@supacloud/admin 0.15.4 → 0.15.5

package/dist/index.js

@@ -25000,11 +25000,10 @@ class BoundedOutputCollector {
       output = lastNewline >= 0 ? output.slice(0, lastNewline + 1) : "";
     }
     const redacted = redactSshOutput(output);
-    if (!this.truncated)
-      return redacted;
-    return `${redacted}${redacted && !redacted.endsWith(`
+    const bounded = !this.truncated ? redacted : `${redacted}${redacted && !redacted.endsWith(`
 `) ? `
 ` : ""}[TRUNCATED: output exceeded ${this.limit}-byte limit]`;
+    return { output: bounded, redacted: redacted !== output };
   }
 }
 var BLOCKED_COMMANDS = [
@@ -25025,11 +25024,73 @@ var BLOCKED_COMMANDS = [
   "chmod -R 777 /"
 ];
 function redactSshCommand(command) {
-  return command.replace(/(\b[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL)[A-Z0-9_]*=)(?:"[^"]*"|'[^']*'|[^\s;]+)/gi, "$1[REDACTED]").replace(/(Authorization\s*[:=]\s*)(['"]?)Bearer\s+[^'"\s;]+\2/gi, "$1$2Bearer [REDACTED]$2").replace(/(\b--(?:password|token|secret|api-key)\s+)(\S+)/gi, "$1[REDACTED]").replace(/(postgres(?:ql)?:\/\/[^:\s/]+:)[^@\s]+@/gi, "$1[REDACTED]@");
+  return command.replace(/(\b[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL)[A-Z0-9_]*=)(?:"[^"]*"|'[^']*'|[^\s;]+)/gi, "$1[REDACTED]").replace(/(Authorization\s*[:=]\s*)(['"]?)Bearer\s+[^'"\s;]+\2/gi, "$1$2Bearer [REDACTED]$2").replace(/(\b--(?:password|token|secret|api-key)\s+)(\S+)/gi, "$1[REDACTED]").replace(/(postgres(?:ql)?:\/\/[^:\s/]*:)[^@\s]+@/gi, "$1[REDACTED]@");
+}
+var SENSITIVE_STRUCTURED_FIELD = /(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)/i;
+function decodedStructuredFieldName(encodedName) {
+  let decodedName = encodedName.replace(/\\'/g, "'");
+  for (let decodingPass = 0;decodingPass < 3; decodingPass += 1) {
+    if (decodedName.length > 256)
+      return null;
+    try {
+      const nextName = JSON.parse(`"${decodedName.replace(/"/g, "\\\"")}"`);
+      if (typeof nextName !== "string" || nextName === decodedName)
+        return decodedName;
+      decodedName = nextName;
+    } catch {
+      return null;
+    }
+  }
+  return decodedName;
+}
+function containsSensitiveStructuredField(message) {
+  const normalizedQuotes = message.replace(/\\"/g, '"').replace(/\\'/g, "'");
+  const fieldPatterns = [
+    /"((?:\\.|[^"\\\r\n])*)"\s*:/g,
+    /'((?:\\.|[^'\\\r\n])*)'\s*:/g,
+    /(?:^|[{,]\s*)([A-Za-z_$\\][A-Za-z0-9_$\\{}]{0,255})\s*:/g
+  ];
+  return fieldPatterns.some((pattern) => [...normalizedQuotes.matchAll(pattern)].some((match) => {
+    const decodedName = decodedStructuredFieldName(match[1]);
+    return decodedName === null || SENSITIVE_STRUCTURED_FIELD.test(decodedName);
+  }));
+}
+function structuredSensitiveFieldsAreRedacted(message) {
+  const normalizedQuotes = message.replace(/\\"/g, '"').replace(/\\'/g, "'");
+  try {
+    const parsedDiagnostic = JSON.parse(normalizedQuotes);
+    if (!parsedDiagnostic || typeof parsedDiagnostic !== "object")
+      return false;
+    let foundSensitiveField = false;
+    const pending = [parsedDiagnostic];
+    while (pending.length > 0) {
+      const current = pending.pop();
+      if (!current || typeof current !== "object")
+        continue;
+      for (const [fieldName, fieldValue] of Object.entries(current)) {
+        if (SENSITIVE_STRUCTURED_FIELD.test(fieldName)) {
+          foundSensitiveField = true;
+          if (fieldValue !== "[REDACTED]")
+            return false;
+        } else if (fieldValue && typeof fieldValue === "object") {
+          pending.push(fieldValue);
+        }
+      }
+    }
+    return foundSensitiveField;
+  } catch {
+    return false;
+  }
 }
 function redactSshOutput(output) {
