shipwatch 0.1.0

package/src/daemon.js

@@ -0,0 +1,326 @@
+/** Daemon entry: persistent task registry, private IPC, bounded log rotation and task lifecycle.
+ * Launched by client.js; owns Task instances and serializes state-changing CLI requests.
+ */
+import net from 'node:net';
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadConfig, loadConfigs, validName } from './config.js';
+import { paths } from './client.js';
+import { Task } from './task.js';
+import { updateDeployMode } from './config-editor.js';
+
+const locations = paths();
+/** Keep two 5 MiB files per task; process lifetime does not make logs grow without limit. */
+const LOG_LIMIT = 5 * 1024 * 1024;
+const jobs = new Map();
+let closing = false;
+let ownsLock = false;
+let server;
+let mutations = Promise.resolve();
+let nextId = 0;
+const counterFile = path.join(locations.home, 'next-task-id.json');
+
+/** Rotation and append are synchronous so log order remains deterministic across deployment events. */
+function logger(name) {
+  return (level, message, remote) => {
+    const filename = path.join(locations.logs, `${name}.log`);
+    try {
+      if (fs.existsSync(filename) && fs.statSync(filename).size >= LOG_LIMIT) {
+        fs.rmSync(filename + '.1', { force: true });
+        fs.renameSync(filename, filename + '.1');
+      }
+      fs.appendFileSync(filename, JSON.stringify({ time: new Date().toISOString(), level, task: name, server: remote, message: String(message).slice(0, String(message).startsWith('SHIPWATCH_REPORT ') ? 131072 : 16384) }) + '\n', { mode: 0o600 });
+    } catch (error) { process.stderr.write(`Cannot write task log: ${error.message}\n`); }
+  };
+}
+
+/** Save only desired lifecycle state and config locations, never credentials or ephemeral progress. */
+function persist() {
+  const temporary = locations.registry + '.tmp';
+  fs.writeFileSync(temporary, JSON.stringify([...jobs.values()].map((job) => job.saved), null, 2) + '\n', { mode: 0o600 });
+  fs.renameSync(temporary, locations.registry);
+}
+
+/** Reserve IDs durably; single deletions never reuse IDs, while kill-all resets the sequence. */
+function saveCounter() {
+  fs.writeFileSync(counterFile + '.tmp', JSON.stringify(nextId), { mode: 0o600 });
+  fs.renameSync(counterFile + '.tmp', counterFile);
+}
+function allocateId() {
+  if (!Number.isSafeInteger(nextId) || nextId >= Number.MAX_SAFE_INTEGER) throw new Error('任务 ID 已耗尽');
+  const id = nextId++;
+  saveCounter();
+  return id;
+}
+
+/** Identity is attached to every response, including tasks with broken configurations. */
+function jobState(job) {
+  return { ...(job.task?.state ?? { name: job.saved.name, directory: job.saved.sourceDirectory ?? job.saved.directory, status: 'error', running: false, lastError: job.error, autoDeployCount: job.saved.autoDeployCount ?? 0 }), id: job.saved.id };
+}
+
+/** Fail closed on a live/unknown PID; only reclaim locks belonging to a definitively dead process. */
+function claimLock() {
+  fs.mkdirSync(locations.logs, { recursive: true, mode: 0o700 });
+  fs.chmodSync(locations.home, 0o700);
+  if (fs.existsSync(locations.lock)) {
+    const owner = JSON.parse(fs.readFileSync(locations.lock, 'utf8'));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0) throw new Error('Invalid daemon lock; inspect SHIPWATCH_HOME');
+    try { process.kill(owner.pid, 0); throw new Error('Daemon is already running or starting'); }
+    catch (error) { if (error.code !== 'ESRCH') throw error; }
+    fs.unlinkSync(locations.lock);
+    fs.rmSync(locations.socket, { force: true });
+  }
+  fs.writeFileSync(locations.lock, JSON.stringify({ pid: process.pid }), { flag: 'wx', mode: 0o600 });
+  ownsLock = true;
+}
+
+/** Compare filesystem identities so symlinks and case aliases cannot create duplicate watchers. */
+async function assertUniqueDirectory(config) {
