bdy 1.24.4 → 1.24.5-dev

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.24.4",
+  "version": "1.24.5-dev",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",

package/distTs/src/command/agent/selftest.js

@@ -5,17 +5,30 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const output_1 = __importDefault(require("../../output"));
 const utils_1 = require("../../utils");
+const sshChannelWindow_1 = require("../../sshChannelWindow");
 // Machine-invoked and hidden, like `agent run`. A freshly downloaded binary is executed
 // with this before it is allowed to replace the installed one (AgentSystem.verifyBinary),
 // so it has to stay hermetic: skipPre keeps out the latest-version fetch and the probe of
 // the running agent, leaving exit 0 to mean exactly one thing - this binary runs here.
 // The version it prints is what tells the caller the archive held the release it asked
-// for; nothing else may be written to stdout.
+// for. Machine-read on both lines, so nothing else may go to stdout.
 const commandAgentSelftest = (0, utils_1.newCommand)('selftest');
 commandAgentSelftest.skipPre = true;
 commandAgentSelftest.action(async () => {
+    // Output.data, not normal: both lines are payload read by a machine, and that is what it is
+    // for - terminal-kit's printf-style formatting would treat a % or ^ in either as markup. It
+    // also keeps the two lines on one writer, so the version cannot end up second.
+    //
     // Not exitNormal(): that exits the moment the write is queued, and stdout is a pipe
     // here, so the version could be lost before it is flushed.
-    output_1.default.normal((0, utils_1.getVersion)());
+    output_1.default.data((0, utils_1.getVersion)());
+    // The window ssh2 will really advertise, measured inside the artifact that ships - see
+    // effectiveChannelWindow(). build.sh fails a release whose binary does not say 8388608,
+    // which is the only check that survives bundling: a rollup bundle has no require.cache,
+    // so the ordering guard in sshChannelWindow.ts cannot see a violation there.
+    //
+    // Printed, not enforced: an agent that would run at ssh2's 2 MB is slower, not broken,
+    // and refusing the update over it would keep a fleet on an older binary for a knob.
+    output_1.default.data(`sshWindow=${(0, sshChannelWindow_1.effectiveChannelWindow)()}`);
 });
 exports.default = commandAgentSelftest;

package/distTs/src/logger.js

@@ -119,6 +119,12 @@ class Logger {
             this.ts = setInterval(() => {
                 this.checkLogSize();
             }, 30000);
+            // A rotation check may never be the reason a process stays up. Without this, every
+            // short-lived command that logs a single line keeps its event loop alive forever -
+            // the ones that end in Output.exitNormal() get away with it, but `agent selftest`
+            // deliberately returns instead of exiting, so the update that runs it read the hang
+            // as 'the downloaded binary does not run on this machine' and gave up.
+            this.ts.unref?.();
         }
         return this.p;
     }

