primo-cli 0.1.17 → 0.1.18

package/dist/commands/deploy.js

@@ -224,11 +224,13 @@ async function check_provider_auth(provider) {
         return false;
     }
 }
-// Pinned to the upstream-published image. primocms's main.yml workflow
-// publishes branch tags for whitelisted prefixes (main, feature/**, rc/**),
-// with slashes slugified to dashes (feature/local-dev-cli → :feature-local-dev-cli).
-// Bump to a release tag (:v3.0.0) when primocms cuts a stable release.
-const PRIMO_SERVER_IMAGE = 'ghcr.io/primocms/primo:main';
+// Track the latest stable release. primocms's tag.yml workflow publishes a
+// :latest image (alongside semver tags) on every version tag — the comment
+// there calls out that "Railway/self-host deployers follow this tag to track
+// releases". Following :latest means deploys pick up new releases on their next
+// rebuild without a per-release bump here. (main.yml still publishes branch tags
+// like :main / :feature-* for testing; :latest is the released line.)
+const PRIMO_SERVER_IMAGE = 'ghcr.io/primocms/primo:latest';
 async function generate_dockerfile(inventory) {
     // One-line Dockerfile: pull the published primo image and run it
     // unchanged. Workspace data (server.yaml, sites/, library/) is uploaded

