RubyGems - ruby_everywhere - Versions diffs - 0.6.0 → 0.7.0 - Mend

ruby_everywhere 0.6.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (45) hide show

checksums.yaml +4 -4
data/exe/every +12 -1
data/exe/rbe +12 -1
data/lib/everywhere/agents_guide.rb +3 -1
data/lib/everywhere/blake2b.rb +17 -1
data/lib/everywhere/boot.rb +21 -4
data/lib/everywhere/builders/android.rb +144 -30
data/lib/everywhere/builders/desktop.rb +25 -17
data/lib/everywhere/builders/ios.rb +244 -9
data/lib/everywhere/cli.rb +2 -0
data/lib/everywhere/commands/build.rb +113 -58
data/lib/everywhere/commands/clean.rb +8 -3
data/lib/everywhere/commands/dev.rb +85 -11
data/lib/everywhere/commands/doctor.rb +138 -21
data/lib/everywhere/commands/install.rb +48 -8
data/lib/everywhere/commands/platform/build.rb +136 -27
data/lib/everywhere/commands/platform/login.rb +16 -2
data/lib/everywhere/commands/platform/runner.rb +113 -23
data/lib/everywhere/commands/preview.rb +359 -0
data/lib/everywhere/commands/publish.rb +20 -2
data/lib/everywhere/commands/release.rb +145 -28
data/lib/everywhere/commands/shell_dir.rb +2 -2
data/lib/everywhere/config.rb +88 -3
data/lib/everywhere/console.rb +2 -1
data/lib/everywhere/engine.rb +24 -0
data/lib/everywhere/framework.rb +21 -4
data/lib/everywhere/ignore.rb +3 -1
data/lib/everywhere/jump.rb +121 -0
data/lib/everywhere/mobile_config_endpoint.rb +47 -0
data/lib/everywhere/mobile_configs_controller.rb +46 -0
data/lib/everywhere/paths.rb +13 -6
data/lib/everywhere/platform/client.rb +27 -6
data/lib/everywhere/platform/credentials.rb +18 -8
data/lib/everywhere/platform/snapshot.rb +10 -0
data/lib/everywhere/receipt.rb +55 -10
data/lib/everywhere/shellout.rb +19 -0
data/lib/everywhere/simulator.rb +12 -1
data/lib/everywhere/version.rb +1 -1
data/support/mobile/android/app/build.gradle.kts +29 -1
data/support/mobile/ios/App/EverywhereConfig.swift +17 -5
data/support/mobile/ios/App/SceneDelegate.swift +75 -8
data/support/mobile/ios/App.xcodeproj/project.pbxproj +2 -2
data/support/mobile/ios/App.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved +0 -1
data/support/mobile/ios/README.md +13 -6
metadata +17 -1

