ruby_everywhere 0.6.0 → 0.8.0

data/lib/everywhere/commands/platform/runner.rb

@@ -7,15 +7,19 @@ require "shellwords"
 require "base64"
 require "json"
 require "open3"
+require "securerandom"
+require "rubygems/package"
+require "zlib"
 require_relative "../../ui"
+require_relative "../../host"
 require_relative "../../paths"
 require_relative "../../platform/client"
 
 module Everywhere
   module Commands
-    # `every platform runner` — runs ON a build runner (a GitHub Actions macOS
-    # machine, or any Mac). It's the glue between the Runner API and the
-    # `every release` signing engine:
+    # `every platform runner` — runs ON a build runner: a macOS machine for the
+    # macos/ios targets, macOS or Linux for android. It's the glue between the
+    # Runner API and the `every release` signing engine:
     #
     #   job spec → mark running → download+extract snapshot → pull JIT creds into
     #   a throwaway keychain (+ .p8) → every release (streaming logs) → upload the
@@ -24,6 +28,30 @@ module Everywhere
     # Authenticated with the per-artifact runner token, so it can only touch the
     # one artifact it was dispatched for.
     class PlatformRunner < Dry::CLI::Command
+      # What `every release` leaves in dist/ per os, newest first when several
+      # match, and how the blob store should label it.
+      ARTIFACTS = { "macos" => %w[*.zip], "ios" => %w[*.ipa], "android" => %w[*.aab *.apk] }.freeze
+      CONTENT_TYPES = {
+        ".zip" => "application/zip",
+        ".ipa" => "application/octet-stream",
+        ".apk" => "application/vnd.android.package-archive",
+        ".aab" => "application/octet-stream"
+      }.freeze
+      RELEASE_NARRATION = {
+        "macos"   => "every release — press → sign → notarize → staple",
+        "ios"     => "every release — build → archive → export .ipa",
+        "android" => "every release — assemble → sign → bundle"
+      }.freeze
+
+      # A .mobileprovision has to be in both: Xcode reads the UserData copy,
+      # xcodebuild's own resolution still reads the MobileDevice one.
+      PROFILE_DIRS = [
+        "~/Library/MobileDevice/Provisioning Profiles",
+        "~/Library/Developer/Xcode/UserData/Provisioning Profiles"
+      ].freeze
+
+      PROFILE_UUID = /\A[0-9a-f-]+\z/i
+
       desc "Run a Platform build on this machine (used by the hosted runner)"
 
       option :artifact,  required: true, desc: "Artifact public id (art_…)"
@@ -49,10 +77,10 @@ module Everywhere
           src = fetch_snapshot(work, job)
           signing_env = pull_credentials(work)
 
-          status, release_json, zip = run_release(src, job, signing_env, shell_dir)
+          status, release_json, built = run_release(src, job, signing_env, shell_dir)
 
-          if status == "succeeded" && zip
-            complete_success(zip, release_json)
+          if status == "succeeded" && built
+            complete_success(built, release_json)
           else
             complete_failure("build failed — see log")
           end
@@ -62,6 +90,12 @@ module Everywhere
       rescue Everywhere::Error => e
         complete_failure(e.message)
         UI.die!(e.message)
+      rescue Everywhere::Fatal => e
+        # UI.die! raises Fatal (a SystemExit), which the rescue above can't see —
+        # without this an upload/signing failure would leave the artifact stuck
+        # "running" on the Platform forever.
+        complete_failure(e.message.to_s.empty? ? "build failed" : e.message)
+        raise
       end
 
       private
@@ -74,32 +108,128 @@ module Everywhere
         @client.download(job["snapshot_url"], tarball)
         src = File.join(work, "src")
         FileUtils.mkdir_p(src)
-        UI.die!("failed to extract snapshot") unless system("tar", "-xzf", tarball, "-C", src)
+        extract_snapshot(tarball, src)
         src
       end
 