package/distTs/src/sshChannelWindow.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sshChannelWindow = void 0;
+exports.effectiveChannelWindow = exports.requireSsh2 = exports.sshChannelWindow = void 0;
 // The SSH channel window, raised before anything in this process loads ssh2.
 //
 // Throughput over one SSH channel is window/RTT, and ssh2 ships a 2 MB window (lib/Channel.js) that is
@@ -13,10 +13,17 @@ exports.sshChannelWindow = void 0;
 // all (measured: still 11.7 MB/s), which is why this half exists. Past 8 MB the inner SSH becomes the
 // ceiling and there is nothing left to win: 32 MB measured 18.7 MB/s.
 //
+// Those numbers predate the refill below being fixed, when the raise only applied to the first burst
+// and the steady-state window was ssh2's 2 MB whatever this said. With the refill honoured, one channel
+// through raw ssh2 does 15.8 MB/s on 2 MB, 30.0 on 4 MB and 59.0 on 8 MB at 60 ms RTT (7.5, 15.2 and
+// 30.1 at 200 ms) - linear in window/RTT, and 8 MB is where a 200 ms link clears the ~19 MB/s an
+// untunneled sftp does. See worker/src/ssh2.js, which carries the same constant and the full set.
+//
 // Memory: a receive window only becomes resident when the consumer is slower than the sender, bounded
-// by the window per busy channel. On an agent that is a handful of channels on one machine, so there
-// is no knob here - unlike the worker, which multiplies it by every concurrent transfer on an edge and
-// reads SSH_CHANNEL_WINDOW for exactly that reason.
+// by the window per busy channel - measured at 15.6 MB of RSS per SATURATED channel on 8 MB against
+// 9.8 MB on 2 MB. On an agent that is a handful of channels on one machine, so there is no knob here -
+// unlike the worker, which multiplies it by every concurrent transfer on an edge and reads
+// SSH_CHANNEL_WINDOW for exactly that reason.
 const SSH_CHANNEL_WINDOW = 8 * 1024 * 1024;
 // Why a mutation rather than a patched dependency: client.js and server.js read these two constants
 // ONCE, by destructuring lib/Channel.js at module load, so replacing them before ssh2 is first
@@ -27,22 +34,39 @@ const SSH_CHANNEL_WINDOW = 8 * 1024 * 1024;
 // Imported FIRST in src/index.ts, which is the only entry point (bin/cli.js requires it) and already
 // the home of process-wide setup like stream.setDefaultHighWaterMark. Requiring only Channel.js here
 // does not pull in client.js or server.js, so the constants are still unread at this point.
-// What happened, for src/index.ts to log once the logger exists. This module deliberately imports
-// NOTHING - logger pulls in ./utils, and the first import of the process reaching that far could drag
-// ssh2 in with it and silence the very thing being set here.
+//
+// That ordering is not left to whoever edits an import list, though: `requireSsh2` below is the only
+// route to ssh2 in src/, enforced by eslint, so client.js cannot be reached without this module
+// having run first. The check for 'ssh2 is already loaded' is kept for the tsc path, but it is a
+// backstop - in the released bundle there is no require.cache to ask, so it cannot be the thing the
+// guarantee rests on.
+//
+// This module deliberately imports NOTHING - logger pulls in ./utils, and the first import of the
+// process reaching that far could drag ssh2 in with it and silence the very thing being set here.
+// What it found is left on `sshChannelWindow` for src/index.ts to log once the logger exists.
 exports.sshChannelWindow = { bytes: SSH_CHANNEL_WINDOW, applied: false, reason: '' };
 const applyChannelWindow = () => {
     try {
         // If ssh2 is already loaded the constants have been read and this can no longer take effect. It
         // means a new module started importing ssh2 above this line - the symptom would otherwise be
         // nothing but slower uploads.
-        if (Object.keys(require.cache).some((f) => f.includes(`ssh2${'/'}lib${'/'}client.js`))) {
+        //
+        // Only asked where there is a cache to ask: the released binary is a rollup bundle with its own
+        // require shim, where `require.cache` is undefined and reading it threw - which took the window
+        // raise with it in every build we ship (1.24.3 and 1.24.4 both run on ssh2's 2 MB) and, worse,
+        // made src/index.ts log at startup. In a bundle the load order is the one this file sets, so
+        // there is nothing to detect: go straight to the mutation.
+        const cache = require.cache;
+        if (cache &&
+            Object.keys(cache).some((f) => f.includes(`ssh2${'/'}lib${'/'}client.js`))) {
             exports.sshChannelWindow.reason = 'ssh2 was already loaded, so its constants had been read';
             return;
         }
         const channel = require('ssh2/lib/Channel.js');
-        if (typeof channel.MAX_WINDOW !== 'number' || typeof channel.WINDOW_THRESHOLD !== 'number') {
-            exports.sshChannelWindow.reason = 'ssh2 no longer exposes MAX_WINDOW/WINDOW_THRESHOLD';
+        if (typeof channel.MAX_WINDOW !== 'number' ||
+            typeof channel.WINDOW_THRESHOLD !== 'number' ||
+            typeof channel.windowAdjust !== 'function') {