+  const identity = fs.statSync(config.directory);
+  for (const [name, job] of jobs) {
+    if (name === config.name) continue;
+    let directory = job.task?.config.directory ?? job.saved.sourceDirectory;
+    if (!directory) {
+      try { directory = (await loadConfig(job.saved.configFile, job.saved.directory, job.saved.name)).directory; } catch { continue; }
+    }
+    let other;
+    try { other = fs.statSync(directory); } catch { continue; }
+    if (identity.dev === other.dev && identity.ino === other.ino) throw new Error(`目录已由任务 ${name} 使用，请先删除原任务`);
+  }
+}
+
+/** Re-read config on start/restart so edits require a deliberate lifecycle action. */
+async function makeTask(saved, passwords = {}) {
+  const config = await loadConfig(saved.configFile, saved.directory, saved.name);
+  await assertUniqueDirectory(config);
+  saved.sourceDirectory = config.directory;
+  for (const server of config.servers) {
+    if (Object.hasOwn(passwords, server.name)) {
+      if (typeof passwords[server.name] !== 'string' || !passwords[server.name] || /[\r\n\0]/.test(passwords[server.name])) throw new Error('Invalid runtime password');
+      server.password = passwords[server.name];
+    }
+    if (server.passwordPrompt && !server.password) throw new Error('Password required; run shipwatch <configuration> to enter it again');
+  }
+  if (config.name !== saved.name) throw new Error('Config name changed; delete the old task and start again');
+  const runtimeRelative = path.relative(config.directory, locations.home);
+  if (!runtimeRelative.startsWith('..') && !path.isAbsolute(runtimeRelative)) {
+    if (!runtimeRelative) throw new Error('Source directory cannot be SHIPWATCH_HOME');
+    config.exclude.push(runtimeRelative.split(path.sep).join('/'));
+  }
+  return new Task(config, logger(config.name), undefined, {
+    autoDeployCount: saved.autoDeployCount ?? 0,
+    onAutoDeploy(count) {
+      const previous = saved.autoDeployCount;
+      saved.autoDeployCount = count;
+      try { persist(); }
+      catch (error) { saved.autoDeployCount = previous; throw error; }
+    },
+  });
+}
+
+/** Load desired tasks after daemon restart; a bad config cannot prevent other tasks from recovering. */
+async function restore() {
+  nextId = fs.existsSync(counterFile) ? JSON.parse(fs.readFileSync(counterFile, 'utf8')) : 0;
+  if (!Number.isSafeInteger(nextId) || nextId < 0) throw new Error('Invalid task ID counter');
+  const savedJobs = fs.existsSync(locations.registry) ? JSON.parse(fs.readFileSync(locations.registry, 'utf8')) : [];
+  if (!Array.isArray(savedJobs)) throw new Error('Invalid task registry');
+  const ids = new Set();
+  for (const saved of savedJobs) {
+    if (!validName(saved?.name)) throw new Error('Invalid task registry name');
+    if (Number.isSafeInteger(saved.id) && saved.id >= 0) nextId = Math.max(nextId, saved.id + 1);
+  }
+  for (const saved of savedJobs) {
+    if (!Number.isSafeInteger(saved.id) || saved.id < 0 || ids.has(saved.id)) saved.id = allocateId();
+    ids.add(saved.id);
+  }
+  saveCounter();
+  // Migrate legacy registries before starting any watchers, so IDs survive immediate shutdown.
+  fs.writeFileSync(locations.registry + '.tmp', JSON.stringify(savedJobs, null, 2) + '\n', { mode: 0o600 });
+  fs.renameSync(locations.registry + '.tmp', locations.registry);
+  for (const saved of savedJobs) {
+    if (!validName(saved.name)) throw new Error('Invalid task registry name');
+    if (jobs.has(saved.name)) { logger(saved.name)('error', '发现重复任务名称，已跳过重复记录'); continue; }
+    const job = { saved };
+    jobs.set(saved.name, job);
+    try { job.task = await makeTask(saved); }
+    catch (error) { job.error = error.message; logger(saved.name)('error', error.message); }
+  }
+  // Populate every saved job before automatic counters can persist the complete registry.