+      # Read with the same pure-Ruby tar the snapshot was WRITTEN with
+      # (Platform::Snapshot uses Gem::Package::TarWriter) instead of shelling
+      # out: `tar -xzf` follows "../" members and symlink members straight out
+      # of the extraction dir, and this archive arrives over the network.
+      def extract_snapshot(tarball, dest)
+        Zlib::GzipReader.open(tarball) do |gz|
+          Gem::Package::TarReader.new(gz) do |tar|
+            tar.each { |entry| extract_entry(entry, dest) }
+          end
+        end
+      rescue Zlib::Error, Gem::Package::TarInvalidError => e
+        UI.die!("failed to extract snapshot (#{e.class.name.split("::").last})")
+      end
+
+      def extract_entry(entry, dest)
+        name = entry.full_name
+        UI.die!("the snapshot contains an unsafe path (#{name})") if unsafe_entry?(name)
+        # Snapshot only ever writes regular files; anything else in the archive
+        # didn't come from us.
+        return unless entry.file? && !entry.symlink?
+
+        path = File.join(dest, name)
+        FileUtils.mkdir_p(File.dirname(path))
+        File.open(path, "wb") { |out| out.write(entry.read(1 << 20)) until entry.eof? }
+        mode = entry.header.mode & 0o777
+        File.chmod(mode.zero? ? 0o644 : mode, path)
+      end
+
+      def unsafe_entry?(name)
+        name.empty? || name.start_with?("/") || name.split("/").include?("..")
+      end
+
       def pull_credentials(work)
         remote_log("pulling signing credentials")
         creds = get!("/runner/artifacts/#{@artifact}/credentials")["credentials"] || []
         env = {}
         creds.each do |cred|
-          path = File.join(work, cred["filename"])
+          path = credential_path(work, cred["filename"])
           File.binwrite(path, Base64.strict_decode64(cred["data_base64"]))
           File.chmod(0o600, path)
+          meta = cred["metadata"] || {}
           case cred["kind"]
           when "apple_developer_id", "apple_distribution"
-            env["APPLE_SIGNING_IDENTITY"] = install_certificate(path, cred["metadata"] || {}, work)
+            env["EVERY_IOS_TEAM_ID"] ||= meta["team_id"]
+            # An android job runs on Linux, where there's no keychain to import
+            # into. A stray apple credential there is the Platform's mistake, not
+            # a reason to lose the build.
+            if Host.darwin?
+              env["APPLE_SIGNING_IDENTITY"] = install_certificate(path, meta, work)
+            else
+              remote_log("skipping #{cred["kind"]} — keychain import needs macOS")
+            end
           when "apple_asc_api_key"
             env["NOTARY_KEY"]    = path
-            env["NOTARY_KEY_ID"] = cred.dig("metadata", "key_id")
-            env["NOTARY_ISSUER"] = cred.dig("metadata", "issuer_id")
+            env["NOTARY_KEY_ID"] = meta["key_id"]
+            env["NOTARY_ISSUER"] = meta["issuer_id"]
+          when "apple_provisioning_profile"
+            profile = install_provisioning_profile(path)
+            env["EVERY_IOS_PROVISIONING_PROFILE"] = profile[:name]
+            env["EVERY_IOS_TEAM_ID"] ||= profile[:team]
+          when "android_keystore"
+            env["EVERY_ANDROID_KEYSTORE"]          = path
+            env["EVERY_ANDROID_KEYSTORE_PASSWORD"] = meta["store_password"]
+            env["EVERY_ANDROID_KEY_ALIAS"]         = meta["key_alias"]
+            # One-key keystores are usually created with a single password.
+            env["EVERY_ANDROID_KEY_PASSWORD"]      = meta["key_password"] || meta["store_password"]
           end
         end
-        env
+        env.compact
       end
 
