@coderook/cli 0.34.9 → 0.34.11

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.9",
+  "version": "0.34.11",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -436,6 +436,32 @@ artifacts or with `cbx attach <file>`, so a release made by pushing a tag
 simply has none until something adds them — which is what a release without a
 build has always looked like.
 
+## Releases and app downloads
+
+```
+cbx release 1.4.0                        name the newest save as a release
+cbx attach ./dist/MyApp-Setup-1.4.0.exe  put the installer on it
+cbx release --downloads public           offer its downloads, keep the source private
+cbx releases                             each release, its files, and who can take them
+```
+
+In a public project, `--downloads public` offers a release's notes,
+attachments and update feed to anybody while the version's own files keep
+their visibility, so one project holds the code and ships the app. There is
+no need for a second project that only holds releases. `--downloads private`
+takes them back. Without a release name it changes an existing release and
+leaves its notes alone.
+
+`cbx releases` marks each one `public`, `downloads public` or `private`, and
+for a public project prints the addresses an app or a script reads, which
+need no account:
+
+```
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases/latest
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/updates      electron-updater's generic provider
+```
+
 ## Building for every platform
 
 ```

package/dist/cbx/src/core/download.js

@@ -3,8 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Downloader = exports.DownloadCancelled = void 0;
+exports.Downloader = exports.DownloadFailed = exports.DownloadCancelled = void 0;
 exports.underway = underway;
+exports.plainReason = plainReason;
 exports.applyMode = applyMode;
 /**
  * Bringing a project down: the file list for a version, then its bytes.
@@ -34,6 +35,25 @@ async function exists(target) {
         return false;
     }
 }
+/** How many bytes are at `target`, or nothing when there is no file. */
+async function sizeOnDisk(target) {
+    try {
+        return (await (0, promises_1.stat)(target)).size;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * A running hash of what is already at `target`, to carry on from. Streamed,
+ * so resuming a large file does not first hold all of it.
+ */
+async function digestPrefix(target) {
+    const hash = (0, node_crypto_1.createHash)("sha256");
+    for await (const block of (0, node_fs_1.createReadStream)(target))
+        hash.update(block);
+    return hash;
+}
 /** The digest of what is on disk, or null when nothing is there to read. */
 async function digestOf(target) {
     try {
@@ -101,6 +121,90 @@ class DownloadCancelled extends Error {
     }
 }
 exports.DownloadCancelled = DownloadCancelled;
+/**
+ * One transfer that could not be completed, named, with the reason in words.
+ *
+ * What people saw instead was the single word `terminated` — undici's message
+ * for a body the other end stopped sending — with no file, no cause and no
+ * hint that anything had been tried. Eight clones started seconds after the
+ * API was redeployed lost their connections mid-file, and four of them ended
+ * on exactly that. The status and code travel with it, because callers ask
+ * whether a failure was a refusal or the network.
+ */
+class DownloadFailed extends Error {
+    what;
+    reason;
+    attempts;
+    status;
+    code;
+    constructor(what, reason, attempts, cause) {
+        super(`Could not download ${what}: ${reason}` +
+            (attempts > 1 ? ` (tried ${attempts} times).` : "."), { cause });
+        this.what = what;
+        this.reason = reason;
+        this.attempts = attempts;
+        this.status = cause.status;
+        this.code = cause.code;
+    }
+}
+exports.DownloadFailed = DownloadFailed;
+/** What each network failure means, for somebody who has not met the code. */
+const PLAIN = {
+    ENOTFOUND: "CodeRook's address could not be looked up, so this computer may be offline",
+    EAI_AGAIN: "CodeRook's address could not be looked up, so this computer may be offline",
+    ECONNREFUSED: "the connection was refused",
+    ECONNRESET: "the connection was dropped",
+    EPIPE: "the connection was dropped",
+    ETIMEDOUT: "the connection timed out",
+    ENETUNREACH: "there is no route to the internet from here",
+    EHOSTUNREACH: "there is no route to the internet from here",
+    UND_ERR_CONNECT_TIMEOUT: "the connection timed out",
+    UND_ERR_SOCKET: "the connection closed before it finished arriving",
+    UND_ERR_RES_CONTENT_LENGTH_MISMATCH: "the connection closed before it finished arriving",
+};
+/**
+ * Why one request failed, said so that a person can act on it.
+ *
+ * Node keeps the real reason in `cause`, and for a failed happy-eyeballs
+ * connection in `cause.errors`; the top-level message is `fetch failed` or
+ * `terminated` whatever happened. The code goes in brackets after the words,
+ * for whoever needs to tell a dead network from a server that hung up.
+ */
+function plainReason(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    const status = error.status;
+    if (typeof status === "number") {
+        /* The fallback message is only the route; the service's own words are better. */
+        return error.message.startsWith("/v1/")
+            ? `CodeRook answered ${status}`
+            : `CodeRook answered ${status}: ${error.message}`;
+    }
+    if (error.name === "TimeoutError") {
+        return `it had not finished arriving after ${REQUEST_DEADLINE_MS / 60_000} minutes`;
+    }
+    const cause = error.cause;
+    const causes = cause?.errors?.length ? cause.errors : cause ? [cause] : [];
+    const codes = [...new Set(causes.map((one) => one.code).filter(Boolean))];
+    const said = codes.map((code) => PLAIN[code]).find(Boolean);
+    const detail = causes
+        .map((one) => [one.code, one.message].filter(Boolean).join(": "))
+        .filter(Boolean)[0];
+    if (error.message === "terminated") {
+        return (`${said ?? "the connection closed before it finished arriving"}` +
+            (detail ? ` (${detail})` : ""));
+    }
+    if (error.message === "fetch failed") {
+        return (`CodeRook could not be reached${said ? `: ${said}` : ""}` +
+            (detail ? ` (${detail})` : ""));
+    }
+    return error.message;
+}
+/** Where `content-range` says a partial answer starts, or null. */
+function rangeStart(headers) {
+    const match = /^bytes (\d+)-\d+\/(?:\d+|\*)$/.exec(headers.get("content-range") ?? "");
+    return match ? Number(match[1]) : null;
+}
 class Downloader {
     credentials;
     aborted = false;
@@ -117,36 +221,73 @@ class Downloader {
             throw new DownloadCancelled();
     }
     /**
-     * One request, repeated while repeating it might help.
