@automattic/vip 4.0.3 → 4.0.6

package/dist/lib/custom-deploy/custom-deploy.js

@@ -3,6 +3,8 @@
 exports.__esModule = true;
 exports.validateCustomDeployKey = validateCustomDeployKey;
 exports.validateFile = validateFile;
+exports.validateLargeArchiveFiles = validateLargeArchiveFiles;
+var _chalk = _interopRequireDefault(require("chalk"));
 var _fs = _interopRequireDefault(require("fs"));
 var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
 var _api = _interopRequireDefault(require("../../lib/api"));
@@ -15,6 +17,14 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const DEPLOY_MAX_FILE_SIZE = 4 * _fileSize.GB_IN_BYTES;
 const WPVIP_DEPLOY_TOKEN = process.env.WPVIP_DEPLOY_TOKEN;
+const SKIP_LARGE_FILE_VALIDATION_FLAG = '--skip-large-file-validation';
+function formatFileSize(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function getLargeArchiveFilesMessage(largeArchiveFiles) {
+  const fileList = largeArchiveFiles.map(file => `- ${file.path} (${formatFileSize(file.size)})`).join('\n');
+  return `Deploy archive contains archive file(s) larger than ${formatFileSize(_customDeploy.LARGE_ARCHIVE_FILE_SIZE_LIMIT)} in the deploy archive:\n${fileList}\nRemove these files from the repository, or rerun with ${_chalk.default.bold(SKIP_LARGE_FILE_VALIDATION_FLAG)} to skip this check.`;
+}
 async function validateCustomDeployKey(app, env) {
   if (!WPVIP_DEPLOY_TOKEN) {
     exit.withError('Valid custom deploy key is required.');
@@ -119,4 +129,31 @@ async function validateFile(appId, envId, fileMeta) {
     });
     exit.withError(`The deploy file size (${fileSize} bytes) exceeds the limit (${DEPLOY_MAX_FILE_SIZE} bytes).`);
   }
+}
+
+/**
+ * @param {number} appId
+ * @param {number} envId
+ * @param {FileMeta} fileMeta
+ */
+async function validateLargeArchiveFiles(appId, envId, fileMeta) {
+  const track = _tracker.trackEventWithEnv.bind(null, appId, envId);
+  let largeArchiveFiles;
+  try {
+    largeArchiveFiles = await (0, _customDeploy.findLargeArchiveFilesInDeployArchive)(fileMeta.fileName);
+  } catch (error) {
+    await track('deploy_app_command_error', {
+      error_type: 'large-archive-file-verify-failed',
+      verify_error: error.message
+    });
+    return exit.withError(`Unable to verify large archive files in the deploy archive: ${error.message}. Rerun with ${SKIP_LARGE_FILE_VALIDATION_FLAG} to skip this check.`);
+  }
+  if (!largeArchiveFiles.length) {
+    return;
+  }
+  await track('deploy_app_command_error', {
+    error_type: 'large-archive-files',
+    large_archive_files: largeArchiveFiles.map(file => file.path)
+  });
+  return exit.withError(getLargeArchiveFilesMessage(largeArchiveFiles));
 }