+      # Credential filenames come from the Platform API, so they're untrusted
+      # input: a "../../.ssh/authorized_keys" would write outside the job's
+      # tmpdir. Only ever a basename, inside work.
+      def credential_path(work, filename)
+        name = File.basename(filename.to_s)
+        UI.die!("the Platform delivered a credential with no usable filename") if name.empty? || [".", ".."].include?(name)
+
+        File.join(work, name)
+      end
+
+      # A .mobileprovision is a CMS-signed DER blob wrapped around a plain XML
+      # plist. Scanning for the plist reads it identically on Linux, where
+      # `security cms -D` doesn't exist.
+      def install_provisioning_profile(path)
+        plist = File.binread(path)[/<\?xml.*<\/plist>/m]
+        UI.die!("the delivered provisioning profile has no embedded plist") unless plist
+
+        uuid = plist[%r{<key>UUID</key>\s*<string>([^<]+)</string>}m, 1]
+        name = plist[%r{<key>Name</key>\s*<string>([^<]+)</string>}m, 1]
+        # TeamIdentifier is an <array> of one — the first <string> after the key.
+        team = plist[%r{<key>TeamIdentifier</key>.*?<string>([^<]+)</string>}m, 1]
+        # The UUID becomes a filename in the user's Provisioning Profiles dirs,
+        # and it's read out of a blob we didn't author — a "../" one would land
+        # anywhere. Shape-check it before it's ever a path segment.
+        UI.die!("the delivered provisioning profile has no usable UUID") unless uuid&.match?(PROFILE_UUID)
+
+        if Host.darwin?
+          profile_dirs.each do |dir|
+            FileUtils.mkdir_p(dir)
+            FileUtils.cp(path, File.join(dir, "#{uuid}.mobileprovision"))
+          end
+        end
+        remote_log("provisioning profile #{UI.bold(name || uuid)}#{team ? " #{UI.dim("(team #{team})")}" : ""}")
+        { name: name, team: team, uuid: uuid }
+      end
+
+      def profile_dirs = PROFILE_DIRS.map { |dir| File.expand_path(dir) }
+
+
       # Import the .p12 into a throwaway keychain and add it to the search list so
       # codesign finds the identity. Returns the identity name for notarize.sh.
+      #
+      # ACCEPTED RISK: `security` takes its passwords on argv, where `ps` can see
+      # them — it has no stdin form (a bare unlock-keychain prompts on the tty,
+      # which is no use in a headless job). What's exposed is this keychain's
+      # random single-use password and the .p12's own, on an ephemeral
+      # single-tenant runner that is destroyed after the build.
       def install_certificate(p12, metadata, work)
         @keychain = File.join(work, "runner.keychain-db")
         password = SecureRandom.hex(12)
@@ -124,11 +254,16 @@ module Everywhere
       end
 
       def run_release(src, job, signing_env, shell_dir)
-        remote_log("every release — press → sign → notarize → staple")
+        os = job.dig("target", "os").to_s
+        channel = job.dig("target", "distribution_channel").to_s
+        remote_log(RELEASE_NARRATION.fetch(os, "every release"))
         cmd = [RbConfig.ruby, "-I", lib_dir, every_exe, "release",
                "--root", src,
-               "--target", "#{job.dig("target", "os")}-#{job.dig("target", "arch")}",
-               "--channel", job.dig("target", "distribution_channel").to_s]
+               "--target", "#{os}-#{job.dig("target", "arch")}",
+               "--channel", channel]
+        # Play wants an App Bundle; every other Android channel (direct download,
+        # sideload, Amazon) wants the installable apk `every release` defaults to.
+        cmd += ["--format", "aab"] if os == "android" && channel == "play"
         cmd += ["--shell-dir", shell_dir] if shell_dir
 
