@glash/cli 0.2.44 → 0.2.46

package/README.md

@@ -109,13 +109,11 @@ glash deploy --asset-mode auto --asset-threshold 100mb
 Every deploy prints a live monitor link. Open it to watch the black-screen deployment flow while the CLI is packaging, uploading, building, routing, and checking the live URL.
 Public asset offload prepares assets in small batches and uses multipart uploads for large files, so image/video-heavy `public/` folders can upload without forcing the source bundle over the platform limit.
 
-Before a local source upload, `glash deploy` automatically runs the project's
-`build` script with the package manager declared in `package.json` or detected
-from its lockfile. The progress display keeps the progress bar on top and shows
-the current two-word action underneath it. A failed local build
-stops the deployment before source is uploaded. Use `--no-build` only when you
-intentionally need to bypass this pre-deploy check. Remote Git deployments
-continue to build on the Glash build worker.
+The Glash build worker compiles uploaded source, so `glash deploy` does not run
+the same build locally by default. Use `glash deploy --build` when you want an
+additional local preflight build before upload. The package manager comes from
+`package.json` or the project's lockfile, and a failed preflight stops before
+source is uploaded. `--no-build` remains accepted for backward compatibility.
 
 Framework/runtime checks:
 
@@ -150,8 +148,8 @@ For glashjs projects, `glash deploy` detects `glashjs` or `glash.config.mjs`, ma
 | `glash projects:rm <slug>` | Delete a project |
 | `glash link <slug>` | Link the current directory to an existing project |
 | `glash open` | Open the linked project's primary domain |
-| `glash deploy [--prod] [--detach]` | Build and deploy the linked project; streams the pipeline until live |
-| `glash deploy --no-build` | Skip the automatic local build before uploading source |
+| `glash deploy [--prod] [--detach]` | Upload and deploy the linked project; streams the pipeline until live |
+| `glash deploy --build` | Run an optional local preflight build before uploading source |
 | `glash deploy --asset-mode offload` | Upload `public/` assets to object storage/CDN before zipping source |
 | `glash deploy --source-upload chunked` | Stage the source zip through multipart object storage to bypass Cloudflare's single-request cap |
 | `glash deployments` | List recent deployments |

package/bin/glash.mjs

@@ -68,7 +68,7 @@ ${color.bold('PROJECTS')}
   open                        Open the project's primary domain in a browser
 
 ${color.bold('DEPLOY')}
-  deploy [--prod] [--detach]  Build and deploy the linked project, syncing .env files
+  deploy [--prod] [--detach]  Upload and deploy the linked project, syncing .env files
   new deploy                  Deploy to a brand new project, ignoring any existing link
   deployments                 List recent deployments
   status <id>                 Show deployment pipeline + events
@@ -88,7 +88,7 @@ ${color.bold('DATABASE')}
   database upload             Restore the latest/local dump into linked glashDB database
 
 ${color.bold('PULL')}
-  pull [<slug>] [--out dir] [--no-env]  Pull source + .env from a glashDB project
+  pull [<slug>] [--out dir] [--no-env]  Unpack a project (asks which, if no slug)
 
 ${color.bold('SYSTEM')}
   update                      Update @glash/cli to the latest version
@@ -98,7 +98,8 @@ ${color.bold('FLAGS')}
   --environment <name>        Env-var environment (default: production)
   --env-file <file[,file]>    Env file(s) to sync before deploy
   --no-env                    Skip automatic env sync during deploy
-  --no-build                  Skip the automatic local build before source upload
+  --build                     Run an optional local preflight build before upload
+  --no-build                  Skip local build (legacy compatibility; now the default)
   --asset-mode <mode>         Public asset handling: inline, auto, offload
   --asset-threshold <size>    Auto-offload threshold (default: 100mb)
   --source-upload <mode>      Source upload: auto, direct, chunked

package/commands/deploy.mjs

@@ -181,7 +181,11 @@ export async function deploy({ flags }) {
     try {
       localBuild = await buildProjectBeforeDeploy(process.cwd(), {
         packageJson: projectProfile.runtime?.pkg,
-        skip: Boolean(flags['no-build']) || process.env.GLASH_CLI_BUILD_RUNNING === '1',
+        // The Glash build host compiles the uploaded source, so doing the same
+        // work locally on every deploy doubles build time. Keep local preflight
+        // validation available as an explicit --build option.
+        skip: !flags.build || Boolean(flags['no-build']) || process.env.GLASH_CLI_BUILD_RUNNING === '1',
+        skipReason: flags['no-build'] ? 'disabled' : 'not-requested',
         onStart: () => indicator.setPhase('prebuilding'),
       });
       report.localBuild = localBuild;
@@ -1305,6 +1309,7 @@ function formatLocalBuildSummary(build) {
   }
   if (build.status === 'failed') return `${build.command || 'build command'} failed`;
   if (build.reason === 'disabled') return 'skipped (--no-build)';
+  if (build.reason === 'not-requested') return 'remote build (use --build for local preflight)';
   if (build.reason === 'no-package-json') return 'skipped (no package.json)';
   if (build.reason === 'no-build-script') return 'skipped (no build script)';
   return build.status || '-';