+  if (!process.argv.includes('--no-resume')) for (const job of jobs.values()) if (job.saved.enabled) job.task?.start();
+}
+
+/** IPC commands expose state snapshots; task objects never cross the socket boundary. */
+async function handle(request) {
+  const { action } = request;
+  let { name } = request;
+  if (request.id !== undefined) {
+    if (!Number.isSafeInteger(request.id) || request.id < 0) throw new Error('无效的任务 ID');
+    const match = [...jobs.values()].find((job) => job.saved.id === request.id);
+    if (!match) throw new Error(`未找到任务 ID：${request.id}`);
+    name = match.saved.name;
+  }
+  if (action === 'ping') return { pid: process.pid, capabilities: ['kill', 'kill-clear', 'kill-reset-id', 'task-id', 'multi-project', 'deploy-mode', 'deploy-progress'] };
+  if (action === 'list') return [...jobs.values()].map(jobState);
+  if (action === 'status') {
+    if (!validName(name) || !jobs.has(name)) throw new Error(`Unknown task: ${name}`);
+    const job = jobs.get(name);
+    return { ...jobState(job), configFile: job.saved.configFile };
+  }
+  if (closing) throw new Error('Daemon is shutting down');
+  if (action === 'start-many') {
+    const configurations = await loadConfigs(request.configFile, request.directory);
+    const prepared = [];
+    for (const config of configurations) {
+      const previous = jobs.get(config.name);
+      if (previous && (!request.restartExisting || previous.saved.configFile !== config.configFile)) throw new Error(`Task ${config.name} already exists; use restart or delete`);
+      const saved = { ...(previous?.saved ?? { id: allocateId() }), name: config.name, configFile: config.configFile, directory: request.directory, enabled: true };
+      const passwords = request.projectPasswords?.[config.name] ?? previous?.passwords ?? {};
+      const task = await makeTask(saved, passwords);
+      prepared.push({ saved, task, passwords, previous });
+    }
+    // Validate all projects before changing the registry or starting any watcher.
+    for (const job of prepared) jobs.set(job.saved.name, job);
+    try { persist(); }
+    catch (error) {
+      for (const job of prepared) { if (job.previous) jobs.set(job.saved.name, job.previous); else jobs.delete(job.saved.name); }
+      throw error;
+    }
+    for (const job of prepared) {
+      await job.previous?.task?.stop();
+      delete job.previous;
+      job.task.start();
+      logger(job.saved.name)('info', `项目已启动：${job.task.config.directory}`);
+    }
+    return prepared.map(jobState);
+  }
+  if (action === 'start') {
+    const config = await loadConfig(request.configFile, request.directory, request.projectName);
+    if (jobs.has(config.name)) throw new Error(`Task ${config.name} already exists; use restart or delete`);
+    const saved = { id: allocateId(), name: config.name, configFile: config.configFile, directory: request.directory, enabled: true };
+    const passwords = request.passwords ?? {};
+    const task = await makeTask(saved, passwords);
+    jobs.set(config.name, { saved, task, passwords });
+    try { persist(); } catch (error) { jobs.delete(config.name); throw error; }
+    task.start();
+    logger(config.name)('info', config.deployMode === 'manual' ? `手动部署任务就绪：${config.directory}` : `Watching ${config.directory}`);
+    return jobState(jobs.get(config.name));
+  }
+  if (action === 'kill') {
+    // Persist stopped intent first so the next list/start cannot resurrect killed tasks.
+    const previous = [...jobs.values()].map((job) => [job, job.saved.enabled]);
+    for (const [job] of previous) job.saved.enabled = false;
+    try { persist(); }
+    catch (error) { for (const [job, enabled] of previous) job.saved.enabled = enabled; throw error; }
+    await Promise.all(previous.map(([job]) => job.task?.stop()));
+    const removed = [...jobs.entries()];
+    jobs.clear();
+    try { persist(); }
+    catch (error) { for (const [name, job] of removed) jobs.set(name, job); throw error; }
+    // Reset only after every task is removed; single-task deletion keeps IDs stable.
