openship 0.6.1 → 0.6.6

package/dist/{chunk-RRJJGVKE.js → chunk-OBPKYXQL.js}

@@ -5,42 +5,42 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-IOT5ZX23.js";
+} from "./chunk-A4GXYE4L.js";
 import {
   createDockerBuildContext,
   normalizeDockerRelativePath,
-  resolveDockerfileCandidates
-} from "./chunk-EMXI4UCU.js";
+  resolveDockerfileCandidates,
+  resolveWithinDirectory
+} from "./chunk-LUKYPVJ4.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-JIMUYEKN.js";
+} from "./chunk-YIMOCZBZ.js";
 import {
   BuildLogger,
   injectGitToken,
   runBuildPipeline,
   sq,
   transferLocalDirectory
-} from "./chunk-VDDMADOF.js";
-import {
-  isRuntimeNotFoundError
-} from "./chunk-ZCFVHA25.js";
+} from "./chunk-LH2PLRQO.js";
 import {
+  PRICING,
   STACKS,
   SYSTEM,
   TRANSFER_EXCLUDES,
   buildOutputTransferExcludes,
+  isRuntimeNotFoundError,
   missingOutputDirectoryMessage,
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";
-import { join, posix } from "path";
+import { posix } from "path";
 
 // ../../packages/adapters/src/types.ts
 var DEFAULT_RESOURCE_CONFIG = {
@@ -48,6 +48,11 @@ var DEFAULT_RESOURCE_CONFIG = {
   memoryMb: 512,
   diskMb: 5120
 };
+var DEFAULT_BUILD_RESOURCE_CONFIG = {
+  cpuCores: PRICING.oblien.buildResources.cpuCores,
+  memoryMb: PRICING.oblien.buildResources.memoryMb,
+  diskMb: PRICING.oblien.buildResources.diskGb * 1024
+};
 function cloudCpus(cpuCores) {
   return Math.max(0.25, cpuCores);
 }
@@ -1367,6 +1372,16 @@ async function provisionCloudWorkspace(client, config, logger) {
     throw err;
   }
 }
+var HostBuildForbiddenError = class extends Error {
+  code = "HOST_BUILD_FORBIDDEN";
+  constructor(message) {
+    super(message);
+    this.name = "HostBuildForbiddenError";
+  }
+};
+function isHostBuildForbiddenError(err) {
+  return err instanceof HostBuildForbiddenError || err instanceof Error && err.name === "HostBuildForbiddenError";
+}
 var CloudRuntime = class {
   name = "cloud";
   capabilities = /* @__PURE__ */ new Set([
@@ -1387,7 +1402,10 @@ var CloudRuntime = class {
     // disk is still there to start back up (see makeActive).
     "unitRestore",
     "serviceShell",
-    "inContainerExec"
+    "inContainerExec",
+    // Runs in the REMOTE workspace over the Oblien API, so it never touches the
+    // control-plane host.
+    "isolatedExec"
   ]);
   /**
    * Services map to Oblien workspaces, not Docker containers, so host-level
@@ -1396,7 +1414,18 @@ var CloudRuntime = class {
    * logging/dns — join this set as they're added in later phases.
    */
   unsupportedComposeKeys = /* @__PURE__ */ new Set([
-    "healthcheck"
+    "healthcheck",
+    // Namespace sharing has no Oblien equivalent — a workspace is not a container
+    // whose netns/pidns a peer can join. Declared here so the deploy warns once
+    // per service and continues, rather than the workload coming up on its own
+    // network with nothing having said so (#533).
+    "networkMode",
+    "pidMode",
+    // A workspace is not a container whose ENTRYPOINT we compose: Oblien resolves its
+    // own workload command, so an override (or a clearing `[]`) has nowhere to land
+    // here. Declared so the deploy says so once per service and continues, rather
+    // than the image's own launcher running with nothing having mentioned it (#575).
+    "entrypoint"
   ]);
   client;
   // Optional admin-scoped proxy. Set when this runtime is constructed
@@ -1409,9 +1438,20 @@ var CloudRuntime = class {
   builtArtifacts = /* @__PURE__ */ new Map();
   activeBuilds = /* @__PURE__ */ new Map();
   compose;
+  /**
+   * May this runtime do work on the machine the API process runs on?
