openship 0.6.1 → 0.6.5

package/dist/{chunk-3LDWWY7U.js → chunk-A7EWM2KA.js}

@@ -2,6 +2,44 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  safeErrorMessage,
+  systemDebug
+} from "./chunk-LEYSL46B.js";
+
+// ../../packages/adapters/src/system/probe-exec.ts
+async function tryExec(executor, command, opts) {
+  try {
+    return opts ? await executor.exec(command, opts) : await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+async function probeExec(executor, command, scope) {
+  const startedAt = Date.now();
+  systemDebug(scope, `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(scope, `exec:ok ${command} (${formatDuration(startedAt)})`);
+    return { output: result.trim(), error: null };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    if (isRemoteConnectionError(err)) {
+      systemDebug(scope, `exec:abort ${command} (${formatDuration(startedAt)}) ${msg}`);
+      throw err;
+    }
+    systemDebug(scope, `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`);
+    return { output: "", error: msg || `\`${command}\` failed` };
+  }
+}
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
 
 // ../../packages/adapters/src/system/port-listen.ts
 var PROC_NET_TCP_CMD = "cat /proc/net/tcp 2>/dev/null; cat /proc/net/tcp6 2>/dev/null; true";
@@ -75,13 +113,6 @@ async function waitForPortFree(executor, port, opts = {}) {
 }
 
 // ../../packages/adapters/src/runtime/port-conflict.ts
-async function tryExec(executor, command) {
-  try {
-    return await executor.exec(command);
-  } catch {
-    return null;
-  }
-}
 async function resolveSystemdUnit(executor, pid) {
   const cgroup = await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null || true`);
   const unitMatch = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m) ?? cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m);
@@ -144,6 +175,9 @@ async function describeProcess(executor, pid) {
 }
 
 export {
+  tryExec,
+  probeExec,
+  withReason,
   waitForPortListening,
   waitForPortFree,
   probeListeningPort,

package/dist/chunk-ELGRMZOW.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { join, resolve } from "path";
+var DEFAULT_HOME = join(homedir(), ".openship");
+var override = process.env.OPENSHIP_HOME?.trim();
+var OS_DIR = override ? resolve(override) : DEFAULT_HOME;
+var IS_ALT_HOME = OS_DIR !== DEFAULT_HOME;
+var DATA_DIR = join(OS_DIR, "data");
+var LOG_DIR = join(OS_DIR, "logs");
+var AUTH_SECRET_FILE = join(OS_DIR, "auth-secret");
+var INTERNAL_TOKEN_FILE = join(OS_DIR, "internal-token");
+
+export {
+  OS_DIR,
+  IS_ALT_HOME,
+  DATA_DIR,
+  LOG_DIR,
+  AUTH_SECRET_FILE,
+  INTERNAL_TOKEN_FILE
+};