+     * Do `work` until it succeeds, it fails in a way repeating cannot help, or
+     * the attempts run out.
      *
      * A restore makes at least one request per file and, for a file kept in
      * pieces, one per piece — three thousand seven hundred and fifty-six for a
      * single file here. At those numbers a dropped connection is not a risk but
      * a certainty, and without this the whole restore ends on the first one.
+     *
+     * `work` is the whole transfer, body included. Retrying only until the
+     * headers arrived was the gap that ended clones: `fetch()` resolves on the
+     * headers, so a connection cut while the bytes were still coming — which is
+     * what a redeploy does to every connection it holds — escaped the loop and
+     * ended the whole run on one file.
+     *
+     * `progressed` lets a transfer that moved forward before failing start its
+     * count again, so a long file over a connection that keeps dropping is
+     * finished rather than abandoned; one that makes no progress still stops
+     * after `RETRY_ATTEMPTS`. `halt` stops it without retrying, for a run that
+     * has already failed elsewhere. `what` names the transfer in the error a
+     * person finally sees.
      */
-    async request(route) {
+    async repeat(work, options = {}) {
         let wait = retry_js_1.RETRY_FIRST_WAIT_MS;
-        for (let attempt = 1;; attempt += 1) {
+        let tries = 0;
+        for (let attempt = 1, stalled = 1;; attempt += 1, stalled += 1) {
             this.check();
+            options.halt?.throwIfAborted();
+            tries = attempt;
             try {
-                return await this.attempt(route);
+                return await work(attempt);
             }
             catch (error) {
                 // Its own cancellation first: `worthRetrying` knows nothing of it.
-                if (error instanceof DownloadCancelled)
-                    throw error;
-                if (attempt >= retry_js_1.RETRY_ATTEMPTS || !(0, retry_js_1.worthRetrying)(error))
-                    throw error;
+                if (error instanceof DownloadCancelled || this.aborted)
+                    throw new DownloadCancelled();
+                if (options.halt?.aborted)
+                    throw options.halt.reason;
+                if (await options.progressed?.()) {
+                    stalled = 0;
+                    wait = retry_js_1.RETRY_FIRST_WAIT_MS;
+                }
+                if (stalled >= retry_js_1.RETRY_ATTEMPTS || !(0, retry_js_1.worthRetrying)(error)) {
+                    if (!options.what)
+                        throw error;
+                    throw new DownloadFailed(options.what, plainReason(error), tries, error);
+                }
                 try {
-                    await (0, retry_js_1.pauseFor)(this.controller.signal, wait);
+                    await (0, retry_js_1.pauseFor)(options.halt
+                        ? AbortSignal.any([this.controller.signal, options.halt])
+                        : this.controller.signal, wait);
                 }
                 catch {
-                    throw new DownloadCancelled();
+                    if (this.aborted)
+                        throw new DownloadCancelled();
+                    throw options.halt?.reason ?? error;
                 }
                 wait *= 2;
             }
         }
     }
+    /** A whole response body and its headers, under the retry rule. */
+    async bytes(route, what, halt) {
+        return this.repeat(async () => {
+            const reply = await this.attempt(route, REQUEST_DEADLINE_MS, halt);
+            return { body: Buffer.from(await reply.arrayBuffer()), headers: reply.headers };
+        }, { what, halt });
+    }
     async attempt(route, 
     /*
       Longer where the service has to build the answer before it can send it.
@@ -158,7 +299,9 @@ class Downloader {
       to assemble and longer under load; three minutes is a request that has
       failed, not one that is still working.
     */
-    deadline = REQUEST_DEADLINE_MS) {
+    deadline = REQUEST_DEADLINE_MS, 
+    /* The run's own stop, when a sibling transfer has already failed it. */
+    halt, extra) {
         const token = await this.credentials.token();
         if (!token)
             throw new Error("Sign in again before downloading");
@@ -167,6 +310,7 @@ class Downloader {
                 authorization: `Bearer ${token}`,
                 "user-agent": "CodeRook/0.1",
                 ...(0, identify_js_1.clientHeaders)(),
+                ...extra,
             },
             /*
               The download's own cancellation, and a deadline.
@@ -180,6 +324,7 @@ class Downloader {
             signal: AbortSignal.any([
                 this.controller.signal,
                 AbortSignal.timeout(deadline),
+                ...(halt ? [halt] : []),
             ]),
         });
         if (!response.ok) {
@@ -190,8 +335,9 @@ class Downloader {
             */
             const tooOld = (0, identify_js_1.readRefusal)(response.status, text);
             if (tooOld) {
-                throw new Error(`${tooOld.message} You are running ${tooOld.yourVersion ?? "an older build"}; ` +
-                    `update from ${tooOld.upgradeUrl}.`);
+                /* With its status, so it is not retried as though it were the network. */
+                throw Object.assign(new Error(`${tooOld.message} You are running ${tooOld.yourVersion ?? "an older build"}; ` +
+                    `update from ${tooOld.upgradeUrl}.`), { status: response.status });
             }
             let message = `${route} failed (${response.status})`;
             let code;
@@ -226,30 +372,29 @@ class Downloader {
      * These routes are reads, so repeating the whole request is safe and is the
      * only way to replace a truncated body.
