kdeploy 1.3.4 → 1.4.1

data/lib/kdeploy/executor/executor.rb

@@ -21,7 +21,8 @@ module Kdeploy
       @port = host_config[:port] # Added custom port support
       @use_sudo = host_config[:use_sudo] || false
       @sudo_password = host_config[:sudo_password]
-      @base_dir = host_config[:base_dir] # Base directory for resolving relative paths
+      raw_base = host_config[:base_dir]
+      @base_dir = raw_base ? File.expand_path(raw_base) : nil
     end
 
     def execute(command, use_sudo: nil)
@@ -29,7 +30,7 @@ module Kdeploy
       command = wrap_with_sudo(command) if use_sudo
 
       Net::SSH.start(@ip, @user, ssh_options) do |ssh|
-        execute_command_on_ssh(ssh, command)
+        with_active_ssh(ssh) { execute_command_on_ssh(ssh, command) }
       end
     rescue Net::SSH::AuthenticationFailed => e
       raise SSHError.new("SSH authentication failed: #{e.message}", e)
@@ -37,6 +38,36 @@ module Kdeploy
       raise SSHError.new("SSH execution failed: #{e.message}", e)
     end
 
+    # Best-effort close of the in-flight SSH session (step/host timeout).
+    def host_ip
+      @ip
+    end
+
+    def host_name
+      @host
+    end
+
+    def abort!
+      ssh = @active_ssh
+      return unless ssh
+
+      warn "Warning: aborting SSH session for #{@host} (#{@ip})"
+      begin
+        ssh.close
+      rescue StandardError
+        # ignore
+      ensure
+        @active_ssh = nil
+      end
+    end
+
+    def with_active_ssh(ssh)
+      @active_ssh = ssh
+      yield
+    ensure
+      @active_ssh = nil if @active_ssh.equal?(ssh)
+    end
+
     def execute_command_on_ssh(ssh, command)
       stdout = String.new
       stderr = String.new
@@ -53,6 +84,7 @@ module Kdeploy
         end
       end
       ssh.loop
+      raise_missing_exit_status!(command, stdout, stderr) if exit_status.nil?
       raise_nonzero_exit!(command, exit_status, stdout, stderr)
       build_command_result(stdout, stderr, command, exit_status)
     end
@@ -76,8 +108,18 @@ module Kdeploy
       }
     end
 
+    def raise_missing_exit_status!(command, stdout, stderr)
+      raise SSHError.new(
+        'Command completed without exit status',
+        nil,
+        command: command,
+        exit_status: nil,
+        stdout: stdout.strip,
+        stderr: stderr.strip
+      )
+    end
+
     def raise_nonzero_exit!(command, exit_status, stdout, stderr)
-      return if exit_status.nil?
       return if exit_status.zero?
 
       raise SSHError.new(
@@ -101,7 +143,9 @@ module Kdeploy
         upload_with_sudo(resolved_source, destination)
       else
         Net::SCP.start(@ip, @user, ssh_options) do |scp|
-          scp.upload!(resolved_source, destination)
+          with_active_ssh(scp.respond_to?(:session) ? scp.session : nil) do
+            scp.upload!(resolved_source, destination)
+          end
         end
       end
     rescue StandardError => e
@@ -112,6 +156,8 @@ module Kdeploy
       # Resolve relative paths relative to base_dir
       resolved_source = resolve_path(source)
       Template.render_and_upload(self, resolved_source, destination, variables)
+    rescue ArgumentError, Errno::ENOENT, FileNotFoundError
+      raise
     rescue StandardError => e
       raise TemplateError.new("Template upload failed: #{e.message}", e)
     end
@@ -140,6 +186,8 @@ module Kdeploy
           use_sudo: use_sudo
         )
         return rsync_result if rsync_result
+
+        warn 'Warning: rsync fast path unavailable; falling back to SCP sync'
       end
 
       # Collect files to sync
@@ -163,6 +211,8 @@ module Kdeploy
         deleted: deleted_count,
         total: files_to_sync.size
       }
+    rescue FileNotFoundError, ArgumentError
+      raise
     rescue StandardError => e
       raise SCPError.new("Directory sync failed: #{e.message}", e)
     end
@@ -175,16 +225,18 @@ module Kdeploy
 
       # Upload to temp location first
       Net::SCP.start(@ip, @user, ssh_options) do |scp|
-        scp.upload!(source, temp_dest)
+        with_active_ssh(scp.respond_to?(:session) ? scp.session : nil) do
+          scp.upload!(source, temp_dest)
+        end
       end
 
