[grade=A] Shipdeck fleet module and manual deploy flow

Adds validated fleet install/lifecycle routes, bridge-backed Git and OCI workflows, persistent service cards, and the Local-tab Shipdeck deployment UI while preserving catalog and External flows.

Judge: urn:ump:if6udffdyelsf4qvskkr65ikhuprsjiajzij6h653fhf2zgyynzq

dashcaddy-api/__tests__/routes/shipdeck-fleet.routes.test.js

@@ -0,0 +1,70 @@
+const express = require('express');
+
+function fetcher(fixtures) {
+  return jest.fn(async (url, opts = {}) => {
+    const key = `${opts.method || 'GET'} ${url.replace(/^https?:\/\/[^/]+/, '')}`;
+    const hit = fixtures[key] || { status: 404, body: { ok: false, error: 'missing fixture' } };
+    return { status: hit.status, json: async () => hit.body };
+  });
+}
+
+function appFor(fixtures = {}, initial = []) {
+  process.env.SHIPDECK_BRIDGE_URL = 'http://127.0.0.1:8977';
+  process.env.SHIPDECK_BRIDGE_TOKEN_FILE = '';
+  jest.resetModules();
+  const make = require('../../routes/shipdeck-fleet');
+  let services = initial.slice();
+  const router = make({
+    asyncHandler: (fn) => async (req, res, next) => { try { await fn(req, res, next); } catch (e) { next(e); } },
+    log: { info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+    auditLogger: { log: jest.fn(async () => {}) },
+    fetchT: fetcher(fixtures),
+    servicesStateManager: { read: async () => services, update: async (fn) => { services = await fn(services); } },
+  });
+  const app = express(); app.use(express.json()); app.use('/api/v1/fleet', router);
+  app.use((err, req, res, next) => res.status(500).json({ success: false, error: err.message }));
+  return { app, services: () => services };
+}
+
+async function request(app, path, options) {
+  const server = app.listen(0); const port = server.address().port;
+  try { const response = await fetch(`http://127.0.0.1:${port}${path}`, options); return { response, body: await response.json() }; }
+  finally { server.close(); }
+}
+
+describe('Shipdeck fleet routes', () => {
+  test('from-git rejects privileged inputs before bridge', async () => {
+    const { app } = appFor();
+    const { response } = await request(app, '/api/v1/fleet/from-git', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ repo_url: 'https://github.com/a/b;id', name: '../bad', subdomain: 'bad', port: 80 }) });
+    expect(response.status).toBe(400);
+  });
+
+  test('from-git persists the card server-side while never returning or storing the token', async () => {
+    const fixtures = { 'POST /api/install': { status: 200, body: { ok: true, service: { logo: '', host: 'localhost', shipdeckfile: '/var/lib/shipdeck/services/demo/Shipdeckfile', journal_row_id: 'demo:1' } } } };
+    const { app, services } = appFor(fixtures);
+    const secret = 'ghp_private_secret';
+    const { response, body } = await request(app, '/api/v1/fleet/from-git', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ repo_url: 'https://github.com/acme/demo', name: 'demo', subdomain: 'demo', port: 8080, token: secret }) });
+    expect(response.status).toBe(200); expect(body.success).toBe(true);
+    expect(JSON.stringify(body)).not.toContain(secret); expect(JSON.stringify(services())).not.toContain(secret);
+    expect(services()[0].managedBy).toBe('shipdeck');
+    expect(services()[0].shipdeckfile).toBe('/var/lib/shipdeck/services/demo/Shipdeckfile');
+  });
+
+  test('from-image validates mounts and registry refs', async () => {
+    const { app } = appFor();
+    const { response } = await request(app, '/api/v1/fleet/from-image', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ image: 'alpine;id', name: 'demo', subdomain: 'demo', port: 8080, mounts: [{ source: '/tmp/../etc', target: '/data' }] }) });
+    expect(response.status).toBe(400);
+  });
+
+  test('lifecycle validates service and proxies argv-shaped action', async () => {
+    const { app } = appFor({ 'POST /api/restart': { status: 200, body: { ok: true, output: 'RESTART demo' } } });
+    const { response, body } = await request(app, '/api/v1/fleet/restart', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'demo' }) });
+    expect(response.status).toBe(200); expect(body.action).toBe('restart');
+  });
+
+  test('shipdeckfile requires registered canonical path', async () => {
+    const { app } = appFor({}, [{ id: 'demo', managedBy: 'shipdeck', shipdeckfile: '/tmp/evil' }]);
+    const { response } = await request(app, '/api/v1/fleet/shipdeckfile?id=demo');
+    expect(response.status).toBe(404);
+  });
+});

dashcaddy-api/routes/fleet.js

@@ -43,6 +43,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { ok, errorResponse } = require('../src/utils/responses');
 const { ErrorCodes } = require('../src/utilities/error-codes');
+const shipdeckFleet = require('./shipdeck-fleet');
 const {
   validateFleetHost,
   resolveAndCheckAddress,
@@ -58,7 +59,7 @@ const MAX_PROBE_CONCURRENCY = 5;
 // Per-host probe timeout for /fleet/status.
 const PROBE_TIMEOUT_MS = 3000;
 
-module.exports = function({ log, asyncHandler }) {
+module.exports = function({ log, asyncHandler, auditLogger, fetchT, servicesStateManager }) {
   const wrap = asyncHandler || ((fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next));
   const router = express.Router();
 
@@ -352,5 +353,15 @@ module.exports = function({ log, asyncHandler }) {
     });
   }));
 
+  // Shipdeck v0.2 lifecycle and install endpoints share the existing /fleet
+  // namespace without changing the DC-108 host-management routes above.
+  router.use('/fleet', shipdeckFleet({
+    asyncHandler: wrap,
+    log,
+    auditLogger,
+    fetchT,
+    servicesStateManager,
+  }));
+
   return router;
 };

