@supacloud/admin 0.7.12 → 0.8.0

package/README.md

@@ -27,11 +27,19 @@ Examples:
 ```bash
 npx @supacloud/admin status
 npx @supacloud/admin ssh ping
+npx @supacloud/admin ssh versions
 npx @supacloud/admin ssh diagnose
 npx @supacloud/admin project create --name my-app
 npx @supacloud/admin project list
 ```
 
+`ssh versions` emits JSON with `schema_version: 1` and fixed
+`management_api`, `edge_runtime`, `caddy`, and `web_console` component fields.
+Each component reports `status` as `ok`, `unknown`, or `error`; a failed probe
+never substitutes a guessed version. Binary evidence is bound to the active
+systemd `ExecStart`, and Web Console evidence comes from its component marker
+plus an explicit `tree_sha256` digest.
+
 ## Verified platform upgrades
 
 Use one explicit Admin command to upgrade Management, Web Console, and an

package/dist/index.js

@@ -25702,8 +25702,10 @@ class HttpTransport {
 }
 
 // src/shared/tools/ssh-tools.ts
+import { Buffer as Buffer2 } from "node:buffer";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { basename as basename3, dirname, join as join2 } from "node:path";
+import { TextDecoder as TextDecoder2 } from "node:util";
 
 // src/shared/releases/local-upgrade-transfer.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
@@ -27280,6 +27282,92 @@ var SAFE_DB_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_-]{0,62}$/;
 var MINIMUM_COMPONENT_UPGRADE_VERSION = "0.50.27";
 var DIRECT_UPGRADE_SSH_TIMEOUT_MS = 720000;
 var PROXIED_UPGRADE_SSH_TIMEOUT_MS = 1320000;
+var PLATFORM_PROBE_TIMEOUT_MS = 1e4;
+var PLATFORM_HASH_TIMEOUT_MS = 30000;
+var WEB_CONSOLE_PROBE_TIMEOUT_MS = 60000;
+var BINARY_VERSION_MAX_BYTES = 2048;
+var WEB_CONSOLE_MARKER_MAX_BYTES = 4096;
+var WEB_CONSOLE_CURRENT_DIR = "/opt/supacloud/web-console/current";
+var STABLE_SEMVER_CORE = "(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)";
+var EXACT_STABLE_SEMVER = new RegExp(`^(?:${STABLE_SEMVER_CORE})(?![\\s\\S])`);
+var SEMVER_CORE_TOKEN = /\d+\.\d+\.\d+/;
+var VERSION_TOKEN_SEPARATOR = /[\s"'()\[\]{}:,;=]+/;
+var BINARY_HASH_BEFORE_FAILED = 70;
+var BINARY_VERSION_FAILED = 71;
+var BINARY_HASH_AFTER_FAILED = 72;
+var PROBE_CHANGED_DURING_READ = 75;
+var WEB_CONSOLE_ROOT_MISSING = 43;
+var WEB_CONSOLE_MARKER_MISSING = 44;
+var WEB_CONSOLE_ROOT_INVALID = 64;
+var WEB_CONSOLE_MARKER_INVALID = 65;
+var WEB_CONSOLE_TREE_INVALID = 66;
+var WEB_CONSOLE_TREE_FAILED = 67;
+var BINARY_HASH_BEFORE_LABEL = "SUPACLOUD_BINARY_HASH_BEFORE=";
+var BINARY_VERSION_LABEL = "SUPACLOUD_BINARY_VERSION_BASE64=";
+var BINARY_HASH_AFTER_LABEL = "SUPACLOUD_BINARY_HASH_AFTER=";
+var WEB_ROOT_REAL_BEFORE_LABEL = "SUPACLOUD_WEB_ROOT_REAL_BEFORE=";
+var WEB_ROOT_ID_BEFORE_LABEL = "SUPACLOUD_WEB_ROOT_ID_BEFORE=";
+var WEB_MARKER_BEFORE_LABEL = "SUPACLOUD_WEB_MARKER_BASE64_BEFORE=";
+var WEB_TREE_BEFORE_LABEL = "SUPACLOUD_WEB_TREE_SHA256_BEFORE=";
+var WEB_TREE_AFTER_LABEL = "SUPACLOUD_WEB_TREE_SHA256_AFTER=";
+var WEB_MARKER_AFTER_LABEL = "SUPACLOUD_WEB_MARKER_BASE64_AFTER=";
+var WEB_ROOT_REAL_AFTER_LABEL = "SUPACLOUD_WEB_ROOT_REAL_AFTER=";
+var WEB_ROOT_ID_AFTER_LABEL = "SUPACLOUD_WEB_ROOT_ID_AFTER=";
+function fixedBinaryProbeCommand(executablePath, versionArgument) {
+  const executable = quoteEnvValue(executablePath);
+  return [
+    "set -o pipefail",
