@glash/cli 0.2.44 → 0.2.45

package/README.md

@@ -109,13 +109,11 @@ glash deploy --asset-mode auto --asset-threshold 100mb
 Every deploy prints a live monitor link. Open it to watch the black-screen deployment flow while the CLI is packaging, uploading, building, routing, and checking the live URL.
 Public asset offload prepares assets in small batches and uses multipart uploads for large files, so image/video-heavy `public/` folders can upload without forcing the source bundle over the platform limit.
 
-Before a local source upload, `glash deploy` automatically runs the project's
-`build` script with the package manager declared in `package.json` or detected
-from its lockfile. The progress display keeps the progress bar on top and shows
-the current two-word action underneath it. A failed local build
-stops the deployment before source is uploaded. Use `--no-build` only when you
-intentionally need to bypass this pre-deploy check. Remote Git deployments
-continue to build on the Glash build worker.
+The Glash build worker compiles uploaded source, so `glash deploy` does not run
+the same build locally by default. Use `glash deploy --build` when you want an
+additional local preflight build before upload. The package manager comes from
+`package.json` or the project's lockfile, and a failed preflight stops before
+source is uploaded. `--no-build` remains accepted for backward compatibility.
 
 Framework/runtime checks:
 
@@ -150,8 +148,8 @@ For glashjs projects, `glash deploy` detects `glashjs` or `glash.config.mjs`, ma
 | `glash projects:rm <slug>` | Delete a project |
 | `glash link <slug>` | Link the current directory to an existing project |
 | `glash open` | Open the linked project's primary domain |
-| `glash deploy [--prod] [--detach]` | Build and deploy the linked project; streams the pipeline until live |
-| `glash deploy --no-build` | Skip the automatic local build before uploading source |
+| `glash deploy [--prod] [--detach]` | Upload and deploy the linked project; streams the pipeline until live |
+| `glash deploy --build` | Run an optional local preflight build before uploading source |
 | `glash deploy --asset-mode offload` | Upload `public/` assets to object storage/CDN before zipping source |
 | `glash deploy --source-upload chunked` | Stage the source zip through multipart object storage to bypass Cloudflare's single-request cap |
 | `glash deployments` | List recent deployments |

package/bin/glash.mjs

@@ -68,7 +68,7 @@ ${color.bold('PROJECTS')}
   open                        Open the project's primary domain in a browser
 
 ${color.bold('DEPLOY')}
-  deploy [--prod] [--detach]  Build and deploy the linked project, syncing .env files
+  deploy [--prod] [--detach]  Upload and deploy the linked project, syncing .env files
   new deploy                  Deploy to a brand new project, ignoring any existing link
   deployments                 List recent deployments
   status <id>                 Show deployment pipeline + events
@@ -98,7 +98,8 @@ ${color.bold('FLAGS')}
   --environment <name>        Env-var environment (default: production)
   --env-file <file[,file]>    Env file(s) to sync before deploy
   --no-env                    Skip automatic env sync during deploy
-  --no-build                  Skip the automatic local build before source upload
+  --build                     Run an optional local preflight build before upload
+  --no-build                  Skip local build (legacy compatibility; now the default)
   --asset-mode <mode>         Public asset handling: inline, auto, offload
   --asset-threshold <size>    Auto-offload threshold (default: 100mb)
   --source-upload <mode>      Source upload: auto, direct, chunked

package/commands/deploy.mjs

@@ -181,7 +181,11 @@ export async function deploy({ flags }) {
     try {
       localBuild = await buildProjectBeforeDeploy(process.cwd(), {
         packageJson: projectProfile.runtime?.pkg,
-        skip: Boolean(flags['no-build']) || process.env.GLASH_CLI_BUILD_RUNNING === '1',
+        // The Glash build host compiles the uploaded source, so doing the same
+        // work locally on every deploy doubles build time. Keep local preflight
+        // validation available as an explicit --build option.
+        skip: !flags.build || Boolean(flags['no-build']) || process.env.GLASH_CLI_BUILD_RUNNING === '1',
+        skipReason: flags['no-build'] ? 'disabled' : 'not-requested',
         onStart: () => indicator.setPhase('prebuilding'),
       });
       report.localBuild = localBuild;
@@ -1305,6 +1309,7 @@ function formatLocalBuildSummary(build) {
   }
   if (build.status === 'failed') return `${build.command || 'build command'} failed`;
   if (build.reason === 'disabled') return 'skipped (--no-build)';
+  if (build.reason === 'not-requested') return 'remote build (use --build for local preflight)';
   if (build.reason === 'no-package-json') return 'skipped (no package.json)';
   if (build.reason === 'no-build-script') return 'skipped (no build script)';
   return build.status || '-';

