diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ec17e39
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,45 @@
+name: CI
+
+on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: ci-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ check:
+ strategy:
+ fail-fast: false
+ matrix:
+ os: [ubuntu-latest, macos-latest]
+ runs-on: ${{ matrix.os }}
+ timeout-minutes: 10
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+ with:
+ go-version-file: go.mod
+ cache: false
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+ with:
+ node-version: '24'
+ - name: Check Go formatting
+ run: test -z "$(gofmt -l cmd/ship)"
+ - name: Test local behavior without cloud credentials
+ run: go test -race ./cmd/ship
+ - name: Go vet
+ run: go vet ./cmd/ship
+ - name: Build without cgo
+ run: CGO_ENABLED=0 go build -trimpath -buildvcs=false -o bin/ship ./cmd/ship
+ - name: Check browser script
+ run: node --check cmd/ship/web/app.js
diff --git a/.gitignore b/.gitignore
index dfbf5d5..0e9c90e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,8 @@ __pycache__/
.venv/
validation/artifacts/
bin/
+.vercel/
+*.private.*
+
+# Local Ship records and plaintext business secrets
+.ship/
diff --git a/PRODUCT.md b/PRODUCT.md
index 75ef94d..8925cd2 100644
--- a/PRODUCT.md
+++ b/PRODUCT.md
@@ -1,6 +1,6 @@
# Ship · 产品范围
-项目名称已由用户确认为 **Ship**（2026-09-17，原名 UpOK）。源码、命令与新安装目录使用 `ship`；已有 UpOK 本地状态继续兼容读取。本仓库公开源码与设计，官网和预编译安装包尚未提供。
+项目名称已由用户确认为 **Ship**（2026-09-17，原名 UpOK）。源码、命令与新安装目录使用 `ship`；新用户状态默认位于 `~/.ship`，已有 UpOK 本地状态继续兼容读取。本仓库公开源码与设计，官网和预编译安装包尚未提供。
当前推进到安装验收：独立安装目录和空白本地状态下，复用现有官方登录，已完成资源登记、实际发布、跨进程核对及数据库数据保留；支持 macOS arm64 的源码安装脚本和无云请求的安装检查已提供。真正的新用户 OAuth、独立外部试用仍未完成。正式 Free 验证因当前测试账号仍是 Trial 暂停，外部试用仍待独立验证。[验收记录](validation/results/upok-install-report.json)
@@ -144,3 +144,11 @@ Terraform / OpenTofu 可用于适合声明式管理的资源；不预先要求
免费是已确认的默认费用约束，兼容性与迁移性也是重要选择依据；不能为了得到免费目标而静默改写语言、数据库引擎或业务语义。若当前项目没有满足约束的组合，应明确说明并让用户选择调整范围或主动选择付费路径。
内部版已选择 Go 标准库程序、CLI 接入 Agent、内嵌网页及本地操作记录；公开安装包和更多接入范围继续按实际验收推进。本地样例、云端实际验收与内部版验收分别记录，当前个人云测试资源保留用于后续验证。
+
+## 本地密钥存储决策（2026-09-17 更新）
+
+用户选择优先采用简单的本地文件方案。业务密钥单独放在私有状态目录的 `secrets/项目名.json` 中，普通配置、CLI 输出和默认网页响应不包含密钥值。macOS/Linux 通过目录 0700、文件 0600 限制其他普通用户访问，密钥仍是明文，不能防止当前用户下有读取权限的程序。原钥匙串实现退出首版依赖；Windows ACL 和文件锁需另外适配并验收。存储迁移保留所有操作标记及未决写入状态。
+
+## Vercel 发布验收（2026-09-17）
+
+已有 Vercel Hobby 项目与 Neon Free 已通过 Ship CLI 的两轮源码发布、更新、HTTP/PostgreSQL 读写、数据保留和日志检查。普通部署保留平台现有 Secret，不要求读取或重写密码；数据库配置不可读时明确显示未核验。历史 Secret 写入在用户确认后按“经诊断未生效”归档，原字段和证据保留，没有重发。真实业务 Secret 元数据保持不变。[验收记录](validation/results/ship-vercel-acceptance.json)
diff --git a/README.md b/README.md
index 1a49077..d0dc45f 100644
--- a/README.md
+++ b/README.md
@@ -4,20 +4,22 @@ Local deployment management for your apps, your cloud accounts, and your coding
Ship 在本地运行，让已有编码 Agent 通过 CLI 部署、检查和维护应用。网页提供应用列表、日志和发布入口，应用与数据库运行在用户自己的云账号中。
-**当前为 Alpha。** 已验证的发布组合是 Railway Trial + Neon Free。正式 Railway Free 和付费账号的发布路径尚未验收，程序会停止这些账号的发布操作。软件采用 MIT 开源；云资源的费用取决于供应商套餐。
+**当前为 Alpha。** 已验证 Railway Trial + Neon Free，以及个人非商业用途的 Vercel Hobby + Neon Free HTTP 容器路径。正式 Railway Free 和付费账号的发布路径尚未验收，程序会停止这些账号的发布操作。软件采用 MIT 开源；云资源的费用与用途限制取决于供应商套餐。
## 已实现
-- 关联已有 Railway 服务与 Neon PostgreSQL，核对资源归属、数据库目标和费用条件。
+- 关联已有 Railway 或 Vercel 项目与 Neon PostgreSQL，核对资源归属和费用条件；数据库连接目标的可核验范围单独显示。
- 从 Dockerfile 项目发布源码，查看状态、日志和应用访问检查。
- 保存本地操作记录，中断后核对原部署；结果未知时阻止重复提交。
- CLI、极简网页和配套 Skill 共用执行逻辑与状态。
-核心操作直接调用用户授权的供应商接口，不依赖作者运营的在线后台。首次创建云资源、数据库迁移、无人值守维护和更多供应商尚未实现。
+核心操作直接调用用户授权的供应商接口，不依赖作者运营的在线后台。首次创建云资源、数据库迁移、无人值守维护和其他供应商尚未实现。
+
+本地记录默认保存在 `~/.ship`，用户主动保存的业务密钥单独以受限权限的明文文件存放。Vercel 普通发布沿用平台已有 Secret，无需先导入或重写；不可读的数据库地址明确标为未核验。[Ship 云端验收](validation/results/ship-vercel-acceptance.json)
## 安装与启动
-目前安装入口仅验收 **macOS arm64**，需要 Go 1.24+、Node.js 20.19+ 和 npm。
+目前安装入口仅验收 **macOS arm64**，需要 Go 1.24+、Node.js 和 npm；Vercel 路径使用 Node.js 24 验收。
```sh
git clone https://github.com/unix2dos/ship.git
@@ -50,12 +52,14 @@ cd "$HOME/.local/share/ship"
截至 2026-09-17：
-- 9 组 Go 检查、race 检测、`go vet`、前端语法与安装检查通过。
+- Go 检查、race 检测、`go vet`、前端语法与安装检查通过，包括改名后的旧状态与发布记录兼容检查。
+- 本地文件密钥存储、私有权限、跨进程读取、旧数据迁移与安装后的页面检查通过。[存储验收](validation/results/local-secret-files-report.json)
- 安装后的工具从空白本地状态关联资源、完成真实发布，再由新进程核对；原 PostgreSQL 数据保留。[安装验收记录](validation/results/upok-install-report.json)
- Go、Python、Node、Rust 的 Linux/amd64 容器样例通过 29 组本地检查。[本地结果](validation/RESULTS.md)
- Go 样例完成真实云端部署、更新、自然休眠唤醒与一次配置故障恢复。[云端结果](validation/CLOUD-RESULTS.md)
+- Ship CLI 完成 Vercel Hobby + Neon 的两次真实 Go 容器发布、源码更新、PostgreSQL 读写、数据保留和日志检查，沿用原有 Secret。此前独立实验验证过闲置后访问，用户也确认过手动 Chrome 访问；自动化浏览器拦截未定位。[Vercel 结果](validation/VERCEL-RESULTS.md)
-外部开发者独立复现、新用户 OAuth、正式 Free、其他本机系统和真实云间迁移仍未验收。早期 PORT 配置快照与运行值的差异保留为未决项。公开报告中的云项目、服务和数据库标识替换为占位符，测试时间、结果与源码指纹保留；本机凭证、个人讨论和原始私有记录不随仓库发布。
+外部开发者独立复现、新用户 OAuth、正式 Railway Free、其他本机系统和真实云间迁移仍未验收。早期 PORT 配置快照与运行值的差异保留为未决项。公开报告中的云项目、服务和数据库标识替换为占位符，测试时间、结果与源码指纹保留；本机凭证、个人讨论和原始私有记录不随仓库发布。
在源码目录运行开发检查：
@@ -70,6 +74,8 @@ python3 validation/install-smoke.py "$HOME/.local/share/ship"
## 设计与反馈
+首次外部试用可按 [独立试用清单](docs/FIRST-TRY.md) 进行。
+
- [产品范围](PRODUCT.md) · [领域术语](CONTEXT.md) · [架构决策](docs/adr/)
- [平台与兼容性研究](docs/research/)
diff --git a/cmd/ship/engine.go b/cmd/ship/engine.go
index 529912f..6e68f58 100644
--- a/cmd/ship/engine.go
+++ b/cmd/ship/engine.go
@@ -24,7 +24,19 @@ func validateReferences(p *Project) error {
if !slugPattern.MatchString(p.Name) {
return errors.New("name must use lowercase letters, digits and hyphens")
}
- for _, id := range []string{p.Workspace, p.RailwayProject, p.Service, p.Environment, p.NeonOrg, p.NeonProject, p.NeonEndpoint} {
+ ids := []string{p.NeonOrg, p.NeonProject, p.NeonEndpoint}
+ switch p.Provider {
+ case "", "railway":
+ ids = append(ids, p.Workspace, p.RailwayProject, p.Service, p.Environment)
+ case "vercel":
+ if !strings.HasPrefix(p.VercelTeam, "team_") || !strings.HasPrefix(p.VercelProject, "prj_") {
+ return errors.New("Vercel requires explicit team and project IDs")
+ }
+ ids = append(ids, p.VercelTeam, p.VercelProject)
+ default:
+ return errors.New("unsupported compute provider")
+ }
+ for _, id := range ids {
if !idPattern.MatchString(id) {
return errors.New("all provider resource IDs must be explicit and valid")
}
@@ -49,9 +61,13 @@ func validateProject(p *Project) error {
if err != nil {
return errors.New("source directory does not exist")
}
- info, err := os.Stat(filepath.Join(p.Source, "Dockerfile"))
+ dockerfile := "Dockerfile"
+ if p.Provider == "vercel" {
+ dockerfile = "Dockerfile.vercel"
+ }
+ info, err := os.Stat(filepath.Join(p.Source, dockerfile))
if err != nil || !info.Mode().IsRegular() {
- return errors.New("internal alpha requires a source directory with a Dockerfile")
+ return fmt.Errorf("internal alpha requires a source directory with %s", dockerfile)
}
return nil
}
@@ -74,8 +90,23 @@ func (e *Engine) check(ctx context.Context, p Project) (ApplicationChecks, error
c := ApplicationChecks{At: time.Now().UTC(), Results: checkApplication(ctx, p.URL)}
return c, e.Store.saveChecks(p.Name, c)
}
+
+func (e *Engine) logs(ctx context.Context, p Project) ([]string, error) {
+ known, err := e.Store.knownSecrets(p.Name)
+ if err != nil {
+ return nil, errors.New("local secret-file redaction context is unavailable; logs withheld")
+ }
+ lines, err := e.Providers.logs(ctx, p)
+ if err != nil {
+ return nil, err
+ }
+ for i := range lines {
+ lines[i] = redact(lines[i], known)
+ }
+ return lines, nil
+}
func excluded(name string) bool {
- for _, v := range []string{".git", "node_modules", ".venv", "__pycache__", "target", ".ship", ".upok", ".pdeploy", ".ssh", ".aws", ".netrc", ".npmrc"} {
+ for _, v := range []string{".git", ".vercel", "node_modules", ".venv", "__pycache__", "target", ".ship", ".upok", ".pdeploy", ".ssh", ".aws", ".netrc", ".npmrc"} {
if name == v {
return true
}
@@ -204,6 +235,12 @@ func (e *Engine) executePublish(ctx context.Context, p Project, op *Operation, w
e.record(op, "blocked", err.Error())
return err
}
+ known, err := e.Store.knownSecrets(p.Name)
+ if err != nil {
+ e.record(op, "blocked", "本地密钥文件不可用，无法完成源码密钥检查")
+ return err
+ }
+ pre.Secrets = append(pre.Secrets, known...)
stage, digest, count, err := bundleSource(p.Source, e.Store.Root, pre.Secrets)
if err != nil {
e.record(op, "blocked", err.Error())
@@ -216,13 +253,17 @@ func (e *Engine) executePublish(ctx context.Context, p Project, op *Operation, w
}
op.SourceHash = digest
op.SourceFiles = count
+ if p.Provider == "vercel" {
+ if err = prepareVercelSource(stage, p); err != nil {
+ e.record(op, "blocked", err.Error())
+ return err
+ }
+ }
// Durable intent precedes the only cloud mutation. Unknown outcomes are reconciled by this unique marker.
if err = e.record(op, "submitting", "正在提交源码；结果未确认前不会重复发布"); err != nil {
return err
}
- args := append([]string{"up", stage, "--path-as-root"}, selectors(p)...)
