herdr-remote 0.2.15 → 0.2.17

package/src/updater.js

@@ -57,6 +57,11 @@ function installKind() {
   return 'npm';
 }
 
+/** `HERDR_REMOTE_UPDATE_CHECK=0` turns the automatic checks off (offline machines, tests). */
+function updateChecksEnabled(env = process.env) {
+  return env.HERDR_REMOTE_UPDATE_CHECK !== '0';
+}
+
 function canSelfUpdate() {
   return installKind() === 'npm';
 }
@@ -130,20 +135,17 @@ function compareVersions(a, b) {
   return 0;
 }
 
-/** One registry, one question: what is the latest published version? */
-async function askRegistry(registry, { timeoutMs, fetchImpl }) {
+/** One JSON request with a deadline. Never throws. */
+async function fetchJson(url, { timeoutMs, fetchImpl }) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetchImpl(`${registry}/${PACKAGE_NAME}/latest`, {
+    const response = await fetchImpl(url, {
       signal: controller.signal,
-      headers: { Accept: 'application/vnd.npm.install-v1+json' },
+      headers: { Accept: 'application/json', 'Cache-Control': 'no-cache' },
     });
     if (!response.ok) return { ok: false, message: `HTTP ${response.status ?? '?'}` };
-    const body = await response.json();
-    const latest = typeof body?.version === 'string' ? body.version : null;
-    if (!latest) return { ok: false, message: 'registry answered without a version' };
-    return { ok: true, latest };
+    return { ok: true, body: await response.json() };
   } catch (error) {
     return { ok: false, message: error?.name === 'AbortError' ? 'timed out' : String(error?.message || error) };
   } finally {
@@ -151,13 +153,45 @@ async function askRegistry(registry, { timeoutMs, fetchImpl }) {
   }
 }
 
+/**
+ * One registry, one question: what is the latest published version?
+ *
+ * The dist-tags endpoint first: a few bytes, answered fresh by npmjs and
+ * npmmirror alike. `/<package>/latest` is the fallback for registries without
+ * it, asked for plain JSON. It used to be asked for npm's abbreviated install
+ * format, which npmjs refuses on that path with a 406, so every check quietly
+ * fell through to a mirror that had not synced the release yet.
+ */
+async function askRegistry(registry, { timeoutMs, fetchImpl }) {
+  const endpoints = [
+    { url: `${registry}/-/package/${PACKAGE_NAME}/dist-tags`, read: (body) => body?.latest },
+    { url: `${registry}/${PACKAGE_NAME}/latest`, read: (body) => body?.version },
+  ];
+  let message = null;
+  for (const endpoint of endpoints) {
+    const attempt = await fetchJson(endpoint.url, { timeoutMs, fetchImpl });
+    if (!attempt.ok) {
+      message = attempt.message;
+      continue;
+    }
+    const latest = endpoint.read(attempt.body);
+    if (typeof latest === 'string' && latest) return { ok: true, latest };
+    message = 'registry answered without a version';
+  }
+  return { ok: false, message };
+}
+
 /**
  * Ask what the current release is.
  *
  * Never throws: an update check is a convenience, and a machine that is offline
- * or behind a proxy should still get a working settings screen. Each configured
- * registry is tried in turn, because the first one is only a guess at which
- * mirror this machine can actually reach.
+ * or behind a proxy should still get a working settings screen.
+ *
+ * Every registry is asked at once and the newest answer wins. Taking the first
+ * answer let a mirror a few minutes (or hours) behind report the release before
+ * last as current. `sources` lists the registries that already carry the
+ * newest version, preferred order first, which is where an install should come
+ * from; `behind` lists the ones that do not, so the screen can say why.
  */
 async function checkForUpdate({
   timeoutMs = 6000,
@@ -165,77 +199,182 @@ async function checkForUpdate({
   registries = registryCandidates(),
 } = {}) {
   const current = currentVersion();
-  const failures = [];
-
-  for (const registry of registries) {
-    const attempt = await askRegistry(registry, { timeoutMs, fetchImpl });
-    if (attempt.ok) {
-      return {
-        ok: true,
-        current,
-        latest: attempt.latest,
-        registry,
-        updateAvailable: compareVersions(attempt.latest, current) > 0,
-      };
-    }
-    failures.push(`${registry}: ${attempt.message}`);
+  const attempts = await Promise.all(registries.map(async (registry) => ({
+    registry,
+    ...(await askRegistry(registry, { timeoutMs, fetchImpl })),
+  })));
+  const answers = attempts.filter((attempt) => attempt.ok);
+
+  if (answers.length === 0) {
+    // The reason is carried out with the failure. "Could not reach npm
+    // registry" with nothing after it leaves the user guessing between DNS, a
+    // proxy, a firewall and a mirror that does not carry the package.
+    return {
+      ok: false,
+      current,
+      errorKey: 'update.errorNetwork',
+      message: attempts.map((attempt) => `${attempt.registry}: ${attempt.message}`).join('; '),
+      triedRegistries: registries,
+    };
   }
 