package/dist/lib/dev-environment/dev-environment-core.js

@@ -28,19 +28,19 @@ var _debug = _interopRequireDefault(require("debug"));
 var _ejs = _interopRequireDefault(require("ejs"));
 var _enquirer = require("enquirer");
 var _graphql = require("graphql");
-var _nodeFetch = _interopRequireDefault(require("node-fetch"));
 var _nodeCrypto = require("node:crypto");
 var _nodeFs = _interopRequireDefault(require("node:fs"));
 var _promises = require("node:fs/promises");
 var _nodePath = _interopRequireDefault(require("node:path"));
 var _semver = _interopRequireDefault(require("semver"));
+var _undici = require("undici");
 var _devEnvironmentCli = require("./dev-environment-cli");
 var _devEnvironmentLando = require("./dev-environment-lando");
 var _landoLoader = require("./lando-loader");
 var _app = _interopRequireDefault(require("../api/app"));
 var _software = require("../config/software");
 var _devEnvironment = require("../constants/dev-environment");
-var _proxyAgent = require("../http/proxy-agent");
+var _proxyDispatcher = require("../http/proxy-dispatcher");
 var _searchAndReplace = require("../search-and-replace");
 var _userError = _interopRequireDefault(require("../user-error"));
 var _xdgData = require("../xdg-data");
@@ -740,9 +740,9 @@ async function maybeUpdateVersion(lando, slug) {
  */
 function fetchVersionList() {
   const url = `https://${_devEnvironment.DEV_ENVIRONMENT_RAW_GITHUB_HOST}${_devEnvironment.DEV_ENVIRONMENT_WORDPRESS_VERSIONS_URI}`;
-  const proxyAgent = (0, _proxyAgent.createProxyAgent)(url);
-  return (0, _nodeFetch.default)(url, {
-    agent: proxyAgent ?? undefined
+  const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(url);
+  return (0, _undici.fetch)(url, {
+    dispatcher: proxyDispatcher ?? undefined
   }).then(res => res.json());
 }
 

package/dist/lib/dev-environment/dev-environment-lando.js

@@ -487,11 +487,15 @@ async function landoInfo(lando, instancePath, options = {}) {
 
     // Add login information
     if (frontEndUrl) {
-      let loginUrl = `${frontEndUrl}wp-admin/`;
+      const loginURL = new URL(`${frontEndUrl}wp-admin/`);
       if (options.autologinKey) {
-        loginUrl += `?vip-dev-autologin=${options.autologinKey}`;
+        loginURL.searchParams.set('vip-dev-autologin', options.autologinKey);
       }
-      appInfo['Login URL'] = loginUrl;
+      loginURL.protocol = 'http:';
+      const httpLoginUrl = loginURL.toString();
+      loginURL.protocol = 'https:';
+      const httpsLoginUrl = loginURL.toString();
+      appInfo['Login URL'] = [httpsLoginUrl, httpLoginUrl].join(_nodeOs.EOL);
       appInfo['Default username'] = 'vipgo';
 
       // Get the stored password from instance data

package/dist/lib/http/download-file.js

@@ -5,11 +5,16 @@ exports.downloadFile = void 0;
 var fs = _interopRequireWildcard(require("fs"));
 var _stream = require("stream");
 var _promises = require("stream/promises");
+var _undici = require("undici");
+var _proxyDispatcher = require("./proxy-dispatcher");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 const downloadFile = async (fileUrl, destinationPath, onProgress) => {
   let response;
+  const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(fileUrl);
   try {
-    response = await fetch(fileUrl);
+    response = await (0, _undici.fetch)(fileUrl, {
+      dispatcher: proxyDispatcher ?? undefined
+    });
   } catch (error) {
     throw new Error(`Request to ${fileUrl} failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
   }

