gloomberb 0.3.1 → 0.3.3

package/src/updater.ts

@@ -1,5 +1,6 @@
 import { writeFileSync, renameSync, unlinkSync, chmodSync, realpathSync } from "fs";
 import { basename } from "path";
+import { gunzipSync } from "zlib";
 
 const REPO = "vincelwt/gloomberb";
 const API_URL = `https://api.github.com/repos/${REPO}/releases/latest`;
@@ -10,6 +11,7 @@ export interface ReleaseInfo {
   downloadUrl: string;
   publishedAt: string;
   updateAction: UpdateAction;
+  compressed?: boolean;
 }
 
 export interface UpdateProgress {
@@ -22,6 +24,12 @@ export type UpdateAction =
   | { kind: "self" }
   | { kind: "manual"; command: string };
 
+export type UpdateCheckResult =
+  | { kind: "available"; release: ReleaseInfo }
+  | { kind: "current" }
+  | { kind: "disabled" }
+  | { kind: "error"; error: string };
+
 function compareSemver(a: string, b: string): number {
   const pa = a.split(".").map(Number);
   const pb = b.split(".").map(Number);
@@ -32,13 +40,30 @@ function compareSemver(a: string, b: string): number {
   return 0;
 }
 
-function getAssetName(): string {
+function getAssetBaseName(): string {
   const os = process.platform === "darwin" ? "darwin" : "linux";
   // macOS x64 uses arm64 binary (runs via Rosetta 2)
   const arch = os === "darwin" || process.arch === "arm64" ? "arm64" : "x64";
   return `gloomberb-${os}-${arch}`;
 }
 
+function resolveReleaseAsset(
+  assets: { name: string; browser_download_url: string }[],
+): { name: string; browser_download_url: string; compressed: boolean } | null {
+  const assetBaseName = getAssetBaseName();
+  const gzAsset = assets.find((asset) => asset.name === `${assetBaseName}.gz`);
+  if (gzAsset) {
+    return { ...gzAsset, compressed: true };
+  }
+
+  const rawAsset = assets.find((asset) => asset.name === assetBaseName);
+  if (rawAsset) {
+    return { ...rawAsset, compressed: false };
+  }
+
+  return null;
+}
+
 function normalizePath(value: string): string {
   return value.replace(/\\/g, "/").toLowerCase();
 }
@@ -123,23 +148,27 @@ export function canSelfUpdate(release: Pick<ReleaseInfo, "updateAction"> | null
   return release?.updateAction.kind === "self";
 }
 
-export async function checkForUpdate(
+export async function checkForUpdateDetailed(
   currentVersion: string,
-): Promise<ReleaseInfo | null> {
+): Promise<UpdateCheckResult> {
   const updateAction = detectUpdateAction();
-  if (!updateAction) return null;
+  if (!updateAction) {
+    return { kind: "disabled" };
+  }
 
+  let timeout: ReturnType<typeof setTimeout> | undefined;
   try {
     const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
+    timeout = setTimeout(() => controller.abort(), 5000);
 
     const res = await fetch(API_URL, {
       signal: controller.signal,
       headers: { Accept: "application/vnd.github+json" },
     });
-    clearTimeout(timeout);
 
-    if (!res.ok) return null;
+    if (!res.ok) {
+      return { kind: "error", error: `GitHub returned ${res.status}` };
+    }
 
     const data = (await res.json()) as {
       tag_name: string;
@@ -148,24 +177,49 @@ export async function checkForUpdate(
     };
 
     const version = data.tag_name.replace(/^v/, "");
-    if (compareSemver(version, currentVersion) <= 0) return null;
+    if (compareSemver(version, currentVersion) <= 0) {
+      return { kind: "current" };
+    }
 