+    const previousId = nextId;
+    nextId = 0;
+    try { saveCounter(); } catch (error) { nextId = previousId; throw error; }
+    closing = true;
+    setImmediate(() => shutdown().catch((error) => { process.stderr.write(error.message + '\n'); process.exitCode = 1; }));
+    return { pid: process.pid, stoppedTasks: previous.length, message: 'All tasks stopped and removed' };
+  }
+  if (action === 'shutdown') {
+    closing = true;
+    setImmediate(() => shutdown().catch((error) => { process.stderr.write(error.message + '\n'); process.exitCode = 1; }));
+    return { message: 'Daemon shutting down; desired tasks will resume on next daemon start' };
+  }
+  if (!validName(name) || !jobs.has(name)) throw new Error(`Unknown task: ${name}`);
+  const job = jobs.get(name);
+  if (action === 'mode') {
+    if (!job.task) throw new Error(job.error ?? '任务配置无效，请先修复配置');
+    await updateDeployMode(job.saved.configFile, name, request.mode);
+    job.task.setDeployMode(request.mode);
+    logger(name)('info', `自动部署已${request.mode === 'auto' ? '开启' : '关闭'}`);
+    return jobState(job);
+  }
+  if (action === 'deploy') {
+    if (!job.task) throw new Error(job.error);
+    const ticket = job.task.trigger();
+    return { message: 'Deployment queued', ...(request.follow ? { ...ticket, name, id: job.saved.id } : {}) };
+  }
+  if (action === 'stop') {
+    const previous = job.saved.enabled;
+    job.saved.enabled = false;
+    try { persist(); } catch (error) { job.saved.enabled = previous; throw error; }
+    await job.task?.stop();
+    return { ...jobState(job), status: 'stopped' };
+  }
+  if (action === 'restart') {
+    const passwords = request.passwords ?? job.passwords ?? {};
+    const previous = job.saved;
+    const saved = { ...previous, ...(request.configFile ? { configFile: request.configFile, directory: request.directory } : {}), enabled: true };
+    const task = await makeTask(saved, passwords);
+    job.saved = saved;
+    try { persist(); } catch (error) { job.saved = previous; throw error; }
+    await job.task?.stop();
+    job.passwords = passwords;
+    job.task = task; job.error = undefined; task.start();
+    return jobState(job);
+  }
+  if (action === 'delete') {
+    await job.task?.stop();
+    jobs.delete(name);
+    try { persist(); } catch (error) { jobs.set(name, job); throw error; }
+    return { message: `Deleted task ${name}; deployment files and logs retained` };
+  }
+  throw new Error(`Unknown command: ${action}`);
+}
+
+/** Stop awaits canceled deployments before releasing the daemon socket and lock. */
+async function shutdown() {
+  closing = true;
+  await Promise.all([...jobs.values()].map((job) => job.task?.stop()));
+  if (server) await new Promise((resolve) => server.close(resolve));
+  cleanup();
+}
+
+/** Only the owning process removes daemon files; a losing concurrent starter does nothing. */
+function cleanup() {
+  if (!ownsLock) return;
+  fs.rmSync(locations.socket, { force: true });
+  fs.rmSync(locations.lock, { force: true });
+  ownsLock = false;
+}
+
+/** Bound requests and serialize mutations; read-only snapshots bypass pending cleanup. */
+async function main() {
+  claimLock();
+  await restore();
+  server = net.createServer((socket) => {
+    let buffer = '';
+    let handled = false;
+    socket.setEncoding('utf8');
+    socket.setTimeout(125000, () => socket.destroy());
+    socket.on('error', (error) => { if (error.code !== 'EPIPE' && error.code !== 'ECONNRESET') process.stderr.write(error.message + '\n'); });
+    socket.on('data', (chunk) => {
+      if (handled) return;
+      buffer += chunk;
+      if (buffer.length > 65536) { socket.destroy(); return; }
+      if (!buffer.includes('\n')) return;
+      handled = true;
+      let request;
+      try { request = JSON.parse(buffer.slice(0, buffer.indexOf('\n'))); }
+      catch (error) { socket.end(JSON.stringify({ error: error.message }) + '\n'); return; }
+      const respond = async () => {
+        try { socket.end(JSON.stringify({ result: await handle(request) }) + '\n'); }
+        catch (error) { socket.end(JSON.stringify({ error: error.message }) + '\n'); }
+      };
+      // Read-only snapshots cannot wait for a stop/restart that is still draining file I/O.
+      if (['ping', 'list', 'status'].includes(request?.action)) void respond();
+      else mutations = mutations.then(respond);
+    });
+  });
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(locations.socket, resolve); });
+  fs.chmodSync(locations.socket, 0o600);
+  for (const signal of ['SIGTERM', 'SIGINT']) process.once(signal, () => {
+    mutations = mutations.then(shutdown).catch((error) => { process.stderr.write(error.message + '\n'); process.exitCode = 1; });
+  });
+}
+
+process.on('exit', cleanup);
+main().catch((error) => { process.stderr.write(error.stack + '\n'); cleanup(); process.exit(1); });

package/src/deploy.js

@@ -0,0 +1,152 @@
+/** Deployment orchestration: SSH agent bootstrap, file-level delta upload and per-server retries.
+ * Exports deploy/SSHTransport; depends on immutable snapshots and a portable Node remote agent.