         # The web UI renders ANSI, but `every release` runs here as a pipe (not a
@@ -144,37 +279,45 @@ module Everywhere
 
         dist = File.join(src, "dist")
         release_json = JSON.parse(File.read(File.join(dist, "release.json"))) rescue nil
-        zip = Dir[File.join(dist, "*.zip")].max_by { |f| File.mtime(f) }
-        [success ? "succeeded" : "failed", release_json, zip]
+        built = ARTIFACTS.fetch(os, %w[*.zip])
+                         .filter_map { |p| Dir[File.join(dist, p)].max_by { |f| File.mtime(f) } }.first
+        [success ? "succeeded" : "failed", release_json, built]
       end
 
-      def complete_success(zip, release_json)
+      def complete_success(built, release_json)
         report_phase("uploading")
-        remote_log("uploading artifact #{UI.dim("(#{(File.size(zip) / 1024.0 / 1024.0).round(1)}MB)")}")
-        signed_id = upload_artifact(zip)
+        remote_log("uploading artifact #{UI.dim("(#{(File.size(built) / 1024.0 / 1024.0).round(1)}MB)")}")
+        signed_id = upload_artifact(built)
         post!("/runner/artifacts/#{@artifact}/complete",
               status: "succeeded", file_signed_id: signed_id, release_json: release_json)
-        UI.success("build succeeded — #{File.basename(zip)}")
+        UI.success("build succeeded — #{File.basename(built)}")
       end
 
+      # Best-effort: if the thing that failed WAS connectivity, reporting the
+      # failure fails too — raising here would replace the real error and abort
+      # cleanup, so log locally and move on.
       def complete_failure(message)
         return if @completed
 
         @client.post("/runner/artifacts/#{@artifact}/complete", status: "failed", error: message)
         @completed = true
+      rescue Everywhere::Error => e
+        UI.warn("couldn't report the failure to the Platform (#{e.message})")
       end
 
-      def upload_artifact(zip)
+      def upload_artifact(built)
         require_relative "../../platform/snapshot"
         reservation = post!("/runner/artifacts/#{@artifact}/upload",
-          filename: File.basename(zip), byte_size: File.size(zip),
-          checksum: Everywhere::Platform::Snapshot.md5_base64(zip), content_type: "application/zip")
+          filename: File.basename(built), byte_size: File.size(built),
+          checksum: Everywhere::Platform::Snapshot.md5_base64(built), content_type: content_type_for(built))
         du = reservation["direct_upload"] || {}
-        res = @client.put_file(du["url"], zip, headers: du["headers"] || {})
+        res = @client.put_file(du["url"], built, headers: du["headers"] || {})
         UI.die!("artifact upload failed (HTTP #{res.code})") unless res.code.to_i.between?(200, 299)
         reservation["signed_id"]
       end
 
+      def content_type_for(path) = CONTENT_TYPES.fetch(File.extname(path), "application/octet-stream")
+
       # ---- log streaming -------------------------------------------------------
 
       # Run cmd, echoing output to this process's stdout AND forwarding it to the
@@ -241,6 +384,8 @@ module Everywhere
       end
 
       def restore_keychains
+        return unless Host.darwin?
+
         run_security("list-keychains", "-d", "user", "-s", *@saved_keychains) if @saved_keychains
         run_security("delete-keychain", @keychain) if @keychain && File.exist?(@keychain)
       end

