openship 0.6.1 → 0.6.6

package/dist/chunk-UVNMQM7W.js

@@ -0,0 +1,444 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  sq
+} from "./chunk-ZFJXPCQP.js";
+import {
+  assessHostSupport,
+  classifyDistro,
+  formatDuration,
+  isRemoteConnectionError,
+  parseOsRelease,
+  parseSystemArch,
+  parseSystemOs,
+  safeErrorMessage,
+  systemDebug
+} from "./chunk-UJ6JZM65.js";
+
+// ../../packages/adapters/src/system/elevated-executor.ts
+import { randomBytes } from "crypto";
+var INSTALL_ENV = "DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew";
+function elevateCommand(command) {
+  return `sudo -n sh -c ${sq(`export ${INSTALL_ENV}; ${command}`)}`;
+}
+var EXECUTOR_DELEGATE = /* @__PURE__ */ Symbol.for("openship.executor.delegate");
+function dirOf(path) {
+  const idx = path.lastIndexOf("/");
+  if (idx < 0) return ".";
+  return idx === 0 ? "/" : path.slice(0, idx);
+}
+function elevatedExecutor(inner) {
+  const readFileElevated = async (path) => {
+    try {
+      return await inner.readFile(path);
+    } catch (err) {
+      try {
+        return await inner.exec(elevateCommand(`cat ${sq(path)}`));
+      } catch {
+        throw err;
+      }
+    }
+  };
+  const existsElevated = async (path) => {
+    if (await inner.exists(path).catch(() => false)) return true;
+    return await inner.exec(elevateCommand(`test -e ${sq(path)}`)).then(() => true).catch(() => false);
+  };
+  const writeFileElevated = async (path, content) => {
+    const stage = `/tmp/.openship-elev-${randomBytes(12).toString("hex")}`;
+    await inner.exec(`mkdir -m 700 ${sq(stage)}`);
+    try {
+      const staged = `${stage}/payload`;
+      await inner.writeFile(staged, content);
+      await inner.exec(
+        elevateCommand(
+          `mkdir -p ${sq(dirOf(path))} && chown 0:0 ${sq(staged)} && mv -f ${sq(staged)} ${sq(path)}`
+        )
+      );
+    } finally {
+      await inner.exec(`rm -rf ${sq(stage)}`).catch(() => void 0);
+    }
+  };
+  const overrides = {
+    exec: (command, opts) => inner.exec(elevateCommand(command), opts),
+    streamExec: (command, onLog, opts) => inner.streamExec(elevateCommand(command), onLog, opts),
+    writeFile: writeFileElevated,
+    readFile: readFileElevated,
+    exists: existsElevated,
+    // Elevated for the same reason as writeFile: the vhost/conf dirs are root-owned,
+    // and the Proxy would otherwise forward this to the inner executor unelevated —
+    // EACCES immediately after an elevated write succeeded.
+    rename: async (from, to) => {
+      await inner.exec(elevateCommand(`mv -f ${sq(from)} ${sq(to)}`));
+    },
+    mkdir: async (path) => {
+      await inner.exec(elevateCommand(`mkdir -p ${sq(path)}`));
+    },
+    rm: async (path) => {
+      await inner.exec(elevateCommand(`rm -rf ${sq(path)}`));
+    }
+  };
+  return new Proxy(inner, {
+    get(target, prop) {
+      if (prop === EXECUTOR_DELEGATE) return target;
+      if (Object.prototype.hasOwnProperty.call(overrides, prop)) {
+        return overrides[prop];
+      }
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+async function ensureOwnedDir(executor, path) {
+  const quoted = sq(path);
+  try {
+    await executor.exec(`mkdir -p ${quoted} && [ -w ${quoted} ]`);
+    return;
+  } catch {
+  }
+  const { isRoot, canSudo } = await resolveEnvironment(executor);
+  if (isRoot) {
+    await executor.exec(`mkdir -p ${quoted}`);
+    return;
+  }
+  if (!canSudo) {
+    throw new Error(
+      `Cannot create ${path} on the target server: the deploy user cannot write there and has no passwordless sudo. Run these once on the server, then redeploy:
+  sudo mkdir -p ${path}
+  sudo chown -R "$(id -un)" ${path}`
+    );
+  }
+  const loginUser = await executor.exec("id -un").then((out) => out.trim()).catch(() => "");
+  const owner = loginUser ? sq(loginUser) : '"$SUDO_USER"';
+  await executor.exec(
+    elevateCommand(
+      [
+        // Without it the `;`-joined steps fall through a failed mkdir, and the
+        // chown's exit status — not the mkdir's — is what the caller sees. That
+        // reported a permission failure as success.
