openship 0.6.5 → 0.6.7

package/dist/{chunk-5OUWIPOB.js → chunk-5T4UVOM3.js}

@@ -3,102 +3,33 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  PACKAGE_ROOT_ONLY_EXCLUDES,
-  hostFirewallRule,
   isSshAuthError,
-  safeErrorMessage,
   systemDebug
-} from "./chunk-LEYSL46B.js";
-
-// ../../packages/adapters/src/archive.ts
-import { execFile } from "child_process";
-import { mkdtemp, rm, stat, writeFile } from "fs/promises";
-import { tmpdir } from "os";
-import { join } from "path";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var ROOT_ONLY_EXCLUDES = new Set(PACKAGE_ROOT_ONLY_EXCLUDES);
-var NOOP_CLEANUP = async () => {
-};
-function getTarCreateEnv() {
-  return {
-    ...process.env,
-    COPYFILE_DISABLE: "1",
-    COPY_EXTENDED_ATTRIBUTES_DISABLE: "1"
-  };
-}
-function tarCreateBaseArgs(localPath) {
-  const darwinFlags = process.platform === "darwin" ? ["--no-mac-metadata", "--no-xattrs", "--no-acls", "--no-fflags"] : [];
-  return [...darwinFlags, "-czf", "-", "-C", localPath];
-}
-async function gitTrackedFiles(localPath) {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["-C", localPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
-      { maxBuffer: 256 * 1024 * 1024 }
-    );
-    const files = stdout.split("\0").filter(Boolean);
-    return files.length > 0 ? files : null;
-  } catch {
-    return null;
-  }
-}
-async function existingRelativePaths(root, paths) {
-  if (!paths?.length) return [];
-  const found = [];
-  for (const p of paths) {
-    try {
-      await stat(join(root, p));
-      found.push(p);
-    } catch {
-    }
-  }
-  return found;
-}
-async function prepareSourceTarArgs(localPath, options) {
-  if (options?.includes?.length) {
-    return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
-  }
-  const files = await gitTrackedFiles(localPath);
-  if (files) {
-    const extra = await existingRelativePaths(localPath, options?.alsoInclude);
-    const entries = extra.length ? [...files, ...extra] : files;
-    const tmpDir = await mkdtemp(join(tmpdir(), "openship-tarlist-"));
-    const listFile = join(tmpDir, "files.null");
-    await writeFile(listFile, entries.join("\0"));
-    const args = [...tarCreateBaseArgs(localPath), "--null", "-T", listFile];
-    return { args, cleanup: () => rm(tmpDir, { recursive: true, force: true }) };
-  }
-  return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
-}
-function getTarCreateArgs(localPath, options) {
-  const args = tarCreateBaseArgs(localPath);
-  if (options?.includes?.length) {
-    args.push(...options.includes);
-    return args;
-  }
-  for (const exclude of options?.excludes ?? []) {
-    const pattern = ROOT_ONLY_EXCLUDES.has(exclude) ? `./${exclude}` : exclude;
-    args.push(`--exclude=${pattern}`);
-  }
-  args.push(".");
-  return args;
-}
+} from "./chunk-N5YZMO33.js";
+import {
+  HOST_CHANNEL_AUTH_REJECTED,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
+  hostFirewallRule,
+  safeErrorMessage
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";
 
 // ../../packages/adapters/src/system/ssh-support.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 import { access } from "fs/promises";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
 function formatSshTarget(config) {
   return `${config.username ?? "root"}@${config.host}:${config.port ?? 22}`;
 }
 function describeSshAuthFailure(config, originalMessage) {
   const target = formatSshTarget(config);
+  if (config.hostChannel) {
+    return `${HOST_CHANNEL_AUTH_REJECTED} Dialed ${target} from inside the Openship API container. ${HOST_CHANNEL_ROW_CREDENTIALS_UNUSED} ${HOST_CHANNEL_NOT_PROVISIONED} (${originalMessage})`;
+  }
   if (config.password) {
     return `SSH password authentication failed for ${target}. Check the username/password, or verify that the server allows password login. (${originalMessage})`;
   }
@@ -119,7 +50,7 @@ Or re-run \`openship up\`, which probes this and offers the exact rule. (${origi
