sproutboat 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -10,6 +10,35 @@ maintained going forward by the `release` skill.
 
 ## [Unreleased]
 
+## [0.10.2] - 2026-09-11
+### Fixed
+- The one-time Zig download no longer depends on ziglang.org being reachable.
+  It now pulls from a random Zig community mirror, with ziglang.org kept only
+  as a last resort, and tries the mirrors in turn on failure. ziglang.org
+  rate-limits the multi-megabyte tarballs and had been timing out mid-build,
+  with no fallback (baronunread/sproutboat#166). The archive sha256 is still
+  enforced whatever the source. `SPROUTBOAT_ZIG_URL` overrides the source;
+  `SPROUTBOAT_ZIG` still points at a prebuilt binary.
+- A leftover `~/.cache/sproutboat/zig-<version>/` directory from an earlier
+  cache layout is removed on the next build instead of sitting unused.
+
+## [0.10.1] - 2026-09-11
+### Fixed
+- `npm install sproutboat` / `bunx sproutboat` work again. 0.10.0's launcher
+  hard-required per-platform `@sproutboat/cli-*` packages that are not published
+  yet, so it always failed with "optional package … is missing". The launcher
+  now falls back to running `src/main.ts` with Bun when no platform binary is
+  installed (the v0.9.0 model), and `optionalDependencies` are dropped until the
+  binaries actually ship. 0.10.0 is deprecated on npm.
+- `sproutboat --version` and the deploy banner report the real version instead
+  of a hard-coded `0.9.0` when run from the npm package rather than a
+  `bun build --compile` binary.
+- `sproutboat build` / `deploy` locate `esbuild` via the installed dependency,
+  not just `process.execPath`'s directory, so bundling works on the Bun
+  fallback path.
+- The launcher no longer hangs when it receives `SIGINT` / `SIGTERM` while
+  forwarding a signal to a running platform binary.
+
 ## [0.10.0] - 2026-09-11
 ### Added
 - Per-platform native CLI: `npm install sproutboat` pulls a prebuilt binary for
@@ -341,7 +370,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.0...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.2...HEAD
+[0.10.2]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.1...v0.10.2
+[0.10.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.0...v0.10.1
 [0.10.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.7.0...v0.8.0

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.9.0 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.10.2 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -40,6 +40,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | `SPROUTBOAT_API_URL` | Control-plane URL. Overrides the saved active endpoint. |
 | `SPROUTBOAT_TOKEN` | API token. Overrides the saved credential for the endpoint. |
 | `SPROUTBOAT_ZIG` | Path to a Zig binary to use instead of downloading the pinned one. |
+| `SPROUTBOAT_ZIG_URL` | URL to download the pinned Zig tarball from, instead of a Zig community mirror. The sha256 is still enforced. |
 | `SPROUTBOAT_UWS_TARBALL` | Path to a uWebSockets source tarball to seed the Porffor cache with, instead of the one vendored in the package. Both targets are seeded from it. |
 | `CC` | C compiler used to build uSockets for a host build (default `cc`). A host build needs one regardless: it is what Porffor compiles its own generated C with. |
 | `AR` | Archiver used to assemble uSockets.a for a host build (default `ar`). |

package/bin/sproutboat.cjs

@@ -1,32 +1,50 @@
 #!/usr/bin/env node
-// npm only selects the packaged executable. The CLI itself always runs in Bun.
+// npm selects the packaged executable for this host when it is installed; that
+// is a native single-file binary that needs no Bun. When it is absent (it is
+// not published yet — see issue #134), fall back to running the TypeScript
+// entry point with Bun, which is how the CLI shipped through v0.9.0.
 const { spawn } = require("node:child_process");
-const { resolve } = require("node:path");
+const { join } = require("node:path");
 