dashcaddy-api/routes/shipdeck-fleet.js

@@ -0,0 +1,185 @@
+/**
+ * Shipdeck fleet module. All privileged values are fail-closed here before
+ * crossing the token-gated host bridge. Tokens are forwarded in-memory only:
+ * never logged, audited, persisted, or returned.
+ */
+const express = require('express');
+const { ok, errorResponse } = require('../src/utils/responses');
+
+const BRIDGE_URL = process.env.SHIPDECK_BRIDGE_URL || '';
+const BRIDGE_TOKEN_FILE = process.env.SHIPDECK_BRIDGE_TOKEN_FILE || '';
+const PROBE_TIMEOUT = Number(process.env.SHIPDECK_PROBE_TIMEOUT || 15000);
+const DEPLOY_TIMEOUT = Number(process.env.SHIPDECK_DEPLOY_TIMEOUT || 920000);
+
+const reServiceName = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const reBinaryPath = /^\/?[A-Za-z0-9][A-Za-z0-9._\-/]{0,255}$/;
+const reSHA256 = /^[a-f0-9]{64}$/;
+const reRegistryRef = /^(?:[A-Za-z0-9][A-Za-z0-9.-]*(?::[0-9]{1,5})?\/)?[A-Za-z0-9][A-Za-z0-9._/-]*(?::[A-Za-z0-9][A-Za-z0-9._-]{0,127}|@sha256:[a-f0-9]{64})$/;
+const reGitURL = /^https:\/\/[A-Za-z0-9.-]+(?::\d{1,5})?\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?\/?$/;
+const reEnvName = /^[A-Z_][A-Z0-9_]*$/;
+const reToken = /^[A-Za-z0-9_.=~-]{0,512}$/;
+const reUser = /^[A-Za-z0-9_][A-Za-z0-9_.-]*(?::[A-Za-z0-9_][A-Za-z0-9_.-]*)?$/;
+const reMountPath = new RegExp('^/[A-Za-z0-9._/-]+$');
+
+function hasControl(value) {
+  return Array.from(value).some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127);
+}
+
+function cleanEnv(value) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('env must be an object');
+  const out = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (!reEnvName.test(key) || typeof val !== 'string' || val.length > 300 || val.includes('"') || val.includes('\\') || hasControl(val)) {
+      throw new Error('env must map uppercase names to strings <=300 chars without quotes, backslashes, or control characters');
+    }
+    out[key] = val;
+  }
+  return out;
+}
+
+function cleanMounts(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > 32) throw new Error('mounts must be an array of at most 32 entries');
+  return value.map((mount) => {
+    if (!mount || typeof mount !== 'object' || Array.isArray(mount)) throw new Error('invalid mount');
+    const source = String(mount.source || '');
+    const target = String(mount.target || '');
+    if (!reMountPath.test(source) || !reMountPath.test(target) || source.includes('..') || target.includes('..')) throw new Error('mount paths must be safe absolute paths');
+    if (mount.read_only !== undefined && typeof mount.read_only !== 'boolean') throw new Error('mount read_only must be boolean');
+    return { source, target, read_only: mount.read_only === true };
+  });
+}
+
+function cleanCommand(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > 64 || value.some((v) => typeof v !== 'string' || !v || v.length > 1024 || hasControl(v))) throw new Error('cmd must be an array of safe argument strings');
+  if (!reBinaryPath.test(value[0])) throw new Error('cmd executable is invalid');
+  return value.slice();
+}
+
+function readToken() {
+  if (!BRIDGE_TOKEN_FILE) return '';
+  try { return require('fs').readFileSync(BRIDGE_TOKEN_FILE, 'utf8').trim(); } catch (_) { return ''; }
+}
+
+module.exports = function fleetRoutes({ asyncHandler, log, auditLogger, fetchT, servicesStateManager }) {
+  const router = express.Router();
+
+  async function bridge(method, path, body, timeout = PROBE_TIMEOUT) {
+    const headers = { 'X-Shipdeck-Token': readToken() };
+    const options = { method, headers };
+    if (body !== undefined) { headers['Content-Type'] = 'application/json'; options.body = JSON.stringify(body); }
+    const response = await fetchT(BRIDGE_URL + path, options, timeout);
+    let parsed;
+    try { parsed = await response.json(); } catch (_) { parsed = { ok: false, error: 'bridge returned non-JSON response' }; }
+    return { status: response.status, body: parsed };
+  }
+
+  function bridgeError(res, status, body, fallback) {
+    const outward = status === 400 || status === 409 ? status : 502;
+    return errorResponse(res, outward, body.error || fallback, body.output ? { output: String(body.output).slice(-4000) } : undefined);
+  }
+
+  router.use((req, res, next) => {
+    if (!BRIDGE_URL) return errorResponse(res, 501, 'Fleet feature not configured: set SHIPDECK_BRIDGE_URL');
+    next();
+  });
+
+  router.post('/from-git', asyncHandler(async (req, res) => {
+    const { repo_url: repoUrl, name, subdomain, port, token, sha256 } = req.body || {};
+    if (typeof repoUrl !== 'string' || !reGitURL.test(repoUrl)) return errorResponse(res, 400, 'repo_url must be https://host/owner/repo');
+    if (typeof name !== 'string' || !reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+    if (typeof subdomain !== 'string' || !reServiceName.test(subdomain)) return errorResponse(res, 400, 'invalid subdomain');
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return errorResponse(res, 400, 'port must be 1-65535');
+    if (sha256 !== undefined && (typeof sha256 !== 'string' || !reSHA256.test(sha256))) return errorResponse(res, 400, 'sha256 must be 64 lowercase hex characters');
+    if (token !== undefined && (typeof token !== 'string' || !reToken.test(token))) return errorResponse(res, 400, 'invalid token');
+    let env; try { env = cleanEnv(req.body.env); } catch (e) { return errorResponse(res, 400, e.message); }
+    try {
+      const payload = { repo_url: repoUrl, service: name, subdomain, port, env, sha256 };
+      if (token !== undefined) payload.token = token;
+      const { status, body } = await bridge('POST', '/api/install', payload, DEPLOY_TIMEOUT);
+      if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'Git deployment failed');
+      const deployed = body.service || {};
+      const card = {
+        id: name, name, url: `https://${subdomain}.sami`, ip: deployed.host || 'localhost',
+        port, logo: deployed.logo || `/assets/${name}.png`, tailscaleOnly: true,
+        isCustom: true, managedBy: 'shipdeck', repoUrl,
+        shipdeckfile: deployed.shipdeckfile, journalRowId: deployed.journal_row_id,
+      };
+      await servicesStateManager.update((services) => {
+        const i = services.findIndex((s) => s.id === name);
+        if (i >= 0) services[i] = { ...services[i], ...card }; else services.push(card);
+        return services;
+      });
+      if (auditLogger) auditLogger.log({ action: 'fleet.from-git', resource: name, details: { repo_url: repoUrl, port }, outcome: 'success' }).catch(() => {});
+      log.info('fleet', 'Shipdeck Git deployment completed', { service: name, port });
+      return ok(res, { service: card, journal_row_id: deployed.journal_row_id, phase: 'live' });
+    } catch (e) {
+      log.error('fleet', 'bridge unreachable during Git deployment', { service: name, error: e.message });
+      return errorResponse(res, 502, 'shipdeck bridge unreachable');
+    }
+  }));
+
+  router.post('/from-image', asyncHandler(async (req, res) => {
+    const { image, name, subdomain, port, user, restart, sha256 } = req.body || {};
+    if (typeof image !== 'string' || !reRegistryRef.test(image)) return errorResponse(res, 400, 'invalid registry image reference');
+    if (typeof name !== 'string' || !reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+    if (typeof subdomain !== 'string' || !reServiceName.test(subdomain)) return errorResponse(res, 400, 'invalid subdomain');
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return errorResponse(res, 400, 'port must be 1-65535');
+    if (sha256 !== undefined && (typeof sha256 !== 'string' || !reSHA256.test(sha256))) return errorResponse(res, 400, 'sha256 must be 64 lowercase hex characters');
+    if (user !== undefined && (typeof user !== 'string' || !reUser.test(user))) return errorResponse(res, 400, 'invalid user');
+    if (restart !== undefined && !['no', 'always', 'unless-stopped', 'on-failure'].includes(restart)) return errorResponse(res, 400, 'invalid restart policy');
+    let env, mounts, cmd;
+    try { env = cleanEnv(req.body.env); mounts = cleanMounts(req.body.mounts); cmd = cleanCommand(req.body.cmd); } catch (e) { return errorResponse(res, 400, e.message); }
+    try {
+      const { status, body } = await bridge('POST', '/api/image/install', { image, name, subdomain, port, env, mounts, user, restart, cmd, sha256 }, DEPLOY_TIMEOUT);
+      if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'Image deployment failed');
+      const deployed = body.service || {};
+      const card = { id: name, name, url: `https://${subdomain}.sami`, ip: 'localhost', port, logo: `/assets/${name}.png`, tailscaleOnly: true, isCustom: true, managedBy: 'shipdeck', image: deployed.image || image, shipdeckfile: deployed.shipdeckfile, journalRowId: deployed.journal_row_id };
+      await servicesStateManager.update((services) => { const i = services.findIndex((s) => s.id === name); if (i >= 0) services[i] = { ...services[i], ...card }; else services.push(card); return services; });
+      if (auditLogger) auditLogger.log({ action: 'fleet.from-image', resource: name, details: { image, port }, outcome: 'success' }).catch(() => {});
+      return ok(res, { service: card, journal_row_id: deployed.journal_row_id, phase: 'live' });
+    } catch (e) { log.error('fleet', 'bridge unreachable during image deployment', { service: name, error: e.message }); return errorResponse(res, 502, 'shipdeck bridge unreachable'); }
+  }));
+
+  router.get('/list', asyncHandler(async (req, res) => {
+    const { status, body } = await bridge('GET', '/api/managed');
+    if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'fleet listing failed');
+    return ok(res, { services: body.services || [] });
+  }));
+
+  for (const action of ['start', 'stop', 'restart', 'rm']) {
+    router.post('/' + action, asyncHandler(async (req, res) => {
+      const name = req.body && req.body.name;
+      if (typeof name !== 'string' || !reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+      const { status, body } = await bridge('POST', '/api/' + action, { name }, DEPLOY_TIMEOUT);
+      if (status !== 200 || !body.ok) return bridgeError(res, status, body, action + ' failed');
+      if (action === 'rm') await servicesStateManager.update((services) => services.filter((s) => s.id !== name));
+      return ok(res, { name, action, output: String(body.output || '').slice(-4000) });
+    }));
+  }
+
+  router.get('/logs', asyncHandler(async (req, res) => {
+    const name = String(req.query.name || '');
+    if (!reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+    const { status, body } = await bridge('GET', '/api/logs?name=' + encodeURIComponent(name));
+    if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'logs failed');
+    return ok(res, { name, logs: String(body.output || '').slice(-64000) });
+  }));
+
+  router.get('/shipdeckfile', asyncHandler(async (req, res) => {
+    const id = String(req.query.id || '');
+    if (!reServiceName.test(id)) return errorResponse(res, 400, 'invalid service id');
+    const services = await servicesStateManager.read();
+    const service = services.find((s) => s.id === id && s.managedBy === 'shipdeck');
+    if (!service || typeof service.shipdeckfile !== 'string' || !/^\/var\/lib\/shipdeck\/services\/[a-z0-9-]+\/Shipdeckfile$/.test(service.shipdeckfile)) return errorResponse(res, 404, 'Shipdeckfile not registered for this service');
+    const { status, body } = await bridge('GET', '/api/shipdeckfile?name=' + encodeURIComponent(id));
+    if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'Shipdeckfile read failed');
+    return ok(res, { id, shipdeckfile: String(body.shipdeckfile || '') });
+  }));
+
+  return router;
+};
+
+module.exports._validation = { reServiceName, reBinaryPath, reSHA256, reRegistryRef, cleanEnv, cleanMounts, cleanCommand };

dashcaddy-api/src/app.js

@@ -676,6 +676,9 @@ async function createApp() {
   apiRouter.use(fleetRoutes({
     log: ctx.log,
     asyncHandler: ctx.asyncHandler,
+    auditLogger: ctx.auditLogger,
+    fetchT: ctx.fetchT,
+    servicesStateManager: ctx.servicesStateManager,
   }));
   apiRouter.use(updatesRoutes({
     updateManager: ctx.updateManager,

