update.sh
Rama master · réplica de lectura del repositorio original.
#!/usr/bin/env bash
# update.sh — one-click update: pull latest + update LS binary + restart PM2
set -e
cd "$(dirname "$0")"
PORT="${PORT:-3003}"
NAME="${PM2_NAME:-windsurf-api}"
# Cross-process serialization for update.sh. mkdir is atomic on every platform
# supported by this script (including macOS hosts without flock). A second
# updater must fail before fetch/stash/reset rather than relying on git's index
# lock after rollback metadata and service lifecycle have already raced.
GIT_DIR_PATH="$(git rev-parse --git-dir)"
UPDATE_LOCK_DIR="$GIT_DIR_PATH/windsurfapi-update.lock"
UPDATE_LOCK_TOKEN="$$-$(date +%s)-${RANDOM}-${RANDOM}"
UPDATE_TARGET_TREE_TMP=""
UPDATE_TAG_LIST_TMP=""
UPDATE_IGNORED_ROOTS_TMP=""
UPDATE_IGNORED_PATHS_TMP=""
OWNED_STASH_OID=""
SERVICE_STOP_FAILED=0
lock_process_is_alive() {
local candidate_pid="$1"
if kill -0 "$candidate_pid" 2>/dev/null; then
return 0
fi
# kill -0 also fails with EPERM when another user owns a live process. Only
# recover when a second read-only process-table check proves the PID absent;
# if ps is unavailable or inconclusive, stay fail-closed.
if command -v ps >/dev/null 2>&1; then
[ -n "$(ps -p "$candidate_pid" -o pid= 2>/dev/null || true)" ] && return 0
return 1
fi
return 0
}
acquire_update_lock() {
if mkdir "$UPDATE_LOCK_DIR" 2>/dev/null; then
return 0
fi
# Recover only a lock whose numeric owner PID is provably gone. Missing,
# malformed, inaccessible, or still-live ownership stays fail-closed.
local lock_pid="" lock_token="" legacy="0"
if [ -r "$UPDATE_LOCK_DIR/owner" ]; then
read -r lock_pid lock_token < "$UPDATE_LOCK_DIR/owner" || true
[[ "$lock_pid" =~ ^[0-9]+$ ]] || return 1
[[ "$lock_token" =~ ^[A-Za-z0-9._-]+$ ]] || return 1
elif [ -r "$UPDATE_LOCK_DIR/pid" ]; then
IFS= read -r lock_pid < "$UPDATE_LOCK_DIR/pid" || true
legacy="1"
lock_token="legacy"
else
return 1
fi
[[ "$lock_pid" =~ ^[0-9]+$ ]] || return 1
lock_process_is_alive "$lock_pid" && return 1
# O_EXCL recovery claim closes the stale-lock ABA: exactly one contender may
# rename the still-existing stale directory. A crash in this tiny recovery
# window intentionally leaves a fail-closed claim for manual inspection.
local claim_path="$UPDATE_LOCK_DIR/recovery"
if ! ( set -o noclobber; printf '%s %s\n' "$$" "$UPDATE_LOCK_TOKEN" > "$claim_path" ) 2>/dev/null; then
return 1
fi
local verify_pid="" verify_token="" verify_legacy="0"
if [ -r "$UPDATE_LOCK_DIR/owner" ]; then
read -r verify_pid verify_token < "$UPDATE_LOCK_DIR/owner" || true
elif [ -r "$UPDATE_LOCK_DIR/pid" ]; then
IFS= read -r verify_pid < "$UPDATE_LOCK_DIR/pid" || true
verify_token="legacy"
verify_legacy="1"
fi
if [ "$verify_pid" != "$lock_pid" ] || [ "$verify_token" != "$lock_token" ] || [ "$verify_legacy" != "$legacy" ]; then
rm -f "$claim_path"
return 1
fi
local quarantine="$UPDATE_LOCK_DIR.stale-$UPDATE_LOCK_TOKEN"
if ! mv "$UPDATE_LOCK_DIR" "$quarantine" 2>/dev/null; then
rm -f "$claim_path"
return 1
fi
rm -f "$quarantine/recovery" "$quarantine/owner" "$quarantine/pid"
rmdir "$quarantine" 2>/dev/null || true
if mkdir "$UPDATE_LOCK_DIR" 2>/dev/null; then