 const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
 const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
-if (!platform || !arch) {
-  console.error(`sproutboat: unsupported platform ${process.platform}/${process.arch}`);
-  process.exit(1);
-}
-const packageName = `@sproutboat/cli-${platform}-${arch}`;
-let executable;
+
+let command;
+let args;
+let viaBun = false;
 try {
-  executable = require.resolve(`${packageName}/bin/sproutboat`);
+  if (!platform || !arch) throw new Error(`unsupported host ${process.platform}/${process.arch}`);
+  command = require.resolve(`@sproutboat/cli-${platform}-${arch}/bin/sproutboat`);
+  args = process.argv.slice(2);
 } catch {
-  console.error(`sproutboat: optional package ${packageName} is missing for ${platform}/${arch}`);
-  console.error("Reinstall sproutboat without --omit=optional, or use a direct release download.");
-  process.exit(1);
+  viaBun = true;
+  // SPROUTBOAT_BUN is an escape hatch for an unusual install; otherwise PATH.
+  command = process.env.SPROUTBOAT_BUN || "bun";
+  args = [join(__dirname, "..", "src", "main.ts"), ...process.argv.slice(2)];
 }
-const child = spawn(resolve(executable), process.argv.slice(2), { stdio: "inherit" });
+
+const child = spawn(command, args, { stdio: "inherit", windowsHide: true });
+
 child.once("error", (error) => {
-  console.error(`sproutboat: could not start bundled executable: ${error.message}`);
+  if (viaBun && error.code === "ENOENT") {
+    console.error("sproutboat: this build needs Bun on PATH. Install it: https://bun.sh");
+  } else {
+    console.error(`sproutboat: could not start: ${error.message}`);
+  }
   process.exit(1);
 });
+
 for (const signal of ["SIGINT", "SIGTERM"]) {
   process.on(signal, () => child.kill(signal));
 }
+
 child.once("exit", (code, signal) => {
-  if (signal) process.kill(process.pid, signal);
-  else process.exit(code ?? 1);
+  if (signal) {
+    // Re-raise so the parent's exit reflects the signal — but drop our own
+    // handler first, or the re-raise re-enters it and the process hangs.
+    process.removeAllListeners(signal);
+    process.kill(process.pid, signal);
+  } else {
+    process.exit(code ?? 1);
+  }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -76,12 +76,6 @@
     "oxlint": "1.81.0",
     "typescript": "7.0.2"
   },
-  "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.10.0",
-    "@sproutboat/cli-darwin-x64": "0.10.0",
-    "@sproutboat/cli-linux-arm64": "0.10.0",
-    "@sproutboat/cli-linux-x64": "0.10.0"
-  },
   "engines": {
     "node": ">=18"
   }

package/src/compile.ts

@@ -201,10 +201,21 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   const launcher = resolve(porffor, "runtime/index.js");
   // A host build never shells `zig`, so it has no zigBin to contribute.
   const zigDir = input.zigBin ? `${dirname(input.zigBin)}:` : "";
+  // The per-platform binary ships esbuild next to it; a compiled build finds it
+  // there. Running from the npm package under Bun, `process.execPath` is Bun
+  // itself and `npm i -g` puts no dependency `.bin` on PATH, so resolve the
+  // esbuild dependency directly. `Bun.which` is the last resort.
   const packagedEsbuild = resolve(dirname(process.execPath), "esbuild");
-  const esbuild = existsSync(packagedEsbuild) ? packagedEsbuild : Bun.which("esbuild");
-  if (!esbuild)
-    throw new Error("the packaged esbuild executable is missing; reinstall the Sproutboat platform package");
+  let esbuild: string | null = existsSync(packagedEsbuild) ? packagedEsbuild : null;
+  if (!esbuild) {
+    try {
+      esbuild = Bun.resolveSync("esbuild/bin/esbuild", import.meta.dir);
+    } catch {
+      esbuild = null;
+    }
+  }
+  esbuild ??= Bun.which("esbuild");
+  if (!esbuild) throw new Error("esbuild could not be located; install it or reinstall sproutboat");
   const path = `${zigDir}${dirname(esbuild)}:${process.env.PATH ?? ""}`;
   const command = PACKAGED
     ? [process.execPath, "__porffor", launcher]

package/src/report.ts

@@ -2,10 +2,13 @@ import { gzipSync } from "bun";
 import { resourceRefs, type SproutboatConfig } from "./config";
 import type { ArtifactManifest } from "./manifest";
 import { bold, dim, leaf, sprout } from "./style";
+import pkg from "../package.json" with { type: "json" };
 
