@automattic/vip 4.0.3 → 4.0.5

package/dist/lib/http/proxy-dispatcher.js

@@ -0,0 +1,97 @@
+"use strict";
+
+exports.__esModule = true;
+exports.createProxyDispatcher = createProxyDispatcher;
+var _debug = _interopRequireDefault(require("debug"));
+var _undici = require("undici");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('vip:proxy-dispatcher');
+const proxyDispatchers = new Map();
+function normalizeNoProxyToken(token) {
+  return token.trim().toLowerCase();
+}
+function isNoProxyMatch(hostname, port, token) {
+  // eslint-disable-next-line security/detect-possible-timing-attacks
+  if (token === '*') {
+    return true;
+  }
+  const [tokenHostRaw, tokenPort] = token.split(':');
+  const tokenHost = tokenHostRaw.replace(/^\./u, '');
+  if (tokenPort && tokenPort !== port) {
+    return false;
+  }
+  if (hostname === tokenHost) {
+    return true;
+  }
+  return hostname.endsWith(`.${tokenHost}`);
+}
+function isCoveredByNoProxy(url) {
+  const NO_PROXY = process.env.NO_PROXY || process.env.no_proxy || null; // NOSONAR
+
+  if (!NO_PROXY) {
+    return false;
+  }
+  const parsedUrl = new URL(url);
+  const hostname = parsedUrl.hostname.toLowerCase();
+  const port = parsedUrl.port || (parsedUrl.protocol === 'http:' ? '80' : '443');
+  const noProxyTokens = NO_PROXY.split(',').map(normalizeNoProxyToken).filter(Boolean);
+  return noProxyTokens.some(token => isNoProxyMatch(hostname, port, token));
+}
+function resolveProxyUrl(url) {
+  const VIP_PROXY = process.env.VIP_PROXY || process.env.vip_proxy || null; // NOSONAR
+  const SOCKS_PROXY = process.env.SOCKS_PROXY || process.env.socks_proxy || null; // NOSONAR
+  const HTTPS_PROXY = process.env.HTTPS_PROXY || process.env.https_proxy || null; // NOSONAR
+
+  if (VIP_PROXY) {
+    return VIP_PROXY;
+  }
+  if (process.env.VIP_USE_SYSTEM_PROXY && !isCoveredByNoProxy(url)) {
+    if (SOCKS_PROXY) {
+      return SOCKS_PROXY;
+    }
+    if (HTTPS_PROXY) {
+      return HTTPS_PROXY;
+    }
+  }
+  return null;
+}
+function redactProxyUrl(proxyUrl) {
+  try {
+    const parsed = new URL(proxyUrl);
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return 'invalid-proxy-url';
+  }
+}
+let listeners = null;
+
+// Suppress ExperimentalWarning: SOCKS5 proxy support is experimental and subject to change
+function suppressExperimentalSocksWarning(warning) {
+  listeners?.forEach(listener => process.on('warning', listener));
+  if (warning.name !== 'ExperimentalWarning' || !/SOCKS5 proxy/u.test(warning.message)) {
+    listeners?.forEach(listener => listener(warning));
+  }
+}
+
+/**
+ * Build an undici dispatcher from the existing proxy resolution logic.
+ *
+ * This keeps env precedence in one place while allowing fetch callers to
+ * provide `dispatcher` instead of `agent`.
+ */
+function createProxyDispatcher(url) {
+  const proxyUrl = resolveProxyUrl(url);
+  if (!proxyUrl) {
+    return null;
+  }
+  if (!proxyDispatchers.has(proxyUrl)) {
+    debug(`Enabling fetch dispatcher proxy support using config: ${redactProxyUrl(proxyUrl)}`);
+    proxyDispatchers.set(proxyUrl, new _undici.ProxyAgent(proxyUrl));
+  }
+  if (listeners === null) {
+    listeners = process.rawListeners('warning');
+    process.removeAllListeners('warning');
+    process.once('warning', suppressExperimentalSocksWarning);
+  }
+  return proxyDispatchers.get(proxyUrl) ?? null;
+}

package/dist/lib/keychain/secure.js

@@ -2,18 +2,18 @@
 
 exports.__esModule = true;
 exports.default = void 0;
-var _nodeKeytar = _interopRequireDefault(require("@postman/node-keytar"));
+var _keytar = _interopRequireDefault(require("@github/keytar"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 class Secure {
   getPassword(service) {
-    return _nodeKeytar.default.getPassword(service, service);
+    return _keytar.default.getPassword(service, service);
   }
   async setPassword(service, password) {
-    await _nodeKeytar.default.setPassword(service, service, password);
+    await _keytar.default.setPassword(service, service, password);
     return true;
   }
   deletePassword(service) {
-    return _nodeKeytar.default.deletePassword(service, service);
+    return _keytar.default.deletePassword(service, service);
   }
 }
 exports.default = Secure;