-  // The reason is carried out with the failure. "Could not reach npm registry"
-  // with nothing after it leaves the user guessing between DNS, a proxy, a
-  // firewall and a mirror that does not carry the package.
+  const latest = answers
+    .map((answer) => answer.latest)
+    .reduce((best, version) => (compareVersions(version, best) > 0 ? version : best));
+  const sources = answers
+    .filter((answer) => compareVersions(answer.latest, latest) === 0)
+    .map((answer) => answer.registry);
+  const behind = answers
+    .filter((answer) => compareVersions(answer.latest, latest) < 0)
+    .map((answer) => ({ registry: answer.registry, version: answer.latest }));
+
   return {
-    ok: false,
+    ok: true,
     current,
-    errorKey: 'update.errorNetwork',
-    message: failures.join('; '),
-    triedRegistries: registries,
+    latest,
+    registry: sources[0],
+    sources,
+    behind,
+    updateAvailable: compareVersions(latest, current) > 0,
   };
 }
 
+/** Just the lines npm meant for a person: its `npm error` / `npm ERR!` summary. */
+function npmErrorSummary(output) {
+  const lines = String(output || '').split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => /^npm (error|ERR!)/.test(line) && !/complete log of this run/i.test(line))
+    .map((line) => line.replace(/^npm (error|ERR!)\s*/, ''))
+    .filter(Boolean);
+  return (lines.length > 0 ? lines.slice(0, 3) : String(output || '').trim().split(/\r?\n/).slice(-3)).join(' ');
+}
+
+/** "No matching version": the registry has not caught up with its own dist-tag. */
+function isNotYetPublished(output) {
+  return /\bETARGET\b|notarget|No matching version found/i.test(String(output || ''));
+}
+
+/** What is actually installed now, read from disk rather than the require cache. */
+function installedVersionOnDisk() {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
+  } catch {
+    return null;
+  }
+}
+
+function runNpm(spawnImpl, args, timeoutMs) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnImpl('npm', args, { timeout: timeoutMs });
+    } catch (error) {
+      resolve({ ok: false, spawnFailed: true, output: String(error?.message || error) });
+      return;
+    }
+    let output = '';
+    let settled = false;
+    const finish = (result) => { if (!settled) { settled = true; resolve(result); } };
+    const collect = (chunk) => { output += String(chunk); };
+    child.stdout?.on('data', collect);
+    child.stderr?.on('data', collect);
+    child.on('error', (error) => finish({ ok: false, spawnFailed: true, output: error.message }));
+    child.on('close', (code) => finish({ ok: code === 0, output: output.trim() }));
+  });
+}
+
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+
 /**
- * Install the newest release over this one.
+ * Install a release over this one.
  *
  * Resolves with `{ ok, output }` rather than rejecting, so the caller can show
  * npm's own message; npm's diagnostics are more useful than anything that could
  * be invented here.
+ *
+ * - The exact version the check found is installed, not `@latest`, from a
+ *   registry that reported it, with `--prefer-online` so npm revalidates the
+ *   package metadata it cached before the release existed.
+ * - Right after a release, npm's view of the package can still lack the new
+ *   version although its dist-tag already points at it: npm answers ETARGET.
+ *   That is a wait, not a failure, so it is retried a few times, then the next
+ *   registry that carries the version is tried.
+ * - Success is what is on disk afterwards, not npm's exit code.
+ *
+ * @param {{
+ *   spawnImpl?: Function,
+ *   timeoutMs?: number,
+ *   installKindImpl?: () => string,
+ *   registry?: string,
+ *   sources?: string[],
+ *   version?: string | null,
+ *   attempts?: number,
+ *   retryDelayMs?: number,
+ *   sleep?: (ms: number) => Promise<unknown>,
+ *   readInstalledVersion?: () => string | null,
+ *   onAttempt?: (progress: { registry: string, attempt: number }) => void,
+ * }} [options]