       # Move to final destination with sudo
-      move_command = "mv #{temp_dest} #{destination}"
+      move_command = "mv #{Shellwords.escape(temp_dest)} #{Shellwords.escape(destination)}"
       execute(move_command, use_sudo: true)
     rescue StandardError => e
       # Try to clean up temp file if it exists
       begin
-        execute("rm -f #{temp_dest}", use_sudo: false) if defined?(temp_dest)
+        execute("rm -f #{Shellwords.escape(temp_dest)}", use_sudo: false) if defined?(temp_dest)
       rescue StandardError
         # Ignore cleanup errors
       end
@@ -257,7 +309,7 @@ module Kdeploy
         sudo_flag,
         "-e \"#{ssh_cmd}\"",
         "#{Shellwords.escape(source)}/",
-        "#{@user}@#{@ip}:#{Shellwords.escape(destination)}/"
+        "#{Shellwords.escape(@user)}@#{Shellwords.escape(@ip)}:#{Shellwords.escape(destination)}/"
       ].reject(&:empty?)
       parts.join(' ')
     end
@@ -314,29 +366,43 @@ module Kdeploy
       # Do not add sudo again if command already starts with sudo
       return command if command.strip.start_with?('sudo')
 
-      # Wrap multi-line/control/compound commands so sudo applies to the full block
+      # Wrap multi-line/control/compound commands so sudo applies to the full block.
+      # Encode payload as base64 so local shell quoting cannot break on quotes/newlines.
       needs_wrap = command.include?("\n") ||
                    command.match?(/\b(if|for|while|case|function)\b/) ||
                    command.match?(/\s(&&|\|\||;)\s/)
 
       if needs_wrap
-        # Escape single quotes in command, then execute via bash -c
-        escaped_command = command.gsub("'", "'\"'\"'")
+        remote = base64_bash_command(command)
         if @sudo_password
-          escaped_password = @sudo_password.gsub('\'', "'\"'\"'").gsub('$', '\\$').gsub('`', '\\`')
-          "echo '#{escaped_password}' | sudo -S bash -c '#{escaped_command}'"
+          "#{sudo_password_prefix}sudo -S #{remote}"
         else
-          "sudo bash -c '#{escaped_command}'"
+          "sudo #{remote}"
         end
       elsif @sudo_password
-        # Wrap single-line command directly
-        escaped_password = @sudo_password.gsub('\'', "'\"'\"'").gsub('$', '\\$').gsub('`', '\\`')
-        "echo '#{escaped_password}' | sudo -S #{command}"
+        "#{sudo_password_prefix}sudo -S #{command}"
       else
         "sudo #{command}"
       end
     end
 
+    def base64_bash_command(command)
+      encoded = [command].pack('m0')
+      "bash -c #{Shellwords.escape("echo #{encoded} | base64 -d | bash")}"
+    end
+
+    def sudo_password_prefix
+      validate_sudo_password!
+      # printf + Shellwords avoids echo/newline injection into the local shell.
+      "printf '%s\\n' #{Shellwords.escape(@sudo_password)} | "
+    end
+
+    def validate_sudo_password!
+      return if @sudo_password.nil?
+
+      raise ArgumentError, 'sudo_password must not contain CR, LF, or NUL' if @sudo_password.match?(/[\r\n\0]/)
+    end
+
     def collect_files_to_sync(source_dir, filter)
       files = []
       source_path = Pathname.new(source_dir)
@@ -445,6 +511,14 @@ module Kdeploy
         # Ignore deletion errors
       end
 
+      # Best-effort: remove empty directories left behind (not the sync root).
+      prune = "find #{destination_dir.shellescape} -mindepth 1 -depth -type d -empty -delete 2>/dev/null || true"
+      begin
+        execute(prune, use_sudo: use_sudo)
+      rescue StandardError
+        # Ignore prune errors
+      end
+
       deleted_count
     end
   end