ops/shipdeck-bridge/bridge.py

@@ -0,0 +1,340 @@
+#!/usr/bin/env python3
+"""shipdeck-bridge — token-gated HTTP wrapper around the shipdeck CLI.
+
+Runs on the DNS2 HOST (not in the container) so that SSH keys, fleet-dns
+credentials and root-level execution stay out of the DashCaddy web container.
+The container reaches it via the docker bridge IP (172.17.0.1), the same
+pattern as the Caddy admin API.
+
+Endpoints (all require X-Shipdeck-Token matching /etc/shipdeck/bridge-token):
+  GET  /api/health                  -> {ok, version}
+  GET  /api/repos                   -> deployable repos (dirs with a Shipdeckfile)
+  GET  /api/services                -> journal-derived service inventory
+  GET  /api/journal?service=N      -> journal rows (newest first)
+  GET  /api/status?service=N       -> live re-probe output
+  POST /api/deploy    {dir}         -> run `shipdeck deploy <dir>` (serialized)
+  POST /api/rollback  {service}     -> run `shipdeck rollback <service>` (serialized)
+  POST /api/install   {repo_url, service, subdomain?} -> GitHub clone+deploy+card (DC-131)
+
+Security model:
+  - Listens on 127.0.0.1:8977 and 172.17.0.1:8977 ONLY (docker bridge + local).
+  - Every request must carry the shared token (0600 file, root-owned).
+  - Deploy dirs are validated: realpath must sit under SHIPDECK_REPOS_ROOT and
+    contain a Shipdeckfile. Service names are strict [a-z0-9-].
+  - The CLI is exec'd via argv lists — never a shell.
+  - Mutations (deploy/rollback) are serialized with a lock; status/journal are
+    concurrent.
+"""
+
+import json
+import os
+import re
+import subprocess
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import urlparse, parse_qs
+from gh_install import gh_install  # DC-131: GitHub -> card installs (init_shared below)
+from gh_install import list_repos as gitea_list_repos  # DC-133
+from image_install import install_image
+import image_install as _image
+
+SHIPDECK_BIN = os.environ.get("SHIPDECK_BIN", "/usr/local/bin/shipdeck")
+TOKEN_FILE = os.environ.get("SHIPDECK_BRIDGE_TOKEN_FILE", "/etc/shipdeck/bridge-token")
+REPOS_ROOT = os.environ.get("SHIPDECK_REPOS_ROOT", "/root")
+LISTEN_HOSTS = ["127.0.0.1", os.environ.get("SHIPDECK_BRIDGE_DOCKER_IP", "172.17.0.1")]
+PORT = int(os.environ.get("SHIPDECK_BRIDGE_PORT", "8977"))
+DEPLOY_TIMEOUT = int(os.environ.get("SHIPDECK_DEPLOY_TIMEOUT", "600"))
+PROBE_TIMEOUT = 90
+MAX_BODY = 65536
+
+RE_SERVICE = re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$")
+
+mutation_lock = threading.Lock()
+
+
+def read_token() -> str:
+    with open(TOKEN_FILE, "r", encoding="utf-8") as f:
+        token = f.read().strip()
+    if not token:
+        raise RuntimeError("SHIPDECK_BRIDGE_TOKEN_FILE is empty; refusing to start unauthenticated")
+    return token
+
+
+TOKEN = read_token()
+
+
+def run_shipdeck(args, timeout):
+    """Exec the shipdeck CLI via argv (no shell). Returns (code, stdout+stderr)."""
+    try:
+        proc = subprocess.run(
+            [SHIPDECK_BIN] + args,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            env={**os.environ, "SHIPDECK_JOURNAL": os.environ.get("SHIPDECK_JOURNAL", "/var/lib/shipdeck/journal.jsonl")},
+        )
+        return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+    except subprocess.TimeoutExpired:
+        return 124, f"shipdeck {' '.join(args)} timed out after {timeout}s"
+    except FileNotFoundError:
+        return 127, f"shipdeck binary not found at {SHIPDECK_BIN}"
+
+
+# DC-131: hand shared state to the GitHub-install module (after run_shipdeck's
+# def so everything it needs exists; avoids a circular import).
+import gh_install as _gh
+_gh.init_shared(RE_SERVICE, REPOS_ROOT, PORT, mutation_lock, run_shipdeck)
+_image.init_shared(mutation_lock, run_shipdeck)
+
+
+def parse_journal(raw: str):
+    """Parse `shipdeck journal [name]` output rows robustly."""
+    rows = []
+    for line in raw.splitlines():
+        m = re.match(
+            r"^(\d{4}-\d{2}-\d{2}T[\d:]+Z)\s+(\S+)\s+(\S+)\s+epoch=(\d+)\s+(\S+)$",
+            line.strip(),
+        )
+        if m:
+            rows.append(
+                {
+                    "time": m.group(1),
+                    "service": m.group(2),
+                    "action": m.group(3),
+                    "epoch": int(m.group(4)),
+                    "duration": m.group(5),
+                }
+            )
+            continue
+        # rollback rows can have 0.0s duration too; tolerate missing duration
+        m = re.match(r"^(\d{4}-\d{2}-\d{2}T[\d:]+Z)\s+(\S+)\s+(\S+)\s+epoch=(\d+)$", line.strip())
+        if m:
+            rows.append(
+                {
+                    "time": m.group(1),
+                    "service": m.group(2),
+                    "action": m.group(3),
+                    "epoch": int(m.group(4)),
+                    "duration": None,
+                }
+            )
+    return rows
+
+
+def service_inventory():
+    code, out = run_shipdeck(["journal"], PROBE_TIMEOUT)
+    if code != 0:
+        return None, out
+    rows = parse_journal(out)
+    inv = {}
+    for r in rows:
+        s = inv.setdefault(
+            r["service"],
+            {"name": r["service"], "host": None, "last_action": r["action"], "last_time": r["time"], "last_epoch": r["epoch"]},
+        )
+        if s["host"] is None:
+            code2, out2 = run_shipdeck(["status", r["service"]], PROBE_TIMEOUT)
+            m = re.search(r"host (\S+)", out2)
+            if m:
+                s["host"] = m.group(1)
+    return sorted(inv.values(), key=lambda x: x["last_time"], reverse=True), None
+
+
+def list_repos():
+    """Depth-1 scan of REPOS_ROOT for dirs containing a Shipdeckfile."""
+    repos = []
+    try:
+        for name in sorted(os.listdir(REPOS_ROOT)):
+            d = os.path.join(REPOS_ROOT, name)
+            if not os.path.isdir(d) or name.startswith("."):
+                continue
+            if os.path.isfile(os.path.join(d, "Shipdeckfile")):
+                repos.append({"dir": d, "name": name})
+    except OSError as e:
+        return None, str(e)
+    return repos, None
+
+
+def resolve_deploy_dir(d):
+    """Validate a deploy dir request. Returns (realpath, None) or (None, error)."""
+    if not isinstance(d, str) or not d.strip():
+        return None, "dir is required"
+    real = os.path.realpath(d)
+    root_real = os.path.realpath(REPOS_ROOT)
+    if real != root_real and not real.startswith(root_real + os.sep):
+        return None, "dir must be under " + root_real
+    if not os.path.isfile(os.path.join(real, "Shipdeckfile")):
+        return None, "no Shipdeckfile in " + real
+    return real, None
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "shipdeck-bridge/1.0"
+
+    def log_message(self, fmt, *args):  # quiet default access log
+        pass
+
+    def _authed(self) -> bool:
+        return bool(TOKEN) and self.headers.get("X-Shipdeck-Token", "") == TOKEN
+
+    def _send(self, code, payload):
+        body = json.dumps(payload).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _deny(self):
+        self._send(401, {"ok": False, "error": "invalid or missing X-Shipdeck-Token"})
+
+    # ----- GET -----
+    def do_GET(self):
+        if not self._authed():
+            return self._deny()
+        u = urlparse(self.path)
+        q = parse_qs(u.query)
+        if u.path == "/api/health":
+            code, out = run_shipdeck(["version"], 10)
+            return self._send(200, {"ok": code == 0, "shipdeck": out.strip()})
+        if u.path == "/api/repos":
+            repos, err = list_repos()
+            if err:
+                return self._send(500, {"ok": False, "error": err})
+            return self._send(200, {"ok": True, "repos": repos})
+        if u.path == "/api/services":
+            inv, err = service_inventory()
+            if err:
+                return self._send(500, {"ok": False, "error": err})
+            return self._send(200, {"ok": True, "services": inv})
+        if u.path == "/api/managed":
+            code, out = run_shipdeck(["ls", "--json"], PROBE_TIMEOUT)
+            if code != 0:
+                return self._send(500, {"ok": False, "error": "shipdeck ls failed", "output": out[-4000:]})
+            try:
+                services = json.loads(out)
+            except json.JSONDecodeError:
+                return self._send(500, {"ok": False, "error": "shipdeck ls returned invalid JSON"})
+            return self._send(200, {"ok": True, "services": services})
+        if u.path == "/api/logs":
+            service = (q.get("name") or [""])[0]
+            if not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            code, out = run_shipdeck(["logs", "-n", "300", service], PROBE_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "output": out[-64000:]})
+        if u.path == "/api/shipdeckfile":
+            service = (q.get("name") or [""])[0]
+            if not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            code, out = run_shipdeck(["shipdeckfile", service], PROBE_TIMEOUT)
+            if code != 0:
+                return self._send(404, {"ok": False, "error": "Shipdeckfile not found"})
+            out = re.sub(r'(?im)^([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY)[A-Z0-9_]*)\s*=.*$', r'\1 = "<redacted>"', out)
+            return self._send(200, {"ok": True, "shipdeckfile": out})
+        if u.path == "/api/journal":
+            service = (q.get("service") or [""])[0]
+            args = ["journal"]
+            if service:
+                if not RE_SERVICE.match(service):
+                    return self._send(400, {"ok": False, "error": "invalid service name"})
+                args.append(service)
+            code, out = run_shipdeck(args, PROBE_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "rows": parse_journal(out), "raw": out[-4000:]})
+        if u.path == "/api/status":
+            service = (q.get("service") or [""])[0]
+            if not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            code, out = run_shipdeck(["status", service], PROBE_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "output": out[-8000:]})
+        return self._send(404, {"ok": False, "error": "not found"})
+
+    # ----- POST -----
+    def do_POST(self):
+        if not self._authed():
+            return self._deny()
+        u = urlparse(self.path)
+        length = int(self.headers.get("Content-Length", "0") or 0)
+        if length > MAX_BODY:
+            return self._send(413, {"ok": False, "error": "body too large"})
+        raw = self.rfile.read(length) if length else b"{}"
+        try:
+            payload = json.loads(raw or b"{}")
+        except json.JSONDecodeError:
+            return self._send(400, {"ok": False, "error": "invalid JSON body"})
+
+        if u.path == "/api/deploy":
+            real, err = resolve_deploy_dir(payload.get("dir"))
+            if err:
+                return self._send(400, {"ok": False, "error": err})
+            with mutation_lock:
+                code, out = run_shipdeck(["deploy", real], DEPLOY_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "exit": code, "output": out[-16000:]})
+
+        if u.path == "/api/rollback":
+            service = payload.get("service")
+            if not isinstance(service, str) or not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            with mutation_lock:
+                code, out = run_shipdeck(["rollback", service], DEPLOY_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "exit": code, "output": out[-16000:]})
+
+        if u.path in {"/api/start", "/api/stop", "/api/restart", "/api/rm"}:
+            service = payload.get("name")
+            if not isinstance(service, str) or not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            action = u.path.rsplit("/", 1)[-1]
+            with mutation_lock:
+                code, out = run_shipdeck([action, service], DEPLOY_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "exit": code, "output": out[-16000:]})
+
+        if u.path == "/api/image/install":
+            if not isinstance(payload, dict):
+                return self._send(400, {"ok": False, "error": "JSON object required"})
+            code, body = install_image(payload)
+            return self._send(code, body)
+
+        if u.path == "/api/gitea/repos":
+            code, body = gitea_list_repos(payload if isinstance(payload, dict) else {})
+            return self._send(code, body)
+
+        if u.path == "/api/install":
+            # DC-131: GitHub URL -> clone -> Shipdeckfile -> deploy -> metadata.
+            # Serialized with the same mutation lock; long timeout (build).
+            if not isinstance(payload, dict):
+                return self._send(400, {"ok": False, "error": "JSON object required"})
+            code, body = gh_install(payload)
+            return self._send(code, body)
+
+        return self._send(404, {"ok": False, "error": "not found"})
+
+
+def main():
+    servers = []
+    last_err = None
+    for host in LISTEN_HOSTS:
+        try:
+            srv = ThreadingHTTPServer((host, PORT), Handler)
+            srv.daemon_threads = True
+            servers.append(srv)
+        except OSError as e:
+            last_err = e
+            print(f"shipdeck-bridge: FAILED to bind {host}:{PORT}: {e}", file=sys.stderr, flush=True)
+    if not servers:
+        # fail fast: systemd restarts us; a silently-dead daemon is worse
+        print(f"shipdeck-bridge: no listeners could bind on {LISTEN_HOSTS}:{PORT}; exiting", file=sys.stderr, flush=True)
+        sys.exit(1)
+    for srv in servers:
+        threading.Thread(target=srv.serve_forever, daemon=True).start()
+        print(f"shipdeck-bridge listening on {srv.server_address[0]}:{PORT}", flush=True)
+    if last_err is not None:
+        # degraded-but-alive: at least one listener bound; keep serving
+        print("shipdeck-bridge: running in DEGRADED mode (partial bind); check logs", file=sys.stderr, flush=True)
+    try:
+        threading.Event().wait()
+    except KeyboardInterrupt:
+        pass
+
+
+if __name__ == "__main__":
+    main()