+    `if exec {BINARY_FD}<${executable}; then :; else exit ${BINARY_HASH_BEFORE_FAILED}; fi`,
+    "PINNED_EXECUTABLE=/proc/$$/fd/$BINARY_FD",
+    `if PINNED_ID=$(stat -Lc '%d:%i' -- "$PINNED_EXECUTABLE"); then :; else exit ${BINARY_HASH_BEFORE_FAILED}; fi`,
+    `if HASH_BEFORE=$(sha256sum -- "$PINNED_EXECUTABLE" | awk '{print $1}'); then :; else exit ${BINARY_HASH_BEFORE_FAILED}; fi`,
+    `printf '${BINARY_HASH_BEFORE_LABEL}%s\\n' "$HASH_BEFORE"`,
+    `if VERSION_BASE64=$( (exec -a ${executable} "$PINNED_EXECUTABLE" ${versionArgument} {BINARY_FD}<&-) 2>&1 | head -c ${BINARY_VERSION_MAX_BYTES + 1} | base64 | tr -d '\\n'); then :; else exit ${BINARY_VERSION_FAILED}; fi`,
+    `printf '${BINARY_VERSION_LABEL}%s\\n' "$VERSION_BASE64"`,
+    `if HASH_AFTER=$(sha256sum -- "$PINNED_EXECUTABLE" | awk '{print $1}'); then :; else exit ${BINARY_HASH_AFTER_FAILED}; fi`,
+    `printf '${BINARY_HASH_AFTER_LABEL}%s\\n' "$HASH_AFTER"`,
+    `[ "$HASH_BEFORE" = "$HASH_AFTER" ] || exit ${PROBE_CHANGED_DURING_READ}`,
+    `if CURRENT_ID=$(stat -Lc '%d:%i' -- ${executable}); then :; else exit ${PROBE_CHANGED_DURING_READ}; fi`,
+    `[ "$PINNED_ID" = "$CURRENT_ID" ] || exit ${PROBE_CHANGED_DURING_READ}`,
+    "exec {BINARY_FD}<&-"
+  ].join(`
+`);
+}
+var BINARY_PROBES = {
+  management_api: {
+    unit: "supacloud.service",
+    source: "systemd:supacloud.service:ExecStart",
+    commands: {
+      "/usr/local/bin/supacloud": {
+        command: fixedBinaryProbeCommand("/usr/local/bin/supacloud", "--version")
+      },
+      "/opt/supacloud/bin/supacloud": {
+        command: fixedBinaryProbeCommand("/opt/supacloud/bin/supacloud", "--version")
+      }
+    }
+  },
+  edge_runtime: {
+    unit: "supacloud-edge-runtime.service",
+    source: "systemd:supacloud-edge-runtime.service:ExecStart",
+    commands: {
+      "/usr/local/bin/supacloud-edge-runtime": {
+        command: fixedBinaryProbeCommand("/usr/local/bin/supacloud-edge-runtime", "--version")
+      },
+      "/opt/supacloud/bin/supacloud-edge-runtime": {
+        command: fixedBinaryProbeCommand("/opt/supacloud/bin/supacloud-edge-runtime", "--version")
+      }
+    }
+  },
+  caddy: {
+    unit: "supacloud-caddy.service",
+    source: "systemd:supacloud-caddy.service:ExecStart",
+    commands: {
+      "/usr/local/bin/supacloud-caddy": {
+        command: fixedBinaryProbeCommand("/usr/local/bin/supacloud-caddy", "version")
+      }
+    }
+  }
+};
 function hostnameSchema(fieldName) {
   return decodedSchema(Type.String(), Type.String({ minLength: 1, maxLength: 253 }), (value) => {
     const normalized = value.trim();
@@ -27337,7 +27425,8 @@ function assertSafeReleaseTag(value) {
   return value;
 }
 function assertExactStableVersion2(value, fieldName) {
-  if (!/^v?\d+\.\d+\.\d+$/.test(value)) {
+  const normalized = value.startsWith("v") ? value.slice(1) : value;
+  if (!EXACT_STABLE_SEMVER.test(normalized)) {
     throw new Error(`${fieldName} must be an exact stable semantic version`);
   }
   return value;
@@ -27657,14 +27746,366 @@ function assertSafeExecCommand(command) {
   }
   return reject();
 }
+async function runFixedRemoteCommand(ssh, command, timeoutMs) {
+  try {
+    return await ssh.exec(command, timeoutMs);
+  } catch {
+    return null;
+  }
+}
+function singleSystemdProperty(output, property) {
+  const prefix = `${property}=`;