-// `bun build --compile` has no package-relative filesystem at runtime. The
-// release build injects this value; source development keeps the package value.
-export const CLI_VERSION = process.env.SPROUTBOAT_CLI_VERSION ?? "0.9.0";
+// `bun build --compile` has no package-relative filesystem at runtime, so the
+// release build injects this via `--define`. Running from source (or the npm
+// package under Bun) falls back to the bundled package.json version — `bun build
+// --compile` inlines the JSON import, so this branch is correct there too.
+export const CLI_VERSION = process.env.SPROUTBOAT_CLI_VERSION ?? pkg.version;
 
 function bytes(n: number): string {
   if (n < 1024) return `${n} B`;

package/src/surface.ts

@@ -194,6 +194,11 @@ export const ENV_VARS: readonly EnvVar[] = [
   { name: "SPROUTBOAT_API_URL", purpose: "Control-plane URL. Overrides the saved active endpoint." },
   { name: "SPROUTBOAT_TOKEN", purpose: "API token. Overrides the saved credential for the endpoint." },
   { name: "SPROUTBOAT_ZIG", purpose: "Path to a Zig binary to use instead of downloading the pinned one." },
+  {
+    name: "SPROUTBOAT_ZIG_URL",
+    purpose:
+      "URL to download the pinned Zig tarball from, instead of a Zig community mirror. The sha256 is still enforced.",
+  },
   {
     name: "SPROUTBOAT_UWS_TARBALL",
     purpose:

package/src/toolchain.ts

@@ -2,8 +2,11 @@
  * The build toolchain: a pinned Zig (the linux-x86_64 cross-compiler Porffor
  * shells out to for `--musl`) plus version stamps for the artifact manifest.
  *
- * Zig is fetched once to ~/.cache/sproutboat/zig-<version>/ and reused. No
- * Docker, no root. Override with SPROUTBOAT_ZIG=/path/to/zig.
+ * Zig is fetched once to ~/.cache/sproutboat/zig-<version>-<platform>/ and
+ * reused. No Docker, no root. It comes from a random Zig community mirror with
+ * ziglang.org as the last resort, because ziglang.org rate-limits the large
+ * tarballs and has been timing out. Override the binary with
+ * SPROUTBOAT_ZIG=/path/to/zig, or the download source with SPROUTBOAT_ZIG_URL.
  */
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
@@ -101,24 +104,69 @@ async function zigComplete(dir: string, key: ZigPlatform, expectedArchive: strin
   }
 }
 