data/lib/everywhere/commands/preview.rb

@@ -0,0 +1,286 @@
+# frozen_string_literal: true
+
+require "dry/cli"
+require "socket"
+require "securerandom"
+require "shellwords"
+require "timeout"
+require "uri"
+require_relative "../shellout"
+require_relative "../console"
+require_relative "../child_processes"
+require_relative "../child_supervision"
+require_relative "../framework"
+require_relative "../config"
+require_relative "../jump"
+
+module Everywhere
+  module Commands
+    # Put the running dev server in someone's hand: boot the app, open a
+    # Cloudflare tunnel to it, and print a QR code that opens the Jump app
+    # (spec: platform/docs/jump.md). The server gets EVERYWHERE_JUMP_TOKEN, so
+    # the Jump endpoints in MobileConfigEndpoint / MobileConfigsController are
+    # live for exactly as long as this command runs.
+    #
+    # Three transports, one seam (tunnel_url):
+    #   default        cloudflared quick tunnel — free, no account, HTTPS,
+    #                  best-effort (restarted with a fresh QR if it drops)
+    #   --tunnel-name  a named tunnel from the developer's own Cloudflare
+    #                  account, for a stable hostname (--tunnel-host says what
+    #                  that hostname is — cloudflared doesn't know its own DNS)
+    #   --lan          no tunnel: the LAN address, for offline use
+    class Preview < Dry::CLI::Command
+      include ChildSupervision
+
+      desc "Run the dev server behind a shareable tunnel for the Jump app"
+
+      option :port,        default: "3000", desc: "Dev server port"
+      option :lan,         type: :boolean, default: false, desc: "Skip the tunnel and share the LAN address"
+      option :tunnel_name, default: nil, desc: "Run a named cloudflared tunnel instead of a quick one"
+      option :tunnel_host, default: nil, desc: "Public hostname the named tunnel is routed to"
+
+      TRYCLOUDFLARE_URL = %r{https://[a-z0-9-]+\.trycloudflare\.com}
+      TUNNEL_BOOT_TIMEOUT = 30
+
+      def call(port: "3000", lan: false, tunnel_name: nil, tunnel_host: nil, **)
+        port = validate_port!(port)
+        # An Integer, because @port is interpolated into the cloudflared command
+        # strings — nothing that reaches a shell should be a free-form String.
+        @port = Integer(port, 10)
+        init_children!
+        @framework = detect_local_framework
+        @config = Everywhere::Config.load(@framework.root)
+        # Multi-use on purpose: a forwarded link must work for a second
+        # coworker's device. Dies with this process — bearers are HMACs over
+        # it, so they die too.
+        @token = SecureRandom.urlsafe_base64(24)
+
+        @lan = lan
+        if lan
+          @url = lan_url(port)
+        else
+          Shellout.ensure_tool!("cloudflared",
+                                "preview shares your app through a Cloudflare tunnel — " \
+                                "install it with `brew install cloudflared` (or use --lan)")
+          validate_tunnel_options!(tunnel_name, tunnel_host)
+          @tunnel_name = tunnel_name
+          @tunnel_host = tunnel_host
+          @url = start_tunnel
+        end
+
+        start_server(port)
+        warn_if_loopback_only if lan
+        announce
+        wait
+      rescue Interrupt
+        nil
+      ensure
+        teardown_children
+      end
+
+      private
+
+      # Preview exists to share a *local* dev server. A remote-mode root has
+      # no local server — the deployed URL is already shareable.
+      def detect_local_framework
+        Framework.detect
+      rescue Everywhere::Error
+        config = Everywhere::Config.load(Dir.pwd)
+        if config.remote?
+          UI.die!("this app runs in remote mode — #{config.remote_url} is already online, share that " \
+                  "(preview tunnels a local dev server)")
+        end
+        UI.die!("no supported framework here (Rails, Hanami, Sinatra) — nothing to preview")
+      end
+
+      def validate_tunnel_options!(name, host)
+        return if name.nil? && host.nil?
+        return if name && host
+
+        UI.die!("--tunnel-name and --tunnel-host go together: cloudflared runs the named tunnel, " \
