openship 0.6.5 → 0.6.7

package/dist/{chunk-MSZUCNPV.js → chunk-MEE6OZFP.js}

@@ -6,13 +6,13 @@ import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-TM2IQPYU.js";
+} from "./chunk-H4FS5BED.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
   wrapLocalBuildCommand
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 
 // ../../packages/adapters/src/runtime/local-build.ts
 var LOCAL_BUILD_DIR = "/tmp/openship/.builds";

package/dist/chunk-N5YZMO33.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+
+// ../../packages/adapters/src/system/errors.ts
+var SSH_AUTH_ERROR_PATTERNS = [
+  "All configured authentication methods failed"
+];
+var RETRYABLE_CONNECTION_ERROR_PATTERNS = [
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "Timed out",
+  "Not connected",
+  "Connection lost",
+  "read ECONNRESET",
+  "Handshake failed",
+  "keepalive timeout",
+  "SSH connection closed before ready",
+  // ssh2 emits "Channel open failure: open failed" / "Channel open failure: …"
+  // when the SSH SERVER refuses a new channel - typically because the cached
+  // connection has gone half-dead (peer-side LOGOUT, network blip,
+  // remote sshd MaxSessions). The inner SshExecutor retries `exec`/
+  // `streamExec` on this, but `pipeLocal`, `transferIn`, and any other
+  // channel-bearing op bubble it up. Listing it here lets `withExecutor`
+  // drop the dead connection and retry transparently - fixes the
+  // "first redeploy fails, second click works" pattern.
+  "Channel open failure",
+  "open failed"
+  // NOT "socket hang up": it is what an HTTP client reports for ANY far end that vanished
+  // mid-request, including a permission-denied Docker socket and a wedged channel, neither
+  // of which a fresh connection fixes. A match here makes `withExecutor` replay its whole
+  // callback — and those callbacks install mail, create mailboxes and ensure the edge, so a
+  // non-retryable cause becomes a repeated mutation. `core/connectivity.ts` labels it
+  // without retrying, `api/lib/remote-state.ts` still maps it to a 503, and the bridge's
+  // 502 carries the real reason — so leaving it out here costs no diagnosis.
+];
+var SshDisconnectedError = class extends Error {
+  constructor(message = "SSH connection lost") {
+    super(message);
+    this.name = "SshDisconnectedError";
+  }
+};
+function isSshDisconnectedError(err) {
+  return err instanceof SshDisconnectedError || err instanceof Error && err.name === "SshDisconnectedError";
+}
+function isSshAuthError(err) {
+  if (!(err instanceof Error)) return false;
+  return SSH_AUTH_ERROR_PATTERNS.some((pattern) => err.message.includes(pattern));
+}
+var HostChannelUnavailableError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "HostChannelUnavailableError";
+    this.code = code;
+  }
+};
+function isRetryableRemoteConnectionError(err) {
+  if (isSshDisconnectedError(err)) return true;
+  if (!(err instanceof Error)) return false;
+  return RETRYABLE_CONNECTION_ERROR_PATTERNS.some(
+    (pattern) => err.message.includes(pattern)
+  );
+}
+function isRemoteConnectionError(err) {
+  return isSshAuthError(err) || isRetryableRemoteConnectionError(err);
+}
+var MAX_COMMAND_CHARS = 120;
+function commandForError(command) {
+  const oneLine = command.trim().replace(/\s+/g, " ");
+  return oneLine.length > MAX_COMMAND_CHARS ? `${oneLine.slice(0, MAX_COMMAND_CHARS)}\u2026 (${command.length} chars)` : oneLine;
+}
+function isRuntimeNotFoundError(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  if (e.statusCode === 404) return true;
+  return typeof e.message === "string" && /no such (container|image|volume|network)/i.test(e.message);
+}
+
+// ../../packages/adapters/src/system/debug.ts
+function isTruthy(value) {
+  if (!value) return false;
+  return ["1", "true", "yes", "on", "debug"].includes(value.toLowerCase());
+}
+function isSystemDebugEnabled() {
+  return isTruthy(process.env.SYSTEM_DEBUG_LOGS);
+}
+function systemDebug(scope, message) {
+  if (!isSystemDebugEnabled()) return;
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  console.log(`[system-debug] ${timestamp} [${scope}] ${message}`);
+}
+function formatDuration(startMs) {
+  return `${Date.now() - startMs}ms`;
+}
+
+export {
+  SshDisconnectedError,
+  isSshAuthError,
+  HostChannelUnavailableError,
+  isRetryableRemoteConnectionError,
+  isRemoteConnectionError,
+  commandForError,
+  isRuntimeNotFoundError,
+  systemDebug,
+  formatDuration
+};