package/dist/chunk-EZPPTWJQ.js

@@ -0,0 +1,292 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  answered,
+  firewallAllowSteps,
+  firewallManager,
+  firewallPersists,
+  refused,
+  shellQuote
+} from "./chunk-LEYSL46B.js";
+
+// ../../packages/adapters/src/system/environment-ops.ts
+function opScript(steps) {
+  return steps.join(" && ");
+}
+function releaseArchOf(profile) {
+  return profile.arch === "unknown" ? refused(
+    "This host's CPU architecture could not be determined, and Openship will not default to amd64 \u2014 a release artifact for the wrong architecture installs cleanly and then fails to execute."
+  ) : answered(profile.arch);
+}
+var HOST_STATE_DIR = "/root/.openship";
+var PACKAGE_NAME = /^[A-Za-z0-9][A-Za-z0-9._+@-]*$/;
+function joinPackages(packages) {
+  if (packages.length === 0) {
+    return refused("No packages were named, so there is nothing to run.");
+  }
+  const bad = packages.find((name) => !PACKAGE_NAME.test(name));
+  if (bad !== void 0) {
+    return refused(`${JSON.stringify(bad)} is not a package name.`);
+  }
+  return answered(packages.join(" "));
+}
+var INSTALL = {
+  // `update` first because an install against a stale index fails on a
+  // just-provisioned box; `-qq` because this output streams into the UI.
+  apt: (names) => answered(["apt-get update -qq", `apt-get install -y -qq ${names}`]),
+  dnf: (names) => answered([`dnf install -y ${names}`]),
+  yum: (names) => answered([`yum install -y ${names}`]),
+  apk: (names) => answered([`apk add --no-cache ${names}`]),
+  brew: (names) => answered([`brew install ${names}`]),
+  none: (names) => refused(
+    `No package manager is available to install ${names} \u2014 Openship looked for apt-get, dnf, yum, apk and brew and found none.`
+  )
+};
+var REMOVE = {
+  // `purge` + `autoremove`, matching what the uninstallers did before this table: a
+  // component Openship installed should leave no config behind when removed.
+  apt: (names) => answered([`apt-get purge -y -qq ${names}`, "apt-get autoremove -y -qq"]),
+  dnf: (names) => answered([`dnf remove -y ${names}`]),
+  yum: (names) => answered([`yum remove -y ${names}`]),
+  apk: (names) => answered([`apk del ${names}`]),
+  brew: (names) => answered([`brew uninstall --force ${names}`]),
+  none: (names) => refused(`No package manager is available to remove ${names}.`)
+};
+var AVAILABLE_VERSION = {
+  apt: (names) => answered([`apt-cache policy ${names} 2>/dev/null`]),
+  dnf: (names) => answered([`dnf -q --cacheonly list available ${names} 2>/dev/null | tail -n1`]),
+  yum: (names) => answered([`yum -q --cacheonly list available ${names} 2>/dev/null | tail -n1`]),
+  apk: (names) => answered([`apk policy ${names} 2>/dev/null`]),
+  brew: (names) => refused(
+    `Openship does not read Homebrew's available version for ${names} \u2014 it reports the installed version only on macOS.`
+  ),
+  none: (names) => refused(`No package manager is available to look up an installable version of ${names}.`)
+};
+function noServiceManager(reason) {
+  const refuse = () => refused(reason);
+  return { enableStart: refuse, isActive: refuse };
+}
+var SERVICE = {
+  systemd: {
+    enableStart: (unit) => answered([`systemctl enable --now ${unit}`]),
+    // `--quiet` because the caller wants the exit code, and a unit name echoed onto
+    // stdout is the kind of thing a `!output` check reads as "running".
+    isActive: (unit) => answered([`systemctl is-active --quiet ${unit}`])
+  },
+  openrc: {
+    // Two steps, not one: `rc-update add` is persistence and `rc-service start` is now.
+    // OpenRC has no `--now`, which is why Alpine used to get a start command of
+    // `undefined` from a table that assumed systemd.
+    enableStart: (unit) => answered([`rc-update add ${unit} default`, `rc-service ${unit} start`]),
+    // Exits 0 started / 3 stopped, and prints to stdout — silenced so the contract
+    // matches systemd's `is-active --quiet`.
+    isActive: (unit) => answered([`rc-service ${unit} status >/dev/null 2>&1`])
+  },
+  launchd: noServiceManager(
+    "This host runs launchd, and Openship does not manage macOS system services \u2014 launchd jobs are addressed by label rather than by unit name, and starting or stopping one is the operator's call."
+  ),
+  none: noServiceManager(