- args = append(args, "--detach", "--json", "--message", op.Marker)
- _, submitErr := e.Providers.call(ctx, "railway", args...)
+ submitErr := e.Providers.submit(ctx, p, stage, op.Marker)
if err = e.record(op, "unknown", "提交结果待核对"); err != nil {
return err
}
@@ -262,7 +303,10 @@ func (e *Engine) reconcileOnce(ctx context.Context, p Project, op *Operation) er
op.DeploymentID = d.ID
op.ProviderState = d.Status
switch d.Status {
- case "SUCCESS":
+ case "SUCCESS", "READY":
+ if p.Provider == "vercel" && !d.AliasAssigned {
+ return e.record(op, "deploying", "构建已完成，等待生产域名关联；不会重复提交")
+ }
c, err := e.check(ctx, p)
if err != nil {
return err
@@ -272,7 +316,7 @@ func (e *Engine) reconcileOnce(ctx context.Context, p Project, op *Operation) er
return e.record(op, "deployed", "平台已完成发布；应用访问检查单独显示")
case "SLEEPING":
return e.record(op, "deployed", "部署已完成；上次核对时服务处于休眠")
- case "FAILED", "CRASHED", "REMOVED", "CANCELED", "CANCELLED", "SKIPPED":
+ case "FAILED", "ERROR", "CRASHED", "REMOVED", "CANCELED", "CANCELLED", "SKIPPED":
return e.record(op, "failed", "平台报告本次部署未运行；请查看日志后决定下一步")
default:
return e.record(op, "deploying", "已找到原部署，等待平台完成；不会创建替代资源")
diff --git a/cmd/ship/main.go b/cmd/ship/main.go
index be8a3f4..cf31d30 100644
--- a/cmd/ship/main.go
+++ b/cmd/ship/main.go
@@ -13,19 +13,23 @@ import (
"syscall"
)
-const help = `ship — internal alpha, existing Railway + Neon project bindings
+const help = `ship — internal alpha, existing Railway or Vercel + Neon project bindings
Global flags (before command):
- --state-dir PATH Private local records (default: config/ship; existing config/upok reused)
+ --state-dir PATH Private local records (default: ~/.ship; existing legacy state reused)
--railway-bin PATH Official Railway CLI binary; no global installation is performed
--neon-bin PATH Official Neon CLI
--neon-config PATH Existing private Neon authentication directory
+ --vercel-bin PATH Official Vercel CLI
+ --vercel-config PATH Existing private Vercel authentication directory
Commands:
- register --name NAME --source DIR --url HTTPS_ORIGIN
+ register --name NAME --source DIR --url HTTPS_ORIGIN [--provider railway|vercel]
--workspace ID --railway-project ID --service ID --environment ID
--neon-org ID --neon-project ID --neon-endpoint ID
[--allow-publish] [--allow-trial]
+ Vercel: use --vercel-team ID --vercel-project ID instead of Railway IDs;
+ --allow-hobby accepts personal noncommercial use of the Hobby plan
list
status NAME Live read-only ownership, account plan and resource checks
check NAME GET /healthz and /readyz; no writes to business data
@@ -33,13 +37,19 @@ Commands:
publish NAME [--detach] Upload a captured source directory to the bound service
reconcile NAME [--wait] Find the existing operation by its deployment marker
history NAME
+ secret save NAME KEY --stdin Save plaintext in an owner-only local file; no cloud changes
+ secret list NAME List saved secret metadata, never values
+ secret check NAME Check local secret-file access; does not verify cloud values
+ secret apply NAME KEY Apply a locally saved Secret to bound Vercel production
+ secret reconcile NAME KEY Reconcile an uncertain Secret write; never resend
authorize NAME [--allow-publish=true|false] [--allow-trial=true|false]
serve [--port 0] [--open] Loopback-only local webpage with session authentication
Official CLI login remains a user-owned prerequisite. This alpha does not create,
delete or adopt whole cloud projects, change billing, or migrate databases.
-All non-server command outputs are JSON. State files contain resource references,
-not cloud credentials. Use one explicit project authorization for regular updates.
+All non-server command outputs are JSON. Business secret values are stored separately
+in private local files and never printed. Official CLI login credentials stay with
+the official tools. Use one explicit project authorization for regular updates.
`
func resolveTool(explicit, envName, legacyEnvName, name, relative string) string {
@@ -56,7 +66,7 @@ func resolveTool(explicit, envName, legacyEnvName, name, relative string) string
binary = real
}
for _, base := range []string{filepath.Dir(binary), filepath.Dir(filepath.Dir(binary))} {
- for _, directory := range []string{"tools", filepath.Join("validation", "cloud-tools")} {
+ for _, directory := range []string{"tools", filepath.Join("validation", "cloud-tools"), filepath.Join("validation", "vercel-tools")} {
p := filepath.Join(base, directory, "node_modules", relative)
if info, e := os.Stat(p); e == nil && !info.IsDir() {
return p
@@ -69,20 +79,21 @@ func resolveTool(explicit, envName, legacyEnvName, name, relative string) string
return ""
}
-func defaultStateDir(base string) string {
- for _, name := range []string{"ship", "upok"} {
- path := filepath.Join(base, name)
+func defaultStateDir(home, base string) string {
+ for _, path := range []string{filepath.Join(home, ".ship"), filepath.Join(base, "ship"), filepath.Join(base, "upok")} {
if _, err := os.Lstat(path); !os.IsNotExist(err) {
return path
}
}
- return filepath.Join(base, "ship")
+ return filepath.Join(home, ".ship")
}
type Settings struct {
- Railway string `json:"railway_bin"`
- Neon string `json:"neon_bin"`
- NeonConfig string `json:"neon_config"`
+ Railway string `json:"railway_bin"`
+ Neon string `json:"neon_bin"`
+ NeonConfig string `json:"neon_config"`
+ Vercel string `json:"vercel_bin,omitempty"`
+ VercelConfig string `json:"vercel_config,omitempty"`
}
func output(v any) { enc := json.NewEncoder(os.Stdout); enc.SetIndent("", " "); enc.Encode(v) }
@@ -107,10 +118,12 @@ func run(ctx context.Context, args []string) error {
return err
}
flags := flag.NewFlagSet("ship", flag.ContinueOnError)
- stateDir := flags.String("state-dir", defaultStateDir(base), "private local state")
+ stateDir := flags.String("state-dir", defaultStateDir(home, base), "private local state")
rwy := flags.String("railway-bin", "", "official Railway CLI")
neon := flags.String("neon-bin", "", "official Neon CLI")
neonConfig := flags.String("neon-config", "", "Neon authentication directory")
+ vercel := flags.String("vercel-bin", "", "official Vercel CLI")
+ vercelConfig := flags.String("vercel-config", "", "Vercel authentication directory")
flags.Usage = func() { fmt.Print(help) }
if err = flags.Parse(args); err != nil {
if errors.Is(err, flag.ErrHelp) {
@@ -140,15 +153,38 @@ func run(ctx context.Context, args []string) error {
if *neonConfig != "" {
settings.NeonConfig = *neonConfig
}
+ if *vercel != "" {
+ settings.Vercel = *vercel
+ }
+ if *vercelConfig != "" {
+ settings.VercelConfig = *vercelConfig
+ }
if settings.NeonConfig == "" {
settings.NeonConfig = filepath.Join(home, ".config", "neon")
}
- providers := &Providers{Railway: resolveTool(settings.Railway, "SHIP_RAILWAY_BIN", "UPOK_RAILWAY_BIN", "railway", "@railway/cli/bin/railway"), Neon: resolveTool(settings.Neon, "SHIP_NEON_BIN", "UPOK_NEON_BIN", "neon", ".bin/neon"), NeonConfig: settings.NeonConfig}
+ providers := &Providers{Railway: resolveTool(settings.Railway, "SHIP_RAILWAY_BIN", "UPOK_RAILWAY_BIN", "railway", "@railway/cli/bin/railway"), Neon: resolveTool(settings.Neon, "SHIP_NEON_BIN", "UPOK_NEON_BIN", "neon", ".bin/neon"), NeonConfig: settings.NeonConfig, Vercel: resolveTool(settings.Vercel, "SHIP_VERCEL_BIN", "UPOK_VERCEL_BIN", "vercel", ".bin/vercel"), VercelConfig: settings.VercelConfig, Store: store}
engine := &Engine{Store: store, Providers: providers}
switch args[0] {
+ case "secret":
+ if len(args) == 4 && (args[1] == "apply" || args[1] == "reconcile") {
+ p, err := store.project(args[2])
+ if err != nil {
+ return errors.New("registered project not found")
+ }
+ info, err := engine.syncVercelSecret(ctx, p, args[3], args[1] == "apply")
+ if err == nil {
+ output(info)
+ }
+ return err
+ }
+ return secretCommand(store, args[1:], os.Stdin)
case "register":
f := flag.NewFlagSet("register", flag.ContinueOnError)
var p Project
+ f.StringVar(&p.Provider, "provider", "railway", "compute provider")
+ f.StringVar(&p.VercelTeam, "vercel-team", "", "Vercel team ID")
+ f.StringVar(&p.VercelProject, "vercel-project", "", "Vercel project ID")
+ f.BoolVar(&p.AllowHobby, "allow-hobby", false, "accept personal noncommercial Hobby conditions")
f.StringVar(&p.Name, "name", "", "local project name")
f.StringVar(&p.Source, "source", "", "source directory")
f.StringVar(&p.URL, "url", "", "application HTTPS origin")
@@ -179,7 +215,7 @@ func run(ctx context.Context, args []string) error {
if err = store.register(p); err != nil {
return err
}
- if err = atomicJSON(filepath.Join(store.Root, "settings.json"), Settings{providers.Railway, providers.Neon, providers.NeonConfig}); err != nil {
+ if err = atomicJSON(filepath.Join(store.Root, "settings.json"), Settings{Railway: providers.Railway, Neon: providers.Neon, NeonConfig: providers.NeonConfig, Vercel: providers.Vercel, VercelConfig: providers.VercelConfig}); err != nil {
return err
}
output(p)
@@ -215,6 +251,7 @@ func run(ctx context.Context, args []string) error {
f := flag.NewFlagSet("authorize", flag.ContinueOnError)
f.BoolVar(&p.AllowPublish, "allow-publish", p.AllowPublish, "authorization for future source updates to this exact service")
f.BoolVar(&p.AllowTrial, "allow-trial", p.AllowTrial, "accept Trial conditions for this binding")
+ f.BoolVar(&p.AllowHobby, "allow-hobby", p.AllowHobby, "accept personal noncommercial Hobby conditions")
if err = f.Parse(args[2:]); err != nil {
return err
}
@@ -257,7 +294,7 @@ func run(ctx context.Context, args []string) error {
if len(args) != 2 {
return errors.New("unexpected logs arguments")
}
- logs, err := providers.logs(ctx, p)
+ logs, err := engine.logs(ctx, p)
if err != nil {
return err
}
diff --git a/cmd/ship/main_test.go b/cmd/ship/main_test.go
index 932af22..0338180 100644
--- a/cmd/ship/main_test.go
+++ b/cmd/ship/main_test.go
@@ -360,8 +360,9 @@ func TestLegacyMarkerSurvivesRename(t *testing.T) {
func TestRenameReusesExistingState(t *testing.T) {
base := t.TempDir()
- shipDir := filepath.Join(base, "ship")
- if defaultStateDir(base) != shipDir {
+ home := filepath.Join(base, "home")
+ shipDir := filepath.Join(home, ".ship")
+ if defaultStateDir(home, base) != shipDir {
t.Fatal("fresh installation did not select Ship state")
}
legacy, err := newStore(filepath.Join(base, "upok"))
@@ -372,7 +373,7 @@ func TestRenameReusesExistingState(t *testing.T) {
if err = legacy.register(p); err != nil {
t.Fatal(err)
}
- reopened, err := newStore(defaultStateDir(base))
+ reopened, err := newStore(defaultStateDir(home, base))
if err != nil {
t.Fatal(err)
}
@@ -386,7 +387,7 @@ func TestRenameReusesExistingState(t *testing.T) {
if _, err = newStore(shipDir); err != nil {
t.Fatal(err)
}
- if defaultStateDir(base) != shipDir {
+ if defaultStateDir(home, base) != shipDir {
t.Fatal("existing Ship state was replaced with legacy state")
}
}
diff --git a/cmd/ship/provider.go b/cmd/ship/provider.go
index 14dd790..f83a159 100644
--- a/cmd/ship/provider.go
+++ b/cmd/ship/provider.go
@@ -17,17 +17,49 @@ import (
)
type Providers struct {
- Railway string
- Neon string
- NeonConfig string
+ Railway string
+ Neon string
+ NeonConfig string
+ Vercel string
+ VercelConfig string
+ Store *Store
// The command seam lets tests verify cloud arguments and unknown outcomes without real mutations.