+ */
+import { readFile } from 'node:fs/promises';
+import { createReadStream } from 'node:fs';
+import { createHash, randomBytes } from 'node:crypto';
+import { setTimeout as delay } from 'node:timers/promises';
+import path from 'node:path';
+import { run } from './process.js';
+import { withPassword } from './password.js';
+
+/** Encode code and parameters so cmd.exe, PowerShell and POSIX shells see only safe characters. */
+const encoded = (value) => Buffer.from(value).toString('base64');
+const nodeCommand = (code) => `node -e "eval(Buffer.from('${encoded(code)}','base64').toString())"`;
+
+export class SSHTransport {
+  /** A transport is scoped to one server and deployment, with no shared mutable connection state. */
+  constructor(server, config, log, signal) {
+    this.server = server;
+    this.config = config;
+    this.log = log;
+    this.signal = signal;
+  }
+
+  /** Strict host verification deliberately relies on the operator's existing known_hosts. */
+  async ssh(command, input, { cleanup = false, quiet = false, hook = false } = {}) {
+    const args = ['-T', '-o', `BatchMode=${this.server.password ? 'no' : 'yes'}`, '-o', 'StrictHostKeyChecking=yes', '-o', 'ConnectTimeout=15', '-o', 'ServerAliveInterval=15', '-o', 'ServerAliveCountMax=3', '-p', String(this.server.port)];
+    if (this.server.password) args.push('-o', 'PreferredAuthentications=password', '-o', 'NumberOfPasswordPrompts=1');
+    if (this.server.identityFile) args.push('-i', this.server.identityFile);
+    args.push(`${this.server.user}@${this.server.host}`, command);
+    return withPassword(this.server.password, (env) => run('ssh', args, { input, env,
+      timeoutMs: cleanup ? Math.min(this.config.timeoutMs, 15000) : this.config.timeoutMs + (hook ? 2000 : 0),
+      signal: cleanup ? undefined : this.signal, onOutput: quiet ? undefined : (chunk) => this.log('info', chunk.trim(), this.server.name) }));
+  }
+
+  /** Install a content-addressed agent atomically; concurrent tasks can share identical agent code. */
+  async install() {
+    const source = await readFile(new URL('./remote-agent.cjs', import.meta.url), 'utf8');
+    const hash = createHash('sha256').update(source).digest('hex');
+    this.agentName = `agent-${hash}.cjs`;
+    const bootstrap = `const fs=require('node:fs'),p=require('node:path'),c=require('node:crypto');let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',x=>s+=x);process.stdin.on('end',()=>{if(c.createHash('sha256').update(s).digest('hex')!=='${hash}')throw Error('Agent checksum mismatch');const d=p.join(require('node:os').homedir(),'.shipwatch-agents');fs.mkdirSync(d,{recursive:true,mode:448});const f=p.join(d,'${this.agentName}');if(fs.existsSync(f))return;const t=f+'.'+process.pid;fs.writeFileSync(t,s,{mode:384});try{fs.renameSync(t,f)}catch(e){fs.rmSync(t,{force:true});if(!fs.existsSync(f))throw e}});`;
+    await this.ssh(nodeCommand(bootstrap), source, { quiet: true });
+  }
+
+  /** Run one remote lifecycle operation; cleanup deliberately survives local task cancellation. */
+  async operation(action, version, input, options = {}) {
+    const payload = encoded(JSON.stringify({ root: this.server.path, version, platform: this.server.platform, keep: this.config.keepReleases }));
+    const code = `process.argv=[process.execPath,'agent','${action}','${payload}'];require(require('node:path').join(require('node:os').homedir(),'.shipwatch-agents','${this.agentName}'));`;
+    return this.ssh(nodeCommand(code), input, { ...options, hook: action === 'hook' });
+  }
+}
+
+/** Base64 framing costs bandwidth but needs no rsync, SFTP library, tar, or remote POSIX shell. */
+async function* uploadPackets(directory, wanted, entries, onFileSent) {
+  for (const key of wanted) {
+    if (!Object.hasOwn(entries, key) || entries[key].type !== 'file') throw new Error('Server requested an unknown file');
+    yield JSON.stringify({ begin: key }) + '\n';
+    for await (const chunk of createReadStream(path.join(directory, key), { highWaterMark: 48 * 1024 })) yield JSON.stringify({ chunk: chunk.toString('base64') }) + '\n';
+    yield '{"end":true}\n';
+    onFileSent?.();
+  }
+}
+
+/** Publish one snapshot to all servers. Failed hosts retry without replaying successful hosts. */
+export async function deploy(config, captured, log, signal, transportFactory = (...args) => new SSHTransport(...args), onProgress = () => {}) {
+  const manifestText = await readFile(path.join(captured.directory, '.shipwatch-manifest.json'), 'utf8');
+  const manifest = JSON.parse(manifestText);
+  return Promise.all(config.servers.map(async (server) => {
+    const transport = transportFactory(server, config, log, signal);
+    let lastError;
+    const startedAt = new Date().toISOString();
+    const started = performance.now();
+    let uploadMs = 0;
