@devicecloud.dev/dcd 5.7.0 → 5.8.0-beta.1

package/dist/gateways/api-gateway.d.ts

@@ -1,7 +1,7 @@
 import { TAppMetadata } from '../types.js';
 import type { AuthContext } from '../types/domain/auth.types.js';
 import type { LiveCommandStatus, LiveExecResult, LiveSession, LiveSessionSummary } from '../types/domain/live.types.js';
-import { components } from '../types/generated/schema.types.js';
+import { components, paths } from '../types/generated/schema.types.js';
 /**
  * Error thrown for non-OK API responses, carrying the HTTP status so callers
  * can branch on auth failures etc. without string matching.
@@ -10,6 +10,17 @@ export declare class ApiError extends Error {
     status: number;
     constructor(message: string, status: number);
 }
+type ResultsResponse = paths['/results/{uploadId}']['get']['responses']['200']['content']['application/json'];
+/**
+ * The last results body a poll loop received and the ETag it came with, so
+ * the next poll can revalidate with `If-None-Match` and get an empty 304 back
+ * when nothing changed. Create one per poll loop; `getResultsForUpload` fills
+ * and clears it.
+ */
+export interface ResultsPollCache {
+    body?: ResultsResponse;
+    etag?: string;
+}
 export declare const ApiGateway: {
     /**
      * Enhances generic "fetch failed" errors with more specific diagnostic information
@@ -98,7 +109,23 @@ export declare const ApiGateway: {
         token?: string;
     }>;
     finishLargeFile(baseUrl: string, auth: AuthContext, fileId: string, partSha1Array: string[]): Promise<unknown>;
-    getResultsForUpload(baseUrl: string, auth: AuthContext, uploadId: string): Promise<{
+    /**
+     * Fetch the result rows for an upload, for the `dcd cloud` poll loop.
+     *
+     * Asks for `?view=summary`, which leaves out `result_files` and the rest of
+     * the columns the CLI never reads. An API that predates the view ignores
+     * the parameter and returns the full rows, a superset, so this works
+     * against either.
+     *
+     * With a `cache`, a repeat poll revalidates with `If-None-Match` and a 304
+     * hands back the cached body.
+     * @param baseUrl API base URL
+     * @param auth AuthContext carrying request headers
+     * @param uploadId Upload ID to fetch results for
+     * @param cache Optional per-poll-loop cache, filled and cleared here
+     * @returns The results response body
+     */
+    getResultsForUpload(baseUrl: string, auth: AuthContext, uploadId: string, cache?: ResultsPollCache): Promise<{
         statusCode?: number;
         results?: components["schemas"]["TResultResponse"][];
     }>;
@@ -209,3 +236,4 @@ export declare const ApiGateway: {
     stopLiveSession(baseUrl: string, auth: AuthContext, sessionName: string): Promise<void>;
     getLiveSession(baseUrl: string, auth: AuthContext, sessionName: string): Promise<LiveSession>;
 };
+export {};