data/lib/everywhere/config.rb CHANGED Viewed

@@ -1,8 +1,13 @@
 # frozen_string_literal: true
 require "yaml"
+require_relative "ui"
 module Everywhere
+  # Also defined by everywhere.rb and framework.rb; repeated here so config.rb
+  # stays loadable on its own (the packaged runtime requires it piecemeal).
+  class Error < StandardError; end
   class << self
     # Register a per-request filter for the mobile tab bar. The block receives
     # the resolved tab list (`[{ "title" =>, "path" =>, "icon" => }, …]`) and
@@ -66,6 +71,50 @@ module Everywhere
       HTML
     end
+    # The page served at /everywhere/jump/leave — the way OUT of a Jump
+    # preview. Once Jump re-roots onto a previewed app (instance.set), every
+    # Jump surface — launcher, scanner, tabs — resolves against the previewed
+    # app, so the escape hatch has to be served by the previewed app itself:
+    # this gem is the one thing guaranteed to be there. Posts clearInstance on
+    # the shell's control channel; shells that aren't multi-instance ignore
+    # it, and a plain browser just goes home.
+    # Fires clearInstance only once VISIBLE. This page rides in the previewed
+    # app's tab bar; shells preload tabs eagerly, but a preloaded webview is
+    # offscreen and reports visibilityState "hidden" — firing on load would
+    # bounce every preview the instant it connects, and a tap on the tab
+    # never re-proposes a visit, so visibility flipping is the ONLY signal a
+    # tab tap gives the page. The button is a belt for browsers and any
+    # webview that lies about visibility.
+    def mobile_jump_leave_html
+      <<~HTML
+        <!DOCTYPE html><html><head><meta charset="utf-8"><title>Jump</title>
+        <meta name="viewport" content="width=device-width,initial-scale=1">
+        <style>
+          body{font-family:-apple-system,system-ui,sans-serif;margin:0;min-height:100vh;
+               display:flex;flex-direction:column;align-items:center;justify-content:center;
+               gap:12px;padding:24px;text-align:center;background:#fff;color:#171717}
+          @media(prefers-color-scheme:dark){body{background:#171717;color:#fafafa}}
+          p{margin:0;opacity:.6}
+          button{font:inherit;font-weight:600;font-size:18px;color:#fff;background:#dc2626;
+                 border:0;border-radius:12px;padding:16px 32px}
+        </style></head>
+        <body>
+        <p>Returning to Jump…</p>
+        <button onclick="everywhereJumpLeave()">Return to Jump</button>
+        <script>
+        function everywhereJumpLeave(){var msg={action:"clearInstance"};
+        var ios=window.webkit&&window.webkit.messageHandlers&&window.webkit.messageHandlers.everywhereControl;
+        var android=window.everywhereControl;
+        if(ios){ios.postMessage(msg);}
+        else if(android&&android.postMessage){android.postMessage(JSON.stringify(msg));}
+        else{window.location.replace("/");}}
+        if(document.visibilityState==="visible"){everywhereJumpLeave();}
+        else{document.addEventListener("visibilitychange",function(){
+          if(document.visibilityState==="visible"){everywhereJumpLeave();}});}
+        </script></body></html>
+      HTML
+    end
     # The page served at /everywhere/auth/native. The shell normally diverts a
     # provider path natively, before the request is ever made; this covers the
     # visits it can't see — a `data-turbo="false"` link, or the POST OmniAuth 2
@@ -150,10 +199,32 @@ module Everywhere
   class Config
     FILE = File.join("config", "everywhere.yml")
+    # Dates, times and symbols are permitted rather than fatal: an unquoted
+    # `version: 2026-07-25` or `mode: :remote` is a typo of a string, and every
+    # value here is read as one anyway — dying on it would be theatre.
+    PERMITTED_YAML_CLASSES = [Date, Time, Symbol].freeze
     def self.load(root = Dir.pwd)
       path = File.join(root, FILE)
-      data = File.exist?(path) ? YAML.safe_load_file(path, aliases: true) || {} : {}
+      return new({}, root) unless File.exist?(path)
+      data = YAML.safe_load_file(path, aliases: true, permitted_classes: PERMITTED_YAML_CLASSES)
+      data = {} if data.nil? || data == false
+      unless data.is_a?(Hash)
+        # Raise, never die!: this also runs inside the packaged app's request
+        # middleware, where a SystemExit would take the whole server down —
+        # runtime callers rescue and keep the last good config, and the CLI's
+        # top-level handler renders an Error just as cleanly.
+        raise Everywhere::Error,
+              "#{UI.short_path(path)} must be a mapping of sections (app:, build:, …), not a #{data.class}"
+      end
       new(data, root)
+    rescue Psych::Exception => e
+      # Psych prefixes syntax errors with the absolute path; the line/column
+      # tail is the useful half, and we've already named the file.
+      detail = e.message.sub(/\A\(#{Regexp.escape(path)}\):\s*/, "")
+      raise Everywhere::Error, "#{UI.short_path(path)} isn't valid YAML: #{detail}"
     end
     attr_reader :root
@@ -169,6 +240,13 @@ module Everywhere
     # matching override; omit it for the shared app-level value.
     def self.os_of(target) = target.to_s.split("-", 2).first
+    # A target may carry a ":<channel>" suffix ("ios-arm64:testflight") that
+    # selects the distribution channel for THAT target. nil when it doesn't.
+    def self.channel_of(target)
+      suffix = target.to_s.split(":", 2)[1]
+      suffix unless suffix.nil? || suffix.empty?
+    end
     def name(target: nil)
       resolved(target)["name"] || File.basename(File.expand_path(root)).split(/[-_]/).map(&:capitalize).join(" ")
     end
@@ -229,8 +307,15 @@ module Everywhere
     # accessor was silently redefined by that one and could never be read.
     def build_capabilities = Array(build["capabilities"])
-    # Build targets (os-arch strings) — the CI matrix, expressed once.
-    def targets = Array(build["targets"])
+    # Build targets as BARE os-arch strings — any ":<channel>" suffix is
+    # stripped. Callers treat these as filesystem/URL-safe identifiers
+    # (`every publish` derives S3 update-manifest key paths from the first one),
+    # so a suffix leaking through here would poison those paths. Use
+    # #build_target_specs when the channel matters.
+    def targets = build_target_specs.map { |t| t.to_s.split(":", 2).first }
+    # The raw `build.targets` entries, suffixes intact ("ios-arm64:testflight").
+    def build_target_specs = Array(build["targets"])
     # "local"  — the app is tebako-pressed and runs on-device (default)
     # "remote" — thin shell around an already-deployed app: no press, no sidecar

