@supacloud/admin 0.7.5 → 0.7.7

package/dist/index.js

@@ -25096,6 +25096,11 @@ class SshConnectionPool {
       } catch {}
     }
   }
+  discard(conn) {
+    try {
+      conn.end();
+    } catch {}
+  }
   closeAll() {
     for (const conn of this.pool) {
       try {
@@ -25130,13 +25135,15 @@ class SshTransport {
     }
     auditCommand(command, this.config.host, false);
     const conn = await this.pool.acquire();
+    let connectionReusable = true;
     try {
       return await new Promise((resolve, reject) => {
         const outputLimit = this.config.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
         const stdout = new BoundedOutputCollector(outputLimit);
         const stderr = new BoundedOutputCollector(outputLimit);
         const timer = setTimeout(() => {
-          conn.end();
+          connectionReusable = false;
+          this.pool.discard(conn);
           reject(new Error(`SSH command timed out after ${timeoutMs}ms`));
         }, timeoutMs);
         conn.exec(command, (err, stream) => {
@@ -25162,7 +25169,8 @@ class SshTransport {
         });
       });
     } finally {
-      this.pool.release(conn);
+      if (connectionReusable)
+        this.pool.release(conn);
     }
   }
   async upload(localPath, remotePath) {
@@ -25622,10 +25630,28 @@ SUPACLOUD_GITHUB_REPOSITORY="\${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supaclou
 SUPACLOUD_RELEASES_API="\${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/releases}"
 SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="\${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-\${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"
 SUPACLOUD_GH_VERSION="\${SUPACLOUD_GH_VERSION:-2.96.0}"
-SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.51.0}"
+SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"
 SUPACLOUD_GH_AMD64_SHA256="\${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"
 SUPACLOUD_GH_ARM64_SHA256="\${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"
 
+supacloud_curl_release_json() {
+    local url="$1"
+    local output="$2"
+    curl -fsSL --proto '=https' --proto-redir '=https' \\
+        --retry 1 --retry-delay 2 --retry-max-time 60 \\
+        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\
+        -o "$output" "$url"
+}
+
+supacloud_curl_release_asset() {
+    local url="$1"
+    local output="$2"
+    curl -fL --proto '=https' --proto-redir '=https' \\
+        --retry 1 --retry-delay 2 --retry-max-time 180 \\
+        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\
+        -o "$output" "$url"
+}
+
 supacloud_component_tag() {
     local component="$1"
     local version="$2"
@@ -25691,18 +25717,15 @@ supacloud_fetch_component_release() {
     supacloud_select_release "$component" "\${required_assets[@]}" <<< "$response"
 }
 
-supacloud_fetch_release_json() {
+supacloud_fetch_release_json() (
     local url="$1"
-    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
-    if curl -fsSL --retry 3 --connect-timeout 15 "$url"; then
-        return 0
-    fi
-    if [[ -n "$proxy" ]]; then
-        curl -fsSL --retry 3 --connect-timeout 15 "\${proxy%/}/\${url}"
-        return
-    fi
-    return 1
-}
+    local response_file
+    response_file=$(mktemp) || return 1
+    trap 'rm -f "$response_file"' EXIT
+    trap 'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1' HUP INT TERM
+    supacloud_download_release_metadata_url "$url" "$response_file" || return 1
+    cat "$response_file"
+)
 
 supacloud_release_asset_url() {
     local release_json="$1"
@@ -25718,11 +25741,26 @@ supacloud_download_url() {
     local output="$2"
     local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
 
-    if curl -fL --retry 3 --connect-timeout 15 -o "$output" "$url"; then
+    if supacloud_curl_release_asset "$url" "$output"; then
+        return 0
+    fi
+    if [[ -n "$proxy" ]]; then
+        supacloud_curl_release_asset "\${proxy%/}/\${url}" "$output"
+        return
+    fi
+    return 1
+}
+
+supacloud_download_release_metadata_url() {
+    local url="$1"
+    local output="$2"
+    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
+
+    if supacloud_curl_release_json "$url" "$output"; then
         return 0
     fi
     if [[ -n "$proxy" ]]; then
-        curl -fL --retry 3 --connect-timeout 15 -o "$output" "\${proxy%/}/\${url}"
+        supacloud_curl_release_json "\${proxy%/}/\${url}" "$output"
         return
     fi
     return 1
@@ -25803,7 +25841,8 @@ supacloud_install_pinned_tar_xz_binary() (
     fi
 
     extract_dir=$(mktemp -d)
-    trap 'rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"' EXIT HUP INT TERM
+    trap 'rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"' EXIT
+    trap 'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"; exit 1' HUP INT TERM
     if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then
         return 1
     fi
@@ -25992,7 +26031,8 @@ supacloud_verify_attestation() (
         if ! verification_output=$(gh attestation verify "$artifact_file" \\
             --bundle "$bundle_file" \\
             --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
-            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" 2>&1); then
+            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\
+            --source-ref "refs/heads/main" 2>&1); then
             echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
             return 1
         fi
@@ -26011,12 +26051,15 @@ supacloud_verify_attestation() (
 )
 