 }
 function execFileText(command, args, timeout = 5e3) {
   return new Promise((resolve, reject) => {
-    execFile2(command, args, { timeout }, (err, stdout, stderr) => {
+    execFile(command, args, { timeout }, (err, stdout, stderr) => {
       if (err) {
         reject(new Error(stderr.trim() || stdout.trim() || err.message));
         return;
@@ -141,7 +72,7 @@ function parseKnownHostsEntries(text) {
   return entries;
 }
 async function reconcileKnownHosts(config) {
-  const knownHostsPath = join2(homedir(), ".ssh", "known_hosts");
+  const knownHostsPath = join(homedir(), ".ssh", "known_hosts");
   try {
     await access(knownHostsPath);
   } catch {
@@ -378,13 +309,12 @@ async function execSshCommand(client, command, timeout = 1e4) {
 }
 
 export {
-  getTarCreateEnv,
-  prepareSourceTarArgs,
   reconcileKnownHosts,
   connectSshClient,
   openSftp,
   openSshUnixSocket,
   DOCKER_DIAL_STDIO_COMMAND,
+  openSshExecChannel,
   attachDialStdioDiagnostics,
   dialStdioDiagnostics,
   openDockerDialStdioChannel,

package/dist/{chunk-EZPPTWJQ.js → chunk-BLEXTYRK.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-3ZAGC5NT.js → chunk-CIJV43LH.js}

@@ -5,37 +5,45 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-7334NSJL.js";
+} from "./chunk-ZPJ74LXE.js";
 import {
-  createDockerBuildContext,
-  normalizeDockerRelativePath,
-  resolveDockerfileCandidates,
-  resolveWithinDirectory
-} from "./chunk-LFCSC4IU.js";
+  createDockerBuildContext
+} from "./chunk-XWHWTHEL.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-MSZUCNPV.js";
+} from "./chunk-MEE6OZFP.js";
 import {
   BuildLogger,
+  dockerBuildContextDirectory,
+  droppedRuntimeEnvMessage,
   injectGitToken,
+  normalizeDockerRelativePath,
+  resolveContextDockerfileCandidates,
+  resolveDockerfileCandidates,
+  resolveWithinDirectory,
   runBuildPipeline,
+  splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-TM2IQPYU.js";
+} from "./chunk-H4FS5BED.js";
 import {
+  isRuntimeNotFoundError
+} from "./chunk-N5YZMO33.js";
+import {
+  PRICING,
   STACKS,
   SYSTEM,
   TRANSFER_EXCLUDES,
   buildOutputTransferExcludes,
-  isRuntimeNotFoundError,
   missingOutputDirectoryMessage,
+  nodeBinPathExport,
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";
@@ -47,6 +55,11 @@ var DEFAULT_RESOURCE_CONFIG = {
   memoryMb: 512,
   diskMb: 5120
 };
+var DEFAULT_BUILD_RESOURCE_CONFIG = {
+  cpuCores: PRICING.oblien.buildResources.cpuCores,
+  memoryMb: PRICING.oblien.buildResources.memoryMb,
+  diskMb: PRICING.oblien.buildResources.diskGb * 1024
+};
 function cloudCpus(cpuCores) {
   return Math.max(0.25, cpuCores);
 }
@@ -713,9 +726,11 @@ function restartPolicyForWorkload(policy) {
   return "always";
 }
 function resolveCloudWorkloadCmd(opts) {
-  const { commandArgv, startCommand, workdir } = opts;
+  const { commandArgv, startCommand, workdir, binPathExport } = opts;
   if (commandArgv != null) return commandArgv.length > 0 ? commandArgv : void 0;
-  return startCommand ? ["sh", "-c", `cd ${sq(workdir)} && ${startCommand}`] : void 0;
+  if (!startCommand) return void 0;
+  const body = `cd ${sq(workdir)} && ${startCommand}`;
+  return ["sh", "-c", binPathExport ? `${binPathExport} && ${body}` : body];
 }
 function exposeTarget(port, serviceName, slug, domain = SYSTEM.DOMAINS.CLOUD_DOMAIN) {
   const service = `service "${serviceName}" on port ${port}`;
@@ -1314,6 +1329,9 @@ function resolveCopyDestinationPath(copy, sourcePath, destination, destinationIs
   const basename = posix.basename(sourcePath.replace(/\/+$/g, "")) || ".";
   return posix.normalize(posix.join(destination, basename));
 }
+function cloudBuildContextPath(config) {
+  return dockerBuildContextDirectory(config) || normalizeDockerRelativePath(config.rootDirectory);
+}
 var PAGE_CONTAINER_PREFIX = "page:";
 async function provisionCloudWorkspace(client, config, logger) {
   logger?.log(`Creating workspace from image "${config.image}"...