data/lib/everywhere/console.rb CHANGED Viewed

@@ -36,7 +36,8 @@ module Everywhere
       desktop: ["desktop", :magenta],
       ios: ["ios", :blue],
       android: ["android", :green],
-      logs: ["logs", :gray]
+      logs: ["logs", :gray],
+      tunnel: ["tunnel", :yellow]
     }.freeze
     TAG_WIDTH = TAGS.values.map { |label, _| label.length }.max

data/lib/everywhere/engine.rb CHANGED Viewed

@@ -51,6 +51,14 @@ module Everywhere
       app.middleware.insert_before 0, Everywhere::AuthHandoff, root: app.root.to_s
     end
+    # `every preview` fronts the dev server with a tunnel whose hostname is
+    # only known at spawn time, so it arrives by env var; without this, Rails'
+    # host authorization greets every phone with a blocked-host page.
+    initializer "everywhere.preview_host" do |app|
+      host = ENV["EVERYWHERE_PREVIEW_HOST"].to_s
+      app.config.hosts << host if app.config.respond_to?(:hosts) && !host.empty?
+    end
     # /everywhere/ios_v1.json — the mobile shells' remote path configuration
     # (rules + settings.tabs), generated from config/everywhere.yml at request
     # time so tab changes ship with a normal deploy. A real controller (not
@@ -64,6 +72,22 @@ module Everywhere
         require_relative "mobile_configs_controller"
         get "/everywhere/reset", to: Everywhere::MobileConfigsController.action(:reset),
                                  as: :everywhere_reset
+        # Jump preview endpoints — dead (404) outside `every preview` runs.
+        # OPTIONS routes are the CORS preflights: the connect page calling
+        # these lives on the Jump site, another origin by definition.
+        get "/everywhere/jump_v1", to: Everywhere::MobileConfigsController.action(:jump_manifest),
+                                   defaults: { format: "json" },
+                                   as: :everywhere_jump_manifest
+        match "/everywhere/jump_v1", to: Everywhere::MobileConfigsController.action(:jump_manifest),
+                                     via: :options
+        post "/everywhere/jump/session", to: Everywhere::MobileConfigsController.action(:jump_session),
+                                         as: :everywhere_jump_session
+        match "/everywhere/jump/session", to: Everywhere::MobileConfigsController.action(:jump_session),
+                                          via: :options
+        # The way back out of a preview — served on EVERY app with this gem,
+        # because after instance.set the previewed app is all Jump can reach.
+        get "/everywhere/jump/leave", to: Everywhere::MobileConfigsController.action(:jump_leave),
+                                      as: :everywhere_jump_leave
         get "/everywhere/:platform_v1", to: Everywhere::MobileConfigsController.action(:show),
                                         constraints: { platform_v1: /(?:ios|android)_v1/ },
                                         defaults: { format: "json" },