ops/shipdeck-bridge/gh_install.py

@@ -0,0 +1,503 @@
+# DC-131: GitHub install — clone, detect, emit Shipdeckfile, deploy, persist metadata.
+import json
+import hashlib
+import os
+import re
+import subprocess
+import sys
+
+# Imported by bridge.py (kept separate so the core bridge stays reviewable).
+import shutil
+import time
+import urllib.parse
+import urllib.request
+
+# DC-133: source server is a user choice. Any https host with /owner/repo.
+REPO_URL_RE = re.compile(
+    r"^https://([A-Za-z0-9.-]+)(?::(\d+))?/([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+?)(?:\.git)?/?$")
+GITHUB_API_HOSTS = {"github.com", "www.github.com"}
+FLEET_GITEA_HOST = os.environ.get("SHIPDECK_GITEA_HOST", "git.dashcaddy.net")
+FLEET_GITEA_TOKEN_FILE = os.environ.get("SHIPDECK_GITEA_TOKEN_FILE", "/etc/shipdeck/gitea-token")
+RESERVED_NAMES = {
+    "dashcaddy", "sec", "chat", "plex", "jellyfin", "atis", "atistest",
+    "status", "get", "get2", "mail", "sami", "moviecast", "cast", "shipdeck",
+    "src", "docs", "router", "sync", "torrent", "radarr", "sonarr", "prowlarr",
+    "portainer", "requests", "emby", "seerr", "gitea", "qdrant", "albyhub",
+}
+INSTALL_PORT_MIN, INSTALL_PORT_MAX = 8950, 8999
+INSTALL_TIMEOUT = int(os.environ.get("SHIPDECK_INSTALL_TIMEOUT", "900"))
+GH_APPS_DIR = os.environ.get("DASHCADDY_GH_APPS_DIR", "/opt/dashcaddy/dashcaddy-api/data/gh-apps")
+Q3 = chr(34) * 3
+SAFE_GO_PACKAGE_RE = re.compile(r"^(?:\.|\./[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)*)$")
+_STATE = {}
+def init_shared(re_service, repos_root, port, lock, run_fn):
+    # bridge.py calls this once at import; avoids a circular import.
+    _STATE.update(RE_SERVICE=re_service, REPOS_ROOT=repos_root,
+                  PORT=port, LOCK=lock, RUN=run_fn)
+
+
+def _used_ports():
+    used = set([_STATE['PORT']])
+    try:
+        out = subprocess.run(["ss", "-ltn"], capture_output=True, text=True, timeout=10).stdout
+        for line in out.splitlines():
+            m = re.search(r":(\d+)\s", line)
+            if m:
+                used.add(int(m.group(1)))
+    except Exception:
+        pass
+    return used
+
+
+def _pick_port():
+    used = _used_ports()
+    for p in range(INSTALL_PORT_MIN, INSTALL_PORT_MAX + 1):
+        if p not in used:
+            return p
+    return None
+
+
+def _detect_and_emit(repo_dir, service, subdomain, host_ts_ip, requested_port=None):
+    """Detect Go/Node/Python, write a Shipdeckfile, and return launch metadata."""
+    port = requested_port or _pick_port()
+    if not isinstance(port, int) or port < 1 or port > 65535:
+        raise RuntimeError("port must be 1-65535")
+    if port in _used_ports():
+        raise RuntimeError("requested port is already in use")
+
+    pkg_bin = "bin/app"
+    mode = ""
+    launch = []
+    build_cmd = ""
+    import glob as _glob
+
+    if os.path.isfile(os.path.join(repo_dir, "go.mod")):
+        main_pkg = None
+        for gf in _glob.glob(os.path.join(repo_dir, "*.go")):
+            try:
+                with open(gf, encoding="utf-8", errors="replace") as fh:
+                    if "package main" in fh.read(2048):
+                        main_pkg = "."
+                        break
+            except OSError:
+                continue
+        if main_pkg is None:
+            dirs = sorted(_glob.glob(os.path.join(repo_dir, "*")))
+            dirs += sorted(_glob.glob(os.path.join(repo_dir, "cmd", "*")))
+            for d in dirs:
+                if not os.path.isdir(d):
+                    continue
+                for gf in _glob.glob(os.path.join(d, "*.go")):
+                    try:
+                        with open(gf, encoding="utf-8", errors="replace") as fh:
+                            if "package main" in fh.read(2048):
+                                main_pkg = "./" + os.path.relpath(d, repo_dir)
+                                break
+                    except OSError:
+                        continue
+                if main_pkg:
+                    break
+        if not main_pkg:
+            raise RuntimeError("no Go main package found (module root, subdirs, or cmd/*)")
+        # main_pkg comes from repository-controlled directory names and is
+        # embedded in Shipdeck's shell build_cmd. Reject every shell metachar,
+        # whitespace byte and traversal segment before rendering it.
+        if not SAFE_GO_PACKAGE_RE.fullmatch(main_pkg) or ".." in main_pkg.split("/"):
+            raise RuntimeError("Go main package path contains unsafe characters")
+        build_cmd = "go build -buildvcs=false -o " + pkg_bin + " " + main_pkg
+        launch = ["/opt/" + service + "/current/app"]
+        mode = "go-build"
+    elif os.path.isfile(os.path.join(repo_dir, "package.json")):
+        with open(os.path.join(repo_dir, "package.json"), encoding="utf-8") as fh:
+            package = json.load(fh)
+        entry = package.get("main") or "server.js"
+        if not re.match(r"^[A-Za-z0-9][A-Za-z0-9._/-]*$", entry) or ".." in entry:
+            raise RuntimeError("package.json main is not a safe relative path")
+        pkg_bin = ".shipdeck-app"
+        build_cmd = ("npm ci && npm run build --if-present && rm -rf .shipdeck-app && "
+                     "mkdir .shipdeck-app && cp -a package.json node_modules .shipdeck-app/ && "
+                     "if [ -d dist ]; then cp -a dist .shipdeck-app/; fi && "
+                     "if [ -d src ]; then cp -a src .shipdeck-app/; fi && "
+                     "if [ -f " + entry + " ]; then mkdir -p .shipdeck-app/$(dirname " + entry + ") && cp -a " + entry + " .shipdeck-app/" + entry + "; fi")
+        launch = ["/usr/bin/node", "/opt/" + service + "/current/.shipdeck-app/" + entry]
+        mode = "node-build"
+    elif os.path.isfile(os.path.join(repo_dir, "requirements.txt")) or os.path.isfile(os.path.join(repo_dir, "pyproject.toml")):
+        entry = "app.py" if os.path.isfile(os.path.join(repo_dir, "app.py")) else "main.py"
+        if not os.path.isfile(os.path.join(repo_dir, entry)):
+            raise RuntimeError("Python repo requires app.py or main.py for automatic install")
+        pkg_bin = ".shipdeck-app"
+        install = ".venv/bin/pip install -r requirements.txt" if os.path.isfile(os.path.join(repo_dir, "requirements.txt")) else ".venv/bin/pip install ."
+        build_cmd = ("rm -rf .shipdeck-app .venv && python3 -m venv .venv && " + install +
+                     " && mkdir .shipdeck-app && cp -a .venv " + entry + " .shipdeck-app/")
+        launch = ["/opt/" + service + "/current/.shipdeck-app/.venv/bin/python", "/opt/" + service + "/current/.shipdeck-app/" + entry]
+        mode = "python-build"
+    else:
+        raise RuntimeError("no automatic recipe: expected go.mod, package.json, requirements.txt, or pyproject.toml")
+
+    nl = "\n"
+    block = subdomain + ".sami {" + nl + "\treverse_proxy 127.0.0.1:" + str(port) + nl + "}"
+    Q = chr(34)
+    cfg = (
+        "# Shipdeckfile generated by shipdeck-bridge /api/install" + nl
+        + "[service]" + nl
+        + "name = " + Q + service + Q + nl
+        + "build_cmd = " + Q + build_cmd.replace("\\", "\\\\").replace(Q, "\\" + Q) + Q + nl
+        + "binary = " + Q + pkg_bin + Q + nl
+        + nl + "[deploy]" + nl
+        + "host = " + Q + "dns2" + Q + nl
+        + "systemd_unit = " + Q + service + ".service" + Q + nl
+        + "port = " + str(port) + nl
+        + nl + "[caddy]" + nl
+        + "block = " + Q*3 + nl + block + nl + Q*3 + nl
+        + "tailnet_only = true" + nl
+        + nl + "[dns]" + nl
+        + "zone = " + Q + "sami" + Q + nl
+        + "record = " + Q + subdomain + ".sami" + Q + nl
+        + "target = " + Q + host_ts_ip + Q + nl
+        + nl + "[verify]" + nl
+        + "http = " + Q + "https://" + subdomain + ".sami/" + Q + nl
+        + "timeout = 20" + nl
+    )
+    shipdeckfile = os.path.join(repo_dir, "Shipdeckfile")
+    with open(shipdeckfile, "w") as fh:
+        fh.write(cfg)
+    return {"mode": mode, "port": port, "binary": pkg_bin, "launch": launch,
+            "shipdeckfile": shipdeckfile}
+
+# args->unit support (DC-131): optional launch args become a repo-provided
+# systemd unit so shipdeck stages + packages it like any repo unit.
+ARG_RE = re.compile(r"^[A-Za-z0-9_./=+-]+$")
+
+
+def _write_repo_unit(repo_dir, service, binary_rel, args, env=None, launcher=None):
+    """Write deploy/<service>.service with args + env baked in."""
+    unit_dir = os.path.join(repo_dir, "deploy")
+    os.makedirs(unit_dir, exist_ok=True)
+    binbase = os.path.basename(binary_rel)
+    if launcher:
+        if (not isinstance(launcher, list) or not launcher or any(
+                not isinstance(a, str) or not a or chr(10) in a or chr(13) in a
+                for a in launcher)):
+            raise ValueError("invalid detected launcher")
+        exec_line = " ".join(launcher)
+    else:
+        exec_line = "/opt/" + service + "/current/" + binbase
+    if args:
+        exec_line += " " + " ".join(args)
+    env_lines = ""
+    for k, v in sorted((env or {}).items()):
+        # gh_install validates this before shared-state mutation. Keep the
+        # helper fail-closed too: never silently drop an environment value.
+        if (not isinstance(k, str) or not isinstance(v, str)
+                or not re.match(r"^[A-Z_][A-Z0-9_]*$", k)
+                or len(v) > 300 or chr(34) in v or chr(92) in v
+                or any(ord(ch) < 32 or ord(ch) == 127 for ch in v)):
+            raise ValueError("invalid systemd environment entry: " + str(k)[:40])
+        env_lines += "Environment=" + chr(34) + k + "=" + v + chr(34) + chr(10)
+    nl = chr(10)
+    q = chr(34)
+    unit = (
+        "[Unit]" + nl
+        + "Description=" + service + " (shipdeck)" + nl
+        + "After=network-online.target" + nl
+        + "Wants=network-online.target" + nl
+        + nl + "[Service]" + nl
+        + "Type=simple" + nl
+        + "ExecStart=" + exec_line + nl
+        + env_lines
+        + "Restart=always" + nl
+        + "RestartSec=5" + nl
+        + "User=root" + nl
+        + nl + "[Install]" + nl
+        + "WantedBy=multi-user.target" + nl
+    )
+    path = os.path.join(unit_dir, service + ".service")
+    with open(path, "w") as fh:
+        fh.write(unit)
+    return path
+
+# ---- Gitea support (DC-132, 2026-09-14) ------------------------------------
+GITEA_HOST = os.environ.get("SHIPDECK_GITEA_HOST", "git.dashcaddy.net")
+GITEA_URL_RE = re.compile(
+    r"^https://" + re.escape(GITEA_HOST) + r"/([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+?)(?:\.git)?/?$")
+GITEA_TOKEN_FILE = os.environ.get("SHIPDECK_GITEA_TOKEN_FILE", "/etc/shipdeck/gitea-token")
+
+
+def _gitea_token():
+    try:
+        with open(GITEA_TOKEN_FILE) as fh:
+            return fh.read().strip()
+    except OSError:
+        return ""
+
+
+def _gitea_api(path):
+    tok = _gitea_token()
+    req = urllib.request.Request(
+        "https://" + GITEA_HOST + "/api/v1" + path,
+        headers={"Authorization": "token " + tok, "User-Agent": "shipdeck-bridge"})
+    with urllib.request.urlopen(req, timeout=15) as r:
+        return json.loads(r.read().decode("utf-8", "replace"))
+
+
+def list_repos(payload):
+    """List repos from the configured fleet Gitea only.
+
+    Arbitrary Git hosts remain valid clone sources for /api/install, but this
+    privileged bridge never turns a user-supplied host into an authenticated
+    HTTP metadata request (SSRF boundary).
+    """
+    g_url = payload.get("gitea_url")
+    token_supplied = "token" in payload
+    req_tok = payload.get("token")
+    if req_tok is not None and (not isinstance(req_tok, str)
+                                or len(req_tok) > 512):
+        # same contract as the panel proxy layer (routes/deploys.js)
+        return 400, {"ok": False, "error": "invalid token"}
+    if g_url is not None and not isinstance(g_url, str):
+        return 400, {"ok": False, "error": "gitea_url must be a string"}
+    g_url = (g_url or "").strip().rstrip("/")
+    if g_url:
+        try:
+            parsed = urllib.parse.urlparse(g_url)
+            parsed_port = parsed.port
+        except ValueError:
+            return 400, {"ok": False, "error": "invalid gitea_url"}
+        if (parsed.scheme != "https" or parsed.hostname != FLEET_GITEA_HOST
+                or parsed.username or parsed.password or parsed.path not in ("", "/")
+                or parsed.query or parsed.fragment or parsed_port not in (None, 443)):
+            return 400, {"ok": False, "error": "gitea_url must be the configured fleet Gitea host"}
+        api_base = "https://" + FLEET_GITEA_HOST + "/api/v1"
+        tok = (req_tok or "").strip()
