@modelstatus/cli 0.1.85 → 0.1.87

package/src/updater.js

@@ -3,10 +3,13 @@
  * Design (see also docs.llmstatus.ai/install):
  *   - Only runs when IS_SHELL_INSTALL is true (Bun-compiled binary). npm-managed
  *     installs defer to `npm update -g @modelstatus/cli`.
- *   - Capped at one check per 24 h (cache file at ~/.config/llmstatus/updater.json).
+ *   - Throttled via CHECK_INTERVAL_MS (30 s default; cache file at
+ *     ~/.config/llmstatus/updater.json). A version that failed to install backs
+ *     off for FAIL_BACKOFF_MS so a bad release can't re-download per command.
  *   - Opt-out via MM_NO_AUTO_UPDATE=1, or any --json/--ci invocation.
  *   - All errors are swallowed silently. The user's command must NEVER break
- *     because the updater hiccupped.
+ *     because the updater hiccupped. Every fetch is deadline-capped so the
+ *     at-exit await can never stall the command on a hung CDN.
  *   - Verifies the downloaded binary's sha256 against `cli/latest/version.json`
  *     before atomically renaming over process.execPath.
  *   - Notification (one stderr line) prints after the user's command finishes —
@@ -31,6 +34,16 @@ const CACHE_FILE = path.join(os.homedir(), ".config", "llmstatus", "updater.json
 // network cost is trivial — this throttle is purely about local CPU/IO.
 // Override with MM_UPDATE_INTERVAL_MS for testing.
 const CHECK_INTERVAL_MS = Number(process.env.MM_UPDATE_INTERVAL_MS) || 30 * 1000;
+// After a download/verify/swap failure for a given version, don't re-attempt
+// that same version for this long — a bad publish must not turn every command
+// into a full binary download. `mm update` ignores this (explicit ask).
+const FAIL_BACKOFF_MS = Number(process.env.MM_UPDATE_FAIL_BACKOFF_MS) || 6 * 60 * 60 * 1000;
+// Deadlines: the check is awaited before process exit, so every network hop
+// must be finite. Manifest legs are tiny (~520 B); the binary is ~60 MB, so it
+// gets a generous — but still finite — cap. On timeout we skip silently and a
+// future run retries.
+const manifestTimeoutMs = () => Number(process.env.MM_UPDATE_FETCH_TIMEOUT_MS) || 5_000;
+const downloadTimeoutMs = () => Number(process.env.MM_UPDATE_DOWNLOAD_TIMEOUT_MS) || 120_000;
 
 /** Tolerant of v-prefixes; splits on dots & dashes (handles 0.1.2-rc1). */
 function parseVer(s) {
@@ -83,7 +96,7 @@ function platformKey() {
 }
 
 async function fetchJson(url) {
-  const res = await fetch(url, { cache: "no-store" });
+  const res = await fetch(url, { cache: "no-store", signal: AbortSignal.timeout(manifestTimeoutMs()) });
   if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
   return res.json();
 }
@@ -101,8 +114,8 @@ MCowBQYDK2VwAyEApu4VP7vB6iwxsPcK5KaosjK7SIp9HrWMt5IvcUwjUOM=
  * invalid (fail closed — never self-update against an unverifiable manifest). */
 async function fetchVerifiedManifest(base) {
   const [mRes, sRes] = await Promise.all([
-    fetch(`${base}/version.json`, { cache: "no-store" }),
-    fetch(`${base}/version.json.sig`, { cache: "no-store" }),
+    fetch(`${base}/version.json`, { cache: "no-store", signal: AbortSignal.timeout(manifestTimeoutMs()) }),
+    fetch(`${base}/version.json.sig`, { cache: "no-store", signal: AbortSignal.timeout(manifestTimeoutMs()) }),
   ]);
   if (!mRes.ok) throw new Error(`GET version.json -> ${mRes.status}`);
   if (!sRes.ok) throw new Error("manifest signature unavailable — refusing to self-update");
@@ -134,21 +147,59 @@ export function isBrewManaged(execPath = process.execPath) {
   return p.includes("/Cellar/") || p.includes("/homebrew/") || p.includes("/linuxbrew/");
 }
 