@@ -1414,7 +1432,12 @@ var CloudRuntime = class {
     // per service and continues, rather than the workload coming up on its own
     // network with nothing having said so (#533).
     "networkMode",
-    "pidMode"
+    "pidMode",
+    // A workspace is not a container whose ENTRYPOINT we compose: Oblien resolves its
+    // own workload command, so an override (or a clearing `[]`) has nowhere to land
+    // here. Declared so the deploy says so once per service and continues, rather
+    // than the image's own launcher running with nothing having mentioned it (#575).
+    "entrypoint"
   ]);
   client;
   // Optional admin-scoped proxy. Set when this runtime is constructed
@@ -1781,7 +1804,7 @@ var CloudRuntime = class {
       logger.log("Using Dockerfile content from source metadata.\n");
       return {
         kind: "remote",
-        contextRelativePath: normalizeDockerRelativePath(config.rootDirectory),
+        contextRelativePath: cloudBuildContextPath(config),
         dockerfile: config.dockerfileContent,
         cleanup: async () => {
         }
@@ -1796,9 +1819,12 @@ var CloudRuntime = class {
       requireRepositoryDockerfile: true,
       onLog: logger.callback
     });
-    const dockerfilePath = resolveWithinDirectory(context.contextDir, context.dockerfileName);
+    const dockerfilePath = resolveWithinDirectory(
+      context.buildContextDir,
+      context.dockerfileName
+    );
     const dockerfile = await readFile(dockerfilePath, "utf-8");
-    const contextRoot = resolveWithinDirectory(context.contextDir, context.rootDirectory);
+    const contextRoot = context.contextSubdir ? context.buildContextDir : resolveWithinDirectory(context.contextDir, context.rootDirectory);
     return {
       kind: "local",
       contextRoot,
@@ -1807,7 +1833,10 @@ var CloudRuntime = class {
     };
   }
   async resolveRemoteDockerfileBuildSource(config, logger) {
-    const candidates = resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
+    const contextSubdir = dockerBuildContextDirectory(config);
+    const candidates = contextSubdir ? resolveContextDockerfileCandidates(contextSubdir, config.dockerfilePath).map(
+      (candidate) => `${contextSubdir}/${candidate}`
+    ) : resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
     const sourceLabel = config.commitSha ? `${config.branch}@${config.commitSha.slice(0, 7)}` : config.branch;
     const checkoutRef = config.commitSha ?? "FETCH_HEAD";
     const sourceDir = "/openship/dockerfile-source";
@@ -1870,7 +1899,7 @@ var CloudRuntime = class {
           sourceWorkspaceId = void 0;
           return {
             kind: "remote",
-            contextRelativePath: normalizeDockerRelativePath(config.rootDirectory),
+            contextRelativePath: cloudBuildContextPath(config),
             dockerfile,
             cleanup: async () => {
               await this.ws(workspaceId).delete().catch(() => {
@@ -2052,6 +2081,25 @@ var CloudRuntime = class {
     const contextSource = contextRelativePath ? joinWorkspacePath(repoRoot, contextRelativePath) : contextRoot;
     const prepareContextCommands = contextRelativePath ? [
       `echo "Copying Dockerfile context ${contextRelativePath}..."`,
+      // `cp -a` FOLLOWS a symlinked source directory, so a repo that tracks
+      // `svc -> /` and declares `build: ./svc` would copy the workspace's root
+      // filesystem into its own build context. The lexical `..` refusal above
+      // cannot see that; only a resolved path can. Same class as
+      // GHSA-443m-7g52-94w8, reachable through the build context rather than
+      // rootDirectory, and asserted here for the same reason the docker paths
+      // assert it: at the sink.
