openship 0.6.6 → 0.6.8

package/dist/chunk-BO6CY4V2.js

@@ -0,0 +1,265 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  containerIdFromCgroup,
+  isContainerPortForwarder,
+  managedDeploymentIdFromUnit,
+  tryExec
+} from "./chunk-D6HU4VUZ.js";
+import {
+  shellQuote
+} from "./chunk-WEZFTL4V.js";
+
+// ../../packages/adapters/src/system/port-listen.ts
+var PROC_NET_TCP_FILES = ["/proc/net/tcp", "/proc/net/tcp6"];
+var TCP_LISTEN = "0A";
+function parseListeningPorts(procText) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const rawLine of procText.split("\n")) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const fields = line.split(/\s+/);
+    if (fields.length < 4) continue;
+    if (fields[3] !== TCP_LISTEN) continue;
+    const local = fields[1];
+    const colon = local.lastIndexOf(":");
+    if (colon === -1) continue;
+    const hexPort = local.slice(colon + 1);
+    if (!/^[0-9A-Fa-f]{1,4}$/.test(hexPort)) continue;
+    const port = parseInt(hexPort, 16);
+    if (port > 0) ports.add(port);
+  }
+  return ports;
+}
+async function probePortListeningOnce(executor, port) {
+  const readable = [];
+  for (const file of PROC_NET_TCP_FILES) {
+    try {
+      readable.push(await executor.exec(`cat ${file} 2>/dev/null`, { timeout: 5e3 }));
+    } catch {
+    }
+  }
+  if (readable.length === 0) return null;
+  return parseListeningPorts(readable.join("\n")).has(port);
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function waitForPortListening(executor, port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 45e3;
+  const intervalMs = opts.intervalMs ?? 1e3;
+  const deadline = Date.now() + timeoutMs;
+  let anyConclusive = false;
+  try {
+    for (; ; ) {
+      const result = await probePortListeningOnce(executor, port);
+      if (result === true) return { listening: true, checked: true };
+      if (result === false) anyConclusive = true;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      await delay(Math.min(intervalMs, remaining));
+    }
+  } catch {
+    return { listening: false, checked: false };
+  }
+  return anyConclusive ? { listening: false, checked: true } : { listening: false, checked: false };
+}
+async function waitForPortFree(executor, port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 15e3;
+  const intervalMs = opts.intervalMs ?? 500;
+  const deadline = Date.now() + timeoutMs;
+  let anyConclusive = false;
+  try {
+    for (; ; ) {
+      const result = await probePortListeningOnce(executor, port);
+      if (result === false) return { free: true, checked: true };
+      if (result === true) anyConclusive = true;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      await delay(Math.min(intervalMs, remaining));
+    }
+  } catch {
+    return { free: false, checked: false };
+  }
+  return anyConclusive ? { free: false, checked: true } : { free: false, checked: false };
+}
+
+// ../../packages/adapters/src/runtime/port-conflict.ts
+async function resolveListenerOwner(executor, pid) {
+  const cgroup = (await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null`))?.trim();
+  if (!cgroup) return { cgroupVerified: false };
+  const evidence = { cgroupVerified: true, processCgroup: cgroup };
+  const containerId = containerIdFromCgroup(cgroup);
+  if (containerId) return { ...evidence, containerId };
+  const systemdUnit = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m)?.[1]?.trim();
+  if (!systemdUnit || !/^[A-Za-z0-9@._:-]+\.service$/.test(systemdUnit)) {
+    return evidence;
+  }
+  const description = await tryExec(
+    executor,
+    `systemctl show ${shellQuote(systemdUnit)} --property=Description --value 2>/dev/null || true`
+  );
+  const deploymentId = managedDeploymentIdFromUnit(systemdUnit);
+  return {
+    ...evidence,
+    systemdUnit,
+    systemdDescription: description?.trim() || void 0,
+    ...deploymentId ? { deploymentId, isManagedDeployment: true } : { isManagedDeployment: false }
+  };
+}
+async function resolveListener(executor, port) {
+  const out = await tryExec(
+    executor,
+    `ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`
+  );
+  const listenerPid = (output) => {
+    if (!output) return null;
+    const ssMatch = output.match(/pid=(\d+)/);
+    const lsofMatch = !ssMatch ? output.match(/^\s*(\d+)\s*$/m) : null;
+    const parsed = ssMatch?.[1] ?? lsofMatch?.[1];
+    if (!parsed) return null;
+    const pid2 = Number.parseInt(parsed, 10);
+    return Number.isSafeInteger(pid2) && pid2 > 0 ? pid2 : null;
+  };
+  const pid = listenerPid(out);
+  if (pid) return { pid, occupied: true, checked: true };
+  const observedListener = Boolean(out?.trim());
+  if (observedListener) {