package/dist/gateways/api-gateway.js

@@ -347,20 +347,73 @@ export const ApiGateway = {
             throw error;
         }
     },
-    async getResultsForUpload(baseUrl, auth, uploadId) {
+    /**
+     * Fetch the result rows for an upload, for the `dcd cloud` poll loop.
+     *
+     * Asks for `?view=summary`, which leaves out `result_files` and the rest of
+     * the columns the CLI never reads. An API that predates the view ignores
+     * the parameter and returns the full rows, a superset, so this works
+     * against either.
+     *
+     * With a `cache`, a repeat poll revalidates with `If-None-Match` and a 304
+     * hands back the cached body.
+     * @param baseUrl API base URL
+     * @param auth AuthContext carrying request headers
+     * @param uploadId Upload ID to fetch results for
+     * @param cache Optional per-poll-loop cache, filled and cleared here
+     * @returns The results response body
+     */
+    async getResultsForUpload(baseUrl, auth, uploadId, cache) {
         // TODO: merge with getUploadStatus
+        const url = `${baseUrl}/results/${uploadId}?view=summary`;
         try {
-            const res = await fetch(`${baseUrl}/results/${uploadId}`, {
-                headers: { ...auth.headers },
-            });
+            const headers = { ...auth.headers };
+            if (cache?.body && cache.etag) {
+                headers['if-none-match'] = cache.etag;
+                // Per the Fetch spec, undici appends `Cache-Control: no-cache` to any
+                // request that carries a conditional header and no Cache-Control of
+                // its own, and Express's `fresh` never answers 304 to a no-cache
+                // request. So every poll would get a full 200. max-age=0 still asks
+                // for revalidation, and keeps undici from adding no-cache.
+                headers['cache-control'] = 'max-age=0';
+            }
+            const res = await fetch(url, { headers });
+            // Before the `!res.ok` check, since a 304 is not `ok`.
+            if (res.status === 304) {
+                if (cache?.body) {
+                    return cache.body;
+                }
+                // We sent no If-None-Match, so there is nothing to reuse. Start over
+                // with an unconditional request on the next poll.
+                if (cache) {
+                    delete cache.body;
+                    delete cache.etag;
+                }
+                throw new Error('Failed to get results: API returned 304 Not Modified to an unconditional request');
+            }
             if (!res.ok) {
                 await this.handleApiError(res, 'Failed to get results');
             }
-            return await parseJsonResponse(res, 'Failed to get results');
+            const body = await parseJsonResponse(res, 'Failed to get results');
+            if (cache) {
+                // Only pin a real result set. The API reports some errors as a 200
+                // with a `{ statusCode, message }` envelope, and an empty set is
+                // rejected by the poll loop; caching either would replay it on 304.
+                const etag = res.headers.get('etag');
+                if (etag && Array.isArray(body.results) && body.results.length > 0) {
+                    cache.body = body;
+                    cache.etag = etag;
+                }
+                else {
+                    delete cache.body;
+                    delete cache.etag;
+                }
+            }
+            return body;
         }
         catch (error) {
             if (error instanceof TypeError && error.message === 'fetch failed') {
-                throw this.enhanceFetchError(error, `${baseUrl}/results/${uploadId}`);
+                throw this.enhanceFetchError(error, url);
             }
             throw error;
         }

package/dist/services/metadata-extractor.service.js

@@ -1,14 +1,9 @@
 import { parseBuffer } from 'bplist-parser';
-import nodeApk from 'node-apk';
 import { readFile, rm } from 'node:fs/promises';
 import * as path from 'node:path';
 import StreamZip from 'node-stream-zip';
 import { parse } from 'plist';
-// node-apk is CJS with no `exports` map; Node's named-export detection for CJS
-// (cjs-module-lexer) is version-dependent, so destructure off the default import
-// instead — that interop is guaranteed on every Node version. bplist-parser 0.5
-// is a real ESM/CJS dual package with named exports, so it imports directly.
-const { Apk } = nodeApk;
+import { readManifestPackage } from '../utils/android-manifest.js';
 /**
  * Parses an Info.plist buffer (XML, UTF-8 BOM'd XML, or binary bplist).
  * Shared by the .app and .zip extractors.
@@ -36,13 +31,13 @@ export class AndroidMetadataExtractor {
         return filePath.endsWith('.apk');
     }
     async extract(filePath) {
-        const apk = new Apk(filePath);
+        const zip = new StreamZip.async({ file: filePath });
         try {
-            const manifest = await apk.getManifestInfo();
-            return { appId: manifest.package, platform: 'android' };
+            const manifest = await zip.entryData('AndroidManifest.xml');
+            return { appId: readManifestPackage(manifest), platform: 'android' };
         }
         finally {
-            apk.close();
+            await zip.close().catch(() => { });
         }
     }
 }

package/dist/services/results-polling.service.d.ts

@@ -118,6 +118,7 @@ export declare class ResultsPollingService {
      * @param apiUrl API base URL
      * @param auth AuthContext carrying request headers
      * @param uploadId Upload ID to fetch results for
+     * @param cache The poll loop's results cache, for ETag revalidation
      * @param debug Whether debug logging is enabled
      * @param logger Optional logger function
      * @returns Promise resolving to test results