data/lib/kdeploy/output/output_formatter.rb

@@ -157,9 +157,18 @@ module Kdeploy
       when :upload_template
         "#{@pastel.blue('>')} Template: #{command[:source]} -> #{command[:destination]}"
       when :sync
-        ignore_str = command[:ignore]&.any? ? " (ignore: #{command[:ignore].join(', ')})" : ''
-        delete_str = command[:delete] ? ' (delete: true)' : ''
-        "#{@pastel.blue('>')} Sync: #{command[:source]} -> #{command[:destination]}#{ignore_str}#{delete_str}"
+        extras = []
+        extras << "ignore: #{command[:ignore].join(', ')}" if command[:ignore]&.any?
+        extras << "exclude: #{command[:exclude].join(', ')}" if command[:exclude]&.any?
+        extras << 'delete: true' if command[:delete]
+        extras << 'fast: true' if command[:fast]
+        extras << "parallel: #{command[:parallel]}" if command[:parallel]
+        suffix = extras.empty? ? '' : " (#{extras.join(', ')})"
+        "#{@pastel.blue('>')} Sync: #{command[:source]} -> #{command[:destination]}#{suffix}"
+      when :wait_port
+        "#{@pastel.magenta('>')} wait_port: #{command[:port]} (timeout: #{command[:timeout]})"
+      when :wait_http
+        "#{@pastel.magenta('>')} wait_http: #{command[:url]} (code: #{command[:code]}, timeout: #{command[:timeout]})"
       else
         "#{@pastel.blue('>')} #{command[:type]}: #{command}"
       end

data/lib/kdeploy/runner/runner.rb

@@ -26,6 +26,7 @@ module Kdeploy
       @retry_policy = retry_policy
       @pool = Concurrent::FixedThreadPool.new(@parallel)
       @results = Concurrent::Hash.new
+      @results_mutex = Mutex.new
     end
 
     def run(task_name)
@@ -66,11 +67,16 @@ module Kdeploy
             progressed = true
           elsif timeout_exceeded?(started_at, now)
             future.cancel if future.respond_to?(:cancel)
-            @results[host_name] ||= {
-              status: :failed,
-              error: "execution timeout after #{@host_timeout}s",
-              output: []
-            }
+            begin
+              meta[:executor_ref]&.get&.abort!
+            rescue StandardError
+              # ignore abort errors
+            end
+            store_result_once(host_name, {
+                                status: :failed,
+                                error: "execution timeout after #{@host_timeout}s",
+                                output: []
+                              })
             pending.delete(future)
             progressed = true
           end
@@ -85,22 +91,24 @@ module Kdeploy
     def create_task_futures(task, task_name)
       @future_meta = {}
       @hosts.map do |name, config|
-        started_at = Concurrent::AtomicReference.new(nil)
+        # Start the host-timeout clock when scheduled so pool wait cannot skip timeout.
+        started_at = Concurrent::AtomicReference.new(Time.now)
+        executor_ref = Concurrent::AtomicReference.new(nil)
         future = Concurrent::Future.execute(executor: @pool) do
-          started_at.set(Time.now)
-          execute_task_for_host(name, config, task, task_name)
+          execute_task_for_host(name, config, task, task_name, executor_ref)
         end
-        @future_meta[future] = { host_name: name, started_at: started_at }
+        @future_meta[future] = { host_name: name, started_at: started_at, executor_ref: executor_ref }
         future
       end
     end
 
     private
 
-    def execute_task_for_host(name, config, task, task_name)
+    def execute_task_for_host(name, config, task, task_name, executor_ref = nil)
       # Add base_dir to config for path resolution
       config_with_base_dir = config.merge(base_dir: @base_dir)
       executor = Executor.new(config_with_base_dir)
+      executor_ref&.set(executor)
       command_executor = CommandExecutor.new(
         executor,
         @output,
@@ -126,7 +134,9 @@ module Kdeploy
     end
 
     def execute_commands(task, command_executor, name, result, task_name)
-      commands = task[:block].call
+      plan = Kdeploy::DSL.normalize_plan(task[:block].call)
+      commands = plan[:commands]
+      on_failure = plan[:on_failure]
 
       commands.each do |command|
         step_result = execute_command(command_executor, command, name)
@@ -142,26 +152,46 @@ module Kdeploy
           error: "#{e.class}: #{e.message}",
           output: error_output_for_step(e)
         }
+        run_on_failure(on_failure, command_executor, name, result)
         break
       end
     end
 
+    def run_on_failure(on_failure, command_executor, name, result)
+      return if on_failure.nil? || on_failure.empty?
+
+      on_failure.each do |command|
+        step_result = execute_command(command_executor, command, name)
+        step_result = step_result.merge(on_failure: true)
+        result[:output] << step_result
+      rescue StandardError => e
+        result[:output] << {
+          type: command[:type],
+          command: step_command_string(command),
+          duration: 0.0,
+          on_failure: true,
+          error: "#{e.class}: #{e.message}",
+          output: error_output_for_step(e)
+        }
+      end
+    end
+
     def collect_future_result(future, host_name)
-      return if @results.key?(host_name)
+      return if result_recorded?(host_name)
 
