inup 1.6.0 → 1.6.3

package/dist/features/headless/headless-runner.js

@@ -6,19 +6,26 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HeadlessRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
 const package_detector_1 = require("../../core/package-detector");
+const upgrader_1 = require("../../core/upgrader");
+const package_manager_detector_1 = require("../../services/package-manager-detector");
+const version_1 = require("../../ui/utils/version");
 const vulnerability_audit_1 = require("./vulnerability-audit");
 const report_1 = require("./report");
+const debug_1 = require("../../features/debug");
 /**
  * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
  * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
- * code when updates exist so CI can gate on it. Read-only: never writes package.json or installs.
+ * code when updates exist so CI can gate on it. With --apply, writes the bumps to package.json and
+ * runs install — the only non-interactive write path.
  *
- * This is the headless counterpart to the interactive `UpgradeRunner`; it shares only the
- * `PackageDetector` (the scan/resolve layer), not the UI/upgrade machinery.
+ * This is the headless counterpart to the interactive `UpgradeRunner`; it shares the
+ * `PackageDetector` (scan/resolve) and, for --apply, the `PackageUpgrader` (write + install).
  */
 class HeadlessRunner {
     detector;
+    options;
     constructor(options) {
+        this.options = options;
         this.detector = new package_detector_1.PackageDetector(options);
     }
     async run(options) {
@@ -26,16 +33,38 @@ class HeadlessRunner {
             if (!this.detector.hasPackageJson()) {
                 throw new Error('No package.json found in current directory');
             }
+            // Start perf tracking so headless runs produce clean timing data too
+            // (the interactive runner starts it itself; headless previously did not).
+            const perfEnabled = (0, debug_1.isPerfLoggingEnabled)();
+            const performanceTracker = (0, debug_1.getPerformanceTracker)();
+            if (perfEnabled)
+                performanceTracker.start();
             const packages = await this.detector.getOutdatedPackages();
             const outdated = this.detector.getOutdatedPackagesOnly(packages);
+            if (perfEnabled) {
+                performanceTracker.mark('allLoaded');
+                (0, debug_1.writePerfLog)({
+                    ...this.detector.getPerfConfig(),
+                    packageManager: null,
+                    mode: 'headless',
+                    env: (0, debug_1.perfEnv)(),
+                }, performanceTracker.snapshot());
+            }
             // Audit the current versions (one bulk request, best-effort) and cross-reference each
             // advisory against the upgrade targets, so the report says whether upgrading *fixes* it.
             const vulnerabilities = await (0, vulnerability_audit_1.auditVulnerabilities)(outdated);
+            // Build the report from the *pre-apply* outdated set: it describes what this run addressed.
+            const report = (0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities);
+            // --apply writes the bumps + lockfile. The scan above already honored .inuprc
+            // (ignore/exclude/scanDirs), so the set we write is exactly the set we report — never more.
+            if (options.apply) {
+                await this.applyUpgrades(outdated, options.target ?? 'minor', !!options.json);
+            }
             if (options.json) {
                 // stdout is reserved for the JSON document only.
-                console.log(JSON.stringify((0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities), null, 2));
+                console.log(JSON.stringify(report, null, 2));
             }
-            else {
+            else if (!options.apply) {
                 console.log((0, report_1.renderPlainReport)(outdated, vulnerabilities));
             }
             // Exit 1 only means "updates exist" (like `prettier --check`); 2 is reserved for errors.
@@ -48,6 +77,61 @@ class HeadlessRunner {
             process.exit(2);
         }
     }
+    /**
+     * Apply upgrades to the already-filtered outdated set, by version policy. Reuses the interactive
+     * write path (`PackageUpgrader`) verbatim — we only build the choices programmatically instead of
+     * from a TUI selection. No path/package filtering happens here: `outdated` is config-filtered.