- Run func(context.Context, string, []string) ([]byte, error)
+ Run func(context.Context, string, []string) ([]byte, error)
+ RunInput func(context.Context, string, []string, []byte) ([]byte, error)
}
type limitedBuffer struct {
bytes.Buffer
exceeded bool
}
+type providerCommandError struct {
+ Tool, Code string
+ Rejected bool
+}
+
+func (e *providerCommandError) Error() string {
+ if e.Rejected {
+ return fmt.Sprintf("%s request was rejected (%s); no automatic retry", e.Tool, e.Code)
+ }
+ return fmt.Sprintf("%s request failed (%s); cloud outcome is not confirmed, no automatic retry", e.Tool, e.Code)
+}
+
+func safeProviderError(tool string, data, stderr []byte) error {
+ if tool == "vercel" && strings.Contains(string(stderr), "Error: You cannot change the key of a Sensitive Environment Variable. (400)") {
+ return &providerCommandError{Tool: tool, Code: "sensitive_key_immutable", Rejected: true}
+ }
+ var response struct {
+ Error struct {
+ Code string `json:"code"`
+ } `json:"error"`
+ }
+ code := "cli_error_or_timeout"
+ if json.Unmarshal(data, &response) == nil && regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`).MatchString(response.Error.Code) {
+ code = response.Error.Code
+ }
+ return &providerCommandError{Tool: tool, Code: code}
+}
+
func (b *limitedBuffer) Write(p []byte) (int, error) {
n := len(p)
room := (2 << 20) - b.Len()
@@ -43,41 +75,53 @@ func cleanEnv() []string {
for _, v := range os.Environ() {
k, _, _ := strings.Cut(v, "=")
switch k {
- case "RAILWAY_TOKEN", "RAILWAY_API_TOKEN", "NEON_API_KEY", "NEON_PROFILE":
+ case "RAILWAY_TOKEN", "RAILWAY_API_TOKEN", "NEON_API_KEY", "NEON_PROFILE", "VERCEL_TOKEN", "VERCEL_ORG_ID", "VERCEL_PROJECT_ID", "VERCEL_TELEMETRY_DISABLED", "NO_UPDATE_NOTIFIER":
continue
}
result = append(result, v)
}
- return result
+ return append(result, "VERCEL_TELEMETRY_DISABLED=1", "NO_UPDATE_NOTIFIER=1")
}
func (v *Providers) call(ctx context.Context, tool string, args ...string) ([]byte, error) {
+ return v.callInput(ctx, tool, nil, args...)
+}
+func (v *Providers) callInput(ctx context.Context, tool string, input []byte, args ...string) ([]byte, error) {
if tool == "neon" {
args = append(args, "--config-dir", v.NeonConfig, "--no-analytics", "--output", "json")
}
- if v.Run != nil {
+ if v.RunInput != nil {
+ return v.RunInput(ctx, tool, args, input)
+ }
+ if v.Run != nil && input == nil {
return v.Run(ctx, tool, args)
}
bin := v.Railway
if tool == "neon" {
bin = v.Neon
}
+ if tool == "vercel" {
+ bin = v.Vercel
+ }
if bin == "" {
return nil, fmt.Errorf("%s CLI is not configured", tool)
}
timeout := 40 * time.Second
- if tool == "railway" && len(args) > 0 && args[0] == "up" {
+ if len(args) > 0 && ((tool == "railway" && args[0] == "up") || (tool == "vercel" && args[0] == "deploy")) {
timeout = 120 * time.Second
}
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
cmd := exec.CommandContext(ctx, bin, args...)
cmd.Env = cleanEnv()
+ if input != nil {
+ cmd.Stdin = bytes.NewReader(input)
+ }
cmd.WaitDelay = 2 * time.Second
var stdout, stderr limitedBuffer
cmd.Stdout = &stdout
cmd.Stderr = &stderr
if err := cmd.Run(); err != nil {
- return nil, fmt.Errorf("%s request failed or timed out; no automatic retry", tool)
+ return nil, safeProviderError(tool, stdout.Bytes(), stderr.Bytes())
}
if stdout.exceeded {
return nil, errors.New("provider output exceeded the size limit")
@@ -119,14 +163,18 @@ func (v *Providers) graph(ctx context.Context, q string, vars any, out any) erro
}
type Deployment struct {
- ID string `json:"id"`
- Status string `json:"status"`
- Meta struct {
+ ID string `json:"id"`
+ Status string `json:"status"`
+ AliasAssigned bool `json:"alias_assigned,omitempty"`
+ Meta struct {
Message string `json:"cliMessage"`
} `json:"meta"`
}
func (v *Providers) deployments(ctx context.Context, p Project) ([]Deployment, error) {
+ if p.Provider == "vercel" {
+ return v.vercelDeployments(ctx, p)
+ }
var d []Deployment
args := append([]string{"deployment", "list"}, selectors(p)...)
args = append(args, "--limit", "100", "--json")
@@ -134,6 +182,9 @@ func (v *Providers) deployments(ctx context.Context, p Project) ([]Deployment, e
return d, err
}
func (v *Providers) variables(ctx context.Context, p Project) (map[string]string, error) {
+ if p.Provider == "vercel" {
+ return v.vercelVariables(ctx, p)
+ }
var raw map[string]*string
args := append([]string{"variable", "list"}, selectors(p)...)
args = append(args, "--json")
@@ -155,7 +206,10 @@ type preflight struct {
}
func (v *Providers) inspect(ctx context.Context, p Project) (preflight, error) {
- result := preflight{Observation: Observation{At: time.Now().UTC(), RailwayPlan: "Unknown", NeonPlan: "Unknown"}}
+ if p.Provider == "vercel" {
+ return v.inspectVercel(ctx, p)
+ }
+ result := preflight{Observation: Observation{At: time.Now().UTC(), Provider: "railway", RailwayPlan: "Unknown", NeonPlan: "Unknown"}}
var account struct {
Project struct {
ID string `json:"id"`
@@ -210,6 +264,7 @@ func (v *Providers) inspect(ctx context.Context, p Project) (preflight, error) {
} else {
result.Observation.RailwayPlan = "Paid or unverified"
}
+ result.Observation.ComputePlan = result.Observation.RailwayPlan
var live struct {
ID string `json:"id"`
Status string `json:"status"`
@@ -225,44 +280,12 @@ func (v *Providers) inspect(ctx context.Context, p Project) (preflight, error) {
}
result.Observation.ServiceState = live.Status
result.Observation.DeploymentID = live.DeploymentID
- var project struct {
- Project struct {
- ID string `json:"id"`
- OrgID string `json:"org_id"`
- } `json:"project"`
- }
- if err := v.decode(ctx, "neon", &project, "api", "/projects/"+p.NeonProject, "--method", "GET"); err != nil {
- return result, err
- }
- if project.Project.ID != p.NeonProject || project.Project.OrgID != p.NeonOrg {
- return result, errors.New("Neon project ownership mismatch")
- }
- var orgs []struct {
- ID string `json:"id"`
- Plan string `json:"plan"`
- }
- if err := v.decode(ctx, "neon", &orgs, "orgs", "list"); err != nil {
- return result, err
- }
- for _, o := range orgs {
- if o.ID == p.NeonOrg {
- result.Observation.NeonPlan = o.Plan
- }
- }
- var endpoint struct {
- Endpoint struct {
- ID string `json:"id"`
- Host string `json:"host"`
- State string `json:"current_state"`
- } `json:"endpoint"`
- }
- if err := v.decode(ctx, "neon", &endpoint, "api", "/projects/"+p.NeonProject+"/endpoints/"+p.NeonEndpoint, "--method", "GET"); err != nil {
+ neon, host, err := v.inspectNeon(ctx, p)
+ result.Observation.NeonPlan = neon.NeonPlan
+ result.Observation.DatabaseState = neon.DatabaseState
+ if err != nil {
return result, err
}
- if endpoint.Endpoint.ID != p.NeonEndpoint || endpoint.Endpoint.Host == "" {
- return result, errors.New("Neon endpoint identity mismatch")
- }
- result.Observation.DatabaseState = endpoint.Endpoint.State
vars, err := v.variables(ctx, p)
if err != nil {
return result, err
@@ -271,7 +294,6 @@ func (v *Providers) inspect(ctx context.Context, p Project) (preflight, error) {
if err != nil || (dsn.Scheme != "postgres" && dsn.Scheme != "postgresql") {
return result, errors.New("DATABASE_URL is missing or invalid; alpha supports the validated PostgreSQL contract")
}
- host := endpoint.Endpoint.Host
parts := strings.SplitN(host, ".", 2)
pooler := ""
if len(parts) == 2 {
@@ -280,6 +302,7 @@ func (v *Providers) inspect(ctx context.Context, p Project) (preflight, error) {
if dsn.Hostname() != host && dsn.Hostname() != pooler {
return result, errors.New("application DATABASE_URL does not match the registered Neon endpoint")
}
+ result.Observation.DatabaseBinding = "provider_value_matches_endpoint"
result.Secrets = secretValues(vars)
switch {
case *c.Subscribed || string(c.Payment) != "null":
@@ -329,6 +352,9 @@ func redact(s string, secrets []string) string {
return inlineSecret.ReplaceAllString(s, "[REDACTED]")
}
func (v *Providers) logs(ctx context.Context, p Project) ([]string, error) {
+ if p.Provider == "vercel" {
+ return v.vercelLogs(ctx, p)
+ }
vars, err := v.variables(ctx, p)
if err != nil {
return nil, errors.New("cannot obtain redaction context; logs withheld")
@@ -382,3 +408,46 @@ func checkApplication(ctx context.Context, base string) []Check {
}
return results
}
+
+func (v *Providers) inspectNeon(ctx context.Context, p Project) (Observation, string, error) {
+ observation := Observation{NeonPlan: "Unknown"}
+ var project struct {
+ Project struct {
+ ID string `json:"id"`
+ OrgID string `json:"org_id"`
+ } `json:"project"`
+ }
+ if err := v.decode(ctx, "neon", &project, "api", "/projects/"+p.NeonProject, "--method", "GET"); err != nil {
+ return observation, "", err
+ }
+ if project.Project.ID != p.NeonProject || project.Project.OrgID != p.NeonOrg {
+ return observation, "", errors.New("Neon project ownership mismatch")
+ }
+ var orgs []struct {
+ ID string `json:"id"`
+ Plan string `json:"plan"`
+ }
+ if err := v.decode(ctx, "neon", &orgs, "orgs", "list"); err != nil {
+ return observation, "", err
+ }
+ for _, o := range orgs {
+ if o.ID == p.NeonOrg {
+ observation.NeonPlan = o.Plan
+ }
+ }
+ var endpoint struct {
+ Endpoint struct {
+ ID string `json:"id"`
+ Host string `json:"host"`
+ State string `json:"current_state"`
+ } `json:"endpoint"`
+ }
+ if err := v.decode(ctx, "neon", &endpoint, "api", "/projects/"+p.NeonProject+"/endpoints/"+p.NeonEndpoint, "--method", "GET"); err != nil {
+ return observation, "", err
+ }
+ if endpoint.Endpoint.ID != p.NeonEndpoint || endpoint.Endpoint.Host == "" {
+ return observation, "", errors.New("Neon endpoint identity mismatch")
+ }
+ observation.DatabaseState = endpoint.Endpoint.State
+ return observation, endpoint.Endpoint.Host, nil
+}
diff --git a/cmd/ship/secrets.go b/cmd/ship/secrets.go
new file mode 100644
index 0000000..9316a66
--- /dev/null
+++ b/cmd/ship/secrets.go
@@ -0,0 +1,214 @@
+package main
+
+import (
+ "crypto/rand"
+ "encoding/hex"
+ "errors"
+ "io"
+ "os"
+ "path/filepath"
+ "regexp"
+ "sort"
+ "time"
+ "unicode/utf8"
+)
+
+const maxSecretSize = 16 << 10
+
+var secretKeyPattern = regexp.MustCompile(`^[A-Z_][A-Z0-9_]{0,127}$`)
+var secretRefPattern = regexp.MustCompile(`^key-[a-f0-9]{32}$`)
