@supacloud/admin 0.7.8 → 0.7.10

package/dist/index.js

@@ -25215,7 +25215,10 @@ class SshTransport {
     let connectionReusable = true;
     let timeoutHandle;
     try {
-      const operationPromise = openSftp(conn).then(operation);
+      const operationPromise = openSftp(conn).then(async (sftp) => {
+        await operation(sftp);
+        sftp.end();
+      });
       await Promise.race([
         operationPromise,
         new Promise((_resolve, reject) => {
@@ -26396,6 +26399,7 @@ async function prepareLocalUpgradeBundle(request) {
 var REMOTE_STAGE_ROOT = "/var/lib/supacloud/upgrade-staging";
 var REMOTE_RUN_ROOT = "/var/lib/supacloud/upgrade-runs";
 var REMOTE_LOG_ROOT = "/var/log/supacloud";
+var REMOTE_UPLOAD_ROOT = "/var/tmp";
 var POLL_INTERVAL_MS = 2000;
 var STATE_READ_ATTEMPTS = 3;
 var REMOTE_STATE_READ_TIMEOUT_MS = 15000;
@@ -26430,9 +26434,9 @@ function trustedInstalledGithubFunction() {
   ].join(`
 `);
 }
-function remotePaths(runId) {
+function buildRemoteUpgradePaths(runId) {
   return {
-    drop: `/tmp/.supacloud-upgrade-upload-${runId}`,
+    drop: `${REMOTE_UPLOAD_ROOT}/.supacloud-upgrade-upload-${runId}`,
     stage: `${REMOTE_STAGE_ROOT}/${runId}`,
     status: `${REMOTE_RUN_ROOT}/${runId}.status`,
     log: `${REMOTE_LOG_ROOT}/upgrade-${runId}.log`,
@@ -26489,9 +26493,19 @@ function requiredRemoteBytes(bundle) {
   const transferBytes = [...bundle.files, ...bundle.verifierArchive ? [bundle.verifierArchive] : []].reduce((total, upload) => total + upload.size, 0);
   return transferBytes * 3 + 512 * 1024 * 1024;
 }
-function prepareDropCommand(paths, bundle) {
+function remoteUploadRootGate() {
+  return [
+    `UPLOAD_ROOT=${quoteShell2(REMOTE_UPLOAD_ROOT)}`,
+    `test -d "$UPLOAD_ROOT" && test ! -L "$UPLOAD_ROOT" || { echo 'Remote upload root must be a directory, not a symlink' >&2; exit 1; }`,
+    `test "$(stat -c '%u' "$UPLOAD_ROOT")" = 0 || { echo 'Remote upload root must be owned by root' >&2; exit 1; }`,
+    `UPLOAD_ROOT_MODE=$(stat -c '%a' "$UPLOAD_ROOT")`,
+    `case "$UPLOAD_ROOT_MODE" in [0-7]|[0-7][0-7]|[0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) ;; *) echo 'Remote upload root has invalid permission bits' >&2; exit 1 ;; esac`,
+    "(( (8#$UPLOAD_ROOT_MODE & 01000) != 0 )) || { echo 'Remote upload root must set the sticky bit' >&2; exit 1; }",
+    `test -w "$UPLOAD_ROOT" && test -x "$UPLOAD_ROOT" || { echo 'Remote upload root is not writable and searchable by the SSH user' >&2; exit 1; }`
+  ];
+}
+function buildPrepareDropCommand(paths, bundle) {
   const directories = [
-    paths.drop,
     `${paths.drop}/bundle`,
     `${paths.drop}/bundle/management-api`,
     `${paths.drop}/bundle/edge-runtime`
@@ -26502,16 +26516,18 @@ function prepareDropCommand(paths, bundle) {
   return [
     "set -euo pipefail",
     "umask 077",
-    `test ! -e ${quoteShell2(paths.drop)} || { echo 'Remote upload drop already exists' >&2; exit 1; }`,
-    "TMP_AVAILABLE_KB=$(df -Pk /tmp | awk 'NR == 2 { print $4 }')",
+    ...remoteUploadRootGate(),
+    `DROP=${quoteShell2(paths.drop)}`,
+    `UPLOAD_AVAILABLE_KB=$(df -Pk "$UPLOAD_ROOT" | awk 'NR == 2 { print $4 }')`,
     "VAR_AVAILABLE_KB=$(df -Pk /var/lib/supacloud | awk 'NR == 2 { print $4 }')",