      */
-    async json(route) {
-        let wait = retry_js_1.RETRY_FIRST_WAIT_MS;
-        for (let attempt = 1;; attempt += 1) {
-            this.check();
-            try {
-                return await (await this.attempt(route)).json();
-            }
-            catch (error) {
-                if (error instanceof DownloadCancelled)
-                    throw error;
-                if (attempt >= retry_js_1.RETRY_ATTEMPTS || !(0, retry_js_1.worthRetrying)(error))
-                    throw error;
-                try {
-                    await (0, retry_js_1.pauseFor)(this.controller.signal, wait);
-                }
-                catch {
-                    throw new DownloadCancelled();
-                }
-                wait *= 2;
-            }
+    async json(route, what) {
+        let tries = 0;
+        try {
+            return await this.repeat(async (attempt) => {
+                tries = attempt;
+                return (await (await this.attempt(route)).json());
+            });
+        }
+        catch (error) {
+            /*
+              A refusal keeps its own words: "not found" is the answer, and callers
+              read its status. Only a failure that never reached an answer is
+              renamed, because that is the one that arrived as a bare `terminated`.
+            */
+            if (error instanceof DownloadCancelled)
+                throw error;
+            if (typeof error.status === "number")
+                throw error;
+            throw new DownloadFailed(what, plainReason(error), tries, error);
         }
     }
     async versions(repositoryId) {
-        const body = await this.json(`/v1/repositories/${repositoryId}/versions`);
+        const body = await this.json(`/v1/repositories/${repositoryId}/versions`, "the list of versions");
         return (body.versions ?? []).map((row) => ({
             id: String(row.id ?? ""),
             sequence: Number(row.sequence ?? 0),
@@ -277,11 +422,17 @@ class Downloader {
      * files to `git fast-import`, which wants them one after another anyway.
      */
     async archive(repositoryId, versionId) {
-        const response = await this.attempt(`/v1/repositories/${repositoryId}/versions/${versionId}/archive`, ARCHIVE_DEADLINE_MS);
-        return new Uint8Array(await response.arrayBuffer());
+        /*
+          Under the retry rule like everything else. It had none: one dropped
+          connection during an archive of hundreds of megabytes ended the import.
+        */
+        return this.repeat(async () => {
+            const response = await this.attempt(`/v1/repositories/${repositoryId}/versions/${versionId}/archive`, ARCHIVE_DEADLINE_MS);
+            return new Uint8Array(await response.arrayBuffer());
+        }, { what: "the version's archive" });
     }
     async files(repositoryId, versionId) {
-        const body = await this.json(`/v1/repositories/${repositoryId}/versions/${versionId}/files`);
+        const body = await this.json(`/v1/repositories/${repositoryId}/versions/${versionId}/files`, "the version's list of files");
         return (body.files ?? []).map((row) => {
             const pieces = Array.isArray(row.chunks) ? row.chunks : null;
             const packed = row.pack && typeof row.pack === "object"
@@ -394,8 +545,8 @@ class Downloader {
                 if (packId && restoredPacks.has(packId))
                     continue;
                 if (packId) {
-                    const reply = await this.request(`/v1/repositories/${repositoryId}/objects/${packId}`);
-                    const body = Buffer.from(await reply.arrayBuffer());
+                    const reply = await this.bytes(`/v1/repositories/${repositoryId}/objects/${packId}`, packName(packed.get(packId) ?? []));
+                    const body = reply.body;
                     const packDigest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
                     const expectedPackDigest = reply.headers.get("x-coderook-sha256");
                     if (expectedPackDigest && packDigest !== expectedPackDigest) {
@@ -463,8 +614,8 @@ class Downloader {
         try {
             for (const [packId, members] of packs) {
                 this.check();
-                const reply = await this.request(`/v1/repositories/${repositoryId}/objects/${packId}`);
-                const body = Buffer.from(await reply.arrayBuffer());
+                const reply = await this.bytes(`/v1/repositories/${repositoryId}/objects/${packId}`, packName(members));
+                const body = reply.body;
                 const expected = reply.headers.get("x-coderook-sha256");
                 if (expected && (0, node_crypto_1.createHash)("sha256").update(body).digest("hex") !== expected) {
                     throw new Error("A solid pack did not arrive intact");
@@ -506,8 +657,7 @@ class Downloader {
       can say it happened.
     */
     recoveredFromGzip = [];
-    async fetchInto(repositoryId, versionId, file, target) {
-        const whole = (0, node_crypto_1.createHash)("sha256");
+    async fetchInto(repositoryId, versionId, file, target, halt) {
         /*
           A sealed file is read whole, by path, whatever shape it is stored in.
     
@@ -516,51 +666,55 @@ class Downloader {
           that cannot match the digest this file was listed with.
         */
         const pieces = file.sealed ? [] : (file.chunks ?? []);
+        if (!pieces.length) {
+            const digest = await this.streamTo(file.objectId && !file.sealed
+                ? `/v1/repositories/${repositoryId}/objects/${file.objectId}`
+                : `/v1/repositories/${repositoryId}/versions/${versionId}/file` +
+                    `?path=${encodeURIComponent(file.path)}`, file.path, target, halt);
+            if (file.sha256 && digest !== file.sha256) {
+                if (await recoverGzipFile(target, file.sha256)) {
+                    this.recoveredFromGzip.push(file.path);
+                    return file.sha256;
+                }
+            }
+            return digest;
+        }
+        const whole = (0, node_crypto_1.createHash)("sha256");
         let recovered = false;
-        // Captured so the generators below do not need `this` rebound.
