openship 0.6.6 → 0.6.7

package/dist/{chunk-SM26HDS2.js → chunk-VSTFHUCV.js}

@@ -3,43 +3,14 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  formatDuration,
-  isRemoteConnectionError,
-  safeErrorMessage,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
-
-// ../../packages/adapters/src/system/probe-exec.ts
-async function tryExec(executor, command, opts) {
-  try {
-    return opts ? await executor.exec(command, opts) : await executor.exec(command);
-  } catch {
-    return null;
-  }
-}
-async function probeExec(executor, command, scope) {
-  const startedAt = Date.now();
-  systemDebug(scope, `exec:start ${command}`);
-  try {
-    const result = await executor.exec(command, { timeout: 1e4 });
-    systemDebug(scope, `exec:ok ${command} (${formatDuration(startedAt)})`);
-    return { output: result.trim(), error: null };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    if (isRemoteConnectionError(err)) {
-      systemDebug(scope, `exec:abort ${command} (${formatDuration(startedAt)}) ${msg}`);
-      throw err;
-    }
-    systemDebug(scope, `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`);
-    return { output: "", error: msg || `\`${command}\` failed` };
-  }
-}
-function withReason(message, error) {
-  if (!error) return message;
-  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
-  if (!first) return message;
-  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
-}
+  containerIdFromCgroup,
+  isContainerPortForwarder,
+  managedDeploymentIdFromUnit,
+  tryExec
+} from "./chunk-UWEV6XTS.js";
+import {
+  shellQuote
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/port-listen.ts
 var PROC_NET_TCP_CMD = "cat /proc/net/tcp 2>/dev/null; cat /proc/net/tcp6 2>/dev/null; true";
@@ -113,23 +84,23 @@ async function waitForPortFree(executor, port, opts = {}) {
 }
 
 // ../../packages/adapters/src/runtime/port-conflict.ts
-async function resolveSystemdUnit(executor, pid) {
+async function resolveListenerOwner(executor, pid) {
   const cgroup = await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null || true`);
-  const unitMatch = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m) ?? cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m);
-  const systemdUnit = unitMatch?.[1]?.trim();
-  if (!systemdUnit || !/^[A-Za-z0-9@._:\\-]+\.service$/.test(systemdUnit)) {
+  const containerId = containerIdFromCgroup(cgroup);
+  if (containerId) return { containerId };
+  const systemdUnit = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m)?.[1]?.trim();
+  if (!systemdUnit || !/^[A-Za-z0-9@._:-]+\.service$/.test(systemdUnit)) {
     return {};
   }
   const description = await tryExec(
     executor,
-    `systemctl show ${systemdUnit} --property=Description --value 2>/dev/null || true`
+    `systemctl show ${shellQuote(systemdUnit)} --property=Description --value 2>/dev/null || true`
   );
-  const managedMatch = systemdUnit.match(/^openship-(.+)\.service$/);
+  const deploymentId = managedDeploymentIdFromUnit(systemdUnit);
   return {
     systemdUnit,
     systemdDescription: description?.trim() || void 0,
-    deploymentId: managedMatch?.[1],
-    isManagedDeployment: Boolean(managedMatch)
+    ...deploymentId ? { deploymentId, isManagedDeployment: true } : { isManagedDeployment: false }
   };
 }
 async function resolveListener(executor, port) {
@@ -170,16 +141,39 @@ async function describeProcess(executor, pid) {
       command = `${rawCommand} (PID ${pid})`;
     }
   }
-  const systemd = await resolveSystemdUnit(executor, pid);
+  if (isContainerPortForwarder(rawCommand)) {
+    return { pid, command, rawCommand, dockerPublished: true };
+  }
+  const systemd = await resolveListenerOwner(executor, pid);
   return { pid, command, rawCommand, ...systemd };
 }
+function portOccupantDetails(port, occupant, stopTarget) {
+  if (!occupant) return { port };
+  return {
+    port,
+    pid: occupant.pid,
+    command: occupant.command,
+    rawCommand: occupant.rawCommand,
+    systemdUnit: occupant.systemdUnit,
+    systemdDescription: occupant.systemdDescription,
+    deploymentId: occupant.deploymentId,
+    isManagedDeployment: occupant.isManagedDeployment,
+    containerId: occupant.containerId,
+    containerName: occupant.containerName,
+    containerImage: occupant.containerImage,
+    ownerProjectId: occupant.ownerProjectId,
+    serviceName: occupant.serviceName,
+    dockerPublished: occupant.dockerPublished,
+    platformContainer: occupant.platformContainer,
+    ambiguousOwners: occupant.ambiguousOwners,
+    ...stopTarget ? { stopTarget } : {}
+  };
+}
 