+    const privilegedOut = await tryExec(
+      executor,
+      `sudo -n ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || sudo -n lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`,
+      { timeout: 5e3 }
+    );
+    const privilegedPid = listenerPid(privilegedOut);
+    if (privilegedPid) return { pid: privilegedPid, occupied: true, checked: true };
+  }
+  const listening = await probePortListeningOnce(executor, port);
+  return {
+    pid: null,
+    occupied: observedListener || listening === true,
+    checked: observedListener || listening !== null
+  };
+}
+function parseListenerPids(output) {
+  const lines = (output ?? "").split("\n").map((line) => line.trim()).filter(Boolean);
+  if (lines.length === 0) return { observed: false, complete: true, pids: [] };
+  const pids = /* @__PURE__ */ new Set();
+  let complete = true;
+  for (const line of lines) {
+    const matches = [...line.matchAll(/pid=(\d+)/g)].map((match) => match[1]);
+    const bare = matches.length === 0 ? line.match(/^(\d+)$/)?.[1] : void 0;
+    const values = bare ? [bare] : matches;
+    if (values.length === 0) complete = false;
+    for (const value of values) {
+      const pid = Number.parseInt(value, 10);
+      if (Number.isSafeInteger(pid) && pid > 0) pids.add(pid);
+      else complete = false;
+    }
+  }
+  return { observed: true, complete, pids: [...pids] };
+}
+async function probeListeningPortOwners(executor, port) {
+  const command = `ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`;
+  const ordinary = parseListenerPids(await tryExec(executor, command));
+  let evidence = ordinary;
+  if (ordinary.observed && !ordinary.complete) {
+    const privileged = parseListenerPids(
+      await tryExec(
+        executor,
+        `sudo -n ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || sudo -n lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null`,
+        { timeout: 5e3 }
+      )
+    );
+    if (privileged.observed && privileged.complete) evidence = privileged;
+    else {
+      evidence = {
+        observed: true,
+        complete: false,
+        pids: [.../* @__PURE__ */ new Set([...ordinary.pids, ...privileged.pids])]
+      };
+    }
+  }
+  if (!evidence.observed) {
+    const listening = await probePortListeningOnce(executor, port);
+    if (listening === null) return { occupants: [], checked: false, ownershipComplete: false };
+    if (!listening) return { occupants: [], checked: true, ownershipComplete: true };
+    return { occupants: [], checked: true, ownershipComplete: false };
+  }
+  const described = await Promise.all(
+    evidence.pids.map((pid) => describeProcess(executor, pid).catch(() => null))
+  );
+  const occupants = described.filter((row) => row !== null);
+  return {
+    occupants,
+    checked: true,
+    ownershipComplete: evidence.complete && occupants.length === evidence.pids.length
+  };
+}
+async function probeListeningPortState(executor, port) {
+  try {
+    const { pid, occupied, checked } = await resolveListener(executor, port);
+    if (!checked || !occupied) return { occupant: null, checked };
+    if (pid === null) {
+      return { occupant: { pid: null, command: "unknown listener" }, checked: true };
+    }
+    return { occupant: await describeProcess(executor, pid), checked: true };
+  } catch {
+    return { occupant: null, checked: false };
+  }
+}
+async function probeListeningPort(executor, port) {
+  return (await probeListeningPortState(executor, port)).occupant;
+}
+async function describeProcess(executor, pid) {
+  let command = `PID ${pid}`;
+  let rawCommand;
+  const args = await tryExec(executor, `ps -p ${pid} -o args= 2>/dev/null || true`);
+  if (args?.trim()) {
+    rawCommand = args.trim();
+    command = `${rawCommand} (PID ${pid})`;
+  } else {
+    const cmd = await tryExec(executor, `ps -p ${pid} -o comm= 2>/dev/null || true`);
+    if (cmd?.trim()) {
+      rawCommand = cmd.trim();
+      command = `${rawCommand} (PID ${pid})`;
+    }
+  }
+  if (isContainerPortForwarder(rawCommand)) {
+    return { pid, command, rawCommand, dockerPublished: true };
+  }
+  const systemd = await resolveListenerOwner(executor, pid);
+  return { pid, command, rawCommand, ...systemd };
+}
+function portOccupantDetails(port, occupant, stopTarget) {
+  if (!occupant) return { port };
+  return {
+    port,
+    pid: occupant.pid,
+    command: occupant.command,
+    rawCommand: occupant.rawCommand,
+    systemdUnit: occupant.systemdUnit,
+    systemdDescription: occupant.systemdDescription,
+    deploymentId: occupant.deploymentId,
+    isManagedDeployment: occupant.isManagedDeployment,
+    containerId: occupant.containerId,
