup, which accounts for the whole
+   * process tree — a `npm start` that forks the real server would otherwise report
+   * only the wrapper's near-zero usage.
+   *
+   * `MainPID` is fetched as the fallback identity (and as the liveness check) for a
+   * host without a readable cgroup; the probe picks the tier itself. `--value` is
+   * used so a stopped unit yields "0" rather than a `MainPID=0` line to parse.
+   */
+  async getUsage(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    try {
+      const out = await this.executor.exec(
+        `systemctl show ${sq(unitName)} -p MainPID --value 2>/dev/null || true`
+      );
+      const pid = Number.parseInt(out.trim(), 10);
+      if (!Number.isFinite(pid) || pid <= 0) return { ...ZERO_USAGE };
+      return sampleBareUsage(this.executor, pid, [
+        // Where systemd places a unit started from /etc/systemd/system. The delegate
+        // path appears when the unit sets Delegate=yes; harmless to probe either way.
+        `/sys/fs/cgroup/system.slice/${unitName}`,
+        `/sys/fs/cgroup/system.slice/${unitName}/init.scope`
+      ]);
+    } catch {
+      return { ...ZERO_USAGE };
+    }
+  }
   async getLogs(deploymentId, tail) {
     const unitName = this.unitName(deploymentId);
     const tailArg = tail ? `-n ${tail}` : `-n 200`;
@@ -1325,6 +1448,19 @@ ${hint}` : "Process exited immediately after spawn (no output captured)";
     if (!pid) return false;
     return this.isAlive(pid);
   }
+  /**
+   * Usage for the tracked process.
+   *
+   * No cgroup candidates: nohup does not create one (that's the documented
+   * limitation above), so the probe uses /proc on Linux and `ps` on macOS. Both
+   * measure the LEADER only — a start command that forks will under-report, which
+   * is the same tradeoff as this supervisor's lack of restart and reboot handling.
+   */
+  async getUsage(deploymentId) {
+    const pid = await this.readPid(deploymentId);
+    if (!pid) return { ...ZERO_USAGE };
+    return sampleBareUsage(this.executor, pid);
+  }
   async getLogs(deploymentId, tail) {
     const logPath = this.logFile(deploymentId);
     try {
@@ -1385,6 +1521,10 @@ async function probeSystemd(executor) {
 }
 