+    else:
+        api_base = "https://" + FLEET_GITEA_HOST + "/api/v1"
+        # Omitted token = use fleet credential. Explicit empty token =
+        # anonymous, even against the fleet host (wire-level distinction).
+        tok = (req_tok or "").strip() if token_supplied else _gitea_token()
+    headers = {"User-Agent": "shipdeck-bridge"}
+    if tok:
+        headers["Authorization"] = "token " + tok
+    try:
+        req = urllib.request.Request(api_base + "/repos/search?limit=50&archived=false",
+                                     headers=headers)
+        with urllib.request.urlopen(req, timeout=15) as r:
+            repos = json.loads(r.read().decode("utf-8", "replace"))
+    except Exception as e:
+        return 502, {"ok": False, "error": "gitea API unreachable: " + str(e)[:200]}
+    host = re.match(r"https?://([^/]+)", api_base).group(1)
+    items = []
+    for repo in repos.get("data", []):
+        full = repo.get("full_name", "")
+        items.append({
+            "id": full.split("/")[-1].lower().replace("_", "-"),
+            "name": repo.get("name"),
+            "full_name": full,
+            "url": "https://" + host + "/" + full,
+            "host": host,
+            "logo": (repo.get("owner") or {}).get("avatar_url") or "",
+            "description": (repo.get("description") or "")[:120],
+        })
+    return 200, {"ok": True, "repos": items}
+
+def _http_json(url, timeout=20, headers=None):
+    h = {"User-Agent": "shipdeck-bridge"}
+    if headers:
+        h.update(headers)
+    req = urllib.request.Request(url, headers=h)
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return json.loads(r.read().decode("utf-8", "replace"))
+
+
+def _gh_env_token():
+    return os.environ.get("SHIPDECK_GH_TOKEN", "")
+
+def gh_install(payload):
+    """Clone, detect, emit Shipdeckfile, deploy, persist metadata. -> (code, body)"""
+    repo_url = payload.get("repo_url")
+    service = payload.get("service")
+    subdomain = payload.get("subdomain")
+    req_token_raw = payload.get("token")
+    token_supplied = "token" in payload
+    # Validate types BEFORE any string ops: a non-string from a direct
+    # bridge call must 400, never raise (same contract as the panel proxy).
+    if repo_url is not None and not isinstance(repo_url, str):
+        return 400, {"ok": False, "error": "repo_url must be a string"}
+    if service is not None and not isinstance(service, str):
+        return 400, {"ok": False, "error": "service must be a string"}
+    if subdomain is not None and not isinstance(subdomain, str):
+        return 400, {"ok": False, "error": "subdomain must be a string"}
+    if req_token_raw is not None and not isinstance(req_token_raw, str):
+        return 400, {"ok": False, "error": "invalid token"}
+    repo_url = repo_url or ""
+    service = (service or "").strip().lower()
+    subdomain = (subdomain or service).strip().lower()
+    req_token = (req_token_raw or "").strip()
+    m = REPO_URL_RE.match(repo_url)
+    if not m:
+        return 400, {"ok": False, "error": "repo_url must be https://host/owner/repo"}
+    rh, rport, owner, repo = m.group(1), m.group(2), m.group(3), m.group(4)
+    if len(req_token) > 512:
+        return 400, {"ok": False, "error": "token too long"}
+    if req_token and not re.match(r"^[A-Za-z0-9_.=~-]+$", req_token):
+        return 400, {"ok": False, "error": "token has unexpected characters"}
+    # metadata: GitHub API for github.com, Gitea API for anything else.
+    # Best-effort: an install can proceed even if metadata is unavailable.
+    logo_url = ""
+    name = repo
+    try:
+        if rh in GITHUB_API_HOSTS:
+            logo_url = "https://github.com/" + owner + ".png"
+            gh_headers = {}
+            gh_token = req_token if token_supplied else _gh_env_token()
+            if gh_token:
+                gh_headers["Authorization"] = "token " + gh_token
+            meta = _http_json("https://api.github.com/repos/%s/%s" % (owner, repo),
+                              headers=gh_headers)
+            name = meta.get("name") or repo
+            logo_url = (meta.get("owner") or {}).get("avatar_url") or logo_url
+        elif rh == FLEET_GITEA_HOST and rport in (None, "443"):
+            g_api = "https://" + rh + (":" + rport if rport else "") + "/api/v1"
+            g_tok = req_token if token_supplied else (
+                _gitea_token() if rh == FLEET_GITEA_HOST else "")
+            g_headers = {"Authorization": "token " + g_tok} if g_tok else {}
+            meta = _http_json(g_api + "/repos/" + owner + "/" + repo,
+                              headers=g_headers)
+            name = meta.get("name") or repo
+            logo_url = (meta.get("owner") or {}).get("avatar_url") or (
+                "https://" + rh + "/avatars/" + owner)
+        # Other HTTPS Git hosts are clone-only. Do not make an HTTP metadata
+        # request to an arbitrary user-selected host from this root service.
+    except Exception as exc:
+        # Metadata is best-effort; the install can proceed without it. Log a
+        # sanitized diagnostic (repo identity only — never token values) so
+        # failures aren't silent.
+        print("gh_install: metadata lookup failed for %s/%s on %s: %s"
+              % (owner, repo, rh, exc), file=sys.stderr)
+    # clone auth: per-request token wins; else fleet token for fleet gitea.
+    # Credentials are passed via env-based git config (GIT_CONFIG_*), which
+    # never appears in process argv (/proc/cmdline) and never lands in the
+    # clone URL, so git's own error output cannot echo the token.
+    clone_url = repo_url
+    tok = req_token if token_supplied else (
+        _gitea_token() if rh == FLEET_GITEA_HOST else "")
+    # Start from the service environment but strip inherited GIT_CONFIG_*
+    # injection. Otherwise an operator/debug environment could leak an
+    # unrelated header into an explicit-anonymous clone. Add back only the
+    # one scoped auth config constructed here.
+    clone_env = {k: v for k, v in os.environ.items()
+                 if not k.startswith("GIT_CONFIG_")}
+    clone_env["GIT_TERMINAL_PROMPT"] = "0"
+    if tok:
+        clone_env["GIT_CONFIG_COUNT"] = "1"
+        clone_env["GIT_CONFIG_KEY_0"] = "http.https://%s%s/.extraheader" % (
+            rh, ":" + rport if rport else "")
+        clone_env["GIT_CONFIG_VALUE_0"] = "Authorization: Bearer " + tok
+
+    def _scrub(text):
+        # defense-in-depth: never echo a token value back to the panel
+        return text.replace(tok, "<redacted>") if tok else text
+    if not _STATE["RE_SERVICE"].match(service):
+        return 400, {"ok": False, "error": "service must match ^[a-z0-9][a-z0-9-]{0,62}$"}
+    if service in RESERVED_NAMES or subdomain in RESERVED_NAMES:
+        return 400, {"ok": False, "error": "service name is reserved"}
+    if not _STATE["RE_SERVICE"].match(subdomain):
+        return 400, {"ok": False, "error": "invalid subdomain"}
+    target = os.path.join(_STATE["REPOS_ROOT"], "repos", "gh-" + service)
+    if os.path.exists(target):
+        return 409, {"ok": False, "error": "service dir already exists: " + target}
+    # Cheap input validation for args/env happens HERE, before the lock:
+    # a payload that was never valid must not touch shared state (no clone
+    # dir, no Shipdeckfile, no port scan). Port augmentation still happens
+    # after detection because it needs the chosen port.
+    args_cfg = payload.get("args")
+    if args_cfg is not None and (not isinstance(args_cfg, list) or any(
+            not isinstance(a, str) or not ARG_RE.match(a) or len(a) > 120
+            for a in args_cfg)):
+        return 400, { "ok": False, "error": "args must be a list of simple tokens" }
+    env_cfg = payload.get("env")
+    if env_cfg is not None and (not isinstance(env_cfg, dict) or any(
+            not isinstance(k, str) or not isinstance(v, str)
+            or not re.match(r"^[A-Z_][A-Z0-9_]*$", k)
+            or len(v) > 300 or chr(34) in v or chr(92) in v
+            or any(ord(ch) < 32 or ord(ch) == 127 for ch in v)
+            for k, v in env_cfg.items())):
+        return 400, {"ok": False, "error": (
+            "env must map valid uppercase names to strings <=300 chars "
+            "without quotes, backslashes, or control characters")}
+    requested_port = payload.get("port")
+    if requested_port is not None and (not isinstance(requested_port, int) or
+                                       isinstance(requested_port, bool) or
+                                       requested_port < 1 or requested_port > 65535):
+        return 400, {"ok": False, "error": "port must be an integer from 1 to 65535"}
+    sha_pin = payload.get("sha256")
+    if sha_pin is not None and (not isinstance(sha_pin, str) or
+                                not re.match(r"^[a-f0-9]{64}$", sha_pin)):
+        return 400, {"ok": False, "error": "sha256 must be 64 lowercase hex characters"}
+    # Serialize the shared-state window on the bridge mutation lock.
+    # Judge round-3: port selection previously ran outside the lock
+    # (ss-snapshot race between concurrent installs). Now clone, port
+    # choice, file writes and deploy all run under the lock, so a
+    # concurrent install's ss scan sees the ports the previous install
+    # already bound — allocation is serialized, not racy.
+    with _STATE['LOCK']:
+        t0 = time.time()
+
+        clone = subprocess.run(
+            ["git", "clone", "--depth", "1", "--single-branch", clone_url, target],
+            capture_output=True, text=True, timeout=180,
+            env=clone_env)
+        if clone.returncode != 0:
+            shutil.rmtree(target, ignore_errors=True)
+            return 400, {"ok": False,
+                         "error": "clone failed: " + _scrub((clone.stderr or ""))[-400:]}
+        if sha_pin:
+            archived = subprocess.run(
+                ["git", "-C", target, "archive", "--format=tar", "HEAD"],
+                capture_output=True, timeout=60)
+            if archived.returncode != 0:
+                shutil.rmtree(target, ignore_errors=True)
+                return 400, {"ok": False, "error": "could not hash cloned source"}
+            actual_sha = hashlib.sha256(archived.stdout).hexdigest()
+            if actual_sha != sha_pin:
+                shutil.rmtree(target, ignore_errors=True)
+                return 400, {"ok": False, "error": "source sha256 mismatch"}
+        try:
+            ts = subprocess.run(["tailscale", "ip", "-4"], capture_output=True,
+                                text=True, timeout=10).stdout.split()
+            host_ts_ip = ts[0] if ts else ""
+            det = _detect_and_emit(target, service, subdomain, host_ts_ip, requested_port)
+        except Exception as e:
+            shutil.rmtree(target, ignore_errors=True)
+            return 400, {"ok": False, "error": str(e)[:400]}
+        args = payload.get("args") or []
+        # align the listen port with the deployed caddy target unless the
+        # caller supplied one
+        has_listen = any(a.lower().lstrip("-").startswith("listen") or a.lower().lstrip("-").startswith("addr") for a in args)
+        if not has_listen and det.get("port"):
+            args = args + ["-listen", "127.0.0.1:" + str(det["port"])]
+        env_cfg = payload.get("env") or {}
+        env_out = {str(k): str(v) for k, v in (env_cfg or {}).items()}
+        if det.get("port"):
+            env_out.setdefault("PORT", str(det["port"]))
+        _write_repo_unit(target, service, det.get("binary", "bin/app"), args,
+                         env_out, det.get("launch"))
+
+        code, out = _STATE["RUN"](["deploy", target], INSTALL_TIMEOUT)
+        if code != 0:
+            return 500, {"ok": False, "error": "deploy failed", "output": out[-4000:], "dir": target}
+        info = {
+            "id": service, "name": name, "repo_url": repo_url,
+            "subdomain": subdomain, "url": "https://%s.sami" % subdomain,
+            "logo": logo_url, "mode": det.get("mode"), "port": det.get("port"),
+            "dir": target, "installed_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            "shipdeckfile": "/var/lib/shipdeck/services/" + service + "/Shipdeckfile",
+            "journal_row_id": service + ":" + str(int(time.time())),
+            "deploy_seconds": round(time.time() - t0, 1),
+        }
+        try:
+            os.makedirs(GH_APPS_DIR, exist_ok=True)
+            with open(os.path.join(GH_APPS_DIR, service + ".json"), "w") as f:
+                json.dump(info, f, indent=1)
+        except OSError:
+            pass
+        return 200, {"ok": True, "service": info, "output": out[-2000:]}