+  const matches = output.split(/\r?\n/).filter((line) => line.startsWith(prefix));
+  return matches.length === 1 ? matches[0].slice(prefix.length) : null;
+}
+function strictExecStartPath(execStart) {
+  if (execStart.length > 4096 || /[\r\n\0]/.test(execStart))
+    return null;
+  const matches = Array.from(execStart.matchAll(/(?:^|[{;]\s*)path=([^;}]+?)\s*(?=;|}|$)/g));
+  if (matches.length !== 1)
+    return null;
+  const executablePath = matches[0]?.[1]?.trim() || "";
+  return /^\/[a-zA-Z0-9._/-]+$/.test(executablePath) ? executablePath : null;
+}
+function execStartEvidence(output) {
+  if (output.length > 8192 || /\0/.test(output)) {
+    return { status: "error", path: null, error: "systemd_output_invalid" };
+  }
+  if (!output.trim())
+    return { status: "unknown", path: null, error: "unit_missing" };
+  const loadState = singleSystemdProperty(output, "LoadState");
+  const execStart = singleSystemdProperty(output, "ExecStart");
+  if (loadState === null || execStart === null) {
+    return { status: "error", path: null, error: "systemd_output_invalid" };
+  }
+  if (loadState !== "loaded")
+    return { status: "unknown", path: null, error: "unit_not_loaded" };
+  if (execStart === "")
+    return { status: "unknown", path: null, error: "exec_start_missing" };
+  const executablePath = strictExecStartPath(execStart);
+  return executablePath ? { status: "ok", path: executablePath, error: null } : { status: "error", path: null, error: "exec_start_invalid" };
+}
+function stableVersion(output) {
+  if (output.length > BINARY_VERSION_MAX_BYTES || /\0/.test(output))
+    return null;
+  const versionTokens = output.split(VERSION_TOKEN_SEPARATOR).filter((token) => SEMVER_CORE_TOKEN.test(token));
+  const versions = versionTokens.map((token) => token.startsWith("v") ? token.slice(1) : token);
+  if (versions.length === 0 || versions.some((version) => !EXACT_STABLE_SEMVER.test(version))) {
+    return null;
+  }
+  const uniqueVersions = new Set(versions);
+  return uniqueVersions.size === 1 ? [...uniqueVersions][0] : null;
+}
+function stableSha256(output) {
+  return /^[0-9a-f]{64}$/.test(output) ? output : null;
+}
+function unavailableBinaryEvidence(definition, evidence) {
+  return {
+    status: evidence.status,
+    version: null,
+    sha256: null,
+    path: evidence.path,
+    source: definition.source,
+    error: evidence.error
+  };
+}
+function canonicalBase64Text(encoded, maximumBytes) {
+  if (encoded.length > Math.ceil(maximumBytes / 3) * 4 || encoded.length % 4 !== 0)
+    return null;
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded))
+    return null;
+  const decodedBytes = Buffer2.from(encoded, "base64");
+  if (decodedBytes.length > maximumBytes || decodedBytes.toString("base64") !== encoded)
+    return null;
+  try {
+    return new TextDecoder2("utf-8", { fatal: true }).decode(decodedBytes);
+  } catch {
+    return null;
+  }
+}
+function taggedProbeValue(line, label) {
+  return line?.startsWith(label) ? line.slice(label.length) : null;
+}
+function binaryProbeFields(output) {
+  if (output.length > 8192 || /[\r\0]/.test(output))
+    return null;
+  const lines = (output.endsWith(`
+`) ? output.slice(0, -1) : output).split(`
+`);
+  if (lines.length < 2 || lines.length > 3)
+    return null;