return 0
fi
return 1
}
if ! acquire_update_lock; then
echo "✗ Another WindsurfAPI update is already in progress ($UPDATE_LOCK_DIR)"
exit 1
fi
if ! ( set -o noclobber; printf '%s %s\n' "$$" "$UPDATE_LOCK_TOKEN" > "$UPDATE_LOCK_DIR/owner" ) 2>/dev/null; then
rmdir "$UPDATE_LOCK_DIR" 2>/dev/null || true
echo "✗ Could not initialize WindsurfAPI update lock ownership"
exit 1
fi
if ! ( set -o noclobber; printf '%s\n' "$$" > "$UPDATE_LOCK_DIR/pid" ) 2>/dev/null; then
rm -f "$UPDATE_LOCK_DIR/owner"
rmdir "$UPDATE_LOCK_DIR" 2>/dev/null || true
echo "✗ Could not initialize WindsurfAPI update lock compatibility PID"
exit 1
fi
cleanup_update_lock() {
local owner_pid="" owner_token=""
[ -r "$UPDATE_LOCK_DIR/owner" ] || return 0
read -r owner_pid owner_token < "$UPDATE_LOCK_DIR/owner" || true
[ "$owner_pid" = "$$" ] && [ "$owner_token" = "$UPDATE_LOCK_TOKEN" ] || return 0
rm -f "$UPDATE_LOCK_DIR/owner" "$UPDATE_LOCK_DIR/pid"
rmdir "$UPDATE_LOCK_DIR" 2>/dev/null || true
}
cleanup_ignored_target_probe_files() {
[ -n "$UPDATE_TARGET_TREE_TMP" ] && rm -f -- "$UPDATE_TARGET_TREE_TMP"
[ -n "$UPDATE_IGNORED_ROOTS_TMP" ] && rm -f -- "$UPDATE_IGNORED_ROOTS_TMP"
[ -n "$UPDATE_IGNORED_PATHS_TMP" ] && rm -f -- "$UPDATE_IGNORED_PATHS_TMP"
UPDATE_TARGET_TREE_TMP=""
UPDATE_IGNORED_ROOTS_TMP=""
UPDATE_IGNORED_PATHS_TMP=""
return 0
}
cleanup_update_probe_files() {
cleanup_ignored_target_probe_files
[ -n "$UPDATE_TAG_LIST_TMP" ] && rm -f -- "$UPDATE_TAG_LIST_TMP"
UPDATE_TAG_LIST_TMP=""
# An empty final path is a normal no-op. Keep the EXIT trap successful so a
# completed update does not return 1 (and skip lock cleanup) under `set -e`.
return 0
}
cleanup_update_state() {
cleanup_update_probe_files
cleanup_update_lock
}
trap cleanup_update_state EXIT
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM
check_ignored_target_conflicts() {
local target_commit="$1"
local -a target_paths=()
local -a target_paths_folded=()
local -a roots_folded=()
local -a local_roots=()
local -a local_pathspecs=()
local -a conflicts=()
local path="" folded="" root="" root_folded="" existing="" ignored="" ignored_root="" left="" right="" duplicate="0"
local i=0
cleanup_ignored_target_probe_files
UPDATE_TARGET_TREE_TMP="$(mktemp "$GIT_DIR_PATH/windsurfapi-target-tree.XXXXXX")" || return 2
UPDATE_IGNORED_ROOTS_TMP="$(mktemp "$GIT_DIR_PATH/windsurfapi-ignored-roots.XXXXXX")" || return 2
UPDATE_IGNORED_PATHS_TMP="$(mktemp "$GIT_DIR_PATH/windsurfapi-ignored-paths.XXXXXX")" || return 2
if ! git ls-tree -r -z --name-only "$target_commit" > "$UPDATE_TARGET_TREE_TMP"; then
echo " ! could not inspect the update target tree; refusing a destructive checkout"
return 2
fi
while IFS= read -r -d '' path; do
target_paths+=("$path")
folded="$(printf '%s' "$path" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
target_paths_folded+=("$folded")
root="${path%%/*}"
root_folded="$(printf '%s' "$root" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
duplicate="0"
for existing in "${roots_folded[@]}"; do
[ "$existing" = "$root_folded" ] && duplicate="1" && break
done
if [ "$duplicate" = "0" ]; then
roots_folded+=("$root_folded")
fi
done < "$UPDATE_TARGET_TREE_TMP"