+            exports.sshChannelWindow.reason = 'ssh2 no longer exposes MAX_WINDOW/WINDOW_THRESHOLD/windowAdjust';
             return;
         }
         if (SSH_CHANNEL_WINDOW < channel.MAX_WINDOW) {
@@ -53,6 +77,39 @@ const applyChannelWindow = () => {
         // ssh2 tops the window up once half of it is spent. Left at its own 1 MB it would top up only in
         // the last eighth of an 8 MB window, which is exactly when a fast sender runs dry.
         channel.WINDOW_THRESHOLD = Math.floor(SSH_CHANNEL_WINDOW / 2);
+        // And the refill itself, which is where the two constants above stopped being worth anything.
+        // client.js and server.js destructure `windowAdjust` from here, but the copy inside Channel.js
+        // closes over ITS OWN 2 MB const, so it refilled to 2 MB whatever these two say: measured on a
+        // 60 MB transfer, the window opened at 8 MB and every refill after it was 32 KB back up to 2 MB
+        // - 1665 window-adjust packets where 14 would do, and a steady-state window of 2 MB. So the raise
+        // only ever bought the first burst. Three lines, ssh2's own (Channel.js windowAdjust), with the
+        // window read from here - and, like the constants, it has to be in place before client.js
+        // destructures it. What still tops up to 2 MB is Channel.js's internal call on the drain path;
+        // the next arriving packet brings the window back to full through this one.
+        //
+        // worker/src/ssh2.js holds the same three lines for the edge, and has the same tests: a window
+        // raised on one end alone changes nothing measurable, so an ssh2 bump has to move both.
+        const refill = (self) => {
+            if (self.outgoing.state === 'closed')
+                return;
+            const amt = SSH_CHANNEL_WINDOW - self.incoming.window;
+            if (amt <= 0)
+                return;
+            self.incoming.window += amt;
+            self._client._protocol.channelWindowAdjust(self.outgoing.id, amt);
+        };
+        channel.windowAdjust = refill;
+        // Read back rather than assume. A bundler that hands consumers a copy of these exports, a frozen
+        // module, an ssh2 that redefines them as getters - all of that would leave the three assignments
+        // above doing nothing, and `applied: true` would then be a claim nobody checked. What this still
+        // cannot see is whether client.js had already destructured them; that is what
+        // effectiveChannelWindow() is for, and what the build gate runs on the shipped binary.
+        if (channel.MAX_WINDOW !== SSH_CHANNEL_WINDOW ||
+            channel.WINDOW_THRESHOLD !== Math.floor(SSH_CHANNEL_WINDOW / 2) ||
+            channel.windowAdjust !== refill) {
+            exports.sshChannelWindow.reason = 'ssh2 kept its own constants, the assignment did not take';
+            return;
+        }
         exports.sshChannelWindow.applied = true;
     }
     catch (err) {
@@ -63,4 +120,42 @@ const applyChannelWindow = () => {
     }
 };
 applyChannelWindow();
+// The only route to ssh2 in src/, so the window above is always in place before client.js and
+// server.js destructure the constants - eslint refuses `import ... from 'ssh2'` and `require('ssh2')`
+// everywhere else (type-only imports are fine, they carry no runtime load). Kept lazy on purpose:
+// requiring ssh2 costs ~70 ms of native binding and protocol module loading, and most commands never
+// open a channel - `bdy --version` should not pay for one.
+const requireSsh2 = () => require('ssh2');
+exports.requireSsh2 = requireSsh2;
+// What client.js ACTUALLY captured, which is the only honest answer to "is the window raised". It
+// destructures MAX_WINDOW at module load, so a mutation that arrived late leaves this at ssh2's 2 MB
+// while Channel.js's exports read 8 MB - the shape that shipped in 1.24.3 and 1.24.4 and that no
+// negative check can see in a bundle, where there is no require.cache to consult.
+//
+// Measured, not asserted: openChannel() passes the window it captured to _protocol.session(), so a
+// Client with a stubbed protocol reports it without a socket, a server or any I/O. `agent selftest`
+// prints it and build.sh fails the release if the binary it just built does not say 8388608.
+const effectiveChannelWindow = () => {
+    try {
+        const { Client } = (0, exports.requireSsh2)();
+        const client = new Client();
+        let captured = 0;
+        // The shape ssh2's isWritable() asks for (lib/utils.js), and nothing more - no socket is opened
+        client._sock = { writable: true, _readableState: { ended: false } };
+        client._chanMgr = { add: () => 0 };
+        client._protocol = {
+            session: (_id, window) => {
+                captured = window;
+            },
+        };
+        client.exec('window-probe', () => { });
+        return captured;
+    }
+    catch {
+        // ssh2's internals moved. Nothing here is worth failing a command over - the build gate reads
+        // the number, and 0 is not the number it wants.
+        return 0;
+    }
+};
+exports.effectiveChannelWindow = effectiveChannelWindow;
 exports.default = SSH_CHANNEL_WINDOW;