+    let updatedFiles = null;
+    let deletedFiles = null;
+    let outcome;
+    const finish = (data) => outcome = { ...data, startedAt, endedAt: new Date().toISOString(), durationMs: performance.now() - started, uploadMs, updatedFiles, deletedFiles, totalFiles: Object.values(manifest.entries).filter((entry) => entry.type === 'file').length };
+
+    for (let attempt = 1; attempt <= config.retry.attempts; attempt++) {
+      const version = `${Date.now()}-${randomBytes(8).toString('hex')}`;
+      let installed = false;
+      let prepared = false;
+      let published = false;
+      let transferredFiles = 0;
+      const progress = (phase, extra = {}) => onProgress({ server: server.name, phase, attempt, attempts: config.retry.attempts, transferredFiles, totalFiles: updatedFiles, ...extra });
+      try {
+        signal?.throwIfAborted();
+        log('info', `Release ${version}, attempt ${attempt}/${config.retry.attempts}`, server.name);
+        updatedFiles = null; progress('connecting');
+        await transport.install(); installed = true;
+        progress('preparing');
+        const response = await transport.operation('prepare', version, manifestText, { quiet: true });
+        prepared = true;
+        const { wanted, deletedFiles: removed = 0 } = JSON.parse(response);
+        updatedFiles = wanted?.length ?? null;
+        deletedFiles = removed;
+        if (!Array.isArray(wanted)) throw new Error('Invalid prepare response');
+        log('info', `${wanted.length} changed files to upload`, server.name);
+        progress('uploading');
+        const uploadStarted = performance.now();
+        try { await transport.operation('upload', version, uploadPackets(captured.directory, wanted, manifest.entries, () => { transferredFiles++; progress('uploading'); })); }
+        finally { uploadMs += performance.now() - uploadStarted; }
+        progress('verifying');
+        await transport.operation('verify', version);
+        // Cancellation must not start a publication after stop has been requested.
+        signal?.throwIfAborted();
+        progress('activating');
+        await transport.operation('activate', version);
+        published = true;
+        let postDeployError;
+        if (server.postDeployCommand) {
+          progress('command');
+          log('info', 'Running post-deploy service command', server.name);
+          try {
+            await transport.operation('hook', version, JSON.stringify({ command: server.postDeployCommand, timeoutMs: config.timeoutMs }));
+          } catch (error) {
+            log('error', `Published, but service command failed: ${error.message}`, server.name);
+            postDeployError = error.message;
+          }
+        }
+        progress('pruning');
+        try { await transport.operation('prune', version); }
+        catch (error) { log('warn', `Published, but retention cleanup failed: ${error.message}`, server.name); }
+        if (postDeployError) return finish({ server: server.name, status: 'failed', published: true, version, attempt, phase: 'postDeploy', error: postDeployError });
+        return finish({ server: server.name, status: 'success', version, uploadedFiles: wanted.length, attempt });
+      } catch (error) {
+        lastError = error.message;
+        log('error', lastError, server.name);
+      } finally {
+        progress('cleanup');
+        if (installed) {
+          try { await transport.operation('cleanup', version, undefined, { cleanup: true, quiet: true }); }
+          catch (error) {
+            // A failed prepare may mean another publisher holds the lock; never remove its lock.
+            if (prepared || published) log('warn', `Cleanup failed; inspect .shipwatch-lock: ${error.message}`, server.name);
+          }
+        }
+        if (outcome) Object.assign(outcome, { endedAt: new Date().toISOString(), durationMs: performance.now() - started });
+        if (outcome) progress(outcome.status);
+      }
+      if (signal?.aborted) break;
+      if (attempt < config.retry.attempts) {
+        const retryMs = Math.min(config.retry.delayMs * 2 ** (attempt - 1), 60000);
+        progress('retrying', { retryAt: Date.now() + retryMs });
+        try { await delay(retryMs, undefined, { signal }); }
+        catch { break; /* Cancellation ends backoff without creating another attempt. */ }
+      }
+    }
+    onProgress({ server: server.name, phase: signal?.aborted ? 'canceled' : 'failed' });
+    return finish({ server: server.name, status: signal?.aborted ? 'canceled' : 'failed', error: lastError });
+  }));
+}

package/src/password.js

@@ -0,0 +1,45 @@
+/** Password bridge: provide SSH_ASKPASS secrets through a private short-lived socket.
+ * Exports withPassword; password values never enter argv, environment variables or temporary files.