+    "This host has no service manager Openship can drive (no running systemd, no OpenRC, no launchd), so services cannot be started, stopped or inspected. A container started without an init system is the usual cause."
+  )
+};
+var GET_DOCKER_IDS = /* @__PURE__ */ new Set([
+  "ubuntu",
+  "debian",
+  "raspbian",
+  "centos",
+  "fedora",
+  "rhel",
+  "rocky"
+]);
+var DOCKER_CE_REPO_FILE = "/etc/yum.repos.d/docker-ce.repo";
+function dockerCeRepoSteps(profile) {
+  const write = `curl -fsSL https://download.docker.com/linux/centos/docker-ce.repo -o ${DOCKER_CE_REPO_FILE}`;
+  const major = /^(\d+)/.exec(profile.versionId ?? "")?.[1];
+  if (!major) return [write];
+  return [write, `sed -i 's|\\$releasever|${major}|g' ${DOCKER_CE_REPO_FILE}`];
+}
+var DOCKER_CE_PACKAGES = "docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin";
+var COMPOSE_PLUGIN_VERSION = "v5.4.0";
+var COMPOSE_PLUGIN_DIR = "/usr/local/lib/docker/cli-plugins";
+var COMPOSE_PLUGIN_PATH = `${COMPOSE_PLUGIN_DIR}/docker-compose`;
+var COMPOSE_PLUGIN_ASSET = {
+  amd64: "x86_64",
+  arm64: "aarch64"
+};
+function withComposePlugin(profile, engine) {
+  const arch = releaseArchOf(profile);
+  if (!arch.supported) return arch;
+  const asset = `docker-compose-linux-${COMPOSE_PLUGIN_ASSET[arch.value]}`;
+  return answered([
+    ...engine,
+    `mkdir -p ${COMPOSE_PLUGIN_DIR}`,
+    `curl -fsSL https://github.com/docker/compose/releases/download/${COMPOSE_PLUGIN_VERSION}/${asset} -o ${COMPOSE_PLUGIN_PATH}`,
+    `chmod 0755 ${COMPOSE_PLUGIN_PATH}`
+  ]);
+}
+function dockerInstallSteps(profile) {
+  if (profile.os === "darwin") {
+    return refused(
+      "Openship does not install Docker on macOS \u2014 Docker Desktop (or OrbStack/Colima) is a GUI application an operator installs and licenses themselves."
+    );
+  }
+  if (profile.os !== "linux") {
+    return refused("Docker can only be installed on a Linux or macOS host.");
+  }
+  const id = profile.distroId?.trim().toLowerCase() ?? "";
+  if (GET_DOCKER_IDS.has(id)) {
+    return answered(["curl -fsSL https://get.docker.com | sh"]);
+  }
+  switch (profile.distroFamily) {
+    case "rhel":
+      if (id === "amzn") {
+        return withComposePlugin(
+          profile,
+          profile.packageManager === "yum" ? (
+            // `amazon-linux-extras` exits 13 with "Installation failed" AFTER yum has
+            // printed "Complete!" and left dockerd on disk — seen once in four runs
+            // against a real amazonlinux:2. `opScript` joins with `&&`, so that exit
+            // aborted the plugin steps below and produced the engine-without-`docker
+            // compose` host {@link withComposePlugin} exists to prevent. Tolerate a
+            // non-zero exit only when the binary is actually there; a real failure has
+            // nothing to find and still aborts. Braced so it stays one step if a step
+            // is ever prepended — `&&` and `||` bind equally and left-associatively.
+            ["{ amazon-linux-extras install -y docker || command -v docker >/dev/null 2>&1; }"]
+          ) : ["dnf install -y docker"]
+        );
+      }
+      return answered([
+        ...dockerCeRepoSteps(profile),
+        `${profile.packageManager} install -y ${DOCKER_CE_PACKAGES}`
+      ]);
+    case "debian":
+      return withComposePlugin(profile, [
+        "apt-get update -qq",
+        "apt-get install -y -qq docker.io"
+      ]);
+    case "alpine":
+      return answered(["apk add --no-cache docker docker-cli docker-cli-compose"]);
+    case "suse":
+    case "arch":
+    case "unknown":
+      return refused(
+        `Openship has no Docker install path for this host (os-release ID=${JSON.stringify(profile.distroId ?? "")}, family ${profile.distroFamily}).`
+      );
+  }
+}
+function homeOf(profile) {
+  const home = profile.home.trim();
+  if (home) return home;
+  if (profile.isRoot) return "/root";
+  const user = profile.loginUser.trim();
+  return user ? `/home/${user}` : "/root";
+}
+function describeProfile(profile) {
+  const name = profile.prettyName?.trim() || profile.distroId?.trim() || profile.os;
+  const parts = [
+    name,
+    `${profile.os}/${profile.arch}`,
+    `pm=${profile.packageManager}`,
+    `init=${profile.serviceManager}`,
+    `firewall=${profile.firewall}`,