-        const request = (route) => this.request(route);
+        // Captured so the generator below does not need `this` rebound.
+        const fetchPiece = (route, what) => this.bytes(route, what, halt);
         const check = () => this.check();
-        const source = pieces.length
-            ? (async function* () {
-                for (let at = 0; at < pieces.length; at += 1) {
-                    check();
-                    const piece = pieces[at];
-                    const reply = await request(`/v1/repositories/${repositoryId}/objects/${piece.objectId}`);
-                    let body = Buffer.from(await reply.arrayBuffer());
-                    /*
-                      Checked against what the upload recorded for this piece, before
-                      a byte of it reaches the file. Without the digest the only
-                      available check was the whole file's, which says that something
-                      in seven gigabytes is wrong and nothing about what.
-                    */
-                    const digest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
-                    if (piece.sha256 && digest !== piece.sha256) {
-                        const plain = gunzippedMatching(body, piece.sha256);
-                        if (!plain) {
-                            throw new Error(`${file.path}: piece ${at + 1} of ${pieces.length} ` +
-                                `did not arrive intact`);
-                        }
-                        recovered = true;
-                        body = plain;
+        /*
+          Each piece is its own retried request, so a connection lost partway
+          through a large file costs the piece that was arriving and no more: the
+          ones already written stay written, and the file carries on from there.
+        */
+        const source = (async function* () {
+            for (let at = 0; at < pieces.length; at += 1) {
+                check();
+                const piece = pieces[at];
+                const reply = await fetchPiece(`/v1/repositories/${repositoryId}/objects/${piece.objectId}`, `${file.path} (piece ${at + 1} of ${pieces.length})`);
+                let body = reply.body;
+                /*
+                  Checked against what the upload recorded for this piece, before
+                  a byte of it reaches the file. Without the digest the only
+                  available check was the whole file's, which says that something
+                  in seven gigabytes is wrong and nothing about what.
+                */
+                const digest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
+                if (piece.sha256 && digest !== piece.sha256) {
+                    const plain = gunzippedMatching(body, piece.sha256);
+                    if (!plain) {
+                        throw new Error(`${file.path}: piece ${at + 1} of ${pieces.length} ` +
+                            `did not arrive intact`);
                     }
-                    whole.update(body);
-                    yield body;
-                }
-            })()
-            : (async function* () {
-                const reply = await request(file.objectId && !file.sealed
-                    ? `/v1/repositories/${repositoryId}/objects/${file.objectId}`
-                    : `/v1/repositories/${repositoryId}/versions/${versionId}/file` +
-                        `?path=${encodeURIComponent(file.path)}`);
-                if (!reply.body)
-                    return;
-                for await (const block of node_stream_1.Readable.fromWeb(reply.body)) {
-                    check();
-                    const buffer = Buffer.from(block);
-                    whole.update(buffer);
-                    yield buffer;
+                    recovered = true;
+                    body = plain;
                 }
-            })();
+                whole.update(body);
+                yield body;
+            }
+        })();
         /*
           `pipeline` rather than a write loop: it applies backpressure, and it
           destroys the file handle when the source throws. A partially written
@@ -568,16 +722,91 @@ class Downloader {
           up holding something that looks finished.
         */
         await (0, promises_2.pipeline)(source, (0, node_fs_1.createWriteStream)(target));
-        const digest = whole.digest("hex");
         if (recovered)
             this.recoveredFromGzip.push(file.path);
-        if (!pieces.length && file.sha256 && digest !== file.sha256) {
-            if (await recoverGzipFile(target, file.sha256)) {
-                this.recoveredFromGzip.push(file.path);
-                return file.sha256;
+        return whole.digest("hex");
+    }
+    /**
+     * Stream one whole object to `target`, carrying on where a dropped
+     * connection left it, and answer with the digest of what was written.
+     *
+     * The body is part of the attempt. A connection cut halfway through used to
+     * escape the retry loop entirely, because `fetch()` had already resolved on
+     * the headers.
+     *
+     * Where the service said it serves byte ranges, a retry asks only for what
+     * is missing: what reached the disk is measured and hashed again from
+     * there, rather than trusted from a count that the failed stream may not
+     * have flushed. Anything other than a partial answer starting exactly at
+     * that byte is taken from the beginning, so a resumed file is never two
+     * different answers spliced together; the digest is checked by the caller
+     * either way.
+     */
+    async streamTo(route, what, target, halt) {
+        let resumable = false;
+        let before = 0;
+        let hash = (0, node_crypto_1.createHash)("sha256");
+        const check = () => this.check();
+        return this.repeat(async (attempt) => {
+            let from = 0;
+            if (attempt > 1 && resumable) {
+                from = await sizeOnDisk(target);
             }
-        }
-        return digest;
+            let reply;
+            try {
+                reply = await this.attempt(route, REQUEST_DEADLINE_MS, halt, from > 0 ? { range: `bytes=${from}-` } : undefined);
+            }
+            catch (error) {
+                /*
+                  Nothing left to send from there — the whole body had landed and
+                  only its ending was lost. Taken again from the start rather than
+                  guessed complete, because only the digest can say it is.