+        "set -e",
+        `p=${quoted}`,
+        "d=$p",
+        "top=",
+        'while [ ! -d "$d" ]; do top=$d; d=$(dirname "$d"); done',
+        'mkdir -p "$p"',
+        // Expansion, not `[ -z "$top" ] && top=…`: that AND-list returns 1 whenever
+        // $top is already set, which under `set -e` would exit before the chown.
+        `chown -R ${owner} "\${top:-$p}"`
+      ].join("; ")
+    )
+  );
+}
+
+// ../../packages/adapters/src/system/environment.ts
+var ENVIRONMENT_PROBE_SCRIPT = `echo "opsh_begin=1"
+# Appended, never replaced: \`ufw\`, \`nft\` and \`iptables\` live in /usr/sbin, which is off
+# a non-root user's PATH on Debian \u2014 so "no firewall installed" was sometimes just "not on
+# this user's PATH", and the box came back \`unknown\`.
+PATH="$PATH:/usr/sbin:/sbin"
+echo "opsh_os=$(uname -s 2>/dev/null || true)"
+echo "opsh_arch=$(uname -m 2>/dev/null || true)"
+echo "opsh_uid=$(id -u 2>/dev/null || true)"
+echo "opsh_user=$(id -un 2>/dev/null || true)"
+echo "opsh_home=$HOME"
+
+OSR=/etc/os-release
+[ -r "$OSR" ] || OSR=/usr/lib/os-release
+# awk and not sed: \`print\` always terminates its record, while sed reproduces the input
+# byte for byte \u2014 and an os-release with no trailing newline glued the next \`echo\` onto
+# the last forwarded line, so \`opsh_pm\` vanished and a working apt host was refused for
+# having no package manager, brackets intact and nothing to flag it.
+[ -r "$OSR" ] && awk '{ print "opsh_osr:" $0 }' "$OSR" 2>/dev/null || true
+
+PM=none
+if command -v apt-get >/dev/null 2>&1; then PM=apt
+elif command -v dnf >/dev/null 2>&1; then PM=dnf
+elif command -v yum >/dev/null 2>&1; then PM=yum
+elif command -v apk >/dev/null 2>&1; then PM=apk
+elif command -v brew >/dev/null 2>&1; then PM=brew
+fi
+echo "opsh_pm=$PM"
+
+SM=none
+if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then SM=systemd
+elif command -v rc-service >/dev/null 2>&1; then SM=openrc
+elif command -v launchctl >/dev/null 2>&1; then SM=launchd
+fi
+echo "opsh_sm=$SM"
+
+SUDO=n
+if [ "$(id -u 2>/dev/null)" != 0 ]; then
+  sudo -n true >/dev/null 2>&1 && SUDO=y
+fi
+echo "opsh_sudo=$SUDO"
+
+# Established BEFORE the firewall probes, because reading a ruleset is privileged:
+# \`iptables -S\` and \`firewall-cmd --state\` refuse outright for an unprivileged user, and a
+# refused read used to come back as "no firewall" \u2014 the one answer that makes us skip
+# opening a port. \`-n\` so a box without passwordless sudo fails instead of waiting for a
+# password on a channel with no TTY, and every elevated command below is a READ.