package/dist/commands/dev.js

@@ -29,6 +29,12 @@ let last_import_time = 0; // Timestamp of last import completion
 let last_local_change_time = 0; // Timestamp of most recent local watcher event
 const importing_site_keys = new Set();
 const pending_local_site_keys = new Set();
+// Sites whose last import returned null (duplicate _ids across files — nothing
+// was pushed). They stay quarantined until a later import succeeds: no CMS→file
+// polling into them (a quarantined site is out of sync with the CMS, so copying
+// remote-only paths in could clobber the local files the user must edit to fix
+// the conflict). Cleared on the next successful import.
+const blocked_site_keys = new Set();
 let is_importing_library = false;
 let has_pending_library_local_changes = false;
 let site_sync_baselines = new Map();
@@ -618,6 +624,7 @@ export async function dev_server(options) {
         }
         // Normalize and load all sites
         spinner.text = `Loading ${sites.length} site${sites.length > 1 ? 's' : ''}...`;
+        const blocked_sites = new Set();
         for (const site of sites) {
             const use_bootstrap = !await site_exists(api_url, site.config.site_id);
             if (sync_policy.mode === 'cms' && !use_bootstrap) {
@@ -625,7 +632,17 @@ export async function dev_server(options) {
                 continue;
             }
             await normalize_site(site.dir);
+            const site_key = get_site_sync_key(site.dir, site.config);
             const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, use_bootstrap, base_dir));
+            if (import_timings === null) {
+                // Duplicate _ids — nothing was pushed; the watcher retries
+                // once the user removes a conflicting file. Quarantine it so
+                // CMS→file polling doesn't sync into an out-of-sync site.
+                blocked_sites.add(site.dir);
+                blocked_site_keys.add(site_key);
+                continue;
+            }
+            blocked_site_keys.delete(site_key);
             if (update_site_sync_state_after_import(site, import_timings, sync_policy)) {
                 await update_site_sync_baseline(site, api_url, server_config, base_dir);
             }
@@ -633,6 +650,8 @@ export async function dev_server(options) {
         // Verify all sites are accessible before proceeding
         spinner.text = 'Verifying sites...';
         for (const site of sites) {
+            if (blocked_sites.has(site.dir))
+                continue;
             await verify_site_ready(api_url, site.config.site_id);
         }
         spinner.succeed('Primo running');
@@ -816,6 +835,15 @@ export async function dev_server(options) {
                             }
                         }
                         const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, false, base_dir));
+                        if (import_timings === null) {
+                            // Duplicate _ids — import_site_files already printed the
+                            // error and wrote sync_status; nothing was pushed. Keep
+                            // the site quarantined from CMS→file polling.
+                            blocked_site_keys.add(get_site_sync_key(site.dir, site.config));
+                            return;
+                        }
+                        // Import succeeded — lift any prior quarantine.
+                        blocked_site_keys.delete(get_site_sync_key(site.dir, site.config));
                         let reload_ms = 0;
                         if (pending_reload) {
                             try {
@@ -974,7 +1002,12 @@ export async function dev_server(options) {
                     else {
                         await normalize_site(site.dir);
                         const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, use_bootstrap, base_dir));
-                        if (update_site_sync_state_after_import(site, import_timings, sync_policy)) {
+                        if (import_timings === null) {
+                            // Duplicate _ids on a freshly discovered site — quarantine
+                            // it from CMS→file polling until a later import succeeds.
+                            blocked_site_keys.add(get_site_sync_key(site.dir, site.config));
+                        }
+                        else if (update_site_sync_state_after_import(site, import_timings, sync_policy)) {
                             await update_site_sync_baseline(site, api_url, server_config, base_dir);
                         }
                     }
@@ -1013,7 +1046,9 @@ export async function dev_server(options) {
                     for (const site of sites) {
                         try {
                             const site_key = get_site_sync_key(site.dir, site.config);
-                            if (importing_site_keys.has(site_key) || pending_local_site_keys.has(site_key)) {
+                            if (importing_site_keys.has(site_key) ||
+                                pending_local_site_keys.has(site_key) ||
+                                blocked_site_keys.has(site_key)) {
                                 continue;
                             }
                             await sync_from_cms(site.dir, api_url, site.config, server_config, base_dir, sync_policy);
@@ -1678,19 +1713,19 @@ function describe_duplicate(category, id, occurrences) {
     const files = [...new Set(occurrences.map((occurrence) => occurrence.file))].sort();
     switch (category) {
         case 'pages':
-            return `duplicate page _id "${id}" in ${files.join(' and ')}; skipping those pages`;
+            return `duplicate page _id "${id}" in ${files.join(' and ')}`;
         case 'page_sections':
-            return `duplicate section _id "${id}" in ${files.join(' and ')}; skipping those pages`;
+            return `duplicate section _id "${id}" in ${files.join(' and ')}`;
         case 'blocks':
-            return `duplicate block _id "${id}" in ${files.join(' and ')}; skipping those blocks`;
+            return `duplicate block _id "${id}" in ${files.join(' and ')}`;
         case 'page_types':
-            return `duplicate page type _id "${id}" in ${files.join(' and ')}; skipping those page types`;
+            return `duplicate page type _id "${id}" in ${files.join(' and ')}`;
         case 'site_fields':
-            return `duplicate site field _id "${id}" in ${files.join(' and ')}; skipping site/fields.yaml`;
+            return `duplicate site field _id "${id}" in ${files.join(' and ')}`;
         case 'block_fields':
-            return `duplicate block field _id "${id}" in ${files.join(' and ')}; skipping those blocks`;
+            return `duplicate block field _id "${id}" in ${files.join(' and ')}`;
         case 'page_type_fields':
-            return `duplicate page type field _id "${id}" in ${files.join(' and ')}; skipping those page types`;
+            return `duplicate page type field _id "${id}" in ${files.join(' and ')}`;
     }
 }
 async function prepare_site_for_local_dev(site_dir) {
@@ -1854,8 +1889,31 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
     const site_id = config.site_id;
     const site_group = resolve_site_group(config, server_config);
     const preparation = await prepare_site_for_local_dev(site_dir);
-    for (const warning of preparation.warnings) {
-        console.log(chalk.yellow(`  ⚠ ${config.name}: ${warning}`));
+    if (preparation.warnings.length > 0) {
+        // Duplicate _ids (the only warning source in prepare_site_for_local_dev)
+        // would leave the server with stale/dangling state if we pushed anyway,
+        // so fail loudly instead of silently excluding the conflicting files.
+        for (const warning of preparation.warnings) {
+            console.log(chalk.red(`  ✖ ${config.name}: ${warning}`));
+        }
+        console.log(chalk.dim('    Remove one of the conflicting files and save to retry.'));
+        const message = preparation.warnings[0];
+        await write_sync_status(site_dir, {
+            ok: false,
+            error: message,
+            failed_at: new Date().toISOString()
+        });
+        try {
+            // Best-effort — older servers don't have this endpoint.
+            await fetch(`${api_url}/api/primo/dev/status`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ status: 'error', message }),
+                signal: AbortSignal.timeout(2000)
+            });
+        }
+        catch { }
+        return null;
     }
     // Create ZIP of site files
     const zip_started = Date.now();

