@liaisonio/cli 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liaisonio/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Liaison Cloud CLI — manage connectors, entries, and applications from the command line",
   "keywords": [
     "liaison",

package/scripts/install.js

@@ -11,21 +11,35 @@
 //   - The user is on an unsupported platform (we exit 0 + warn, NOT fail,
 //     so npm install doesn't break for transitive deps)
 //
+// Honours HTTPS_PROXY / HTTP_PROXY env vars for users behind corporate proxies
+// (Node's built-in https.get does NOT honour these out of the box — we handle
+// it manually via a CONNECT tunnel). Retries once on transient network errors.
+//
 // Network failures DO fail the install — silently shipping a broken package
 // is worse than a clear error the user can retry.
 
 'use strict';
 
 const https = require('https');
+const http = require('http');
+const net = require('net');
+const tls = require('tls');
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { URL } = require('url');
 
 const pkg = require('../package.json');
 const VERSION = `v${pkg.version}`;
 const REPO = 'liaisonio/cli';
 const RELEASE_BASE = `https://github.com/${REPO}/releases/download/${VERSION}`;
 
+// How long to wait for a single HTTP round-trip before giving up.
+const SOCKET_TIMEOUT_MS = 30_000;
+// How many times to retry a download after a transient error. Retries are
+// linear-backoff with 2s then 5s gaps.
+const RETRY_DELAYS_MS = [2000, 5000];
+
 // process.platform-process.arch → release asset GOOS-GOARCH suffix.
 const PLATFORMS = {
   'darwin-arm64': { os: 'darwin', arch: 'arm64', ext: '' },
@@ -73,74 +87,186 @@ const destPath = path.join(vendorDir, `liaison${platform.ext}`);
 
 fs.mkdirSync(vendorDir, { recursive: true });
 
-// Followed-redirect HTTP GET that streams to a file.
-function downloadToFile(targetUrl, outPath) {
+// ─── proxy support ──────────────────────────────────────────────────────────
+
+// getProxy reads HTTPS_PROXY / HTTP_PROXY / https_proxy / http_proxy, in the
+// order npm / curl do. Returns a parsed URL or null.
+function getProxy() {
+  const raw =
+    process.env.HTTPS_PROXY ||
+    process.env.https_proxy ||
+    process.env.HTTP_PROXY ||
+    process.env.http_proxy;
+  if (!raw) return null;
+  try {
+    return new URL(raw);
+  } catch {
+    warn(`ignoring invalid proxy URL: ${raw}`);
+    return null;
+  }
+}
+
+// tunnelThroughProxy opens a TCP connection to the proxy, issues an HTTP
+// CONNECT to the target, and upgrades the socket to TLS. Returns a Promise
+// resolving to an established TLSSocket that can be handed to https.request
+// as `createConnection`. Zero external dependencies.
+function tunnelThroughProxy(proxy, targetHost, targetPort) {
   return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(outPath);
-    function get(u, depth) {
-      if (depth > 5) {
-        reject(new Error(`too many redirects fetching ${targetUrl}`));
+    const proxyPort = proxy.port || (proxy.protocol === 'https:' ? 443 : 80);
+    const authHeader = proxy.username
+      ? `Proxy-Authorization: Basic ${Buffer.from(
+          `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password || '')}`,
+        ).toString('base64')}\r\n`
+      : '';
+
+    const proxySocket = net.connect(proxyPort, proxy.hostname, () => {
+      proxySocket.write(
+        `CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\n` +
+          `Host: ${targetHost}:${targetPort}\r\n` +
+          authHeader +
+          `\r\n`,
+      );
+    });
+
+    let buf = Buffer.alloc(0);
+    const onData = (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      const end = buf.indexOf('\r\n\r\n');
+      if (end === -1) return;
+      const head = buf.slice(0, end).toString('utf8');
+      const status = head.split(' ')[1];
+      proxySocket.removeListener('data', onData);
+      if (status !== '200') {
+        reject(new Error(`proxy CONNECT failed: ${head.split('\r\n')[0]}`));
+        proxySocket.end();
         return;
       }
-      https
-        .get(u, { headers: { 'User-Agent': 'liaison-cli-installer' } }, (res) => {
-          if (
-            res.statusCode &&
-            res.statusCode >= 300 &&
-            res.statusCode < 400 &&
-            res.headers.location
-          ) {
-            res.resume();
-            get(res.headers.location, depth + 1);
-            return;
-          }
-          if (res.statusCode !== 200) {
-            reject(new Error(`HTTP ${res.statusCode} for ${u}`));
-            res.resume();
-            return;
-          }
-          res.pipe(file);
-          file.on('finish', () => file.close(() => resolve()));
-          file.on('error', reject);
-        })
-        .on('error', reject);
-    }
-    get(targetUrl, 0);
+      // Upgrade to TLS — the CONNECT tunnel is now a raw TCP pipe to target.
+      const tlsSocket = tls.connect({
+        socket: proxySocket,
+        servername: targetHost,
+      });
+      tlsSocket.once('secureConnect', () => resolve(tlsSocket));
+      tlsSocket.once('error', reject);
+    };
+    proxySocket.on('data', onData);
+    proxySocket.once('error', reject);
   });
 }
 