package/dist/lib/keychain.js

@@ -10,7 +10,7 @@ const debug = (0, _debug.default)('@automattic/vip:keychain');
 try {
   // Try using Secure keychain ("keytar") first
   // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const Secure = require('./keychain/secure');
+  const Secure = require('./keychain/secure').default;
   keychain = new Secure();
 } catch (error) {
   debug('Cannot use Secure keychain; falling back to Insecure keychain (Details: %o)', error);

package/dist/lib/media-import/status.js

@@ -9,9 +9,11 @@ var _enquirer = require("enquirer");
 var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
 var _promises = require("node:fs/promises");
 var _nodePath = require("node:path");
+var _undici = require("undici");
 var _api = _interopRequireDefault(require("../../lib/api"));
 var _format = require("../../lib/cli/format");
 var _mediaFileImport = require("../../lib/media-import/media-file-import");
+var _proxyDispatcher = require("../http/proxy-dispatcher");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const IMPORT_MEDIA_PROGRESS_POLL_INTERVAL = 1000;
 const ONE_MINUTE_IN_MILLISECONDS = 1000 * 60;
@@ -237,7 +239,10 @@ Downloading errors details from ${fileErrorsUrl}
       clearAfter: true
     });
     try {
-      const response = await fetch(fileErrorsUrl);
+      const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(fileErrorsUrl);
+      const response = await (0, _undici.fetch)(fileErrorsUrl, {
+        dispatcher: proxyDispatcher ?? undefined
+      });
       return await response.json();
     } catch (err) {
       progressTracker.suffix += `${_chalk.default.red(`Could not download import errors report\n${err.message}`)}`;

package/dist/lib/retry.js

@@ -4,6 +4,7 @@ exports.__esModule = true;
 exports.EXPONENTIAL_BACKOFF_STARTING_IN_50_MS = exports.EXPONENTIAL_BACKOFF_STARTING_IN_200_MS = exports.EXPONENTIAL_BACKOFF_STARTING_IN_100_MS = void 0;
 exports.exponentialBackoff = exponentialBackoff;
 exports.retry = retry;
+var _promises = require("node:timers/promises");
 // copied over from our internal lib
 
 const EXPONENTIAL_BACKOFF_STARTING_IN_50_MS = exports.EXPONENTIAL_BACKOFF_STARTING_IN_50_MS = exponentialBackoff(50);
@@ -108,7 +109,7 @@ function isValidInterval(interval) {
   }
   return typeof interval === 'number' && Number.isInteger(interval) && interval >= 0 && interval <= MAX_INTERVAL_BETWEEN_ATTEMPTS;
 }
-async function awaitInterval(interval, attemptNumber) {
+function awaitInterval(interval, attemptNumber) {
   let newInterval;
   if (typeof interval === 'function') {
     newInterval = interval(attemptNumber);
@@ -118,7 +119,7 @@ async function awaitInterval(interval, attemptNumber) {
   } else {
     newInterval = interval;
   }
-  return new Promise(resolve => setTimeout(resolve, newInterval));
+  return (0, _promises.setTimeout)(newInterval);
 }
 function validateTask(task) {
   if (typeof task !== 'function') {

package/dist/lib/search-and-replace.js

@@ -130,13 +130,12 @@ const searchAndReplace = async (fileName, pairs, {
     // replace() throws strings... OMG
     exit.withError(replaceError);
   }
-  const streams = [replacedStream];
+  const transforms = [];
   if (isMyDumper) {
-    streams.push((0, _database.fixMyDumperTransform)());
+    transforms.push((0, _database.fixMyDumperTransform)());
   }
-  streams.push(writeStream);
   try {
-    await (0, _promises.pipeline)(streams);
+    await (0, _promises.pipeline)(replacedStream, ...transforms, writeStream);
   } catch (error) {
     console.log(_chalk.default.red("Oh no! We couldn't write to the output file.  Please check your available disk space and file/folder permissions."));
     throw error;

package/dist/lib/validations/custom-deploy.js

@@ -1,6 +1,8 @@
 "use strict";
 
