wasm-cli 1.6.0__tar.gz → 1.6.2__tar.gz

{wasm_cli-1.6.0/src/wasm_cli.egg-info → wasm_cli-1.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wasm-cli
-Version: 1.6.0
+Version: 1.6.2
 Summary: Web App System Management - Deploy and manage web applications on Linux servers
 Author: Yago López Prado
 Author-email: Yago López Prado <yago.lopez.adeje@gmail.com>

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/docs/superpowers/plans/2026-08-13-wasm-competitive-parity-roadmap.md

@@ -527,3 +527,24 @@ La API entera ya existe (`api/databases.py`). UI con tabs por engine:
   tests con deps de pip NO validan las deps de distro; toda API nueva de una librería
   empaquetada debe contrastarse con la versión de noble/bookworm/Fedora (tabla en
   CLAUDE.md) y el gate del contenedor es el chokepoint que lo garantiza.
+- 2026-08-14 (rediseño): el dueño rechazó la estética austera de la v1 tras usarla
+  ("pobre, asimétrica, componentes horribles"). Nueva dirección en
+  `docs/superpowers/specs/2026-08-14-wasm-panel-design-v2.md` (Geist, acento índigo,
+  elevación, esqueleto de página común, pills en vez de raíl) implementada entera y
+  **publicada como v1.6.0** (Release y CI verdes). Verificación visual con capturas
+  reales (scripts/panel_screenshots.py, 16 pantallas ambos temas + móvil) revisadas
+  en dos rondas por el implementador y una por el orquestador. El spec de diseño de
+  2026-08-12 queda superado en lo estético; sus restricciones técnicas (CSP, sin
+  build, vendor con checksum, color de estado + acento) siguen vigentes.
+- 2026-08-27 (v1.6.1): **EACCES al arrancar toda app no-monorepo**: el deploy corre
+  como root y dejaba `/var/www/apps/{app}` propiedad de root mientras la unidad corre
+  como `service_user` (www-data); pnpm escribe un temporal `_tmp_*` en el cwd en cada
+  `pnpm run`, así que el servicio moría en bucle de reinicios (visto en producción en
+  bodas.arennalabs.com). El chown existía solo en el deployer monorepo — regla 3 rota:
+  la implementación nunca llegó al pipeline común. Fix en v1.6.1:
+  `deployers/helpers/permissions.py::hand_over_tree` como implementación única, paso
+  "Setting permissions" en el pipeline base tras el build (afecta a nextjs, nodejs,
+  python y vite; static define su propia lista y docker-compose no usa el pipeline —
+  a propósito: un `chown -R` sobre bind mounts rompería los datos de contenedores), y
+  los `.env` vuelven a 0600 tras el `chmod -R`. Remediación en servidores ya
+  desplegados: `chown -R www-data:www-data /var/www/apps/{app}` y restart del unit.

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wasm-cli"
-version = "1.6.0"
+version = "1.6.2"
 description = "Web App System Management - Deploy and manage web applications on Linux servers"
 readme = "README.md"
 license = { text = "WASM-NCSAL" }

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/setup.py

@@ -9,7 +9,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="wasm-cli",
-    version="1.6.0",
+    version="1.6.2",
     description="Web App System Management - Deploy and manage web applications on Linux servers",
     author="Yago López Prado",
     author_email="yago.lopez.adeje@gmail.com",

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/src/wasm/__init__.py

@@ -15,7 +15,7 @@ from importlib.metadata import version as _installed_version
 #: as an OBS build directory. The single source of truth is the ``version``
 #: field of pyproject.toml; ``scripts/release.py`` keeps this literal and the
 #: distribution packaging files in step with it.
-_FALLBACK_VERSION = "1.6.0"
+_FALLBACK_VERSION = "1.6.2"
 
 try:
     __version__ = _installed_version("wasm-cli")

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/src/wasm/cli/commands/env.py

@@ -303,6 +303,10 @@ def configure(state: Context, domain: str) -> None:
 @click.option(
     "--unmask",
     is_flag=True,
+    # Explicit, not implied: click 8.5 reports an unset flag default as a
+    # sentinel, and the guarantee that secrets stay masked must not depend on
+    # which click a distribution ships.
+    default=False,
     help="Print secret values in clear instead of hiding them.",
 )
 @pass_context

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/src/wasm/cli/commands/webapp.py

@@ -833,15 +833,10 @@ def _update_monorepo(
     deployer.domain = domain
     deployer.package_manager = "pnpm"
 
-    logger.step(4, total_steps, "Installing dependencies")
-    deployer._install_dependencies()
-
-    logger.step(5, total_steps, "Running database migrations")
-    deployer._run_prisma_migrations()
-
-    logger.step(6, total_steps, "Building applications")
-    deployer._set_permissions()
-    deployer._build_all()
+    # The deployer's own update, not a copy of its steps: the copy handed the
+    # tree over before building and left every build output owned by root.
+    step = iter(range(4, total_steps + 1))
+    deployer.update(on_step=lambda message: logger.step(next(step), total_steps, message))
 
     logger.step(7, total_steps, "Restarting applications")
     service_manager = ServiceManager(verbose=logger.verbose)