+   *
+   * DEFAULT DENY, unlike every other optional knob on PlatformConfig. The permissive
+   * default is what the two host arms below relied on, and the cost of forgetting to
+   * set it is a tenant's build commands running on a multi-tenant control plane —
+   * while the cost of a missed opt-IN is a self-hosted local-orchestrated cloud deploy
+   * failing loudly with the message below. Loud beats silent here.
+   */
+  allowHostBuild;
   constructor(client, opts) {
     this.client = client;
     this.adminProxy = opts?.adminProxy;
+    this.allowHostBuild = opts?.allowHostBuild ?? false;
     this.compose = new CloudComposeSupport({
       client,
       builtArtifacts: this.builtArtifacts,
@@ -1420,6 +1460,16 @@ var CloudRuntime = class {
       execAndStream: (runtime, command, onLog, timeoutSeconds) => this.execAndStream(runtime, command, onLog, timeoutSeconds)
     });
   }
+  /**
+   * Refuse work on the API's own machine unless this runtime was explicitly built to
+   * allow it. `what` completes the sentence "… is not allowed to <what>".
+   */
+  assertHostWorkAllowed(what) {
+    if (this.allowHostBuild) return;
+    throw new HostBuildForbiddenError(
+      `This deployment asked to ${what}, which is not permitted on this instance. Cloud builds run inside your Oblien workspace. If this project was moved here from a self-hosted install, redeploy it so its build settings are re-resolved for the cloud (its stored settings still say "build locally").`
+    );
+  }
   supports(cap) {
     return this.capabilities.has(cap);
   }
@@ -1496,6 +1546,11 @@ var CloudRuntime = class {
         return activeBuild.abort.signal.aborted ? { ...result2, status: "cancelled", errorMessage: void 0 } : result2;
       }
       const buildLocally = config.buildStrategy === "local";
+      if (buildLocally) {
+        this.assertHostWorkAllowed(
+          "run this project's install and build commands on the machine this API runs on"
+        );
+      }
       let wsId;
       let rt;
       try {
@@ -1629,6 +1684,9 @@ var CloudRuntime = class {
             await this.ensureWorkspaceGit(rt, plog, "build workspace");
             return;
           }
+          this.assertHostWorkAllowed(
+            "package a source directory from the machine this API runs on"
+          );
           await transferLocalDirectory(
             cfg.localPath,
             {
@@ -1743,17 +1801,15 @@ var CloudRuntime = class {
     if (!config.localPath) {
       return this.resolveRemoteDockerfileBuildSource(config, logger);
     }
+    this.assertHostWorkAllowed("read and package a source tree from the machine this API runs on");
     logger.log("Preparing local Dockerfile source...\n");
     const context = await createDockerBuildContext(config, {
       requireRepositoryDockerfile: true,
       onLog: logger.callback
     });
-    const dockerfilePath = join(context.contextDir, ...context.dockerfileName.split("/"));
+    const dockerfilePath = resolveWithinDirectory(context.contextDir, context.dockerfileName);
     const dockerfile = await readFile(dockerfilePath, "utf-8");
-    const contextRoot = join(
-      context.contextDir,
-      ...normalizeDockerRelativePath(context.rootDirectory).split("/").filter(Boolean)
-    );
+    const contextRoot = resolveWithinDirectory(context.contextDir, context.rootDirectory);
     return {
       kind: "local",
       contextRoot,
@@ -3129,5 +3185,7 @@ function clampShellWindow(value, fallback, min, max) {
 export {
   PAGE_CONTAINER_PREFIX,
   provisionCloudWorkspace,
+  HostBuildForbiddenError,
+  isHostBuildForbiddenError,
   CloudRuntime
 };

package/dist/{chunk-6ODUBKUB.js → chunk-PCPVTH6M.js}

@@ -3,102 +3,31 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  HOST_CHANNEL_AUTH_REJECTED,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
+  hostFirewallRule,
   isSshAuthError,