+                "but only your Cloudflare DNS knows its public hostname")
+      end
+
+      # --- transports -----------------------------------------------------------
+
+      def lan_url(port)
+        "http://#{lan_ip}:#{port}"
+      end
+
+      def lan_ip
+        Socket.ip_address_list.find { |a| a.ipv4_private? }&.ip_address ||
+          UI.die!("couldn't find a LAN address — is this machine on a network? (drop --lan to tunnel instead)")
+      end
+
+      def start_tunnel
+        if @tunnel_name
+          UI.step("starting named tunnel #{UI.bold(@tunnel_name)} → #{UI.cyan("https://#{@tunnel_host}")}")
+          spawn_tunnel("cloudflared tunnel run --url http://127.0.0.1:#{@port} #{@tunnel_name.shellescape}")
+          "https://#{@tunnel_host}"
+        else
+          UI.step("starting Cloudflare quick tunnel")
+          quick_tunnel_url
+        end
+      end
+
+      # Quick tunnels choose their hostname at startup and print it once;
+      # everything else cloudflared logs is noise here, so the relay drops it
+      # and the on_line hook fishes out the URL.
+      def quick_tunnel_url
+        found = Queue.new
+        spawn_tunnel("cloudflared tunnel --url http://127.0.0.1:#{@port}",
+                     on_line: ->(line) { (url = line[TRYCLOUDFLARE_URL]) && found << url },
+                     quiet: true)
+        begin
+          Timeout.timeout(TUNNEL_BOOT_TIMEOUT) { found.pop }
+        rescue Timeout::Error
+          UI.die!("cloudflared never reported a tunnel URL after #{TUNNEL_BOOT_TIMEOUT}s — " \
+                  "check your network, or share on the local network with --lan")
+        end
+      end
+
+      # quiet drops the child's routine chatter but always lets errors
+      # through — a quick tunnel that can't connect must say why.
+      def spawn_tunnel(cmd, on_line: nil, quiet: false)
+        filter = quiet ? ->(line) { line.match?(/\bERR\b|error/i) ? line : :drop } : nil
+        supervise(:tunnel, {}, cmd, chdir: Dir.pwd, filter: filter, on_line: on_line)
+      end
+
+      # Rails' puma template binds 0.0.0.0, but a rackup-style bin/dev often
+      # pins --host 127.0.0.1 — then the LAN URL on the QR is a promise the
+      # server can't keep. Say so, instead of letting the phone time out.
+      def warn_if_loopback_only
+        TCPSocket.new(URI.parse(@url).host, Integer(@port)).close
+      rescue SystemCallError
+        UI.warn("the dev server only listens on 127.0.0.1, so phones can't reach #{@url} — " \
+                "make bin/dev bind 0.0.0.0 (rackup --host 0.0.0.0), or drop --lan and tunnel instead")
+      end
+
+      # --- the dev server -------------------------------------------------------
+
+      def start_server(port)
+        # Attaching to an already-running server (dev's behavior) can't work
+        # here: that process has no EVERYWHERE_JUMP_TOKEN, so Jump could never
+        # pair with it.
+        if port_open?(port)
+          UI.die!("something is already running on port #{port} — preview must start the server itself " \
+                  "(the Jump pairing token rides in on its environment); stop that server or use --port")
+        end
+
+        UI.step("starting #{UI.bold(@framework.name)} dev server #{UI.dim("(" + @framework.dev_command + ")")}")
+        env = { "PORT" => port.to_s,
+                "EVERYWHERE_JUMP_TOKEN" => @token,
+                "EVERYWHERE_PREVIEW_HOST" => URI.parse(@url).host }
+        # `rails server` binds localhost by default, which would make the LAN
+        # address on the QR a lie. BINDING is Rails' own env override; rackup
+        # bin/devs that pin --host still get warn_if_loopback_only.
+        env["BINDING"] = "0.0.0.0" if @lan
+        pid = supervise(:web, env, @framework.dev_command, chdir: @framework.root)
+        wait_for_port(port, pid: pid)
+      end
+
+      # --- the invitation -------------------------------------------------------
+
+      def jump_base = ENV.fetch("EVERY_JUMP_URL", "https://jump.rubyeverywhere.com").chomp("/")
+
+      def connect_url
+        "#{jump_base}/connect?#{URI.encode_www_form(url: @url, token: @token)}"
+      end
+
+      # POST /j on the Jump site trades the long connect URL for a short one —