+PRIV=
+[ "$SUDO" = y ] && PRIV="sudo -n"
+
+HAS_UFW=n; HAS_FWD=n; HAS_NFT=n; HAS_IPT=n
+command -v ufw >/dev/null 2>&1 && HAS_UFW=y
+command -v firewall-cmd >/dev/null 2>&1 && HAS_FWD=y
+command -v nft >/dev/null 2>&1 && HAS_NFT=y
+command -v iptables >/dev/null 2>&1 && HAS_IPT=y
+FW=unknown
+if [ "$HAS_UFW" = y ]; then
+  case "$($PRIV ufw status 2>/dev/null || true)" in *"Status: active"*) FW=ufw ;; esac
+  if [ "$FW" = unknown ] && grep -qiE "^[[:space:]]*ENABLED[[:space:]]*=[[:space:]]*yes" /etc/ufw/ufw.conf 2>/dev/null; then FW=ufw; fi
+fi
+if [ "$FW" = unknown ] && [ "$HAS_FWD" = y ]; then
+  case "$($PRIV firewall-cmd --state 2>/dev/null || true)" in *running*) FW=firewalld ;; esac
+fi
+if [ "$FW" = unknown ] && [ "$HAS_NFT" = y ]; then
+  case "$($PRIV nft list tables 2>/dev/null || true)" in *"table inet filter"*) FW=nftables ;; esac
+fi
+if [ "$FW" = unknown ] && [ "$HAS_IPT" = y ]; then
+  IPT="$($PRIV iptables -S INPUT 2>/dev/null || true)"
+  case "$IPT" in
+    *"-P INPUT DROP"*) FW=iptables ;;
+    # A permissive POLICY does not mean a permissive CHAIN. RHEL's stock ruleset and every
+    # hand-written iptables-persistent file end INPUT in a catch-all reject with the policy
+    # left at ACCEPT, and reading the policy alone reported those hosts as unfirewalled \u2014
+    # so nothing opened a port and the service came up unreachable. Any terminal drop counts:
+    # a single banned IP over-reports slightly, and over-reporting only costs a warning
+    # while under-reporting costs the port. (There is deliberately no \`-P INPUT REJECT\`
+    # arm: netfilter has no such built-in policy, so the old one was unreachable.)
+    *"-P INPUT "*)
+      if printf '%s\\n' "$IPT" | grep -qE '^-A INPUT .*-j (DROP|REJECT)'; then FW=iptables; else FW=none; fi
+      ;;
+  esac
+fi
+if [ "$FW" = unknown ] && [ "$HAS_UFW$HAS_FWD$HAS_NFT$HAS_IPT" = nnnn ]; then FW=none; fi
+echo "opsh_fw=$FW"
+
+LIBC=unknown
+if command -v ldd >/dev/null 2>&1; then
+  case "$(ldd --version 2>&1 || true)" in
+    *musl*) LIBC=musl ;;
+    *GNU*|*GLIBC*|*glibc*) LIBC=glibc ;;
+  esac
+fi
+echo "opsh_libc=$LIBC"
+
+SEL=absent
+if command -v getenforce >/dev/null 2>&1; then
+  SEL=disabled
+  case "$(getenforce 2>/dev/null || true)" in
+    Enforcing*) SEL=enforcing ;;
+    Permissive*) SEL=permissive ;;
+  esac
+fi
+echo "opsh_selinux=$SEL"
+
+CT=n
+[ -f /.dockerenv ] && CT=y
+[ -f /run/.containerenv ] && CT=y
+if [ "$CT" = n ] && grep -qaE "(docker|lxc|containerd|kubepods|libpod)" /proc/1/cgroup 2>/dev/null; then CT=y; fi
+if [ "$CT" = n ] && command -v systemd-detect-virt >/dev/null 2>&1; then
+  systemd-detect-virt --container --quiet >/dev/null 2>&1 && CT=y
+fi
+echo "opsh_container=$CT"
+
+echo "opsh_end=1"
+exit 0`;
+var ENVIRONMENT_PROBE_TIMEOUT_MS = 2e4;
+var MAX_INTERCEPT_CHARS = 400;
+var ENVIRONMENT_PROFILE_TTL_MS = 5 * 6e4;
+function profileIsFresh(measuredAt) {
+  return Date.now() - measuredAt < ENVIRONMENT_PROFILE_TTL_MS;
+}
+var profileCache = /* @__PURE__ */ new WeakMap();
+function isUnansweredProbe(message) {
+  const text = message.trim().toLowerCase();
+  if (text.includes("timed out") || text.includes("without an exit status")) return true;
+  return EXIT_STATUS_ONLY.test(text);
+}
+var EXIT_STATUS_ONLY = /^exit code (?:-?\d+|null|undefined)$/;
+var SILENT_PROBE = "the probe produced no output at all";
+async function runProbe(executor) {
+  const startedAt = Date.now();
+  systemDebug("environment", "probe:start");
+  try {
+    const text = await executor.exec(ENVIRONMENT_PROBE_SCRIPT, {
