wasm-cli 1.0.3__tar.gz → 1.2.0__tar.gz

{wasm_cli-1.0.3/src/wasm_cli.egg-info → wasm_cli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wasm-cli
-Version: 1.0.3
+Version: 1.2.0
 Summary: Web App System Management - Deploy and manage web applications on Linux servers
 Author: Yago López Prado
 Author-email: Yago López Prado <yago.lopez.adeje@gmail.com>

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wasm-cli"
-version = "1.0.3"
+version = "1.2.0"
 description = "Web App System Management - Deploy and manage web applications on Linux servers"
 readme = "README.md"
 license = { text = "WASM-NCSAL" }

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/setup.py

@@ -9,7 +9,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="wasm-cli",
-    version="1.0.3",
+    version="1.2.0",
     description="Web App System Management - Deploy and manage web applications on Linux servers",
     author="Yago López Prado",
     author_email="yago.lopez.adeje@gmail.com",

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/src/wasm/__init__.py

@@ -15,7 +15,7 @@ from importlib.metadata import version as _installed_version
 #: as an OBS build directory. The single source of truth is the ``version``
 #: field of pyproject.toml; ``scripts/release.py`` keeps this literal and the
 #: distribution packaging files in step with it.
-_FALLBACK_VERSION = "1.0.3"
+_FALLBACK_VERSION = "1.2.0"
 
 try:
     __version__ = _installed_version("wasm-cli")

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/src/wasm/cli/commands/health.py

@@ -28,11 +28,11 @@ from datetime import datetime
 import click
 
 from wasm.cli.app import Context, pass_context
+from wasm.core.app_state import RUNNING, STATIC, resolve_states
 from wasm.core.config import Config
-from wasm.core.exceptions import ServiceError, WASMError
+from wasm.core.exceptions import WASMError
 from wasm.core.logger import Logger
 from wasm.core.store import get_store
-from wasm.core.utils import domain_to_app_name
 from wasm.managers.apache_manager import ApacheManager
 from wasm.managers.cert_manager import CertificateInfo, CertManager
 from wasm.managers.nginx_manager import NginxManager
@@ -50,21 +50,14 @@ def _print_status(logger: Logger, key: str, value: str, status: str) -> None:
     Print a key-value pair with status indicator.
 
     Args:
-        logger: Logger of the current command, kept for signature stability.
+        logger: Logger of the current command. Writing through it is what makes
+            ``wasm --no-color health`` colourless; the escape codes used to be
+            written to stdout directly, so the flag did nothing here.
         key: Name of the checked item.
         value: Human readable result.
         status: One of "ok", "warning", "error" or "info".
     """
-    if status == "ok":
-        indicator = "\033[32m[OK]\033[0m"
-    elif status == "warning":
-        indicator = "\033[33m[!]\033[0m"
-    elif status == "error":
-        indicator = "\033[31m[X]\033[0m"
-    else:  # info
-        indicator = "\033[34m[i]\033[0m"
-
-    print(f"  {indicator} {key}: {value}")
+    logger.check(key, value, status)
 
 
 def _days_until(expiry: str) -> int | None:
@@ -222,37 +215,35 @@ def run_health_check(verbose: bool = False) -> int:
     service_manager = ServiceManager(verbose=verbose)
 
