percher 1.4.0 → 1.4.1

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "percher",
-    "version": "1.4.0",
+    "version": "1.4.1",
     "description": "CLI for the Percher hosting platform — publish apps with one command",
     "type": "module",
     "bin": {
@@ -28,10 +28,10 @@
         "typecheck": "tsc --noEmit"
     },
     "dependencies": {
-        "@percher/shared": "^1.3.0",
-        "@percher/client": "^1.4.0",
-        "@percher/core": "^1.4.0",
-        "@percher/toml": "^1.0.5",
+        "@percher/shared": "^1.3.1",
+        "@percher/client": "^1.4.1",
+        "@percher/core": "^1.4.1",
+        "@percher/toml": "^1.0.6",
         "cac": "^7.0.0",
         "picocolors": "^1.1.1"
     },

package/dist/templates/astro/Caddyfile

@@ -2,5 +2,9 @@
 	bind 0.0.0.0
 	root * /srv
 	encode gzip zstd
-	file_server
+	route {
+		@percher_platform path_regexp percher_platform (?i)(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))
+		respond @percher_platform 404
+		file_server
+	}
 }

package/dist/templates/astro/Dockerfile

@@ -10,27 +10,26 @@ WORKDIR /app
 COPY . .
 RUN bun install && bun run build
 
+# Preserve build inputs for deployment; only this filtered copy reaches /srv.
+FROM build AS static-content
+RUN bun -e 'const fs=require("node:fs"),path=require("node:path");const root=fs.realpathSync(process.argv[1]),dir=fs.realpathSync(process.argv[2]),dest=process.argv[3];const deny=new RegExp("(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))","i");const reserved=p=>deny.test("/"+p.split(path.sep).join("/"));if((dir!==root&&!dir.startsWith(root+path.sep))||reserved(path.relative(root,dir)))throw Error("Static output escapes the project or selects platform content");if(fs.existsSync(dest))throw Error("Reserved static staging directory already exists");fs.cpSync(dir,dest,{recursive:true,filter:p=>{if(reserved(path.relative(dir,p))||reserved(path.relative(root,p)))return false;if(fs.lstatSync(p).isSymbolicLink())throw Error("Static content cannot contain symlinks");return true}})' '/app' '/app/dist' '/percher-static-content'
+
 # --- Serve stage: minimal Caddy image --------------------------------
 # Build pinned Caddy source with refreshed security modules. The scratch
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :8080.
 FROM golang:1.26.10-alpine3.23@sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e AS caddy-source
-ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
-  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
-RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
- && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.7 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.7 /src \
  && chmod -R u+w /src
 WORKDIR /src
-RUN apk add --no-cache patch \
- && patch -p1 < /tmp/caddy-cel-go.patch \
- && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \
-      go.opentelemetry.io/otel/sdk/log@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \
+RUN go get github.com/go-chi/chi/v5@v5.3.2 github.com/klauspost/compress@v1.20.1 \
+      go.opentelemetry.io/otel@v1.46.0 go.opentelemetry.io/otel/sdk/log@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.46.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.46.0 \
       golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \
       golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \
  && go mod tidy \
@@ -46,7 +45,7 @@ COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-ce
 COPY --from=caddy-source /out/caddy /usr/bin/caddy
 COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
 COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
+COPY --from=static-content /percher-static-content /srv
 LABEL dev.percher.health-client="static-http-v1"
 # HOME points at the writable tmpfs so non-root Caddy can persist its
 # XDG state (storage-clean lock, config autosave) under Percher's

package/dist/templates/capsule/Dockerfile

@@ -22,22 +22,17 @@ RUN bun install && bun run build
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :8080.
 FROM golang:1.26.10-alpine3.23@sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e AS caddy-source
-ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
-  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
-RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
- && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.7 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.7 /src \
  && chmod -R u+w /src
 WORKDIR /src
-RUN apk add --no-cache patch \
- && patch -p1 < /tmp/caddy-cel-go.patch \
- && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \
-      go.opentelemetry.io/otel/sdk/log@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \
+RUN go get github.com/go-chi/chi/v5@v5.3.2 github.com/klauspost/compress@v1.20.1 \
+      go.opentelemetry.io/otel@v1.46.0 go.opentelemetry.io/otel/sdk/log@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.46.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.46.0 \
       golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \
       golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \
  && go mod tidy \

package/dist/templates/eleventy/Caddyfile

@@ -2,5 +2,9 @@
 	bind 0.0.0.0
 	root * /srv
 	encode gzip zstd
-	file_server
+	route {
+		@percher_platform path_regexp percher_platform (?i)(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))
+		respond @percher_platform 404
+		file_server
+	}
 }