+  const hashBefore = taggedProbeValue(lines[0], BINARY_HASH_BEFORE_LABEL);
+  const versionBase64 = taggedProbeValue(lines[1], BINARY_VERSION_LABEL);
+  const hashAfter = lines.length === 3 ? taggedProbeValue(lines[2], BINARY_HASH_AFTER_LABEL) : null;
+  if (hashBefore === null || versionBase64 === null || lines.length === 3 && hashAfter === null)
+    return null;
+  const versionOutput = canonicalBase64Text(versionBase64, BINARY_VERSION_MAX_BYTES);
+  return versionOutput === null ? null : { versionOutput, hashBefore, hashAfter };
+}
+function completedBinaryProbe(fields) {
+  const version = stableVersion(fields.versionOutput);
+  const hashBefore = stableSha256(fields.hashBefore);
+  const hashAfter = fields.hashAfter === null ? null : stableSha256(fields.hashAfter);
+  if (hashBefore && hashAfter && hashBefore !== hashAfter) {
+    return { version: null, sha256: null, error: "binary_changed_during_probe" };
+  }
+  const sha2562 = hashBefore && hashAfter ? hashBefore : null;
+  if (!version)
+    return { version: null, sha256: sha2562, error: "version_output_invalid" };
+  return sha2562 ? { version, sha256: sha2562, error: null } : { version, sha256: null, error: "sha256_output_invalid" };
+}
+function reservedBinaryProbeFailure(execution, fields) {
+  if (execution.code === PROBE_CHANGED_DURING_READ) {
+    return { version: null, sha256: null, error: "binary_changed_during_probe" };
+  }
+  if (execution.code === BINARY_HASH_BEFORE_FAILED) {
+    return { version: null, sha256: null, error: "sha256_probe_failed" };
+  }
+  if (execution.code === BINARY_VERSION_FAILED) {
+    return { version: null, sha256: null, error: "version_probe_failed" };
+  }
+  if (execution.code === BINARY_HASH_AFTER_FAILED) {
+    const version = fields ? stableVersion(fields.versionOutput) : null;
+    return version ? { version, sha256: null, error: "sha256_probe_failed" } : { version: null, sha256: null, error: fields ? "version_output_invalid" : "binary_probe_output_invalid" };
+  }
+  return null;
+}
+function binaryProbeValues(execution) {
+  if (!execution)
+    return { version: null, sha256: null, error: "binary_probe_transport_failed" };
+  const fields = binaryProbeFields(execution.stdout);
+  const reservedFailure = reservedBinaryProbeFailure(execution, fields);
+  if (reservedFailure)
+    return reservedFailure;
+  if (!execution.success)
+    return { version: null, sha256: null, error: "binary_probe_failed" };
+  return fields ? completedBinaryProbe(fields) : { version: null, sha256: null, error: "binary_probe_output_invalid" };
+}
+async function binaryComponentEvidence(ssh, definition) {
+  const execStart = await systemdBinaryEvidence(ssh, definition);
+  if (execStart.status !== "ok" || !execStart.path)
+    return unavailableBinaryEvidence(definition, execStart);
+  const fixedProbe = definition.commands[execStart.path];
+  if (!fixedProbe)
+    return unavailableBinaryEvidence(definition, {
+      status: "error",
+      path: execStart.path,
+      error: "exec_start_not_allowed"
+    });
+  const evidence = await fixedBinaryEvidence(ssh, definition, execStart.path, fixedProbe);
+  const verifiedExecStart = await systemdBinaryEvidence(ssh, definition);
+  if (verifiedExecStart.status !== "ok") {
+    return unavailableBinaryEvidence(definition, {
+      status: "error",