package/dist/lib/http/proxy-dispatcher.js

@@ -0,0 +1,97 @@
+"use strict";
+
+exports.__esModule = true;
+exports.createProxyDispatcher = createProxyDispatcher;
+var _debug = _interopRequireDefault(require("debug"));
+var _undici = require("undici");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('vip:proxy-dispatcher');
+const proxyDispatchers = new Map();
+function normalizeNoProxyToken(token) {
+  return token.trim().toLowerCase();
+}
+function isNoProxyMatch(hostname, port, token) {
+  // eslint-disable-next-line security/detect-possible-timing-attacks
+  if (token === '*') {
+    return true;
+  }
+  const [tokenHostRaw, tokenPort] = token.split(':');
+  const tokenHost = tokenHostRaw.replace(/^\./u, '');
+  if (tokenPort && tokenPort !== port) {
+    return false;
+  }
+  if (hostname === tokenHost) {
+    return true;
+  }
+  return hostname.endsWith(`.${tokenHost}`);
+}
+function isCoveredByNoProxy(url) {
+  const NO_PROXY = process.env.NO_PROXY || process.env.no_proxy || null; // NOSONAR
+
+  if (!NO_PROXY) {
+    return false;
+  }
+  const parsedUrl = new URL(url);
+  const hostname = parsedUrl.hostname.toLowerCase();
+  const port = parsedUrl.port || (parsedUrl.protocol === 'http:' ? '80' : '443');
+  const noProxyTokens = NO_PROXY.split(',').map(normalizeNoProxyToken).filter(Boolean);
+  return noProxyTokens.some(token => isNoProxyMatch(hostname, port, token));
+}
+function resolveProxyUrl(url) {
+  const VIP_PROXY = process.env.VIP_PROXY || process.env.vip_proxy || null; // NOSONAR
+  const SOCKS_PROXY = process.env.SOCKS_PROXY || process.env.socks_proxy || null; // NOSONAR
+  const HTTPS_PROXY = process.env.HTTPS_PROXY || process.env.https_proxy || null; // NOSONAR
+
+  if (VIP_PROXY) {
+    return VIP_PROXY;
+  }
+  if (process.env.VIP_USE_SYSTEM_PROXY && !isCoveredByNoProxy(url)) {
+    if (SOCKS_PROXY) {
+      return SOCKS_PROXY;
+    }
+    if (HTTPS_PROXY) {
+      return HTTPS_PROXY;
+    }
+  }
+  return null;
+}
+function redactProxyUrl(proxyUrl) {
+  try {
+    const parsed = new URL(proxyUrl);
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return 'invalid-proxy-url';
+  }
+}
+let listeners = null;
+
+// Suppress ExperimentalWarning: SOCKS5 proxy support is experimental and subject to change
+function suppressExperimentalSocksWarning(warning) {
+  listeners?.forEach(listener => process.on('warning', listener));
+  if (warning.name !== 'ExperimentalWarning' || !/SOCKS5 proxy/u.test(warning.message)) {
+    listeners?.forEach(listener => listener(warning));
+  }
+}
+
+/**
+ * Build an undici dispatcher from the existing proxy resolution logic.
+ *
+ * This keeps env precedence in one place while allowing fetch callers to
+ * provide `dispatcher` instead of `agent`.
+ */
+function createProxyDispatcher(url) {
+  const proxyUrl = resolveProxyUrl(url);
+  if (!proxyUrl) {
+    return null;
+  }
+  if (!proxyDispatchers.has(proxyUrl)) {
+    debug(`Enabling fetch dispatcher proxy support using config: ${redactProxyUrl(proxyUrl)}`);
+    proxyDispatchers.set(proxyUrl, new _undici.ProxyAgent(proxyUrl));
+  }
+  if (listeners === null) {
+    listeners = process.rawListeners('warning');
+    process.removeAllListeners('warning');
+    process.once('warning', suppressExperimentalSocksWarning);
+  }
+  return proxyDispatchers.get(proxyUrl) ?? null;
+}

package/dist/lib/keychain/secure.js

@@ -2,18 +2,18 @@
 
 exports.__esModule = true;
 exports.default = void 0;
-var _nodeKeytar = _interopRequireDefault(require("@postman/node-keytar"));
+var _keytar = _interopRequireDefault(require("@github/keytar"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 class Secure {
   getPassword(service) {
-    return _nodeKeytar.default.getPassword(service, service);
+    return _keytar.default.getPassword(service, service);
   }
   async setPassword(service, password) {
-    await _nodeKeytar.default.setPassword(service, service, password);
+    await _keytar.default.setPassword(service, service, password);
     return true;
   }
   deletePassword(service) {
-    return _nodeKeytar.default.deletePassword(service, service);
+    return _keytar.default.deletePassword(service, service);
   }
 }
 exports.default = Secure;

package/dist/lib/keychain.js

@@ -10,7 +10,7 @@ const debug = (0, _debug.default)('@automattic/vip:keychain');
 try {
   // Try using Secure keychain ("keytar") first
   // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const Secure = require('./keychain/secure');
+  const Secure = require('./keychain/secure').default;
   keychain = new Secure();
 } catch (error) {
   debug('Cannot use Secure keychain; falling back to Insecure keychain (Details: %o)', error);