-  const redactedLines = output.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|DB_URI|DATABASE_URL|DSN)[A-Z0-9_]*\s*=\s*).*$/gim, "$1[REDACTED]");
-  const redactedStructuredFields = redactedLines.replace(/((?:["']?(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)["']?)\s*:\s*)(?:"[^"]*"|'[^']*'|[^,}\]\r\n]+)/gi, "$1[REDACTED]");
+  const redactedEscapedFields = output.split(`
+`).map((line) => containsSensitiveStructuredField(line) && !structuredSensitiveFieldsAreRedacted(line) ? "[REDACTED: structured secret output]" : line).join(`
+`);
+  const redactedLines = redactedEscapedFields.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|DB_URI|DATABASE_URL|DSN)[A-Z0-9_]*\s*=\s*).*$/gim, "$1[REDACTED]");
+  const redactedStructuredFields = redactedLines.replace(/((?:["']?(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)["']?)\s*:\s*)("[^"]*"|'[^']*'|[^,}\]\r\n]+)/gi, (_match, prefix, literal) => {
+    const quote = literal[0];
+    return `${prefix}${quote === '"' || quote === "'" ? `${quote}[REDACTED]${quote}` : "[REDACTED]"}`;
+  });
   return redactSshCommand(redactedStructuredFields);
 }
 function isCommandBlocked(command) {
@@ -25172,13 +25233,17 @@ class SshTransport {
                 reject(new SshCommandOutcomeUnknownError("SSH command stream closed without a terminal status; remote outcome is unknown"));
                 return;
               }
+              const finalizedStdout = stdout.finalize();
+              const finalizedStderr = stderr.finalize();
               resolve({
                 success: code === 0,
-                stdout: stdout.finalize(),
-                stderr: stderr.finalize(),
+                stdout: finalizedStdout.output,
+                stderr: finalizedStderr.output,
                 code: code ?? 128,
                 stdoutTruncated: stdout.truncated,
-                stderrTruncated: stderr.truncated
+                stderrTruncated: stderr.truncated,
+                stdoutRedacted: finalizedStdout.redacted,
+                stderrRedacted: finalizedStderr.redacted
               });
             }).on("error", () => {
               clearTimeout(timer);
@@ -27317,8 +27382,10 @@ var REMOTE_LOG_ROOT = "/var/log/supacloud";
 var REMOTE_UPLOAD_ROOT = "/var/tmp";
 var REMOTE_COMMAND_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var CONTROL_PLANE_BACKUP_ROOT = "/var/lib/supacloud/backups/control-plane-upgrades";
+var CONTROL_PLANE_PREFLIGHT_PREFIX = "SUPACLOUD_CONTROL_PLANE_UPGRADE_PREFLIGHT=";
 var CONTROL_PLANE_SAFETY_PREFIX = "SUPACLOUD_CONTROL_PLANE_UPGRADE_SAFETY=";
-var MINIMUM_CONTROL_PLANE_SAFETY_VERSION = [0, 61, 4];
+var UPGRADE_FAILURE_PREFIX = "SUPACLOUD_UPGRADE_FAILURE=";
+var MINIMUM_CONTROL_PLANE_SAFETY_VERSION = [0, 61, 7];
 var POLL_INTERVAL_MS = 2000;
 var STATE_READ_ATTEMPTS = 3;
 var REMOTE_STATE_READ_TIMEOUT_MS = 15000;
@@ -27342,13 +27409,13 @@ function canonicalTimestamp(candidate) {
   const timestamp = new Date(candidate);
   return Number.isFinite(timestamp.valueOf()) && timestamp.toISOString() === candidate;
 }
-function parseControlPlaneSafetyEvidence(log) {
-  const receiptLines = log.split(/\r?\n/).filter((line) => line.startsWith(CONTROL_PLANE_SAFETY_PREFIX));
+function parseControlPlaneSafetyReceipt(log, prefix) {
+  const receiptLines = log.split(/\r?\n/).filter((line) => line.startsWith(prefix));
   if (receiptLines.length !== 1)
     throw new Error("Remote upgrade did not emit one control-plane safety receipt");
   let candidate;
   try {
-    candidate = JSON.parse(receiptLines[0].slice(CONTROL_PLANE_SAFETY_PREFIX.length));
+    candidate = JSON.parse(receiptLines[0].slice(prefix.length));
   } catch {
     throw new Error("Remote control-plane safety receipt is not valid JSON");
   }
@@ -27380,6 +27447,46 @@ function parseControlPlaneSafetyEvidence(log) {