-    `test "${"$"}TMP_AVAILABLE_KB" -ge ${Math.ceil(requiredBytes / 1024)} && test "${"$"}VAR_AVAILABLE_KB" -ge ${Math.ceil(requiredBytes / 1024)} || { echo 'Insufficient remote disk space for verified upgrade staging' >&2; exit 1; }`,
+    `test "${"$"}UPLOAD_AVAILABLE_KB" -ge ${Math.ceil(requiredBytes / 1024)} && test "${"$"}VAR_AVAILABLE_KB" -ge ${Math.ceil(requiredBytes / 1024)} || { echo 'Insufficient remote disk space for verified upgrade staging' >&2; exit 1; }`,
+    `mkdir -m 700 -- "$DROP" || { echo 'Unable to create exclusive remote upload drop' >&2; exit 1; }`,
     `install -d -m 700 ${directories.map(quoteShell2).join(" ")}`
   ].join(`
 `);
 }
 async function prepareRemoteDrop(ssh, paths, bundle) {
-  const prepared = await ssh.exec(prepareDropCommand(paths, bundle), 30000);
+  const prepared = await ssh.exec(buildPrepareDropCommand(paths, bundle), 30000);
   if (!prepared.success)
     throw remoteFailure("Unable to prepare remote upload drop", prepared);
 }
@@ -26716,7 +26732,10 @@ function buildAdoptDropScript(paths) {
     "trap 'exit 130' INT",
     "trap 'exit 143' TERM",
     `install -d -o root -g root -m 700 ${quoteShell2(REMOTE_STAGE_ROOT)} ${quoteShell2(REMOTE_RUN_ROOT)} ${quoteShell2(REMOTE_LOG_ROOT)}`,
-    'test ! -e "$STAGE" && test ! -e "$STATUS" && test ! -e "$LOG"',
+    'if [ -e "$STAGE" ] || [ -L "$STAGE" ] || [ -e "$STATUS" ] || [ -L "$STATUS" ] || [ -e "$LOG" ] || [ -L "$LOG" ]; then',
+    "  echo 'Upgrade adoption target already exists' >&2",
+    "  exit 1",
+    "fi",
     `systemctl status "$UNIT" >/dev/null 2>&1 && { echo 'Upgrade unit already exists' >&2; exit 1; } || true`,
     "ADOPTION_ACTIVE=true",
     'mv "$DROP" "$STAGE"',
@@ -26793,7 +26812,7 @@ async function startRemoteUpgrade(ssh, paths) {
   }
   throw startFailure;
 }
-function readStateScript(paths) {
+function buildRemoteStateScript(paths) {
   return [
     "set -euo pipefail",
     `DROP=${quoteShell2(paths.drop)}`,
@@ -26803,11 +26822,11 @@ function readStateScript(paths) {
     `UNIT=${quoteShell2(paths.unit)}`,
     `printf 'STATUS=%s\\n' "$(sed -n '1p' "$STATUS" 2>/dev/null || true)"`,
     `printf 'UNIT=%s\\n' "$(systemctl is-active "$UNIT" 2>/dev/null || true)"`,
-    'if [ -e "$STAGE" ]; then echo STAGE_EXISTS=yes; else echo STAGE_EXISTS=no; fi',
+    'if [ -e "$STAGE" ] || [ -L "$STAGE" ]; then echo STAGE_EXISTS=yes; else echo STAGE_EXISTS=no; fi',
     'if [ -d "$STAGE" ] && [ ! -L "$STAGE" ]; then echo STAGE_DIRECTORY=yes; else echo STAGE_DIRECTORY=no; fi',
-    'if [ -e "$DROP" ]; then echo DROP_EXISTS=yes; else echo DROP_EXISTS=no; fi',
-    'if [ -e "$STATUS" ]; then echo STATUS_EXISTS=yes; else echo STATUS_EXISTS=no; fi',
-    'if [ -e "$LOG" ]; then echo LOG_EXISTS=yes; else echo LOG_EXISTS=no; fi',
+    'if [ -e "$DROP" ] || [ -L "$DROP" ]; then echo DROP_EXISTS=yes; else echo DROP_EXISTS=no; fi',
+    'if [ -e "$STATUS" ] || [ -L "$STATUS" ]; then echo STATUS_EXISTS=yes; else echo STATUS_EXISTS=no; fi',
+    'if [ -e "$LOG" ] || [ -L "$LOG" ]; then echo LOG_EXISTS=yes; else echo LOG_EXISTS=no; fi',
     'UNIT_LOAD_STATE=$(systemctl show --property=LoadState --value "$UNIT" 2>/dev/null || true)',
     `test -n "$UNIT_LOAD_STATE" || { echo 'Unable to read remote upgrade unit load state' >&2; exit 1; }`,
     `printf 'UNIT_LOAD=%s\\n' "$UNIT_LOAD_STATE"`,
@@ -26829,7 +26848,7 @@ function remoteStatePresence(output, field) {
   return presence === "yes";
 }