data/lib/everywhere/framework.rb CHANGED Viewed

@@ -32,9 +32,24 @@ module Everywhere
       File.exist?(File.join(root, "config.ru")) && gemfile_mentions?(root, "sinatra")
     end
+    # Bundler reads either name, and `gem "rails"` / `gem("rails")` are the same
+    # line to it. Anchored at the start of the line so a commented-out gem — the
+    # usual reason a Gemfile still mentions one — doesn't count as detection.
+    GEMFILE_NAMES = %w[Gemfile gems.rb].freeze
     def self.gemfile_mentions?(root, gem_name)
-      gemfile = File.join(root, "Gemfile")
-      File.exist?(gemfile) && File.read(gemfile).match?(/gem ["']#{Regexp.escape(gem_name)}/)
+      pattern = /^\s*gem[\s(]+["']#{Regexp.escape(gem_name)}/
+      GEMFILE_NAMES.any? do |name|
+        path = File.join(root, name)
+        File.exist?(path) && read_source(path).match?(pattern)
+      end
+    end
+    # Gemfiles are UTF-8, but the process may be running under LANG=C, where
+    # File.read tags the bytes as US-ASCII and any accented comment makes the
+    # match raise instead of answering.
+    def self.read_source(path)
+      File.read(path, encoding: "UTF-8").scrub
     end
     attr_reader :root
@@ -120,8 +135,10 @@ module Everywhere
       def name = "rails"
       # CLI
+      # executable?, not exist?: a repo downloaded as a zip loses the exec bit,
+      # and running bin/dev then dies with a bare "Permission denied".
       def dev_command
-        File.exist?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rails server"
+        File.executable?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rails server"
       end
       def precompile_env
@@ -187,7 +204,7 @@ module Everywhere
       def name = "sinatra"
       def dev_command
-        File.exist?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rackup --host 127.0.0.1"
+        File.executable?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rackup --host 127.0.0.1"
       end
       # No asset pipeline by default; nothing to precompile.

data/lib/everywhere/ignore.rb CHANGED Viewed

@@ -31,7 +31,9 @@ module Everywhere
     def self.for(root)
       path = File.join(root, FILE)
-      source = File.exist?(path) ? File.read(path) : DEFAULTS.join("\n")
+      # UTF-8 explicitly (and scrubbed): under LANG=C the bytes come back
+      # US-ASCII and a non-ASCII path pattern makes the matching raise.
+      source = File.exist?(path) ? File.read(path, encoding: "UTF-8").scrub : DEFAULTS.join("\n")
       new(parse(source))
     end