+                */
+                if (from === 0 || error.status !== 416)
+                    throw error;
+                from = 0;
+                reply = await this.attempt(route, REQUEST_DEADLINE_MS, halt);
+            }
+            before = from;
+            const append = from > 0 && reply.status === 206 && rangeStart(reply.headers) === from;
+            if (reply.status !== 206) {
+                resumable = reply.headers.get("accept-ranges") === "bytes";
+            }
+            hash = append ? await digestPrefix(target) : (0, node_crypto_1.createHash)("sha256");
+            const sink = (0, node_fs_1.createWriteStream)(target, { flags: append ? "a" : "w" });
+            if (!reply.body) {
+                sink.end();
+                await new Promise((resolve, reject) => {
+                    sink.once("finish", resolve).once("error", reject);
+                });
+            }
+            else {
+                await (0, promises_2.pipeline)(node_stream_1.Readable.fromWeb(reply.body), new node_stream_1.Transform({
+                    transform(block, _encoding, done) {
+                        try {
+                            check();
+                        }
+                        catch (error) {
+                            done(error);
+                            return;
+                        }
+                        const buffer = Buffer.from(block);
+                        hash.update(buffer);
+                        done(null, buffer);
+                    },
+                }), sink);
+            }
+            return hash.digest("hex");
+        }, {
+            what,
+            halt,
+            /*
+              Counted again from nothing when this attempt moved the file on —
+              judged by what reached the disk, since that is where the next
+              attempt starts.
+            */
+            progressed: async () => resumable && (await sizeOnDisk(target)) > before,
+        });
     }
     /**
      * Write a version into `destination`.
@@ -609,6 +838,15 @@ class Downloader {
         const staging = `${destination}.incoming`;
         await (0, promises_1.rm)(staging, { recursive: true, force: true });
         const manifest = {};
+        /*
+          Stops the other lanes once one transfer has failed for good.
+    
+          Without it the first failure rejected the run while five other lanes
+          went on writing into the staging folder — so the cleanup below removed
+          it, and the lanes still running made it again. That is how failed clones
+          left `.incoming` folders behind.
+        */
+        const halt = new AbortController();
         try {
             let written = 0;
             let bytes = 0;
@@ -688,8 +926,8 @@ class Downloader {
                   so fetch the decoded pack once, verify it, and materialise every
                   member before releasing the buffer.
                 */
-                const reply = await this.request(`/v1/repositories/${repositoryId}/objects/${packId}`);
-                const body = Buffer.from(await reply.arrayBuffer());
+                const reply = await this.bytes(`/v1/repositories/${repositoryId}/objects/${packId}`, packName(packed.get(packId) ?? []), halt.signal);
+                const body = reply.body;
                 const packDigest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
                 const expectedPackDigest = reply.headers.get("x-coderook-sha256");
                 if (expectedPackDigest && packDigest !== expectedPackDigest) {
@@ -719,7 +957,7 @@ class Downloader {
             const restoreFile = async (file) => {
                 const full = (0, safe_path_js_1.inside)(staging, file.path);
                 await (0, promises_1.mkdir)(node_path_1.default.dirname(full), { recursive: true });
-                const digest = await this.fetchInto(repositoryId, versionId, file, full);
+                const digest = await this.fetchInto(repositoryId, versionId, file, full, halt.signal);
                 /*
                   The whole file's digest, checked after every piece has already been
                   checked individually. Both are needed: the pieces catch a corrupt or
@@ -782,30 +1020,53 @@ class Downloader {
                     });
                 }
             };
+            /*
+              The first failure that outlasted its retries, which is what the run
+              reports. Whatever the other lanes throw while being stopped is only
+              the echo of it.
+            */
+            let failure = null;
             const lane = async () => {
                 for (;;) {
+                    if (halt.signal.aborted)
+                        return;
                     const at = next;
                     next += 1;
                     if (at >= jobs.length)
                         return;
-                    this.check();
                     const job = jobs[at];
                     const size = sizeOf(job);
                     await roomFor(size);
+                    if (halt.signal.aborted)
+                        return;
                     flying += size;
                     try {
+                        this.check();
                         if (job.kind === "pack")
                             await restorePack(job.id);
                         else
                             await restoreFile(job.file);
                     }
+                    catch (error) {
+                        if (!failure)
+                            failure = { error };
+                        halt.abort(new Error("stopped: another file failed"));
+                        return;
+                    }
                     finally {
                         flying -= size;
                         wakeAll();
                     }
                 }
             };
+            /*
+              Every lane settled before anything else happens — on failure most of
+              all, so that nothing is still writing into the staging folder when it
+              is removed.
+            */
             await Promise.all(Array.from({ length: Math.min(LANES, jobs.length) }, () => lane()));
+            if (failure)
+                throw failure.error;
             /*
               Everything has arrived and verified, so it can go into place. Each
               file is renamed over its destination individually: a rename within
@@ -882,6 +1143,19 @@ class Downloader {
     }
 }
 exports.Downloader = Downloader;
+/**
+ * A solid pack named by what is in it. Its object id means nothing to the
+ * person reading the error; the files they will be missing do.
