@pushpalsdev/cli 1.0.94 → 1.0.95

package/dist/pushpals-cli.js

@@ -11,6 +11,7 @@ import {
   mkdirSync,
   readdirSync,
   readFileSync as readFileSync4,
+  renameSync,
   rmSync as rmSync2,
   writeFileSync
 } from "fs";
@@ -1978,8 +1979,29 @@ async function runCommandWithEnv(command, cwd, env, timeoutMs) {
     };
   }
 }
+function appendGitConfigEnv(env, key, value) {
+  const existingCount = Number.parseInt(String(env.GIT_CONFIG_COUNT ?? "0").trim(), 10);
+  const count = Number.isFinite(existingCount) && existingCount >= 0 ? existingCount : 0;
+  for (let index = 0;index < count; index++) {
+    if (String(env[`GIT_CONFIG_KEY_${index}`] ?? "") === key)
+      return env;
+  }
+  return {
+    ...env,
+    GIT_CONFIG_COUNT: String(count + 1),
+    [`GIT_CONFIG_KEY_${count}`]: key,
+    [`GIT_CONFIG_VALUE_${count}`]: value
+  };
+}
+function withWindowsGitSchannelEnv(env, platform = process.platform) {
+  if (platform !== "win32")
+    return env;
+  if (parseBooleanFlag(env.PUSHPALS_DISABLE_WINDOWS_GIT_SCHANNEL) === true)
+    return env;
+  return appendGitConfigEnv(env, "http.sslBackend", "schannel");
+}
 async function runGitWithEnv(args, cwd, env) {
-  return await runCommandWithEnv(["git", ...args], cwd, env);
+  return await runCommandWithEnv(["git", ...args], cwd, withWindowsGitSchannelEnv(env));
 }
 async function runGit(args, cwd) {
   return await runGitWithEnv(args, cwd, {
@@ -2264,15 +2286,59 @@ function resolveRuntimePlatformKey() {
   throw new Error(`Unsupported platform for embedded runtime binaries: ${process.platform}/${process.arch}`);
 }
 async function fetchLatestReleaseTag() {
-  const response = await fetchWithTimeout(`${GITHUB_API_URL}/releases/latest`, { headers: GITHUB_HEADERS }, 20000);
-  if (!response.ok) {
-    throw new Error(`Failed to resolve latest release tag (HTTP ${response.status})`);
+  try {
+    const response = await fetchWithTimeout(`${GITHUB_API_URL}/releases/latest`, { headers: GITHUB_HEADERS }, 20000);
+    if (!response.ok) {
+      throw new Error(`Failed to resolve latest release tag (HTTP ${response.status})`);
+    }
+    const payload = await response.json();
+    const tagName = String(payload.tag_name ?? "").trim();
+    if (!tagName)
+      throw new Error("Latest release payload did not include tag_name");
+    return tagName;
+  } catch (err) {
+    const fallback = await fetchLatestReleaseTagWithGitFallback(err);
+    if (fallback)
+      return fallback;
+    throw err;
   }
-  const payload = await response.json();
-  const tagName = String(payload.tag_name ?? "").trim();
-  if (!tagName)
-    throw new Error("Latest release payload did not include tag_name");
-  return tagName;
+}
+async function fetchLatestReleaseTagWithGitFallback(cause) {
+  const message = String(cause instanceof Error ? cause.message : cause ?? "");
+  if (process.platform !== "win32" || !/certificate|cert_|unable to verify|self[- ]signed|tls|ssl/i.test(message) && !/fetch failed/i.test(message)) {
+    return null;
+  }
+  console.warn("[pushpals] Bun could not verify the GitHub API certificate; resolving latest release tag with Git instead.");
+  const result = await runGitWithEnv([
+    "ls-remote",
+    "--tags",
+    "--refs",
+    `https://github.com/${GITHUB_OWNER}/${GITHUB_REPO}.git`,
+    "refs/tags/v*"
+  ], process.cwd(), {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GCM_INTERACTIVE: "Never"
+  });
+  if (!result.ok)
+    return null;
+  const tags = result.stdout.split(/\r?\n/g).map((line) => line.trim().match(/refs\/tags\/(v\d+\.\d+\.\d+(?:[-.][0-9A-Za-z.-]+)?)$/)?.[1]).filter((tag) => Boolean(tag));
+  return sortReleaseTagsDescending(tags)[0] ?? null;
+}
+function sortReleaseTagsDescending(tags) {
+  return [...new Set(tags)].sort((a, b) => compareReleaseTags(b, a));
+}
+function compareReleaseTags(a, b) {
+  const parse = (value) => String(value).replace(/^v/i, "").split(/[.-]/g).map((part) => Number.parseInt(part, 10)).map((part) => Number.isFinite(part) ? part : 0);