+ * @returns {Promise<{ ok: boolean, errorKey?: string, installed?: string | null, output?: string, summary?: string }>}
  */
-function performUpdate({
+async function performUpdate({
   spawnImpl = spawn,
   timeoutMs = 180_000,
   // Seam for tests: the suite runs from a checkout, where the guard below is
   // correctly the only reachable outcome.
   installKindImpl = installKind,
-  // The registry that just answered the version check. Installing from
-  // somewhere the machine has been shown to reach beats installing from a
-  // default it may have no route to. Empty means "whatever npm is configured
-  // with", which is the right answer when no check has run.
+  // The registries that reported `version`, preferred first. Empty means
+  // "whatever npm is configured with", which is right when no check has run.
   registry = '',
+  sources = [],
+  version = null,
+  attempts = 3,
+  retryDelayMs = 15_000,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  readInstalledVersion = installedVersionOnDisk,
+  onAttempt = () => {},
 } = {}) {
-  return new Promise((resolve) => {
-    const kind = installKindImpl();
-    if (kind !== 'npm') {
-      resolve({ ok: false, errorKey: `update.cannot.${kind}` });
-      return;
+  const kind = installKindImpl();
+  if (kind !== 'npm') return { ok: false, errorKey: `update.cannot.${kind}` };
+
+  const target = typeof version === 'string' && VERSION_PATTERN.test(version) ? version : null;
+  const spec = `${PACKAGE_NAME}@${target || 'latest'}`;
+  const registries = [];
+  for (const candidate of [registry, ...sources]) {
+    const normalized = normalizeRegistry(candidate);
+    if (normalized && !registries.includes(normalized)) registries.push(normalized);
+  }
+  if (registries.length === 0) registries.push('');
+
+  let last = { output: '' };
+  let notYetPublished = false;
+  for (const source of registries) {
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+      onAttempt({ registry: source, attempt });
+      const args = ['install', '-g', spec, '--prefer-online'];
+      if (source) args.push('--registry', source);
+      const result = await runNpm(spawnImpl, args, timeoutMs);
+      if (result.ok) {
+        const installed = readInstalledVersion();
+        if (target && installed && compareVersions(installed, target) < 0) {
+          return { ok: false, errorKey: 'update.errorNotApplied', installed, output: result.output.slice(-2000) };
+        }
+        return { ok: true, installed, output: result.output.slice(-2000) };
+      }
+      last = result;
+      if (result.spawnFailed) {
+        return { ok: false, errorKey: 'update.errorFailed', output: result.output, summary: result.output };
+      }
+      notYetPublished = isNotYetPublished(result.output);
+      if (!notYetPublished) break; // Not a wait: this registry will not do better.
+      if (attempt < attempts) await sleep(retryDelayMs);
     }
-    const args = ['install', '-g', `${PACKAGE_NAME}@latest`];
-    const normalizedRegistry = normalizeRegistry(registry);
-    if (normalizedRegistry) args.push('--registry', normalizedRegistry);
-    const child = spawnImpl('npm', args, {
-      encoding: 'utf8',
-      timeout: timeoutMs,
-    });
-    let output = '';
-    const collect = (chunk) => { output += String(chunk); };
-    child.stdout?.on('data', collect);
-    child.stderr?.on('data', collect);
-    child.on('error', (error) => {
-      resolve({ ok: false, errorKey: 'update.errorFailed', output: error.message });
-    });
-    child.on('close', (code) => {
-      resolve({ ok: code === 0, output: output.trim().slice(-2000) });
-    });
-  });
+  }
+  return {
+    ok: false,
+    errorKey: notYetPublished ? 'update.errorNotYetPublished' : 'update.errorFailed',
+    output: String(last.output || '').slice(-2000),
+    summary: npmErrorSummary(last.output),
+  };
 }
 
 module.exports = {
@@ -247,6 +386,9 @@ module.exports = {
   compareVersions,
   currentVersion,
   installKind,
+  installedVersionOnDisk,
+  npmErrorSummary,
   performUpdate,
   registryCandidates,
+  updateChecksEnabled,
 };