   }
   return receipt;
 }
+function parseControlPlaneSafetyEvidence(log) {
+  return parseControlPlaneSafetyReceipt(log, CONTROL_PLANE_SAFETY_PREFIX);
+}
+function parseControlPlanePreflightEvidence(log) {
+  return parseControlPlaneSafetyReceipt(log, CONTROL_PLANE_PREFLIGHT_PREFIX);
+}
+function parsedUpgradeFailureReceipt(log) {
+  const receiptLines = log.split(/\r?\n/).filter((line) => line.startsWith(UPGRADE_FAILURE_PREFIX));
+  if (receiptLines.length !== 1)
+    throw new Error("Remote upgrade did not emit one structured failure receipt");
+  let candidate;
+  try {
+    candidate = JSON.parse(receiptLines[0].slice(UPGRADE_FAILURE_PREFIX.length));
+  } catch {
+    throw new Error("Remote upgrade failure receipt is not valid JSON");
+  }
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    throw new Error("Remote upgrade failure receipt is invalid");
+  }
+  return candidate;
+}
+function upgradeFailureReceiptIsInvalid(receipt) {
+  const causes = receipt.causes;
+  return !exactObjectKeys(receipt, ["causes", "schema", "summary"]) || receipt.schema !== "supacloud.upgrade-failure.v1" || typeof receipt.summary !== "string" || !receipt.summary || receipt.summary.length > 500 || /[\u0000-\u001f\u007f]/.test(receipt.summary) || !Array.isArray(causes) || causes.length > 8 || causes.some((cause) => typeof cause !== "string" || !cause || cause.length > 500 || /[\u0000-\u001f\u007f]/.test(cause));
+}
+function upgradeFailureMessageContainsSensitiveData(message) {
+  const bareBearer = /\bBearer\s+(?!\[REDACTED\](?:\s|$|[,;.)]))\S+/i;
+  return redactSshOutput(message) !== message || bareBearer.test(message);
+}
+function parseUpgradeFailureEvidence(log) {
+  const receipt = parsedUpgradeFailureReceipt(log);
+  if (upgradeFailureReceiptIsInvalid(receipt)) {
+    throw new Error("Remote upgrade failure receipt is invalid");
+  }
+  const messages = [receipt.summary, ...receipt.causes];
+  if (messages.some(upgradeFailureMessageContainsSensitiveData)) {
+    throw new Error("Remote upgrade failure receipt contains sensitive data");
+  }
+  return receipt;
+}
 function assertControlPlaneSafetyVersion(version) {
   const match = version.match(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/);
   if (!match)
@@ -27392,7 +27499,7 @@ function assertControlPlaneSafetyVersion(version) {
     if (requested[index] > MINIMUM_CONTROL_PLANE_SAFETY_VERSION[index])
       return;
     if (requested[index] < MINIMUM_CONTROL_PLANE_SAFETY_VERSION[index]) {
-      throw new Error("Local artifact upgrades require Management 0.61.4 or newer with control-plane backup safety");
+      throw new Error("Local artifact upgrades require Management 0.61.7 or newer with control-plane backup preflight safety");
     }
   }
 }
@@ -27713,6 +27820,7 @@ function bundledVerifierSetup(paths, architecture) {
 function upgradeScriptExecution(paths, bundle, request) {
   const runnerAsset = `${paths.stage}/bundle/management-api/${bundle.managementBinaryName}`;
   const runner = `${paths.stage}/runner`;
+  const preflight = 'CONTROL_PLANE_PREFLIGHT_RECEIPT=$(env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" --control-plane-upgrade-preflight)';
   return [
     `MANAGEMENT_VERSION=${quoteShell2(request.managementVersion)}`,
     `RUNNER_ASSET=${quoteShell2(runnerAsset)}`,
@@ -27723,7 +27831,9 @@ function upgradeScriptExecution(paths, bundle, request) {
     '"$RUNNER" --version | grep -Eq "(^|[^0-9])${MANAGEMENT_VERSION//./\\.}([^0-9]|$)"',
     `timeout 5s "$RUNNER" --systemd-unit-helper-sha256 | grep -Eq 'SupaCloud systemd-unit helper SHA-256: [0-9a-f]{64}'`,
     `timeout 5s "$RUNNER" --postgrest-launcher-sha256 | grep -Eq 'SupaCloud PostgREST launcher SHA-256: [0-9a-f]{64}'`,