 exports.__esModule = true;
+exports.LARGE_ARCHIVE_FILE_SIZE_LIMIT = void 0;
+exports.findLargeArchiveFilesInDeployArchive = findLargeArchiveFilesInDeployArchive;
 exports.validateDeployFileExt = validateDeployFileExt;
 exports.validateFilename = validateFilename;
 exports.validateName = validateName;
@@ -11,6 +13,7 @@ var _nodeFs = require("node:fs");
 var _path = _interopRequireDefault(require("path"));
 var tar = _interopRequireWildcard(require("tar"));
 var exit = _interopRequireWildcard(require("../../lib/cli/exit"));
+var _fileSize = require("../../lib/constants/file-size");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const errorMessages = {
@@ -22,6 +25,62 @@ const errorMessages = {
 };
 const symlinkIgnorePattern = /\/node_modules\/[^/]+\/\.bin\//;
 const macosxDir = '__MACOSX';
+const LARGE_ARCHIVE_FILE_SIZE_LIMIT = exports.LARGE_ARCHIVE_FILE_SIZE_LIMIT = 20 * _fileSize.MB_IN_BYTES;
+function getDeployFileExt(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith('.tar.gz')) {
+    return '.tar.gz';
+  }
+  if (lower.endsWith('.tgz')) {
+    return '.tgz';
+  }
+  if (lower.endsWith('.zip')) {
+    return '.zip';
+  }
+  return _path.default.extname(lower);
+}
+function isDeployArchiveFile(filename) {
+  return ['.zip', '.tar.gz', '.tgz'].includes(getDeployFileExt(filename));
+}
+async function findLargeArchiveFilesInZipArchive(filePath) {
+  const zipFile = new _nodeStreamZip.default.async({
+    file: filePath
+  });
+  try {
+    const zipEntries = await zipFile.entries();
+    return Object.values(zipEntries).filter(entry => !entry.isDirectory && isDeployArchiveFile(entry.name) && entry.size > LARGE_ARCHIVE_FILE_SIZE_LIMIT).map(entry => ({
+      path: entry.name,
+      size: entry.size
+    }));
+  } finally {
+    await zipFile.close();
+  }
+}
+async function findLargeArchiveFilesInTarArchive(filePath) {
+  const largeArchiveFiles = [];
+  await tar.list({
+    file: filePath,
+    onReadEntry: entry => {
+      if (entry.type === 'File' && isDeployArchiveFile(entry.path) && entry.size > LARGE_ARCHIVE_FILE_SIZE_LIMIT) {
+        largeArchiveFiles.push({
+          path: entry.path,
+          size: entry.size
+        });
+      }
+    }
+  });
+  return largeArchiveFiles;
+}
+async function findLargeArchiveFilesInDeployArchive(filePath) {
+  const ext = getDeployFileExt(filePath);
+  if (ext === '.zip') {
+    return findLargeArchiveFilesInZipArchive(filePath);
+  }
+  if (ext === '.tar.gz' || ext === '.tgz') {
+    return findLargeArchiveFilesInTarArchive(filePath);
+  }
+  return [];
+}
 
 /**
  * Check if a file has a valid extension
@@ -30,10 +89,7 @@ const macosxDir = '__MACOSX';
  * @returns {boolean} True if the extension is valid
  */
 function validateDeployFileExt(filename) {
-  let ext = _path.default.extname(filename).toLowerCase();
-  if (ext === '.gz' && _path.default.extname(_path.default.basename(filename, ext)) === '.tar') {
-    ext = '.tar.gz';
-  }
+  const ext = getDeployFileExt(filename);
   if (!['.zip', '.tar.gz', '.tgz'].includes(ext)) {
     exit.withError(errorMessages.invalidExt);
   }

package/dist/lib/validations/line-by-line.js

@@ -4,9 +4,8 @@ exports.__esModule = true;
 exports.fileLineValidations = fileLineValidations;
 exports.getReadInterface = getReadInterface;
 var _debug = _interopRequireDefault(require("debug"));
-var _nodeFs = require("node:fs");
+var _nodeEvents = require("node:events");
 var _promises = require("node:fs/promises");
-var _nodeReadline = require("node:readline");
 var exit = _interopRequireWildcard(require("../../lib/cli/exit"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
@@ -18,11 +17,8 @@ async function getReadInterface(filename) {
   } catch {
     exit.withError('The file at the provided path is either missing or not readable. Please check the input and try again.');
   }
-  return (0, _nodeReadline.createInterface)({
-    input: (0, _nodeFs.createReadStream)('', {
-      fd
-    }),
-    output: undefined
+  return fd.readLines({
+    encoding: 'binary'
   });
 }
 async function fileLineValidations(appId, envId, fileName, validations, searchReplace) {
@@ -41,8 +37,7 @@ async function fileLineValidations(appId, envId, fileName, validations, searchRe
   });
 
