fix(setup): scope the compose port skip to published ports; print both k8s forwards

Review round on #5964:

- ensureComposePortsFree skipped conflict handling whenever the project had any container running, so leftover db/redis (which publish neither app port) waved through a foreign process on :3000 — it then surfaced as a raw compose bind error instead of the prompt. Read the host ports the project actually publishes and skip only those; the remaining ports still get the full check. Reading from the containers rather than the file matters because what counts is what is bound right now.
- The post-install note and the skip path documented only the app forward, while offerPortForward runs two. Skipping the prompt or copying the printed command left the editor's socket dead — the exact failure this change set exists to fix. Both commands now come from one forwardCommands() helper, so what is printed and what is run cannot drift.

Author: TheodoreSpeaks

scripts/setup/modes/compose.ts

@@ -19,28 +19,62 @@ import {
 } from '../steps.ts'
 import { glyph, theme } from '../theme.ts'
 
+const REQUIRED_PORTS = [3000, 3002] as const
+
+/**
+ * Host ports this compose project currently publishes. Read from the containers
+ * rather than assumed from the file, because what matters is what is bound right
+ * now — a project with only db/redis up publishes neither app port, so those
+ * still need the conflict check.
+ */
+function composePublishedPorts(composeFile: string): Set<number> {
+  const ids = spawnSync('docker', ['compose', '-f', composeFile, 'ps', '-q'], {
+    cwd: ROOT,
+    encoding: 'utf8',
+  })
+  const containers = ids.status === 0 ? ids.stdout.split('\n').filter(Boolean) : []
+  if (containers.length === 0) return new Set()
+
+  const inspect = spawnSync(
+    'docker',
+    [
+      'inspect',
+      ...containers,
+      '--format',
+      '{{range $port, $bindings := .HostConfig.PortBindings}}{{range $bindings}}{{.HostPort}} {{end}}{{end}}',
+    ],
+    { encoding: 'utf8' }
+  )
+  if (inspect.status !== 0) return new Set()
+  const published = new Set<number>()
+  for (const token of inspect.stdout.split(/\s+/)) {
+    const port = Number(token)
+    if (Number.isInteger(port) && port > 0) published.add(port)
+  }
+  return published
+}
+
 /**
  * Compose publishes 3000 and 3002 — resolve conflicts before touching docker,
  * instead of letting `docker compose up` die halfway through startup. Aborting
  * is fatal here: compose can't come up while the ports are held.
  */
 async function ensureComposePortsFree(composeFile: string): Promise<void> {
-  // This stack already holding 3000/3002 is not a conflict — `docker compose up
-  // -d` reconciles its own containers. Without this, re-running setup against a
-  // running install reports its own realtime container as a blocker and offers
-  // to kill Docker's listener, which is never the right move. A genuinely
-  // foreign process still gets caught below, and a foreign *container* surfaces
-  // as a clear bind error from compose itself.
-  const ours = spawnSync('docker', ['compose', '-f', composeFile, 'ps', '-q'], {
-    cwd: ROOT,
-    encoding: 'utf8',
-  })
-  if (ours.status === 0 && ours.stdout.trim()) {
-    p.log.step('Existing Sim containers hold :3000/:3002 — compose will reconcile them')
-    return
+  // A port this stack already publishes is not a conflict — `docker compose up
+  // -d` reconciles its own containers, and reporting the install's own realtime
+  // container as a blocker (offering to kill Docker's listener) is never right.
+  // Skip only the ports this project actually publishes: leftover db/redis
+  // containers must not wave through a foreign process sitting on 3000, which
+  // would otherwise surface as a raw compose bind error instead of the prompt.
+  const ours = composePublishedPorts(composeFile)
+  const toCheck = REQUIRED_PORTS.filter((port) => !ours.has(port))
+  if (toCheck.length < REQUIRED_PORTS.length) {
+    const skipped = REQUIRED_PORTS.filter((port) => ours.has(port))
+    p.log.step(`Existing Sim containers hold :${skipped.join(', :')} — compose will reconcile them`)
   }
-  if (await ensurePortsFree([3000, 3002])) return
-  throw new SetupError('ports 3000/3002 are in use', [
+  if (toCheck.length === 0) return
+  if (await ensurePortsFree(toCheck)) return
+  throw new SetupError(`ports ${toCheck.map((port) => `:${port}`).join('/')} are in use`, [
     `free the ports, then re-run: ${theme.command('bun run setup')}`,
     `see what holds them: ${theme.command('lsof -nP -iTCP:3000 -sTCP:LISTEN')}`,
     `stop a container publishing them: ${theme.command('docker ps')}`,

scripts/setup/modes/k8s.ts

@@ -386,10 +386,14 @@ export async function runK8sMode(detection: Detection): Promise<void> {
 
   p.note(
     [
-      `open ${APP_URL} (needs the port-forward below)`,
+      `open ${APP_URL} (needs both forwards below)`,
       `pods:      kubectl --context ${shq(context)} -n ${NAMESPACE} get pods`,
       `app logs:  kubectl --context ${shq(context)} -n ${NAMESPACE} logs deploy/${RELEASE}-app --tail 50`,
-      `forward:   kubectl --context ${shq(context)} -n ${NAMESPACE} port-forward svc/${RELEASE}-app 3000:3000`,
+      // Both, always: the app alone loads but the editor's socket has nothing to
+      // reach, which is the reconnect failure this change set exists to fix.
+      ...forwardCommands(context).map(
+        (command, index) => `${index === 0 ? 'forward:  ' : '          '} ${command}`
+      ),
       `tear down: helm uninstall ${RELEASE} --kube-context ${shq(context)} -n ${NAMESPACE}`,
     ].join('\n'),
     'Reach your cluster'
@@ -398,6 +402,16 @@ export async function runK8sMode(detection: Detection): Promise<void> {
   await offerPortForward(context)
 }
 
+/**
+ * Both forwards, in the order a user should run them. Kept in one place so the
+ * printed instructions and what the wizard actually runs cannot drift — the app
+ * alone leaves the editor's socket dead.
+ */
+function forwardCommands(context: string): string[] {
+  const scope = `kubectl --context ${shq(context)} -n ${NAMESPACE} port-forward`
+  return [`${scope} svc/${RELEASE}-app 3000:3000`, `${scope} svc/${RELEASE}-realtime 3002:3002`]
+}
+
 /**
  * The services are ClusterIP, so a healthy release is still unreachable from the
  * host — "Sim is ready" with nothing on :3000 is the least satisfying way to end
@@ -414,7 +428,15 @@ async function offerPortForward(context: string): Promise<void> {
     initialValue: true,
   })
   if (!forward) {
-    p.log.info(theme.muted('Skipped — run the forward command above when you want to reach it.'))
+    p.log.info(
+      theme.muted(
+        `Skipped — run both forwards when you want to reach it (the second keeps the editor's socket alive):\n${forwardCommands(
+          context
+        )
+          .map((command) => `  ${command}`)
+          .join('\n')}`
+      )
+    )
     return
   }