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/src/wasm/deployers/base.py

@@ -42,6 +42,7 @@ from wasm.deployers.helpers import (
 )
 from wasm.deployers.helpers.health import failure_output, wait_until_healthy
 from wasm.deployers.helpers.nginx_config import NginxAdvancedConfig
+from wasm.deployers.helpers.permissions import hand_over_tree
 from wasm.deployers.helpers.registration import StoreRegistrar
 from wasm.deployers.helpers.summary import print_deployment_summary
 from wasm.deployers.interface import AppDeployer, StepReporter, UpdateResult
@@ -1163,6 +1164,11 @@ class BaseDeployer(AppDeployer):
                 icon=Icons.BUILD,
                 run=self.build,
             ),
+            DeployStep(
+                title="Setting permissions",
+                icon=Icons.LOCK,
+                run=self._set_permissions,
+            ),
             DeployStep(
                 title="Creating site configuration",
                 icon=Icons.GLOBE,
@@ -1235,6 +1241,36 @@ class BaseDeployer(AppDeployer):
         if self.app_name:
             self.store.update_service_status(self.app_name, active=True, enabled=True)
 
+    def _set_permissions(self) -> None:
+        """
+        Hand the deployed tree over to the account the service runs as.
+
+        The deployment ran as root, so without this step the service user
+        cannot write into its own app directory and the unit fails at start
+        with EACCES.
+        """
+        hand_over_tree(
+            self.app_path,
+            user=self.config.service_user,
+            group=self.config.service_group,
+            runner=self.runner,
+            fs=self.fs,
+            logger=self.logger,
+            env_files=self._env_files(),
+        )
+
+    def _env_files(self) -> list[Path]:
+        """
+        List the environment files whose modes must survive ``_set_permissions``.
+
+        Returns:
+            The dotenv files at the application root. Subclasses that write
+            environment files elsewhere override this.
+        """
+        if not self.app_path.is_dir():
+            return []
+        return sorted(path for path in self.app_path.glob(".env*") if path.is_file())
+
     def _recorder(self) -> DeploymentRecorder:
         """
         Build the recorder :meth:`deploy` and :meth:`update` write history with.
@@ -1312,6 +1348,12 @@ class BaseDeployer(AppDeployer):
             report("Building")
             self.build()
 
+            # The pull, the install and the build all ran as root, and the
+            # service writes into what they produced: Next.js creates
+            # .next/cache/images on the first optimised image, and uploads land
+            # in directories a pull may have just added.
+            self._set_permissions()
+
             start_command = self.get_start_command()
             result = UpdateResult(
                 package_manager=self.package_manager,

wasm_cli-1.6.2/src/wasm/deployers/helpers/permissions.py

@@ -0,0 +1,84 @@
+# Copyright (c) 2024-2026 Yago Lopez Prado
+# Licensed under WASM-NCSAL 1.0 (Commercial use prohibited)
+# https://github.com/Perkybeet/wasm/blob/main/LICENSE
+
+"""
+Ownership hand-over for deployed trees.
+
+The whole deployment runs as root, but the generated unit runs as the
+configured service user. That user must be able to write into the app
+directory: pnpm creates a temporary file in the project root on every
+``pnpm run``, and Next.js writes into ``.next`` at runtime, so a root-owned
+tree fails at start with EACCES and systemd restarts it forever.
+
+This is the one implementation both the base pipeline and the monorepo
+deployer use; it used to exist only in the monorepo deployer, which is why
+every other app type shipped with the bug above.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from pathlib import Path
+
+from wasm.core.fs import SECRET_MODE, FileSystem
+from wasm.core.logger import Logger
+from wasm.core.runner import CommandRunner
+
+#: Deadline for the recursive chown and chmod over a deployed tree.
+_PERMISSIONS_TIMEOUT = 60
+
+
+def hand_over_tree(
+    app_path: Path,
+    *,
+    user: str,
+    group: str,
+    runner: CommandRunner,
+    fs: FileSystem,
+    logger: Logger,
+    env_files: Iterable[Path] = (),
+) -> None:
+    """
+    Make ``user`` the owner of the deployed tree, keeping secrets private.
+
+    Args:
+        app_path: Root of the deployed application.
+        user: Account the service runs as.
+        group: Group the service runs as.
+        runner: Runner the chown and chmod execute through.
+        fs: Filesystem used to restore the mode of the secret files.
+        logger: Logger for the non-fatal failures.
+        env_files: Files holding secrets whose mode must come back to 0600
+            after the recursive chmod.
+    """
+    result = runner.run(
+        ["chown", "-R", f"{user}:{group}", str(app_path)],
+        timeout=_PERMISSIONS_TIMEOUT,
+    )
+    # Not fatal: the build is good, and an app that never writes runs fine. One
+    # that does fails with EACCES in its own log, far from here, so this is the
+    # only place the operator can be told the cause.
+    if not result.success:
+        logger.warning(
+            f"Could not hand {app_path} over to {user}:{group}; the service may fail "
+            f"with EACCES: {result.stderr.strip()}"
+        )
+
+    # Directories need the execute bit and the built assets must stay readable
+    # by the web server, whatever umask the fetch and the build left behind.
+    result = runner.run(
+        ["chmod", "-R", "u+rwX,g+rX,o+rX", str(app_path)],
+        timeout=_PERMISSIONS_TIMEOUT,
+    )
+    if not result.success:
+        logger.warning(
+            f"Could not make {app_path} readable by the web server: {result.stderr.strip()}"
+        )
+
+    # That -R also put o+r on the .env files, which hold the secrets this
+    # deployment was given. The chown above has just made the service account
+    # their owner, so 0600 is readable by the application and by nobody else.
+    for env_file in env_files:
+        if env_file.exists():
+            fs.chmod(env_file, SECRET_MODE)