-function downloadToString(targetUrl) {
+// httpsGetRaw makes a single HTTPS GET request. If an HTTPS_PROXY is set, it
+// tunnels through it via CONNECT; otherwise it uses stock https.request.
+// Returns a Promise<IncomingMessage>. Caller is responsible for consuming or
+// discarding the body.
+function httpsGetRaw(targetUrl) {
   return new Promise((resolve, reject) => {
-    function get(u, depth) {
-      if (depth > 5) {
-        reject(new Error(`too many redirects fetching ${targetUrl}`));
-        return;
+    const u = new URL(targetUrl);
+    const proxy = getProxy();
+
+    const reqOptions = {
+      host: u.hostname,
+      port: u.port || 443,
+      path: u.pathname + u.search,
+      method: 'GET',
+      headers: {
+        'User-Agent': 'liaison-cli-installer',
+        Host: u.host,
+      },
+      timeout: SOCKET_TIMEOUT_MS,
+    };
+
+    const runRequest = (agentSocket) => {
+      if (agentSocket) {
+        reqOptions.createConnection = () => agentSocket;
       }
-      https
-        .get(u, { headers: { 'User-Agent': 'liaison-cli-installer' } }, (res) => {
-          if (
-            res.statusCode &&
-            res.statusCode >= 300 &&
-            res.statusCode < 400 &&
-            res.headers.location
-          ) {
-            res.resume();
-            get(res.headers.location, depth + 1);
-            return;
-          }
-          if (res.statusCode !== 200) {
-            reject(new Error(`HTTP ${res.statusCode} for ${u}`));
-            res.resume();
-            return;
-          }
-          let body = '';
-          res.setEncoding('utf8');
-          res.on('data', (chunk) => (body += chunk));
-          res.on('end', () => resolve(body));
-        })
-        .on('error', reject);
+      const req = https.request(reqOptions, resolve);
+      req.on('error', reject);
+      req.on('timeout', () => {
+        req.destroy(new Error(`timeout after ${SOCKET_TIMEOUT_MS}ms`));
+      });
+      req.end();
+    };
+
+    if (proxy) {
+      tunnelThroughProxy(proxy, u.hostname, u.port || 443)
+        .then(runRequest)
+        .catch(reject);
+    } else {
+      runRequest(null);
     }
-    get(targetUrl, 0);
+  });
+}
+
+// Follow HTTP redirects up to maxRedirects, returning the final IncomingMessage
+// that actually holds the body. Non-2xx status codes at the end of the chain
+// are returned as-is; caller decides whether to treat them as an error.
+async function httpsGet(targetUrl, maxRedirects = 5) {
+  let current = targetUrl;
+  for (let i = 0; i <= maxRedirects; i++) {
+    const res = await httpsGetRaw(current);
+    if (
+      res.statusCode >= 300 &&
+      res.statusCode < 400 &&
+      res.headers.location
+    ) {
+      res.resume();
+      current = res.headers.location;
+      continue;
+    }
+    return res;
+  }
+  throw new Error(`too many redirects fetching ${targetUrl}`);
+}
+
+// withRetry wraps an async function so it's tried a few times with backoff
+// on network errors. Does NOT retry on 4xx/5xx from the server — those are
+// deterministic and a retry will just hit the same error.
+async function withRetry(label, fn) {
+  let lastErr;
+  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (attempt < RETRY_DELAYS_MS.length) {
+        const delay = RETRY_DELAYS_MS[attempt];
+        warn(`${label}: ${err.message}, retrying in ${delay}ms...`);
+        await new Promise((r) => setTimeout(r, delay));
+        continue;
+      }
+    }
+  }
+  throw lastErr;
+}
+
+function downloadToFile(targetUrl, outPath) {
+  return withRetry(`download ${path.basename(outPath)}`, async () => {
+    const res = await httpsGet(targetUrl);
+    if (res.statusCode !== 200) {
+      res.resume();
+      throw new Error(`HTTP ${res.statusCode} for ${targetUrl}`);
+    }
+    await new Promise((resolve, reject) => {
+      const file = fs.createWriteStream(outPath);
+      res.pipe(file);
+      file.on('finish', () => file.close(() => resolve()));
+      file.on('error', reject);
+      res.on('error', reject);
+    });
+  });
+}
+
+function downloadToString(targetUrl) {
+  return withRetry(`fetch ${path.basename(new URL(targetUrl).pathname)}`, async () => {
+    const res = await httpsGet(targetUrl);
+    if (res.statusCode !== 200) {
+      res.resume();
+      throw new Error(`HTTP ${res.statusCode} for ${targetUrl}`);
+    }
+    let body = '';
+    res.setEncoding('utf8');
+    for await (const chunk of res) body += chunk;
+    return body;
   });
 }
 
@@ -151,6 +277,11 @@ function sha256(filepath) {
 }
 
 async function main() {
+  const proxy = getProxy();
+  if (proxy) {
+    log(`using proxy ${proxy.protocol}//${proxy.hostname}:${proxy.port || ''}`);
+  }
+
   log(`fetching ${url}`);
   await downloadToFile(url, destPath);
   fs.chmodSync(destPath, 0o755);
@@ -174,6 +305,10 @@ async function main() {
   log(`installed ${filename} (sha256 ok)`);
 }
 
+// Suppress the unused `http` import warning — kept for future use if we
+// ever need HTTP-not-HTTPS downloads (CI staging).
+void http;
+
 main().catch((err) => {
-  die(`download failed: ${err.message}`);
+  die(`download failed: ${err.message}. You can retry with \`npm rebuild @liaisonio/cli\`, or set HTTPS_PROXY if you're behind a corporate proxy.`);
 });