+ */
+function packName(members) {
+    const first = members[0]?.path;
+    if (!first)
+        return "a pack of small files";
+    const others = members.length - 1;
+    return others > 0
+        ? `${first} and ${others} other small file${others === 1 ? "" : "s"} stored with it`
+        : first;
+}
 /** The gunzipped bytes when they hash to `expected`, otherwise null. */
 function gunzippedMatching(body, expected) {
     if (body.length < 2 || body[0] !== 0x1f || body[1] !== 0x8b)

package/dist/cbx/src/core/rules.js

@@ -170,11 +170,70 @@ function ruleMatches(relativePath, isDirectory, rule) {
     }
     return relativePath.split("/").some((segment) => expression.test(segment));
 }
+const NONE = [];
+const indexes = new WeakMap();
+function indexFor(rules) {
+    let index = indexes.get(rules);
+    if (index)
+        return index;
+    const kinds = rules.map((rule) => {
+        if (rule.directoryOnly) {
+            const bare = trailingSlashOff(rule.pattern);
+            return rule.anchored || bare.includes("/") ? "wholePath" : "ownName";
+        }
+        return rule.anchored || rule.pattern.includes("/") ? "wholePath" : "segment";
+    });
+    const named = kinds.flatMap((kind, at) => (kind === "wholePath" ? [] : [at]));
+    index = { kinds, named, answers: new Map() };
+    indexes.set(rules, index);
+    return index;
+}
+function namedMatches(index, rules, name) {
+    let found = index.answers.get(name);
+    if (found)
+        return found;
+    found = NONE;
+    for (const at of index.named) {
+        if (matcher(rules[at].pattern).test(name)) {
+            if (found === NONE)
+                found = [];
+            found.push(at);
+        }
+    }
+    index.answers.set(name, found);
+    return found;
+}
 /** The last matching rule wins, as it does in gitignore. */
 function lastMatchingRule(relativePath, isDirectory, rules) {
+    if (!rules.length)
+        return null;
+    const index = indexFor(rules);
+    const segments = relativePath.split("/");
+    /* Which named rules some segment satisfies, and which the last one does. */
+    const anySegment = new Uint8Array(rules.length);
+    const ownName = new Uint8Array(rules.length);
+    for (let at = 0; at < segments.length; at += 1) {
+        const hits = namedMatches(index, rules, segments[at]);
+        for (const hit of hits)
+            anySegment[hit] = 1;
+        if (at === segments.length - 1)
+            for (const hit of hits)
+                ownName[hit] = 1;
+    }
     let found = null;
-    for (const rule of rules) {
-        if (ruleMatches(relativePath, isDirectory, rule))
+    for (let at = 0; at < rules.length; at += 1) {
+        const rule = rules[at];
+        const kind = index.kinds[at];
+        let matched;
+        if (kind === "segment")
+            matched = anySegment[at] === 1;
+        else if (kind === "ownName")
+            matched = isDirectory && ownName[at] === 1;
+        else if (rule.directoryOnly && !isDirectory)
+            matched = false;
+        else
+            matched = matcher(rule.pattern).test(relativePath);
+        if (matched)
             found = rule;
     }
     return found;
@@ -223,8 +282,10 @@ function decidingRule(relativePath, isDirectory, layers, remembered) {
     }
     return decide(relativePath, isDirectory, layers);
 }
-function excludes(relativePath, isDirectory, layers) {
-    const rule = decidingRule(relativePath, isDirectory, layers);
+function excludes(relativePath, isDirectory, layers, 
+/* Folder answers to reuse; see FolderAnswers. Only for one fixed set of rules. */
+remembered) {
+    const rule = decidingRule(relativePath, isDirectory, layers, remembered);
     return Boolean(rule && !rule.negated);
 }
 /**

package/dist/cbx/src/core/worktree.js

@@ -1110,6 +1110,12 @@ onFound) {
     const layers = await collectLayers(root, rules);
     const tracked = await gitTracked(root);
     const found = [];
+    /*
+      Every entry asks about each folder above it; those answers do not change
+      during one walk, so each folder is decided once rather than once per file
+      beneath it.
+    */
+    const folderAnswers = new Map();
     /*
       A level at a time, eight in flight.
   
@@ -1142,7 +1148,7 @@ onFound) {
                         continue;
                     const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
                     if (entry.isDirectory()) {
-                        if ((0, rules_js_1.excludes)(relative, true, layers) &&
+                        if ((0, rules_js_1.excludes)(relative, true, layers, folderAnswers) &&
                             !(0, rules_js_1.negationReachesInto)(relative, layers) &&
                             !tracked?.folders.has(relative)) {
                             continue;
@@ -1152,7 +1158,7 @@ onFound) {
                     }
                     if (!entry.isFile())
                         continue;
-                    if ((0, rules_js_1.excludes)(relative, false, layers) && !tracked?.files.has(relative))
+                    if ((0, rules_js_1.excludes)(relative, false, layers, folderAnswers) && !tracked?.files.has(relative))
                         continue;
                     here.push({ full, relative });
                 }

package/dist/cli/src/api.js

@@ -31,6 +31,7 @@ exports.compareVersions = compareVersions;
 exports.fileTextAt = fileTextAt;
 exports.versions = versions;
 exports.markRelease = markRelease;
+exports.setReleaseDownloadsPublic = setReleaseDownloadsPublic;
 exports.issues = issues;
 exports.createIssue = createIssue;
 exports.releases = releases;
@@ -628,6 +629,17 @@ async function markRelease(repositoryId, versionId, name, notes) {
         versionId: String(body.release?.versionId ?? versionId),
     };
 }
+/**
+ * Make a release's downloads public, or private again, apart from its source.
+ *
+ * What is attached to the release, its notes and the update feed are offered
+ * to anybody while the version's files keep their own visibility, so one
+ * project can ship its installers without a second public project for them.