ops/shipdeck-bridge/image_install.py

@@ -0,0 +1,103 @@
+"""Validated OCI image installs for shipdeck-bridge."""
+import json
+import os
+import re
+import shutil
+import subprocess
+import time
+
+RE_SERVICE = re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$")
+RE_IMAGE = re.compile(r"^(?:[A-Za-z0-9][A-Za-z0-9.-]*(?::[0-9]{1,5})?/)?[A-Za-z0-9][A-Za-z0-9._/-]*(?::[A-Za-z0-9][A-Za-z0-9._-]{0,127}|@sha256:[a-f0-9]{64})$")
+RE_SHA = re.compile(r"^[a-f0-9]{64}$")
+RE_ENV = re.compile(r"^[A-Z_][A-Z0-9_]*$")
+RE_USER = re.compile(r"^[A-Za-z0-9_][A-Za-z0-9_.-]*(?::[A-Za-z0-9_][A-Za-z0-9_.-]*)?$")
+RE_CMD0 = re.compile(r"^/?[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$")
+RESTARTS = {"no", "always", "unless-stopped", "on-failure"}
+DRAFT_ROOT = os.environ.get("SHIPDECK_IMAGE_DRAFTS", "/var/lib/shipdeck/drafts")
+_STATE = {}
+
+
+def init_shared(lock, run_fn):
+    _STATE.update(LOCK=lock, RUN=run_fn)
+
+
+def _q(value):
+    return json.dumps(value, ensure_ascii=True)
+
+
+def install_image(payload):
+    image = payload.get("image")
+    name = payload.get("name")
+    subdomain = payload.get("subdomain")
+    port = payload.get("port")
+    sha = payload.get("sha256")
+    env = payload.get("env") or {}
+    mounts = payload.get("mounts") or []
+    user = payload.get("user") or ""
+    restart = payload.get("restart") or "unless-stopped"
+    cmd = payload.get("cmd") or []
+    if not isinstance(image, str) or not RE_IMAGE.match(image): return 400, {"ok": False, "error": "invalid image"}
+    if not isinstance(name, str) or not RE_SERVICE.match(name): return 400, {"ok": False, "error": "invalid service name"}
+    if not isinstance(subdomain, str) or not RE_SERVICE.match(subdomain): return 400, {"ok": False, "error": "invalid subdomain"}
+    if not isinstance(port, int) or isinstance(port, bool) or not 1 <= port <= 65535: return 400, {"ok": False, "error": "invalid port"}
+    if sha is not None and (not isinstance(sha, str) or not RE_SHA.match(sha)): return 400, {"ok": False, "error": "invalid sha256"}
+    if user and (not isinstance(user, str) or not RE_USER.match(user)): return 400, {"ok": False, "error": "invalid user"}
+    if restart not in RESTARTS: return 400, {"ok": False, "error": "invalid restart"}
+    if not isinstance(env, dict) or any(not isinstance(k, str) or not isinstance(v, str) or not RE_ENV.match(k) or len(v) > 300 or any(ord(c) < 32 or ord(c) == 127 for c in v) or '"' in v or '\\' in v for k, v in env.items()): return 400, {"ok": False, "error": "invalid env"}
+    if not isinstance(cmd, list) or len(cmd) > 64 or any(not isinstance(v, str) or not v or len(v) > 1024 or any(c in v for c in "\x00\r\n") for v in cmd): return 400, {"ok": False, "error": "invalid cmd"}
+    if cmd and not RE_CMD0.match(cmd[0]): return 400, {"ok": False, "error": "invalid cmd executable"}
+    if not isinstance(mounts, list) or len(mounts) > 32: return 400, {"ok": False, "error": "invalid mounts"}
+    clean_mounts = []
+    for mount in mounts:
+        if not isinstance(mount, dict): return 400, {"ok": False, "error": "invalid mount"}
+        source, target = mount.get("source"), mount.get("target")
+        if not isinstance(source, str) or not isinstance(target, str) or not source.startswith("/") or not target.startswith("/") or ".." in source or ".." in target or not re.match(r"^/[A-Za-z0-9._/-]+$", source + target): return 400, {"ok": False, "error": "invalid mount path"}
+        if mount.get("read_only") not in (None, True, False): return 400, {"ok": False, "error": "invalid mount mode"}
+        clean_mounts.append({"source": source, "target": target, "read_only": mount.get("read_only") is True})
+
+    with _STATE["LOCK"]:
+        pull_args = ["pull", "--json"]
+        if sha: pull_args += ["--sha256", sha]
+        pull_args.append(image)
+        code, pull_out = _STATE["RUN"](pull_args, 900)
+        if code != 0: return 500, {"ok": False, "error": "image pull failed", "output": pull_out[-4000:]}
+        try:
+            pulled = json.loads(pull_out)
+            digest = pulled["digest"]
+            if not re.match(r"^sha256:[a-f0-9]{64}$", digest): raise ValueError("bad digest")
+            pin = digest.split(":", 1)[1]
+            if not cmd:
+                image_cfg = (pulled.get("config") or {}).get("config") or {}
+                cmd = list(image_cfg.get("Entrypoint") or []) + list(image_cfg.get("Cmd") or [])
+        except (ValueError, KeyError, TypeError):
+            return 500, {"ok": False, "error": "shipdeck pull returned invalid metadata"}
+        if not cmd or not RE_CMD0.match(cmd[0]):
+            return 400, {"ok": False, "error": "image has no safe default command; provide cmd"}
+        ts = subprocess.run(["tailscale", "ip", "-4"], capture_output=True, text=True, timeout=10).stdout.split()
+        if not ts: return 500, {"ok": False, "error": "could not determine fleet host Tailscale IP"}
+        draft = os.path.join(DRAFT_ROOT, name)
+        if os.path.exists(draft): shutil.rmtree(draft)
+        os.makedirs(draft, mode=0o700, exist_ok=False)
+        lines = [
+            "# Generated by shipdeck-bridge; immutable manifest pin.", "[service]",
+            "name = " + _q(name), "binary = " + _q(cmd[0] if cmd else "/bin/sh"), "",
+            "[source]", "image = " + _q(image), "sha256 = " + _q(pin), "",
+            "[deploy]", 'host = "dns2"', "systemd_unit = " + _q(name + ".service"),
+            "port = " + str(port), "", "[runtime]", "user = " + _q(user),
+            "restart = " + _q(restart), "cmd = " + _q(cmd), "",
+        ]
+        if env:
+            lines.append("[env]")
+            lines.extend(k + " = " + _q(v) for k, v in sorted(env.items()))
+            lines.append("")
+        for mount in clean_mounts:
+            lines += ["[[volumes]]", "source = " + _q(mount["source"]), "target = " + _q(mount["target"]), "read_only = " + ("true" if mount["read_only"] else "false"), ""]
+        lines += ["[caddy]", 'block = """', subdomain + ".sami {", "\treverse_proxy 127.0.0.1:" + str(port), "}", '"""', "tailnet_only = true", "", "[dns]", 'zone = "sami"', "record = " + _q(subdomain + ".sami"), "target = " + _q(ts[0]), "", "[verify]", "http = " + _q("https://" + subdomain + ".sami/"), "timeout = 30", ""]
+        path = os.path.join(draft, "Shipdeckfile")
+        with open(path, "w", encoding="utf-8") as fh: fh.write("\n".join(lines))
+        os.chmod(path, 0o600)
+        code, out = _STATE["RUN"](["deploy", draft], 900)
+        if code != 0: return 500, {"ok": False, "error": "image deploy failed", "output": out[-4000:]}
+        installed_path = "/var/lib/shipdeck/services/" + name + "/Shipdeckfile"
+        row_id = name + ":" + str(int(time.time()))
+        return 200, {"ok": True, "service": {"name": name, "image": image + "@sha256:" + pin, "port": port, "shipdeckfile": installed_path, "journal_row_id": row_id}, "output": out[-2000:]}

ops/shipdeck-bridge/shipdeck-bridge.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=shipdeck-bridge — token-gated HTTP wrapper for the shipdeck CLI (DashCaddy deploys panel)
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /opt/shipdeck-bridge/bridge.py
+Environment=SHIPDECK_BIN=/usr/local/bin/shipdeck
+Environment=SHIPDECK_BRIDGE_TOKEN_FILE=/etc/shipdeck/bridge-token
+Environment=SHIPDECK_REPOS_ROOT=/root
+Environment=SHIPDECK_BRIDGE_PORT=8977
+Restart=on-failure
+RestartSec=3
+# root: needs the ssh keys + fleet-dns that shipdeck orchestrates
+User=root
+
+[Install]
+WantedBy=multi-user.target