[ "${#target_paths[@]}" -gt 0 ] || return 0
# Inventory ignored roots in collapsed form first. This avoids descending
# into wholly ignored trees such as node_modules while discovering the real
# on-disk spelling of roots whose case differs from the target. Do not trust
# core.ignorecase here: it can be absent or stale on a case-insensitive FS.
if ! git ls-files --others --ignored --exclude-standard --directory -z > "$UPDATE_IGNORED_ROOTS_TMP"; then
echo " ! could not inventory ignored runtime roots; refusing a destructive checkout"
return 2
fi
while IFS= read -r -d '' ignored; do
ignored="${ignored%/}"
ignored_root="${ignored%%/*}"
left="$(printf '%s' "$ignored_root" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
duplicate="0"
for right in "${roots_folded[@]}"; do
[ "$left" = "$right" ] || continue
for existing in "${local_roots[@]}"; do
[ "$existing" = "$ignored_root" ] && duplicate="1" && break
done
if [ "$duplicate" = "0" ]; then
local_roots+=("$ignored_root")
local_pathspecs+=(":(top,literal)$ignored_root")
fi
break
done
done < "$UPDATE_IGNORED_ROOTS_TMP"
[ "${#local_roots[@]}" -gt 0 ] || return 0
if ! git ls-files --others --ignored --exclude-standard -z -- "${local_pathspecs[@]}" > "$UPDATE_IGNORED_PATHS_TMP"; then
echo " ! could not inspect ignored runtime paths; refusing a destructive checkout"
return 2
fi
while IFS= read -r -d '' ignored; do
left="$(printf '%s' "$ignored" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
for ((i = 0; i < ${#target_paths_folded[@]}; i++)); do
right="${target_paths_folded[$i]}"
if [ "$left" = "$right" ] || [[ "$left" == "$right/"* ]] || [[ "$right" == "$left/"* ]]; then
conflicts+=("$ignored")
break
fi
done
done < "$UPDATE_IGNORED_PATHS_TMP"
if [ "${#conflicts[@]}" -gt 0 ]; then
echo " ! update target would overwrite ignored runtime data; move or back up these paths first:"
local shown="0"
for path in "${conflicts[@]}"; do
echo " $path"
shown=$((shown + 1))
[ "$shown" -ge 20 ] && break
done
return 1
fi
return 0
}
stable_tag_is_newer() {
local left="${1#v}" right="${2#v}"
local left_major="" left_minor="" left_patch=""
local right_major="" right_minor="" right_patch=""
IFS=. read -r left_major left_minor left_patch <<< "$left"
IFS=. read -r right_major right_minor right_patch <<< "$right"
local -a left_parts=("$left_major" "$left_minor" "$left_patch")
local -a right_parts=("$right_major" "$right_minor" "$right_patch")
local index="0" position="0" left_part="" right_part="" left_digit="" right_digit=""
while [ "$index" -lt 3 ]; do
left_part="${left_parts[$index]}"
right_part="${right_parts[$index]}"
if [ "${#left_part}" -ne "${#right_part}" ]; then
[ "${#left_part}" -gt "${#right_part}" ]
return
fi
if [ "$left_part" != "$right_part" ]; then
position="0"
while [ "$position" -lt "${#left_part}" ]; do
left_digit="${left_part:$position:1}"
right_digit="${right_part:$position:1}"
if [ "$left_digit" != "$right_digit" ]; then
[ "$left_digit" -gt "$right_digit" ]
return
fi
position=$((position + 1))
done
fi
index=$((index + 1))
done
return 1
}
is_git_object_id() {
local oid="$1"
[[ "$oid" =~ ^[0-9a-f]+$ ]] || return 1
[ "${#oid}" -eq 40 ] || [ "${#oid}" -eq 64 ]
}
is_nonnegative_git_count() {
local value="$1"
[[ "$value" =~ ^(0|[1-9][0-9]*)$ ]] || return 1
# Bash's `[` accepts decimal strings syntactically but emits `integer
# expected` and returns false for values outside its signed integer range.
# Every caller branches on the result, so accepting an oversized count here
# would turn an unknown count into zero and could allow a destructive reset.
# Keep the bound below both Bash's range and JavaScript's safe-integer limit,
# and reject before any arithmetic comparison is attempted.
[ "${#value}" -le 16 ] || return 1
if [ "${#value}" -eq 16 ] && [ "$value" -gt 9007199254740991 ]; then
return 1
fi
return 0
}
port_listener_probe() {
local output="" rc=0
if command -v ss >/dev/null 2>&1; then
if ! output="$(ss -ltn 2>/dev/null)"; then
return 2
fi
printf '%s\n' "$output" | grep -q ":$PORT "
return $?
fi
if command -v lsof >/dev/null 2>&1; then
lsof -nP -iTCP:"$PORT" -sTCP:LISTEN -t >/dev/null 2>&1
rc=$?