     apps = store.list_apps()
-    apps_running = 0
-    apps_stopped = 0
-    apps_failed = 0
-
-    for app in apps:
-        try:
-            # The unit was created from domain_to_app_name(); a hand-rolled
-            # replace() disagrees with it for any domain that is not lowercase.
-            status = service_manager.get_status(domain_to_app_name(app.domain))
-        except ServiceError as e:
-            apps_failed += 1
-            warnings.append(f"App '{app.domain}' could not be queried: {e}")
-            continue
-
-        if status.get("active"):
-            apps_running += 1
-        else:
-            apps_stopped += 1
-            warnings.append(f"App '{app.domain}' is not running")
+
+    # The same resolver `wasm list` uses. When these two commands each decided
+    # for themselves what "running" meant, list reported fifteen applications
+    # running while this reported seven stopped, and five of the seven were
+    # static sites that have no service to run in the first place.
+    states = resolve_states(apps, service_manager)
+
+    apps_running = sum(1 for s in states.values() if s.label == RUNNING)
+    apps_static = sum(1 for s in states.values() if s.label == STATIC)
+    unhealthy = [(domain, s) for domain, s in states.items() if not s.healthy]
+
+    for domain, current in unhealthy:
+        warnings.append(f"App '{domain}' - {current.detail or current.label.lower()}")
 
     total_apps = len(apps)
+    served = apps_running + apps_static
     if total_apps > 0:
-        if apps_stopped > 0 or apps_failed > 0:
+        summary = f"{served}/{total_apps} serving"
+        if apps_static:
+            summary += f" ({apps_static} static)"
+        if unhealthy:
             _print_status(
                 logger,
                 "Applications",
-                f"{apps_running}/{total_apps} running, {apps_stopped} stopped",
+                f"{summary}, {len(unhealthy)} need attention",
                 "warning",
             )
         else:
-            _print_status(logger, "Applications", f"{apps_running}/{total_apps} running", "ok")
+            _print_status(logger, "Applications", summary, "ok")
     else:
         _print_status(logger, "Applications", "No applications deployed", "info")
 

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/src/wasm/cli/commands/web.py

@@ -40,7 +40,6 @@ Two structural notes about the Click migration:
 from __future__ import annotations
 
 import importlib.util
-import ipaddress
 import os
 import signal
 import socket
@@ -59,6 +58,13 @@ from wasm.cli.app import Context, enable_dry_run, pass_context
 from wasm.core.exceptions import SecurityError, WASMError
 from wasm.core.fs import get_fs
 from wasm.core.logger import Logger, set_colors_disabled
+from wasm.core.net import (
+    host_addresses,
+    is_loopback_host,
+    loopback_access_lines,
+    normalize_host,
+    strip_brackets,
+)
 from wasm.core.runner import get_runner
 
 if TYPE_CHECKING:
@@ -68,23 +74,18 @@ if TYPE_CHECKING:
 PID_FILE = Path("/var/run/wasm-web.pid")
 PID_FILE_USER = Path.home() / ".wasm" / "web.pid"
 
-#: The address a socket is given when it should answer on every interface. It
-#: is named here to be recognised and refused, never bound by default.
-ALL_INTERFACES = "0.0.0.0"  # noqa: S104
-
-#: Spellings of "every interface" that no resolver accepts, so they cannot be
-#: classified by looking them up. The empty string is the one that mattered: a
-#: version of this module kept a set of loopback *strings* with "" in it, and
-#: ``wasm web start --host ""`` walked past the refusal below and bound the
-#: root panel to every interface in cleartext.
-WILDCARD_SPELLINGS = frozenset({"", "*"})
-
 #: Package installation is slow on a cold cache but must not hang a session.
 INSTALL_TIMEOUT = 900
 
 #: Seconds between stopping and starting again, so the port is released.
 RESTART_PAUSE = 1
 
+#: How far past a taken port to look for a free one to name. The panel is not
+#: moved automatically - see :func:`_start` - but the port offered instead has
+#: to be one that will actually work, and the search has to finish while the
+#: operator is still reading the error.
+PORT_SUGGESTION_SPAN = 20
+
 F = TypeVar("F", bound=Callable[..., Any])
 
 
@@ -208,110 +209,6 @@ def _exit(code: int) -> NoReturn:
 # How the panel is exposed
 # ---------------------------------------------------------------------------
 