package/dist/lib/media-import/status.js

@@ -9,9 +9,11 @@ var _enquirer = require("enquirer");
 var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
 var _promises = require("node:fs/promises");
 var _nodePath = require("node:path");
+var _undici = require("undici");
 var _api = _interopRequireDefault(require("../../lib/api"));
 var _format = require("../../lib/cli/format");
 var _mediaFileImport = require("../../lib/media-import/media-file-import");
+var _proxyDispatcher = require("../http/proxy-dispatcher");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const IMPORT_MEDIA_PROGRESS_POLL_INTERVAL = 1000;
 const ONE_MINUTE_IN_MILLISECONDS = 1000 * 60;
@@ -237,7 +239,10 @@ Downloading errors details from ${fileErrorsUrl}
       clearAfter: true
     });
     try {
-      const response = await fetch(fileErrorsUrl);
+      const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(fileErrorsUrl);
+      const response = await (0, _undici.fetch)(fileErrorsUrl, {
+        dispatcher: proxyDispatcher ?? undefined
+      });
       return await response.json();
     } catch (err) {
       progressTracker.suffix += `${_chalk.default.red(`Could not download import errors report\n${err.message}`)}`;

package/dist/lib/retry.js

@@ -4,6 +4,7 @@ exports.__esModule = true;
 exports.EXPONENTIAL_BACKOFF_STARTING_IN_50_MS = exports.EXPONENTIAL_BACKOFF_STARTING_IN_200_MS = exports.EXPONENTIAL_BACKOFF_STARTING_IN_100_MS = void 0;
 exports.exponentialBackoff = exponentialBackoff;
 exports.retry = retry;
+var _promises = require("node:timers/promises");
 // copied over from our internal lib
 
 const EXPONENTIAL_BACKOFF_STARTING_IN_50_MS = exports.EXPONENTIAL_BACKOFF_STARTING_IN_50_MS = exponentialBackoff(50);
@@ -108,7 +109,7 @@ function isValidInterval(interval) {
   }
   return typeof interval === 'number' && Number.isInteger(interval) && interval >= 0 && interval <= MAX_INTERVAL_BETWEEN_ATTEMPTS;
 }
-async function awaitInterval(interval, attemptNumber) {
+function awaitInterval(interval, attemptNumber) {
   let newInterval;
   if (typeof interval === 'function') {
     newInterval = interval(attemptNumber);
@@ -118,7 +119,7 @@ async function awaitInterval(interval, attemptNumber) {
   } else {
     newInterval = interval;
   }
-  return new Promise(resolve => setTimeout(resolve, newInterval));
+  return (0, _promises.setTimeout)(newInterval);
 }
 function validateTask(task) {
   if (typeof task !== 'function') {

package/dist/lib/search-and-replace.js

@@ -130,13 +130,12 @@ const searchAndReplace = async (fileName, pairs, {
     // replace() throws strings... OMG
     exit.withError(replaceError);
   }
-  const streams = [replacedStream];
+  const transforms = [];
   if (isMyDumper) {
-    streams.push((0, _database.fixMyDumperTransform)());
+    transforms.push((0, _database.fixMyDumperTransform)());
   }
-  streams.push(writeStream);
   try {
-    await (0, _promises.pipeline)(streams);
+    await (0, _promises.pipeline)(replacedStream, ...transforms, writeStream);
   } catch (error) {
     console.log(_chalk.default.red("Oh no! We couldn't write to the output file.  Please check your available disk space and file/folder permissions."));
     throw error;

package/dist/lib/validations/custom-deploy.js

@@ -1,6 +1,8 @@
 "use strict";
 