   // Block until the processing completes
-  await new Promise(resolve => readInterface.on('close', resolve));
-  readInterface.close();
+  await (0, _nodeEvents.once)(readInterface, 'close');
   return Promise.all(validations.map(validation => {
     if (Object.hasOwn(validation, 'postLineExecutionProcessing') && typeof validation.postLineExecutionProcessing === 'function') {
       return validation.postLineExecutionProcessing({

package/dist/lib/validations/sql.js

@@ -6,6 +6,7 @@ exports.validateFilename = validateFilename;
 exports.validateImportFileExtension = void 0;
 var _singleLineLog = require("@wwa/single-line-log");
 var _chalk = _interopRequireDefault(require("chalk"));
+var _nodeEvents = require("node:events");
 var _nodePath = _interopRequireDefault(require("node:path"));
 var exit = _interopRequireWildcard(require("../../lib/cli/exit"));
 var _clientFileUploader = require("../../lib/client-file-uploader");
@@ -472,8 +473,7 @@ const validate = async (filename, options = DEFAULT_VALIDATION_OPTIONS) => {
   });
 
   // Block until the processing completes
-  await new Promise(resolve => readInterface.on('close', resolve));
-  readInterface.close();
+  await (0, _nodeEvents.once)(readInterface, 'close');
   await postLineExecutionProcessing({
     isImport: options.isImport,
     skipChecks: options.skipChecks

package/docs/COMMANDER-MIGRATION.md

@@ -16,6 +16,7 @@ Goal: remove the abandoned `args` package, keep CLI behavior stable, and support
 - `_opts` controls are still honored: app/env context fetch, confirmation gating, output formatting, wildcard command handling, required positional args.
 - Shared formatting/output and telemetry hooks are still in the wrapper path.
 - Local nested subcommand dispatch still works via sibling executable resolution.
+- Short-option equals normalization: `-x=value` is rewritten to `-x value` for short options expecting values before parsing; boolean short flags are not affected. Tracked option defaults are applied after parsing when the option remains undefined post-parse, preserving default+parser parity.
 
 ## Post-Migration Hardening
 

package/docs/RELEASING.md

@@ -51,6 +51,8 @@ A few steps should be completed before releasing:
 
 1. You have completed [final testing before deployment](TESTING.md#final-testing-before-releasing).
 
+1. Run the release smoke tests to verify high-risk CLI parser/dispatch commands. First ensure the binaries are built (`npm run build`), then run `npm run smoke:release`. This tests option parsing, short-option equals syntax, and command routing against the built binaries.
+
 1. The pre-publish [script](https://github.com/Automattic/vip-cli/blob/trunk/helpers/prepublishOnly.js) has been run. This script performs some confidence checks to avoid common mistakes.
 
 1. Finally, release your changes as a [new minor or major NPM version](#releasing-a-new-version).

package/docs/TESTING.md

@@ -64,4 +64,19 @@ VIP_PROXY="" API_HOST=http://localhost:4000 node ./dist/bin/vip -- wp option get
 
 ## Final testing before releasing
 
-TODO: How should final testing before releasing be done?
+Before releasing a new version, run the release smoke tests to verify high-risk CLI commands:
+
+```bash
+npm run smoke:release
+```
+
+This script tests critical parser/dispatch paths for commands like `logs`, `slowlogs`, `wp`, and `dev-env shell`. It verifies:
+
+- Short-option equals syntax (e.g., `-l=10`)
+- Default value explicit matches
+- Option-only and separator/subcommand handling
+- Command routing without requiring credentials, API access, or Docker/Lando
+
+The tests target the built `dist/bin/*.js` binaries, so ensure `npm run build` has been run first. All tests use `--help` or other non-executing forms to avoid side effects.
+
+Exit code 0 indicates all tests passed; non-zero indicates failures that should be reviewed before release.

package/helpers/build-sea.js

@@ -83,8 +83,8 @@ function buildBundle() {
 		format: 'cjs',
 		outfile: bundlePath,
 		external: [
-			'@postman/node-keytar',
-			'@postman/node-keytar/*',
+			'@github/keytar',
+			'@github/keytar/*',
 			'cpu-features',
 			'cpu-features/*',
 			'lando',