data/lib/everywhere/jump.rb ADDED Viewed

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+require "openssl"
+require "securerandom"
+module Everywhere
+  # Jump: the companion app that previews RubyEverywhere apps on a real
+  # device (spec: platform/docs/jump.md). The server side is two endpoints,
+  # live only while `every preview` runs (EVERYWHERE_JUMP_TOKEN set):
+  #
+  #   POST /everywhere/jump/session   {token, device_name} -> {bearer}
+  #   GET  /everywhere/jump_v1.json   Authorization: Bearer ... -> manifest
+  #
+  # The pairing token is per-run and multi-use (a forwarded link must work
+  # for a second coworker's device); each device exchanges it once for a
+  # bearer. Bearers are stateless HMACs keyed on the token — no session
+  # store, and every bearer dies with the run because the token does.
+  module Jump
+    PROTOCOL = 1
+    SESSION_PATH = "/everywhere/jump/session"
+    MANIFEST_PATH = "/everywhere/jump_v1.json"
+    module_function
+    def token = ENV["EVERYWHERE_JUMP_TOKEN"]
+    def enabled? = !token.to_s.empty?
+    def manifest_hash(config)
+      {
+        "version" => 1,
+        "jump_protocol" => PROTOCOL,
+        "app" => { "name" => config.name, "identifier" => config.bundle_id },
+        "appearance" => {
+          "tint_color" => config.tint_color,
+          "background_color" => config.background_color
+        }.compact,
+        "entry_path" => config.entry_path,
+        "remote_instances" => (true if config.remote_instances?),
+        "path_configuration" => {
+          "ios" => "/everywhere/ios_v1.json",
+          "android" => "/everywhere/android_v1.json"
+        },
+        "native_extensions" => [
+          ("ios" if config.native_ios?),
+          ("android" if config.native_android?)
+        ].compact
+      }.compact
+    end
+    # nil on a bad token; the session hash otherwise. Logs to stderr so the
+    # connect shows up in the terminal `every preview` is pumping.
+    def exchange(candidate, device_name)
+      return nil unless valid_token?(candidate)
+      warn connect_log_line(device_name)
+      { "bearer" => mint_bearer, "jump_protocol" => PROTOCOL }
+    end
+    def mint_bearer(tok = token)
+      nonce = SecureRandom.hex(12)
+      "v1.#{nonce}.#{signature(tok, nonce)}"
+    end
+    def valid_bearer?(bearer, tok = token)
+      version, nonce, mac = bearer.to_s.split(".", 3)
+      return false unless version == "v1" && nonce && mac && !tok.to_s.empty?
+      expected = signature(tok, nonce)
+      mac.bytesize == expected.bytesize && OpenSSL.fixed_length_secure_compare(mac, expected)
+    end
+    def valid_token?(candidate, tok = token)
+      candidate = candidate.to_s
+      return false if tok.to_s.empty? || candidate.empty?
+      candidate.bytesize == tok.bytesize && OpenSSL.fixed_length_secure_compare(candidate, tok)
+    end
+    def signature(tok, nonce)
+      OpenSSL::HMAC.hexdigest("SHA256", tok, "jump-session-v1:#{nonce}")
+    end
+    LEAVE_PATH = "/everywhere/jump/leave"
+    # The connect page lives on the Jump site; the endpoints live on the
+    # previewed app — always cross-origin. `*` is safe here: nothing is
+    # cookie-authenticated, the token/bearer IS the credential.
+    CORS_HEADERS = {
+      "access-control-allow-origin" => "*",
+      "access-control-allow-methods" => "GET, POST, OPTIONS",
+      "access-control-allow-headers" => "authorization, content-type",
+      "access-control-max-age" => "600"
+    }.freeze
+    # Appended to the previewed app's resolved tabs while preview runs: after
+    # instance.set the previewed app's path configuration is the ONLY chrome
+    # Jump has, so without this tab there is no way back to the launcher. A
+    # tabless app gets a pair — its own content as tab one, the exit as tab
+    # two — because a lone exit tab would replace the app's content outright.
+    def exit_tabs(config, os, tabs)
+      return tabs + [exit_tab(os)] unless tabs.empty?
+      app_tab = { "title" => config.name,
+                  "path" => config.entry_path || "/",
+                  "icon" => os.to_s == "android" ? "apps" : "app" }
+      [app_tab, exit_tab(os)]
+    end
+    def exit_tab(os)
+      { "title" => "Jump",
+        "path" => LEAVE_PATH,
+        "icon" => os.to_s == "android" ? "u_turn_left" : "arrow.uturn.backward.circle" }
+    end
+    def connect_log_line(device_name)
+      name = device_name.to_s.gsub(/[[:cntrl:]]/, "").strip[0, 64]
+      name = "A device" if name.empty?
+      "[everywhere] Jump connected: #{name}"
+    end
+  end
+end