 exports.__esModule = true;
+exports.LARGE_ARCHIVE_FILE_SIZE_LIMIT = void 0;
+exports.findLargeArchiveFilesInDeployArchive = findLargeArchiveFilesInDeployArchive;
 exports.validateDeployFileExt = validateDeployFileExt;
 exports.validateFilename = validateFilename;
 exports.validateName = validateName;
@@ -11,6 +13,7 @@ var _nodeFs = require("node:fs");
 var _path = _interopRequireDefault(require("path"));
 var tar = _interopRequireWildcard(require("tar"));
 var exit = _interopRequireWildcard(require("../../lib/cli/exit"));
+var _fileSize = require("../../lib/constants/file-size");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const errorMessages = {
@@ -22,6 +25,62 @@ const errorMessages = {
 };
 const symlinkIgnorePattern = /\/node_modules\/[^/]+\/\.bin\//;
 const macosxDir = '__MACOSX';
+const LARGE_ARCHIVE_FILE_SIZE_LIMIT = exports.LARGE_ARCHIVE_FILE_SIZE_LIMIT = 20 * _fileSize.MB_IN_BYTES;
+function getDeployFileExt(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith('.tar.gz')) {
+    return '.tar.gz';
+  }
+  if (lower.endsWith('.tgz')) {
+    return '.tgz';
+  }
+  if (lower.endsWith('.zip')) {
+    return '.zip';
+  }
+  return _path.default.extname(lower);
+}
+function isDeployArchiveFile(filename) {
+  return ['.zip', '.tar.gz', '.tgz'].includes(getDeployFileExt(filename));
+}
+async function findLargeArchiveFilesInZipArchive(filePath) {
+  const zipFile = new _nodeStreamZip.default.async({
+    file: filePath
+  });
+  try {
+    const zipEntries = await zipFile.entries();
+    return Object.values(zipEntries).filter(entry => !entry.isDirectory && isDeployArchiveFile(entry.name) && entry.size > LARGE_ARCHIVE_FILE_SIZE_LIMIT).map(entry => ({
+      path: entry.name,
+      size: entry.size
+    }));
+  } finally {
+    await zipFile.close();
+  }
+}
+async function findLargeArchiveFilesInTarArchive(filePath) {
+  const largeArchiveFiles = [];
+  await tar.list({
+    file: filePath,
+    onReadEntry: entry => {
+      if (entry.type === 'File' && isDeployArchiveFile(entry.path) && entry.size > LARGE_ARCHIVE_FILE_SIZE_LIMIT) {
+        largeArchiveFiles.push({
+          path: entry.path,
+          size: entry.size
+        });
+      }
+    }
+  });
+  return largeArchiveFiles;
+}
+async function findLargeArchiveFilesInDeployArchive(filePath) {
+  const ext = getDeployFileExt(filePath);
+  if (ext === '.zip') {
+    return findLargeArchiveFilesInZipArchive(filePath);
+  }
+  if (ext === '.tar.gz' || ext === '.tgz') {
+    return findLargeArchiveFilesInTarArchive(filePath);
+  }
+  return [];
+}
 
 /**
  * Check if a file has a valid extension
@@ -30,10 +89,7 @@ const macosxDir = '__MACOSX';
  * @returns {boolean} True if the extension is valid
  */
 function validateDeployFileExt(filename) {
-  let ext = _path.default.extname(filename).toLowerCase();
-  if (ext === '.gz' && _path.default.extname(_path.default.basename(filename, ext)) === '.tar') {
-    ext = '.tar.gz';
-  }
+  const ext = getDeployFileExt(filename);
   if (!['.zip', '.tar.gz', '.tgz'].includes(ext)) {
     exit.withError(errorMessages.invalidExt);
   }

package/dist/lib/validations/line-by-line.js

@@ -4,9 +4,8 @@ exports.__esModule = true;
 exports.fileLineValidations = fileLineValidations;
 exports.getReadInterface = getReadInterface;
 var _debug = _interopRequireDefault(require("debug"));
-var _nodeFs = require("node:fs");
+var _nodeEvents = require("node:events");
 var _promises = require("node:fs/promises");
-var _nodeReadline = require("node:readline");
 var exit = _interopRequireWildcard(require("../../lib/cli/exit"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
@@ -18,11 +17,8 @@ async function getReadInterface(filename) {
   } catch {
     exit.withError('The file at the provided path is either missing or not readable. Please check the input and try again.');
   }
-  return (0, _nodeReadline.createInterface)({
-    input: (0, _nodeFs.createReadStream)('', {
-      fd
-    }),
-    output: undefined
+  return fd.readLines({
+    encoding: 'binary'
   });
 }
 async function fileLineValidations(appId, envId, fileName, validations, searchReplace) {
@@ -41,8 +37,7 @@ async function fileLineValidations(appId, envId, fileName, validations, searchRe
   });
 