package/commands/pull.mjs

@@ -1,9 +1,9 @@
 // glash pull
 //
-// Default mode: pulls the linked glashDB project's source + .env to the
-// current directory.
+// Unpacks a glashDB project's active deployed image to the current directory,
+// plus its .env. Works however long ago the project was deployed.
 //
-//   glash pull                    → uses the linked project (.glash/project.json)
+//   glash pull                    → pick a project from your glashDB account
 //   glash pull <slug>             → pulls a specific project by slug
 //   glash pull --out ../somewhere → write to a different directory
 //   glash pull --no-env           → skip writing .env
@@ -16,7 +16,8 @@ import { createWriteStream } from 'node:fs';
 import { Readable } from 'node:stream';
 import { argv, cwd, exit, stdout, stderr } from 'node:process';
 import { API_URL, getToken, readProjectLink } from '../lib/config.mjs';
-import { color, info, fail } from '../lib/ui.mjs';
+import { apiGet } from '../lib/api.mjs';
+import { color, info, fail, prompt } from '../lib/ui.mjs';
 
 export async function pull(parsed) {
   const flags = parsed?.flags ?? {};
@@ -25,15 +26,12 @@ export async function pull(parsed) {
   const token = await getToken();
   if (!token) return fail('Not signed in. Run `glash login` first.');
 
-  // Resolve which project to pull
+  // Resolve which project to pull. With no argument, pick from the projects on
+  // this glashDB account rather than guessing.
   let slugOrId = positional[0] ?? flags.project;
   if (!slugOrId) {
-    const link = await readProjectLink();
-    if (link?.slug) slugOrId = link.slug;
-    else if (link?.projectId) slugOrId = link.projectId;
-  }
-  if (!slugOrId) {
-    return fail('No project specified. Pass `glash pull <slug>` or run `glash link <slug>` first.');
+    slugOrId = await chooseProject();
+    if (!slugOrId) return;
   }
 
   const outDir = resolve(flags.out ? String(flags.out) : cwd());
@@ -52,6 +50,51 @@ export async function pull(parsed) {
   stdout.write(color.dim(`\n  next:  cd ${outDir} && glash deploy\n`));
 }
 
+// Lists this account's projects and asks which one to pull. The project linked
+// to the current directory, if any, is the default on Enter.
+async function chooseProject() {
+  let projects;
+  try {
+    projects = await apiGet('/projects');
+  } catch (e) {
+    fail(`Could not list your projects: ${e.message}`);
+    return null;
+  }
+  if (!projects?.length) {
+    fail('This account has no projects yet. Run `glash projects:new` first.');
+    return null;
+  }
+
+  const link = await readProjectLink().catch(() => null);
+  const linkedIndex = projects.findIndex(
+    (p) => (link?.projectId && p.id === link.projectId) || (link?.slug && p.slug === link.slug),
+  );
+
+  stdout.write('\n  Your projects:\n\n');
+  projects.forEach((p, i) => {
+    const marker = i === linkedIndex ? color.dim('  (linked here)') : '';
+    stdout.write(`  ${String(i + 1).padStart(2)}. ${p.slug}${p.name && p.name !== p.slug ? color.dim(` - ${p.name}`) : ''}${marker}\n`);
+  });
+
+  const fallback = linkedIndex >= 0 ? projects[linkedIndex] : null;
+  const suffix = fallback ? ` [${fallback.slug}]` : '';
+  const answer = (await prompt(`\n  Which project do you want to pull?${suffix} `)).trim();
+
+  if (!answer) {
+    if (fallback) return fallback.slug;
+    fail('No project selected.');
+    return null;
+  }
+  const byNumber = Number(answer);
+  if (Number.isInteger(byNumber) && byNumber >= 1 && byNumber <= projects.length) {
+    return projects[byNumber - 1].slug;
+  }
+  const byName = projects.find((p) => p.slug === answer || p.id === answer);
+  if (byName) return byName.slug;
+  fail(`No project named "${answer}" on this account.`);
+  return null;
+}
+
 async function downloadAndExtract(token, slugOrId, outDir) {
   const url = `${API_URL}/projects/${encodeURIComponent(slugOrId)}/source.tar.gz`;
   const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
@@ -66,7 +109,7 @@ async function downloadAndExtract(token, slugOrId, outDir) {
   if (child.status !== 0) {
     throw new Error(`tar extract failed: ${child.stderr?.toString() || 'unknown'}`);
   }
-  info(color.dim(`  ✓ source written to ${outDir}`));
+  info(color.dim(`  ✓ project files unpacked to ${outDir}`));
 }
 