+
+type SecretVersion struct {
+ Ref string `json:"ref"`
+ Value string `json:"value,omitempty"`
+ SavedAt time.Time `json:"saved_at"`
+ SyncState string `json:"sync_state,omitempty"`
+ RemoteID string `json:"remote_id,omitempty"`
+ RemoteUpdatedAt int64 `json:"remote_updated_at,omitempty"`
+ Marker string `json:"marker,omitempty"`
+ WriteErrorCode string `json:"write_error_code,omitempty"`
+ ResolvedAt *time.Time `json:"resolved_at,omitempty"`
+ Resolution string `json:"resolution,omitempty"`
+ ResolutionEvidence string `json:"resolution_evidence,omitempty"`
+}
+
+type SecretInfo struct {
+ Key string `json:"key"`
+ Versions int `json:"saved_versions"`
+ SavedAt time.Time `json:"saved_at"`
+ Status string `json:"status"`
+}
+
+func (s *Store) secretRecords(name string) (map[string][]SecretVersion, error) {
+ if !slugPattern.MatchString(name) {
+ return nil, errors.New("invalid project name")
+ }
+ refs := map[string][]SecretVersion{}
+ path := filepath.Join(s.Root, "secrets", name+".json")
+ info, err := os.Lstat(path)
+ if os.IsNotExist(err) {
+ return refs, nil
+ }
+ if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 {
+ return nil, errors.New("secret file must be a regular private file accessible only to its owner")
+ }
+ err = readJSON(path, &refs)
+ if err != nil || refs == nil {
+ return nil, errors.New("local secret records could not be read")
+ }
+ for key, versions := range refs {
+ if !secretKeyPattern.MatchString(key) || len(versions) == 0 {
+ return nil, errors.New("invalid local secret reference")
+ }
+ for _, version := range versions {
+ if !secretRefPattern.MatchString(version.Ref) || version.SavedAt.IsZero() || len(version.Value) > maxSecretSize {
+ return nil, errors.New("invalid local secret reference")
+ }
+ }
+ }
+ return refs, nil
+}
+
+func (s *Store) saveSecret(name, key string, value []byte) (SecretInfo, error) {
+ var info SecretInfo
+ if !secretKeyPattern.MatchString(key) || len(value) == 0 || len(value) > maxSecretSize || !utf8.Valid(value) {
+ return info, errors.New("secret requires an uppercase variable name and 1–16384 bytes of UTF-8 text")
+ }
+ if _, err := s.project(name); err != nil {
+ return info, errors.New("registered project not found")
+ }
+ unlock, err := s.lock(name)
+ if err != nil {
+ return info, err
+ }
+ defer unlock()
+ refs, err := s.secretRecords(name)
+ if err != nil {
+ return info, err
+ }
+ var id [16]byte
+ if _, err = rand.Read(id[:]); err != nil {
+ return info, err
+ }
+ version := SecretVersion{Ref: "key-" + hex.EncodeToString(id[:]), Value: string(value), SavedAt: time.Now().UTC()}
+ // Retain old versions to redact historical logs after a rotation.
+ refs[key] = append(refs[key], version)
+ if err = atomicJSON(filepath.Join(s.Root, "secrets", name+".json"), refs); err != nil {
+ return info, errors.New("saving the local private secret file failed; no cloud changes were made")
+ }
+ return SecretInfo{key, len(refs[key]), version.SavedAt, "local_only_cloud_unverified"}, nil
+}
+
+func (s *Store) secretInfo(name string) ([]SecretInfo, error) {
+ refs, err := s.secretRecords(name)
+ if err != nil {
+ return nil, err
+ }
+ result := []SecretInfo{}
+ for key, versions := range refs {
+ result = append(result, secretInfoFor(key, versions))
+ }
+ sort.Slice(result, func(i, j int) bool { return result[i].Key < result[j].Key })
+ return result, nil
+}
+
+func secretInfoFor(key string, versions []SecretVersion) SecretInfo {
+ last := versions[len(versions)-1]
+ status := "local_only_cloud_unverified"
+ if last.SyncState == "synced" {
+ status = "last_write_confirmed"
+ }
+ if last.SyncState == "applying" || last.SyncState == "unknown" {
+ status = "write_outcome_unknown"
+ }
+ if last.SyncState == "diagnosed_not_applied" {
+ status = "write_diagnosed_not_applied"
+ }
+ if last.SyncState == "rejected" {
+ status = "write_rejected"
+ }
+ return SecretInfo{key, len(versions), last.SavedAt, status}
+}
+
+func (s *Store) secretValue(name, ref string) ([]byte, error) {
+ if !secretRefPattern.MatchString(ref) {
+ return nil, errors.New("invalid local secret reference")
+ }
+ records, err := s.secretRecords(name)
+ if err != nil {
+ return nil, err
+ }
+ for _, versions := range records {
+ for _, version := range versions {
+ if version.Ref == ref {
+ if version.Value == "" {
+ return nil, errors.New("legacy Secret has no local value; migrate the saved value without rewriting cloud configuration")
+ }
+ return []byte(version.Value), nil
+ }
+ }
+ }
+ return nil, errors.New("local secret value was not found")
+}
+
+// Read every saved version for redaction; a saved value alone is never proof of the current cloud configuration.
+func (s *Store) knownSecrets(name string) ([]string, error) {
+ refs, err := s.secretRecords(name)
+ if err != nil {
+ return nil, err
+ }
+ var values []string
+ for _, versions := range refs {
+ for _, version := range versions {
+ if version.Value == "" {
+ return nil, errors.New("legacy Secret has no local value; migrate it before reading logs or publishing")
+ }
+ // Include explicitly saved values even when their variable name has no secret-like suffix.
+ values = append(values, secretValues(map[string]string{"SECRET": version.Value})...)
+ }
+ }
+ return values, nil
+}
+
+func secretCommand(store *Store, args []string, input io.Reader) error {
+ if len(args) < 2 {
+ return errors.New("use secret save NAME KEY --stdin, secret list NAME, or secret check NAME")
+ }
+ action, name := args[0], args[1]
+ if _, err := store.project(name); err != nil {
+ return errors.New("registered project not found")
+ }
+ switch {
+ case action == "save" && len(args) == 4 && args[3] == "--stdin":
+ if file, ok := input.(*os.File); ok {
+ stat, err := file.Stat()
+ if err != nil || stat.Mode()&os.ModeCharDevice != 0 {
+ return errors.New("pipe the secret or redirect a private file to stdin; terminal input would echo the value")
+ }
+ }
+ value, err := io.ReadAll(io.LimitReader(input, maxSecretSize+1))
+ defer clear(value)
+ if err != nil {
+ return errors.New("secret input could not be read")
+ }
+ info, err := store.saveSecret(name, args[2], value)
+ if err == nil {
+ output(info)
+ }
+ return err
+ case action == "list" && len(args) == 2:
+ info, err := store.secretInfo(name)
+ if err == nil {
+ output(info)
+ }
+ return err
+ case action == "check" && len(args) == 2:
+ values, err := store.knownSecrets(name)
+ if err == nil {
+ output(map[string]any{"local_values_accessible": true, "redaction_value_count": len(values), "cloud_configuration_verified": false})
+ }
+ return err
+ default:
+ return errors.New("invalid secret command; values are accepted only on stdin and never printed")
+ }
+}
diff --git a/cmd/ship/secrets_test.go b/cmd/ship/secrets_test.go
new file mode 100644
index 0000000..7d506fc
--- /dev/null
+++ b/cmd/ship/secrets_test.go
@@ -0,0 +1,198 @@
+package main
+
+import (
+ "bytes"
+ "context"
+ "os"
+ "os/exec"
+ "path/filepath"
+ "strings"
+ "testing"
+)
+
+func TestSavedSecretsProtectLogsAndSourceUploads(t *testing.T) {
+ e, p := fixture(t)
+ if err := e.Store.register(p); err != nil {
+ t.Fatal(err)
+ }
+ if _, err := e.Store.saveSecret(p.Name, "CREDENTIAL", []byte("saved-secret-from-an-old-version")); err != nil {
+ t.Fatal(err)
+ }
+ uploads := 0
+ e.Providers.Run = func(_ context.Context, tool string, args []string) ([]byte, error) {
+ if tool == "railway" && args[0] == "up" {
+ uploads++
+ }
+ if tool == "railway" && args[0] == "logs" {
+ return []byte("saved-secret-from-an-old-version"), nil
+ }
+ return healthyProvider(tool, args)
+ }
+ logs, err := e.logs(context.Background(), p)
+ if err != nil || len(logs) != 1 || logs[0] != "[REDACTED]" {
+ t.Fatal("locally saved secret was exposed in logs")
+ }
+ if err = os.WriteFile(filepath.Join(p.Source, "app.txt"), []byte("saved-secret-from-an-old-version"), 0600); err != nil {
+ t.Fatal(err)
+ }
+ op, unlock, err := e.begin(p)
+ if err != nil {
+ t.Fatal(err)
+ }
+ defer unlock()
+ if e.executePublish(context.Background(), p, op, false) == nil || uploads != 0 || op.State != "blocked" {
+ t.Fatal("source containing a locally saved secret was submitted")
+ }
+}
+
+func TestSecretStorageAndRotationKeepValuesOutOfOrdinaryRecords(t *testing.T) {
+ e, p := fixture(t)
+ if err := e.Store.register(p); err != nil {
+ t.Fatal(err)
+ }
+ for _, value := range []string{"synthetic-old-secret", "synthetic-new-secret"} {
+ info, err := e.Store.saveSecret(p.Name, "APP_CREDENTIAL", []byte(value))
+ if err != nil || info.Status != "local_only_cloud_unverified" {
+ t.Fatalf("local save failed: %v", err)
+ }
+ }
+ reopened, err := newStore(e.Store.Root)
+ if err != nil {
+ t.Fatal(err)
+ }
+ values, err := reopened.knownSecrets(p.Name)
+ if err != nil || redact("synthetic-old-secret synthetic-new-secret", values) != "[REDACTED] [REDACTED]" {
+ t.Fatal("saved versions did not protect historical logs")
+ }
+ info, err := reopened.secretInfo(p.Name)
+ if err != nil || len(info) != 1 || info[0].Versions != 2 || info[0].Status != "local_only_cloud_unverified" {
+ t.Fatal("local save was incorrectly treated as cloud verification")
+ }
+ secretPath := filepath.Join(e.Store.Root, "secrets", p.Name+".json")
+ err = filepath.Walk(e.Store.Root, func(path string, item os.FileInfo, err error) error {
+ if err != nil || item.IsDir() {
+ return err
+ }
+ data, err := os.ReadFile(path)
+ contains := bytes.Contains(data, []byte("synthetic-old-secret")) || bytes.Contains(data, []byte("synthetic-new-secret"))
+ if path == secretPath {
+ if !contains || item.Mode().Perm() != 0600 {
+ t.Fatal("private secret file is missing or has unsafe permissions")
+ }
+ } else if contains {
+ t.Fatal("plaintext secret entered an ordinary project record")
+ }
+ return err
+ })
+ if err != nil {
+ t.Fatal(err)
+ }
+ before, err := os.ReadFile(secretPath)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if err = os.Chmod(secretPath, 0644); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = e.Store.saveSecret(p.Name, "APP_CREDENTIAL", []byte("third-secret")); err == nil {
+ t.Fatal("insecure secret file was accepted")
+ }