+ */
+import net from 'node:net';
+import { mkdtemp, chmod, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomBytes } from 'node:crypto';
+
+/** One bridge per SSH invocation prevents credentials from being reused across target servers. */
+export async function withPassword(password, operation) {
+  if (!password) return operation(process.env);
+  const directory = await mkdtemp('/tmp/sw-auth-');
+  const socketPath = path.join(directory, 'askpass.sock');
+  const token = randomBytes(32).toString('hex');
+  const clients = new Set();
+  const server = net.createServer((socket) => {
+    clients.add(socket);
+    socket.on('close', () => clients.delete(socket));
+    socket.on('error', () => socket.destroy());
+    socket.setTimeout(5000, () => socket.destroy());
+    let request = '';
+    socket.setEncoding('utf8');
+    socket.on('data', (chunk) => {
+      request += chunk;
+      if (request.length > 256) socket.destroy();
+      else if (request.includes('\n')) {
+        if (request.trim() === token) socket.end(password + '\n');
+        else socket.destroy();
+      }
+    });
+  });
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(socketPath, resolve); });
+    await chmod(socketPath, 0o600);
+    return await operation({ ...process.env,
+      SSH_ASKPASS: fileURLToPath(new URL('../bin/askpass.cjs', import.meta.url)), SSH_ASKPASS_REQUIRE: 'force',
+      SHIPWATCH_AUTH_SOCKET: socketPath, SHIPWATCH_AUTH_TOKEN: token,
+    });
+  } finally {
+    for (const client of clients) client.destroy();
+    if (server.listening) await new Promise((resolve) => server.close(resolve));
+    await rm(directory, { recursive: true, force: true });
+  }
+}

package/src/presentation.js

@@ -0,0 +1,56 @@
+/** Chinese CLI presentation: translate routine messages while retaining original diagnostics and JSON contracts. */
+import { formatReport, formatTable, formatTaskList, formatTime, statusText, fitLine } from './task-list.js';
+import { brand, colorLevel, tint, toneCode, cleanText, stateTone, stateMark } from './terminal.js';
+
+/** Translate built-in progress messages; SSH/OS/service diagnostics remain verbatim for troubleshooting. */
+export function messageText(value) {
+  return String(value ?? '').replace(/Release (\S+), attempt (\d+)\/(\d+)/g, '版本 $1，第 $2/$3 次尝试')
+    .replace(/(\d+) changed files to upload/g, '待上传文件：$1 个').replace(/Uploaded /g, '已上传：')
+    .replace(/SHA-256 verification passed/g, 'SHA-256 校验通过').replace(/Activated /g, '已发布版本：')
+    .replace(/Synchronized target directory /g, '已同步目标目录：').replace(/Pruned /g, '已清理旧版本：')
+    .replace(/Running post-deploy service command/g, '正在执行发布后的服务命令').replace(/Service command completed/g, '服务命令执行完成')
+    .replace(/Published, but service command failed:/g, '文件已发布，但服务命令失败：').replace(/Published, but retention cleanup failed:/g, '发布成功，但旧版本清理失败：')
+    .replace(/Task loop failed:/g, '任务循环异常：').replace(/Cleanup failed; inspect .shipwatch-lock:/g, '清理失败，请检查 .shipwatch-lock：')
+    .replace(/Task stopped/g, '任务已停止').replace(/Watching /g, '正在监听：').replace(/Deployment queued/g, '发布已加入队列')
+    .replace(/All tasks stopped and removed/g, '已停止并删除全部任务').replace(/Deleted task (.*); deployment files and logs retained/g, '已删除任务 $1；发布文件和日志保留')
+    .replace(/Daemon shutting down; desired tasks will resume on next daemon start/g, '后台进程正在关闭；下次启动时恢复任务');
+}
+
+/** Render lifecycle results without exposing credentials or raw task objects in the human view. */
+export function formatResult(result, columns) {
+  if (result.summary) return formatTaskList([result], columns) + '\n' + formatReport(result.summary, columns);
+  if (result.name && result.status) return formatTaskList([result], columns);
+  const rows = [];
+  if (result.message) rows.push(['结果', messageText(result.message)]);
+  if (result.pid) rows.push(['进程编号', result.pid]);
+  if (result.stoppedTasks !== undefined) rows.push(['已移除任务数', result.stoppedTasks]);
+  const level = colorLevel();
+  return formatTable(['项目', '内容'], rows, columns, { color: level > 0, headerColor: toneCode('cyan', level), cellColor: (column) => column === 1 ? toneCode('green', level) : toneCode('muted', level) });
+}
+
+/** Interactive overview adds the approved wordmark and useful shortcuts around the same table. */