-#: Address family alias, for the helpers below.
-IPAddress = ipaddress.IPv4Address | ipaddress.IPv6Address
-
-
-def _strip_brackets(host: str) -> str:
-    """
-    Remove the brackets an IPv6 literal is often written with.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        The spelling without a surrounding ``[]`` pair.
-    """
-    candidate = host.strip()
-    if len(candidate) > 1 and candidate.startswith("[") and candidate.endswith("]"):
-        return candidate[1:-1]
-    return candidate
-
-
-def _host_addresses(host: str) -> tuple[IPAddress, ...]:
-    """
-    Return every address a host spelling would end up bound to.
-
-    Comparing host strings is what made this decision wrong: "" , "*", "0",
-    "0.0.0.0", "::" and a name in ``/etc/hosts`` pointing at 0.0.0.0 are six
-    spellings of the same socket, and a set of known-good strings misses five
-    of them. The resolver is asked instead, and its answer is classified with
-    :mod:`ipaddress`.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        The addresses, empty when the spelling cannot be resolved. Empty means
-        "unknown", and every caller treats unknown as exposed.
-    """
-    candidate = _strip_brackets(host)
-    if candidate in WILDCARD_SPELLINGS:
-        return (ipaddress.ip_address(ALL_INTERFACES),)
-
-    try:
-        return (ipaddress.ip_address(candidate),)
-    except ValueError:
-        pass
-
-    try:
-        # A resolution covers names and also the inet_aton spellings ipaddress
-        # refuses but a socket accepts, such as "0" (INADDR_ANY) and "127.1".
-        infos = socket.getaddrinfo(candidate, None, type=socket.SOCK_STREAM)
-    except (OSError, UnicodeError, ValueError):
-        return ()
-
-    addresses = []
-    for info in infos:
-        # A link-local sockaddr carries a %scope suffix that ipaddress refuses.
-        text = str(info[4][0]).split("%", 1)[0]
-        try:
-            addresses.append(ipaddress.ip_address(text))
-        except ValueError:
-            return ()
-    return tuple(addresses)
-
-
-def _is_loopback_host(host: str) -> bool:
-    """
-    Report whether only this machine could reach a panel bound to a host.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        True only when the spelling is known to resolve to loopback addresses
-        and nothing else. A spelling that cannot be resolved is not loopback,
-        because guessing in the other direction publishes a root shell.
-    """
-    addresses = _host_addresses(host)
-    return bool(addresses) and all(address.is_loopback for address in addresses)
-
-
-def _normalize_host(host: str) -> str:
-    """
-    Canonicalise a host spelling so what is checked is what is reported.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        The canonical spelling. Every way of writing "every interface" becomes
-        the address it binds, so the refusal below names a real address instead
-        of quoting an empty string back at the operator.
-    """
-    candidate = _strip_brackets(host)
-    addresses = _host_addresses(candidate)
-    if not addresses:
-        return candidate
-    if candidate in WILDCARD_SPELLINGS or all(address.is_unspecified for address in addresses):
-        return str(addresses[0])
-    try:
-        return str(ipaddress.ip_address(candidate))
-    except ValueError:
-        # A name: binding it is the resolver's business, not this module's.
-        return candidate
-
 
 @dataclass(frozen=True)
 class StartOptions:
@@ -422,11 +319,11 @@ def _build_security_config(options: StartOptions) -> SecurityConfig:
 
     # Normalised first, so the exposure decision, the message and the address
     # that is finally bound all talk about the same thing.
-    host = _normalize_host(options.host)
+    host = normalize_host(options.host)
     port = options.port
     whitelist = list(options.allow_ip)
     proxies = list(options.trusted_proxy)
-    local_only = _is_loopback_host(host)
+    local_only = is_loopback_host(host)
 
     if options.require_https and not (options.tls_cert and options.tls_key):
         raise SecurityError(
@@ -443,7 +340,7 @@ def _build_security_config(options: StartOptions) -> SecurityConfig:
         unresolved = (
             f"WASM could not resolve {host!r}, so it cannot show that only this machine "
             "would reach the panel, and treats it as exposed.\n"
-            if not _host_addresses(host)
+            if not host_addresses(host)
             else ""
         )
         raise SecurityError(
@@ -708,6 +605,116 @@ def _prompt_install(missing_apt: list[str], missing_pip: list[str], verbose: boo
 # ---------------------------------------------------------------------------
 