+ if _, err = reopened.knownSecrets(p.Name); err == nil {
+ t.Fatal("insecure secret file was read")
+ }
+ after, err := os.ReadFile(secretPath)
+ if err != nil || !bytes.Equal(before, after) {
+ t.Fatal("failed write changed existing secrets")
+ }
+ if err = os.Chmod(secretPath, 0600); err != nil {
+ t.Fatal(err)
+ }
+
+ cmd := exec.Command(os.Args[0], "-test.run=^TestSecretFileChild$")
+ cmd.Env = append(os.Environ(), "SHIP_TEST_SECRET_DIR="+e.Store.Root)
+ output, err := cmd.CombinedOutput()
+ if err != nil {
+ t.Fatalf("separate-process read failed: %v", err)
+ }
+ if bytes.Contains(output, []byte("synthetic-old-secret")) || bytes.Contains(output, []byte("synthetic-new-secret")) {
+ t.Fatal("CLI printed secret values")
+ }
+}
+
+func TestSecretFileChild(t *testing.T) {
+ root := os.Getenv("SHIP_TEST_SECRET_DIR")
+ if root == "" {
+ t.Skip("child of private-file persistence check")
+ }
+ store, err := newStore(root)
+ if err != nil {
+ t.Fatal(err)
+ }
+ values, err := store.knownSecrets("demo")
+ if err != nil || redact("synthetic-new-secret", values) != "[REDACTED]" {
+ t.Fatal("persisted secret could not be read")
+ }
+ for _, action := range []string{"list", "check"} {
+ if err = secretCommand(store, []string{action, "demo"}, nil); err != nil {
+ t.Fatal(err)
+ }
+ }
+}
+
+func TestLegacyMissingValueAndSecretSymlinkAreRejected(t *testing.T) {
+ e, p := fixture(t)
+ if err := e.Store.register(p); err != nil {
+ t.Fatal(err)
+ }
+ if _, err := e.Store.saveSecret(p.Name, "TOKEN", []byte("synthetic-value")); err != nil {
+ t.Fatal(err)
+ }
+ records, err := e.Store.secretRecords(p.Name)
+ if err != nil {
+ t.Fatal(err)
+ }
+ records["TOKEN"][0].Value = ""
+ records["TOKEN"][0].SyncState = "unknown"
+ path := filepath.Join(e.Store.Root, "secrets", p.Name+".json")
+ if err = atomicJSON(path, records); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = e.Store.secretValue(p.Name, records["TOKEN"][0].Ref); err == nil {
+ t.Fatal("missing legacy value was treated as available")
+ }
+ info, err := e.Store.secretInfo(p.Name)
+ if err != nil || info[0].Status != "write_outcome_unknown" {
+ t.Fatal("storage transition erased an unresolved cloud write")
+ }
+ outside := filepath.Join(t.TempDir(), "external.json")
+ if err = os.Rename(path, outside); err != nil {
+ t.Fatal(err)
+ }
+ if err = os.Symlink(outside, path); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = e.Store.secretRecords(p.Name); err == nil {
+ t.Fatal("symlinked secret file was followed")
+ }
+}
+
+func TestSecretInputBoundary(t *testing.T) {
+ e, p := fixture(t)
+ if err := e.Store.register(p); err != nil {
+ t.Fatal(err)
+ }
+ for _, args := range [][]string{
+ {"save", p.Name, "APP_CREDENTIAL", "value-on-command-line"},
+ {"save", p.Name, "../bad", "--stdin"},
+ {"save", "missing", "APP_CREDENTIAL", "--stdin"},
+ } {
+ if secretCommand(e.Store, args, strings.NewReader("dummy-value")) == nil {
+ t.Fatal("invalid secret command accepted")
+ }
+ }
+ for _, value := range []string{"", string([]byte{0xff}), strings.Repeat("x", maxSecretSize+1)} {
+ if secretCommand(e.Store, []string{"save", p.Name, "APP_CREDENTIAL", "--stdin"}, strings.NewReader(value)) == nil {
+ t.Fatal("invalid secret size accepted")
+ }
+ }
+}
diff --git a/cmd/ship/server.go b/cmd/ship/server.go
index 5819fa1..9ec5248 100644
--- a/cmd/ship/server.go
+++ b/cmd/ship/server.go
@@ -154,7 +154,7 @@ func (a *localAPI) ServeHTTP(w http.ResponseWriter, r *http.Request) {
http.Error(w, "method rejected", 405)
return
}
- lines, err := a.engine.Providers.logs(ctx, p)
+ lines, err := a.engine.logs(ctx, p)
if err != nil {
jsonResponse(w, 502, map[string]string{"error": err.Error()})
return
diff --git a/cmd/ship/store.go b/cmd/ship/store.go
index bdc91c6..c57a8d6 100644
--- a/cmd/ship/store.go
+++ b/cmd/ship/store.go
@@ -19,6 +19,10 @@ var idPattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]{7,99}$`)
type Project struct {
Name string `json:"name"`
+ Provider string `json:"provider,omitempty"`
+ VercelTeam string `json:"vercel_team,omitempty"`
+ VercelProject string `json:"vercel_project,omitempty"`
+ AllowHobby bool `json:"allow_personal_noncommercial_hobby,omitempty"`
Source string `json:"source"`
URL string `json:"url"`
Workspace string `json:"railway_workspace"`
@@ -44,14 +48,17 @@ type ApplicationChecks struct {
Results []Check `json:"results"`
}
type Observation struct {
- At time.Time `json:"at"`
- RailwayPlan string `json:"railway_plan"`
- NeonPlan string `json:"neon_plan"`
- ServiceState string `json:"service_state"`
- DeploymentID string `json:"deployment_id"`
- DatabaseState string `json:"database_state"`
- Eligible bool `json:"eligible"`
- Reason string `json:"reason,omitempty"`
+ At time.Time `json:"at"`
+ Provider string `json:"provider,omitempty"`
+ ComputePlan string `json:"compute_plan,omitempty"`
+ DatabaseBinding string `json:"database_binding,omitempty"`
+ RailwayPlan string `json:"railway_plan"`
+ NeonPlan string `json:"neon_plan"`
+ ServiceState string `json:"service_state"`
+ DeploymentID string `json:"deployment_id"`
+ DatabaseState string `json:"database_state"`
+ Eligible bool `json:"eligible"`
+ Reason string `json:"reason,omitempty"`
}
type Operation struct {
ID string `json:"id"`
@@ -80,7 +87,7 @@ func newStore(root string) (*Store, error) {
if err != nil {
return nil, err
}
- for _, sub := range []string{"", "projects", "operations", "observations", "checks", "locks"} {
+ for _, sub := range []string{"", "projects", "operations", "observations", "checks", "locks", "secrets"} {
p := filepath.Join(root, sub)
if err = os.MkdirAll(p, 0700); err != nil {
return nil, err
diff --git a/cmd/ship/vercel.go b/cmd/ship/vercel.go
new file mode 100644
index 0000000..480939e
--- /dev/null
+++ b/cmd/ship/vercel.go
@@ -0,0 +1,323 @@
+package main
+
+import (
+ "bytes"
+ "context"
+ "encoding/json"
+ "errors"
+ "net/url"
+ "os"
+ "path/filepath"
+ "strings"
+ "time"
+)
+
+type vercelDeployment struct {
+ ID string `json:"id"`
+ UID string `json:"uid"`
+ State string `json:"readyState"`
+ Target string `json:"target"`
+ Alias []string `json:"alias"`
+ AliasAssigned json.RawMessage `json:"aliasAssigned"`
+ Meta map[string]string `json:"meta"`
+}
+
+type vercelProject struct {
+ ID string `json:"id"`
+ AccountID string `json:"accountId"`
+ Targets map[string]vercelDeployment `json:"targets"`
+}
+
+type vercelEnv struct {
+ ID string `json:"id"`
+ Key string `json:"key"`
+ Value string `json:"value"`
+ Type string `json:"type"`
+ Visibility string `json:"visibility"`
+ Target []string `json:"target"`
+ UpdatedAt int64 `json:"updatedAt"`
+ Comment string `json:"comment"`
+ GitBranch string `json:"gitBranch"`
+ ConfigurationID string `json:"configurationId"`
+ CustomEnvironmentIDs []string `json:"customEnvironmentIds"`
+}
+
+func (item vercelEnv) production() bool {
+ for _, target := range item.Target {
+ if target == "production" {
+ return true
+ }
+ }
+ return false
+}
+
+func (v *Providers) vercelCall(ctx context.Context, p Project, input []byte, args ...string) ([]byte, error) {
+ if v.VercelConfig == "" {
+ return nil, errors.New("supply --vercel-config for the official CLI authentication directory")
+ }
+ args = append(args, "--scope", p.VercelTeam, "--global-config", v.VercelConfig, "--non-interactive")
+ return v.callInput(ctx, "vercel", input, args...)
+}
+
+func (v *Providers) vercelAPI(ctx context.Context, p Project, path, method string, input []byte, out any) error {
+ args := []string{"api", path, "--method", method, "--raw"}
+ if input != nil {
+ args = append(args, "--input", "-")
+ }
+ data, err := v.vercelCall(ctx, p, input, args...)
+ if err != nil {
+ return err
+ }
+ if out != nil && json.Unmarshal(data, out) != nil {
+ return errors.New("Vercel returned invalid JSON")
+ }
+ return nil
+}
+
+func (v *Providers) vercelAccount(ctx context.Context, p Project) (vercelProject, string, error) {
+ var project vercelProject
+ var team struct {
+ ID string `json:"id"`
+ Billing struct {
+ Plan string `json:"plan"`
+ } `json:"billing"`
+ Membership struct {
+ Role string `json:"role"`
+ } `json:"membership"`
+ }
+ if err := v.vercelAPI(ctx, p, "/v2/teams/"+p.VercelTeam, "GET", nil, &team); err != nil {
+ return project, "", err
+ }
+ if team.ID != p.VercelTeam || team.Membership.Role != "OWNER" {
+ return project, "", errors.New("Vercel team ownership could not be verified")
+ }
+ if err := v.vercelAPI(ctx, p, "/v9/projects/"+p.VercelProject, "GET", nil, &project); err != nil {
+ return project, team.Billing.Plan, err
+ }
+ if project.ID != p.VercelProject || project.AccountID != p.VercelTeam {
+ return project, team.Billing.Plan, errors.New("Vercel project ownership mismatch")
+ }
+ return project, team.Billing.Plan, nil
+}
+
+func (v *Providers) vercelEnvs(ctx context.Context, p Project) ([]vercelEnv, error) {
+ var response struct {
+ Envs []vercelEnv `json:"envs"`
+ }
+ if err := v.vercelAPI(ctx, p, "/v10/projects/"+p.VercelProject+"/env", "GET", nil, &response); err != nil {
+ return nil, err
+ }
+ if response.Envs == nil {
+ return nil, errors.New("Vercel environment metadata is unavailable")
+ }
+ return response.Envs, nil
+}
+
+func (v *Providers) vercelVariables(ctx context.Context, p Project) (map[string]string, error) {
+ if v.Store == nil {
+ return nil, errors.New("local secret store is unavailable")
+ }
+ envs, err := v.vercelEnvs(ctx, p)
+ if err != nil {
+ return nil, err
+ }
+ refs, err := v.Store.secretRecords(p.Name)
+ if err != nil {
+ return nil, err
+ }
+ for _, versions := range refs {
+ for _, version := range versions {
+ if version.SyncState == "unknown" || version.SyncState == "applying" {
+ return nil, errors.New("a Secret write is unresolved; reconcile it before publishing or reading logs")
+ }
+ }
+ }
+ values := map[string]string{}
+ for _, item := range envs {
+ if !item.production() {
+ continue
+ }
+ if _, exists := values[item.Key]; exists {
+ return nil, errors.New("ambiguous production environment variables")
+ }
+ if item.Type == "sensitive" || item.Visibility == "secret" {
+ // Presence is observable even when the provider keeps the value write-only.
+ // Source deployment retains that configuration; a local cache is optional.
+ values[item.Key] = ""
+ versions := refs[item.Key]
+ if len(versions) == 0 {
+ continue
+ }
+ last := versions[len(versions)-1]
+ if last.SyncState != "synced" || last.RemoteID != item.ID || last.RemoteUpdatedAt != item.UpdatedAt || last.Marker != item.Comment || item.UpdatedAt <= 0 {
+ continue
+ }
+ value, err := v.Store.secretValue(p.Name, last.Ref)
+ if err != nil {
+ return nil, err
+ }
+ values[item.Key] = string(value)
+ clear(value)
+ } else {
+ if item.Key == "DATABASE_URL" {
+ return nil, errors.New("Vercel DATABASE_URL must remain a Secret")
+ }
+ values[item.Key] = item.Value
+ }
+ }
+ return values, nil
+}
+
+func databaseEndpointMatches(raw, host string) bool {
+ dsn, err := url.Parse(raw)
+ if err != nil || (dsn.Scheme != "postgres" && dsn.Scheme != "postgresql") || host == "" {
+ return false
+ }
+ parts := strings.SplitN(host, ".", 2)
+ pooler := ""
+ if len(parts) == 2 {
+ pooler = parts[0] + "-pooler." + parts[1]
+ }
+ return dsn.Hostname() == host || dsn.Hostname() == pooler
+}
+
+func (v *Providers) inspectVercel(ctx context.Context, p Project) (preflight, error) {
+ result := preflight{Observation: Observation{At: time.Now().UTC(), Provider: "vercel", ComputePlan: "Unknown", NeonPlan: "Unknown", DatabaseBinding: "unverified"}}
+ project, plan, err := v.vercelAccount(ctx, p)
+ if err != nil {
+ return result, err
+ }
+ result.Observation.ComputePlan = plan
+ production := project.Targets["production"]
+ result.Observation.ServiceState = production.State
+ result.Observation.DeploymentID = production.ID
+ address, _ := url.Parse(p.URL)
+ belongs := false
+ for _, alias := range production.Alias {
+ belongs = belongs || alias == address.Host
+ }
+ if !belongs {
+ return result, errors.New("application URL is not an alias of the bound Vercel production project")
+ }
+ neon, host, err := v.inspectNeon(ctx, p)
+ if err != nil {
+ return result, err
+ }
+ result.Observation.NeonPlan = neon.NeonPlan
+ result.Observation.DatabaseState = neon.DatabaseState
+ if plan != "hobby" {
+ result.Observation.Reason = "此 Vercel 路径只支持已核对的 Hobby，停止付费或未知计划的发布"
+ return result, nil
+ }
+ if !p.AllowHobby {
+ result.Observation.Reason = "需要明确接受 Hobby 个人非商业用途条件"
+ return result, nil
+ }
+ if neon.NeonPlan != "free" {
+ result.Observation.Reason = "数据库组织不是已验证的 Free 计划"
+ return result, nil
+ }
+ vars, err := v.vercelVariables(ctx, p)
+ if err != nil {
+ result.Observation.Reason = err.Error()
+ return result, nil
+ }
+ databaseURL, configured := vars["DATABASE_URL"]
+ if !configured {
+ result.Observation.Reason = "Vercel production 未配置 DATABASE_URL"
+ return result, nil
+ }
+ if databaseURL != "" && !databaseEndpointMatches(databaseURL, host) {
+ result.Observation.Reason = "本地保存的 DATABASE_URL 与登记的 Neon 连接端点不匹配"
+ return result, nil
+ }
+ result.Observation.DatabaseBinding = "provider_secret_retained_not_readable"
+ if databaseURL != "" {
+ result.Observation.DatabaseBinding = "last_write_and_metadata_match_not_runtime_identity"
+ }
+ result.Secrets = secretValues(vars)
+ result.Observation.Eligible = true
+ return result, nil
+}
+
+func aliasAssigned(value json.RawMessage) bool {
+ if bytes.Equal(value, []byte("true")) {
+ return true
+ }
+ var timestamp int64
+ return json.Unmarshal(value, ×tamp) == nil && timestamp > 0
+}
+
+func (v *Providers) vercelDeployments(ctx context.Context, p Project) ([]Deployment, error) {
+ var response struct {
+ Deployments []vercelDeployment `json:"deployments"`
+ }
+ if err := v.vercelAPI(ctx, p, "/v7/deployments?projectId="+url.QueryEscape(p.VercelProject)+"&limit=100&target=production", "GET", nil, &response); err != nil {
+ return nil, err
+ }
+ result := []Deployment{}
+ for _, item := range response.Deployments {
+ if item.Target != "production" {
+ continue
+ }
+ d := Deployment{ID: item.UID, Status: item.State, AliasAssigned: aliasAssigned(item.AliasAssigned)}
+ d.Meta.Message = item.Meta["ship_operation"]
+ result = append(result, d)
+ }
+ return result, nil
+}
+
+func (v *Providers) submit(ctx context.Context, p Project, stage, marker string) error {
+ if p.Provider == "vercel" {
+ _, err := v.vercelCall(ctx, p, nil, "deploy", stage, "--project", p.VercelProject, "--prod", "--yes", "--json", "--no-wait", "--meta", "ship_operation="+marker)
+ return err
+ }
+ args := append([]string{"up", stage, "--path-as-root"}, selectors(p)...)
+ args = append(args, "--detach", "--json", "--message", marker)
+ _, err := v.call(ctx, "railway", args...)
+ return err
+}
+
+func prepareVercelSource(stage string, p Project) error {
+ var config map[string]json.RawMessage
+ if err := readJSON(filepath.Join(stage, "vercel.json"), &config); err != nil {
+ return errors.New("Vercel container source requires vercel.json with framework set to container")
+ }
+ var framework string
+ if json.Unmarshal(config["framework"], &framework) != nil || framework != "container" {
+ return errors.New("Vercel framework must be container")
+ }
+ // Keep the alpha's deployment behavior reviewable; advanced project configuration needs separate validation.
+ if len(config) != 1 {
+ return errors.New("this alpha accepts only the container framework field in vercel.json")
+ }
+ if _, err := os.Stat(filepath.Join(stage, "Dockerfile.vercel")); err != nil {
+ return errors.New("Dockerfile.vercel is missing")
+ }
+ if err := os.Mkdir(filepath.Join(stage, ".vercel"), 0700); err != nil {
+ return err
+ }
+ // Provider link metadata is generated locally and excluded by Vercel from the upload.
+ return atomicJSON(filepath.Join(stage, ".vercel", "project.json"), map[string]string{"projectId": p.VercelProject, "orgId": p.VercelTeam})
+}
+
+func (v *Providers) vercelLogs(ctx context.Context, p Project) ([]string, error) {
+ if _, _, err := v.vercelAccount(ctx, p); err != nil {
+ return nil, err
+ }
+ vars, err := v.vercelVariables(ctx, p)
+ if err != nil {
+ return nil, errors.New("Vercel Secret metadata could not be checked or a write is unresolved; logs withheld")
+ }
+ data, err := v.vercelCall(ctx, p, nil, "logs", "--project", p.VercelProject, "--environment", "production", "--limit", "40", "--json", "--no-follow")
+ if err != nil {
+ return nil, err
+ }
+ lines := []string{}
+ for _, line := range strings.Split(string(data), "\n") {
+ if strings.TrimSpace(line) != "" {
+ lines = append(lines, redact(line, secretValues(vars)))
+ }
+ }
+ return lines, nil
+}
diff --git a/cmd/ship/vercel_secrets.go b/cmd/ship/vercel_secrets.go
new file mode 100644
index 0000000..7ba571a
--- /dev/null
+++ b/cmd/ship/vercel_secrets.go
@@ -0,0 +1,181 @@
+package main
+
+import (
+ "bytes"
+ "context"
+ "encoding/json"
+ "errors"
+ "net/url"
+ "path/filepath"
+ "unicode/utf8"
+)
+
+func productionSecret(envs []vercelEnv, key string) (*vercelEnv, error) {
+ var found *vercelEnv
+ for i := range envs {
+ item := &envs[i]
+ if item.Key != key || !item.production() {
+ continue
+ }
+ if found != nil || len(item.Target) != 1 || item.GitBranch != "" || len(item.CustomEnvironmentIDs) > 0 || item.ConfigurationID != "" {
+ return nil, errors.New("Secret is ambiguous, shared across environments, or integration-managed; review it in Vercel before proceeding")
+ }
+ if !idPattern.MatchString(item.ID) || item.UpdatedAt <= 0 {
+ return nil, errors.New("Vercel Secret identity or version is unavailable")
+ }
+ found = item
+ }
+ return found, nil
+}
+
+func (e *Engine) syncVercelSecret(ctx context.Context, p Project, key string, apply bool) (SecretInfo, error) {
+ var empty SecretInfo
+ if p.Provider != "vercel" || !secretKeyPattern.MatchString(key) {
+ return empty, errors.New("Secret sync requires a Vercel binding and an uppercase variable name")
+ }
+ unlock, err := e.Store.lock(p.Name)
+ if err != nil {
+ return empty, err
+ }
+ defer unlock()
+ refs, err := e.Store.secretRecords(p.Name)
+ if err != nil {
+ return empty, err
+ }
+ versions := refs[key]
+ if len(versions) == 0 {
+ return empty, errors.New("save the Secret in the local private file first")
+ }
+ last := &versions[len(versions)-1]
+ if !apply {
+ pending := false
+ for i := range versions {
+ if versions[i].SyncState == "unknown" || versions[i].SyncState == "applying" {
+ last = &versions[i]
+ pending = true
+ break
+ }
+ }
+ if !pending && (last.SyncState == "diagnosed_not_applied" || last.SyncState == "rejected") {
+ return secretInfoFor(key, versions), nil
+ }
+ }
+ if _, plan, err := e.Providers.vercelAccount(ctx, p); err != nil {
+ return empty, err
+ } else if apply && (plan != "hobby" || !p.AllowHobby || !p.AllowPublish) {
+ return empty, errors.New("Secret writes require authorized personal noncommercial Hobby conditions")
+ }
+ envs, err := e.Providers.vercelEnvs(ctx, p)
+ if err != nil {
+ return empty, err
+ }
+ remote, err := productionSecret(envs, key)
+ if err != nil {
+ return empty, err
+ }
+ if apply {
+ for _, version := range versions {
+ if version.SyncState == "unknown" || version.SyncState == "applying" {
+ return empty, errors.New("a previous Secret write is unresolved; use secret reconcile before another write")
+ }
+ }
+ if last.SyncState == "synced" || last.SyncState == "rejected" || last.SyncState == "diagnosed_not_applied" {
+ return empty, errors.New("this local version already has a completed write attempt; save a new version for an intentional update")
+ }
+ ops, err := e.Store.operations(p.Name)
+ if err != nil {
+ return empty, err
+ }
+ for _, op := range ops {
+ if !op.terminal() {
+ return empty, errors.New("reconcile the pending deployment before changing its Secrets")
+ }
+ }
+ neon, host, err := e.Providers.inspectNeon(ctx, p)
+ if err != nil {
+ return empty, err
+ }
+ if neon.NeonPlan != "free" {
+ return empty, errors.New("Secret writes require the validated Neon Free binding")
+ }
+ value, err := e.Store.secretValue(p.Name, last.Ref)
+ if err != nil {
+ return empty, err
+ }
+ defer clear(value)
+ if !utf8.Valid(value) || bytes.IndexByte(value, 0) >= 0 || len(value) == 0 || len(value) > maxSecretSize {
+ return empty, errors.New("Vercel Secret must be bounded UTF-8 text without NUL bytes")
+ }
+ if key == "DATABASE_URL" && !databaseEndpointMatches(string(value), host) {
+ return empty, errors.New("DATABASE_URL does not match the registered Neon endpoint")
+ }
+ last.Marker = "ship-secret:" + last.Ref
+ last.SyncState = "applying"
+ last.RemoteID = ""
+ last.RemoteUpdatedAt = 0
+ path, method := "/v10/projects/"+p.VercelProject+"/env", "POST"
+ if remote != nil {
+ last.RemoteID = remote.ID
+ last.RemoteUpdatedAt = remote.UpdatedAt
+ path = "/v10/projects/" + p.VercelProject + "/env/" + url.PathEscape(remote.ID)
+ method = "PATCH"
+ }
+ body := map[string]any{"value": string(value), "type": "sensitive", "visibility": "secret", "target": []string{"production"}, "comment": last.Marker}
+ if remote == nil {
+ body["key"] = key
+ }
+ payload, err := json.Marshal(body)
+ if err != nil {
+ return empty, err
+ }
+ defer clear(payload)
+ refs[key] = versions
+ if err = atomicJSON(filepath.Join(e.Store.Root, "secrets", p.Name+".json"), refs); err != nil {
+ return empty, err
+ }
+ // An unknown response is resolved by reading the marker and version, never by replaying this mutation.
+ writeErr := e.Providers.vercelAPI(ctx, p, path, method, payload, nil)
+ var commandErr *providerCommandError
+ if errors.As(writeErr, &commandErr) {
+ last.WriteErrorCode = commandErr.Code
+ if commandErr.Rejected {
+ last.SyncState = "rejected"
+ refs[key] = versions
+ if err = atomicJSON(filepath.Join(e.Store.Root, "secrets", p.Name+".json"), refs); err != nil {
+ return empty, err
+ }
+ return empty, writeErr
+ }
+ }
+ last.SyncState = "unknown"
+ refs[key] = versions
+ if err = atomicJSON(filepath.Join(e.Store.Root, "secrets", p.Name+".json"), refs); err != nil {
+ return empty, err
+ }
+ envs, err = e.Providers.vercelEnvs(ctx, p)
+ if err != nil {
+ return empty, errors.New("Secret write outcome is unknown; use secret reconcile, not another apply")
+ }
+ remote, err = productionSecret(envs, key)
+ if err != nil {
+ return empty, err
+ }
+ }
+ if last.Marker == "" || remote == nil || remote.Type != "sensitive" || remote.Comment != last.Marker || (last.RemoteID != "" && remote.ID != last.RemoteID) {
+ return empty, errors.New("cannot confirm the original Secret write; keep it unresolved and review the cloud state")
+ }
+ if last.SyncState == "synced" && remote.UpdatedAt != last.RemoteUpdatedAt {
+ return empty, errors.New("cloud Secret changed after the confirmed write")
+ }
+ if last.SyncState != "synced" && remote.UpdatedAt <= last.RemoteUpdatedAt {
+ return empty, errors.New("Secret version has not advanced; original write remains unconfirmed")
+ }
+ last.RemoteID = remote.ID
+ last.RemoteUpdatedAt = remote.UpdatedAt
+ last.SyncState = "synced"
+ refs[key] = versions
+ if err = atomicJSON(filepath.Join(e.Store.Root, "secrets", p.Name+".json"), refs); err != nil {
+ return empty, err
+ }
+ return secretInfoFor(key, versions), nil
+}
diff --git a/cmd/ship/vercel_test.go b/cmd/ship/vercel_test.go
new file mode 100644
index 0000000..80b22dc
--- /dev/null
+++ b/cmd/ship/vercel_test.go
@@ -0,0 +1,310 @@
+package main
+
+import (
+ "context"
+ "encoding/json"
+ "errors"
+ "os"
+ "path/filepath"
+ "strings"
+ "testing"
+)
+
+func TestProviderErrorDoesNotEchoResponseDetails(t *testing.T) {
+ err := safeProviderError("vercel", []byte(`{"error":{"code":"bad_request","message":"rejected plaintext-private-value"}}`), nil)
+ if !strings.Contains(err.Error(), "bad_request") || strings.Contains(err.Error(), "plaintext-private-value") {
+ t.Fatal("provider response details escaped redaction boundary")
+ }
+ err = safeProviderError("vercel", []byte(`{"error":{"code":"unsafe value with spaces","message":"plaintext-private-value"}}`), nil)
+ if !strings.Contains(err.Error(), "cli_error_or_timeout") || strings.Contains(err.Error(), "unsafe value") {
+ t.Fatal("unstructured provider detail was exposed")
+ }
+}
+
+func TestVercelKnownValidationRejectionIsNotUnknown(t *testing.T) {
+ // Exact response observed from the pinned CLI in the isolated cloud probe.
+ err := safeProviderError("vercel", nil, []byte("Error: You cannot change the key of a Sensitive Environment Variable. (400)\n"))
+ var classified *providerCommandError
+ if !errors.As(err, &classified) || !classified.Rejected || classified.Code != "sensitive_key_immutable" {
+ t.Fatal("known provider validation rejection was discarded")
+ }
+ f := newVercelFixture(t)
+ run := f.e.Providers.RunInput
+ f.e.Providers.RunInput = func(ctx context.Context, tool string, args []string, input []byte) ([]byte, error) {
+ if input != nil {
+ f.writes++
+ return nil, err
+ }
+ return run(ctx, tool, args, input)
+ }
+ if _, err = f.e.syncVercelSecret(context.Background(), f.p, "DATABASE_URL", true); err == nil {
+ t.Fatal("rejected write reported success")
+ }
+ records, readErr := f.e.Store.secretRecords(f.p.Name)
+ if readErr != nil || records["DATABASE_URL"][0].SyncState != "rejected" {
+ t.Fatal("definite rejection was not preserved")
+ }
+ if _, err = f.e.syncVercelSecret(context.Background(), f.p, "DATABASE_URL", true); err == nil || f.writes != 1 {
+ t.Fatal("rejected attempt was automatically reused")
+ }
+}
+
+type vercelFixture struct {
+ e *Engine
+ p Project
+ env vercelEnv
+ hidden *vercelEnv
+ plan, owner string
+ writes, uploads int
+ loseReply bool
+ deployments []vercelDeployment
+}
+
+func newVercelFixture(t *testing.T) *vercelFixture {
+ t.Helper()
+ e, p := fixture(t)
+ p.Provider = "vercel"
+ p.VercelTeam = "team_demo123"
+ p.VercelProject = "prj_demo123"
+ p.AllowHobby = true
+ f := &vercelFixture{e: e, p: p, plan: "hobby", owner: p.VercelTeam, env: vercelEnv{ID: "env_demo123", Key: "DATABASE_URL", Type: "sensitive", Visibility: "secret", Target: []string{"production"}, UpdatedAt: 100}}
+ if err := e.Store.register(p); err != nil {
+ t.Fatal(err)
+ }
+ if err := os.Rename(filepath.Join(p.Source, "Dockerfile"), filepath.Join(p.Source, "Dockerfile.vercel")); err != nil {
+ t.Fatal(err)
+ }
+ if err := os.WriteFile(filepath.Join(p.Source, "vercel.json"), []byte(`{"framework":"container"}`), 0600); err != nil {
+ t.Fatal(err)
+ }
+ if _, err := e.Store.saveSecret(p.Name, "DATABASE_URL", []byte("postgresql://user:cached-password@ep-demo1.region.neon.tech/db")); err != nil {
+ t.Fatal(err)
+ }
+ e.Providers.Store = e.Store
+ e.Providers.VercelConfig = "/private/vercel-auth"
+ e.Providers.RunInput = func(_ context.Context, tool string, args []string, input []byte) ([]byte, error) {
+ if tool == "neon" {
+ return healthyProvider(tool, args)
+ }
+ if tool != "vercel" {
+ t.Fatalf("unexpected provider %s", tool)
+ }
+ joined := strings.Join(args, " ")
+ if !strings.Contains(joined, "--scope "+p.VercelTeam) || !strings.Contains(joined, "--global-config /private/vercel-auth") {
+ t.Fatal("Vercel call lost its explicit account scope")
+ }
+ if strings.Contains(joined, "cached-password") {
+ t.Fatal("secret entered command arguments")
+ }
+ switch args[0] {
+ case "deploy":
+ f.uploads++
+ if !strings.Contains(joined, "--prod") || !strings.Contains(joined, "--project "+p.VercelProject) {
+ t.Fatal("deployment target was implicit")
+ }
+ for i, a := range args {
+ if a == "--meta" {
+ f.deployments = []vercelDeployment{{UID: "dpl_original", State: "BUILDING", Target: "production", Meta: map[string]string{"ship_operation": strings.TrimPrefix(args[i+1], "ship_operation=")}}}
+ }
+ }
+ return nil, errors.New("lost deployment response")
+ case "logs":
+ return []byte("cached-password"), nil
+ case "api":
+ path := args[1]
+ switch {
+ case strings.HasPrefix(path, "/v2/teams/"):
+ return jsonBytes(map[string]any{"id": f.owner, "billing": map[string]string{"plan": f.plan}, "membership": map[string]string{"role": "OWNER"}}), nil
+ case path == "/v9/projects/"+p.VercelProject:
+ return jsonBytes(vercelProject{ID: p.VercelProject, AccountID: p.VercelTeam, Targets: map[string]vercelDeployment{"production": {ID: "dpl_old", State: "READY", Alias: []string{"demo.example.test"}}}}), nil
+ case strings.HasPrefix(path, "/v7/deployments?"):
+ return jsonBytes(map[string]any{"deployments": f.deployments}), nil
+ case strings.Contains(path, "/env"):
+ if input == nil {
+ return jsonBytes(map[string]any{"envs": []vercelEnv{f.env}}), nil
+ }
+ f.writes++
+ if path != "/v10/projects/"+p.VercelProject+"/env/"+f.env.ID {
+ t.Fatal("Secret update diverged from the pinned official CLI endpoint")
+ }
+ var body map[string]any
+ if json.Unmarshal(input, &body) != nil || body["type"] != "sensitive" || body["visibility"] != "secret" {
+ t.Fatal("Secret protection was downgraded")
+ }
+ if _, exists := body["key"]; exists {
+ t.Fatal("Secret update attempted to rename an existing key")
+ }
+ next := f.env
+ next.UpdatedAt++
+ next.Comment = body["comment"].(string)
+ if f.loseReply {
+ f.hidden = &next
+ return nil, errors.New("lost Secret response")
+ }
+ f.env = next
+ return []byte(`{}`), nil
+ }
+ }
+ return nil, errors.New("unexpected Vercel invocation")
+ }
+ return f
+}
+
+func TestVercelSecretUnknownWriteAndDrift(t *testing.T) {
+ f := newVercelFixture(t)
+ ctx := context.Background()
+ pre, err := f.e.Providers.inspect(ctx, f.p)
+ if err != nil || !pre.Observation.Eligible || pre.Observation.DatabaseBinding != "provider_secret_retained_not_readable" {
+ t.Fatal("local cache was treated as cloud truth")
+ }
+ f.loseReply = true
+ if _, err = f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", true); err == nil || f.writes != 1 {
+ t.Fatal("uncertain Secret write was not retained")
+ }
+ if _, err = f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", true); err == nil || f.writes != 1 {
+ t.Fatal("uncertain Secret write was replayed")
+ }
+ pre, err = f.e.Providers.inspect(ctx, f.p)
+ if err != nil || pre.Observation.Eligible {
+ t.Fatal("unresolved Secret write did not block deployment")
+ }
+ f.env = *f.hidden
+ if _, err = f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", false); err != nil || f.writes != 1 {
+ t.Fatalf("original Secret was not reconciled: %v", err)
+ }
+ pre, err = f.e.Providers.inspect(ctx, f.p)
+ if err != nil || !pre.Observation.Eligible || pre.Observation.DatabaseBinding != "last_write_and_metadata_match_not_runtime_identity" {
+ t.Fatalf("confirmed binding was not eligible: %v", err)
+ }
+ lines, err := f.e.logs(ctx, f.p)