 async function downloadEnv(token, slugOrId, outDir, force) {

package/lib/api.mjs

@@ -21,13 +21,11 @@ function retryAfterMs(headers) {
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-// Transient HTTP statuses worth retrying. These mean the request almost
-// certainly never reached app logic (gateway/edge hiccup, cold start,
-// rate-limit), so retrying is safe even for non-idempotent POSTs and is the
-// main reason `glash deploy` survives flaky networks, VPNs and corporate
-// proxies across machines.
-const RETRYABLE_STATUS = new Set([408, 425, 429, 500, 502, 503, 504, 522, 524]);
-const DEFAULT_RETRIES = 4;
+// Transient edge and rate-limit statuses worth a short retry budget. A plain
+// application HTTP 500 is intentionally excluded: retrying it four times made
+// deterministic failures slow and hid useful Cloudflare 1101 diagnostics.
+const RETRYABLE_STATUS = new Set([408, 425, 429, 502, 503, 504, 522, 524]);
+const DEFAULT_RETRIES = 2;
 // Per-request wall-clock ceiling. Without this a contended/wedged backend
 // leaves `glash deploy` hanging forever after "source bundle X MB" with no
 // output. On timeout we abort and retry instead of hanging. Uploads (FormData)
@@ -43,6 +41,38 @@ function backoffMs(attempt, retryAfter) {
   return Math.round(jitter);
 }
 
+export function sanitizeRemoteMessage(value, maxLength = 500) {
+  const clean = String(value ?? '')
+    .replace(/\x1B\][^\x07]*(?:\x07|\x1B\\)/g, '')
+    .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, '')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!clean) return '';
+  return clean.length > maxLength ? `${clean.slice(0, maxLength - 1)}…` : clean;
+}
+
+export function responseErrorMessage(status, rawBody) {
+  const raw = String(rawBody ?? '');
+  if (/\berror(?:\s+code\s*:|\s+)\s*1101\b/i.test(raw)) {
+    return 'GlashDB API is temporarily unavailable (Cloudflare error 1101). The backend container did not start.';
+  }
+  try {
+    const data = JSON.parse(raw);
+    const remote = Array.isArray(data?.message) ? data.message.join(', ') : data?.message;
+    const safe = sanitizeRemoteMessage(remote);
+    if (safe) return safe;
+  } catch {}
+  // Do not echo arbitrary HTML or terminal control sequences returned by a
+  // compromised proxy. Plain short text is useful; markup is not.
+  if (!/[<>]/.test(raw)) {
+    const safe = sanitizeRemoteMessage(raw, 240);
+    if (safe) return `HTTP ${status}: ${safe}`;
+  }
+  return `HTTP ${status}`;
+}
+
 export async function api(method, path, { body, token, query, retries = DEFAULT_RETRIES, signal, timeoutMs } = {}) {
   const headers = {
     Accept: 'application/json',
@@ -115,12 +145,8 @@ export async function api(method, path, { body, token, query, retries = DEFAULT_
         attempt += 1;
         continue;
       }
-      let message = `HTTP ${res.status}`;
-      try {
-        const data = await res.json();
-        if (typeof data?.message === 'string') message = data.message;
-        else if (Array.isArray(data?.message)) message = data.message.join(', ');
-      } catch {}
+      const rawBody = await res.text().catch(() => '');
+      let message = responseErrorMessage(res.status, rawBody);
       if (res.status === 401 && !path.includes('/auth/login') && !path.includes('/auth/cli/login')) {
         message = `${message}. Run \`glash login\` again, then retry the command.`;
       }

package/lib/project-build.mjs

@@ -38,12 +38,13 @@ export async function planProjectBuild(cwd, { packageJson } = {}) {
 export async function buildProjectBeforeDeploy(cwd, {
   packageJson,
   skip = false,
+  skipReason = 'disabled',
   onStart,
   onLine,
   spawnImpl = spawn,
   env = process.env,
 } = {}) {
-  if (skip) return { status: 'skipped', reason: 'disabled' };
+  if (skip) return { status: 'skipped', reason: skipReason };
 
   const plan = await planProjectBuild(cwd, { packageJson });
   if (plan.status !== 'ready') return plan;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glash/cli",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "description": "glashDB command-line interface - deploy projects, pull source + env, manage env vars.",
   "license": "Apache-2.0",
   "homepage": "https://glashdb.com",