@orb44/cli 0.1.7 → 0.1.8

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.7 status
-npx @orb44/cli@0.1.7 pulse
-npx @orb44/cli@0.1.7 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.8 status
+npx @orb44/cli@0.1.8 pulse
+npx @orb44/cli@0.1.8 install     # later: background pulse, starts after reboot
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.7 logout
+npx @orb44/cli@0.1.8 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -169,6 +169,8 @@ function printAdvice(notes) {
 
 async function sendPulse(device, { preview = true } = {}) {
   const pulse = collectPulse();
+  const ver = readCliVersion(SCRIPT);
+  if (ver && ver !== "0.0.0") pulse.cliVersion = ver;
   if (preview) {
     console.log(bold("📡 " + t(lang, "payload")));
     console.log(formatPulsePreview(pulse, lang));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {

package/server/pulse.mjs

@@ -266,6 +266,7 @@ export function sanitizePulse(raw = {}) {
   const limited = Boolean(raw.limited);
   const oom = Boolean(raw.oom) || hardening.oomKills > 0;
   const pressure = sanitizePressure(raw.pressure || raw);
+  const cliVersion = sanitizeCliVersion(raw.cliVersion);
   const base = {
     ts: Number(raw.ts) || Date.now(),
     hostname: sanitizeComm(raw.hostname) || os.hostname().slice(0, 40),
@@ -281,10 +282,18 @@ export function sanitizePulse(raw = {}) {
     limited,
     hardening,
     pressure,
+    cliVersion,
   };
   return { ...base, gradeInside: gradeInside(base) };
 }
 
+function sanitizeCliVersion(raw) {
+  const v = String(raw || "").trim();
+  if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}(-[a-z0-9.]+)?$/i.test(v)) return null;
+  if (v === "0.0.0") return null;
+  return v.slice(0, 32);
+}
+
 const ADMIN_PORTS = new Set([2019, 2375, 2376, 3306, 5432, 6379, 27017, 9200, 11211, 15672, 8500, 2379, 6443, 9090, 5601, 7474, 7687, 1080, 6432]);
 
 const SERVICE_NAME = {

package/server/sat-update.mjs

@@ -104,13 +104,35 @@ export async function fetchLatestMeta(fetchFn = fetch) {
   const version = j?.version;
   const tarball = j?.dist?.tarball;
   if (!version || !tarball) throw new Error("registry meta");
-  return { version: String(version), tarball: String(tarball) };
+  return { version: String(version), tarball: canonicalTarballUrl(tarball) };
 }
 
-export async function unpackTarball(url, tmp, fetchFn = fetch) {
-  const r = await fetchFn(url);
-  if (!r?.ok) throw new Error(`tarball ${r?.status || "fail"}`);
-  const buf = Buffer.from(await r.arrayBuffer());
+/** npm metadata uses /@scope/name/; GET of the tarball is more reliable as /@scope%2fname/. */
+export function canonicalTarballUrl(url) {
+  try {
+    const u = new URL(String(url));
+    u.pathname = u.pathname.replace(/^\/@([^/]+)\/([^/]+)\//, "/@$1%2f$2/");
+    return u.href;
+  } catch {
+    return String(url || "");
+  }
+}
+
+export async function unpackTarball(url, tmp, fetchFn = fetch, { retries = 4, delayMs = 1500 } = {}) {
+  const href = canonicalTarballUrl(url);
+  let last = "fail";
+  let buf = null;
+  for (let i = 0; i < retries; i++) {
+    const r = await fetchFn(href);
+    last = r?.status || "fail";
+    if (r?.ok) {
+      buf = Buffer.from(await r.arrayBuffer());
+      break;
+    }
+    if (Number(last) !== 404 && Number(last) !== 429) break;
+    if (i < retries - 1 && delayMs) await new Promise((ok) => setTimeout(ok, delayMs * (i + 1)));
+  }
+  if (!buf) throw new Error(`tarball ${last}`);
   const tgz = path.join(tmp, "pkg.tgz");
   fs.writeFileSync(tgz, buf);
   const unpack = path.join(tmp, "unpack");