package/distTs/src/sshKeygen.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSshHostKey = void 0;
+const sshChannelWindow_1 = require("./sshChannelWindow");
 const createSshHostKey = () => {
-    const Ssh2 = require('ssh2');
+    const Ssh2 = (0, sshChannelWindow_1.requireSsh2)();
     const keys = Ssh2.utils.generateKeyPairSync('ed25519', {});
     return keys.private;
 };

package/distTs/src/tunnel/server/sftp.js

@@ -4,13 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = __importDefault(require("../../logger"));
-const ssh2_1 = __importDefault(require("ssh2"));
 const promises_1 = __importDefault(require("fs/promises"));
 const fs_1 = require("fs");
 const path_1 = require("path");
 const node_os_1 = require("node:os");
 const utils_1 = require("../../utils");
-const { STATUS_CODE } = ssh2_1.default.utils.sftp;
+const sshChannelWindow_1 = require("../../sshChannelWindow");
+const ssh2 = (0, sshChannelWindow_1.requireSsh2)();
+const { STATUS_CODE } = ssh2.utils.sftp;
 var SftpOpenFlag;
 (function (SftpOpenFlag) {
     SftpOpenFlag[SftpOpenFlag["READ"] = 1] = "READ";

package/distTs/src/tunnel/server/ssh.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const events_1 = __importDefault(require("events"));
-const ssh2_1 = __importDefault(require("ssh2"));
 const logger_1 = __importDefault(require("../../logger"));
 const crypto_1 = require("crypto");
 const child_process_1 = require("child_process");
@@ -12,6 +11,9 @@ const node_net_1 = __importDefault(require("node:net"));
 const sftp_1 = __importDefault(require("./sftp"));
 const buddy_1 = __importDefault(require("../api/buddy"));
 const utils_1 = require("../../utils");
+const sshChannelWindow_1 = require("../../sshChannelWindow");
+// The window is applied by the module this comes from, so ssh2 cannot be reached before it ran
+const ssh2 = (0, sshChannelWindow_1.requireSsh2)();
 const pipeStreamToChannel = (stream, channel) => {
     channel.once('exit', (code, signal) => {
         logger_1.default.debug(`shell channel exit: ${code}, signal: ${signal}`);
@@ -38,7 +40,7 @@ class ServerSsh extends events_1.default {
         this.agent = agent;
         this.login = login;
         this.password = password;
-        this.server = new ssh2_1.default.Server({
+        this.server = new ssh2.Server({
             hostKeys: [hostKey],
             highWaterMark: 65536,
             ident: 'SSH-2.0-Buddy',
@@ -97,7 +99,7 @@ class ServerSsh extends events_1.default {
             for (let i = 0; i < keys.length; i += 1) {
                 const key = keys[i];
                 const content = key.content ? key.content : key;
-                const publicKey = ssh2_1.default.utils.parseKey(content);
+                const publicKey = ssh2.utils.parseKey(content);
                 if (publicKey instanceof Error) {
                     continue;
                 }
@@ -127,7 +129,7 @@ class ServerSsh extends events_1.default {
     }
     createProxyConnection(privateKey, user) {
         return new Promise((resolve, reject) => {
-            const client = new ssh2_1.default.Client();
+            const client = new ssh2.Client();
             client.once('error', (err) => {
                 client.removeAllListeners();
                 reject(err);

package/distTs/src/tunnel/ssh/client.js

@@ -3,12 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const ssh2_1 = require("ssh2");
 const events_1 = __importDefault(require("events"));
 const logger_1 = __importDefault(require("../../logger"));
 const texts_1 = require("../../texts");
 const utils_1 = require("../../utils");
+const sshChannelWindow_1 = require("../../sshChannelWindow");
 const tunnel_1 = require("../../types/tunnel");
+// Through sshChannelWindow, never straight from 'ssh2': the window is applied when that module is
+// imported, so client.js cannot read the constants before it - the placement of this line has
+// nothing to do with it, imports hoist above it either way. eslint enforces the route.
+const ssh2 = (0, sshChannelWindow_1.requireSsh2)();
 class SshClient extends events_1.default {
     ip;
     port;
@@ -47,7 +51,7 @@ class SshClient extends events_1.default {
     async open() {
         return new Promise((resolve, reject) => {
             this.close();
-            this.client = new ssh2_1.Client();
+            this.client = new ssh2.Client();
             this.client.setNoDelay();
             this.client.on('ready', () => {
                 if (this.client) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.24.4",
+  "version": "1.24.5-dev",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",