ops/shipdeck-bridge/test_fleet_ops.py

@@ -0,0 +1,115 @@
+import json
+import os
+import tempfile
+import unittest
+from unittest import mock
+
+import gh_install
+import image_install
+import bridge
+
+
+class FleetOpsTests(unittest.TestCase):
+    def test_empty_bridge_token_fails_closed(self):
+        with mock.patch("builtins.open", mock.mock_open(read_data="  \n")):
+            with self.assertRaisesRegex(RuntimeError, "refusing to start unauthenticated"):
+                bridge.read_token()
+
+    def test_detects_go_node_python_at_requested_port(self):
+        gh_install._STATE.update(PORT=8977)
+        with mock.patch.object(gh_install, "_used_ports", return_value={8977}):
+            cases = {
+                "go": {"go.mod": "module x\n", "main.go": "package main\nfunc main(){}\n"},
+                "node": {"package.json": json.dumps({"main": "server.js"}), "server.js": ""},
+                "python": {"requirements.txt": "", "app.py": ""},
+            }
+            for i, (kind, files) in enumerate(cases.items()):
+                with tempfile.TemporaryDirectory() as d:
+                    for name, body in files.items():
+                        with open(os.path.join(d, name), "w", encoding="utf-8") as fh: fh.write(body)
+                    got = gh_install._detect_and_emit(d, "demo-" + kind, "demo-" + kind, "100.121.150.22", 8100 + i)
+                    self.assertEqual(got["port"], 8100 + i)
+                    self.assertTrue(got["mode"].startswith(kind))
+                    self.assertTrue(os.path.isfile(got["shipdeckfile"]))
+
+    def test_rejects_repository_controlled_go_package_shell_metachars(self):
+        gh_install._STATE.update(PORT=8977)
+        with tempfile.TemporaryDirectory() as d, mock.patch.object(
+                gh_install, "_used_ports", return_value={8977}):
+            os.mkdir(os.path.join(d, "cmd;touch-pwned"))
+            with open(os.path.join(d, "go.mod"), "w", encoding="utf-8") as fh:
+                fh.write("module x\n")
+            with open(os.path.join(d, "cmd;touch-pwned", "main.go"), "w", encoding="utf-8") as fh:
+                fh.write("package main\nfunc main(){}\n")
+            with self.assertRaisesRegex(RuntimeError, "unsafe characters"):
+                gh_install._detect_and_emit(d, "demo", "demo", "100.121.150.22", 8100)
+
+    def test_gitea_repo_listing_rejects_arbitrary_hosts_before_http(self):
+        with mock.patch("gh_install.urllib.request.urlopen") as urlopen:
+            code, body = gh_install.list_repos({"gitea_url": "https://127.0.0.1"})
+        self.assertEqual(code, 400)
+        self.assertIn("configured fleet Gitea", body["error"])
+        urlopen.assert_not_called()
+
+    def test_unknown_git_host_skips_metadata_http_but_remains_cloneable(self):
+        payload = {"repo_url": "https://code.example/owner/repo", "service": "demo"}
+        lock = mock.MagicMock()
+        lock.__enter__ = mock.Mock()
+        lock.__exit__ = mock.Mock(return_value=False)
+        gh_install._STATE.update(RE_SERVICE=gh_install.re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$"),
+                                 REPOS_ROOT="/tmp", PORT=8977, LOCK=lock, RUN=mock.Mock())
+        with mock.patch("gh_install._http_json") as http_json, mock.patch(
+                "gh_install.os.path.exists", return_value=True):
+            code, _ = gh_install.gh_install(payload)
+        self.assertEqual(code, 409)
+        http_json.assert_not_called()
+
+    def test_git_token_is_env_only_never_clone_url_or_error(self):
+        secret = "ghp_private_secret"
+        lock = mock.MagicMock()
+        lock.__enter__ = mock.Mock()
+        lock.__exit__ = mock.Mock(return_value=False)
+        with tempfile.TemporaryDirectory() as root:
+            gh_install._STATE.update(RE_SERVICE=gh_install.re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$"),
+                                     REPOS_ROOT=root, PORT=8977, LOCK=lock, RUN=mock.Mock())
+            failed = mock.Mock(returncode=1, stdout="", stderr="clone rejected " + secret)
+            with mock.patch.object(gh_install, "_http_json", return_value={"name": "repo", "owner": {}}), mock.patch(
+                    "gh_install.subprocess.run", return_value=failed) as run:
+                code, body = gh_install.gh_install({"repo_url": "https://github.com/acme/repo", "service": "demo", "token": secret})
+        self.assertEqual(code, 400)
+        argv = run.call_args.args[0]
+        env = run.call_args.kwargs["env"]
+        self.assertEqual(argv[-2], "https://github.com/acme/repo")
+        self.assertNotIn(secret, " ".join(argv))
+        self.assertIn(secret, env["GIT_CONFIG_VALUE_0"])
+        self.assertNotIn(secret, json.dumps(body))
+
+    def test_image_install_pins_digest_and_never_returns_env_secret(self):
+        digest = "a" * 64
+        pull = {"digest": "sha256:" + digest, "config": {"config": {"Entrypoint": [], "Cmd": ["/bin/app"]}}}
+        calls = []
+        def run(args, timeout):
+            calls.append(args)
+            return (0, json.dumps(pull)) if args[0] == "pull" else (0, "DEPLOYED")
+        image_install.init_shared(mock.MagicMock(), run)
+        image_install._STATE["LOCK"].__enter__ = mock.Mock()
+        image_install._STATE["LOCK"].__exit__ = mock.Mock(return_value=False)
+        payload = {"image": "alpine:3.20", "name": "demo", "subdomain": "demo", "port": 8080, "env": {"API_TOKEN": "private-value"}}
+        with tempfile.TemporaryDirectory() as drafts, mock.patch.object(image_install, "DRAFT_ROOT", drafts), mock.patch("image_install.subprocess.run") as sp:
+            sp.return_value.stdout = "100.121.150.22\n"
+            code, body = image_install.install_image(payload)
+        self.assertEqual(code, 200)
+        self.assertNotIn("private-value", json.dumps(body))
+        self.assertEqual(calls[0][:2], ["pull", "--json"])
+        self.assertEqual(calls[1][0], "deploy")
+        self.assertIn("@sha256:" + digest, body["service"]["image"])
+
+    def test_image_install_rejects_traversal_before_pull(self):
+        run = mock.Mock()
+        image_install.init_shared(mock.MagicMock(), run)
+        code, _ = image_install.install_image({"image": "alpine:3.20", "name": "demo", "subdomain": "demo", "port": 8080, "mounts": [{"source": "/tmp/../etc", "target": "/data"}]})
+        self.assertEqual(code, 400)
+        run.assert_not_called()
+
+
+if __name__ == "__main__": unittest.main()

status/js/core/service-create.js

@@ -121,6 +121,8 @@
     if (modalContent) modalContent.scrollTop = 0;
 
     document.body.style.overflow = 'hidden';
+    const createButton = document.getElementById('add-service-create');
+    if (createButton) { createButton.textContent = 'Deploy with Shipdeck'; createButton.disabled = false; }
 
     // Set smart SSL default
     const sslSelect = document.getElementById('ssl-type-select');
@@ -170,14 +172,17 @@
     const tabExternal = document.getElementById('tab-external');
 
     function switchServiceType() {
+      const createButton = document.getElementById('add-service-create');
       if (localRadio.checked) {
         localConfig.style.display = 'grid';
         externalConfig.style.display = 'none';
+        if (createButton) createButton.textContent = 'Deploy with Shipdeck';
         if (tabLocal) { tabLocal.style.background = 'var(--accent)'; tabLocal.style.color = 'var(--bg)'; }
         if (tabExternal) { tabExternal.style.background = 'transparent'; tabExternal.style.color = 'var(--muted)'; }
       } else {
         localConfig.style.display = 'none';
         externalConfig.style.display = 'block';
+        if (createButton) createButton.textContent = 'Create Service';
         if (tabExternal) { tabExternal.style.background = 'var(--accent)'; tabExternal.style.color = 'var(--bg)'; }
         if (tabLocal) { tabLocal.style.background = 'transparent'; tabLocal.style.color = 'var(--muted)'; }
       }
@@ -389,8 +394,17 @@
     document.getElementById('service-name-input').value = '';
     document.getElementById('service-subdomain-input').value = '';
     document.getElementById('service-port-input').value = '';
-    document.getElementById('service-ip-input').value = QUICK_IPS.lan || '';
+    document.getElementById('service-ip-input').value = 'localhost';
     document.getElementById('service-logo-input').value = '';
+    document.getElementById('service-source-url').value = '';
+    document.getElementById('service-sha256-input').value = '';
+    document.getElementById('service-git-token').value = '';
+    const deployStatus = document.getElementById('shipdeck-deploy-status');
+    if (deployStatus) deployStatus.textContent = '';
+    const shipdeckPreview = document.getElementById('shipdeckfile-preview');
+    if (shipdeckPreview) shipdeckPreview.removeAttribute('open');
+    const shipdeckContent = document.getElementById('shipdeckfile-content');
+    if (shipdeckContent) shipdeckContent.textContent = 'Deploy the service to render its immutable Shipdeckfile.';
     document.getElementById('dns-ttl-input').value = DC.DEFAULTS.TTL;
     document.getElementById('ssl-type-select').value = getSmartSslDefault();
     document.getElementById('ca-name-input').value = '';
@@ -438,124 +452,88 @@
     if (tabExternal) { tabExternal.style.background = 'transparent'; tabExternal.style.color = 'var(--muted)'; }
   }
 
-  // ===== CREATE NEW SERVICE =====
+  // ===== DEPLOY LOCAL SOURCE WITH SHIPDECK =====
+
+  async function loadShipdeckfile(name) {
+    const content = document.getElementById('shipdeckfile-content');
+    if (!name) {
+      if (content) content.textContent = 'Enter a service name, then deploy to render its immutable Shipdeckfile.';
+      return;
+    }
+    if (content) content.textContent = 'Loading Shipdeckfile\u2026';
+    try {
+      const response = await secureFetch(`/api/v1/fleet/shipdeckfile?id=${encodeURIComponent(name)}`);
+      const result = await response.json();
+      if (!response.ok || !result.success) throw new Error(result.error || 'Shipdeckfile is not available yet');
+      if (content) content.textContent = result.shipdeckfile;
+    } catch (error) {
+      if (content) content.textContent = error.message;
+    }
+  }
 
   async function createNewService() {
-    const name = document.getElementById('service-name-input').value.trim();
-    const subdomain = (document.getElementById('service-subdomain-input').value.trim() || deriveSubdomain(name)).toLowerCase();
-    const port = document.getElementById('service-port-input').value.trim();
-    const ip = document.getElementById('service-ip-input').value.trim();
+    const nameLabel = document.getElementById('service-name-input').value.trim();
+    const name = deriveSubdomain(nameLabel);
+    const subdomain = document.getElementById('service-subdomain-input').value.trim().toLowerCase();
+    const port = Number(document.getElementById('service-port-input').value);
+    const repoUrl = document.getElementById('service-source-url').value.trim();
+    const sha256 = document.getElementById('service-sha256-input').value.trim().toLowerCase();
+    const token = document.getElementById('service-git-token').value;
+    const ip = document.getElementById('service-ip-input').value.trim() || 'localhost';
     const logo = document.getElementById('service-logo-input').value.trim();
-    const createDns = document.getElementById('create-dns-record').checked;
-    const ttl = parseInt(document.getElementById('dns-ttl-input').value) || DC.DEFAULTS.TTL;
-    const tailscaleOnly = document.getElementById('manual-tailscale-only')?.checked || false;
+    const button = document.getElementById('add-service-create');
+    const status = document.getElementById('shipdeck-deploy-status');
 
-    const sslType = document.getElementById('ssl-type-select')?.value || 'caddy-managed';
-    const caName = document.getElementById('ca-name-input')?.value || '';
-    const existingCa = document.getElementById('existing-ca-select')?.value || '';
-    const enableAuth = document.getElementById('enable-auth')?.checked || false;
-    const enableCors = document.getElementById('enable-cors')?.checked || false;
-    const customHeaders = document.getElementById('custom-headers-input')?.value || '';
-    const upstreamPath = document.getElementById('upstream-path-input')?.value || '/';
-    const healthCheck = document.getElementById('health-check-input')?.value || '';
-    const timeout = document.getElementById('timeout-input')?.value || 30;
-
-    // Category is optional — pulled from either local or external select by the
-    // openAddServiceModal reset. If user doesn't choose one, it stays undefined
-    // and we don't send it (so the backend keeps the existing behavior).
-    const categoryEl = document.getElementById('service-category-input')
-      || document.getElementById('external-service-category');
-    const category = categoryEl?.value || '';
-
-    const dnsToken = window.getToken(getPrimaryDnsId(), 'admin');
-
-    if (!name || !port || !ip) {
-      showNotification('Please fill in Name, Port, and IP Address', 'warning');
+    if (!nameLabel || !name || !subdomain || !Number.isInteger(port) || port < 1 || port > 65535 || !repoUrl) {
+      showNotification('Name, Subdomain, Port, and Source URL are required.', 'warning');
+      return;
+    }
+    if (!/^https:\/\/[A-Za-z0-9.-]+(?::\d{1,5})?\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?\/?$/.test(repoUrl)) {
+      showNotification('Source URL must be a GitHub, Gitea, or Git HTTPS URL.', 'warning');
+      return;
+    }
+    if (sha256 && !/^[a-f0-9]{64}$/.test(sha256)) {
+      showNotification('Sha256 pin must be 64 lowercase hex characters.', 'warning');
       return;
     }
 