package/dist/services/results-polling.service.js

@@ -133,6 +133,9 @@ export class ResultsPollingService {
         let { auth } = options;
         this.initializePollingDisplay(json, logger);
         let sequentialPollFailures = 0;
+        // The last result set and its ETag, so a poll that finds nothing changed
+        // gets an empty 304 instead of the whole set again.
+        const resultsCache = {};
         const pollIntervalMs = auth.mode === 'bearer'
             ? this.BEARER_POLL_INTERVAL_MS
             : this.APIKEY_POLL_INTERVAL_MS;
@@ -229,7 +232,7 @@ export class ResultsPollingService {
                     nextPollAt = null;
                     renderStatus();
                     auth = await this.refreshPollingAuth(auth, uploadId, subscription, debug, logger);
-                    const updatedResults = await this.fetchAndLogResults(apiUrl, auth, uploadId, debug, logger);
+                    const updatedResults = await this.fetchAndLogResults(apiUrl, auth, uploadId, resultsCache, debug, logger);
                     const { summary } = this.calculateStatusSummary(updatedResults);
                     if (!json) {
                         statusBody = this.buildStatusBody(updatedResults, quiet, summary);
@@ -395,21 +398,28 @@ export class ResultsPollingService {
      * @param apiUrl API base URL
      * @param auth AuthContext carrying request headers
      * @param uploadId Upload ID to fetch results for
+     * @param cache The poll loop's results cache, for ETag revalidation
      * @param debug Whether debug logging is enabled
      * @param logger Optional logger function
      * @returns Promise resolving to test results
      */
-    async fetchAndLogResults(apiUrl, auth, uploadId, debug, logger) {
+    async fetchAndLogResults(apiUrl, auth, uploadId, cache, debug, logger) {
         if (debug && logger) {
             logger(`[DEBUG] Polling for results: ${uploadId}`);
         }
-        const { results: updatedResults } = await ApiGateway.getResultsForUpload(apiUrl, auth, uploadId);
+        // A 304 hands back the cached body itself; a 200 is always a new object.
+        const cachedBody = cache.body;
+        const response = await ApiGateway.getResultsForUpload(apiUrl, auth, uploadId, cache);
+        const notModified = cachedBody !== undefined && response === cachedBody;
+        const { results: updatedResults } = response;
         // An empty array would otherwise read as "all complete, all passed".
         if (!updatedResults || updatedResults.length === 0) {
             throw new Error('no results');
         }
         if (debug && logger) {
-            logger(`[DEBUG] Poll received ${updatedResults.length} results`);
+            logger(notModified
+                ? `[DEBUG] Poll not modified (304), reusing ${updatedResults.length} cached results`
+                : `[DEBUG] Poll received ${updatedResults.length} results`);
             for (const result of updatedResults) {
                 logger(`[DEBUG] Result status: ${result.test_file_name} - ${result.status}`);
             }

package/dist/utils/android-manifest.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Reads the `package` attribute of the root `<manifest>` element.
+ * @param xml - Contents of the APK's AndroidManifest.xml entry
+ * @returns The application id, e.g. `org.wikipedia`
+ */
+export declare function readManifestPackage(xml: Buffer): string;