[ "$rc" -eq 0 ] && return 0
[ "$rc" -eq 1 ] && return 1
return 2
fi
return 2
}
pm2_process_is_live() {
local pids="" pid="" found=""
PM2_LIVE_PID=""
if ! pids="$(pm2 pid "$NAME" 2>/dev/null)"; then
return 1
fi
while IFS= read -r pid; do
[[ "$pid" =~ ^[1-9][0-9]*$ ]] || continue
if kill -0 "$pid" 2>/dev/null; then
[ -z "$found" ] || return 1
found="$pid"
fi
done <<< "$pids"
[ -n "$found" ] || return 1
PM2_LIVE_PID="$found"
return 0
}
# A rollback must prove that the failed target is no longer represented by the
# named PM2 app before Git moves the checkout back. Real PM2 exits successfully
# and prints an empty result for a deleted name, while a stopped entry reports
# `0`. Any positive PID is still a PM2 record even when that OS process has just
# died: accepting it based on `kill -0` would race PM2's restart/accounting and
# could move Git underneath a process that comes back from the failed target.
pm2_named_process_is_absent() {
local pids="" pid=""
if ! pids="$(pm2 pid "$NAME" 2>/dev/null)"; then
return 1
fi
while IFS= read -r pid; do
[ -z "$pid" ] && continue
[ "$pid" = "0" ] && continue
return 1
done <<< "$pids"
return 0
}
health_response_matches_commit() {
local body="$1" expected="$2" expected_pid="$3"
[[ "$expected_pid" =~ ^[1-9][0-9]*$ ]] || return 1
[[ "$expected" =~ ^([0-9a-fA-F]{40}|[0-9a-fA-F]{64})$ ]] || return 1
if command -v node >/dev/null 2>&1; then
printf '%s' "$body" | node -e '
const fs = require("node:fs");
let body;
try { body = JSON.parse(fs.readFileSync(0, "utf8")); } catch { process.exit(1); }
const expectedCommit = process.argv[1].toLowerCase();
const expectedPid = Number(process.argv[2]);
const actualCommit = typeof body?.commit === "string"
? body.commit.trim().toLowerCase()
: "";
const commitMatches = /^[0-9a-f]{7,64}$/.test(actualCommit)
&& (actualCommit === expectedCommit || expectedCommit.startsWith(actualCommit));
if (!body || Array.isArray(body) || body.status !== "ok" || !commitMatches
|| !Number.isSafeInteger(body.pid) || body.pid !== expectedPid) process.exit(1);
' "$expected" "$expected_pid" >/dev/null 2>&1
return $?
fi
if command -v jq >/dev/null 2>&1; then
printf '%s' "$body" | jq -e --arg expected "$expected" --argjson expectedPid "$expected_pid" \
'type == "object" and .status == "ok" and (.commit | type == "string") and
((.commit | ascii_downcase) as $actual |
($expected | ascii_downcase) as $wanted |
($actual | test("^[0-9a-f]{7,64}$")) and
($actual == $wanted or ($wanted | startswith($actual)))) and
(.pid | type == "number") and .pid == $expectedPid' \
>/dev/null 2>&1
return $?
fi
return 1
}
if ! command -v pm2 >/dev/null 2>&1; then
echo "✗ pm2 is required for a safe update; refusing to mutate Git or the LS installation"
exit 1
fi
echo "=== [1/5] Pull latest ==="
# Fetch only the release branch here. Published-tag authority comes from
# `ls-remote` below; importing/pruning the remote tag namespace would either keep
# revoked local refs alive or destroy operator-owned local tags.
git fetch --quiet --no-tags origin master
BEFORE=$(git rev-parse HEAD)
REMOTE_HEAD=$(git rev-parse origin/master)
DIRTY=$(git status --porcelain)
FORCE_RESET="${WINDSURFAPI_UPDATE_FORCE_RESET:-0}"
FORCE_UPDATE="${WINDSURFAPI_UPDATE_FORCE:-0}"