+  safeErrorMessage,
   systemDebug
-} from "./chunk-ZCFVHA25.js";
-import {
-  PACKAGE_ROOT_ONLY_EXCLUDES
-} from "./chunk-OTLSJYAC.js";
-
-// ../../packages/adapters/src/archive.ts
-import { execFile } from "child_process";
-import { mkdtemp, rm, stat, writeFile } from "fs/promises";
-import { tmpdir } from "os";
-import { join } from "path";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var ROOT_ONLY_EXCLUDES = new Set(PACKAGE_ROOT_ONLY_EXCLUDES);
-var NOOP_CLEANUP = async () => {
-};
-function getTarCreateEnv() {
-  return {
-    ...process.env,
-    COPYFILE_DISABLE: "1",
-    COPY_EXTENDED_ATTRIBUTES_DISABLE: "1"
-  };
-}
-function tarCreateBaseArgs(localPath) {
-  const darwinFlags = process.platform === "darwin" ? ["--no-mac-metadata", "--no-xattrs", "--no-acls", "--no-fflags"] : [];
-  return [...darwinFlags, "-czf", "-", "-C", localPath];
-}
-async function gitTrackedFiles(localPath) {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["-C", localPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
-      { maxBuffer: 256 * 1024 * 1024 }
-    );
-    const files = stdout.split("\0").filter(Boolean);
-    return files.length > 0 ? files : null;
-  } catch {
-    return null;
-  }
-}
-async function existingRelativePaths(root, paths) {
-  if (!paths?.length) return [];
-  const found = [];
-  for (const p of paths) {
-    try {
-      await stat(join(root, p));
-      found.push(p);
-    } catch {
-    }
-  }
-  return found;
-}
-async function prepareSourceTarArgs(localPath, options) {
-  if (options?.includes?.length) {
-    return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
-  }
-  const files = await gitTrackedFiles(localPath);
-  if (files) {
-    const extra = await existingRelativePaths(localPath, options?.alsoInclude);
-    const entries = extra.length ? [...files, ...extra] : files;
-    const tmpDir = await mkdtemp(join(tmpdir(), "openship-tarlist-"));
-    const listFile = join(tmpDir, "files.null");
-    await writeFile(listFile, entries.join("\0"));
-    const args = [...tarCreateBaseArgs(localPath), "--null", "-T", listFile];
-    return { args, cleanup: () => rm(tmpDir, { recursive: true, force: true }) };
-  }
-  return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
-}
-function getTarCreateArgs(localPath, options) {
-  const args = tarCreateBaseArgs(localPath);
-  if (options?.includes?.length) {
-    args.push(...options.includes);
-    return args;
-  }
-  for (const exclude of options?.excludes ?? []) {
-    const pattern = ROOT_ONLY_EXCLUDES.has(exclude) ? `./${exclude}` : exclude;
-    args.push(`--exclude=${pattern}`);
-  }
-  args.push(".");
-  return args;
-}
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";
 
 // ../../packages/adapters/src/system/ssh-support.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 import { access } from "fs/promises";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
 function formatSshTarget(config) {
   return `${config.username ?? "root"}@${config.host}:${config.port ?? 22}`;
 }
 function describeSshAuthFailure(config, originalMessage) {
   const target = formatSshTarget(config);
+  if (config.hostChannel) {
+    return `${HOST_CHANNEL_AUTH_REJECTED} Dialed ${target} from inside the Openship API container. ${HOST_CHANNEL_ROW_CREDENTIALS_UNUSED} ${HOST_CHANNEL_NOT_PROVISIONED} (${originalMessage})`;
+  }
   if (config.password) {
     return `SSH password authentication failed for ${target}. Check the username/password, or verify that the server allows password login. (${originalMessage})`;
   }
@@ -107,9 +36,19 @@ function describeSshAuthFailure(config, originalMessage) {
   }
   return `SSH authentication failed for ${target}. (${originalMessage})`;
 }
+function describeSshConnectFailure(config, originalMessage) {
+  const target = formatSshTarget(config);
+  const port = config.port ?? 22;