+      timeout: ENVIRONMENT_PROBE_TIMEOUT_MS
+    });
+    systemDebug("environment", `probe:ok (${formatDuration(startedAt)}) ${text.length}b`);
+    return { text, failed: false, unanswered: false };
+  } catch (err) {
+    if (isRemoteConnectionError(err)) {
+      systemDebug(
+        "environment",
+        `probe:abort (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
+      );
+      throw err;
+    }
+    const message = safeErrorMessage(err);
+    systemDebug("environment", `probe:fail (${formatDuration(startedAt)}) ${message}`);
+    return { text: message, failed: true, unanswered: isUnansweredProbe(message) };
+  }
+}
+function members(all) {
+  return Object.keys(all);
+}
+var PACKAGE_MANAGERS = members({
+  apt: true,
+  dnf: true,
+  yum: true,
+  apk: true,
+  brew: true,
+  none: true
+});
+var SERVICE_MANAGERS = members({
+  systemd: true,
+  openrc: true,
+  launchd: true,
+  none: true
+});
+var FIREWALLS = members({
+  ufw: true,
+  firewalld: true,
+  nftables: true,
+  iptables: true,
+  none: true,
+  unknown: true
+});
+var LIBCS = members({ glibc: true, musl: true, unknown: true });
+var SELINUX_STATES = members({
+  enforcing: true,
+  permissive: true,
+  disabled: true,
+  absent: true
+});
+function oneOf(value, allowed, fallback) {
+  const found = allowed.find((member) => member === value?.trim());
+  return found ?? fallback;
+}
+function splitProbeOutput(text) {
+  const keys = {};
+  const osReleaseLines = [];
+  for (const line of text.split("\n")) {
+    if (line.startsWith("opsh_osr:")) {
+      osReleaseLines.push(line.slice("opsh_osr:".length));
+      continue;
+    }
+    if (!line.startsWith("opsh_")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    keys[line.slice(0, eq)] = line.slice(eq + 1).trimEnd();
+  }
+  return { keys, osRelease: osReleaseLines.join("\n") };
+}
+function summarizeInterception(text) {
+  const collapsed = text.split("\n").map((line) => line.trim()).filter(Boolean).join(" ");
+  if (!collapsed) return null;
+  return collapsed.length > MAX_INTERCEPT_CHARS ? `${collapsed.slice(0, MAX_INTERCEPT_CHARS)}\u2026` : collapsed;
+}
+function parseEnvironmentProbe(probe) {
+  const { keys, osRelease } = splitProbeOutput(probe.text);
+  const complete = keys.opsh_begin === "1" && keys.opsh_end === "1";
+  const said = complete ? null : summarizeInterception(probe.text);
+  const unanswered = !complete && (probe.unanswered || said === null);
+  const forcedCommand = unanswered ? null : said;
+  const probeError = unanswered ? said ?? SILENT_PROBE : null;
+  const os = complete ? parseSystemOs(keys.opsh_os) : "unknown";
+  const osRaw = complete ? keys.opsh_os?.trim() || null : null;
+  const archRaw = complete ? keys.opsh_arch?.trim() || null : null;
+  const arch = complete ? parseSystemArch(keys.opsh_arch) : "unknown";
+  const osReleaseFields = parseOsRelease(osRelease);
+  const distroId = osReleaseFields.ID ?? null;
+  const { distro, family } = classifyDistro(distroId, osReleaseFields.ID_LIKE);
+  const isRoot = keys.opsh_uid?.trim() === "0";
+  const loginUser = keys.opsh_user?.trim() || (isRoot ? "root" : "");
+  const home = keys.opsh_home?.trim() || (isRoot ? "/root" : loginUser ? `/home/${loginUser}` : "");
+  const packageManager = oneOf(keys.opsh_pm, PACKAGE_MANAGERS, "none");
+  const profile = {
+    os,
+    osRaw,
+    arch,
+    archRaw,
+    // `distro` stays null off Linux, where the concept doesn't apply — the existing
+    // contract every call site was written against.