+ */
+async function setReleaseDownloadsPublic(repositoryId, versionId, value) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}/release/downloads`, { method: "PUT", body: { public: value } });
+}
 async function issues(repositoryId) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/issues`);
     return {
@@ -671,6 +683,9 @@ async function releases(repositoryId) {
         releasedAt: String(row.releasedAt ?? ""),
         releasedBy: String(row.releasedBy ?? ""),
         assets: Array.isArray(row.assets) ? row.assets : [],
+        attachments: Array.isArray(row.attachments) ? row.attachments : [],
+        downloadsPublic: row.downloadsPublic === true,
+        sourcePublic: row.sourcePublic === true,
     }));
 }
 async function collaborators(repositoryId) {

package/dist/cli/src/cli.js

@@ -1656,14 +1656,33 @@ trackName) {
         });
     }
     const line = progressLine();
-    const result = await downloader.run(repositoryId, latest.id, destination, (progress) => {
-        line(`  ${track(progress.percent)} ${String(progress.percent).padStart(3)}%  ` +
-            `${progress.files}/${progress.totalFiles}  ` +
-            dim(progress.path.slice(-40)));
-    }, 
-    // What this folder received last time, so a file the project has since
-    // dropped is removed while everything untracked is left alone.
-    held, mode);
+    let result;
+    try {
+        result = await downloader.run(repositoryId, latest.id, destination, (progress) => {
+            line(`  ${track(progress.percent)} ${String(progress.percent).padStart(3)}%  ` +
+                `${progress.files}/${progress.totalFiles}  ` +
+                dim(progress.path.slice(-40)));
+        }, 
+        // What this folder received last time, so a file the project has since
+        // dropped is removed while everything untracked is left alone.
+        held, mode);
+    }
+    catch (error) {
+        done(line);
+        if (!(error instanceof download_js_1.DownloadFailed))
+            throw error;
+        /*
+          Named, and with what it did not do. A transfer fails before anything
+          is put in place, so the folder is as it was and the staging copy is
+          gone — which is what someone deciding whether to run it again needs.
+        */
+        console.error(red(error.message));
+        console.error(dim(((0, node_fs_1.existsSync)(destination)
+            ? `Nothing in ${destination} was changed.`
+            : `No folder was made at ${destination}.`) +
+            " Run the same command again to retry."));
+        return 1;
+    }
     done(line);
     /*
       Said, not hidden. The files are right, but the service sent them still
@@ -2801,6 +2820,10 @@ const SPECS = [
         group: "Your projects",
         summary: "what has been released, and its files",
         usage: "releases [project]",
+        detail: "Each release with its files and who can take them: public (source and\n" +
+            "downloads), downloads public (the source stays private) or private.\n" +
+            "For a public project it also prints the addresses an app or a script\n" +
+            "reads them from, which need no account.",
         run: service_commands_js_1.commandReleases,
     },
     {
@@ -3060,14 +3083,22 @@ const SPECS = [
             "Nothing is uploaded: a release is a version with a name on it, so the\n" +
             "version has to exist already.\n\n" +
             "The same thing happens when a git tag is pushed to a CodeRook remote —\n" +
-            "`git push cbx v1.0` and `cbx release v1.0` are one action.",
+            "`git push cbx v1.0` and `cbx release v1.0` are one action.\n\n" +
+            "Put the installers on it with `cbx attach`. In a public project,\n" +
+            "--downloads public offers the release's notes, attachments and update\n" +
+            "feed to anybody while the version's source stays private, so one\n" +
+            "project can ship its own app without a second, public project for the\n" +
+            "installers. Without a name, --downloads changes an existing release.",
         options: [
             { flags: "--version <n>", description: "name this version instead of the newest" },
             { flags: "--notes <text>", description: "what changed, for the release page" },
+            { flags: "--downloads <public|private>", description: "who can take what is attached, apart from the source" },
         ],
         examples: [
             "cbx release v1.0",
             'cbx release v1.2 --version 41 --notes "Fixes the export dialog"',
+            "cbx release 1.4.0 --downloads public",
+            "cbx release --downloads private --version 41",
         ],
         run: service_commands_js_1.commandRelease,
     },

package/dist/cli/src/network.js

@@ -60,6 +60,17 @@ function describeError(error) {
         return "CodeRook did not answer in time. Check the connection, then try again.";
     }
     const cause = error.cause;
+    if (error.message === "terminated") {
+        /*
+          undici's word for an answer whose body stopped arriving: the server
+          hung up mid-reply, or something between here and it did. On its own it
+          read as though the command had been killed.
+        */
+        const detail = [cause?.code, cause?.message].filter(Boolean).join(": ");
+        return ("The connection to CodeRook closed before its answer finished arriving" +
+            (detail ? ` (${detail})` : "") +
+            ". Check the connection, then try again.");
+    }
     if (error.message === "fetch failed") {
         /*
           Said in words first, with the code after for whoever needs it. The most

package/dist/cli/src/service_commands.js

@@ -119,12 +119,22 @@ async function commandIssues(parsed) {
  * would be a feature that exists twice and agrees by luck.
  */
 async function commandRelease(parsed) {
+    /*
+      `--downloads public|private` decides who can take what is attached,
+      apart from the source. Given without a name it changes an existing
+      release and nothing else: naming it again would rewrite its notes.