+  if (config.hostChannel) {
+    return `Cannot reach the host SSH endpoint ${target} from inside the Openship API container. Host control is configured, but the connection never completed. The usual cause is a host firewall dropping traffic from the Docker bridge to the host's SSH port \u2014 allow it with:
+${hostFirewallRule("unknown", [], port)}
+Or re-run \`openship up\`, which probes this and offers the exact rule. (${originalMessage})`;
+  }
+  return `Cannot reach ${target} over SSH. Check that the host is up, that port ${port} is open, and that no firewall or security group is dropping the connection. (${originalMessage})`;
+}
 function execFileText(command, args, timeout = 5e3) {
   return new Promise((resolve, reject) => {
-    execFile2(command, args, { timeout }, (err, stdout, stderr) => {
+    execFile(command, args, { timeout }, (err, stdout, stderr) => {
       if (err) {
         reject(new Error(stderr.trim() || stdout.trim() || err.message));
         return;
@@ -131,7 +70,7 @@ function parseKnownHostsEntries(text) {
   return entries;
 }
 async function reconcileKnownHosts(config) {
-  const knownHostsPath = join2(homedir(), ".ssh", "known_hosts");
+  const knownHostsPath = join(homedir(), ".ssh", "known_hosts");
   try {
     await access(knownHostsPath);
   } catch {
@@ -205,6 +144,10 @@ function toConnectConfig(config) {
     passphrase: config.privateKeyPassphrase,
     agent: config.sshAgent,
     tryKeyboard: false,
+    // Explicit rather than relying on ssh2's implicit 20s so callers can shorten it.
+    // The container→host channel does (8s): a filtered SYN there would otherwise
+    // stall every host operation for 20s apiece with no output.
+    readyTimeout: config.readyTimeoutMs ?? 2e4,
     keepaliveInterval: 15e3,
     // 10 (~150s) rather than 3 (45s): a small server pegged by a heavy
     // `docker build` / `bun install` can briefly starve sshd of keepalive
@@ -230,12 +173,12 @@ async function connectSshClient(config) {
         reject(new Error(describeSshAuthFailure(config, err.message)));
         return;
       }
-      reject(err);
+      reject(new Error(describeSshConnectFailure(config, err.message)));
     });
     client.on("close", () => {
       if (settled) return;
       settled = true;
-      reject(new Error("SSH connection closed before ready"));
+      reject(new Error(describeSshConnectFailure(config, "SSH connection closed before ready")));
     });
     client.connect(toConnectConfig(config));
   });
@@ -263,6 +206,7 @@ async function openSshUnixSocket(client, socketPath) {
     });
   });
 }
+var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
 async function openSshExecChannel(client, command) {
   return new Promise((resolve, reject) => {
     client.exec(command, (err, stream) => {
@@ -274,6 +218,50 @@ async function openSshExecChannel(client, command) {
     });
   });
 }
+var DIAL_STDIO_DIAGNOSTICS = /* @__PURE__ */ Symbol("openship.dialStdioDiagnostics");
+var DIAL_STDIO_STDERR_CAP = 4096;
+function attachDialStdioDiagnostics(stream) {
+  const channel = stream;
+  if (channel[DIAL_STDIO_DIAGNOSTICS]) return stream;
+  const diagnostics = {
+    stderr: "",
+    exitCode: null,
+    signal: null,
+    error: null
+  };
+  channel[DIAL_STDIO_DIAGNOSTICS] = diagnostics;
+  const stderr = stream.stderr;
+  stderr?.on("data", (chunk) => {
+    if (diagnostics.stderr.length >= DIAL_STDIO_STDERR_CAP) return;
+    diagnostics.stderr = (diagnostics.stderr + chunk.toString("utf8")).slice(
+      0,
+      DIAL_STDIO_STDERR_CAP
+    );
+  });
+  stream.on("exit", (code, signal) => {
+    diagnostics.exitCode = typeof code === "number" ? code : null;
+    diagnostics.signal = typeof signal === "string" ? signal : null;
+  });
+  stream.on("error", (err) => {
+    diagnostics.error ??= safeErrorMessage(err);
+  });
+  return stream;
+}