-/** Replace the executable via the atomic tmp+rename pattern ONLY (a new inode).
- * We must NOT writeFileSync over the live executable's inode: truncating +
- * rewriting a running, memory-mapped Mach-O can make macOS SIGKILL the running
- * process mid-write ("killed: 9"). Requires a writable parent dir; callers
- * pre-check dirWritable() and never reach here otherwise. Throws on failure
- * (the outer catch swallows it — better no update than a half-written binary). */
-function replaceBinary(exe, buf) {
-  const tmp = path.join(path.dirname(exe), `.${path.basename(exe)}.new.${process.pid}`);
+/** Where a downloaded-and-sha-verified binary for `version` is staged (same dir
+ * as the exe, so the final rename stays same-filesystem/atomic). Deliberately
+ * NOT pid-suffixed: it survives a failed swap so the next attempt skips the
+ * ~60 MB re-download. */
+function stagedPath(exe, version) {
+  const v = String(version).replace(/[^A-Za-z0-9._-]/g, "_");
+  return path.join(path.dirname(exe), `.${path.basename(exe)}.staged.${v}`);
+}
+
+/** Best-effort sweep of update leftovers next to the exe: parked `<exe>.old.*`
+ * copies from a Windows swap (the running image can't be deleted mid-swap, only
+ * renamed aside — see replaceBinary) and staged downloads. `keepStaged` is the
+ * path of a staged download to preserve, or `true` to preserve all staged files
+ * (used by the routine per-check sweep, which doesn't yet know the pending
+ * version). Never throws; a still-running old exe just stays until a later run. */
+function cleanupLeftovers(exe, keepStaged) {
   try {
-    fs.writeFileSync(tmp, buf, { mode: 0o755 });
-    fs.renameSync(tmp, exe);
-  } catch (e) {
-    try { fs.unlinkSync(tmp); } catch { /* tmp may not exist */ }
-    throw e;
+    const dir = path.dirname(exe);
+    const base = path.basename(exe);
+    for (const name of fs.readdirSync(dir)) {
+      const full = path.join(dir, name);
+      if (name.startsWith(`.${base}.staged.`)) {
+        if (keepStaged === true || full === keepStaged) continue;
+      } else if (!name.startsWith(`${base}.old.`)) {
+        continue;
+      }
+      try { fs.unlinkSync(full); } catch { /* e.g. old exe still running on Windows */ }
+    }
+  } catch { /* best effort */ }
+}
+
+/** Swap the staged (already-verified) binary into place via rename ONLY — a new
+ * inode. We must NOT writeFileSync over the live executable's inode: truncating
+ * + rewriting a running, memory-mapped Mach-O can make macOS SIGKILL the running
+ * process mid-write ("killed: 9"). On Windows a running .exe's image file can't
+ * be deleted or overwritten — but it CAN be renamed — so park the live binary
+ * aside first and sweep the parked copy on a later run (cleanupLeftovers).
+ * Requires a writable parent dir; callers pre-check dirWritable() and never
+ * reach here otherwise. Throws on failure (the caller memoizes it — better no
+ * update than a half-written binary). */
+function replaceBinary(exe, staged) {
+  if (process.platform === "win32") {
+    const parked = `${exe}.old.${process.pid}`;
+    fs.renameSync(exe, parked);
+    try {
+      fs.renameSync(staged, exe);
+    } catch (e) {
+      try { fs.renameSync(parked, exe); } catch { /* leave parked as a last resort */ }
+      throw e;
+    }
+    return;
   }
+  fs.renameSync(staged, exe);
 }
 
 // Our Developer ID team. A self-update download must be signed by us before we
@@ -171,27 +222,49 @@ function verifyMacSignature(file) {
 