# 版本门禁（tag gate）: normal OTA installs the newest published tag, not
# origin/master HEAD. Post-tag release notes, generated assets, and work for
# the next release must not make the published release impossible to install.
# WINDSURFAPI_UPDATE_FORCE=1 explicitly opts into the untagged branch HEAD.
# Filter exact stable semver before choosing. The remote ref namespace is the
# publication authority: `git fetch --tags` never removes a revoked tag, so
# selecting from `git tag --list` can reinstall a release deleted upstream.
# Each candidate is fetched only into FETCH_HEAD, preserving all local tags.
LATEST_TAG=""
RELEASE_COMMIT=""
UPDATE_TAG_LIST_TMP="$(mktemp "$GIT_DIR_PATH/windsurfapi-release-tags.XXXXXX")"
if ! git ls-remote --tags origin 'refs/tags/v[0-9]*' > "$UPDATE_TAG_LIST_TMP"; then
echo " ! could not verify published release tags; refusing update"
exit 1
fi
REMOTE_TAG_NAMES=()
REMOTE_TAG_OBJECTS=()
REMOTE_TAG_PEELED=()
while IFS= read -r advertised_line || [ -n "$advertised_line" ]; do
if [[ "$advertised_line" != *$'\t'* ]] || [[ "${advertised_line#*$'\t'}" == *$'\t'* ]]; then
echo " ! remote tag enumeration returned a malformed record; refusing update"
exit 1
fi
advertised_oid="${advertised_line%%$'\t'*}"
advertised_ref="${advertised_line#*$'\t'}"
if [ -z "$advertised_oid" ] || [ -z "$advertised_ref" ] \
|| ! is_git_object_id "$advertised_oid" || [[ "$advertised_ref" != refs/tags/* ]]; then
echo " ! remote tag enumeration returned a malformed record; refusing update"
exit 1
fi
advertised_name="${advertised_ref#refs/tags/}"
advertised_peeled="0"
if [[ "$advertised_name" == *'^{}' ]]; then
advertised_name="${advertised_name:0:${#advertised_name}-3}"
advertised_peeled="1"
fi
if [ -z "$advertised_name" ] || [[ "$advertised_name" == .* ]] \
|| [[ "$advertised_name" == *. ]] || [[ "$advertised_name" == */ ]] \
|| [[ "$advertised_name" == *'..'* ]] || [[ "$advertised_name" == *'//'* ]] \
|| [[ "$advertised_name" == *'@{'* ]] || [[ "$advertised_name" =~ [[:space:]~^:?*\[\\] ]]; then
echo " ! remote tag enumeration returned an invalid ref name; refusing update"
exit 1
fi
[[ "$advertised_name" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || continue
advertised_index="-1"
for index in "${!REMOTE_TAG_NAMES[@]}"; do
if [ "${REMOTE_TAG_NAMES[$index]}" = "$advertised_name" ]; then
advertised_index="$index"
break
fi
done
if [ "$advertised_peeled" = "1" ]; then
if [ "$advertised_index" -lt 0 ] || [ -n "${REMOTE_TAG_PEELED[$advertised_index]:-}" ]; then
echo " ! remote tag enumeration returned an orphan/duplicate peeled ref; refusing update"
exit 1
fi
REMOTE_TAG_PEELED[$advertised_index]="$advertised_oid"
else
if [ "$advertised_index" -ge 0 ]; then
echo " ! remote tag enumeration returned a duplicate tag ref; refusing update"
exit 1
fi
REMOTE_TAG_NAMES+=("$advertised_name")
REMOTE_TAG_OBJECTS+=("$advertised_oid")
REMOTE_TAG_PEELED+=("")
fi
done < "$UPDATE_TAG_LIST_TMP"