package/dist/commands/pull.js

@@ -8,6 +8,10 @@ import { get_auth_token } from '../utils/auth.js';
 import { authenticate_interactively } from './login.js';
 import { write_site_config } from '../utils/site-config.js';
 import { read_server_config, write_server_config, normalize_server_url } from '../utils/server-config.js';
+// Directories owned by the server export. Local files under these that no
+// longer exist in the export are stale (e.g. a page that gained children
+// moved from pages/foo.yaml to pages/foo/index.yaml) and get trashed.
+const MANAGED_DIRS = ['pages', 'blocks', 'page-types', 'site'];
 async function detect_server() {
     const ports = [3000, 8080, 5173];
     for (const port of ports) {
@@ -209,8 +213,27 @@ async function pull_one_site(server, headers, site, site_dir, spinner) {
     const temp_zip = path.join(site_dir, '.primo-export.zip');
     await fs.writeFile(temp_zip, Buffer.from(zip_data));
     spinner.text = `Extracting ${site.name}...`;
-    await extract(temp_zip, { dir: site_dir });
-    await fs.unlink(temp_zip);
+    const temp_dir = path.join(site_dir, '.primo', `pull-temp-${Date.now()}`);
+    let trashed = [];
+    try {
+        await fs.mkdir(temp_dir, { recursive: true });
+        await extract(temp_zip, { dir: temp_dir });
+        await fs.unlink(temp_zip);
+        trashed = await reconcile_managed_dirs(site_dir, temp_dir);
+        await fs.cp(temp_dir, site_dir, { recursive: true });
+    }
+    finally {
+        await fs.rm(temp_dir, { recursive: true, force: true });
+        // Also drop the archive: on a successful pull it was already unlinked
+        // above, but if extract() threw it's still sitting in site_dir.
+        await fs.rm(temp_zip, { force: true });
+    }
+    if (trashed.length > 0) {
+        console.log(chalk.dim('  Removed stale files (moved to .primo/trash):'));
+        for (const trashed_path of trashed) {
+            console.log(chalk.dim(`    ${trashed_path}`));
+        }
+    }
     await write_site_config(site_dir, {
         name: site.name || 'Imported Site',
         site_id: site.id,
@@ -220,6 +243,92 @@ async function pull_one_site(server, headers, site, site_dir, spinner) {
     await copy_schemas(site_dir);
     await add_schema_references(site_dir);
 }
+// Move local files under MANAGED_DIRS that have no counterpart in the fresh
+// export into .primo/trash/pull-<ts>/, then remove newly-empty directories
+// (best-effort). Returns the trashed paths relative to the site dir.
+async function reconcile_managed_dirs(site_dir, temp_dir) {
+    const trashed = [];
+    const stamp = Date.now();
+    for (const dir of MANAGED_DIRS) {
+        const local_root = path.join(site_dir, dir);
+        const temp_root = path.join(temp_dir, dir);
+        for (const relative of await list_files_recursive(local_root)) {
+            // Keep the local file only if the export still has a *file* at the
+            // same path. If the counterpart is now a directory (a file→dir
+            // transition, e.g. pages/foo.yaml became pages/foo/…), the local
+            // file is stale and must be trashed — otherwise the later fs.cp
+            // can't lay a directory over the surviving file and the pull fails.
+            try {
+                const counterpart = await fs.stat(path.join(temp_root, relative));
+                if (counterpart.isFile())
+                    continue;
+            }
+            catch {
+                // Missing from the export — stale.
+            }
+            const local_path = path.join(local_root, relative);
+            // Scope the trash path by the managed dir. Two managed dirs can hold
+            // the same relative name (pages/config.yaml, blocks/config.yaml);
+            // without the dir segment they'd collide at trash/pull-<ts>/config.yaml
+            // and the second move would clobber the first while both are reported.
+            const trash_path = path.join(site_dir, '.primo', 'trash', `pull-${stamp}`, dir, relative);
+            await fs.mkdir(path.dirname(trash_path), { recursive: true });
+            try {
+                await fs.rename(local_path, trash_path);
+            }
+            catch {
+                // Cross-device move — fall back to copy + delete.
+                await fs.copyFile(local_path, trash_path);
+                await fs.unlink(local_path);
+            }
+            trashed.push(`${dir}/${relative}`);
+        }
+        await remove_empty_dirs(local_root);
+    }
+    return trashed;
+}
+async function list_files_recursive(root, prefix = '') {
+    let entries;
+    try {
+        entries = await fs.readdir(root, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const files = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith('.'))
+            continue;
+        const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            files.push(...await list_files_recursive(path.join(root, entry.name), relative));
+        }
+        else if (entry.isFile()) {
+            files.push(relative);
+        }
+    }
+    return files;
+}
+// Remove empty directories bottom-up. rmdir on a non-empty dir fails, which
+// we ignore — only newly-emptied dirs go away.
+async function remove_empty_dirs(root) {
+    let entries;
+    try {
+        entries = await fs.readdir(root, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            await remove_empty_dirs(path.join(root, entry.name));
+        }
+    }
+    try {
+        await fs.rmdir(root);
+    }
+    catch { }
+}
 async function pull_library_into(server, headers, root_dir, spinner) {
     spinner.start('Pulling library...');
     const response = await fetch(`${server}/api/primo/export-library`, { headers });