 export {
-  tryExec,
-  probeExec,
-  withReason,
   waitForPortListening,
   waitForPortFree,
   probeListeningPort,
-  describeProcess
+  describeProcess,
+  portOccupantDetails
 };

package/dist/chunk-WU54BXFE.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  sq
+} from "./chunk-H3WT3A6R.js";
+
+// ../../packages/adapters/src/runtime/managed-artifact.ts
+var MANAGED_ARTIFACT_BASE = "/opt/openship";
+var PROTECTED_ROOTS = /* @__PURE__ */ new Set([
+  MANAGED_ARTIFACT_BASE,
+  // BareRuntime's own layout (workDir = MANAGED_ARTIFACT_BASE): releases/<depId>,
+  // .builds/<sessionId>. The parents hold every project's releases at once.
+  `${MANAGED_ARTIFACT_BASE}/releases`,
+  `${MANAGED_ARTIFACT_BASE}/.builds`,
+  // The static tree, whose parent is ALSO the one directory bind-mounted into the
+  // edge container — removing it stops the box serving every static site it hosts.
+  `${MANAGED_ARTIFACT_BASE}/static`,
+  `${MANAGED_ARTIFACT_BASE}/static/releases`,
+  `${MANAGED_ARTIFACT_BASE}/static/.builds`
+]);
+function canonical(ref) {
+  const trimmed = ref.trim();
+  return trimmed.length > 1 ? trimmed.replace(/\/+$/, "") : trimmed;
+}
+function assertManagedArtifactPath(ref) {
+  const target = canonical(ref);
+  if (!target.startsWith("/") || target.includes("..")) {
+    throw new Error(
+      `Refusing to remove "${ref}": an artifact path must be absolute and free of "..".`
+    );
+  }
+  if (PROTECTED_ROOTS.has(target)) {
+    throw new Error(
+      `Refusing to remove "${ref}": that is a shared parent directory, not one deployment's output.`
+    );
+  }
+  if (target !== MANAGED_ARTIFACT_BASE && !target.startsWith(`${MANAGED_ARTIFACT_BASE}/`)) {
+    throw new Error(
+      `Refusing to remove "${ref}": outside ${MANAGED_ARTIFACT_BASE}. Openship removes only directories it created (release dirs, static doc-roots, build dirs).`
+    );
+  }
+}
+async function removeManagedArtifact(executor, ref) {
+  assertManagedArtifactPath(ref);
+  const target = canonical(ref);
+  if (executor) {
+    await executor.exec(`rm -rf ${sq(target)}`);
+    if (await executor.exists(target)) {
+      throw new Error(`Failed to remove ${target}: still present after rm -rf.`);
+    }
+    return;
+  }
+  const { rm, access } = await import("fs/promises");
+  await rm(target, { recursive: true, force: true });
+  const stillThere = await access(target).then(
+    () => true,
+    () => false
+  );
+  if (stillThere) throw new Error(`Failed to remove ${target}: still present after rm.`);
+}
+function isArtifactPathRef(ref) {
+  return ref.startsWith("/");
+}
+
+export {
+  removeManagedArtifact,
+  isArtifactPathRef
+};