 async function downloadAndReplace(version, key, expectedSha) {
   const exe = process.execPath;
-  const ext = process.platform === "win32" ? ".exe" : "";
-  const url = `${CDN}/cli/${version}/modelstatus-cli-${key}${ext}`;
-  const res = await fetch(url);
-  if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
-  const buf = Buffer.from(await res.arrayBuffer());
-  const actualSha = crypto.createHash("sha256").update(buf).digest("hex");
-  if (actualSha !== expectedSha) {
-    throw new Error(`sha256 mismatch: expected ${expectedSha.slice(0, 12)}…, got ${actualSha.slice(0, 12)}…`);
-  }
-  // On macOS, verify the SIGNATURE before trusting these bytes as our binary.
-  // Stage to a temp file, codesign-verify it, then swap — never swap unverified.
-  if (process.platform === "darwin") {
-    const staged = path.join(path.dirname(exe), `.${path.basename(exe)}.verify.${process.pid}`);
+  const staged = stagedPath(exe, version);
+  cleanupLeftovers(exe, staged);
+
+  // Reuse a previously-downloaded copy of this exact version when its sha256
+  // still matches the manifest — a failed swap must not cost a full ~60 MB
+  // re-download on the next attempt.
+  let haveStaged = false;
+  try {
+    const existing = fs.readFileSync(staged);
+    haveStaged = crypto.createHash("sha256").update(existing).digest("hex") === expectedSha;
+  } catch { /* no staged copy yet */ }
+
+  if (!haveStaged) {
+    const ext = process.platform === "win32" ? ".exe" : "";
+    const url = `${CDN}/cli/${version}/modelstatus-cli-${key}${ext}`;
+    const res = await fetch(url, { signal: AbortSignal.timeout(downloadTimeoutMs()) });
+    if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    const actualSha = crypto.createHash("sha256").update(buf).digest("hex");
+    if (actualSha !== expectedSha) {
+      throw new Error(`sha256 mismatch: expected ${expectedSha.slice(0, 12)}…, got ${actualSha.slice(0, 12)}…`);
+    }
+    // Stage via tmp+rename so a concurrent run can't observe a half-written file.
+    const tmp = `${staged}.${process.pid}`;
     try {
-      fs.writeFileSync(staged, buf, { mode: 0o755 });
-      verifyMacSignature(staged);
-    } finally {
-      try { fs.unlinkSync(staged); } catch { /* best effort */ }
+      fs.writeFileSync(tmp, buf, { mode: 0o755 });
+      fs.renameSync(tmp, staged);
+    } catch (e) {
+      try { fs.unlinkSync(tmp); } catch { /* tmp may not exist */ }
+      throw e;
     }
   }
-  replaceBinary(exe, buf);
+
+  // On macOS, verify the SIGNATURE before trusting these bytes as our binary —
+  // never swap unverified. A codesign failure discards the staged copy (bad
+  // bytes must not be reused).
+  try {
+    verifyMacSignature(staged);
+  } catch (e) {
+    try { fs.unlinkSync(staged); } catch { /* best effort */ }
+    throw e;
+  }
+  replaceBinary(exe, staged);
 }
 
 /** Strip an optional leading "v" for display. The manifest writes "v0.1.8" but
@@ -199,6 +272,24 @@ async function downloadAndReplace(version, key, expectedSha) {
  * "0.1.8 → v0.1.9" which looks like a typo. */
 function dispVer(v) { return String(v).replace(/^v/, ""); }
 
+/** Memoize a per-version install failure so the background check backs off
+ * (FAIL_BACKOFF_MS) instead of re-attempting a version that keeps failing. */
+function recordFailure(version, e) {
+  const cache = readCache() || {};
+  const prior = cache.fail?.version === version ? cache.fail.count || 0 : 0;
+  writeCache({
+    ...cache,
+    fail: { version, at: Date.now(), count: prior + 1, reason: String(e?.message ?? e).slice(0, 200) },
+  });
+}
+
+function clearFailure() {
+  const cache = readCache();
+  if (!cache?.fail) return;
+  delete cache.fail;
+  writeCache(cache);
+}
+
 /**
  * Force an update RIGHT NOW for an explicit `mm update` / `--update` — ignores
  * the 30s throttle AND MM_NO_AUTO_UPDATE (the user asked for it). Swaps the
@@ -230,7 +321,15 @@ export async function forceUpdate() {
     if (!dirWritable(path.dirname(process.execPath))) {
       return { status: "manual", from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
     }
-    await downloadAndReplace(manifest.version, key, expectedSha);
+    // Explicit ask → no backoff gate, but record/clear the failure memo so the
+    // background checks stay in sync with what happened here.
+    try {
+      await downloadAndReplace(manifest.version, key, expectedSha);
+    } catch (e) {
+      recordFailure(manifest.version, e);
+      throw e;
+    }
+    clearFailure();
     return { status: "updated", from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
   } catch (e) {
     return { status: "error", message: e?.message ?? String(e) };
@@ -251,14 +350,30 @@ export async function maybeCheckForUpdate(flags = {}) {
     const key = platformKey();
     if (!key) return null;
 