+      path: execStart.path,
+      error: "exec_start_recheck_failed"
+    });
+  }
+  return verifiedExecStart.path === execStart.path ? evidence : unavailableBinaryEvidence(definition, {
+    status: "error",
+    path: execStart.path,
+    error: "exec_start_changed_during_probe"
+  });
+}
+async function systemdBinaryEvidence(ssh, definition) {
+  const systemdCommand = `systemctl show --property=LoadState --property=ExecStart -- ${definition.unit}`;
+  const systemdExecution = await runFixedRemoteCommand(ssh, systemdCommand, PLATFORM_PROBE_TIMEOUT_MS);
+  if (!systemdExecution)
+    return { status: "error", path: null, error: "systemd_probe_transport_failed" };
+  if (!systemdExecution.success)
+    return { status: "error", path: null, error: "systemd_probe_failed" };
+  return execStartEvidence(systemdExecution.stdout);
+}
+async function fixedBinaryEvidence(ssh, definition, executablePath, fixedProbe) {
+  const execution = await runFixedRemoteCommand(ssh, fixedProbe.command, PLATFORM_HASH_TIMEOUT_MS);
+  const probe = binaryProbeValues(execution);
+  return {
+    status: probe.error ? "error" : "ok",
+    version: probe.version,
+    sha256: probe.sha256,
+    path: executablePath,
+    source: definition.source,
+    error: probe.error
+  };
+}
+function parseWebConsoleVersion(markerOutput) {
+  if (markerOutput.length > WEB_CONSOLE_MARKER_MAX_BYTES || /\0/.test(markerOutput))
+    return null;
+  try {
+    const marker = JSON.parse(markerOutput);
+    if (typeof marker !== "object" || marker === null || Array.isArray(marker))
+      return null;
+    const fields = marker;
+    if (fields.schema_version !== 1 || fields.component !== "web-console")
+      return null;
+    return typeof fields.version === "string" && EXACT_STABLE_SEMVER.test(fields.version) ? fields.version : null;
+  } catch {
+    return null;
+  }
+}
+var WEB_CONSOLE_PROBE_COMMAND = [
+  "set -o pipefail",
+  `ROOT=${quoteEnvValue(WEB_CONSOLE_CURRENT_DIR)}`,
+  'if [ ! -e "$ROOT" ] && [ ! -L "$ROOT" ]; then exit 43; fi',
+  `test -d "$ROOT" || exit ${WEB_CONSOLE_ROOT_INVALID}`,
+  `ROOT_REAL_BEFORE=$(readlink -f -- "$ROOT") || exit ${WEB_CONSOLE_ROOT_INVALID}`,
+  `case "$ROOT_REAL_BEFORE" in "$ROOT"|/opt/supacloud/web-console/releases/*) ;; *) exit ${WEB_CONSOLE_ROOT_INVALID} ;; esac`,
+  `ROOT_ID_BEFORE=$(stat -c '%d:%i' -- "$ROOT_REAL_BEFORE") || exit ${WEB_CONSOLE_ROOT_INVALID}`,
+  "MARKER_BEFORE=$ROOT_REAL_BEFORE/.supacloud-component.json",
+  `test ! -L "$MARKER_BEFORE" || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  `test -e "$MARKER_BEFORE" || exit ${WEB_CONSOLE_MARKER_MISSING}`,
+  `test -f "$MARKER_BEFORE" || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  `test "$(stat -c '%s' -- "$MARKER_BEFORE")" -le ${WEB_CONSOLE_MARKER_MAX_BYTES} || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  `MARKER_BASE64_BEFORE=$(head -c ${WEB_CONSOLE_MARKER_MAX_BYTES + 1} -- "$MARKER_BEFORE" | base64 | tr -d '\\n') || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  "web_tree_sha256() {",
+  "  local TREE_ROOT INVALID_ENTRY TREE_DIGEST",
+  "  TREE_ROOT=$1",
+  `  INVALID_ENTRY=$(cd -- "$TREE_ROOT" && find . -xdev ! -type d ! -type f -print -quit) || return ${WEB_CONSOLE_TREE_FAILED}`,
+  `  test -z "$INVALID_ENTRY" || return ${WEB_CONSOLE_TREE_INVALID}`,