 
+def _port_in_use(host: str, port: int) -> bool:
+    """
+    Ask whether the panel's address is already taken.
+
+    Binding is the only reliable answer: a connection attempt says nothing
+    about a socket bound with no backlog, and reading ``ss`` output means
+    parsing a different format on every distribution.
+
+    Args:
+        host: Address the panel would bind.
+        port: Port the panel would bind.
+
+    Returns:
+        True when binding would fail because something holds the address.
+    """
+    family = socket.AF_INET6 if ":" in strip_brackets(host) else socket.AF_INET
+    probe = socket.socket(family, socket.SOCK_STREAM)
+    try:
+        # Deliberately not SO_REUSEADDR: with it the bind succeeds against a
+        # socket in TIME_WAIT, which is the case this is meant to catch.
+        probe.bind((strip_brackets(host), port))
+    except OSError:
+        return True
+    except (ValueError, socket.gaierror):
+        # An address this process cannot even parse is not this check's problem;
+        # the bind that follows will report it properly.
+        return False
+    finally:
+        probe.close()
+    return False
+
+
+def _first_free_port(host: str, port: int) -> int | None:
+    """
+    Find a port to offer in place of one that is taken.
+
+    Args:
+        host: Address the panel would bind.
+        port: The port that turned out to be taken.
+
+    Returns:
+        The first free port above it, or None when the whole search span is
+        held. Naming a port without checking it is what made the old suggestion
+        useless: it was the requested port plus one, and on a machine busy
+        enough to hit this at all that is frequently taken too.
+    """
+    for candidate in range(port + 1, min(port + 1 + PORT_SUGGESTION_SPAN, 65536)):
+        if not _port_in_use(host, candidate):
+            return candidate
+    return None
+
+
+def _report_taken_port(host: str, port: int, logger: Logger) -> None:
+    """
+    Explain a taken port, including why the panel does not move itself.
+
+    Moving to the next free port would be the obliging thing to do and it is
+    the wrong thing to do. The port is an address other things point at - an
+    SSH tunnel, a reverse proxy, a bookmark, a script - so a panel that lands
+    somewhere new whenever the old place is busy cannot be automated. It would
+    also paper over the case this check exists to catch: a second panel, still
+    running, still holding a root session.
+
+    None of that is obvious from the outside, so it is said rather than
+    implied.
+
+    Args:
+        host: Address the panel would have bound.
+        port: The port something else holds.
+        logger: Logger for the report.
+    """
+    logger.error(f"Something is already listening on {host}:{port}")
+    logger.info("WASM does not move the panel to another port on its own:")
+    logger.info("  the port is what your SSH tunnel, proxy and bookmarks point at,")
+    logger.info("  and moving it would hide a panel that is still running here.")
+    logger.info("If it is a panel this machine has forgotten about:")
+    logger.info("  wasm web stop")
+    logger.info("To see what holds the port:")
+    logger.info(f"  ss -ltnp 'sport = :{port}'")
+
+    free = _first_free_port(host, port)
+    if free is None:
+        logger.info(
+            f"Nothing up to {port + PORT_SUGGESTION_SPAN} is free either. "
+            "Choose a port with --port."
+        )
+        return
+    logger.info(f"Or serve on {free}, which is free right now:")
+    logger.info(f"  wasm web start --port {free}")
+
+
+def _report_daemon_started(config: SecurityConfig, pid: int, logger: Logger) -> None:
+    """
+    Report a backgrounded panel, and how to reach it.
+
+    Args:
+        config: The configuration it was started with.
+        pid: Process id of the panel.
+        logger: Logger for the report.
+    """
+    scheme = "https" if config.require_https else "http"
+
+    logger.success(f"Web server started in background (PID: {pid})")
+    logger.info(f"Server running at {scheme}://{config.host}:{config.port}")
+    for line in loopback_access_lines(config.host, config.port, scheme=scheme):
+        logger.info(line)
+    logger.info("Use 'wasm web status' to check status")
+    logger.info("Use 'wasm web stop' to stop the server")
+
+
 def _start(options: StartOptions, verbose: bool, *, dry_run: bool = False) -> int:
     """
     Start the panel, refusing an unsafe exposure first.
@@ -773,11 +780,20 @@ def _start(options: StartOptions, verbose: bool, *, dry_run: bool = False) -> in
             # Process not running, remove stale PID file
             get_fs().remove(pid_file, missing_ok=True)
 