+     */
+    async applyUpgrades(outdated, target, json) {
+        const choices = this.buildChoices(outdated, target);
+        if (choices.length === 0)
+            return;
+        const packageManager = this.resolvePackageManager();
+        // With --json, run the upgrader quietly: its own progress + the install child's stdout go to
+        // stderr, leaving stdout for the JSON document only.
+        const upgrader = new upgrader_1.PackageUpgrader(packageManager, { quiet: json });
+        await upgrader.upgradePackages(choices, outdated);
+    }
+    /**
+     * Build `PackageUpgradeChoice[]` from the outdated set per the version policy. Mirrors
+     * `createUpgradeChoices` in the TUI: preserves the original range prefix (^/~) unless --save-exact.
+     *
+     * - minor/patch: take the in-range target (`rangeVersion`); skip packages whose only update is a
+     *   major (no in-range bump). Uses upgradeType 'range'.
+     * - latest: take `latestVersion`; uses upgradeType 'latest' (majors included).
+     */
+    buildChoices(outdated, target) {
+        const saveExact = this.options?.saveExact ?? false;
+        const choices = [];
+        for (const pkg of outdated) {
+            const useLatest = target === 'latest';
+            // minor/patch only act on packages with an in-range bump; major-only updates are skipped.
+            if (!useLatest && !pkg.hasRangeUpdate)
+                continue;
+            const targetVersion = useLatest ? pkg.latestVersion : pkg.rangeVersion;
+            if (!targetVersion)
+                continue;
+            const targetVersionWithPrefix = saveExact
+                ? targetVersion
+                : (0, version_1.applyVersionPrefix)(pkg.currentVersion, targetVersion);
+            choices.push({
+                name: pkg.name,
+                packageJsonPath: pkg.packageJsonPath,
+                dependencyType: pkg.type,
+                upgradeType: useLatest ? 'latest' : 'range',
+                targetVersion: targetVersionWithPrefix,
+                currentVersionSpecifier: pkg.currentVersion,
+            });
+        }
+        return choices;
+    }
+    /** Resolve the package manager the same way the interactive runner does. */
+    resolvePackageManager() {
+        const cwd = this.options?.cwd || process.cwd();
+        return this.options?.packageManager
+            ? package_manager_detector_1.PackageManagerDetector.getInfo(this.options.packageManager)
+            : package_manager_detector_1.PackageManagerDetector.detect(cwd);
+    }
 }
 exports.HeadlessRunner = HeadlessRunner;
 //# sourceMappingURL=headless-runner.js.map

package/dist/services/http/adaptive-controller.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * AIMD (additive-increase / multiplicative-decrease) concurrency controller.
+ *
+ * Mirrors the congestion-control family TCP uses. It performs no I/O and does not
+ * own the semaphore — it is a pure decision function: feed it the outcome of each
+ * request, and on each control tick it returns the next concurrency limit, which
+ * the caller applies to the resizable semaphore.
+ *
+ * Back-off signals (only real errors move the limit down):
+ *  - congestion (HTTP 429/503): the registry explicitly telling us to slow down →
+ *    immediate hard multiplicative-decrease (×hardDecreaseFactor), the moment the
+ *    signal arrives, not deferred to the next tick.
+ *  - retryable/transient errors in a tick window → soft multiplicative-decrease
+ *    (×softDecreaseFactor) and no increase.
+ *
+ * Otherwise (healthy link) the limit ramps additively (+increaseStep) toward the
+ * ceiling and holds there.
+ *
+ * NOTE on latency: we sample successful single-attempt latency into an EWMA, but
+ * it is used for *instrumentation only* — never to drive back-off. The npm
+ * registry is a CDN whose latency varies widely on a perfectly healthy link;
+ * reacting to that variance made the controller oscillate and lose to a fixed
+ * limit. Real congestion shows up as 429, which we handle directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdaptiveController = exports.DEFAULT_TUNING = void 0;
+exports.DEFAULT_TUNING = {
+    floor: 6,
+    ceil: 24,
+    increaseStep: 4,
+    softDecreaseFactor: 0.7,
+    hardDecreaseFactor: 0.5,
+    ewmaAlpha: 0.3,
+    ticksEveryCompletions: 6,
+};
+const clamp = (value, lo, hi) => Math.max(lo, Math.min(hi, value));
+class AdaptiveController {
+    onTick;
+    tuning;
+    limit;
+    // EWMA of successful single-attempt latency. Kept for instrumentation only
+    // (the perf modal / logs); it does not drive concurrency decisions.