+  `  TREE_DIGEST=$(cd -- "$TREE_ROOT" && find . -xdev -type f -print0 | LC_ALL=C sort -z | xargs -0 -r sha256sum -- | sha256sum | awk '{print $1}') || return ${WEB_CONSOLE_TREE_FAILED}`,
+  `  printf '%s' "$TREE_DIGEST"`,
+  "}",
+  'TREE_BEFORE=$(web_tree_sha256 "$ROOT_REAL_BEFORE")',
+  "TREE_STATUS=$?",
+  'test "$TREE_STATUS" -eq 0 || exit "$TREE_STATUS"',
+  'TREE_AFTER=$(web_tree_sha256 "$ROOT_REAL_BEFORE")',
+  "TREE_STATUS=$?",
+  `test "$TREE_STATUS" -eq 0 || exit ${PROBE_CHANGED_DURING_READ}`,
+  "MARKER_AFTER=$ROOT_REAL_BEFORE/.supacloud-component.json",
+  `test ! -L "$MARKER_AFTER" && test -f "$MARKER_AFTER" || exit ${PROBE_CHANGED_DURING_READ}`,
+  `test "$(stat -c '%s' -- "$MARKER_AFTER")" -le ${WEB_CONSOLE_MARKER_MAX_BYTES} || exit ${PROBE_CHANGED_DURING_READ}`,
+  `MARKER_BASE64_AFTER=$(head -c ${WEB_CONSOLE_MARKER_MAX_BYTES + 1} -- "$MARKER_AFTER" | base64 | tr -d '\\n') || exit ${PROBE_CHANGED_DURING_READ}`,
+  `test -d "$ROOT" || exit ${PROBE_CHANGED_DURING_READ}`,
+  `ROOT_REAL_AFTER=$(readlink -f -- "$ROOT") || exit ${PROBE_CHANGED_DURING_READ}`,
+  `ROOT_ID_AFTER=$(stat -c '%d:%i' -- "$ROOT_REAL_AFTER") || exit ${PROBE_CHANGED_DURING_READ}`,
+  `printf '${WEB_ROOT_REAL_BEFORE_LABEL}%s\\n' "$ROOT_REAL_BEFORE"`,
+  `printf '${WEB_ROOT_ID_BEFORE_LABEL}%s\\n' "$ROOT_ID_BEFORE"`,
+  `printf '${WEB_MARKER_BEFORE_LABEL}%s\\n' "$MARKER_BASE64_BEFORE"`,
+  `printf '${WEB_TREE_BEFORE_LABEL}%s\\n' "$TREE_BEFORE"`,
+  `printf '${WEB_TREE_AFTER_LABEL}%s\\n' "$TREE_AFTER"`,
+  `printf '${WEB_MARKER_AFTER_LABEL}%s\\n' "$MARKER_BASE64_AFTER"`,
+  `printf '${WEB_ROOT_REAL_AFTER_LABEL}%s\\n' "$ROOT_REAL_AFTER"`,
+  `printf '${WEB_ROOT_ID_AFTER_LABEL}%s\\n' "$ROOT_ID_AFTER"`
+].join(`
+`);
+var WEB_CONSOLE_PROBE_LABELS = [
+  WEB_ROOT_REAL_BEFORE_LABEL,
+  WEB_ROOT_ID_BEFORE_LABEL,
+  WEB_MARKER_BEFORE_LABEL,
+  WEB_TREE_BEFORE_LABEL,
+  WEB_TREE_AFTER_LABEL,
+  WEB_MARKER_AFTER_LABEL,
+  WEB_ROOT_REAL_AFTER_LABEL,
+  WEB_ROOT_ID_AFTER_LABEL
+];
+function taggedWebConsoleProbeValues(output) {
+  if (output.length > 16384 || /[\r\0]/.test(output))
+    return null;
+  const lines = (output.endsWith(`
+`) ? output.slice(0, -1) : output).split(`
+`);
+  if (lines.length !== WEB_CONSOLE_PROBE_LABELS.length)
+    return null;
+  const probeValues = WEB_CONSOLE_PROBE_LABELS.map((label, index) => taggedProbeValue(lines[index], label));
+  return probeValues.some((probeValue) => probeValue === null) ? null : probeValues;
+}
+function webConsoleConsistencyError(probeValues) {
+  const [rootBefore, rootIdBefore, markerBefore, treeBefore, treeAfter, markerAfter, rootAfter, rootIdAfter] = probeValues;
+  if (rootBefore !== rootAfter || rootIdBefore !== rootIdAfter) {
+    return "web_console_root_changed_during_probe";
+  }
+  if (markerBefore !== markerAfter)
+    return "marker_changed_during_probe";
+  return treeBefore !== treeAfter ? "tree_sha256_changed_during_probe" : null;
+}
+function webConsoleProbeFields(output) {
+  const probeValues = taggedWebConsoleProbeValues(output);
+  if (!probeValues)
+    return null;
+  const [rootBefore, rootIdBefore, markerBefore, treeBefore, , markerAfter, rootAfter, rootIdAfter] = probeValues;
+  const supportedRoot = /^\/opt\/supacloud\/web-console\/(?:current|releases\/[A-Za-z0-9][A-Za-z0-9._-]*)$/;
+  if (![rootBefore, rootAfter].every((root) => supportedRoot.test(root)))