package/dist/{chunk-VLQ3UIVO.js → chunk-NRTJRNAE.js}

@@ -2,14 +2,6 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  edgeDownExplanation,
-  explainEdgeDown,
-  isEdgeDownFailure
-} from "./chunk-I3DPMTSF.js";
-import {
-  edgeFailureReason
-} from "./chunk-WE7BXW6L.js";
 import {
   ACME_CHALLENGE_LOCATION,
   ACME_HTTP01_PORT,
@@ -26,14 +18,28 @@ import {
   edgeChallengeVhostConf,
   isCloudFrontedHost,
   luaSourceAvailable
-} from "./chunk-PZRRL5PC.js";
+} from "./chunk-QHMDCYZ3.js";
+import {
+  edgeDownExplanation,
+  explainEdgeDown,
+  isEdgeDownFailure
+} from "./chunk-I3DPMTSF.js";
+import {
+  probeHostedHttp
+} from "./chunk-R4VDPFLS.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-FZ6QCF6B.js";
 import {
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
+import {
+  edgeFailureReason
+} from "./chunk-GIPJNNI5.js";
+import {
+  probeListeningPort
+} from "./chunk-VSTFHUCV.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -41,7 +47,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -291,21 +297,49 @@ async function readDeclaredPair(exec, certPath, keyPath, container) {
 }
 