+      // `pwd -P` rather than `readlink -f`: it is a POSIX shell builtin, so it
+      // exists in every workspace image, and it answers both questions at once —
+      // the `cd` fails when the context is not a directory, and the resolved path
+      // reveals a symlink that left the checkout.
+      // BOTH sides resolved, and an unresolvable either side is fatal: an empty
+      // `__root` would turn the prefix test into `"/"*`, which every absolute path
+      // matches — a containment check that passes vacuously is worse than none.
+      // `|| __x=""` keeps `set -e` from killing the script before the message.
+      `__root="$(cd ${sq(repoRoot)} && pwd -P)" || __root=""`,
+      `__ctx="$(cd ${sq(contextSource)} 2>/dev/null && pwd -P)" || __ctx=""`,
+      `if [ -z "$__root" ] || [ -z "$__ctx" ]; then echo "Build context ${contextRelativePath} is not a directory in this repository." >&2; exit 1; fi`,
+      `case "$__ctx/" in "$__root/"*) ;; *) echo "Build context ${contextRelativePath} resolves outside this repository." >&2; exit 1 ;; esac`,
       `mkdir -p ${sq(contextRoot)}`,
       `cp -a ${sq(`${contextSource}/.`)} ${sq(contextRoot)}/`
     ] : ['echo "Using repository root as Dockerfile context."'];
@@ -2374,15 +2422,28 @@ fi`;
       }
     }
     const startCommand = builtArtifact?.runtime.startCommand || config.startCommand || "npm start";
+    const projectEnv = splitRuntimeEnv(config.envVars);
+    if (projectEnv.dropped.length > 0) {
+      onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: droppedRuntimeEnvMessage(projectEnv.dropped)
+      });
+    }
     const envArray = toEnvArray2({
       ...builtArtifact?.runtime.env ?? {},
-      ...config.envVars
+      ...Object.fromEntries(projectEnv.entries)
     });
     const restartPolicy = config.restartPolicy === "no" ? "never" : config.restartPolicy ?? "always";
+    const workloadCmd = resolveCloudWorkloadCmd({
+      startCommand,
+      workdir: workDir,
+      binPathExport: builtArtifact ? "" : nodeBinPathExport(config.packageManager, [workDir, "/app"])
+    });
     try {
       await ws.workloads.create({
         name: "app",
-        cmd: ["sh", "-c", `cd ${workDir} && ${startCommand}`],
+        cmd: workloadCmd,
         working_dir: workDir,
         env: [...envArray, `PORT=${config.port}`],
         restart_policy: restartPolicy,
@@ -2684,15 +2745,7 @@ fi`;
   }
   async purge(deployment) {
     if (deployment.containerId?.startsWith(PAGE_CONTAINER_PREFIX)) {
-      const slug = deployment.containerId.slice(5);
-      try {
-        if (this.adminProxy?.deletePage) {
-          await this.adminProxy.deletePage(slug);
-        } else {
-          await this.client.pages.delete(slug);
-        }
-      } catch {
-      }
+      await this.destroy(deployment.containerId);
       return;
     }
     if (!deployment.containerId) return;
@@ -2706,10 +2759,7 @@ fi`;
         err instanceof Error ? err.message : err
       );
     }
-    try {
-      await this.destroy(deployment.containerId);
-    } catch {
-    }
+    await this.destroy(deployment.containerId);
   }
   // ── Observability ──────────────────────────────────────────────────────
   async getContainerInfo(containerId) {