       begin
         future_result = future.value
         if future_result.nil?
-          @results[host_name] = { status: :unknown, error: 'Future returned nil', output: [] }
+          store_result_once(host_name, { status: :unknown, error: 'Future returned nil', output: [] })
         elsif future_result.is_a?(Array) && future_result.length == 2
           name, result = future_result
-          @results[name] = result
+          store_result_once(name, result)
         else
-          @results[host_name] = {
-            status: :unknown,
-            error: "Unexpected result format: #{future_result.class}",
-            output: []
-          }
+          store_result_once(host_name, {
+                              status: :unknown,
+                              error: "Unexpected result format: #{future_result.class}",
+                              output: []
+                            })
         end
 
         if future.rejected?
@@ -170,12 +200,22 @@ module Kdeploy
           rescue StandardError
             'Unknown error'
           end
-          @results[host_name] ||= { status: :failed, error: error, output: [] }
+          store_result_once(host_name, { status: :failed, error: error, output: [] })
         end
       rescue StandardError => e
-        @results[host_name] = { status: :failed, error: "#{e.class}: #{e.message}", output: [] }
+        store_result_once(host_name, { status: :failed, error: "#{e.class}: #{e.message}", output: [] })
       ensure
-        @results[host_name] ||= { status: :unknown, error: 'No result collected', output: [] }
+        store_result_once(host_name, { status: :unknown, error: 'No result collected', output: [] })
+      end
+    end
+
+    def result_recorded?(host_name)
+      @results_mutex.synchronize { @results.key?(host_name) }
+    end
+
+    def store_result_once(host_name, result)
+      @results_mutex.synchronize do
+        @results[host_name] ||= result
       end
     end
 
@@ -225,6 +265,10 @@ module Kdeploy
         command_executor.execute_upload_template(command, host_name)
       when :sync
         command_executor.execute_sync(command, host_name)
+      when :wait_port
+        command_executor.execute_wait_port(command, host_name)
+      when :wait_http
+        command_executor.execute_wait_http(command, host_name)
       else
         raise ConfigurationError, "Unknown command type: #{command[:type]}"
       end
@@ -240,6 +284,10 @@ module Kdeploy
         "upload_template: #{command[:source]} -> #{command[:destination]}"
       when :sync
         "sync: #{command[:source]} -> #{command[:destination]}"
+      when :wait_port
+        "wait_port: #{command[:port]}"
+      when :wait_http
+        "wait_http: #{command[:url]}"
       else
         command[:type].to_s
       end
@@ -256,6 +304,10 @@ module Kdeploy
         "upload_template: #{command[:source]} -> #{command[:destination]}"
       when :sync
         "sync: #{command[:source]} -> #{command[:destination]}"
+      when :wait_port
+        "wait_port: #{command[:port]}"
+      when :wait_http
+        "wait_http: #{command[:url]}"
       else
         command[:type].to_s
       end

data/lib/kdeploy/template/template.rb

@@ -51,7 +51,8 @@ module Kdeploy
     end
 
     def self.extract_template_identifiers(template_content)
-      identifiers = template_content.scan(/<%=\s*([a-zA-Z_]\w*)/).flatten
+      # Match <%= name %> and <%= @name %>; still ignores method calls / hash access.
+      identifiers = template_content.scan(/<%=\s*@?([a-zA-Z_]\w*)/).flatten
       identifiers.uniq - ruby_keywords
     end
 

data/lib/kdeploy/version.rb

@@ -2,5 +2,5 @@
 
 # Kdeploy module for version management
 module Kdeploy
-  VERSION = '1.3.4' unless const_defined?(:VERSION)
+  VERSION = '1.4.1' unless const_defined?(:VERSION)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kdeploy
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 1.4.1
 platform: ruby
 authors:
 - Kk
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-07 00:00:00.000000000 Z
+date: 2026-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf
@@ -160,8 +160,12 @@ extensions:
 - ext/mkrf_conf.rb
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
+- CONTRIBUTING.md
+- LICENSE
 - README.md
 - README_EN.md
+- SECURITY.md
 - exe/kdeploy
 - ext/mkrf_conf.rb
 - lib/kdeploy.rb
@@ -188,8 +192,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kevin197011/kdeploy
-  source_code_uri: https://github.com/kevin197011/kdeploy.git
+  source_code_uri: https://github.com/kevin197011/kdeploy
   changelog_uri: https://github.com/kevin197011/kdeploy/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/kevin197011/kdeploy/issues
+  documentation_uri: https://github.com/kevin197011/kdeploy/blob/main/docs/REQUIREMENTS.md
   rubygems_mfa_required: 'true'
 post_install_message: "\U0001F389 Thanks for installing kdeploy!\n\nShell completion
   will be configured automatically.\nYou may need to restart your shell or run:\n