-    const assetName = getAssetName();
-    const asset = data.assets.find((a) => a.name === assetName);
-    if (!asset) return null;
+    const asset = resolveReleaseAsset(data.assets);
+    if (!asset) {
+      return {
+        kind: "error",
+        error: `No compatible release asset found for ${getAssetBaseName()}`,
+      };
+    }
 
     return {
-      version,
-      tagName: data.tag_name,
-      downloadUrl: asset.browser_download_url,
-      publishedAt: data.published_at,
-      updateAction,
+      kind: "available",
+      release: {
+        version,
+        tagName: data.tag_name,
+        downloadUrl: asset.browser_download_url,
+        publishedAt: data.published_at,
+        updateAction,
+        compressed: asset.compressed,
+      },
     };
-  } catch {
-    return null;
+  } catch (error: unknown) {
+    if (error instanceof Error && error.name === "AbortError") {
+      return { kind: "error", error: "Update check timed out" };
+    }
+    return {
+      kind: "error",
+      error: error instanceof Error ? error.message : "Update check failed",
+    };
+  } finally {
+    if (timeout) clearTimeout(timeout);
   }
 }
 
+export async function checkForUpdate(
+  currentVersion: string,
+): Promise<ReleaseInfo | null> {
+  const result = await checkForUpdateDetailed(currentVersion);
+  return result.kind === "available" ? result.release : null;
+}
+
 export async function performUpdate(
   release: ReleaseInfo,
   onProgress: (p: UpdateProgress) => void,
@@ -219,7 +273,9 @@ export async function performUpdate(
     // Write to temp file
     const blob = new Blob(chunks);
     const buffer = await blob.arrayBuffer();
-    writeFileSync(updatePath, Buffer.from(buffer));
+    const downloaded = Buffer.from(buffer);
+    const nextBinary = release.compressed ? gunzipSync(downloaded) : downloaded;
+    writeFileSync(updatePath, nextBinary);
     chmodSync(updatePath, 0o755);
 
     // Swap binaries

package/src/utils/api-client.test.ts

@@ -0,0 +1,86 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import type { AuthUser } from "./api-client";
+import { apiClient } from "./api-client";
+
+const originalFetch = globalThis.fetch;
+
+const verifiedUser: AuthUser = {
+  id: "user-1",
+  name: "Test User",
+  email: "test@example.com",
+  username: "test",
+  emailVerified: true,
+  image: null,
+  createdAt: "2026-03-30T00:00:00.000Z",
+  updatedAt: "2026-03-30T00:00:00.000Z",
+};
+
+function createResponse(body: unknown, options: { status?: number; cookies?: string[] } = {}): Response {
+  const headers = {
+    getSetCookie: () => options.cookies ?? [],
+    get: (name: string) => {
+      if (name.toLowerCase() !== "set-cookie") return null;
+      return options.cookies?.[0] ?? null;
+    },
+  } as Headers;
+
+  return {
+    ok: (options.status ?? 200) >= 200 && (options.status ?? 200) < 300,
+    status: options.status ?? 200,
+    headers,
+    text: async () => JSON.stringify(body),
+  } as Response;
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  apiClient.setSessionToken(null);
+  apiClient.setWebSocketToken(null);
+});
+
+describe("apiClient auth cookies", () => {
+  test("captures secure session cookies after login and reuses them on session refresh", async () => {
+    const seenCookies: Array<string | null> = [];
+
+    globalThis.fetch = (async (_input: Request | string | URL, init?: RequestInit) => {
+      const headers = new Headers(init?.headers);
+      seenCookies.push(headers.get("Cookie"));
+
+      if (seenCookies.length === 1) {
+        return createResponse(
+          { token: "ws-token", user: verifiedUser },
+          { cookies: ["__Secure-gloomberb.session_token=signed-token.value; Path=/; HttpOnly; Secure; SameSite=Lax"] },
+        );
+      }
+
+      return createResponse({ user: verifiedUser });
+    }) as typeof fetch;
+
+    await apiClient.signIn("test@example.com", "password");
+    await apiClient.getSession();
+
+    expect(apiClient.getSessionToken()).toBe("signed-token.value");
+    expect(apiClient.getWebSocketToken()).toBe("ws-token");
+    expect(seenCookies).toEqual([
+      null,
+      "__Secure-gloomberb.session_token=signed-token.value",
+    ]);
+  });
+
+  test("replays both supported cookie names when restoring a saved session token", async () => {
+    const seenCookies: Array<string | null> = [];
+    apiClient.setSessionToken("persisted-token.value");
+
+    globalThis.fetch = (async (_input: Request | string | URL, init?: RequestInit) => {
+      const headers = new Headers(init?.headers);
+      seenCookies.push(headers.get("Cookie"));
+      return createResponse({ user: verifiedUser });
+    }) as typeof fetch;
+
+    await apiClient.getSession();
+
+    expect(seenCookies).toEqual([
+      "__Secure-gloomberb.session_token=persisted-token.value; gloomberb.session_token=persisted-token.value",
+    ]);
+  });
+});

