agentplane 0.2.1 → 0.2.3

package/dist/cli/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cli/http.ts"],"names":[],"mappings":"AAOA,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,SAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B7F;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,SAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B5F;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA2Bf"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cli/http.ts"],"names":[],"mappings":"AAQA,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,SAA2B,GACnC,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,SAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,SAAS,SAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/cli/http.js

@@ -1,8 +1,9 @@
 import { writeFile } from "node:fs/promises";
 import { exitCodeForError } from "./exit-codes.js";
 import { CliError } from "../shared/errors.js";
-const DEFAULT_TIMEOUT_MS = 1500;
-export async function fetchJson(url, timeoutMs = DEFAULT_TIMEOUT_MS) {
+const DEFAULT_FETCH_TIMEOUT_MS = 1500;
+const DEFAULT_DOWNLOAD_TIMEOUT_MS = 30_000;
+export async function fetchJson(url, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -32,7 +33,7 @@ export async function fetchJson(url, timeoutMs = DEFAULT_TIMEOUT_MS) {
         clearTimeout(timeout);
     }
 }
-export async function fetchText(url, timeoutMs = DEFAULT_TIMEOUT_MS) {
+export async function fetchText(url, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -62,7 +63,7 @@ export async function fetchText(url, timeoutMs = DEFAULT_TIMEOUT_MS) {
         clearTimeout(timeout);
     }
 }
-export async function downloadToFile(url, destPath, timeoutMs = DEFAULT_TIMEOUT_MS) {
+export async function downloadToFile(url, destPath, timeoutMs = DEFAULT_DOWNLOAD_TIMEOUT_MS) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {

package/dist/commands/upgrade.d.ts

@@ -9,15 +9,37 @@ export type UpgradeFlags = {
     backup: boolean;
     yes: boolean;
 };
+type GitHubRelease = {
+    assets?: {
+        name?: string;
+        browser_download_url?: string;
+    }[];
+    tarball_url?: string;
+};
 export declare function normalizeFrameworkSourceForUpgrade(source: string): {
     source: string;
     owner: string;
     repo: string;
     migrated: boolean;
 };
+export declare function resolveUpgradeDownloadFromRelease(opts: {
+    release: GitHubRelease;
+    owner: string;
+    repo: string;
+    assetName: string;
+    checksumName: string;
+}): {
+    kind: "assets";
+    bundleUrl: string;
+    checksumUrl: string;
+} | {
+    kind: "tarball";
+    tarballUrl: string;
+};
 export declare function cmdUpgradeParsed(opts: {
     cwd: string;
     rootOverride?: string;
     flags: UpgradeFlags;
 }): Promise<number>;
+export {};
 //# sourceMappingURL=upgrade.d.ts.map

package/dist/commands/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAmBF,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB,CAWA;AAkOD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuQlB"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAmBF,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB,CAWA;AAED,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GACG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAqB1C;AAkOD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgSlB"}