+    containerName: occupant.containerName,
+    containerImage: occupant.containerImage,
+    ownerProjectId: occupant.ownerProjectId,
+    serviceName: occupant.serviceName,
+    dockerPublished: occupant.dockerPublished,
+    platformContainer: occupant.platformContainer,
+    ambiguousOwners: occupant.ambiguousOwners,
+    ...stopTarget ? { stopTarget } : {}
+  };
+}
+
+export {
+  waitForPortListening,
+  waitForPortFree,
+  probeListeningPortOwners,
+  probeListeningPort,
+  describeProcess,
+  portOccupantDetails
+};

package/dist/{chunk-FE7ZZQSE.js → chunk-D3OEMXYP.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-I3DPMTSF.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
 import {
   edgeFailureReason
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-X53JXRS4.js";
 
 // ../../packages/adapters/src/system/docker-edge-executor.ts
 import Dockerode from "dockerode";

package/dist/chunk-D6HU4VUZ.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
+import {
+  safeErrorMessage,
+  shellQuote
+} from "./chunk-WEZFTL4V.js";
+
+// ../../packages/adapters/src/system/probe-exec.ts
+async function tryExec(executor, command, opts) {
+  try {
+    return opts ? await executor.exec(command, opts) : await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+async function probeExec(executor, command, scope) {
+  const startedAt = Date.now();
+  systemDebug(scope, `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(scope, `exec:ok ${command} (${formatDuration(startedAt)})`);
+    return { output: result.trim(), error: null };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    if (isRemoteConnectionError(err)) {
+      systemDebug(scope, `exec:abort ${command} (${formatDuration(startedAt)}) ${msg}`);
+      throw err;
+    }
+    systemDebug(scope, `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`);
+    return { output: "", error: msg || `\`${command}\` failed` };
+  }
+}
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
+
+// ../../packages/adapters/src/infra/mail-container.ts
+var MAIL_HOST_STATE_DIR = "/var/lib/openship/mail";
+var MAIL_CONTAINER_MOUNTS = [
+  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
+  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
+  // deferred mail without this — keep it on the host.
+  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
+  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
+  // breaks DMARC until DNS repropagates.
+  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
+  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
+  // amavis 50-user). Seeded from baked defaults on first boot.
+  { host: `${MAIL_HOST_STATE_DIR}/config/postfix`, container: "/etc/postfix", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
+  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
+  // freshclam re-download and delay readiness. `seed: true` because that same mount
+  // HIDES the database baked into the image: with nothing copying it across, clamd
+  // finds an empty database directory and exits (issue #565).
+  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav", seed: true },
+  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
+];
+var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
+var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
+var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
+var MAIL_HOST_PATHS = {
+  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
+  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
+  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
+  // connection, while direct-to-MX delivery for the un-relayed domains stays
+  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
+  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/openship_tls_policy`,
+  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
+};
+
+// ../../packages/adapters/src/system/port-owner.ts
+var OPENSHIP_LABEL = {
+  project: "openship.project",
+  deployment: "openship.deployment",
+  service: "openship.service",
+  build: "openship.build"
+};
+var PS_FIELDS = [
+  "{{.ID}}",
+  "{{.Names}}",
+  "{{.Image}}",
+  `{{.Label "${OPENSHIP_LABEL.project}"}}`,
+  `{{.Label "${OPENSHIP_LABEL.deployment}"}}`,
+  `{{.Label "${OPENSHIP_LABEL.service}"}}`,
+  `{{.Label "${OPENSHIP_LABEL.build}"}}`,
+  '{{.Label "com.docker.compose.project"}}',
+  '{{.Label "com.docker.compose.service"}}'
+];
+var PS_FORMAT = PS_FIELDS.join("\\t");
+function parsePsLines(out) {
+  const containers = [];
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const f = line.split("	");
+    const id = f[0]?.trim();
+    const name = f[1]?.trim();
+    if (!id || !name || !/^[0-9a-f]{12,64}$/i.test(id)) continue;
+    containers.push({