+    ewmaMs = 0;
+    hasEwma = false;
+    completionsSinceTick = 0;
+    retriesSinceTick = 0;
+    /**
+     * @param packageCount  number of packages this run will fetch; drives the smart
+     *                       initial limit so a run starts near its work size and
+     *                       ramps to the ceiling, rather than crawling up from the
+     *                       floor and losing to a fixed baseline.
+     * @param onTick        optional sink for control decisions (perf modal / logs).
+     * @param tuning        override the defaults (constants live in one place).
+     */
+    constructor(packageCount, onTick, tuning = {}) {
+        this.onTick = onTick;
+        this.tuning = { ...exports.DEFAULT_TUNING, ...tuning };
+        // Smart start: aim at the work size, clamped to [floor, ceil].
+        this.limit = clamp(Math.min(this.tuning.ceil, packageCount), this.tuning.floor, this.tuning.ceil);
+    }
+    /** Whether the controller should even run; tiny runs are better off fixed. */
+    static shouldControl(packageCount, tuning = {}) {
+        const ceil = tuning.ceil ?? exports.DEFAULT_TUNING.ceil;
+        // Nothing to ramp toward and no steady state to learn below the ceiling.
+        return packageCount > ceil;
+    }
+    getLimit() {
+        return this.limit;
+    }
+    /**
+     * Record a completed request. Returns a new limit to apply IMMEDIATELY when a
+     * congestion signal demands a hard back-off, otherwise null (the limit may
+     * still change at the next control tick — see `maybeTick`).
+     */
+    record(kind, latencyMs) {
+        this.completionsSinceTick++;
+        if (kind === 'success' && latencyMs !== undefined) {
+            this.sampleLatency(latencyMs);
+            return null;
+        }
+        if (kind === 'congested') {
+            this.retriesSinceTick++;
+            return this.applyHardDecrease();
+        }
+        // retryable / transient
+        this.retriesSinceTick++;
+        return null;
+    }
+    /**
+     * Call after each completion. If a control tick is due, computes and returns
+     * the next limit (and emits a ControlTick); otherwise returns null.
+     */
+    maybeTick(now = Date.now()) {
+        if (this.completionsSinceTick < this.tuning.ticksEveryCompletions) {
+            return null;
+        }
+        return this.tick(now);
+    }
+    sampleLatency(latencyMs) {
+        if (!this.hasEwma) {
+            this.ewmaMs = latencyMs;
+            this.hasEwma = true;
+        }
+        else {
+            const a = this.tuning.ewmaAlpha;
+            this.ewmaMs = a * latencyMs + (1 - a) * this.ewmaMs;
+        }
+    }
+    applyHardDecrease() {
+        const next = clamp(Math.round(this.limit * this.tuning.hardDecreaseFactor), this.tuning.floor, this.tuning.ceil);
+        this.limit = next;
+        this.emit('hard-down');
+        // A hard decrease resets the tick window so we don't immediately bump back up.
+        this.resetWindow();
+        return next;
+    }
+    tick(now) {
+        // Back off only on real errors seen since the last tick; otherwise ramp to
+        // the ceiling and hold (latency is not a signal — see the class docblock).