+function dialStdioDiagnostics(stream) {
+  const diagnostics = stream?.[DIAL_STDIO_DIAGNOSTICS];
+  if (!diagnostics) return "";
+  const parts = [];
+  const stderr = diagnostics.stderr.trim();
+  if (stderr) parts.push(stderr.replace(/\s+/g, " "));
+  if (diagnostics.error) parts.push(diagnostics.error);
+  if (diagnostics.signal) parts.push(`killed by ${diagnostics.signal}`);
+  else if (diagnostics.exitCode) parts.push(`exit code ${diagnostics.exitCode}`);
+  if (parts.length === 0) return "";
+  return `\`${DOCKER_DIAL_STDIO_COMMAND}\` reported: ${parts.join(" \u2014 ")}`;
+}
+async function openDockerDialStdioChannel(client) {
+  return attachDialStdioDiagnostics(await openSshExecChannel(client, DOCKER_DIAL_STDIO_COMMAND));
+}
 async function execSshCommand(client, command, timeout = 1e4) {
   return new Promise((resolve, reject) => {
     let stdout = "";
@@ -319,12 +307,14 @@ async function execSshCommand(client, command, timeout = 1e4) {
 }
 
 export {
-  getTarCreateEnv,
-  prepareSourceTarArgs,
   reconcileKnownHosts,
   connectSshClient,
   openSftp,
   openSshUnixSocket,
+  DOCKER_DIAL_STDIO_COMMAND,
   openSshExecChannel,
+  attachDialStdioDiagnostics,
+  dialStdioDiagnostics,
+  openDockerDialStdioChannel,
   execSshCommand
 };

package/dist/chunk-Q7WGTQQ5.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  PACKAGE_ROOT_ONLY_EXCLUDES
+} from "./chunk-UJ6JZM65.js";
+
+// ../../packages/adapters/src/archive.ts
+import { execFile } from "child_process";
+import { mkdtemp, rm, stat, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var ROOT_ONLY_EXCLUDES = new Set(PACKAGE_ROOT_ONLY_EXCLUDES);
+var NOOP_CLEANUP = async () => {
+};
+function getTarCreateEnv() {
+  return {
+    ...process.env,
+    COPYFILE_DISABLE: "1",
+    COPY_EXTENDED_ATTRIBUTES_DISABLE: "1"
+  };
+}
+function tarCreateBaseArgs(localPath) {
+  const darwinFlags = process.platform === "darwin" ? ["--no-mac-metadata", "--no-xattrs", "--no-acls", "--no-fflags"] : [];
+  return [...darwinFlags, "-czf", "-", "-C", localPath];
+}
+async function gitTrackedFiles(localPath) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", localPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      { maxBuffer: 256 * 1024 * 1024 }
+    );
+    const files = stdout.split("\0").filter(Boolean);
+    return files.length > 0 ? files : null;
+  } catch {
+    return null;
+  }
+}
+async function existingRelativePaths(root, paths) {
+  if (!paths?.length) return [];
+  const found = [];
+  for (const p of paths) {
+    try {
+      await stat(join(root, p));
+      found.push(p);
+    } catch {
+    }
+  }
+  return found;
+}
+async function prepareSourceTarArgs(localPath, options) {
+  if (options?.includes?.length) {
+    return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
+  }
+  const files = await gitTrackedFiles(localPath);
+  if (files) {
+    const extra = await existingRelativePaths(localPath, options?.alsoInclude);
+    const entries = extra.length ? [...files, ...extra] : files;
+    const tmpDir = await mkdtemp(join(tmpdir(), "openship-tarlist-"));
+    const listFile = join(tmpDir, "files.null");
+    await writeFile(listFile, entries.join("\0"));
+    const args = [...tarCreateBaseArgs(localPath), "--null", "-T", listFile];
+    return { args, cleanup: () => rm(tmpDir, { recursive: true, force: true }) };
+  }
+  return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
+}
+function getTarCreateArgs(localPath, options) {
+  const args = tarCreateBaseArgs(localPath);
+  if (options?.includes?.length) {
+    args.push(...options.includes);
+    return args;
+  }
+  for (const exclude of options?.excludes ?? []) {
+    const pattern = ROOT_ONLY_EXCLUDES.has(exclude) ? `./${exclude}` : exclude;
+    args.push(`--exclude=${pattern}`);
+  }
+  args.push(".");
+  return args;
+}
+
+export {
+  getTarCreateEnv,
+  prepareSourceTarArgs
+};