@glash/cli 0.2.49 → 0.2.50

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -273,7 +273,9 @@ export async function deploy({ flags }) {
273
273
  if (uploadMeta.framework) formData.append('framework', uploadMeta.framework);
274
274
 
275
275
  indicator.setPhase('glashing');
276
- dep = await apiPost('/deployments/upload', formData);
276
+ // projectId in the query lets the server check membership before it
277
+ // accepts the upload body.
278
+ dep = await apiPost(`/deployments/upload?projectId=${encodeURIComponent(projectId)}`, formData);
277
279
  report.sourceUpload = { mode: 'direct', parts: 1 };
278
280
  report.packagesUploaded = 1;
279
281
  }
package/commands/pull.mjs CHANGED
@@ -11,7 +11,7 @@
11
11
  import { spawnSync } from 'node:child_process';
12
12
  import { fileURLToPath } from 'node:url';
13
13
  import { dirname, join, resolve } from 'node:path';
14
- import { mkdir, writeFile, stat } from 'node:fs/promises';
14
+ import { chmod, mkdir, writeFile, stat } from 'node:fs/promises';
15
15
  import { createWriteStream } from 'node:fs';
16
16
  import { Readable } from 'node:stream';
17
17
  import { argv, cwd, exit, stdout, stderr } from 'node:process';
@@ -140,10 +140,13 @@ async function downloadEnv(token, slugOrId, outDir, force) {
140
140
  const exists = await stat(envPath).then(() => true).catch(() => false);
141
141
  if (exists && !force) {
142
142
  const backup = `${envPath}.glash-backup-${Date.now()}`;
143
- await writeFile(backup, await readFileOrEmpty(envPath));
143
+ await writeFile(backup, await readFileOrEmpty(envPath), { mode: 0o600 });
144
144
  info(color.dim(` · existing .env backed up → ${backup}`));
145
145
  }
146
146
  await writeFile(envPath, body, { mode: 0o600 });
147
+ // writeFile's mode applies only when it creates the file; an existing .env
148
+ // keeps its old (often world-readable) permissions without this.
149
+ await chmod(envPath, 0o600).catch(() => {});
147
150
  const lines = body.split('\n').filter(Boolean).length;
148
151
  info(color.dim(` ✓ ${lines} env var${lines === 1 ? '' : 's'} written to .env`));
149
152
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@glash/cli",
3
- "version": "0.2.49",
3
+ "version": "0.2.50",
4
4
  "description": "glashDB command-line interface - deploy projects, pull source + env, manage env vars.",
5
5
  "license": "Apache-2.0",
6
6
  "homepage": "https://glashdb.com",