+        const retries = this.retriesSinceTick;
+        let reason;
+        if (retries > 0) {
+            this.limit = clamp(Math.round(this.limit * this.tuning.softDecreaseFactor), this.tuning.floor, this.tuning.ceil);
+            reason = 'soft-down';
+        }
+        else if (this.limit < this.tuning.ceil) {
+            this.limit = clamp(this.limit + this.tuning.increaseStep, this.tuning.floor, this.tuning.ceil);
+            reason = 'up';
+        }
+        else {
+            reason = 'hold';
+        }
+        this.emit(reason, now);
+        this.resetWindow();
+        return this.limit;
+    }
+    emit(reason, now = Date.now()) {
+        this.onTick?.({
+            atMs: now,
+            limit: this.limit,
+            ewmaMs: Math.round(this.ewmaMs),
+            retries: this.retriesSinceTick,
+            reason,
+        });
+    }
+    resetWindow() {
+        this.completionsSinceTick = 0;
+        this.retriesSinceTick = 0;
+    }
+}
+exports.AdaptiveController = AdaptiveController;
+//# sourceMappingURL=adaptive-controller.js.map

package/dist/services/http/etag-store.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setEtagCacheEnabled = setEtagCacheEnabled;
+exports.readEtag = readEtag;
+exports.writeEtag = writeEtag;
+exports.etagCacheDir = etagCacheDir;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** Bump when the on-disk entry shape changes; old generations are ignored. */
+const SCHEMA = 'v1';
+/** Entries untouched for longer than this are swept on first access. */
+const MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000; // 14 days
+let enabled = true;
+let sweptThisProcess = false;
+/** Allow tests/callers to toggle the store without touching call sites. */
+function setEtagCacheEnabled(value) {
+    enabled = value;
+}
+/** Resolve (and lazily create) the cache directory, sweeping stale entries once. */
+function cacheDir() {
+    // Version data is not project-specific, so it lives in the OS temp area, shared
+    // across every project the user scans.
+    const dir = (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'inup', 'etag-cache', SCHEMA);
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    if (!sweptThisProcess) {
+        sweptThisProcess = true;
+        sweepStale(dir);
+    }
+    return dir;
+}
+/** Delete entries not modified within MAX_AGE_MS. Best-effort, runs once. */
+function sweepStale(dir) {
+    try {
+        const cutoff = Date.now() - MAX_AGE_MS;
+        for (const name of (0, node_fs_1.readdirSync)(dir)) {
+            const file = (0, node_path_1.join)(dir, name);
+            try {
+                if ((0, node_fs_1.statSync)(file).mtimeMs < cutoff)
+                    (0, node_fs_1.unlinkSync)(file);
+            }
+            catch {
+                /* skip files we can't stat/remove */
+            }
+        }
+    }
+    catch {
+        /* sweeping is optional; never fail a run over it */
+    }
+}
+/** Stable, filesystem-safe filename for a cache key (the registry path). */
+function fileFor(key) {
+    const hash = (0, node_crypto_1.createHash)('sha1').update(key).digest('hex');
+    return (0, node_path_1.join)(cacheDir(), `${hash}.json`);
+}
+/** Read a stored entry, or null if absent/unreadable/disabled. */
+function readEtag(key) {
+    if (!enabled)
+        return null;
+    try {
+        const file = fileFor(key);
+        if (!(0, node_fs_1.existsSync)(file))
+            return null;
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+        if (!parsed || typeof parsed.etag !== 'string' || !parsed.data)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist an entry. Best-effort; failures are ignored. */
+function writeEtag(key, etag, data) {
+    if (!enabled || !etag)
+        return;
+    try {
+        (0, node_fs_1.writeFileSync)(fileFor(key), JSON.stringify({ etag, data }));
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Test/maintenance helper: the resolved cache directory. */
+function etagCacheDir() {
+    return cacheDir();
+}
+//# sourceMappingURL=etag-store.js.map

package/dist/services/http/resizable-semaphore.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResizableSemaphore = void 0;
+/**
+ * A counting semaphore whose limit can change at runtime.
+ *
+ * - `acquire()` resolves immediately if there is headroom, otherwise queues a
+ *   waiter (FIFO) until a `release()` opens a slot.