package/lib/api.mjs

@@ -21,13 +21,11 @@ function retryAfterMs(headers) {
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-// Transient HTTP statuses worth retrying. These mean the request almost
-// certainly never reached app logic (gateway/edge hiccup, cold start,
-// rate-limit), so retrying is safe even for non-idempotent POSTs and is the
-// main reason `glash deploy` survives flaky networks, VPNs and corporate
-// proxies across machines.
-const RETRYABLE_STATUS = new Set([408, 425, 429, 500, 502, 503, 504, 522, 524]);
-const DEFAULT_RETRIES = 4;
+// Transient edge and rate-limit statuses worth a short retry budget. A plain
+// application HTTP 500 is intentionally excluded: retrying it four times made
+// deterministic failures slow and hid useful Cloudflare 1101 diagnostics.
+const RETRYABLE_STATUS = new Set([408, 425, 429, 502, 503, 504, 522, 524]);
+const DEFAULT_RETRIES = 2;
 // Per-request wall-clock ceiling. Without this a contended/wedged backend
 // leaves `glash deploy` hanging forever after "source bundle X MB" with no
 // output. On timeout we abort and retry instead of hanging. Uploads (FormData)
@@ -43,6 +41,38 @@ function backoffMs(attempt, retryAfter) {
   return Math.round(jitter);
 }
 
+export function sanitizeRemoteMessage(value, maxLength = 500) {
+  const clean = String(value ?? '')
+    .replace(/\x1B\][^\x07]*(?:\x07|\x1B\\)/g, '')
+    .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, '')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!clean) return '';
+  return clean.length > maxLength ? `${clean.slice(0, maxLength - 1)}…` : clean;
+}
+
+export function responseErrorMessage(status, rawBody) {
+  const raw = String(rawBody ?? '');
+  if (/\berror(?:\s+code\s*:|\s+)\s*1101\b/i.test(raw)) {
+    return 'GlashDB API is temporarily unavailable (Cloudflare error 1101). The backend container did not start.';
+  }
+  try {
+    const data = JSON.parse(raw);
+    const remote = Array.isArray(data?.message) ? data.message.join(', ') : data?.message;
+    const safe = sanitizeRemoteMessage(remote);
+    if (safe) return safe;
+  } catch {}
+  // Do not echo arbitrary HTML or terminal control sequences returned by a
+  // compromised proxy. Plain short text is useful; markup is not.
+  if (!/[<>]/.test(raw)) {
+    const safe = sanitizeRemoteMessage(raw, 240);
+    if (safe) return `HTTP ${status}: ${safe}`;
+  }
+  return `HTTP ${status}`;
+}
+
 export async function api(method, path, { body, token, query, retries = DEFAULT_RETRIES, signal, timeoutMs } = {}) {
   const headers = {
     Accept: 'application/json',
@@ -115,12 +145,8 @@ export async function api(method, path, { body, token, query, retries = DEFAULT_
         attempt += 1;
         continue;
       }
-      let message = `HTTP ${res.status}`;
-      try {
-        const data = await res.json();
-        if (typeof data?.message === 'string') message = data.message;
-        else if (Array.isArray(data?.message)) message = data.message.join(', ');
-      } catch {}
+      const rawBody = await res.text().catch(() => '');
+      let message = responseErrorMessage(res.status, rawBody);
       if (res.status === 401 && !path.includes('/auth/login') && !path.includes('/auth/cli/login')) {
         message = `${message}. Run \`glash login\` again, then retry the command.`;
       }

package/lib/project-build.mjs

@@ -38,12 +38,13 @@ export async function planProjectBuild(cwd, { packageJson } = {}) {
 export async function buildProjectBeforeDeploy(cwd, {
   packageJson,
   skip = false,
+  skipReason = 'disabled',
   onStart,
   onLine,
   spawnImpl = spawn,
   env = process.env,
 } = {}) {
-  if (skip) return { status: 'skipped', reason: 'disabled' };
+  if (skip) return { status: 'skipped', reason: skipReason };
 
   const plan = await planProjectBuild(cwd, { packageJson });
   if (plan.status !== 'ready') return plan;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glash/cli",
-  "version": "0.2.44",
+  "version": "0.2.45",
   "description": "glashDB command-line interface - deploy projects, pull source + env, manage env vars.",
   "license": "Apache-2.0",
   "homepage": "https://glashdb.com",