-    if (!subdomain) {
-      showNotification('Could not derive subdomain from name. Please set one in Options.', 'warning');
-      return;
-    }
-
-    if (createDns && !dnsToken) {
-      showNotification('DNS Admin token required. Configure it in the Tokens menu first.', 'warning');
-      return;
-    }
-
-    const results = { dns: null, caddy: null, dashboard: false };
-
+    const original = button.textContent;
+    let deployed = false;
+    button.disabled = true;
+    button.textContent = 'Building\u2026';
+    if (status) status.textContent = 'Building';
     try {
-      if (createDns) {
-        try {
-          await window.createDnsRecord(subdomain, ip, ttl);
-          results.dns = 'created';
-        } catch (error) {
-          console.error('DNS creation failed:', error);
-          results.dns = error.message;
-          throw new Error(`DNS creation failed: ${error.message}`);
-        }
-      } else {
-        results.dns = 'skipped';
-      }
-
-      const caddyConfig = window.generateCaddyConfig({
-        subdomain, port, ip, sslType, caName, existingCa,
-        enableAuth, enableCors, customHeaders, upstreamPath, healthCheck, timeout, tailscaleOnly
+      const payload = { repo_url: repoUrl, name, subdomain, port };
+      if (sha256) payload.sha256 = sha256;
+      if (token) payload.token = token;
+      const response = await secureFetch('/api/v1/fleet/from-git', {
+        method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload)
       });
-
-      try {
-        const caddyResponse = await secureFetch('/api/v1/site', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            domain: buildDomain(subdomain),
-            upstream: `${ip}:${port}`,
-            config: caddyConfig
-          })
-        });
-
-        const caddyResult = await caddyResponse.json();
-        if (caddyResult.success) {
-          results.caddy = 'added & reloaded';
-        } else {
-          console.error('Caddy configuration failed:', caddyResult.error);
-          results.caddy = caddyResult.error || 'failed';
-          throw new Error(`Caddy configuration failed: ${caddyResult.error}`);
-        }
-      } catch (error) {
-        console.error('Caddy API error:', error);
-        results.caddy = error.message;
-        throw new Error(`Caddy API error: ${error.message}`);
-      }
-
-      const serviceConfig = {
-        name, subdomain, port, ip,
-        logo: logo || `/assets/${subdomain}.png`,
-        tailscaleOnly: tailscaleOnly || false
-      };
-      // Only include category if user actually picked one
-      if (category) serviceConfig.category = category;
-
-      await window.addServiceToConfig(serviceConfig);
-      results.dashboard = true;
-
-      const statusParts = [
-        `DNS: ${results.dns === 'created' ? '\u2713' : results.dns === 'skipped' ? '\u25CB' : '\u2717'}`,
-        `Caddy: ${results.caddy === 'added & reloaded' ? '\u2713' : '\u2717'}`,
-        `Dashboard: ${results.dashboard ? '\u2713' : '\u2717'}`
-      ];
-      showNotification(`Service "${name}" created! ${statusParts.join(' | ')} \u2014 ${buildServiceUrl(subdomain)}${tailscaleOnly ? ' (Tailscale)' : ''}`, 'success', 6000);
-
-      closeAddServiceModal();
-
+      button.textContent = 'Deploying\u2026';
+      if (status) status.textContent = 'Building \u2192 Deploying';
+      const result = await response.json();
+      if (!response.ok || !result.success) throw new Error(result.error || 'Shipdeck deployment failed');
+      const service = { ...result.service, name: nameLabel, ip, logo: logo || result.service.logo };
+      // /fleet/from-git has already committed this card through the API's
+      // servicesStateManager. Only mirror it in this page's in-memory model;
+      // a second /services write here would race and could overwrite peers.
+      const existing = window.APPS.findIndex(app => app.id === service.id);
+      if (existing >= 0) window.APPS[existing] = { ...window.APPS[existing], ...service };
+      else window.APPS.push(service);
+      await loadShipdeckfile(name);
+      if (status) status.textContent = `Building \u2192 Deploying \u2192 Live \u00b7 journal ${result.journal_row_id || 'recorded'}`;
+      button.textContent = 'Live';
+      deployed = true;
       window.buildGrid();
       window.refreshAll();
-
+      showNotification(`Service "${nameLabel}" is live at ${buildServiceUrl(subdomain)} \u00b7 journal ${result.journal_row_id || 'recorded'}`, 'success', 7000);
     } catch (error) {
-      console.error('Error creating service:', error);
-      showNotification(`Error creating "${name}": ${error.message}`, 'error', 6000);
+      if (status) status.textContent = `Deployment failed: ${error.message}`;
+      showNotification(`Shipdeck deployment failed: ${error.message}`, 'error', 7000);
+    } finally {
+      document.getElementById('service-git-token').value = '';
+      button.disabled = deployed;
+      if (button.textContent !== 'Live') button.textContent = original;
     }
   }
 
@@ -571,6 +549,11 @@
       createNewService();
     }
   });
+  document.getElementById('shipdeckfile-preview')?.addEventListener('toggle', (event) => {
+    if (event.target.open) {
+      loadShipdeckfile(deriveSubdomain(document.getElementById('service-name-input')?.value || ''));
+    }
+  });
 
   setupServiceTypeSwitching();
   setupAutoSubdomain();

status/js/core/service-modals.js

@@ -162,36 +162,53 @@
 
         <div class="grid-2col">
           <div>
-            <label for="service-port-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Port</label>
-            <input type="number" id="service-port-input" placeholder="e.g., 8096" style="font-size: 1rem;" />
+            <label for="service-subdomain-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Subdomain</label>
+            <input type="text" id="service-subdomain-input" placeholder="auto-derived from name" required />
           </div>
           <div>
-            <label for="service-ip-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">IP Address</label>
-            <input type="text" id="service-ip-input" placeholder="Auto-detected" style="font-size: 1rem;" />
-            <div class="quick-ip-buttons" style="display: flex; gap: 4px; margin-top: 4px; flex-wrap: wrap;">
-              <button type="button" class="quick-ip-btn" data-ip="127.0.0.1" title="Localhost" style="font-size: 0.7rem; padding: 2px 6px;">localhost</button>
-              <button type="button" class="quick-ip-btn" data-ip="" id="quick-ip-lan" title="LAN IP" style="font-size: 0.7rem; padding: 2px 6px;">LAN</button>
-              <button type="button" class="quick-ip-btn" data-ip="" id="quick-ip-tailscale" title="Tailscale IP" style="font-size: 0.7rem; padding: 2px 6px;">Tailscale</button>
-            </div>
+            <label for="service-port-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Port</label>
+            <input type="number" id="service-port-input" placeholder="e.g., 8096" min="1" max="65535" required style="font-size: 1rem;" />
           </div>
         </div>
 
+        <div>
+          <label for="service-source-url" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Source URL</label>
+          <input type="url" id="service-source-url" placeholder="https://github.com/owner/repo" required style="font-size: 1rem;" />
+        </div>
+
+        <div class="grid-2col">
+          <div>
+            <label for="service-sha256-input">Sha256 pin (optional)</label>
+            <input type="text" id="service-sha256-input" maxlength="64" autocomplete="off" placeholder="64 lowercase hex characters" />
+          </div>
+          <div>
+            <label for="service-git-token">Token (optional)</label>
+            <input type="password" id="service-git-token" maxlength="512" autocomplete="off" placeholder="Private repositories" />
+          </div>
+        </div>
+
+        <div class="grid-2col">
+          <div>
+            <label for="service-ip-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Deployed Host / IP</label>
+            <input type="text" id="service-ip-input" value="localhost" placeholder="localhost" style="font-size: 1rem;" />
+          </div>
+          <div>
+            <label for="service-logo-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Logo URL</label>
+            <input type="text" id="service-logo-input" placeholder="/assets/name.png" />
+          </div>
+        </div>
+
+        <details id="shipdeckfile-preview">
+          <summary id="shipdeckfile-toggle" style="cursor: pointer; color: var(--accent); font-size: 0.8rem; user-select: none;">Show Shipdeckfile</summary>
+          <pre id="shipdeckfile-content" style="white-space: pre-wrap; max-height: 220px; overflow: auto; font-size: 0.72rem; background: var(--card-bg); padding: 10px; border-radius: 6px;">Deploy the service to render its immutable Shipdeckfile.</pre>
+        </details>
+        <div id="shipdeck-deploy-status" aria-live="polite" style="font-size: 0.78rem; color: var(--accent); min-height: 1.2em;"></div>
+
         <!-- Options (collapsed by default) -->
         <details id="local-advanced-options">
           <summary style="cursor: pointer; color: var(--accent); font-size: 0.8rem; user-select: none;">Options</summary>
           <div style="margin-top: 10px; display: grid; gap: 10px; font-size: 0.8rem;">
 
-            <div class="grid-2col">
-              <div>
-                <label for="service-subdomain-input">Subdomain:</label>
-                <input type="text" id="service-subdomain-input" placeholder="auto-derived from name" />
-              </div>
-              <div>
-                <label for="service-logo-input">Logo URL:</label>
-                <input type="text" id="service-logo-input" placeholder="/assets/name.png" />
-              </div>
-            </div>
-
             <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 8px; align-items: start;">
               <label style="display: flex; align-items: center; gap: 6px; cursor: pointer;">
                 <input type="checkbox" id="create-dns-record" checked />

status/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'dashcaddy-shell-31798d1d47';
+const CACHE = 'dashcaddy-shell-81f570ab9f';
 const PRECACHE = [
   '/',
   '/index.html',

status/tests/shipdeck-manual-add.test.js

@@ -0,0 +1,29 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const modal = fs.readFileSync(path.join(__dirname, '../js/core/service-modals.js'), 'utf8');
+const flow = fs.readFileSync(path.join(__dirname, '../js/core/service-create.js'), 'utf8');
+const bundle = fs.readFileSync(path.join(__dirname, '../dist/core.js'), 'utf8');
+
+test('Add Service keeps Local and External tabs and adds Shipdeck fields', () => {
+  for (const id of ['service-type-local', 'service-type-external', 'service-name-input', 'service-subdomain-input', 'service-port-input', 'service-source-url', 'service-sha256-input', 'service-git-token', 'service-ip-input', 'service-logo-input', 'shipdeckfile-preview']) {
+    assert.match(modal, new RegExp(`id=["']${id}["']`), id);
+  }
+  assert.match(modal, /id="service-git-token"[^>]*type="password"|type="password"[^>]*id="service-git-token"/);
+});
+
+test('Local deployment calls fleet route and renders lifecycle status', () => {
+  assert.match(flow, /secureFetch\('\/api\/v1\/fleet\/from-git'/);
+  assert.match(flow, /\/api\/v1\/fleet\/shipdeckfile\?id=/);
+  assert.match(flow, /Building.*Deploying.*Live/s);
+  assert.match(flow, /service-git-token'\)\.value = ''/);
+});
+
+test('External service flow remains present and unchanged in the bundle', () => {
+  assert.match(flow, /async function createExternalService/);
+  assert.match(flow, /\/api\/v1\/site\/external/);
+  assert.match(bundle, /\/api\/v1\/fleet\/from-git/);
+  assert.match(bundle, /\/api\/v1\/site\/external/);
+});