package/src/utils/api-client.ts

@@ -3,6 +3,7 @@ import type { InstrumentSearchResult } from "../types/instrument";
 import { debugLog } from "./debug-log";
 
 const DEFAULT_API_URL = "https://api.gloom.sh";
+const SESSION_COOKIE_NAMES = ["__Secure-gloomberb.session_token", "gloomberb.session_token"] as const;
 const cloudApiLog = debugLog.createLogger("cloud-api");
 
 export interface ChatMessage {
@@ -107,6 +108,7 @@ function marketKey(symbol: string, exchange?: string): string {
 
 type ChannelListener = (message: ChatMessage) => void;
 type QuoteListener = (target: QuoteStreamTarget, quote: CloudQuotePayload) => void;
+type SessionCookieName = (typeof SESSION_COOKIE_NAMES)[number];
 
 class ApiRequestError extends Error {
   constructor(message: string, readonly status?: number) {
@@ -117,6 +119,7 @@ class ApiRequestError extends Error {
 
 class GloomApiClient {
   private sessionToken: string | null = null;
+  private sessionCookieName: SessionCookieName | null = null;
   private websocketToken: string | null = null;
   private currentUser: AuthUser | null = null;
   private readonly baseUrl: string;
@@ -142,6 +145,9 @@ class GloomApiClient {
   }
 
   setSessionToken(token: string | null): void {
+    if (this.sessionToken !== token) {
+      this.sessionCookieName = null;
+    }
     this.sessionToken = token;
     if (!token) {
       this.websocketToken = null;
@@ -195,22 +201,41 @@ class GloomApiClient {
 
   private extractSessionCookie(res: Response): void {
     const setCookie = res.headers.getSetCookie?.() ?? [];
+    const fallbackHeader = res.headers.get("set-cookie");
+    if (fallbackHeader) {
+      setCookie.push(fallbackHeader);
+    }
     for (const cookie of setCookie) {
-      const match = cookie.match(/gloomberb\.session_token=([^;]+)/);
-      if (match) {
+      for (const cookieName of SESSION_COOKIE_NAMES) {
+        const escapedCookieName = cookieName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const match = cookie.match(new RegExp(`${escapedCookieName}=([^;]+)`));
+        if (!match) continue;
         this.sessionToken = match[1] ?? null;
+        this.sessionCookieName = cookieName;
+        return;
       }
     }
   }
 
+  private buildSessionCookieHeader(): string | null {
+    if (!this.sessionToken) return null;
+    const cookieNames = this.sessionCookieName ? [this.sessionCookieName] : SESSION_COOKIE_NAMES;
+    return cookieNames.map((cookieName) => `${cookieName}=${this.sessionToken}`).join("; ");
+  }
+
+  private setSessionCookieHeader(headers: Headers): void {
+    const cookieHeader = this.buildSessionCookieHeader();
+    if (cookieHeader) {
+      headers.set("Cookie", cookieHeader);
+    }
+  }
+
   private async request<T>(path: string, options?: RequestInit): Promise<T> {
     const headers = new Headers(options?.headers);
     if (!headers.has("Content-Type") && options?.method && options.method !== "GET") {
       headers.set("Content-Type", "application/json");
     }
-    if (this.sessionToken) {
-      headers.set("Cookie", `gloomberb.session_token=${this.sessionToken}`);
-    }
+    this.setSessionCookieHeader(headers);
     headers.set("Origin", this.baseUrl);
 
     const res = await fetch(`${this.baseUrl}${path}`, {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.3.1";
+export const VERSION = "0.3.3";