 supacloud_attestation_verifier_available() {
-    local version
+    local version help
     command -v gh >/dev/null 2>&1 || return 1
     version=$(supacloud_gh_version)
     [[ -n "$version" ]] || return 1
     supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1
-    gh attestation verify --help 2>&1 | grep -q -- '--signer-workflow'
+    help=$(gh attestation verify --help 2>&1) || return 1
+    grep -Eq -- '(^|[[:space:]])--bundle([=[:space:]]|$)' <<< "$help" || return 1
+    grep -Eq -- '(^|[[:space:]])--signer-workflow([=[:space:]]|$)' <<< "$help" || return 1
+    grep -Eq -- '(^|[[:space:]])--source-ref([=[:space:]]|$)' <<< "$help"
 }
 
 supacloud_download_release_asset() (
@@ -26031,10 +26074,11 @@ supacloud_download_release_asset() (
     mkdir -p "$(dirname "$destination")"
     temporary_artifact=$(mktemp "\${destination}.tmp.XXXXXX")
     temporary_checksums=$(mktemp "\${destination}.SHA256SUMS.tmp.XXXXXX")
-    trap 'rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"' EXIT HUP INT TERM
+    trap 'rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"' EXIT
+    trap 'trap - EXIT HUP INT TERM; rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"; exit 1' HUP INT TERM
 
     if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\
-        || ! supacloud_download_url "$checksum_url" "$temporary_checksums" \\
+        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\
         || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then
         rm -f "$temporary_artifact" "$temporary_checksums"
         return 1
@@ -26076,6 +26120,8 @@ var SAFE_HOSTNAME = /^(?=.{1,253}$)(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9
 var SAFE_SYSTEMD_UNIT = /^[a-zA-Z0-9][a-zA-Z0-9_.@:-]{0,127}$/;
 var SAFE_DB_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_-]{0,62}$/;
 var MINIMUM_COMPONENT_UPGRADE_VERSION = "0.50.27";
+var DIRECT_UPGRADE_SSH_TIMEOUT_MS = 720000;
+var PROXIED_UPGRADE_SSH_TIMEOUT_MS = 1320000;
 function hostnameSchema(fieldName) {
   return decodedSchema(Type.String(), Type.String({ minLength: 1, maxLength: 253 }), (value) => {
     const normalized = value.trim();
@@ -26171,6 +26217,12 @@ function componentPreflightCommands(request) {
     `test "$EDGE_RUNTIME_MODE_VALUE" = external || { echo 'Edge Runtime component upgrade supports persisted external mode only' >&2; exit 1; }`
   ] : [];
 }
+function signalSafeCleanupTraps(cleanupCommand) {
+  return [
+    `trap '${cleanupCommand}' EXIT`,
+    `trap 'trap - EXIT HUP INT TERM; ${cleanupCommand}; exit 1' HUP INT TERM`
+  ];
+}
 function buildRootUpgradeScript(request) {
   const envAssignments = upgradeEnvAssignments(request);
   return [
@@ -26179,12 +26231,12 @@ function buildRootUpgradeScript(request) {
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     "export PATH",
     "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
-    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY",
+    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
     'for tool in curl jq file sha256sum tar; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
     ...componentPreflightCommands(request),
     "STAGED_MANAGEMENT=''",
-    `trap 'test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"' EXIT HUP INT TERM`,
+    ...signalSafeCleanupTraps('test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"'),
     `source ${quoteEnvValue(request.helperPath)}`,
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
@@ -26195,7 +26247,11 @@ function buildRootUpgradeScript(request) {
 }
 function buildOfficialUpgradeCommand(request) {
   const rootScript = buildRootUpgradeScript(request);
-  return `set -e; trap 'rm -f ${request.helperPath}' EXIT HUP INT TERM; ` + 'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`;
+  return [
+    "set -e",
+    ...signalSafeCleanupTraps(`rm -f ${request.helperPath}`),
+    'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`
+  ].join("; ");
 }
 async function removeRemoteUpgradeHelper(ssh, helperPath) {
   const cleanup = await ssh.exec(`rm -f ${quoteEnvValue(helperPath)}`);
@@ -26224,12 +26280,12 @@ function officialUpgradeOutcome(execution, executionError, cleanupError) {
     throw remoteUpgradeFailure(execution);
   return execution;
 }
-async function executeOfficialUpgrade(ssh, helperPath, command) {
+async function executeOfficialUpgrade(ssh, helperPath, command, timeoutMs) {
   let execution;
   let executionError;
   try {
     await ssh.uploadText(helperPath, release_assets_default, 384);
-    execution = await ssh.exec(command, 600000);
+    execution = await ssh.exec(command, timeoutMs);
   } catch (error) {
     executionError = error;
   }
@@ -26544,7 +26600,8 @@ ${result.stderr.slice(-500)}`;
           githubProxy,
           helperPath
         });
-        const upgradeExecution = await executeOfficialUpgrade(ssh, helperPath, cmd);
+        const upgradeTimeoutMs = githubProxy ? PROXIED_UPGRADE_SSH_TIMEOUT_MS : DIRECT_UPGRADE_SSH_TIMEOUT_MS;
+        const upgradeExecution = await executeOfficialUpgrade(ssh, helperPath, cmd, upgradeTimeoutMs);
         const edgeBoundary = edgeRuntimeVersion ? "" : `
 ⚠️ Edge Runtime was not upgraded; provide --edge_runtime_version for a component transaction.`;
         text = `✅ Upgrade done

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",