package/dist/commands/push.js

@@ -333,14 +333,12 @@ async function try_bootstrap_site(server, token, zip_buffer, config, site_id, gr
         form.append('group', config.group);
     if (group_name)
         form.append('group_name', group_name);
-    // Register the site against the deploy URL's host so the first visit to
-    // that domain finds a matching site instead of dropping into CreateSite.
-    try {
-        form.append('host', new URL(server).host);
-    }
-    catch {
-        // Malformed server URL — let the server fall back to its own default.
-    }
+    // Host is intentionally not sent. A pushed site is created unassigned —
+    // the server seeds `host` with a placeholder (the site's own id) so the
+    // site is editable in the dashboard but not publicly served until an
+    // operator assigns a real domain. The lone exception is bootstrap of the
+    // very first site on a fresh instance, where the server falls back to the
+    // deploy URL's host so that instance's front door resolves immediately.
     form.append('file', new Blob([zip_buffer]), 'site.zip');
     const headers = {};
     if (token)

package/dist/utils/binary.js

@@ -9,7 +9,64 @@ import ora from 'ora';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PRIMO_HOME = path.join(os.homedir(), '.primo');
 const BIN_DIR = path.join(PRIMO_HOME, 'bin');
-const VERSION = '3.2.3'; // matches primo releases
+const REPO = 'primocms/primo';
+// Resolve the latest primo release tag at runtime rather than pinning a version
+// here — a pinned constant silently goes stale (it sat on 3.2.3 through two
+// releases). Cached for the process so repeated calls in one CLI run don't
+// re-hit the API. Bounded by a 10s timeout so an already-installed binary can
+// still be reused promptly when GitHub is slow or unreachable.
+let latest_version_cache;
+async function get_latest_version() {
+    if (latest_version_cache !== undefined)
+        return latest_version_cache;
+    try {
+        const res = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+            headers: { Accept: 'application/vnd.github+json' },
+            // Node 18+ ships AbortSignal.timeout; keeps the version check from
+            // hanging CLI startup when GitHub stalls.
+            signal: AbortSignal.timeout(10_000)
+        });
+        // Rate limits come back as 403 or 429. Detect them the way GitHub's docs
+        // prescribe, since no single signal covers every case:
+        //   - primary limit: 403 with x-ratelimit-remaining: 0
+        //   - secondary limit: 403/429 with a Retry-After header, or a body
+        //     message mentioning a secondary rate limit (remaining may be > 0)
+        //   - 429 is always a rate limit
+        // Treat all of these as "can't tell", never a definitive version —
+        // otherwise a throttled run would mask an outdated binary as current. A
+        // plain 403 with quota remaining (e.g. a genuine permission error) is a
+        // real "unavailable" verdict, not a throttle.
+        if (res.status === 403 || res.status === 429) {
+            const remaining = res.headers.get('x-ratelimit-remaining');
+            const retry_after = res.headers.get('retry-after');
+            let rate_limited = res.status === 429 || remaining === '0' || retry_after !== null;
+            if (!rate_limited) {
+                // Last resort: peek at the body for the secondary-limit message.
+                const body = await res.text().catch(() => '');
+                rate_limited = /secondary rate limit|rate limit/i.test(body);
+            }
+            latest_version_cache = rate_limited
+                ? { status: 'throttled', reason: `GitHub rate limit (${res.status})` }
+                : { status: 'unavailable' };
+            return latest_version_cache;
+        }
+        if (!res.ok)
+            throw new Error(`GitHub API ${res.status}`);
+        const data = (await res.json());
+        const version = parse_semver(data.tag_name ?? null);
+        latest_version_cache = version ? { status: 'resolved', version } : { status: 'unavailable' };
+    }
+    catch (err) {
+        // Timeout / DNS / connection reset — indistinguishable from being
+        // offline. Treat as throttled (can't confirm) so we don't force a