+ if err != nil || len(lines) != 1 || lines[0] != "[REDACTED]" {
+ t.Fatal("cached database password leaked through logs")
+ }
+ f.env.UpdatedAt++
+ pre, err = f.e.Providers.inspect(ctx, f.p)
+ if err != nil || !pre.Observation.Eligible || pre.Observation.DatabaseBinding != "provider_secret_retained_not_readable" {
+ t.Fatal("externally changed Secret was trusted")
+ }
+ lines, err = f.e.logs(ctx, f.p)
+ if err != nil || len(lines) != 1 || lines[0] != "[REDACTED]" {
+ t.Fatal("known historical secrets were not redacted")
+ }
+}
+
+func TestVercelDeployRetainsOpaqueProviderSecrets(t *testing.T) {
+ f := newVercelFixture(t)
+ if err := os.Remove(filepath.Join(f.e.Store.Root, "secrets", f.p.Name+".json")); err != nil {
+ t.Fatal(err)
+ }
+ op, unlock, err := f.e.begin(f.p)
+ if err != nil {
+ t.Fatal(err)
+ }
+ defer unlock()
+ if err = f.e.executePublish(context.Background(), f.p, op, false); err != nil {
+ t.Fatalf("existing configuration could not be retained: %v", err)
+ }
+ if f.uploads != 1 || f.writes != 0 || op.State != "deploying" {
+ t.Fatal("source deployment depended on replacing provider Secrets")
+ }
+ observation := f.e.Store.observation(f.p.Name)
+ if observation == nil || observation.DatabaseBinding != "provider_secret_retained_not_readable" {
+ t.Fatal("opaque database identity was reported as verified")
+ }
+}
+
+func TestDiagnosedSecretHistoryDoesNotReopen(t *testing.T) {
+ f := newVercelFixture(t)
+ records, err := f.e.Store.secretRecords(f.p.Name)
+ if err != nil {
+ t.Fatal(err)
+ }
+ records["DATABASE_URL"][0].SyncState = "diagnosed_not_applied"
+ records["DATABASE_URL"][0].Resolution = "user-approved diagnosis"
+ path := filepath.Join(f.e.Store.Root, "secrets", f.p.Name+".json")
+ if err = atomicJSON(path, records); err != nil {
+ t.Fatal(err)
+ }
+ before, _ := os.ReadFile(path)
+ f.e.Providers.RunInput = func(context.Context, string, []string, []byte) ([]byte, error) {
+ t.Fatal("archived diagnosis contacted the provider")
+ return nil, nil
+ }
+ info, err := f.e.syncVercelSecret(context.Background(), f.p, "DATABASE_URL", false)
+ if err != nil || info.Status != "write_diagnosed_not_applied" {
+ t.Fatal("archived disposition was reopened")
+ }
+ after, _ := os.ReadFile(path)
+ if string(before) != string(after) {
+ t.Fatal("historical disposition changed")
+ }
+}
+
+func TestVercelBoundariesAndDeploymentReconciliation(t *testing.T) {
+ f := newVercelFixture(t)
+ ctx := context.Background()
+ f.plan = "pro"
+ if _, err := f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", true); err == nil || f.writes != 0 {
+ t.Fatal("paid plan permitted a mutation")
+ }
+ f.plan = "hobby"
+ f.owner = "team_other123"
+ if _, err := f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", true); err == nil || f.writes != 0 {
+ t.Fatal("wrong owner permitted a mutation")
+ }
+ f.owner = f.p.VercelTeam
+ if _, err := f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", true); err != nil {
+ t.Fatal(err)
+ }
+ op, unlock, err := f.e.begin(f.p)
+ if err != nil {
+ t.Fatal(err)
+ }
+ err = f.e.executePublish(ctx, f.p, op, false)
+ unlock()
+ if err != nil || f.uploads != 1 || op.State != "deploying" || op.DeploymentID != "dpl_original" {
+ t.Fatalf("lost response was not reconciled: %v", err)
+ }
+ if _, release, err := f.e.begin(f.p); err == nil {
+ release()
+ t.Fatal("duplicate deployment permitted")
+ }
+ f.deployments[0].State = "READY"
+ recovered, err := f.e.reconcile(ctx, f.p, false)
+ if err != nil || recovered.State != "deploying" {
+ t.Fatal("READY without production alias was marked deployed")
+ }
+ f.deployments[0].State = "ERROR"
+ recovered, err = f.e.reconcile(ctx, f.p, false)
+ if err != nil || recovered.State != "failed" || recovered.DeploymentID != "dpl_original" || f.uploads != 1 {
+ t.Fatal("reconciliation changed the original deployment")
+ }
+ if _, err = f.e.Store.saveSecret(f.p.Name, "DATABASE_URL", []byte("postgresql://user:other-password@other-db.example/db")); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = f.e.syncVercelSecret(ctx, f.p, "DATABASE_URL", true); err == nil || f.writes != 1 {
+ t.Fatal("wrong database endpoint was applied")
+ }
+}
+
+func TestVercelSourceRejectsImplicitConfiguration(t *testing.T) {
+ f := newVercelFixture(t)
+ stage, _, _, err := bundleSource(f.p.Source, f.e.Store.Root, nil)
+ if err != nil {
+ t.Fatal(err)
+ }
+ defer os.RemoveAll(stage)
+ if err = prepareVercelSource(stage, f.p); err != nil {
+ t.Fatal(err)
+ }
+ var linked map[string]string
+ if readJSON(filepath.Join(stage, ".vercel/project.json"), &linked) != nil || linked["orgId"] != f.p.VercelTeam || linked["projectId"] != f.p.VercelProject {
+ t.Fatal("staged source lost its explicit resource binding")
+ }
+ if err = os.WriteFile(filepath.Join(stage, "vercel.json"), []byte(`{"framework":null}`), 0600); err != nil {
+ t.Fatal(err)
+ }
+ if prepareVercelSource(stage, f.p) == nil {
+ t.Fatal("Other framework was accepted for a container deployment")
+ }
+}
diff --git a/cmd/ship/web/app.js b/cmd/ship/web/app.js
index 1e50505..b269940 100644
--- a/cmd/ship/web/app.js
+++ b/cmd/ship/web/app.js
@@ -16,18 +16,19 @@ function time(value){return value?new Date(value).toLocaleString():'尚未检查
function showDialog(title,text,opener=document.activeElement){dialogOpener=opener;$('dialog-title').textContent=title;const pre=document.createElement('pre');pre.textContent=text;$('dialog-body').replaceChildren(pre);$('dialog').showModal();}
$('close').addEventListener('click',()=>$('dialog').close());
$('dialog').addEventListener('close',()=>{if(dialogOpener?.isConnected)dialogOpener.focus();load().catch(e=>message(e.message,true));});
-$('add').addEventListener('click',()=>showDialog('关联已有应用','内部版先关联已有 Railway + Neon 资源。\n\n在已有 Agent 中选择项目，让它使用随源码提供的 ship Skill，核对资源归属后运行 register。\n\n首次创建云资源、通用资源接管和数据库迁移尚未接入这一版。'));
+$('add').addEventListener('click',()=>showDialog('关联已有应用','内部版先关联已有 Railway 或 Vercel 项目与 Neon 资源。\n\n在已有 Agent 中选择项目，让它使用随源码提供的 ship Skill，核对资源归属后运行 register。\n\n首次创建云资源、通用资源接管和数据库迁移尚未接入这一版。'));
async function load(){
const views=await api('projects');const fragment=document.createDocumentFragment();
for(const view of views){
const p=view.project,o=view.observation,op=view.operations[0];const pending=op&&!terminal.has(op.state);
const card=$('card').content.cloneNode(true),article=card.querySelector('article');article.dataset.name=p.name;
card.querySelector('.name').textContent=p.name;
- card.querySelector('.plan').textContent=o?'Railway '+o.railway_plan+' · Neon '+o.neon_plan:'尚未读取资源状态';
+ const provider=p.provider==='vercel'?'Vercel':'Railway';
+ card.querySelector('.plan').textContent=o?provider+' '+(o.compute_plan||o.railway_plan||'待确认')+' · Neon '+o.neon_plan:'尚未读取资源状态';
const status=card.querySelector('.status');
const newerOperation=op?.provider_state&&(!o||new Date(op.updated_at)>new Date(o.at));
const cloudState=newerOperation?op.provider_state:o?.service_state;
- status.textContent=pending?(op.state==='unknown'?(view.running?'正在确认发布':'结果待核实'):'正在发布'):op?.state==='blocked'?'发布未执行':op?.state==='failed'?'最近发布失败':cloudState==='SLEEPING'?'最近状态：休眠':cloudState==='SUCCESS'?'最近部署成功':'状态待刷新';
+ status.textContent=pending?(op.state==='unknown'?(view.running?'正在确认发布':'结果待核实'):'正在发布'):op?.state==='blocked'?'发布未执行':op?.state==='failed'?'最近发布失败':cloudState==='SLEEPING'?'最近状态：休眠':['SUCCESS','READY'].includes(cloudState)?'最近部署成功':'状态待刷新';
if(pending||!o||op?.state==='blocked')status.classList.add('warn');if(op?.state==='failed')status.classList.add('bad');
card.querySelector('.address').textContent=p.url;card.querySelector('.visit').href=p.url;
card.querySelector('[data-action="publish"]').disabled=!!pending||!p.allow_publish;
@@ -35,9 +36,10 @@ async function load(){
card.querySelector('.recovery').hidden=!pending||view.running;
card.querySelector('.observed').textContent=time(newerOperation?op.updated_at:o?.at);
card.querySelector('.database').textContent=o?.database_state||'尚未读取';
+ card.querySelector('.binding').textContent=o?.database_binding==='last_write_and_metadata_match_not_runtime_identity'?'上次写入与平台记录一致；运行连接仍需检查':o?.database_binding==='provider_value_matches_endpoint'?'配置地址与登记数据库一致':o?.database_binding==='provider_secret_retained_not_readable'?'沿用平台已有 Secret；连接目标未核验':'待核对';
const checks=view.checks;
card.querySelector('.checked').textContent=checks?(checks.results.every(c=>c.ok)?'通过':'未通过或待确认')+' · '+time(checks.at):'尚未检查（刷新资源状态不会唤醒应用）';
- card.querySelector('.authorization').textContent=p.allow_publish?'允许向此服务发布当前源码'+(p.allow_trial?'，已接受 Trial 试用条件':''):'仅查看';
+ card.querySelector('.authorization').textContent=p.allow_publish?'允许向此服务发布当前源码'+(p.provider==='vercel'?(p.allow_personal_noncommercial_hobby?'，已确认 Hobby 个人非商业用途':''):(p.allow_trial?'，已接受 Trial 试用条件':'')):'仅查看';
if(checks&&!checks.results.every(c=>c.ok)&&!pending){status.textContent='访问待确认';status.classList.add('warn');}
fragment.append(card);
}
diff --git a/cmd/ship/web/index.html b/cmd/ship/web/index.html
index 501d635..e30fcfe 100644
--- a/cmd/ship/web/index.html
+++ b/cmd/ship/web/index.html
@@ -2,5 +2,5 @@
Ship · 我的应用
Ship本地
内部试验版 · Trial 不等于正式 Free
-应用详情
- 状态更新
- 数据库
- 最近访问检查
- 项目授权
应用详情
- 状态更新
- 数据库
- 连接配置
- 最近访问检查
- 项目授权