+    return null;
+  if (![rootIdBefore, rootIdAfter].every((rootId) => /^\d+:\d+$/.test(rootId)))
+    return null;
+  const markerOutput = canonicalBase64Text(markerBefore, WEB_CONSOLE_MARKER_MAX_BYTES);
+  if (markerOutput === null || canonicalBase64Text(markerAfter, WEB_CONSOLE_MARKER_MAX_BYTES) === null)
+    return null;
+  const consistencyError = webConsoleConsistencyError(probeValues);
+  return {
+    markerOutput,
+    treeSha256: consistencyError ? null : stableSha256(treeBefore),
+    consistencyError
+  };
+}
+function webConsoleProbeError(execution, fields, version, treeSha256) {
+  if (!execution)
+    return { status: "error", error: "web_console_probe_transport_failed" };
+  if (execution.code === WEB_CONSOLE_ROOT_MISSING)
+    return { status: "unknown", error: "web_console_missing" };
+  if (execution.code === WEB_CONSOLE_MARKER_MISSING)
+    return { status: "unknown", error: "marker_missing" };
+  if (execution.code === PROBE_CHANGED_DURING_READ) {
+    return { status: "error", error: "web_console_changed_during_probe" };
+  }
+  if (execution.code === WEB_CONSOLE_ROOT_INVALID || execution.code === WEB_CONSOLE_TREE_INVALID) {
+    return { status: "error", error: "web_console_invalid_file" };
+  }
+  if (execution.code === WEB_CONSOLE_MARKER_INVALID)
+    return { status: "error", error: "marker_invalid" };
+  if (execution.code === WEB_CONSOLE_TREE_FAILED)
+    return { status: "error", error: "tree_sha256_probe_failed" };
+  if (!execution.success)
+    return { status: "error", error: "web_console_probe_failed" };
+  if (!fields)
+    return { status: "error", error: "web_console_probe_output_invalid" };
+  if (fields.consistencyError)
+    return { status: "error", error: fields.consistencyError };
+  if (!version)
+    return { status: "error", error: "marker_invalid" };
+  return treeSha256 ? { status: "ok", error: null } : { status: "error", error: "tree_sha256_output_invalid" };
+}
+async function webConsoleEvidence(ssh) {
+  const execution = await runFixedRemoteCommand(ssh, WEB_CONSOLE_PROBE_COMMAND, WEB_CONSOLE_PROBE_TIMEOUT_MS);
+  const fields = execution?.success ? webConsoleProbeFields(execution.stdout) : null;
+  const version = fields && !fields.consistencyError ? parseWebConsoleVersion(fields.markerOutput) : null;
+  const treeSha256 = fields?.treeSha256 ?? null;
+  const state = webConsoleProbeError(execution, fields, version, treeSha256);
+  return {
+    status: state.status,
+    version,
+    tree_sha256: treeSha256,
+    path: WEB_CONSOLE_CURRENT_DIR,
+    source: "component_marker_and_tree_sha256",
+    error: state.error
+  };
+}
+async function platformVersions(ssh) {
+  const [managementApi, edgeRuntime, caddy, webConsole] = await Promise.all([
+    binaryComponentEvidence(ssh, BINARY_PROBES.management_api),
+    binaryComponentEvidence(ssh, BINARY_PROBES.edge_runtime),
+    binaryComponentEvidence(ssh, BINARY_PROBES.caddy),
+    webConsoleEvidence(ssh)
+  ]);
+  return {
+    schema_version: 1,
+    components: {
+      management_api: managementApi,
+      edge_runtime: edgeRuntime,
+      caddy,
+      web_console: webConsole
+    }
+  };
+}
 function registerSshTools(server, ssh) {
   server.tool("ssh", `Server management via SSH. Available before & after SupaCloud installation.