+    # The PID file only catches a panel this machine still has a record of. A
+    # panel whose PID file was removed, or anything else on the port, walked
+    # past that check: the token was printed and then uvicorn failed with a
+    # bare OSError, leaving an operator holding a credential for a server that
+    # never started.
+    if not dry_run and _port_in_use(host, config.port):
+        _report_taken_port(host, config.port, logger)
+        return 1
+
     if config.ip_whitelist:
         logger.info(f"Only these clients may connect: {', '.join(config.ip_whitelist)}")
     if config.trusted_proxies:
         logger.info(f"Forwarding headers believed from: {', '.join(config.trusted_proxies)}")
-    elif _is_loopback_host(host) and not config.require_https:
+    elif is_loopback_host(host) and not config.require_https:
         logger.warning(
             "Serving plain HTTP on loopback. Behind a TLS proxy, pass --trusted-proxy "
             "so the session cookie is issued with the Secure flag."
@@ -835,17 +851,13 @@ def _start_daemon(config: SecurityConfig, verbose: bool) -> int:
         Exit code.
     """
     logger = Logger(verbose=verbose)
-    scheme = "https" if config.require_https else "http"
 
     # Fork process
     pid = os.fork()
 
     if pid > 0:
         # Parent process
-        logger.success(f"Web server started in background (PID: {pid})")
-        logger.info(f"Server running at {scheme}://{config.host}:{config.port}")
-        logger.info("Use 'wasm web status' to check status")
-        logger.info("Use 'wasm web stop' to stop the server")
+        _report_daemon_started(config, pid, logger)
         return 0
 
     # Child process

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/src/wasm/cli/commands/webapp.py

@@ -33,19 +33,21 @@ from typing import Any, TypeVar
 import click
 
 from wasm.cli.app import Context, enable_dry_run, pass_context
+from wasm.core.app_state import RUNNING, STATIC, resolve_states
 from wasm.core.config import Config
 from wasm.core.dependencies import check_deployment_ready
 from wasm.core.exceptions import DeploymentError, ServiceError, WASMError
-from wasm.core.logger import Logger, set_colors_disabled
+from wasm.core.logger import Logger, set_colors_disabled, state, styled
 from wasm.core.runner import (
     CommandResult,
     get_runner,
 )
-from wasm.core.store import AppStatus, get_store
+from wasm.core.store import get_store
 from wasm.core.utils import domain_to_app_name, remove_directory
 from wasm.deployers import detect_app_type, get_deployer
 from wasm.deployers.docker_compose import DockerComposeDeployer
 from wasm.deployers.monorepo import MonorepoDeployer
+from wasm.deployers.registry import available_types
 from wasm.managers.apache_manager import ApacheManager
 from wasm.managers.backup_manager import RollbackManager
 from wasm.managers.cert_manager import CertManager
@@ -67,17 +69,10 @@ _FOLLOW_TIMEOUT = 86400
 #: Docker Compose pulls images and rebuilds; it needs room.
 _COMPOSE_TIMEOUT = 1800
 