+      # a nicer link to read out and a much smaller QR. Best-effort: preview
+      # works offline from the Jump site's point of view.
+      def share_link
+        require "net/http"
+        require "json"
+        uri = URI.parse("#{jump_base}/j")
+        response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                                                       open_timeout: 5, read_timeout: 5) do |http|
+          http.post(uri.path, JSON.generate(url: @url, token: @token),
+                    "content-type" => "application/json")
+        end
+        response.code == "201" ? JSON.parse(response.body)["url"] : nil
+      rescue StandardError
+        nil
+      end
+
+      def announce
+        link = share_link || connect_url
+        UI.step("preview of #{UI.bold(@config.name)} is live → #{UI.cyan(@url)}")
+        Console.print(qr_ansi(link)) if $stdout.tty?
+        Console.print("  Scan with your phone's camera, or send:\n\n    #{UI.cyan(link)}\n\n")
+        Console.print("  #{UI.dim("Manual entry in Jump:")} #{@url}  #{UI.dim("token:")} #{@token}\n")
+        Console.print(UI.dim("  The link and QR die with this session — Ctrl-C to stop.\n"))
+        UI.note("waiting for devices…", marker: "⌁", color: :cyan)
+      end
+
+      # Half-block rendering: ▀ painted fg-for-top-module, bg-for-bottom packs
+      # two QR rows into one terminal line and one module into one column —
+      # a quarter of the area of rqrcode's own as_ansi, which burns two full
+      # cells per module. Explicit black/white (not theme colors), because a
+      # camera needs dark-on-light no matter what the terminal theme thinks.
+      #
+      # rqrcode is pure Ruby. The rescue is portability hardening: a missing
+      # gem downgrades the session to link-only instead of killing it.
+      def qr_ansi(link)
+        require "rqrcode"
+        modules = RQRCode::QRCode.new(link, level: :l).modules
+        quiet = 2
+        size = modules.length + quiet * 2
+        dark = lambda do |x, y|
+          gx = x - quiet
+          gy = y - quiet
+          gy.between?(0, modules.length - 1) && gx.between?(0, modules.length - 1) && modules[gy][gx]
+        end
+        (0...size).step(2).map do |y|
+          "  " + (0...size).map do |x|
+            top = dark.call(x, y)
+            bottom = (y + 1 < size) && dark.call(x, y + 1)
+            "\e[#{top ? 30 : 97};#{bottom ? 40 : 107}m▀"
+          end.join + "\e[0m"
+        end.join("\n") << "\e[0m\n"
+      rescue LoadError, StandardError => e
+        UI.warn("couldn't render the QR (#{e.class}) — use the link below")
+        ""
+      end
+
+      # --- the wait loop --------------------------------------------------------
+
+      # The server's death ends the session; the tunnel's doesn't. Quick
+      # tunnels are explicitly best-effort — Cloudflare recycles them — so a
+      # dead tunnel is restarted and the fresh URL re-announced. (The token
+      # survives, but the origin changed, so recents/short links need the new
+      # invitation.)
+      def wait
+        loop do
+          sleep 1
+          web = @children.synchronize { @pids[:web] }
+          UI.die!("the dev server exited — scroll up for its output") unless ChildProcesses.alive?(web)
+
+          tunnel = @children.synchronize { @pids[:tunnel] }
+          next if tunnel.nil? || ChildProcesses.alive?(tunnel)
+
+          UI.warn("the tunnel dropped — starting a fresh one")
+          stop_child(:tunnel)
+          @url = start_tunnel
+          announce
+        end
+      end
+
+      # --- child supervision (dev.rb's pattern, without the dock) ---------------
+
+      def spawn_child(env, cmd, chdir:)
+        return Shellout.spawn_pty(env, cmd, chdir: chdir) if Shellout.pty?
+
+        # No pty (Windows): a plain pipe loses colors but keeps the output —
+        # and the quick tunnel's URL parsing, which reads it. child_env for
+        # the same reason spawn_pty uses it: the CLI's own BUNDLE_* must not
+        # follow the app's server into its child.
+        io, writer = IO.pipe
+        pid = Process.spawn(Shellout.child_env(env), cmd, chdir: chdir, %i[out err] => writer)
+        writer.close
+        [io, pid]
+      end
+    end
+  end
+end