-Actions: ping, setup, install, upgrade, diagnose, exec, troubleshoot, container_logs, tenant_manage, tenant_list, tenant_inspect, tenant_diagnose, tenant_migrate`, {
+Actions: ping, setup, install, upgrade, versions, diagnose, exec, troubleshoot, container_logs, tenant_manage, tenant_list, tenant_inspect, tenant_diagnose, tenant_migrate`, {
     action: withDescription(stringEnum([
       "ping",
       "setup",
       "install",
       "upgrade",
+      "versions",
       "diagnose",
       "exec",
       "troubleshoot",
@@ -27806,22 +28247,16 @@ ${result.stderr.slice(-500)}`;
         break;
       }
       case "upgrade": {
-        const version = args.version ? assertSafeReleaseTag(args.version) : undefined;
-        const edgeRuntimeVersion = args.edge_runtime_version ? assertSafeReleaseTag(args.edge_runtime_version) : undefined;
+        const version = args.version ? assertExactStableVersion2(assertSafeReleaseTag(args.version), "version") : undefined;
+        const edgeRuntimeVersion = args.edge_runtime_version ? assertExactStableVersion2(assertSafeReleaseTag(args.edge_runtime_version), "edge_runtime_version") : undefined;
         if (edgeRuntimeVersion && !version) {
           throw new Error("'version' is required with 'edge_runtime_version'");
         }
-        if (edgeRuntimeVersion && version) {
-          assertExactStableVersion2(version, "version");
-          assertExactStableVersion2(edgeRuntimeVersion, "edge_runtime_version");
-        }
         const validatedProxy = args.github_proxy ? assertSafeGithubProxy(args.github_proxy) : undefined;
         if (args.artifact_transport === "local") {
           if (!version || !edgeRuntimeVersion) {
             throw new Error("Local artifact transport requires exact 'version' and 'edge_runtime_version'");
           }
-          assertExactStableVersion2(version, "version");
-          assertExactStableVersion2(edgeRuntimeVersion, "edge_runtime_version");
           if (validatedProxy && !["direct", "none"].includes(validatedProxy.toLowerCase())) {
             throw new Error("Local artifact transport only supports direct GitHub downloads");
           }
@@ -27847,17 +28282,27 @@ ${result.stderr.slice(-500)}`;
 ${upgradeExecution.stdout.slice(-300)}${edgeBoundary}`;
         break;
       }
+      case "versions": {
+        text = JSON.stringify(await platformVersions(ssh), null, 2);
+        break;
+      }
       case "diagnose": {
         const cmds = [
+          "set -o pipefail",
           "echo '=== OS ===' && uname -a",
           "echo '=== Memory ===' && free -h",
           "echo '=== Disk ===' && df -h /",
           "echo '=== Docker ===' && (docker ps --format 'table {{.Names}}\t{{.Status}}' 2>/dev/null || echo 'Not found')",
-          "echo '=== PostgreSQL ===' && (pg_isready 2>/dev/null && echo 'Running' || echo 'Not detected')",
-          "echo '=== Management API ===' && (curl -sf http://localhost:9090/health > /dev/null && echo 'Running' || echo 'Not running')"
+          "echo '=== Management API /health ==='",
+          "(curl --fail --silent --show-error --max-time 5 --max-filesize 4096 http://127.0.0.1:9090/health 2>&1 | head -c 4096) || echo 'Probe failed'",
+          "printf '\\n'",
+          "echo '=== Management API /monitor/health ==='",
+          "(curl --fail --silent --show-error --max-time 15 --max-filesize 16384 http://127.0.0.1:9090/monitor/health 2>&1 | head -c 16384) || echo 'Probe failed'",
+          "printf '\\n'"
         ];
-        const r = await ssh.exec(cmds.join(" && "));
-        text = r.stdout || r.stderr;
+        const r = await ssh.exec(cmds.join(`
+`), 30000);
+        text = redactTenantConfig((r.stdout || r.stderr).slice(0, 32768));
         break;
       }
       case "exec": {
@@ -28692,7 +29137,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.7.12",
+  version: "0.8.0",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",
@@ -28762,6 +29207,7 @@ var sshActionSchema = stringEnum([
   "setup",
   "install",
   "upgrade",
+  "versions",
   "diagnose",
   "exec",
   "troubleshoot",
@@ -28816,6 +29262,7 @@ EXAMPLES
 
   supacloud-admin status
   supacloud-admin ssh ping
+  supacloud-admin ssh versions
   supacloud-admin ssh install --public_domain api.example.com --studio_domain studio.example.com
   supacloud-admin project create --name my-app
   supacloud-admin project list

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.12",
+  "version": "0.8.0",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",