+    profile.isRoot ? "root" : profile.canSudo ? `${profile.loginUser}+sudo` : profile.loginUser
+  ];
+  if (profile.isContainer) parts.push("container");
+  return parts.filter(Boolean).join(" \xB7 ");
+}
+function sshdEnableHintFor(profile) {
+  switch (profile.serviceManager) {
+    case "systemd":
+      return profile.distroFamily === "debian" ? "sudo systemctl enable --now ssh" : "sudo systemctl enable --now sshd";
+    case "openrc":
+      return "sudo rc-update add sshd default && sudo rc-service sshd start";
+    case "launchd":
+      return "sudo systemsetup -setremotelogin on";
+    case "none":
+      return "start this host's SSH server (no service manager was detected, so start it however this host does)";
+  }
+}
+function hostFacts(profile) {
+  const home = homeOf(profile);
+  return {
+    profile,
+    describe: () => describeProfile(profile),
+    sshdEnableHint: () => sshdEnableHintFor(profile),
+    // Both delegate: these are facts about a `SystemFirewall`, not about a profile, and
+    // the CLI reads them off a locally-measured firewall with no profile in hand.
+    firewallManager: () => firewallManager(profile.firewall),
+    firewallPersists: () => firewallPersists(profile.firewall),
+    home: () => home,
+    // macOS has no /root to own anything, and there it is a local target rather than
+    // a provisioned server, so the invoking user's home is the only sensible anchor.
+    stateDir: () => profile.os === "darwin" ? `${home}/.openship` : HOST_STATE_DIR,
+    scratchDir: () => `${home}/.openship`,
+    installsNeedRoot: () => profile.os !== "darwin"
+  };
+}
+function withPackages(packages, rule) {
+  const names = joinPackages(packages);
+  return names.supported ? rule(names.value) : names;
+}
+function hostCommands(profile) {
+  const pm = profile.packageManager;
+  const service = SERVICE[profile.serviceManager];
+  const unit = (name) => shellQuote(name);
+  const firewallScoped = (scope, steps) => {
+    const manager = firewallManager(profile.firewall);
+    return manager.supported ? steps(manager.value, scope) : manager;
+  };
+  return {
+    pkgInstall: (packages) => withPackages(packages, INSTALL[pm]),
+    pkgInstallVariants: (variants) => {
+      if (pm === "none") return INSTALL.none("this package");
+      const chosen = variants[pm];
+      return chosen.supported ? withPackages(chosen.value, INSTALL[pm]) : chosen;
+    },
+    pkgRemove: (packages) => withPackages(packages, REMOVE[pm]),
+    pkgAvailableVersion: (pkg) => withPackages([pkg], AVAILABLE_VERSION[pm]),
+    // Unit names are quoted rather than validated: unlike package names they are
+    // data-derived (a project slug, a unit read off a `systemctl list-units` scan), so
+    // the guarantee has to hold for a string nobody vetted.
+    serviceEnableStart: (name) => service.enableStart(unit(name)),
+    serviceIsActive: (name) => service.isActive(unit(name)),
+    firewallAllow: (scope) => firewallScoped(scope, firewallAllowSteps),
+    dockerInstall: () => dockerInstallSteps(profile),
+    // Through `unit()` like every other unit name, so there is one path to a service verb
+    // rather than one path plus an exception that happens to be safe today.
+    dockerStart: () => service.enableStart(unit("docker")),
+    releaseArch: () => releaseArchOf(profile)
+  };
+}
+function mapRefusals(commands, onRefusal, gate) {
+  const out = {};
+  for (const name of Object.keys(commands)) {
+    const fn = commands[name];
+    out[name] = ((...args) => {
+      if (gate !== null) return refused(gate);
+      const answer = fn(...args);
+      return answer.supported ? answer : refused(onRefusal(answer.reason));
+    });
+  }
+  return out;
+}
+function hostRefusal(profile) {
+  if (profile.supported) return null;
+  const reason = profile.unsupportedReason ?? "Openship cannot drive this host, and the detector recorded no reason.";
+  return `${reason} (host: ${describeProfile(profile)})`;
+}
+function envOps(profile) {
+  const facts = hostFacts(profile);
+  const label = describeProfile(profile);
+  const withHost = (reason) => `${reason} (host: ${label})`;
+  return { ...facts, ...mapRefusals(hostCommands(profile), withHost, hostRefusal(profile)) };
+}
+
+export {
+  opScript,
+  HOST_STATE_DIR,
+  hostRefusal,
+  envOps
+};