-#: Application types ``create`` accepts, in the order they are offered.
-APP_TYPES = [
-    "nextjs",
-    "nodejs",
-    "vite",
-    "python",
-    "static",
-    "monorepo",
-    "docker-compose",
-    "auto",
-]
+#: Application types ``create`` accepts, in the order they are offered. Read
+#: from the registry rather than typed out here: a hand-written copy is a copy
+#: that goes stale the first time a deployer is added, and it did.
+APP_TYPES = [entry["type"] for entry in available_types()]
 
 #: Node package managers ``create`` and ``update`` accept.
 PACKAGE_MANAGERS = ["npm", "pnpm", "bun", "auto"]
@@ -464,30 +459,44 @@ def _list_apps(logger: Logger) -> int:
         logger.info("  wasm deploy -d example.com -s https://github.com/user/repo")
         return 0
 
+    # Asked of systemd and of the port, not read from the status column. That
+    # column is written at deploy time and never again, so it called everything
+    # Running while health, which did ask, reported half of them stopped.
+    states = resolve_states(apps, ServiceManager(verbose=logger.verbose))
+
     headers = ["Domain", "Type", "Status", "Port", "SSL"]
     rows = []
 
-    labels = {
-        AppStatus.RUNNING.value: "Running",
-        AppStatus.STOPPED.value: "Stopped",
-        AppStatus.DEPLOYING.value: "Deploying",
-        AppStatus.FAILED.value: "Failed",
-    }
-
     for app in apps:
-        status_str = labels.get(app.status, "Unknown")
-        port_str = str(app.port) if app.port else "static"
-        ssl_str = "yes" if app.ssl_enabled else "no"
+        current = states[app.domain]
+        rows.append(
+            [
+                styled(app.domain, "bold"),
+                app.app_type,
+                state(current.label),
+                styled(app.port, "") if app.port else state("static"),
+                state("yes") if app.ssl_enabled else state("no"),
+            ]
+        )
 
-        rows.append([app.domain, app.app_type, status_str, port_str, ssl_str])
+    logger.table(headers, rows, justify=["left", "left", "left", "right", "left"])
 
-    logger.table(headers, rows)
+    running = sum(1 for s in states.values() if s.label == RUNNING)
+    static = sum(1 for s in states.values() if s.label == STATIC)
+    unhealthy = [(domain, s) for domain, s in states.items() if not s.healthy]
 
     logger.blank()
-    running = sum(1 for a in apps if a.status == AppStatus.RUNNING.value)
-    static = sum(1 for a in apps if a.is_static)
     logger.info(f"Total: {len(apps)} apps ({running} running, {static} static)")
 
+    # The reason belongs next to the list. Making the operator run a second
+    # command to find out why something says Stopped is how the contradiction
+    # between these two commands went unnoticed for as long as it did.
+    if unhealthy:
+        logger.blank()
+        logger.warning(f"{len(unhealthy)} need attention:")
+        for domain, current in unhealthy:
+            logger.list_item(f"{domain} - {current.detail or current.label.lower()}")
+
     return 0
 
 

{wasm_cli-1.0.3 → wasm_cli-1.2.0}/src/wasm/cli/interactive.py

@@ -34,9 +34,11 @@ class InteractiveMode:
             raise WASMError(
                 "Interactive mode needs questionary, which is missing",
                 details=(
-                    "It is a hard dependency, so this means a broken install.\n"
-                    "  pip install --force-reinstall wasm-cli\n"
-                    "  or, on a distribution package: apt install python3-questionary"
+                    "Every other command works without it. To get it:\n"
+                    "  apt install python3-questionary        Debian 13, Ubuntu 24.04+\n"
+                    "  dnf install python3-questionary        Fedora 42+\n"
+                    "  pip install questionary                anywhere else\n"
+                    "It is not packaged for Debian 12, Ubuntu 22.04 or Leap 15."
                 ),
             )