data/lib/everywhere/mobile_config_endpoint.rb CHANGED Viewed

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require_relative "config"
+require_relative "jump"
 module Everywhere
   # Rack middleware serving the mobile shells' remote path configuration:
@@ -32,6 +33,26 @@ module Everywhere
     end
     def call(env)
+      # Jump endpoints exist only while `every preview` runs (pass through
+      # otherwise, so nothing is reachable on a normal deploy). The leave page
+      # is the exception — it's how Jump escapes a previewed app, so it must
+      # answer whenever this gem is present.
+      if Jump.enabled?
+        if env["REQUEST_METHOD"] == "OPTIONS" &&
+           [Jump::SESSION_PATH, Jump::MANIFEST_PATH].include?(env["PATH_INFO"])
+          return [204, Jump::CORS_HEADERS.dup, []]
+        end
+        if env["REQUEST_METHOD"] == "POST" && env["PATH_INFO"] == Jump::SESSION_PATH
+          return jump_session(env)
+        end
+        if env["REQUEST_METHOD"] == "GET" && env["PATH_INFO"] == Jump::MANIFEST_PATH
+          return jump_manifest(env)
+        end
+      end
+      if env["REQUEST_METHOD"] == "GET" && env["PATH_INFO"] == Jump::LEAVE_PATH
+        return html(Everywhere.mobile_jump_leave_html)
+      end
       return @app.call(env) unless env["REQUEST_METHOD"] == "GET"
       if env["PATH_INFO"] == RESET
@@ -56,11 +77,37 @@ module Everywhere
       os = match[1]
       config = Config.load(@root)
       tabs = Everywhere.resolve_tabs(config.tabs_for(os), request_for(env))
+      tabs = Jump.exit_tabs(config, os, tabs) if Jump.enabled?
       json(config.path_configuration_json(os, tabs: tabs))
     end
     private
+    def jump_session(env)
+      require "json"
+      body = JSON.parse(env["rack.input"].read.to_s) rescue {}
+      result = Jump.exchange(body["token"], body["device_name"])
+      return forbidden unless result
+      [201, jump_json_headers, [JSON.generate(result)]]
+    end
+    def jump_manifest(env)
+      require "json"
+      bearer = env["HTTP_AUTHORIZATION"].to_s.delete_prefix("Bearer ").strip
+      return forbidden unless Jump.valid_bearer?(bearer)
+      [200, jump_json_headers, [JSON.generate(Jump.manifest_hash(Config.load(@root)))]]
+    end
+    def forbidden
+      [403, jump_json_headers, ['{"error":"invalid or expired preview token"}']]
+    end
+    def jump_json_headers
+      { "content-type" => "application/json", "cache-control" => "no-store" }.merge(Jump::CORS_HEADERS)
+    end
     def json(body)
       [200, { "content-type" => "application/json", "cache-control" => cache_control }, [body]]
     end