 // ../../packages/adapters/src/system/output-exists.ts
-function buildCommand(servedPath) {
+var SAFE_HOST = /^[A-Za-z0-9][A-Za-z0-9.-]{0,252}$/;
+var SAFE_PATH = /^\/[A-Za-z0-9._~/-]*$/;
+function safeRequestPath(path) {
+  return SAFE_PATH.test(path) && !path.split("/").includes("..");
+}
+function buildCommand(servedPath, opts) {
   const p = servedPath.replace(/'/g, "'\\''");
-  return [
+  const parts = [
     `if [ -e '${p}' ]; then echo FOUND; fi`,
-    `if [ -f '${p}' ] || [ -f '${p}/index.html' ]; then echo INDEX; fi`,
-    "true"
-  ].join("; ");
+    `if [ -f '${p}' ] || [ -f '${p}/index.html' ]; then echo INDEX; fi`
+  ];
+  const host = opts?.hostname;
+  const path = opts?.requestPath ?? "/";
+  if (host && SAFE_HOST.test(host) && safeRequestPath(path)) {
+    const port = opts?.edgePort ?? 80;
+    const maxTime = opts?.timeoutSeconds ?? 3;
+    parts.push(
+      `if command -v curl >/dev/null 2>&1; then echo "HTTP $(curl -sS -o /dev/null -w '%{http_code} %{num_connects}' --max-time ${maxTime} -H 'Host: ${host}' -H 'X-Forwarded-Proto: https' 'http://127.0.0.1:${port}${path}' 2>/dev/null)"; fi`
+    );
+  }
+  parts.push("true");
+  return parts.join("; ");
+}
+function statusIsServed(status) {
+  if (status >= 200 && status < 400) return true;
+  return status === 401 || status === 403;
 }
-async function probeStaticOutput(executor, servedPath) {
+function parseHttp(out) {
+  const match = /(^|\n)HTTP (\d+) (\d+)(\r?\n|$)/.exec(out);
+  if (!match) return {};
+  const status = Number(match[2]);
+  const connects = Number(match[3]);
+  if (!Number.isFinite(status) || status === 0 || connects === 0) return {};
+  return { status, served: statusIsServed(status) };
+}
+async function probeStaticOutput(executor, servedPath, opts) {
   try {
-    const out = await executor.exec(buildCommand(servedPath), { timeout: 5e3 });
+    const out = await executor.exec(buildCommand(servedPath, opts), { timeout: 8e3 });
     return {
       found: /(^|\n)FOUND(\r?\n|$)/.test(out),
       hasIndex: /(^|\n)INDEX(\r?\n|$)/.test(out),
-      checked: true
+      checked: true,
+      ...parseHttp(out)
     };
   } catch {
     return { found: false, hasIndex: false, checked: false };
@@ -321,14 +355,15 @@ var PROXY_HEADERS = `proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto $openship_fwd_proto;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";`;
+        proxy_set_header Connection "upgrade";
+        proxy_pass_header X-Accel-Buffering;`;
 var FORWARD_VARS = `    set $openship_fwd_proto $scheme;
     set $openship_redirect_https 1;
     if ($http_x_forwarded_proto = "https") {
         set $openship_fwd_proto https;
         set $openship_redirect_https 0;
     }`;
-var VHOST_GENERATION = 1;
+var VHOST_GENERATION = 2;
 var GENERATION_MARKER = `# openship-vhost-gen: ${VHOST_GENERATION}`;
 var GENERATED_HEADER = `# Auto-generated by Openship - do not edit manually
 ${GENERATION_MARKER}`;
@@ -638,6 +673,11 @@ function assertValidStaticRoot(root, opts) {
   }
 }
 var execFileAsync = promisify(cpExecFile);
+function isAcmePortBindFailure(output) {
+  return /could not bind (?:tcp )?port|address already in use|problem binding to port/i.test(
+    output || ""
+  );
+}
 function summarizeCertbotFailure(output, domain) {
   const edgeDown = edgeDownExplanation(output);
   if (edgeDown) return edgeDown;
@@ -654,7 +694,9 @@ function certbotDiagnosis(output, domain) {
   const challengeUrl = pick(/https?:\/\/\S*\.well-known\/acme-challenge\/\S*/i);
   const redirectedToHttps = /^https:/i.test(challengeUrl ?? "");
   let diagnosis;
-  if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
+  if (isAcmePortBindFailure(text)) {
+    diagnosis = `Couldn't start the certificate challenge listener for ${domain} on port ${ACME_HTTP01_PORT}: something on this server is already holding it. That port is used only while a certificate is being issued, so this is almost always a certificate run from an earlier attempt that hasn't exited \u2014 retry, and if it persists find the holder with \`ss -ltnp | grep ${ACME_HTTP01_PORT}\` and stop it. Nothing was requested from Let's Encrypt, so this is not a DNS or routing problem.`;
+  } else if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
   } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
@@ -968,8 +1010,19 @@ var NginxProvider = class {
    *
    * Advisory: never throws.
    */
-  async probeStaticRoot(servedPath) {
-    if (this.executor) return probeStaticOutput(this.executor, servedPath);
+  async probeStaticRoot(servedPath, opts) {
+    if (this.executor) return probeStaticOutput(this.executor, servedPath, opts);
+    const fs = await this.probeStaticRootViaFs(servedPath);
+    if (!opts?.hostname) return fs;
+    const http = await probeHostedHttp({
+      hostname: opts.hostname,
+      path: opts.requestPath ?? "/",
+      port: opts.edgePort ?? 80,
+      timeoutMs: (opts.timeoutSeconds ?? 3) * 1e3
+    });
+    return http ? { ...fs, status: http.status, served: http.served } : fs;
+  }
+  async probeStaticRootViaFs(servedPath) {
     const found = await this._exists(servedPath);
     if (!found) return { found: false, hasIndex: false, checked: true };
     const isFile = await fsStat(servedPath).then((s) => s.isFile()).catch(() => false);
@@ -1450,18 +1503,24 @@ ${serveLocation}
   /**
    * Provision a TLS certificate using certbot.
    *
-   * Runs `certbot certonly` in webroot mode using the ACME challenge
-   * directory served by OpenResty, then rewrites the config to include
-   * SSL and reloads.
+   * HTTP-01 ONLY — there is no DNS-01 path anywhere in this file, and the DNS credentials the
+   * product stores are for record MANAGEMENT, not for challenges.
+   *
+   * The authenticator is `--standalone` on {@link ACME_HTTP01_PORT} (a loopback alt-port), with
+   * the edge proxying `/.well-known/acme-challenge/` to it — see `ACME_CHALLENGE_LOCATION`. So
+   * Let's Encrypt fetches the challenge over :80 from OpenResty, which forwards it to certbot's
+   * transient listener. No port-80 fight, no webroot directory to keep in sync, and zero
+   * downtime: certbot holds that port only while issuing.
    *
-   * Only --webroot is attempted. The previous --standalone fallback was
-   * dead code on any normal install: certbot --standalone binds to port
-   * 80 itself, but OpenResty already owns 80 on the same box, so the
-   * fallback would always fail with EADDRINUSE — amplifying a transient
-   * --webroot failure into an immediate hard error. The caller
-   * (route-registration.ts) already wraps provisionCert in try/catch so
-   * a webroot failure becomes a "deploy continues on HTTP, retry from
-   * Domains tab" warning instead of a deploy abort.
+   * THIS COMMENT USED TO DESCRIBE `--webroot`, and argued that `--standalone` was dead code
+   * because "certbot --standalone binds to port 80 itself, but OpenResty already owns 80". That
+   * was true of plain `--standalone`, and it is exactly the problem `--http-01-port` solves —
+   * the two sat contradicting each other in one file, with the doc describing a mechanism the
+   * code below had stopped using. Left recorded because the stale version's reasoning is
+   * persuasive enough to "fix" the code back.
+   *
+   * The caller (route-registration.ts) wraps this in try/catch, so a failure becomes a "deploy
+   * continues on HTTP, retry from the Domains tab" warning rather than a deploy abort.
    */
   async provisionCert(domain, opts) {
     assertValidDomain(domain);
@@ -1493,7 +1552,15 @@ ${serveLocation}
         ...opts?.force ? ["--force-renewal"] : []
       ], opts?.onLog);
     } catch (err) {
-      throw new Error(summarizeCertbotFailure(this.redactAcmeSecrets(safeErrorMessage(err)), domain));
+      const raw = this.redactAcmeSecrets(safeErrorMessage(err));
+      let summary = summarizeCertbotFailure(raw, domain);
+      if (isAcmePortBindFailure(raw) && this.executor) {
+        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(() => null);
+        if (occupant) {
+          summary += ` Currently held by ${occupant.command}` + (occupant.pid !== null ? ` (pid ${occupant.pid})` : "") + (occupant.systemdUnit ? ` via ${occupant.systemdUnit}` : "") + `.`;
+        }
+      }
+      throw new Error(summary);
     } finally {
       if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
     }
@@ -1965,6 +2032,7 @@ export {
   acmeKeyArgs,
   assertValidChallengeToken,
   MANAGED_STATIC_BASE,
+  isAcmePortBindFailure,
   summarizeCertbotFailure,
   NginxProvider
 };