+ * - `setLimit()` may grow or shrink the limit at any time. Growing wakes as many
+ *   queued waiters as the new headroom allows. Shrinking never aborts in-flight
+ *   holders — it simply stops admitting new ones until natural releases drain
+ *   `inFlight` back below the new limit.
+ * - `release()` is guarded: it only wakes a waiter when `inFlight < limit`. This
+ *   is what makes a shrink actually take effect (an unconditional wake would
+ *   re-admit immediately and ignore the smaller limit).
+ *
+ * Invariant: `inFlight` never exceeds `limit` at the moment of admission. A prior
+ * shrink can leave `inFlight > limit` transiently; no new holder is admitted
+ * until it drains.
+ */
+class ResizableSemaphore {
+    limit;
+    inFlight = 0;
+    waiters = [];
+    constructor(initialLimit) {
+        this.limit = Math.max(1, Math.floor(initialLimit));
+    }
+    getLimit() {
+        return this.limit;
+    }
+    getInFlight() {
+        return this.inFlight;
+    }
+    getWaiterCount() {
+        return this.waiters.length;
+    }
+    setLimit(next) {
+        this.limit = Math.max(1, Math.floor(next));
+        // Growing may have opened headroom for queued waiters.
+        this.drainWaiters();
+    }
+    async acquire() {
+        // `inFlight` is the single authoritative counter and is incremented exactly
+        // once per admission, synchronously at the moment admission is decided —
+        // either here (fast path) or in `drainWaiters` (when a slot frees up). A
+        // woken waiter must NOT increment again, or a concurrent fast-path acquire
+        // reading a stale count could over-admit past the limit.
+        if (this.inFlight < this.limit) {
+            this.inFlight++;
+            return;
+        }
+        await new Promise((resolve) => this.waiters.push(resolve));
+    }
+    release() {
+        this.inFlight--;
+        this.drainWaiters();
+    }
+    /**
+     * Wakes queued waiters while there is headroom, incrementing `inFlight` for
+     * each as it is admitted so the count stays authoritative and synchronous.
+     */
+    drainWaiters() {
+        while (this.inFlight < this.limit && this.waiters.length > 0) {
+            const next = this.waiters.shift();
+            this.inFlight++;
+            next();
+        }
+    }
+}
+exports.ResizableSemaphore = ResizableSemaphore;
+//# sourceMappingURL=resizable-semaphore.js.map

package/dist/services/http/retry.js

@@ -1,10 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTransientNetworkError = exports.isRetryableStatus = exports.sleep = void 0;
+exports.isTransientNetworkError = exports.parseRetryAfterMs = exports.isCongestionStatus = exports.isRetryableStatus = exports.sleep = void 0;
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 exports.sleep = sleep;
 const isRetryableStatus = (statusCode) => statusCode === 408 || statusCode === 429 || statusCode >= 500;
 exports.isRetryableStatus = isRetryableStatus;
+// Registry explicitly signaling congestion: the highest-quality back-off signal.
+const isCongestionStatus = (statusCode) => statusCode === 429 || statusCode === 503;
+exports.isCongestionStatus = isCongestionStatus;
+// Parse a Retry-After header (delta-seconds or HTTP-date) into milliseconds.
+// Returns null when absent or unparseable.
+const parseRetryAfterMs = (header, now = Date.now()) => {
+    if (header === undefined)
+        return null;
+    const value = (Array.isArray(header) ? header[0] : header)?.toString().trim();
+    if (!value)
+        return null;
+    const asSeconds = Number(value);
+    if (Number.isFinite(asSeconds)) {
+        return asSeconds >= 0 ? Math.round(asSeconds * 1000) : null;
+    }
+    const asDate = Date.parse(value);
+    if (Number.isFinite(asDate)) {
+        return Math.max(0, asDate - now);
+    }
+    return null;
+};
+exports.parseRetryAfterMs = parseRetryAfterMs;
 const isTransientNetworkError = (error) => {
     if (!(error instanceof Error)) {
         return false;