+      id,
+      name: name.replace(/^\//, ""),
+      image: f[2]?.trim() ?? "",
+      ...f[3]?.trim() ? { projectId: f[3].trim() } : {},
+      ...f[4]?.trim() ? { deploymentId: f[4].trim() } : {},
+      ...f[5]?.trim() ? { serviceName: f[5].trim() } : {},
+      ...f[6]?.trim() ? { buildSessionId: f[6].trim() } : {},
+      ...f[7]?.trim() ? { composeProject: f[7].trim() } : {},
+      ...f[8]?.trim() ? { composeService: f[8].trim() } : {}
+    });
+  }
+  return containers;
+}
+async function queryContainers(executor, filter) {
+  const out = await tryExec(
+    executor,
+    `docker ps --no-trunc --filter ${filter} --format '${PS_FORMAT}' 2>/dev/null`
+  );
+  return out === null ? null : parsePsLines(out);
+}
+async function resolveContainerPublishingPort(executor, port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return { kind: "unknown" };
+  const containers = await queryContainers(executor, `publish=${port}`);
+  if (containers === null) return { kind: "unknown" };
+  if (containers.length === 0) return { kind: "none" };
+  if (containers.length === 1) return { kind: "one", container: containers[0] };
+  return { kind: "ambiguous", containers };
+}
+function containerIdFromCgroup(cgroup) {
+  const match = cgroup?.match(/(?:^|[^0-9a-f])([0-9a-f]{64})(?:[^0-9a-f]|$)/);
+  return match?.[1] ?? null;
+}
+async function stopContainerDurably(executor, ref) {
+  await tryExec(executor, `docker update --restart=no ${shellQuote(ref)} 2>/dev/null || true`);
+  await tryExec(executor, `docker stop ${shellQuote(ref)} 2>/dev/null || true`);
+}
+async function describeContainerById(executor, containerId) {
+  if (!/^[0-9a-f]{12,64}$/i.test(containerId)) return null;
+  const containers = await queryContainers(executor, `id=${shellQuote(containerId)}`);
+  return containers?.[0] ?? null;
+}
+var EDGE_CONTAINER_NAME = "openship-edge";
+function isOurEdgeContainer(name, image) {
+  return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
+}
+var PORT_FORWARDER_NAMES = [
+  "docker-proxy",
+  "rootlesskit",
+  "rootlesskit-docker-proxy",
+  "slirp4netns",
+  "pasta",
+  // LXD/Incus publish a container port with `forkproxy`, whose cgroup is the snap's
+  // daemon unit — the same misattribution with a different daemon.
+  "forkproxy"
+];
+function isContainerPortForwarder(command) {
+  const argv0 = command?.trim().split(/\s+/)[0];
+  if (!argv0) return false;
+  const base = argv0.replace(/.*\//, "");
+  return PORT_FORWARDER_NAMES.some(
+    (name) => base === name || base.startsWith(`${name}-`) || base.length >= 15 && name.startsWith(base)
+  );
+}
+var MANAGED_DEPLOYMENT_UNIT_RE = /^openship-(dep_[A-Za-z0-9_-]+)\.service$/;
+function managedDeploymentUnitName(deploymentId) {
+  return `openship-${deploymentId}.service`;
+}
+function managedDeploymentIdFromUnit(unit) {
+  return unit?.match(MANAGED_DEPLOYMENT_UNIT_RE)?.[1] ?? null;
+}
+var PROTECTED_UNITS = /* @__PURE__ */ new Set([
+  "docker",
+  "docker.socket",
+  "dockerd",
+  "snap.docker.dockerd",
+  "containerd",
+  "containerd.socket",
+  "podman",
+  // Other container/VM supervisors whose forwarders land on their daemon unit.
+  "lxd",
+  "snap.lxd.daemon",
+  "incus",
+  "k3s",
+  "k3s-agent",
+  "kubelet",
+  "libvirtd",
+  "ssh",
+  "sshd",
+  "dbus",
+  "systemd-resolved",
+  "systemd-networkd",
+  "systemd-logind",
+  // The control plane itself, and a from-source dev install of it.
+  "openship",
+  "openship-dev"
+]);
+var USER_MANAGER_UNIT_RE = /^user@\d+$/;
+function classifyProxy(text) {
+  if (!text) return void 0;
+  const t = text.toLowerCase();
+  if (t.includes("openresty")) return "openresty";
+  if (/(^|[\s/:])nginx/.test(t)) return "nginx";
+  if (/(^|[\s/:])caddy/.test(t)) return "caddy";
+  if (/(apache2|httpd)/.test(t)) return "apache";
+  if (/(^|[\s/:])traefik/.test(t)) return "traefik";
+  if (/(^|[\s/:])haproxy/.test(t)) return "haproxy";
+  return void 0;
+}
+function bareUnit(unit) {
+  return unit.replace(/\.service$/, "");
+}
+function isProtectedUnit(unit) {
+  const bare = bareUnit(unit);
+  return PROTECTED_UNITS.has(bare) || USER_MANAGER_UNIT_RE.test(bare);
+}
+function mayStopUnitForEdgeTakeover(unit) {
+  if (!unit) return false;
+  if (managedDeploymentIdFromUnit(unit)) return true;
+  return !isProtectedUnit(unit);
+}
+
+export {
+  MAIL_HOST_STATE_DIR,
+  tryExec,
+  probeExec,
+  withReason,
+  OPENSHIP_LABEL,
+  resolveContainerPublishingPort,
+  containerIdFromCgroup,
+  stopContainerDurably,
+  describeContainerById,
+  EDGE_CONTAINER_NAME,
+  isOurEdgeContainer,
+  isContainerPortForwarder,
+  managedDeploymentUnitName,
+  managedDeploymentIdFromUnit,
+  classifyProxy,
+  mayStopUnitForEdgeTakeover
+};