+// Zig asks tooling not to hammer ziglang.org for the multi-megabyte tarballs:
+// pick a random community mirror and keep the official host only as a last
+// resort. https://ziglang.org/download/community-mirrors.txt
+const ZIG_MIRRORS_URL = "https://ziglang.org/download/community-mirrors.txt";
+
+function shuffle<T>(items: T[]): T[] {
+  for (let i = items.length - 1; i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1));
+    [items[i], items[j]] = [items[j], items[i]];
+  }
+  return items;
+}
+
+/**
+ * Ordered list of URLs to try for the pinned Zig tarball: the community mirrors
+ * (shuffled) followed by ziglang.org. Falls back to ziglang.org alone if the
+ * mirror list itself is unreachable.
+ */
+async function zigDownloadUrls(
+  key: ZigPlatform,
+  fetcher: NonNullable<EnsureZigOptions["fetcher"]>,
+  timeoutMs: number,
+): Promise<string[]> {
+  const file = `zig-${key}-${ZIG_VERSION}.tar.xz`;
+  const official = `https://ziglang.org/download/${ZIG_VERSION}/${file}`;
+  try {
+    const response = await fetcher(ZIG_MIRRORS_URL, { signal: AbortSignal.timeout(Math.min(timeoutMs, 10_000)) });
+    if (response.ok) {
+      const mirrors = (await response.text())
+        .split(/\s+/)
+        .filter((line) => line.startsWith("https://"))
+        .map((base) => `${base.replace(/\/+$/, "")}/${file}`);
+      if (mirrors.length > 0) return [...shuffle(mirrors), official];
+    }
+  } catch {
+    // Mirror list unreachable: the official host is the only option left.
+  }
+  return [official];
+}
+
 async function downloadZig(
-  url: string,
+  urls: string[],
   path: string,
   fetcher: NonNullable<EnsureZigOptions["fetcher"]>,
   timeoutMs: number,
 ): Promise<void> {
-  let last: unknown;
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      const response = await fetcher(url, { signal: AbortSignal.timeout(timeoutMs) });
-      if (!response.ok) throw new Error(`HTTP ${response.status}`);
-      await writeFile(path, new Uint8Array(await response.arrayBuffer()));
-      return;
-    } catch (error) {
-      last = error;
+  // One shot per mirror; two at the single fallback URL so a lone flaky host
+  // still gets a retry.
+  const attemptsPer = urls.length > 1 ? 1 : 2;
+  const failures: string[] = [];
+  for (const url of urls) {
+    for (let attempt = 0; attempt < attemptsPer; attempt++) {
+      try {
+        const response = await fetcher(url, { signal: AbortSignal.timeout(timeoutMs) });
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        await writeFile(path, new Uint8Array(await response.arrayBuffer()));
+        return;
+      } catch (error) {
+        failures.push(`${url}: ${String(error)}`);
+      }
     }
   }
-  throw new ZigToolchainError("download", `could not download pinned Zig from ${url}: ${String(last)}`);
+  throw new ZigToolchainError("download", `could not download pinned Zig\n  ${failures.join("\n  ")}`);
 }
 
 async function waitForZigPublisher(
@@ -151,6 +199,10 @@ export async function ensureZig(options: EnsureZigOptions = {}): Promise<string>
   const root = resolve(
     options.cacheRoot ?? process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? resolve(homedir(), ".cache/sproutboat"),
   );
+  // Older builds cached Zig at `zig-<version>/` with no platform suffix; nothing
+  // reads that layout now, so drop it rather than leave it as dead weight.
+  const legacy = resolve(root, `zig-${ZIG_VERSION}`);
+  if (existsSync(legacy)) await rm(legacy, { recursive: true, force: true }).catch(() => {});
   const dir = resolve(root, `zig-${ZIG_VERSION}-${key}`);
   const expected = options.expectedSha256 ?? ZIG_SHA256[key];
   if (await zigComplete(dir, key, expected)) return resolve(dir, "zig");
@@ -164,14 +216,16 @@ export async function ensureZig(options: EnsureZigOptions = {}): Promise<string>
     return ensureZig(options);
   }
   const stage = resolve(root, `.zig-${ZIG_VERSION}-${key}-${process.pid}-${crypto.randomUUID()}`);
-  const url = options.url ?? `https://ziglang.org/download/${ZIG_VERSION}/zig-${key}-${ZIG_VERSION}.tar.xz`;
+  const fetcher = options.fetcher ?? fetch;
+  const sourceUrl = options.url ?? process.env.SPROUTBOAT_ZIG_URL;
+  const urls = sourceUrl ? [sourceUrl] : await zigDownloadUrls(key, fetcher, options.timeoutMs ?? 30_000);
   console.log(`Fetching Zig ${ZIG_VERSION} (${key}, one-time)...`);
   try {
     if (await zigComplete(dir, key, expected)) return resolve(dir, "zig");
     await rm(dir, { recursive: true, force: true });
     await mkdir(stage);
     const archive = resolve(stage, "zig.tar.xz");
-    await downloadZig(url, archive, options.fetcher ?? fetch, options.timeoutMs ?? 30_000);
+    await downloadZig(urls, archive, fetcher, options.timeoutMs ?? 60_000);
     const actual = await sha256File(archive);
     if (actual !== expected)
       throw new ZigToolchainError(