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/src/wasm/deployers/monorepo.py

@@ -49,6 +49,7 @@ from wasm.deployers.helpers import (
     TurboHelper,
     WorkspaceHelper,
 )
+from wasm.deployers.helpers.permissions import hand_over_tree
 from wasm.deployers.interface import AppDeployer, StepReporter, UpdateResult
 from wasm.deployers.registry import DeployerRegistry
 from wasm.managers.apache_manager import ApacheManager
@@ -415,9 +416,6 @@ class MonorepoDeployer(AppDeployer):
             self.logger.step(5, total_steps, "Installing dependencies", Icons.PACKAGE)
             self._install_dependencies()
 
-            # Set permissions for service user
-            self._set_permissions()
-
             # Step 6: Prisma migrations
             self.logger.step(6, total_steps, "Running database migrations", Icons.DATABASE)
             self._run_prisma_migrations()
@@ -426,6 +424,10 @@ class MonorepoDeployer(AppDeployer):
             self.logger.step(7, total_steps, "Building applications", Icons.BUILD)
             self._build_all()
 
+            # Only now: the build runs as root too, and handing over before it
+            # left every workspace's build output unwritable by its service.
+            self._set_permissions()
+
             # Step 8: Create sites (without SSL initially)
             self.logger.step(8, total_steps, "Creating site configurations", Icons.GLOBE)
             self._create_sites(with_ssl=False)
@@ -533,8 +535,8 @@ class MonorepoDeployer(AppDeployer):
         prisma_updated = self._run_prisma_migrations()
 
         report("Building applications")
-        self._set_permissions()
         self._build_all()
+        self._set_permissions()
 
         return UpdateResult(
             package_manager=self.package_manager,
@@ -948,34 +950,22 @@ class MonorepoDeployer(AppDeployer):
         return False
 
     def _set_permissions(self) -> None:
-        """Set correct ownership and permissions for the app directory."""
-        service_user = self.config.service_user
-        service_group = self.config.service_group
-
-        try:
-            # Change ownership recursively
-            result = self.runner.run(
-                ["chown", "-R", f"{service_user}:{service_group}", str(self.app_path)],
-                timeout=60,
-            )
-            if not result.success:
-                self.logger.debug(f"chown failed: {result.stderr}")
+        """
+        Hand the deployed tree over to the account the services run as.
 
-            # Ensure directories are executable and writable
-            self.runner.run(
-                ["chmod", "-R", "u+rwX,g+rX,o+rX", str(self.app_path)],
-                timeout=60,
-            )
-        except OSError as e:
-            self.logger.debug(f"Failed to set permissions: {e}")
-
-        # That -R also put o+r on the .env files written a step earlier, which
-        # hold the database password this deployer generated. The chown above
-        # has just made the service account their owner, so 0600 is readable by
-        # the application and by nobody else.
-        for env_file in self._env_files():
-            if env_file.exists():
-                self.fs.chmod(env_file, SECRET_MODE)
+        The deployment ran as root, so without this step the workspace units
+        cannot write into their own app directory and fail at start with
+        EACCES.
+        """
+        hand_over_tree(
+            self.app_path,
+            user=self.config.service_user,
+            group=self.config.service_group,
+            runner=self.runner,
+            fs=self.fs,
+            logger=self.logger,
+            env_files=self._env_files(),
+        )
 
     def _env_files(self) -> list[Path]:
         """

{wasm_cli-1.6.0 → wasm_cli-1.6.2/src/wasm_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wasm-cli
-Version: 1.6.0
+Version: 1.6.2
 Summary: Web App System Management - Deploy and manage web applications on Linux servers
 Author: Yago López Prado
 Author-email: Yago López Prado <yago.lopez.adeje@gmail.com>

{wasm_cli-1.6.0 → wasm_cli-1.6.2}/src/wasm_cli.egg-info/SOURCES.txt

@@ -74,6 +74,7 @@ src/wasm/deployers/helpers/health.py
 src/wasm/deployers/helpers/nginx_config.py
 src/wasm/deployers/helpers/package_manager.py
 src/wasm/deployers/helpers/path_resolver.py
+src/wasm/deployers/helpers/permissions.py
 src/wasm/deployers/helpers/preflight.py
 src/wasm/deployers/helpers/prisma.py
 src/wasm/deployers/helpers/registration.py