+    */
+    const downloads = parsed.flags.get("downloads");
+    if (downloads !== undefined && downloads !== "public" && downloads !== "private") {
+        console.error((0, colour_js_1.red)("--downloads is public or private: cbx release v1.0 --downloads public"));
+        return 1;
+    }
     const name = parsed.positional[0];
-    if (!name) {
+    if (!name && downloads === undefined) {
         console.error((0, colour_js_1.red)("Name the release: cbx release v1.0"));
         return 1;
     }
-    const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[1]);
+    const project = await (0, project_commands_js_1.resolveProject)(name ? parsed.positional[1] : parsed.positional[0]);
     if (!project)
         return 1;
     const all = await (0, api_js_1.versions)(project.id);
@@ -161,15 +171,32 @@ async function commandRelease(parsed) {
         return 1;
     }
     const notes = parsed.flags.get("notes");
-    try {
-        await (0, api_js_1.markRelease)(project.id, target.id, name, typeof notes === "string" ? notes : null);
+    if (name) {
+        try {
+            await (0, api_js_1.markRelease)(project.id, target.id, name, typeof notes === "string" ? notes : null);
+        }
+        catch (error) {
+            console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        console.log(`${(0, colour_js_1.green)("Released")} ${(0, colour_js_1.bold)(name)} ${(0, colour_js_1.dim)("at")} v${target.sequence}` +
+            `${(0, colour_js_1.dim)(" — ")}${target.message.split("\n")[0].slice(0, 48)}`);
     }
-    catch (error) {
-        console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
-        return 1;
+    if (downloads !== undefined) {
+        try {
+            await (0, api_js_1.setReleaseDownloadsPublic)(project.id, target.id, downloads === "public");
+        }
+        catch (error) {
+            console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        console.log(downloads === "public"
+            ? `${(0, colour_js_1.green)("Downloads public")} ${(0, colour_js_1.dim)("on")} v${target.sequence}${(0, colour_js_1.dim)(": anybody can take what is attached; the source keeps its own visibility.")}`
+            : `${(0, colour_js_1.green)("Downloads private")} ${(0, colour_js_1.dim)("on")} v${target.sequence}${(0, colour_js_1.dim)(": only people on this project can take them now.")}`);
+        if (downloads === "public" && project.visibility !== "public") {
+            console.log((0, colour_js_1.dim)("  The project itself is not public, so nobody outside it can reach them yet: cbx visibility public."));
+        }
     }
-    console.log(`${(0, colour_js_1.green)("Released")} ${(0, colour_js_1.bold)(name)} ${(0, colour_js_1.dim)("at")} v${target.sequence}` +
-        `${(0, colour_js_1.dim)(" — ")}${target.message.split("\n")[0].slice(0, 48)}`);
     return 0;
 }
 async function commandReleases(parsed) {
@@ -186,13 +213,30 @@ async function commandReleases(parsed) {
         const when = release.releasedAt
             ? new Date(release.releasedAt).toLocaleDateString()
             : "";
+        const who = release.sourcePublic
+            ? "public"
+            : release.downloadsPublic
+                ? "downloads public"
+                : "private";
         console.log(`  ${(0, colour_js_1.accent)(`v${release.sequence}`).padEnd(16)} ` +
             `${(release.name || "—").padEnd(28)} ${when.padEnd(14)} ` +
-            `${release.assets.length} files`);
+            `${`${release.assets.length + release.attachments.length} files`.padEnd(10)} ${(0, colour_js_1.dim)(who)}`);
         const firstLine = release.notes.split("\n")[0];
         if (firstLine)
             console.log(`    ${(0, colour_js_1.dim)(firstLine)}`);
     }
+    /* Where an app or a script reads them, for a project anybody can reach. */
+    const owner = project.visibility === "public" && published.some((one) => one.downloadsPublic || one.sourcePublic)
+        ? await (0, api_js_1.whoami)().then((me) => me.username).catch(() => null)
+        : null;
+    if (owner) {
+        const base = `https://api.coderook.com/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(project.slug)}`;
+        console.log("");
+        console.log((0, colour_js_1.dim)("  From code, no account needed:"));
+        console.log(`  ${(0, colour_js_1.dim)("latest release")}  ${base}/releases/latest`);
+        console.log(`  ${(0, colour_js_1.dim)("all releases")}    ${base}/releases`);
+        console.log(`  ${(0, colour_js_1.dim)("update feed")}     ${base}/updates`);
+    }
     return 0;
 }
 /** Who can reach a project, and who has been asked. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.9",
+  "version": "0.34.11",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -246,11 +246,13 @@ line's source to find these — this is the whole of it:
 GET /projects?q=                                  public projects, newest first
 GET /projects/{owner}/{slug}                      one project
 GET /projects/{owner}/{slug}/versions             the versions it offers
+GET /projects/{owner}/{slug}/releases             every release, with its downloads
 GET /projects/{owner}/{slug}/releases/latest      newest release and its files
 GET /projects/{owner}/{slug}/updates/latest.yml   electron-updater feed
 GET /projects/{owner}/{slug}/versions/{v}/files         every file, with digests
 GET /projects/{owner}/{slug}/versions/{v}/file?path=    one file
 GET /projects/{owner}/{slug}/versions/{v}/archive       the version as a zip
+GET /projects/{owner}/{slug}/versions/{v}/last-changes?path=   which version last changed each entry
 GET /projects/{owner}/{slug}/versions/{v}/attachments   files attached to it
 GET /projects/{owner}/{slug}/versions/{v}/attachments/{id}   download one
 ```
@@ -279,8 +281,16 @@ The feed serves `latest.yml`, `latest-mac.yml` and `latest-linux.yml` with
 each file's size and SHA-512, and redirects file names to their downloads.
 Anything else can read `releases/latest` as JSON: version, notes, and every
 file with its size, SHA-256 and `url`. Updaters have no account, so the
-project they read must be public; keep private code in a separate project and
-ship releases from a public one.
+project they read must be public, but its source need not be:
+
+```bash
+cbx release 1.4.0 --downloads public   # notes, attachments and feed public; files stay private
+cbx releases                           # public / downloads public / private, and the addresses
+```
+
+**Ask before `--downloads public`**: it publishes the attached files to anyone.
+One project holds the code and ships the app; a second "releases" project is
+no longer needed.
 
 ## Building executables for every platform