data/lib/everywhere/mobile_configs_controller.rb CHANGED Viewed

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require_relative "config"
+require_relative "jump"
 module Everywhere
   # Serves the mobile shells' remote path configuration in Rails apps:
@@ -31,6 +32,7 @@ module Everywhere
       os = params[:platform_v1].delete_suffix("_v1")
       tabs = Everywhere.resolve_tabs(config.tabs_for(os), request)
+      tabs = Jump.exit_tabs(config, os, tabs) if Jump.enabled?
       render json: config.path_configuration_hash(os, tabs: tabs)
     end
@@ -52,6 +54,43 @@ module Everywhere
       render json: json
     end
+    # Jump preview endpoints (spec: platform/docs/jump.md §3). 404 unless
+    # `every preview` is running (EVERYWHERE_JUMP_TOKEN set), so nothing is
+    # reachable on a normal deploy. Always cross-origin (the connect page
+    # lives on the Jump site), hence the CORS headers + preflight.
+    def jump_session
+      return head(:not_found) unless Jump.enabled?
+      apply_jump_headers
+      return head(:no_content) if request.method == "OPTIONS"
+      result = Jump.exchange(params[:token], params[:device_name])
+      return head(:forbidden) unless result
+      render json: result, status: :created
+    end
+    def jump_manifest
+      return head(:not_found) unless Jump.enabled?
+      apply_jump_headers
+      return head(:no_content) if request.method == "OPTIONS"
+      bearer = request.headers["Authorization"].to_s.delete_prefix("Bearer ").strip
+      return head(:forbidden) unless Jump.valid_bearer?(bearer)
+      render json: Jump.manifest_hash(Config.load(::Rails.root.to_s))
+    end
+    # GET /everywhere/jump/leave — the way back OUT of a Jump preview. Served
+    # unconditionally (unlike the endpoints above): once Jump re-roots onto a
+    # previewed app, this page is its only path home, preview session or not.
+    def jump_leave
+      response.headers["cache-control"] = "no-store"
+      render html: Everywhere.mobile_jump_leave_html.html_safe,
+             layout: false, content_type: "text/html"
+    end
     # GET /everywhere/reset?to=/path — the native "reset the app" page. Auth
     # flows redirect the shell here so it rebuilds cleanly before landing on
     # `to`. Never cached (it must run every time).
@@ -60,5 +99,12 @@ module Everywhere
       render html: Everywhere.mobile_reset_html(params[:to]).html_safe,
              layout: false, content_type: "text/html"
     end
+    private
+    def apply_jump_headers
+      response.headers["cache-control"] = "no-store"
+      Jump::CORS_HEADERS.each { |key, value| response.headers[key] = value }
+    end
   end
 end

data/lib/everywhere/paths.rb CHANGED Viewed

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
+require_relative "ui"
 module Everywhere
   # Filesystem locations the CLI resolves relative to the gem itself, so
   # `every dev`/`build`/`release` work in any project the gem is installed into.
@@ -83,8 +85,12 @@ module Everywhere
     end
     # Per-user cache dir. Keeps heavy build state out of the gem and the app.
+    # `~` needs a home to expand against, and a container run with --user has
+    # neither HOME nor a passwd entry.
     def cache_dir
       File.expand_path(ENV["RUBYEVERYWHERE_HOME"] || "~/.rubyeverywhere")
+    rescue ArgumentError
+      UI.die!("couldn't resolve your home directory — set HOME or RUBYEVERYWHERE_HOME")
     end
     # The stamped copy of the iOS template for one app. Persistent (not a
@@ -130,12 +136,13 @@ module Everywhere
       File.join(cache_dir, "android-fonts")
     end
-    # The stamped copy of the Tauri shell for one app, keyed by bundle id.
-    # Only apps that declare `native.desktop` get one — everyone else compiles
-    # the gem's own copy, which is identical for them and stays warm across
-    # projects (see cargo_target_dir). Persistent for the same reason the mobile
-    # work dirs are: cargo's incremental state lives inside it, and a cold Tauri
-    # build is minutes where a warm one is seconds.
+    # The staged copy of the Tauri shell for one app, keyed by bundle id.
+    # Every app builds from one of these — cargo never runs inside the
+    # installed gem, which may be root-owned — but only apps that declare
+    # `native.desktop` get their Rust stamped in; everyone else's copy is
+    # identical to the template and shares cargo_target_dir so the compile
+    # stays warm across projects. Persistent for the same reason the mobile
+    # work dirs are: a cold Tauri build is minutes where a warm one is seconds.
     def desktop_work_dir(bundle_id)
       File.join(cache_dir, "desktop", bundle_id)
     end