data/lib/everywhere/commands/publish.rb

@@ -8,6 +8,7 @@ require_relative "../s3"
 require_relative "../update_manifest"
 require_relative "../paths"
 require_relative "../ui"
+require_relative "build"
 
 module Everywhere
   module Commands
@@ -21,6 +22,15 @@ module Everywhere
     # from everywhere.yml's updates.s3 section. See UpdateManifest for the
     # layout/JSON contract.
     class Publish < Dry::CLI::Command
+      # Only the .apk needs a specific type: Android refuses to install a
+      # download the server labelled application/octet-stream.
+      CONTENT_TYPES = {
+        ".zip" => "application/zip",
+        ".apk" => "application/vnd.android.package-archive",
+        ".aab" => "application/octet-stream",
+        ".ipa" => "application/octet-stream"
+      }.freeze
+
       desc "Publish a released build to your update bucket (self-hosted auto-updates)"
 
       option :root,        default: ".",  desc: "App root directory"
@@ -46,6 +56,12 @@ module Everywhere
           publish!(receipt_path(receipt), notes: read_notes(notes, notes_file),
                    key: key, latest_alias: latest_alias, force: force)
         end
+      rescue Everywhere::S3::Error => e
+        # RequestTimeExpired means the bucket rejected our SigV4 timestamp; the
+        # only realistic local cause is a wrong clock, and the raw message
+        # doesn't say so.
+        hint = e.message.include?("RequestTimeExpired") ? " — your system clock may be off by more than 15 minutes" : ""
+        UI.die!("#{e.message}#{hint}")
       end
 
       private
@@ -131,7 +147,7 @@ module Everywhere
       def rollback!(version, latest_alias:)
         # os/arch come from the receipt on publish; on rollback there may be no
         # dist/, so take the target from build.targets (or the default).
-        target = Array(@config.targets).first || "macos-arm64"
+        target = Array(@config.targets).first || Build::DEFAULT_TARGET
         os, arch = target.split("-", 2)
         loc = { channel: @channel, os: os, arch: arch, prefix: prefix }
 
@@ -157,6 +173,8 @@ module Everywhere
       def preflight!
         UI.die!("no updates.url in everywhere.yml — add an updates: section (see `every updates keygen`)") unless @config.updates_url
         UI.die!("no updates.public_key in everywhere.yml — run `every updates keygen`") unless @config.updates_public_key
+        updates_errors = @config.updates_errors
+        UI.die!("updates: in config/everywhere.yml:\n#{updates_errors.join("\n")}") unless updates_errors.empty?
         UI.die!("no updates.s3.bucket in everywhere.yml") if s3_config["bucket"].to_s.empty?
         UI.die!("missing bucket credentials — set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY") if
           ENV["AWS_ACCESS_KEY_ID"].to_s.empty? || ENV["AWS_SECRET_ACCESS_KEY"].to_s.empty?
@@ -207,6 +225,8 @@ module Everywhere
         signature
       rescue Minisign::PassphraseError
         UI.die!("wrong or missing key passphrase — set EVERYWHERE_SIGNING_KEY_PASSPHRASE")
+      rescue Minisign::Error => e
+        UI.die!("couldn't sign with that key — #{e.message}")
       end
 
       def signing_key(key_option)
@@ -244,7 +264,7 @@ module Everywhere
       end
 
       def content_type(filename)
-        filename.end_with?(".zip") ? "application/zip" : "application/octet-stream"
+        CONTENT_TYPES.fetch(File.extname(filename), "application/octet-stream")
       end
 
       def read_notes(notes, notes_file)