package/dist/commands/upgrade.js

@@ -12,6 +12,7 @@ import { CliError } from "../shared/errors.js";
 import { ensureNetworkApproved } from "./shared/network-approval.js";
 const DEFAULT_UPGRADE_ASSET = "agentplane-upgrade.tar.gz";
 const DEFAULT_UPGRADE_CHECKSUM_ASSET = "agentplane-upgrade.tar.gz.sha256";
+const UPGRADE_DOWNLOAD_TIMEOUT_MS = 60_000;
 function parseGitHubRepo(source) {
     const trimmed = source.trim();
     if (!trimmed)
@@ -42,6 +43,27 @@ export function normalizeFrameworkSourceForUpgrade(source) {
     }
     return { source: `https://github.com/${owner}/${repo}`, owner, repo, migrated: false };
 }
+export function resolveUpgradeDownloadFromRelease(opts) {
+    const assets = Array.isArray(opts.release.assets) ? opts.release.assets : [];
+    const asset = assets.find((a) => a?.name === opts.assetName);
+    const checksumAsset = assets.find((a) => a?.name === opts.checksumName);
+    if (asset?.browser_download_url && checksumAsset?.browser_download_url) {
+        return {
+            kind: "assets",
+            bundleUrl: asset.browser_download_url,
+            checksumUrl: checksumAsset.browser_download_url,
+        };
+    }
+    const tarballUrl = typeof opts.release.tarball_url === "string" ? opts.release.tarball_url : "";
+    if (!tarballUrl) {
+        throw new CliError({
+            exitCode: exitCodeForError("E_NETWORK"),
+            code: "E_NETWORK",
+            message: `Upgrade assets not found in ${opts.owner}/${opts.repo} release`,
+        });
+    }
+    return { kind: "tarball", tarballUrl };
+}
 async function resolveUpgradeRoot(extractedDir) {
     const entries = await readdir(extractedDir, { withFileTypes: true });
     const dirs = entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -293,12 +315,15 @@ export async function cmdUpgradeParsed(opts) {
         tempRoot = await mkdtemp(path.join(os.tmpdir(), "agentplane-upgrade-"));
         let bundlePath = "";
         let checksumPath = "";
+        // GitHub release tarballs contain the full repository. When we fall back to tarball_url,
+        // we must ignore non-upgrade paths instead of failing validation.
+        let allowNonUpgradePaths = false;
         if (flags.bundle) {
             const isUrl = flags.bundle.startsWith("http://") || flags.bundle.startsWith("https://");
             bundlePath = isUrl ? path.join(tempRoot, "bundle.tar.gz") : path.resolve(flags.bundle);
             if (isUrl) {
                 await ensureApproved("upgrade downloads the bundle/checksum from the network");
-                await downloadToFile(flags.bundle, bundlePath);
+                await downloadToFile(flags.bundle, bundlePath, UPGRADE_DOWNLOAD_TIMEOUT_MS);
             }
             const checksumValue = flags.checksum ?? "";
             const checksumIsUrl = checksumValue.startsWith("http://") || checksumValue.startsWith("https://");
@@ -307,7 +332,7 @@ export async function cmdUpgradeParsed(opts) {
                 : path.resolve(checksumValue);
             if (checksumIsUrl) {
                 await ensureApproved("upgrade downloads the bundle/checksum from the network");
-                await downloadToFile(checksumValue, checksumPath);
+                await downloadToFile(checksumValue, checksumPath, UPGRADE_DOWNLOAD_TIMEOUT_MS);
             }
         }
         else {
@@ -316,39 +341,47 @@ export async function cmdUpgradeParsed(opts) {
                 ? `https://api.github.com/repos/${owner}/${repo}/releases/tags/${flags.tag}`
                 : `https://api.github.com/repos/${owner}/${repo}/releases/latest`;
             await ensureApproved("upgrade fetches release metadata and downloads assets from the network");
-            const release = (await fetchJson(releaseUrl));
-            const assets = Array.isArray(release.assets) ? release.assets : [];
             const assetName = flags.asset ?? DEFAULT_UPGRADE_ASSET;
             const checksumName = flags.checksumAsset ?? DEFAULT_UPGRADE_CHECKSUM_ASSET;
-            const asset = assets.find((entry) => entry.name === assetName);
-            const checksumAsset = assets.find((entry) => entry.name === checksumName);
-            if (!asset?.browser_download_url || !checksumAsset?.browser_download_url) {
+            const release = (await fetchJson(releaseUrl));
+            const download = resolveUpgradeDownloadFromRelease({
+                release,
+                owner,
+                repo,
+                assetName,
+                checksumName,
+            });
+            if (download.kind === "assets") {
+                bundlePath = path.join(tempRoot, assetName);
+                checksumPath = path.join(tempRoot, checksumName);
+                await downloadToFile(download.bundleUrl, bundlePath, UPGRADE_DOWNLOAD_TIMEOUT_MS);
+                await downloadToFile(download.checksumUrl, checksumPath, UPGRADE_DOWNLOAD_TIMEOUT_MS);
+            }
+            else {
+                process.stderr.write(`${warnMessage(`upgrade release does not include ${assetName}/${checksumName}; falling back to tarball_url without checksum verification`)}\n`);
+                allowNonUpgradePaths = true;
+                bundlePath = path.join(tempRoot, "source.tar.gz");
+                await downloadToFile(download.tarballUrl, bundlePath, UPGRADE_DOWNLOAD_TIMEOUT_MS);
+                checksumPath = "";
+            }
+        }
+        if (checksumPath) {
+            const expected = parseSha256Text(await readFile(checksumPath, "utf8"));
+            if (!expected) {
                 throw new CliError({
-                    exitCode: exitCodeForError("E_NETWORK"),
-                    code: "E_NETWORK",
-                    message: `Upgrade assets not found in ${owner}/${repo} release`,
+                    exitCode: 3,
+                    code: "E_VALIDATION",
+                    message: "Upgrade checksum file is empty or invalid",
+                });
+            }
+            const actual = await sha256File(bundlePath);
+            if (actual !== expected) {
+                throw new CliError({
+                    exitCode: 3,
+                    code: "E_VALIDATION",
+                    message: `Upgrade checksum mismatch (expected ${expected}, got ${actual})`,
                 });
             }
-            bundlePath = path.join(tempRoot, assetName);
-            checksumPath = path.join(tempRoot, checksumName);
-            await downloadToFile(asset.browser_download_url, bundlePath);
-            await downloadToFile(checksumAsset.browser_download_url, checksumPath);
-        }
-        const expected = parseSha256Text(await readFile(checksumPath, "utf8"));
-        if (!expected) {
-            throw new CliError({
-                exitCode: 3,
-                code: "E_VALIDATION",
-                message: "Upgrade checksum file is empty or invalid",
-            });
-        }
-        const actual = await sha256File(bundlePath);
-        if (actual !== expected) {
-            throw new CliError({
-                exitCode: 3,
-                code: "E_VALIDATION",
-                message: `Upgrade checksum mismatch (expected ${expected}, got ${actual})`,
-            });
         }
         extractRoot = await mkdtemp(path.join(os.tmpdir(), "agentplane-upgrade-extract-"));
         await extractArchive({
@@ -387,6 +420,9 @@ export async function cmdUpgradeParsed(opts) {
                 });
             }
             if (!isAllowedUpgradePath(rel)) {
+                if (allowNonUpgradePaths) {
+                    continue;
+                }
                 throw new CliError({
                     exitCode: 3,
                     code: "E_VALIDATION",
@@ -452,6 +488,13 @@ export async function cmdUpgradeParsed(opts) {
                 }
             }
         }
+        if (fileContents.size === 0) {
+            throw new CliError({
+                exitCode: 3,
+                code: "E_VALIDATION",
+                message: "Upgrade bundle contains no applicable files (expected AGENTS.md and/or .agentplane/).",
+            });
+        }
         if (flags.dryRun) {
             process.stdout.write(`Upgrade dry-run: ${additions.length} add, ${updates.length} update, ${skipped.length} unchanged\n`);
             for (const rel of additions)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentplane",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Agent Plane CLI for task workflows, recipes, and project automation.",
   "keywords": [
     "agentplane",
@@ -54,7 +54,7 @@
     "prepublishOnly": "npm run prepack"
   },
   "dependencies": {
-    "@agentplaneorg/core": "0.2.1",
+    "@agentplaneorg/core": "0.2.3",
     "yauzl": "^2.10.0"
   },
   "devDependencies": {