data/lib/everywhere/platform/client.rb CHANGED Viewed

@@ -3,6 +3,11 @@
 require "net/http"
 require "json"
 require "uri"
+begin
+  require "openssl" # optional stdlib; NETWORK_ERRORS below adapts if it's absent
+rescue LoadError
+  nil
+end
 require_relative "../version"
 module Everywhere
@@ -27,6 +32,19 @@ module Everywhere
     end
     class Client
+      # Everything a flaky link, a hung host or a TLS-intercepting proxy can
+      # throw at us. OpenSSL is an optional stdlib (net/http requires it
+      # best-effort), so its error class is only listed when it loaded.
+      NETWORK_ERRORS = [
+        SocketError, EOFError,
+        Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::ETIMEDOUT,
+        Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::EPIPE,
+        Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout,
+        *(defined?(OpenSSL::SSL::SSLError) ? [OpenSSL::SSL::SSLError] : [])
+      ].freeze
+      OPEN_TIMEOUT = 15
       def self.base_url(explicit = nil)
         (explicit || ENV["EVERYWHERE_PLATFORM_URL"] || DEFAULT_URL).chomp("/")
       end
@@ -56,8 +74,8 @@ module Everywhere
           req.body_stream = io
           http(uri) { |conn| conn.request(req) }
         end
-      rescue SocketError, Errno::ECONNREFUSED, Errno::ETIMEDOUT => e
-        raise Error, "upload to #{uri.host} failed (#{e.class})"
+      rescue *NETWORK_ERRORS => e
+        raise Error, "upload to #{uri.host} failed (#{e.class}: #{e.message})"
       end
       # GET a (possibly redirecting, signed) URL and stream it to dest. Sends the
@@ -83,12 +101,15 @@ module Everywhere
           end
         end
         dest
+      rescue *NETWORK_ERRORS => e
+        raise Error, "download from #{uri.host} failed (#{e.class}: #{e.message})"
       end
       private
       def http(uri, &block)
-        Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https", &block)
+        Net::HTTP.start(uri.hostname, uri.port,
+                        use_ssl: uri.scheme == "https", open_timeout: OPEN_TIMEOUT, &block)
       end
       def request(klass, path, body = nil)
@@ -102,10 +123,10 @@ module Everywhere
           req.body = JSON.generate(body)
         end
-        res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(req) }
+        res = http(uri) { |conn| conn.request(req) }
         Response.new(res.code.to_i, parse(res.body))
-      rescue SocketError, Errno::ECONNREFUSED, Errno::ETIMEDOUT => e
-        raise Error, "couldn't reach the Platform at #{@base_url} (#{e.class})"
+      rescue *NETWORK_ERRORS => e
+        raise Error, "couldn't reach the Platform at #{@base_url} (#{e.class}: #{e.message})"
       end
       def parse(body)

data/lib/everywhere/platform/credentials.rb CHANGED Viewed

@@ -2,6 +2,7 @@
 require "json"
 require "fileutils"
+require_relative "../ui"
 module Everywhere
   module Platform
@@ -22,15 +23,20 @@ module Everywhere
       end
       def self.load
-        data =
-          if File.exist?(path)
-            JSON.parse(File.read(path)) rescue {}
-          else
-            {}
-          end
+        data = File.exist?(path) ? read_or_warn(path) : {}
         new(data.is_a?(Hash) ? data : {})
       end
+      # A corrupt store used to look identical to "logged out", which sends
+      # people re-running login forever. Say which file to delete.
+      def self.read_or_warn(path)
+        JSON.parse(File.read(path))
+      rescue JSON::ParserError, SystemCallError, IOError => e
+        Everywhere::UI.warn("ignoring unreadable credentials at #{path} (#{e.class}) — " \
+                            "delete it and run `every platform login`")
+        {}
+      end
       def initialize(data)
         @data = data
       end
@@ -63,8 +69,12 @@ module Everywhere
         dir = File.dirname(path)
         FileUtils.mkdir_p(dir)
         File.chmod(0o700, dir)
-        File.write(path, "#{JSON.pretty_generate(@data)}\n")
-        File.chmod(0o600, path)
+        # Create it 0600 rather than write-then-chmod: the token must never exist
+        # on disk world-readable, even for an instant.
+        File.open(path, File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |f|
+          f.write("#{JSON.pretty_generate(@data)}\n")
+        end
+        File.chmod(0o600, path) # the mode above only applies on create; tighten stores from older versions
       end
     end
   end