package/dist/utils/android-manifest.js

@@ -0,0 +1,97 @@
+// Reads the package name out of an APK's compiled AndroidManifest.xml (Android
+// binary XML). This replaced node-apk, whose node-forge dependency carried an
+// unpatched advisory for certificate code the CLI never used. Layouts follow
+// the ResChunk_header / ResStringPool_header / ResXMLTree_* structs in AOSP's
+// libandroidfw ResourceTypes.h; every integer is little-endian.
+const RES_STRING_POOL_TYPE = 0x0001;
+const RES_XML_TYPE = 0x0003;
+const RES_XML_START_ELEMENT_TYPE = 0x0102;
+const UTF8_FLAG = 0x0100;
+const TYPE_STRING = 0x03;
+const NO_INDEX = 0xffff_ffff;
+const CHUNK_HEADER_SIZE = 8;
+/**
+ * Returns a lookup for the strings in the string pool chunk at `offset`.
+ * Strings are decoded on demand, so a malformed entry the manifest never
+ * refers to can't fail the parse.
+ */
+function stringPool(xml, offset) {
+    const headerSize = xml.readUInt16LE(offset + 2);
+    const count = xml.readUInt32LE(offset + 8);
+    const utf8 = (xml.readUInt32LE(offset + 16) & UTF8_FLAG) !== 0;
+    const stringsStart = offset + xml.readUInt32LE(offset + 20);
+    return (index) => {
+        if (index >= count) {
+            throw new Error(`String index ${index} is out of range`);
+        }
+        let pos = stringsStart + xml.readUInt32LE(offset + headerSize + index * 4);
+        if (utf8) {
+            // Two lengths, each 1 byte or 2 when the high bit is set: the UTF-16
+            // length (unused here), then the UTF-8 byte length.
+            pos += xml[pos] & 0x80 ? 2 : 1;
+            let length = xml[pos++];
+            if (length & 0x80)
+                length = ((length & 0x7f) << 8) | xml[pos++];
+            return xml.toString('utf8', pos, pos + length);
+        }
+        // UTF-16 length in code units: 2 bytes, or 4 when the high bit is set.
+        let length = xml.readUInt16LE(pos);
+        pos += 2;
+        if (length & 0x80_00) {
+            length = ((length & 0x7f_ff) << 16) | xml.readUInt16LE(pos);
+            pos += 2;
+        }
+        return xml.toString('utf16le', pos, pos + length * 2);
+    };
+}
+/**
+ * Reads the `package` attribute of the root `<manifest>` element.
+ * @param xml - Contents of the APK's AndroidManifest.xml entry
+ * @returns The application id, e.g. `org.wikipedia`
+ */
+export function readManifestPackage(xml) {
+    if (xml.length < CHUNK_HEADER_SIZE || xml.readUInt16LE(0) !== RES_XML_TYPE) {
+        throw new Error('AndroidManifest.xml is not Android binary XML');
+    }
+    const end = Math.min(xml.length, xml.readUInt32LE(4));
+    let offset = xml.readUInt16LE(2);
+    let stringAt;
+    while (offset + CHUNK_HEADER_SIZE <= end) {
+        const type = xml.readUInt16LE(offset);
+        const headerSize = xml.readUInt16LE(offset + 2);
+        const size = xml.readUInt32LE(offset + 4);
+        if (size < CHUNK_HEADER_SIZE) {
+            throw new Error(`Malformed binary XML chunk at offset ${offset}`);
+        }
+        if (type === RES_STRING_POOL_TYPE) {
+            stringAt = stringPool(xml, offset);
+        }
+        else if (type === RES_XML_START_ELEMENT_TYPE) {
+            // The first element is the document root.
+            if (!stringAt)
+                throw new Error('Binary XML has no string pool');
+            const ext = offset + headerSize;
+            if (stringAt(xml.readUInt32LE(ext + 4)) !== 'manifest') {
+                throw new Error('Root element of AndroidManifest.xml is not <manifest>');
+            }
+            const attributeStart = ext + xml.readUInt16LE(ext + 8);
+            const attributeSize = xml.readUInt16LE(ext + 10);
+            const attributeCount = xml.readUInt16LE(ext + 12);
+            for (let i = 0; i < attributeCount; i++) {
+                const attr = attributeStart + i * attributeSize;
+                if (stringAt(xml.readUInt32LE(attr + 4)) !== 'package')
+                    continue;
+                // Use the typed string value when there is one, else the raw string
+                // the attribute was compiled from.
+                const raw = xml.readUInt32LE(attr + 8);
+                const index = xml[attr + 15] === TYPE_STRING ? xml.readUInt32LE(attr + 16) : raw;
+                if (index === NO_INDEX)
+                    break;
+                return stringAt(index);
+            }
+            throw new Error('<manifest> has no package attribute');
+        }
+        offset += size;
+    }
+    throw new Error('AndroidManifest.xml has no <manifest> element');
+}

package/package.json

@@ -6,13 +6,12 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@supabase/supabase-js": "^2.108.2",
     "bplist-parser": "^0.5.0",
     "chalk": "^6.0.0",
     "citty": "^0.2.2",
     "js-yaml": "^5.2.2",
-    "node-apk": "^1.2.1",
     "node-stream-zip": "^1.15.0",
     "plist": "^5.0.0",
     "tar": "^7.5.16",
@@ -69,7 +68,7 @@
     "test:unit": "node scripts/test-runner.mjs --unit",
     "typecheck": "tsc --noEmit -p tsconfig.test.json"
   },
-  "version": "5.7.0",
+  "version": "5.8.0-beta.1",
   "bugs": {
     "url": "https://discord.gg/gm3mJwcNw8"
   },
@@ -112,12 +111,14 @@
       "qs@<6.16.0": "6.16.0",
       "fast-uri@>=3.0.0 <3.1.8": "3.1.8",
       "hono@>=4.0.0 <4.13.7": "4.13.7",
+      "source-map-js@<1.2.2": "1.2.2",
       "micromatch>picomatch": "^2.3.2",
       "tinyglobby>picomatch": "^4.0.4"
     },
     "auditConfig": {
       "ignoreGhsas": [
-        "GHSA-frvp-7c67-39w9"
+        "GHSA-frvp-7c67-39w9",
+        "GHSA-vfj7-8cjw-p6xm"
       ]
     }
   }