+export function formatTaskOverview(tasks, columns = 80) {
+  const level = colorLevel();
+  const table = formatTaskList(tasks, columns);
+  if (!level) return table;
+  const automatic = tasks.filter((task) => task.deployMode === 'auto').length;
+  const errors = tasks.filter((task) => task.status === 'error').length;
+  return brand(level) + table + '\n' + tint(fitLine(`${tasks.length} 个项目 · ${automatic} 个自动部署 · ${errors} 个异常`, columns), errors ? 'yellow' : 'muted', level) + '\n' + tint(fitLine('详情 sw info <ID>    日志 sw logs -f', columns), 'muted', level) + '\n';
+}
+
+/** Explicit details keep long directories/config paths complete, even before the first deployment. */
+export function formatTaskDetails(task, columns) {
+  const level = colorLevel();
+  const rows = [
+    ['任务 ID', task.id], ['任务名称', task.name], ['任务状态', statusText(task.status)],
+    ['部署模式', task.deployMode === 'manual' ? '手动' : task.deployMode === 'auto' ? '自动' : '-'],
+    ['监听目录', task.directory], ['配置文件', task.configFile],
+    ['启动时间', formatTime(task.startedAt)], ['最近发布', formatTime(task.lastDeployAt)],
+    ['自动次数', task.autoDeployCount ?? 0],
+    ...(task.lastError ? [['错误详情', messageText(task.lastError)]] : []),
+  ];
+  const heading = level ? brand(level) + tint(fitLine(`◈ ${cleanText(task.name)} #${task.id}  ${stateMark(task.status)} ${statusText(task.status)}`, columns), stateTone(task.status), level, true) + '\n\n' : '';
+  return heading + formatTable(['项目', '内容'], rows, columns, { wrapCells: true, color: level > 0, headerColor: toneCode('cyan', level), cellColor: (column) => column === 0 ? toneCode('muted', level) : undefined }) + (task.summary ? '\n' + formatReport(task.summary, columns) : '');
+}
+
+export { formatReport, formatTime, statusText };

package/src/process.js

@@ -0,0 +1,53 @@
+/** Process adapter: bounded subprocess execution and safe POSIX argument quoting.
+ * Exports run/quote; uses spawn without a local shell, with timeout and cancellation.
+ */
+import { spawn } from 'node:child_process';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+/** Quote a single remote shell argument, including embedded apostrophes. */
+export const quote = (value) => "'" + String(value).replaceAll("'", "'\\''") + "'";
+
+/** Run a command with bounded captured output; onOutput streams chunks to task logs. */
+export function run(command, args, { timeoutMs = 120000, signal, onOutput, input, env = process.env } = {}) {
+  return new Promise((resolve, reject) => {
+    signal?.throwIfAborted();
+    const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, env });
+    let output = '';
+    let stdout = '';
+    let failure;
+    let killTimer;
+    /** Kill the process group so SSH/rsync children cannot survive a canceled task. */
+    const terminate = (reason) => {
+      if (failure) return;
+      failure = reason;
+      const kill = (kind) => { try { process.kill(-child.pid, kind); } catch (error) { if (error.code !== 'ESRCH') child.kill(kind); } };
+      if (child.pid) {
+        kill('SIGTERM');
+        killTimer = setTimeout(() => kill('SIGKILL'), 1000);
+      }
+    };
+    const abort = () => terminate(new Error('Operation canceled'));
+    signal?.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(() => terminate(new Error(`${command} timed out after ${timeoutMs}ms`)), timeoutMs);
+    for (const stream of [child.stdout, child.stderr]) {
+      stream.setEncoding('utf8');
+      stream.on('data', (chunk) => {
+        output = (output + chunk).slice(-65536);
+        if (stream === child.stdout) stdout += chunk;
+        if (stdout.length > 16 * 1024 * 1024) terminate(new Error('Command output exceeds 16 MiB'));
+        onOutput?.(chunk);
+      });
+    }
+    const source = typeof input === 'string' || Buffer.isBuffer(input) ? [input] : (input ?? []);
+    pipeline(Readable.from(source), child.stdin).catch((error) => { if (error.code !== 'EPIPE' && error.code !== 'ERR_STREAM_PREMATURE_CLOSE') terminate(error); });
+    child.on('error', (error) => { failure = error; });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      signal?.removeEventListener('abort', abort);
+      if (failure || code !== 0) reject(failure ?? new Error(`${command} exited ${code}: ${output.trim()}`));
+      else resolve(stdout);
+    });
+  });
+}