+    distro: os === "linux" ? distro : null,
+    distroFamily: os === "linux" ? family : "unknown",
+    distroId,
+    versionId: osReleaseFields.VERSION_ID ?? null,
+    prettyName: osReleaseFields.PRETTY_NAME ?? null,
+    packageManager,
+    serviceManager: oneOf(keys.opsh_sm, SERVICE_MANAGERS, "none"),
+    firewall: oneOf(keys.opsh_fw, FIREWALLS, "unknown"),
+    libc: oneOf(keys.opsh_libc, LIBCS, "unknown"),
+    selinux: oneOf(keys.opsh_selinux, SELINUX_STATES, "absent"),
+    isContainer: keys.opsh_container?.trim() === "y",
+    isRoot,
+    // Meaningless when root, and the script never probes sudo in that case — the
+    // deliberate `false` the previous detector also returned.
+    canSudo: !isRoot && keys.opsh_sudo?.trim() === "y",
+    loginUser,
+    home,
+    forcedCommand,
+    probeError,
+    supported: false,
+    unsupportedReason: null
+  };
+  return { ...profile, ...assessHostSupport(profile) };
+}
+function cacheKeyFor(executor) {
+  let root = executor;
+  for (let hops = 0; hops < 8; hops += 1) {
+    const delegate = root[EXECUTOR_DELEGATE];
+    if (!delegate || delegate === root) break;
+    root = delegate;
+  }
+  return root;
+}
+async function resolveEnvironment(executor) {
+  const key = cacheKeyFor(executor);
+  const cached = profileCache.get(key);
+  if (cached && profileIsFresh(cached.measuredAt)) {
+    systemDebug("environment", "cache:hit");
+    return cached.profile;
+  }
+  systemDebug("environment", cached ? "cache:stale" : "cache:miss");
+  const promise = (async () => {
+    const profile = parseEnvironmentProbe(await runProbe(key));
+    if (profile.probeError && cached) {
+      systemDebug("environment", `detect:keep-previous ${profile.probeError}`);
+      return cached.profile;
+    }
+    systemDebug("environment", `detect:done ${JSON.stringify(profile)}`);
+    return profile;
+  })();
+  const entry = { measuredAt: Date.now(), profile: promise };
+  const forget = () => {
+    if (profileCache.get(key) === entry) profileCache.delete(key);
+  };
+  profileCache.set(key, entry);
+  promise.then((profile) => {
+    if (profile.probeError) forget();
+  }, forget);
+  return promise;
+}
+function cacheEnvironment(executor, profile) {
+  profileCache.set(cacheKeyFor(executor), {
+    measuredAt: Date.now(),
+    profile: Promise.resolve(profile)
+  });
+}
+
+export {
+  ENVIRONMENT_PROBE_SCRIPT,
+  ENVIRONMENT_PROBE_TIMEOUT_MS,
+  profileIsFresh,
+  parseEnvironmentProbe,
+  resolveEnvironment,
+  cacheEnvironment,
+  EXECUTOR_DELEGATE,
+  dirOf,
+  elevatedExecutor,
+  ensureOwnedDir
+};