+        // needless re-download of a working binary.
+        latest_version_cache = {
+            status: 'throttled',
+            reason: err instanceof Error ? err.message : 'network error'
+        };
+    }
+    return latest_version_cache;
+}
 // Path to locally built binary (for development)
 // The binary is at primo/primo (inside the primo repo directory)
 const LOCAL_BINARY = path.resolve(__dirname, '..', '..', '..', 'primo', 'primo');
@@ -46,9 +103,12 @@ function get_platform() {
     return { os: osName, arch: archName, ext };
 }
 function get_download_url(platform) {
-    const base = 'https://github.com/primocms/primo/releases/download';
+    // /releases/latest/download/<asset> 302-redirects to the newest release's
+    // asset, so we never name a version here — the binary always tracks the
+    // latest published release. fetch() follows the redirect automatically.
+    const base = `https://github.com/${REPO}/releases/latest/download`;
     const filename = `primo_${platform.os}_${platform.arch}${platform.ext}`;
-    return `${base}/v${VERSION}/${filename}`;
+    return `${base}/${filename}`;
 }
 // Extract a bare semver (e.g. "3.2.1") from a binary's --version output.
 // The server prints a build banner first, then "<name> version vX.Y.Z", so we
@@ -113,8 +173,8 @@ export async function ensure_binary() {
         return LOCAL_BINARY;
     }
     catch { }
-    // A managed binary already on disk is reused only when it matches the pinned
-    // version. A stale binary (older release, or a pre-rename "palacms" build
+    // A managed binary already on disk is reused only when it matches the latest
+    // release. A stale binary (older release, or a pre-rename "palacms" build
     // reporting a different version) is re-downloaded so fixes actually reach
     // users who already have a binary installed.
     let updating_from = null;
@@ -127,8 +187,17 @@ export async function ensure_binary() {
     // Need to download - get the target path
     const platform = get_platform();
     const binary_path = path.join(BIN_DIR, `primo${platform.ext}`);
+    // Resolve the target version for display only (the download URL follows the
+    // /latest redirect regardless). Falls back to "latest" when we couldn't
+    // confirm the tag; surface a throttle notice so a rate-limited check isn't
+    // silent.
+    const lookup = await get_latest_version();
+    const target_version = lookup.status === 'resolved' ? lookup.version : 'latest';
+    if (lookup.status === 'throttled') {
+        console.log(chalk.dim(`  (couldn't confirm latest version: ${lookup.reason}; downloading current release)`));
+    }
     const spinner = ora(updating_from
-        ? `Updating primo ${updating_from} → ${VERSION}...`
+        ? `Updating primo ${updating_from} → ${target_version}...`
         : 'Setting up Primo...').start();
     try {
         // Create directories
@@ -148,7 +217,7 @@ export async function ensure_binary() {
         // Make executable, then atomically replace any existing binary.
         await fs.chmod(tmp_path, 0o755);
         await fs.rename(tmp_path, binary_path);
-        spinner.succeed(updating_from ? `Primo updated to ${VERSION}` : 'Primo setup complete');
+        spinner.succeed(updating_from ? `Primo updated to ${target_version}` : 'Primo setup complete');
         return binary_path;
     }
     catch (error) {
@@ -184,5 +253,15 @@ export async function get_binary_version() {
 // developer-chosen and must not be clobbered by a download.
 async function is_binary_current() {
     const installed = await get_binary_version();
-    return installed === VERSION;
+    if (!installed)
+        return false;
+    const latest = await get_latest_version();
+    // resolved  → compare versions.
+    // throttled → can't confirm (rate-limited / offline); keep the installed
+    //             binary rather than thrashing a re-download, and it'll refresh
+    //             on the next unthrottled run.
+    // unavailable → no usable release to compare against; keep what's on disk.
+    if (latest.status !== 'resolved')
+        return true;
+    return installed === latest.version;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primo-cli",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Local development CLI for Primo",
   "type": "module",
   "bin": {