@whyvix/remote 0.3.7 → 0.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "private": false,
   "type": "module",
   "files": [

package/packages/agent/src/deployment-manager.js

@@ -24,6 +24,7 @@ export class DeploymentManager{
   this.security=security;this.audit=audit;this.execFileFn=execFileFn;this.transferArtifact=transferArtifact;
  }
  listProfiles(){return [...this.profiles.values()].map(({alias,label="",remoteAlias})=>({alias,label,remoteAlias}));}
+ resolveOperation({profile:profileAlias,operation,commit}){return buildDeploymentOperation(this.#profile(profileAlias),{operation,commit});}
  #profile(alias){const value=String(alias||"");if(!PROFILE_RE.test(value)||!this.profiles.has(value))fail("DEPLOY_PROFILE_DENIED","Deployment profile is not registered");return this.profiles.get(value);}
  async prepareLocal({profile:profileAlias,commit,baseCommit=null}){
   const profile=this.#profile(profileAlias);
@@ -33,8 +34,8 @@ export class DeploymentManager{
   const {stdout:rootRaw}=await this.execFileFn("git",["rev-parse","--show-toplevel"],{cwd:repo,windowsHide:true,maxBuffer:1024*1024});
   const root=this.security.resolveAllowed(rootRaw.trim());
   if(path.resolve(root)!==path.resolve(repo))fail("DEPLOY_PROFILE_DENIED","Deployment repository root does not match profile");
-  const {stdout:status}=await this.execFileFn("git",["status","--porcelain"],{cwd:root,windowsHide:true,maxBuffer:1024*1024});
-  const dirty=status.split(/\r?\n/).filter(Boolean).filter(line=>!line.startsWith("?? .deploy/"));
+  const {stdout:status}=await this.execFileFn("git",["status","--porcelain","--untracked-files=no"],{cwd:root,windowsHide:true,maxBuffer:1024*1024});
+  const dirty=status.split(/\r?\n/).filter(Boolean);
   if(dirty.length)fail("DEPLOY_REPOSITORY_DIRTY","Deployment repository must be clean");
   try{await this.execFileFn("git",["cat-file","-e",commit+"^{commit}"],{cwd:root,windowsHide:true,maxBuffer:1024*1024});}catch{fail("DEPLOY_COMMIT_INVALID","Deployment commit does not exist locally");}
   let dependencyChanged=false;

package/packages/agent/src/deployment-protocol.js

@@ -22,9 +22,9 @@ export function releaseIdFromCommit(commit){
 
 export function buildDeployHelperArgs(input){
  const operation=String(input?.operation||""),commit=String(input?.commit||""),releaseId=releaseIdFromCommit(commit);
- if(!["verify","prepare","status"].includes(operation))fail("DEPLOY_OPERATION_DENIED","Deployment helper operation is not allowed");
+ if(!["verify","prepare","certify","status","activate"].includes(operation))fail("DEPLOY_OPERATION_DENIED","Deployment helper operation is not allowed");
  if(input?.releaseId!==undefined&&String(input.releaseId)!==releaseId)fail("DEPLOY_ARGUMENT_INVALID","Release identity does not match commit");
- if(operation==="status"){if(input?.artifactSha256!==undefined)fail("DEPLOY_ARGUMENT_INVALID","Status does not accept artifact checksum");return Object.freeze([operation,releaseId,commit]);}
+ if(["status","activate","certify"].includes(operation)){if(input?.artifactSha256!==undefined)fail("DEPLOY_ARGUMENT_INVALID",operation+" does not accept artifact checksum");return Object.freeze([operation,releaseId,commit]);}
  const artifactSha256=String(input?.artifactSha256||"");if(!HASH_RE.test(artifactSha256))fail("DEPLOY_CHECKSUM_INVALID","Artifact SHA-256 is required");
  return Object.freeze([operation,releaseId,commit,artifactSha256]);
 }

package/packages/agent/src/remote-execution-manager.js

@@ -11,6 +11,11 @@ function classifySshFailure(state,code){
  if(text.includes("permission denied")||text.includes("authentication failed")||text.includes("no supported authentication methods available"))return "REMOTE_AUTH_FAILED";
  return state.errorCode||"REMOTE_EXEC_FAILED";
 }
+function quoteRemoteArg(value){
+ const text=String(value);
+ return "'" + text.replaceAll("'", "'\"'\"'") + "'";
+}
+function serializeRemoteCommand(argv){return argv.map(quoteRemoteArg).join(" ");}
 function appendBounded(state,key,chunk,maxBytes){
  const current=Buffer.from(state[key],"utf8"),incoming=Buffer.from(chunk);
  const room=Math.max(0,maxBytes-current.length);
@@ -52,7 +57,7 @@ export class RemoteExecutionManager {
   for(const state of this.jobs.values())if(state.running)runningJobs++;
   if(runningJobs>=this.maxRunningJobs)fail("REMOTE_JOB_LIMIT","Remote running job limit reached");
   const target=this.#target(alias),remoteArgv=allowDeployHelper?["whyvix-deploy",...args]:this.#argv(executable,args),timeout=Math.max(1,Math.min(Number(timeoutMs)||30000,300000)),id=String(this.nextId++);
-  const sshArgs=["--",target.alias,...remoteArgv],child=this.spawnFn("ssh",sshArgs,{windowsHide:true,shell:false});
+  const sshArgs=["--",target.alias,serializeRemoteCommand(remoteArgv)],child=this.spawnFn("ssh",sshArgs,{windowsHide:true,shell:false});
   const state={id,ownerId:String(ownerId),alias:target.alias,executable,stdout:"",stderr:"",truncated:false,running:true,exitCode:null,child};this.jobs.set(id,state);this.audit({event:"remote.start",id,alias:state.alias,executable});
   child.stdout?.on("data",x=>appendBounded(state,"stdout",x,this.maxOutputBytes));child.stderr?.on("data",x=>appendBounded(state,"stderr",x,this.maxOutputBytes));
   const finish=()=>{if(state.timer){clearTimeout(state.timer);state.timer=null;}};

package/packages/agent/src/tools.js

@@ -116,6 +116,7 @@ export function createToolExecutor({ security, processManager, remoteExecutionMa
     if(tool==="remote.targets"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return{targets:remoteExecutionManager.listTargets()};}
     if(tool==="remote.start"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return remoteExecutionManager.start(args);}
     if(tool==="remote.deploy_status"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return remoteExecutionManager.startDeployHelper({alias:args.alias,input:{operation:"status",commit:args.commit},timeoutMs:args.timeoutMs,ownerId:args.ownerId});}
+    if(tool==="deploy.status_release"||tool==="deploy.certify_release"||tool==="deploy.activate_release"){if(!remoteExecutionManager||!deploymentManager)throw Object.assign(new Error("Deployment authority is not configured"),{code:"DEPLOY_PROFILE_DENIED"});const operation=tool==="deploy.status_release"?"status":tool==="deploy.certify_release"?"certify":"activate",resolved=deploymentManager.resolveOperation({profile:args.profile,operation,commit:args.commit});return remoteExecutionManager.startDeployHelper({alias:resolved.remoteAlias,input:{operation,commit:resolved.commit},timeoutMs:args.timeoutMs,ownerId:args.ownerId});}
     if(tool==="remote.output"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.output(args);}
     if(tool==="remote.input"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.input(args);}
     if(tool==="remote.stop"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.stop(args);}