+    // Sweep parked .old binaries from a previous (Windows) swap; keep any
+    // staged downloads — the pending version isn't known yet.
+    cleanupLeftovers(process.execPath, true);
+
+    // Record the attempt BEFORE the network hop: a hung/unreachable CDN gets
+    // probed at most once per interval (each probe deadline-capped), not on
+    // every single run.
+    writeCache({ ...cache, last_check: Date.now() });
+
     const manifest = await fetchVerifiedManifest(`${CDN}/cli/${CHANNEL_PATH}`);
-    // Always update the cache so we don't re-check for 24 h.
+    // Update the cache so we don't re-check within the throttle interval.
     writeCache({ ...cache, last_check: Date.now(), latest_known: manifest.version });
 
     if (!manifest.version || compareVer(manifest.version, BUILD_VERSION) <= 0) return null;
     const expectedSha = manifest.sha256?.[key];
     if (!expectedSha) return null;
 
+    // A version that already failed to install (sha mismatch, codesign, swap
+    // error) backs off — don't burn a download per command on a bad release.
+    // A newer published version passes this gate and clears the memo naturally.
+    if (cache.fail && cache.fail.version === manifest.version && Date.now() - (cache.fail.at || 0) < FAIL_BACKOFF_MS) {
+      return null;
+    }
+
     // Only self-update when we can atomically swap the binary (writable parent
     // dir). For root-owned dirs like /usr/local/bin we can't — and overwriting
     // the live binary in place is unsafe — so signal a manual reinstall instead
@@ -267,7 +382,13 @@ export async function maybeCheckForUpdate(flags = {}) {
       return { manual: true, from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
     }
 
-    await downloadAndReplace(manifest.version, key, expectedSha);
+    try {
+      await downloadAndReplace(manifest.version, key, expectedSha);
+    } catch (e) {
+      recordFailure(manifest.version, e);
+      return null;
+    }
+    clearFailure();
     return { from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
   } catch {
     return null;

package/src/upgrade.js

@@ -2,24 +2,53 @@ import { openUrl } from "./openUrl.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-/** Open Stripe checkout and poll /me until the plan flips off "free". Mirrors
- * the browser-login poll UX. Returns the new plan, or null on timeout. */
-export async function upgradeViaBrowser({ client, plan, log = console.error, onTick }) {
+/** Has the account reached the TARGET plan? "pro" = any paid plan; "lifetime"
+ * needs an explicit lifetime marker (plan_status/planStatus/plan) — a Pro
+ * subscriber buying Lifetime already reads plan="pro", so a bare "not free"
+ * check would claim success before the Stripe page even loads. Exported for
+ * tests. */
+export function planArrived(account, target) {
+  if (!account) return false;
+  if (target === "lifetime") {
+    const status = account.plan_status ?? account.planStatus ?? null;
+    return status === "lifetime" || account.plan === "lifetime";
+  }
+  return !!account.plan && account.plan !== "free";
+}
+
+/** Open Stripe checkout and poll /me until the TARGET plan is active. Mirrors
+ * the browser-login poll UX. Returns the plan name on success, or null on
+ * timeout — the caller must NOT claim success on null. `pollMs`/`timeoutMs`
+ * are injectable for tests. */
+export async function upgradeViaBrowser({ client, plan, log = console.error, onTick, pollMs = 4000, timeoutMs = 10 * 60 * 1000 }) {
+  const target = plan === "lifetime" ? "lifetime" : "pro";
+
+  // Snapshot BEFORE opening checkout: already on the target → nothing to buy
+  // (and nothing to falsely "confirm" on the first poll tick).
+  try {
+    const me = await client.me();
+    if (planArrived(me?.account, target)) {
+      log(`\n  ✓ Your plan is already ${target} — nothing to buy.\n`);
+      return target;
+    }
+  } catch { /* can't pre-check — the poll below decides */ }
+
   const { url } = await client.checkout(plan);
   if (!url) throw new Error("Could not start checkout.");
   log(`\n  Opening checkout in your browser…`);
   log(`  If it doesn't open, visit:\n    ${url}\n`);
   openUrl(url);
+  log(`  Waiting for checkout to complete… (ctrl-c to stop)`);
 
-  const deadline = Date.now() + 10 * 60 * 1000;
+  const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    await sleep(4000);
+    await sleep(pollMs);
     try {
       const me = await client.me();
       onTick?.(me);
-      if (me?.account?.plan && me.account.plan !== "free") {
-        log(`\n  ✓ Upgraded to ${me.account.plan}. Thank you!\n`);
-        return me.account.plan;
+      if (planArrived(me?.account, target)) {
+        log(`\n  ✓ Upgraded to ${target}. Thank you!\n`);
+        return target;
       }
     } catch {
       /* keep polling */