-    `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`
+    preflight,
+    `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`,
+    `printf '%s\\n' "$CONTROL_PLANE_PREFLIGHT_RECEIPT"`
   ];
 }
 function buildLocalUpgradeRunScript(paths, bundle, request, architecture) {
@@ -27939,6 +28049,9 @@ async function remoteLogTail(ssh, paths) {
   const output = await ssh.exec(rootCommand(script), 15000);
   if (!output.success)
     throw remoteFailure("Unable to read the remote upgrade log", output);
+  if (output.stdoutRedacted || output.stderrRedacted || output.stdoutTruncated || output.stderrTruncated) {
+    throw new Error("Remote upgrade log required transport redaction or truncation");
+  }
   return output.stdout.slice(-4000);
 }
 async function cleanupRemoteRecords(ssh, paths) {
@@ -28036,11 +28149,13 @@ async function completedUpgradeOutput(ssh, paths) {
   } catch (error) {
     throw remoteReconciliationFailure("Upgrade succeeded but its retained log could not be read", [error], paths);
   }
+  let preflightEvidence;
   let safetyEvidence;
   try {
+    preflightEvidence = parseControlPlanePreflightEvidence(log);
     safetyEvidence = parseControlPlaneSafetyEvidence(log);
   } catch (error) {
-    throw remoteReconciliationFailure("Upgrade succeeded but control-plane safety evidence is invalid", [error], paths);
+    throw remoteReconciliationFailure("Upgrade succeeded but control-plane preflight or safety evidence is invalid", [error], paths);
   }
   try {
     await cleanupRemoteRecords(ssh, paths);
@@ -28048,7 +28163,7 @@ async function completedUpgradeOutput(ssh, paths) {
     throw remoteReconciliationFailure("Upgrade succeeded but remote evidence cleanup could not be confirmed", [error], paths);
   }
   return `✅ Upgrade done
-${JSON.stringify(safetyEvidence)}
+${JSON.stringify({ preflight: preflightEvidence, transaction: safetyEvidence })}
 ${log.slice(-1500)}`;
 }
 async function throwRemoteUpgradeFailure(ssh, paths, status) {
@@ -28058,13 +28173,19 @@ async function throwRemoteUpgradeFailure(ssh, paths, status) {
   } catch (error) {
     throw remoteReconciliationFailure("Remote upgrade failed but its retained log could not be read", [error], paths);
   }
-  const failure = new Error(`Remote local upgrade failed (${status}): ${log.slice(-1500)}`);
   if (status.endsWith(":CLEANUP_AFTER_TRANSACTION")) {
-    throw remoteReconciliationFailure("Upgrade transaction completed but staging cleanup is incomplete", [failure], paths);
+    throw remoteReconciliationFailure("Upgrade transaction completed but staging cleanup is incomplete", [new Error(`Remote local upgrade ended with ${status}`)], paths);
   }
   if (status.includes("CLEANUP")) {
-    throw remoteReconciliationFailure("Upgrade transaction and staging cleanup both failed", [failure], paths);
+    throw remoteReconciliationFailure("Upgrade transaction and staging cleanup both failed", [new Error(`Remote local upgrade ended with ${status}`)], paths);
+  }
+  let failureEvidence;
+  try {
+    failureEvidence = parseUpgradeFailureEvidence(log);
+  } catch (error) {
+    throw remoteReconciliationFailure("Remote upgrade failed without valid structured failure evidence", [error], paths);
   }
+  const failure = new Error(`Remote local upgrade failed (${status}): ${failureEvidence.summary}` + (failureEvidence.causes.length > 0 ? `; causes: ${failureEvidence.causes.join(" | ")}` : ""));
   try {
     await cleanupRemoteRecords(ssh, paths);
   } catch (cleanupError) {
@@ -32245,7 +32366,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.15.4",
+  version: "0.15.5",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.15.4",
+  "version": "0.15.5",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",