+  const left = parse(a);
+  const right = parse(b);
+  const max = Math.max(left.length, right.length, 3);
+  for (let index = 0;index < max; index++) {
+    const delta = (left[index] ?? 0) - (right[index] ?? 0);
+    if (delta !== 0)
+      return delta;
+  }
+  return a.localeCompare(b);
 }
 function resolvePreferredRuntimeReleaseTag(explicitTag, env = process.env) {
   const fromArg = String(explicitTag ?? "").trim();
@@ -2588,7 +2654,7 @@ function buildEmbeddedRuntimeEnv(baseEnv, opts) {
     const existing = env[key];
     return typeof existing !== "string" || existing.trim().length === 0;
   })) : {};
-  return {
+  const runtimeEnv = {
     ...inherited,
     PUSHPALS_REPO_ROOT_OVERRIDE: opts.repoRoot,
     PUSHPALS_PROJECT_ROOT_OVERRIDE: opts.repoRoot,
@@ -2609,6 +2675,7 @@ function buildEmbeddedRuntimeEnv(baseEnv, opts) {
     ...typeof env.PUSHPALS_DOCKER_BIN === "string" && env.PUSHPALS_DOCKER_BIN.trim() ? { PUSHPALS_DOCKER_BIN: env.PUSHPALS_DOCKER_BIN.trim() } : {},
     ...typeof env.PUSHPALS_DOCKER_BIN_ABSOLUTE === "string" && env.PUSHPALS_DOCKER_BIN_ABSOLUTE.trim() ? { PUSHPALS_DOCKER_BIN_ABSOLUTE: env.PUSHPALS_DOCKER_BIN_ABSOLUTE.trim() } : {}
   };
+  return withWindowsGitSchannelEnv(runtimeEnv, platform);
 }
 function parseBooleanFlag(raw) {
   const normalized = String(raw ?? "").trim().toLowerCase();
@@ -2752,13 +2819,51 @@ function readRemoteBuddyAutonomousEngineState(logPath) {
 async function downloadBinaryAsset(tag, assetName, outPath) {
   console.log(`[pushpals] Downloading embedded runtime binary ${assetName} from ${tag}...`);
   const url = `${GITHUB_RELEASE_URL}/${encodeURIComponent(tag)}/${assetName}`;
-  const response = await fetchWithTimeout(url, { headers: GITHUB_HEADERS }, 60000);
-  if (!response.ok) {
-    throw new Error(`Failed to download ${assetName} from ${tag} (HTTP ${response.status})`);
+  try {
+    const response = await fetchWithTimeout(url, { headers: GITHUB_HEADERS }, 60000);
+    if (!response.ok) {
+      throw new Error(`Failed to download ${assetName} from ${tag} (HTTP ${response.status})`);
+    }
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    mkdirSync(dirname(outPath), { recursive: true });
+    await Bun.write(outPath, bytes);
+    return;
+  } catch (err) {
+    const fallback = await downloadBinaryAssetWithWindowsCurlFallback(url, outPath, err);
+    if (fallback)
+      return;
+    throw err;
+  }
+}
+async function downloadBinaryAssetWithWindowsCurlFallback(url, outPath, cause) {
+  if (process.platform !== "win32")
+    return false;
+  const message = String(cause instanceof Error ? cause.message : cause ?? "");
+  if (!/certificate|cert_|unable to verify|self[- ]signed|tls|ssl/i.test(message) && !/fetch failed/i.test(message)) {
+    return false;
   }
-  const bytes = new Uint8Array(await response.arrayBuffer());
+  const tmpPath = `${outPath}.download-${process.pid}-${Date.now()}.tmp`;
   mkdirSync(dirname(outPath), { recursive: true });
-  await Bun.write(outPath, bytes);
+  rmSync2(tmpPath, { force: true });
+  console.warn("[pushpals] Bun could not verify the GitHub release certificate; retrying download with Windows curl certificate handling.");
+  const result = await runCommandWithEnv([
+    "curl.exe",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--ssl-no-revoke",
+    "--output",
+    tmpPath,
+    url
+  ], process.cwd(), process.env, 120000);
+  if (!result.ok || !existsSync5(tmpPath)) {
+    rmSync2(tmpPath, { force: true });
+    const detail = result.stderr || result.stdout || `exit ${result.exitCode}`;
+    throw new Error(`Windows curl fallback failed while downloading runtime binary: ${detail}`);
+  }
+  renameSync(tmpPath, outPath);
+  return true;
 }
 async function ensureRuntimeBinaries(runtimeRoot, runtimeTag) {
   const platformKey = resolveRuntimePlatformKey();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.0.94",
+  "version": "1.0.95",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {