pakstr 0.28.0 → 0.29.1

package/dist/runners/DockerGradleRunner.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const crypto_1 = require("crypto");
 const process_1 = require("./process");
 const dockerNetwork_1 = require("./dockerNetwork");
+const timeouts_1 = require("./timeouts");
 const CONTAINER_RELEASE_APK_SIGNED = "/workspace/app/build/outputs/apk/release/app-release.apk";
 const CONTAINER_RELEASE_APK_UNSIGNED = "/workspace/app/build/outputs/apk/release/app-release-unsigned.apk";
 const CONTAINER_DEBUG_APK = "/workspace/app/build/outputs/apk/debug/app-debug.apk";
@@ -22,16 +23,17 @@ class DockerGradleRunner {
         this.execute = execute;
     }
     async build(request) {
+        const timeoutMs = (0, timeouts_1.buildTimeoutMs)();
         this.checkDockerAvailable();
-        this.ensureDockerImage();
+        this.ensureDockerImage(timeoutMs);
         const storage = this.createBuildStorage(request.androidRoot);
         let primaryError;
         let result;
         try {
             result =
                 request.mode === "release"
-                    ? this.buildRelease(request, storage)
-                    : this.buildDebug(request, storage);
+                    ? this.buildRelease(request, storage, timeoutMs)
+                    : this.buildDebug(request, storage, timeoutMs);
         }
         catch (error) {
             primaryError = error;
@@ -55,10 +57,8 @@ class DockerGradleRunner {
             throw new Error("Docker build completed without a result");
         return result;
     }
-    buildDebug(request, storage) {
-        this.execute("docker", [
-            "run",
-            "--rm",
+    buildDebug(request, storage, timeoutMs) {
+        this.runBuildContainer([
             ...(0, dockerNetwork_1.dockerNetworkArgs)(),
             "-v",
             `${storage.workspaceVolume}:/workspace`,
@@ -68,17 +68,15 @@ class DockerGradleRunner {
             "./gradlew",
             "assembleDebug",
             "-Dorg.gradle.vfs.watch=false",
-        ], { streamOutput: true });
+        ], { streamOutput: true, timeoutMs, timeoutHint: (0, timeouts_1.buildTimeoutHint)("Gradle build") });
         const artifactPath = hostArtifactPath(request.androidRoot, "debug");
         this.copyFromVolume(storage.workspaceVolume, CONTAINER_DEBUG_APK, artifactPath);
         return { artifactPath: requireApk(artifactPath), unsigned: false };
     }
-    buildRelease(request, storage) {
+    buildRelease(request, storage, timeoutMs) {
         // Unsigned release build: no signing config is wired up because
         // PAKSTR_ANDROID_KEYSTORE_PATH is not set in the container environment.
-        this.execute("docker", [
-            "run",
-            "--rm",
+        this.runBuildContainer([
             ...(0, dockerNetwork_1.dockerNetworkArgs)(),
             "-v",
             `${storage.workspaceVolume}:/workspace`,
@@ -89,11 +87,27 @@ class DockerGradleRunner {
             "assembleRelease",
             "--no-daemon",
             "-Dorg.gradle.vfs.watch=false",
-        ], { env: scrubSigningEnv(process.env), streamOutput: true });
+        ], {
+            env: scrubSigningEnv(process.env),
+            streamOutput: true,
+            timeoutMs,
+            timeoutHint: (0, timeouts_1.buildTimeoutHint)("Gradle build"),
+        });
         const artifactPath = hostArtifactPath(request.androidRoot, "release-unsigned");
         this.copyFromVolume(storage.workspaceVolume, CONTAINER_RELEASE_APK_UNSIGNED, artifactPath);
         return { artifactPath: requireApk(artifactPath), unsigned: true };
     }
+    runBuildContainer(args, options) {
+        const container = `pakstr-build-${(0, crypto_1.randomUUID)()}`;
+        try {
+            this.execute("docker", ["run", "--rm", "--name", container, ...args], options);
+        }
+        catch (error) {
+            // Remove it before the workspace volume it may still hold is cleaned up.
+            (0, timeouts_1.removeFailedRunContainer)(this.execute, container);
+            throw error;
+        }
+    }
     createBuildStorage(androidRoot) {
         const suffix = (0, crypto_1.randomUUID)();
         const storage = {
@@ -101,7 +115,7 @@ class DockerGradleRunner {
         };
         assertRegularAbsolutePath(androidRoot, "Android workspace");
         try {
-            this.execute("docker", ["volume", "create", storage.workspaceVolume]);
+            this.execute("docker", ["volume", "create", storage.workspaceVolume], timeouts_1.DOCKER_COMMAND_OPTIONS);
             this.copyDirectoryToVolume(androidRoot, storage.workspaceVolume);
             return storage;
         }
@@ -127,8 +141,8 @@ class DockerGradleRunner {
                 `${volume}:/workspace`,
                 this.image,
                 "true",
-            ]);
-            this.execute("docker", ["cp", `${source}${path_1.default.sep}.`, `${container}:/workspace`]);
+            ], timeouts_1.DOCKER_COMMAND_OPTIONS);
+            this.execute("docker", ["cp", `${source}${path_1.default.sep}.`, `${container}:/workspace`], timeouts_1.DOCKER_COPY_OPTIONS);
         }
         finally {
             this.removeContainer(container);
@@ -148,8 +162,8 @@ class DockerGradleRunner {
                 `${volume}:/workspace:ro`,
                 this.image,
                 "true",
-            ]);
-            this.execute("docker", ["cp", `${container}:${source}`, destination]);
+            ], timeouts_1.DOCKER_COMMAND_OPTIONS);
+            this.execute("docker", ["cp", `${container}:${source}`, destination], timeouts_1.DOCKER_COPY_OPTIONS);
         }
         finally {
             this.removeContainer(container);
@@ -157,7 +171,7 @@ class DockerGradleRunner {
     }
     removeBuildStorage(storage) {
         try {
-            this.execute("docker", ["volume", "rm", "--force", storage.workspaceVolume]);
+            this.execute("docker", ["volume", "rm", "--force", storage.workspaceVolume], timeouts_1.DOCKER_COMMAND_OPTIONS);
         }
         catch {
             throw new Error(`Failed to remove temporary Docker volume: ${storage.workspaceVolume}`);
@@ -165,7 +179,7 @@ class DockerGradleRunner {
     }
     removeContainer(container) {
         try {
-            this.execute("docker", ["rm", "--force", container]);
+            this.execute("docker", ["rm", "--force", container], timeouts_1.DOCKER_COMMAND_OPTIONS);
         }
         catch {
             // A failed docker create leaves no container to remove.
@@ -179,14 +193,21 @@ class DockerGradleRunner {
             throw new Error("Docker is not installed or not running. Install Docker Desktop to use pakstr.");
         }
     }
-    ensureDockerImage() {
+    ensureDockerImage(timeoutMs) {
         try {
-            this.execute("docker", ["image", "inspect", this.image]);
+            this.execute("docker", ["image", "inspect", this.image], timeouts_1.DOCKER_COMMAND_OPTIONS);
             console.log(`🐳 Docker image ready: ${this.image}`);
         }
-        catch {
+        catch (error) {
+            // An unresponsive daemon is not a missing image; don't wait on a pull too.
+            if (error instanceof process_1.ProcessTimeoutError)
+                throw error;
             console.log(`⬇️ Pulling Docker image: ${this.image}`);
-            this.execute("docker", ["pull", this.image], { streamOutput: true });
+            this.execute("docker", ["pull", this.image], {
+                streamOutput: true,
+                timeoutMs,
+                timeoutHint: (0, timeouts_1.buildTimeoutHint)("image pull"),
+            });
         }
     }
 }

package/dist/runners/DockerSignRunner.js

@@ -11,6 +11,8 @@ const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const process_1 = require("./process");
 const dockerNetwork_1 = require("./dockerNetwork");
+const timeouts_1 = require("./timeouts");
+const artifactPublisher_1 = require("../commands/artifactPublisher");
 class DockerSignRunner {
     image;
     execute;
@@ -29,11 +31,13 @@ class DockerSignRunner {
         // (mirroring how DockerGradleRunner transports the workspace).
         const apkVolume = `pakstr-sign-apk-${(0, crypto_2.randomUUID)()}`;
         const outVolume = `pakstr-sign-out-${(0, crypto_2.randomUUID)()}`;
+        const signContainer = `pakstr-sign-${(0, crypto_2.randomUUID)()}`;
+        let hostSigned;
         let primaryError;
         let result;
         try {
-            this.execute("docker", ["volume", "create", apkVolume]);
-            this.execute("docker", ["volume", "create", outVolume]);
+            this.execute("docker", ["volume", "create", apkVolume], timeouts_1.DOCKER_COMMAND_OPTIONS);
+            this.execute("docker", ["volume", "create", outVolume], timeouts_1.DOCKER_COMMAND_OPTIONS);
             this.copyFileToVolume(request.unsignedApkPath, apkVolume, "/work/unsigned.apk");
             const password = (0, crypto_1.randomBytes)(32).toString("base64url");
             const nsecString = nsecToString(request.nsec);
@@ -51,9 +55,11 @@ class DockerSignRunner {
             if (request.identityProofPubkey) {
                 signingEnvNames.push("IDENTITY_PROOF_PUBKEY");
             }
-            const stdout = this.execute("docker", [
+            const stdout = this.runSignContainer(signContainer, [
                 "run",
                 "--rm",
+                "--name",
+                signContainer,
                 ...(0, dockerNetwork_1.dockerNetworkArgs)(),
                 "--tmpfs",
                 "/signing:mode=0700,uid=0",
@@ -67,7 +73,13 @@ class DockerSignRunner {
                 request.appId,
                 "/work/unsigned.apk",
                 "/out/signed.apk",
-            ], { env, secrets: [nsecString, password], streamOutput: true }).stdout;
+            ], {
+                env,
+                secrets: [nsecString, password],
+                streamOutput: true,
+                timeoutMs: timeouts_1.DOCKER_SIGN_TIMEOUT_MS,
+                timeoutHint: `The signing container did not finish. ${timeouts_1.DOCKER_DAEMON_HINT}`,
+            }).stdout;
             const signerSha256 = parseSignerSha(stdout);
             const identityProof = parseIdentityProof(stdout);
             if (request.identityProofPubkey && !identityProof) {
@@ -85,33 +97,50 @@ class DockerSignRunner {
                 }
             }
             // Copy the signed APK out of the output volume to the host.
-            const hostSigned = path_1.default.join(os_1.default.tmpdir(), `pakstr-signed-${(0, crypto_2.randomUUID)()}.apk`);
+            hostSigned = path_1.default.join(os_1.default.tmpdir(), `pakstr-signed-${(0, crypto_2.randomUUID)()}.apk`);
             this.copyFromVolume(outVolume, "/out/signed.apk", hostSigned);
             if (!fs_1.default.existsSync(hostSigned) || !fs_1.default.lstatSync(hostSigned).isFile()) {
                 throw new Error("Sign runner did not produce a signed APK");
             }
-            fs_1.default.mkdirSync(path_1.default.dirname(request.signedApkPath), { recursive: true });
-            fs_1.default.rmSync(request.signedApkPath, { force: true });
+            if (fs_1.default.statSync(hostSigned).size === 0) {
+                throw new Error("Sign runner produced an empty signed APK");
+            }
             const finalPath = path_1.default.resolve(request.signedApkPath);
-            // Copy (not rename) across the tmpfs → workspace device boundary; CI
-            // runners put /tmp and the checkout on different filesystems, so
-            // fs.rename fails with EXDEV. COPYFILE_FICLONE is a harmless hint.
-            fs_1.default.copyFileSync(hostSigned, finalPath, fs_1.default.constants.COPYFILE_FICLONE);
-            fs_1.default.rmSync(hostSigned, { force: true });
+            fs_1.default.mkdirSync(path_1.default.dirname(finalPath), { recursive: true });
+            // Copy (not rename) across the tmpfs → workspace device boundary into a
+            // staging directory next to the output (CI runners put /tmp and the
+            // checkout on different filesystems, so fs.rename fails with EXDEV),
+            // then replace the output without deleting the previous APK first.
+            // `pakstr sign` signs in place, so that previous APK is the unsigned one.
+            (0, artifactPublisher_1.publishArtifact)((0, artifactPublisher_1.stageArtifact)(hostSigned, finalPath, "signed APK"), finalPath);
             result = { signedApkPath: finalPath, signerSha256, identityProof: identityProof ?? undefined };
         }
         catch (error) {
             primaryError = error;
         }
         finally {
-            for (const v of [outVolume, apkVolume]) {
+            // Also covers a partial signed APK left by a failed or timed-out copy,
+            // or a directory if the container produced one. The path is our own
+            // random temp name, so a recursive removal is safe.
+            if (hostSigned) {
                 try {
-                    this.execute("docker", ["volume", "rm", "--force", v]);
+                    fs_1.default.rmSync(hostSigned, { recursive: true, force: true });
                 }
                 catch {
                     /* best-effort cleanup */
                 }
             }
+            for (const v of [outVolume, apkVolume]) {
+                try {
+                    this.execute("docker", ["volume", "rm", "--force", v], timeouts_1.DOCKER_COMMAND_OPTIONS);
+                }
+                catch (error) {
+                    // Best-effort: don't fail (or mask the real error of) the signing run.
+                    console.warn(`Warning: failed to remove temporary Docker volume ${v} ` +
+                        `(${error instanceof Error ? error.message.split("\n")[0] : "unknown error"}); ` +
+                        `remove it with: docker volume rm --force ${v}`);
+                }
+            }
         }
         if (primaryError)
             throw primaryError;
@@ -119,6 +148,16 @@ class DockerSignRunner {
             throw new Error("Sign runner completed without a result");
         return result;
     }
+    runSignContainer(container, args, options) {
+        try {
+            return this.execute("docker", args, options);
+        }
+        catch (error) {
+            // A killed docker client leaves the container (and its secrets) running.
+            (0, timeouts_1.removeFailedRunContainer)(this.execute, container);
+            throw error;
+        }
+    }
     copyFileToVolume(source, volume, destination) {
         const container = `pakstr-sign-copy-${(0, crypto_2.randomUUID)()}`;
         try {
@@ -131,8 +170,8 @@ class DockerSignRunner {
                 `${volume}:/work`,
                 this.image,
                 "true",
-            ]);
-            this.execute("docker", ["cp", source, `${container}:${destination}`]);
+            ], timeouts_1.DOCKER_COMMAND_OPTIONS);
+            this.execute("docker", ["cp", source, `${container}:${destination}`], timeouts_1.DOCKER_COPY_OPTIONS);
         }
         finally {
             this.removeContainer(container);
@@ -155,8 +194,8 @@ class DockerSignRunner {
                 `${volume}:${mountDir}:ro`,
                 this.image,
                 "true",
-            ]);
-            this.execute("docker", ["cp", `${container}:${source}`, destination]);
+            ], timeouts_1.DOCKER_COMMAND_OPTIONS);
+            this.execute("docker", ["cp", `${container}:${source}`, destination], timeouts_1.DOCKER_COPY_OPTIONS);
         }
         finally {
             this.removeContainer(container);
@@ -164,7 +203,7 @@ class DockerSignRunner {
     }
     removeContainer(container) {
         try {
-            this.execute("docker", ["rm", "--force", container]);
+            this.execute("docker", ["rm", "--force", container], timeouts_1.DOCKER_COMMAND_OPTIONS);
         }
         catch {
             /* a failed create leaves no container */

package/dist/runners/LocalGradleRunner.js

@@ -7,6 +7,7 @@ exports.LocalGradleRunner = void 0;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const process_1 = require("./process");
+const timeouts_1 = require("./timeouts");
 /**
  * Local Gradle runner for users who already have a JDK + Android SDK + Gradle
  * installed. The default and only specified builder is `docker`; this remains
@@ -15,6 +16,8 @@ const process_1 = require("./process");
 class LocalGradleRunner {
     async build(request) {
         const { androidRoot, mode } = request;
+        const timeoutMs = (0, timeouts_1.buildTimeoutMs)();
+        const timeoutHint = (0, timeouts_1.buildTimeoutHint)("Gradle build");
         const gradlewPath = path_1.default.join(androidRoot, "gradlew");
         if (!fs_1.default.existsSync(gradlewPath)) {
             throw new Error("gradlew not found in Android project root");
@@ -25,6 +28,8 @@ class LocalGradleRunner {
             (0, process_1.runProcess)(gradlewPath, ["assembleDebug"], {
                 cwd: androidRoot,
                 streamOutput: true,
+                timeoutMs,
+                timeoutHint,
             });
             return { artifactPath: requireApk(androidRoot, "debug"), unsigned: false };
         }
@@ -34,6 +39,8 @@ class LocalGradleRunner {
             cwd: androidRoot,
             env,
             streamOutput: true,
+            timeoutMs,
+            timeoutHint,
         });
         const artifactPath = requireApk(androidRoot, "release-unsigned");
         return { artifactPath, unsigned: true };

package/dist/runners/process.js

@@ -1,15 +1,44 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProcessOutputLimitError = exports.ProcessTimeoutError = void 0;
 exports.runProcess = runProcess;
 exports.redact = redact;
 const child_process_1 = require("child_process");
+class ProcessTimeoutError extends Error {
+    timeoutMs;
+    constructor(message, timeoutMs) {
+        super(message);
+        this.timeoutMs = timeoutMs;
+        this.name = "ProcessTimeoutError";
+    }
+}
+exports.ProcessTimeoutError = ProcessTimeoutError;
+/** The process wrote more than MAX_OUTPUT_BYTES to stdout or stderr and was killed. */
+class ProcessOutputLimitError extends Error {
+    maxBuffer;
+    constructor(message, maxBuffer) {
+        super(message);
+        this.maxBuffer = maxBuffer;
+        this.name = "ProcessOutputLimitError";
+    }
+}
+exports.ProcessOutputLimitError = ProcessOutputLimitError;
 const MAX_DIAGNOSTIC_LENGTH = 32 * 1024;
+// Node's spawnSync default, stated explicitly so the error can name it.
+const MAX_OUTPUT_BYTES = 1024 * 1024;
 function runProcess(command, args, options = {}) {
     const result = (0, child_process_1.spawnSync)(command, args, {
         cwd: options.cwd,
         env: options.env,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: MAX_OUTPUT_BYTES,
+        // SIGKILL, not the default SIGTERM: spawnSync waits for the child to exit,
+        // so a child that ignores SIGTERM (e.g. PID 1 in a container) would still
+        // block forever.
+        ...(options.timeoutMs
+            ? { timeout: options.timeoutMs, killSignal: "SIGKILL" }
+            : {}),
     });
     const stdout = redact(result.stdout ?? "", options.secrets ?? []);
     const stderr = redact(result.stderr ?? "", options.secrets ?? []);
@@ -20,6 +49,18 @@ function runProcess(command, args, options = {}) {
             process.stderr.write(stderr);
     }
     if (result.error) {
+        const code = result.error.code;
+        const label = redact([command, args[0]].filter(Boolean).join(" "), options.secrets ?? []);
+        const diagnostic = bounded(`${stderr}\n${stdout}`.trim());
+        const suffix = diagnostic ? `\n${diagnostic}` : "";
+        if (options.timeoutMs && code === "ETIMEDOUT") {
+            const hint = options.timeoutHint ? ` ${options.timeoutHint}` : "";
+            throw new ProcessTimeoutError(`${label} timed out after ${formatDuration(options.timeoutMs)} and was stopped.${hint}${suffix}`, options.timeoutMs);
+        }
+        if (code === "ENOBUFS") {
+            throw new ProcessOutputLimitError(`${label} wrote more than ${MAX_OUTPUT_BYTES / (1024 * 1024)} MiB of output and was stopped; ` +
+                `its output was cut off at that point.${suffix}`, MAX_OUTPUT_BYTES);
+        }
         throw new Error(`Failed to run ${command}: ${redact(result.error.message, options.secrets ?? [])}`);
     }
     if (result.status !== 0) {
@@ -35,6 +76,16 @@ function redact(value, secrets) {
         .sort((a, b) => b.length - a.length)
         .reduce((output, secret) => output.split(secret).join("[REDACTED]"), value);
 }
+function formatDuration(ms) {
+    if (ms % 60_000 === 0)
+        return plural(ms / 60_000, "minute");
+    if (ms % 1_000 === 0)
+        return plural(ms / 1_000, "second");
+    return `${ms} ms`;
+}
+function plural(count, unit) {
+    return `${count} ${unit}${count === 1 ? "" : "s"}`;
+}
 function bounded(value) {
     if (value.length <= MAX_DIAGNOSTIC_LENGTH)
         return value;

package/dist/runners/timeouts.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOCKER_COPY_OPTIONS = exports.DOCKER_COMMAND_OPTIONS = exports.DOCKER_DAEMON_HINT = exports.DEFAULT_BUILD_TIMEOUT_MINUTES = exports.BUILD_TIMEOUT_ENV = exports.DOCKER_SIGN_TIMEOUT_MS = exports.DOCKER_COPY_TIMEOUT_MS = exports.DOCKER_COMMAND_TIMEOUT_MS = void 0;
+exports.buildTimeoutMs = buildTimeoutMs;
+exports.buildTimeoutHint = buildTimeoutHint;
+exports.removeFailedRunContainer = removeFailedRunContainer;
+/**
+ * Upper bounds for the subprocesses pakstr runs, so a wedged Docker daemon, a
+ * stalled network or a hung Gradle build fails with a clear error instead of
+ * blocking the CLI (and CI jobs) forever. The limits are deliberately generous:
+ * they only exist to turn an indefinite hang into a failure.
+ */
+/** Docker daemon calls (inspect, create, rm, volume) that normally take seconds. */
+exports.DOCKER_COMMAND_TIMEOUT_MS = 2 * 60_000;
+/** `docker cp` of the Android workspace or an APK. */
+exports.DOCKER_COPY_TIMEOUT_MS = 10 * 60_000;
+/** The signing container (keystore derivation, apksigner, verification). */
+exports.DOCKER_SIGN_TIMEOUT_MS = 15 * 60_000;
+/** Gradle builds and builder image pulls, which can be slow on a cold cache. */
+exports.BUILD_TIMEOUT_ENV = "PAKSTR_BUILD_TIMEOUT_MINUTES";
+exports.DEFAULT_BUILD_TIMEOUT_MINUTES = 60;
+exports.DOCKER_DAEMON_HINT = "The Docker daemon may be unresponsive; check that Docker is running (`docker info`) and try again.";
+exports.DOCKER_COMMAND_OPTIONS = {
+    timeoutMs: exports.DOCKER_COMMAND_TIMEOUT_MS,
+    timeoutHint: exports.DOCKER_DAEMON_HINT,
+};
+exports.DOCKER_COPY_OPTIONS = {
+    timeoutMs: exports.DOCKER_COPY_TIMEOUT_MS,
+    timeoutHint: exports.DOCKER_DAEMON_HINT,
+};
+/**
+ * Build/pull timeout from PAKSTR_BUILD_TIMEOUT_MINUTES (default 60). `0`
+ * disables the limit and returns undefined.
+ */
+function buildTimeoutMs(env = process.env) {
+    const raw = env[exports.BUILD_TIMEOUT_ENV]?.trim();
+    if (!raw)
+        return exports.DEFAULT_BUILD_TIMEOUT_MINUTES * 60_000;
+    const minutes = Number(raw);
+    if (!/^\d+$/.test(raw) || !Number.isSafeInteger(minutes * 60_000)) {
+        throw new Error(`${exports.BUILD_TIMEOUT_ENV} must be a whole number of minutes (0 disables the limit), got "${raw}"`);
+    }
+    return minutes === 0 ? undefined : minutes * 60_000;
+}
+function buildTimeoutHint(step) {
+    return `If the ${step} needs longer, raise ${exports.BUILD_TIMEOUT_ENV} (0 disables the limit).`;
+}
+/**
+ * Remove the named container after its `docker run` failed. When the client is
+ * killed (timeout, output limit) the container keeps running, holding its
+ * volumes and any secrets in its environment; after other failures it is
+ * usually gone already, which counts as removed. Never throws, so the caller
+ * can rethrow the original failure.
+ */
+function removeFailedRunContainer(execute, container) {
+    try {
+        execute("docker", ["rm", "--force", container], exports.DOCKER_COMMAND_OPTIONS);
+    }
+    catch (error) {
+        // Older Docker versions fail `rm --force` for a container that is gone.
+        if (error instanceof Error && error.message.includes("No such container"))
+            return;
+        console.error(`Failed to remove container ${container} after docker run failed; ` +
+            `if it is still running, remove it with: docker rm --force ${container}`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -27,6 +27,7 @@
     "README.md"
   ],
   "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",
     "build": "tsc",
     "type-test": "tsc -p tsconfig.type-tests.json",
     "test": "npm run build && npm run type-test && node --test test/*.test.js",
@@ -54,9 +55,9 @@
     "applesauce-core": "^6.2.0",
     "applesauce-signers": "^6.2.2",
     "fs-extra": "^11.3.6",
-    "js-yaml": "^5.3.0",
+    "js-yaml": "^5.4.1",
     "node-fetch": "^3.3.2",
-    "sharp": "^0.35.3",
+    "sharp": "^0.35.5",
     "unzipper": "^0.12.5"
   },
   "repository": {