 // ../../packages/adapters/src/runtime/bare.ts
+function parentPath(path) {
+  const idx = path.replace(/\/+$/, "").lastIndexOf("/");
+  return idx > 0 ? path.slice(0, idx) : "/";
+}
 var DEFAULT_WORK_DIR = "/opt/openship";
 var DEFAULT_BUILD_TIMEOUT = 10 * 60 * 1e3;
 var STATIC_RELEASE_BASE = "/opt/openship/static";
@@ -1399,8 +1539,17 @@ var BareRuntime = class {
     "destroy",
     "runtimeLogs",
     "streamLogs",
+    // Real measurements now (cgroup → /proc → ps, via the supervisor), so this can
+    // finally be declared. It was absent while getUsage returned a zeros stub — but
+    // nothing checked, so callers rendered those zeros as data. Anything reading
+    // usage should gate on supports("usage") rather than trust the numbers.
+    // Network is the one gap: per-process rx/tx needs eBPF or a netns, so it stays 0.
+    "usage",
     "containerIp",
     "rollback",
+    // The release dir + supervisor unit survive a redeploy, so restoring a
+    // past release really is an in-place unit swap (see makeActive).
+    "unitRestore",
     "inContainerExec"
   ]);
   workDir;
@@ -1466,6 +1615,60 @@ var BareRuntime = class {
   releaseDir(deploymentId) {
     return `${this.workDir}/releases/${deploymentId}`;
   }
+  /** Per-project directory holding the paths that must survive a release swap.
+   *  The `shared/` half of the Capistrano layout `releases/` already implements. */
+  sharedDir(projectId) {
+    return `${this.workDir}/shared/${projectId}`;
+  }
+  /**
+   * Repoint the release's persistent paths at `shared/`, so a redeploy doesn't
+   * take the app's data with the old release.
+   *
+   * Docker gets this from a volume; bare has no mount to hang it on, so the
+   * equivalent is the deploy convention: keep the state outside the release tree
+   * and symlink it in. The first release that ships the path SEEDS the shared
+   * copy from it — frameworks ship a skeleton there (Laravel's `storage/` has
+   * `framework/cache`, `framework/sessions`, …) and an app handed an empty
+   * directory instead would fail on write.
+   *
+   * Best-effort per path: a box without the shared dir writable is a storage
+   * problem to report, not a reason to fail an otherwise good release.
+   */
+  async linkPersistentPaths(releaseDir, projectId, volumes, log) {
+    const targets = appVolumeTargets(volumes ?? []);
+    if (targets.length === 0) return;
+    const shared = this.sharedDir(projectId);
+    for (const relative of targets) {
+      const sharedPath = `${shared}/${relative}`;
+      const releasePath = `${releaseDir}/${relative}`;
+      try {
+        if (!await this.executor.exists(sharedPath)) {
+          await this.executor.mkdir(parentPath(sharedPath));
+          if (await this.executor.exists(releasePath)) {
+            await this.executor.exec(`cp -a ${sq(releasePath)} ${sq(sharedPath)}`);
+          } else {
+            await this.executor.mkdir(sharedPath);
+          }
+        }
+        await this.executor.rm(releasePath);
+        await this.executor.mkdir(parentPath(releasePath));
+        await this.executor.exec(`ln -sfn ${sq(sharedPath)} ${sq(releasePath)}`);
+        log?.({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Persistent path ${relative} \u2192 ${sharedPath}
+`,
+          level: "info"
+        });
+      } catch (err) {
+        log?.({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Could not persist ${relative}: ${safeErrorMessage(err)}
+`,
+          level: "warn"
+        });
+      }
+    }
+  }
   async promoteBuildArtifact(artifactPath, deploymentId, previousDeploymentId) {
     const releaseDir = this.releaseDir(deploymentId);
     if (artifactPath === releaseDir) return releaseDir;
@@ -1727,6 +1930,7 @@ var BareRuntime = class {
       config.deploymentId,
       config.previousDeploymentId
     ) : stagedDir;
+    await this.linkPersistentPaths(workDir, config.projectId, config.volumes, _onLog);
     const sv = await this.supervisor();
     const env = {
       ...Object.fromEntries(
@@ -1887,8 +2091,19 @@ var BareRuntime = class {
     const sv = await this.supervisor();
     return sv.streamLogs(containerId, onLog, opts);
   }
-  async getUsage(_containerId) {
-    return { cpuPercent: 0, memoryMb: 0, diskMb: 0, networkRxBytes: 0, networkTxBytes: 0 };
+  /**
+   * CPU / memory / disk-IO for the deployment's process.
+   *
+   * `containerId` is the DEPLOYMENT id here, not a docker container id — that's the
+   * bare runtime's convention throughout (it's what the supervisor keys units and
+   * PID files on).
+   *
+   * The supervisor owns the measurement because the identity differs: systemd has a
+   * unit and a cgroup, nohup has a PID file. Both land on the same probe.
+   */
+  async getUsage(containerId) {
+    const sv = await this.supervisor();
+    return sv.getUsage(containerId);
   }
   // ── Network ────────────────────────────────────────────────────────────
   async getContainerIp(_containerId) {

package/dist/{chunk-MZ2WEHHY.js → chunk-JIMUYEKN.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-4Z5QO7N6.js";
+} from "./chunk-VDDMADOF.js";
 import {
   LocalExecutor
-} from "./chunk-TYVME3XD.js";
+} from "./chunk-6FH4AXVY.js";
 import {
   wrapLocalBuildCommand
-} from "./chunk-FPRHYBY2.js";
+} from "./chunk-ZFJXPCQP.js";
 
 // ../../packages/adapters/src/runtime/local-build.ts
 var LOCAL_BUILD_DIR = "/tmp/openship/.builds";