   // Block until the processing completes
-  await new Promise(resolve => readInterface.on('close', resolve));
-  readInterface.close();
+  await (0, _nodeEvents.once)(readInterface, 'close');
   return Promise.all(validations.map(validation => {
     if (Object.hasOwn(validation, 'postLineExecutionProcessing') && typeof validation.postLineExecutionProcessing === 'function') {
       return validation.postLineExecutionProcessing({

package/dist/lib/validations/sql.js

@@ -6,6 +6,7 @@ exports.validateFilename = validateFilename;
 exports.validateImportFileExtension = void 0;
 var _singleLineLog = require("@wwa/single-line-log");
 var _chalk = _interopRequireDefault(require("chalk"));
+var _nodeEvents = require("node:events");
 var _nodePath = _interopRequireDefault(require("node:path"));
 var exit = _interopRequireWildcard(require("../../lib/cli/exit"));
 var _clientFileUploader = require("../../lib/client-file-uploader");
@@ -472,8 +473,7 @@ const validate = async (filename, options = DEFAULT_VALIDATION_OPTIONS) => {
   });
 
   // Block until the processing completes
-  await new Promise(resolve => readInterface.on('close', resolve));
-  readInterface.close();
+  await (0, _nodeEvents.once)(readInterface, 'close');
   await postLineExecutionProcessing({
     isImport: options.isImport,
     skipChecks: options.skipChecks

package/docs/COMMANDER-MIGRATION.md

@@ -16,6 +16,7 @@ Goal: remove the abandoned `args` package, keep CLI behavior stable, and support
 - `_opts` controls are still honored: app/env context fetch, confirmation gating, output formatting, wildcard command handling, required positional args.
 - Shared formatting/output and telemetry hooks are still in the wrapper path.
 - Local nested subcommand dispatch still works via sibling executable resolution.
+- Short-option equals normalization: `-x=value` is rewritten to `-x value` for short options expecting values before parsing; boolean short flags are not affected. Tracked option defaults are applied after parsing when the option remains undefined post-parse, preserving default+parser parity.
 
 ## Post-Migration Hardening
 

package/docs/RELEASING.md

@@ -51,6 +51,8 @@ A few steps should be completed before releasing:
 
 1. You have completed [final testing before deployment](TESTING.md#final-testing-before-releasing).
 
+1. Run the release smoke tests to verify high-risk CLI parser/dispatch commands. First ensure the binaries are built (`npm run build`), then run `npm run smoke:release`. This tests option parsing, short-option equals syntax, and command routing against the built binaries.
+
 1. The pre-publish [script](https://github.com/Automattic/vip-cli/blob/trunk/helpers/prepublishOnly.js) has been run. This script performs some confidence checks to avoid common mistakes.
 
 1. Finally, release your changes as a [new minor or major NPM version](#releasing-a-new-version).

package/docs/TESTING.md

@@ -64,4 +64,19 @@ VIP_PROXY="" API_HOST=http://localhost:4000 node ./dist/bin/vip -- wp option get
 
 ## Final testing before releasing
 
-TODO: How should final testing before releasing be done?
+Before releasing a new version, run the release smoke tests to verify high-risk CLI commands:
+
+```bash
+npm run smoke:release
+```
+
+This script tests critical parser/dispatch paths for commands like `logs`, `slowlogs`, `wp`, and `dev-env shell`. It verifies:
+
+- Short-option equals syntax (e.g., `-l=10`)
+- Default value explicit matches
+- Option-only and separator/subcommand handling
+- Command routing without requiring credentials, API access, or Docker/Lando
+
+The tests target the built `dist/bin/*.js` binaries, so ensure `npm run build` has been run first. All tests use `--help` or other non-executing forms to avoid side effects.
+
+Exit code 0 indicates all tests passed; non-zero indicates failures that should be reviewed before release.

package/helpers/build-sea.js

@@ -83,8 +83,8 @@ function buildBundle() {
 		format: 'cjs',
 		outfile: bundlePath,
 		external: [
-			'@postman/node-keytar',
-			'@postman/node-keytar/*',
+			'@github/keytar',
+			'@github/keytar/*',
 			'cpu-features',
 			'cpu-features/*',
 			'lando',