 async function readRemoteState(ssh, paths, timeoutMs = REMOTE_STATE_READ_TIMEOUT_MS) {
-  const state = await ssh.exec(rootCommand(readStateScript(paths)), timeoutMs);
+  const state = await ssh.exec(rootCommand(buildRemoteStateScript(paths)), timeoutMs);
   if (!state.success)
     throw remoteFailure("Unable to read remote upgrade state", state);
   return {
@@ -26918,6 +26937,9 @@ function remoteEvidence(paths) {
 function remoteReconciliationFailure(message, failures, paths) {
   return new RemoteUpgradeReconciliationError(failures.map((failure) => operationError(failure, message)), `${message}; reconcile remote evidence at ${remoteEvidence(paths)}; do not retry blindly`);
 }
+function buildUploadDropCleanupFailure(transferFailure, cleanupFailure, paths) {
+  return remoteReconciliationFailure("Local upgrade failed and upload-drop cleanup did not complete", [transferFailure, cleanupFailure], paths);
+}
 function failureRequiresRemoteReconciliation(error) {
   return error instanceof RemoteUpgradeReconciliationError;
 }
@@ -26938,6 +26960,14 @@ function assertSuccessfulUnitStoppedNormally(state, paths) {
     return;
   throw remoteReconciliationFailure(`Remote upgrade published SUCCEEDED but the unit stopped abnormally or ambiguously ` + `(state=${state.serviceState} load=${state.unitLoadState})`, [], paths);
 }
+function failedUnitReachedTerminalState(state) {
+  return unitStoppedNormally(state) || state.serviceState === "failed" && state.unitLoadState === "loaded";
+}
+function assertFailedUnitReachedTerminalState(state, paths) {
+  if (failedUnitReachedTerminalState(state))
+    return;
+  throw remoteReconciliationFailure(`Remote upgrade published FAILED but the unit state is ambiguous ` + `(state=${state.serviceState} load=${state.unitLoadState})`, [], paths);
+}
 function assertTerminalEvidence(state, paths) {
   if (state.status !== "SUCCEEDED" && !state.status.startsWith("FAILED:"))
     return;
@@ -27015,6 +27045,7 @@ async function awaitRemoteUpgrade(ssh, paths) {
       return await completedUpgradeOutput(ssh, paths);
     }
     if (state.status.startsWith("FAILED:") && !unitRunning) {
+      assertFailedUnitReachedTerminalState(state, paths);
       await throwRemoteUpgradeFailure(ssh, paths, state.status);
     }
     if (Date.now() >= observationDeadline) {
@@ -27033,7 +27064,7 @@ async function awaitRemoteUpgrade(ssh, paths) {
 }
 async function executeLocalUpgradeTransfer(ssh, request) {
   const runId = randomUUID3();
-  const paths = remotePaths(runId);
+  const paths = buildRemoteUpgradePaths(runId);
   const preflight = await remoteUpgradePreflight(ssh);
   const bundle = await prepareLocalUpgradeBundle({ ...preflight, ...request });
   let adopted = false;
@@ -27053,7 +27084,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
         try {
           await cleanupRemoteDrop(ssh, paths);
         } catch (cleanupError) {
-          transferError = new AggregateError([transferError, cleanupError], "Local upgrade failed and upload-drop cleanup did not complete");
+          transferError = buildUploadDropCleanupFailure(transferError, cleanupError, paths);
         }
       }
       throw transferError;
@@ -28949,7 +28980,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.7.8",
+  version: "0.7.10",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",