# Consider stable versions from newest to oldest, selecting the first whose
# exact remote object peels correctly and is reachable from origin/master.
REMOTE_TAG_USED=()
while true; do
newest_index="-1"
for index in "${!REMOTE_TAG_NAMES[@]}"; do
[ "${REMOTE_TAG_USED[$index]:-0}" = "1" ] && continue
if [ "$newest_index" -lt 0 ] || stable_tag_is_newer "${REMOTE_TAG_NAMES[$index]}" "${REMOTE_TAG_NAMES[$newest_index]}"; then
newest_index="$index"
fi
done
[ "$newest_index" -ge 0 ] || break
REMOTE_TAG_USED[$newest_index]="1"
candidate="${REMOTE_TAG_NAMES[$newest_index]}"
expected_object="${REMOTE_TAG_OBJECTS[$newest_index]}"
expected_peeled="${REMOTE_TAG_PEELED[$newest_index]:-}"
if ! git fetch --quiet --no-tags origin "refs/tags/$candidate"; then
echo " ! could not fetch remote release tag $candidate; refusing update"
exit 1
fi
if ! fetched_object=$(git rev-parse FETCH_HEAD 2>/dev/null) \
|| ! is_git_object_id "$fetched_object" || [ "$fetched_object" != "$expected_object" ]; then
echo " ! remote release tag $candidate changed during verification; refusing update"
exit 1
fi
if ! fetched_commit=$(git rev-parse 'FETCH_HEAD^{commit}' 2>/dev/null) \
|| ! is_git_object_id "$fetched_commit" \
|| ! fetched_type=$(git cat-file -t "$fetched_object" 2>/dev/null); then
echo " ! remote release tag $candidate did not resolve to a verified commit; refusing update"
exit 1
fi
if [ -n "$expected_peeled" ]; then
if [ "$fetched_type" != "tag" ] || [ "$fetched_commit" != "$expected_peeled" ]; then
echo " ! annotated remote tag $candidate failed peeled-commit correspondence; refusing update"
exit 1
fi
elif [ "$fetched_type" != "commit" ] || [ "$fetched_commit" != "$fetched_object" ]; then
echo " ! lightweight remote tag $candidate did not name one commit; refusing update"
exit 1
fi
if git merge-base --is-ancestor "$fetched_commit" origin/master; then
LATEST_TAG="$candidate"
RELEASE_COMMIT="$fetched_commit"
break
else
ancestor_status=$?
if [ "$ancestor_status" -ne 1 ]; then
echo " ! could not verify whether $candidate is reachable from origin/master; refusing update"
exit 1
fi
fi
done
if [ "$FORCE_UPDATE" = "1" ]; then
TARGET="$REMOTE_HEAD"
elif [ -z "$LATEST_TAG" ]; then
echo " ! no stable release tag is reachable from origin/master; refusing to follow an unverified branch HEAD"
echo " set WINDSURFAPI_UPDATE_FORCE=1 only if you intentionally want origin/master"
exit 1
else
TARGET="$RELEASE_COMMIT"
fi
if [ -n "$LATEST_TAG" ]; then
if ! UNRELEASED=$(git rev-list --count "${RELEASE_COMMIT}..${REMOTE_HEAD}" 2>/dev/null); then
echo " ! could not verify commits after the latest release; refusing update"
exit 1
fi
if ! is_nonnegative_git_count "$UNRELEASED"; then
echo " ! Git returned an invalid release-distance count; refusing update"
exit 1
fi
if [ "${UNRELEASED:-0}" -gt 0 ]; then
echo " i 远端有 ${UNRELEASED} 个未发布提交；本次只安装 ${LATEST_TAG}"
if [ "$FORCE_UPDATE" = "1" ]; then
echo " WINDSURFAPI_UPDATE_FORCE=1：改为跟随 origin/master"
fi
fi
fi
if ! TO_TARGET=$(git rev-list --count "HEAD..${TARGET}" 2>/dev/null); then
echo " ! could not verify whether the target is ahead; refusing update"
exit 1
fi
if ! is_nonnegative_git_count "$TO_TARGET"; then
echo " ! Git returned an invalid target-ahead count; refusing update"
exit 1
fi
if ! PAST_TARGET=$(git rev-list --count "${TARGET}..HEAD" 2>/dev/null); then
echo " ! could not verify whether this checkout is past the target; refusing update"
exit 1
fi
if ! is_nonnegative_git_count "$PAST_TARGET"; then
echo " ! Git returned an invalid target-past count; refusing update"
exit 1
fi
if ! UNPUSHED=$(git rev-list --count "${REMOTE_HEAD}..HEAD" 2>/dev/null); then
echo " ! could not verify local commits against origin/master; refusing update"
exit 1
fi
if ! is_nonnegative_git_count "$UNPUSHED"; then
echo " ! Git returned an invalid local-commit count; refusing update"
exit 1
fi
if [ "${TO_TARGET:-0}" -gt 0 ] && [ "${PAST_TARGET:-0}" -gt 0 ]; then
echo " ! 当前 HEAD 与更新目标 ${TARGET:0:7} 已分叉；拒绝非 fast-forward 更新"
exit 1
fi
RESET_TARGET="$TARGET"
if [ "$FORCE_RESET" = "1" ] && [ "${TO_TARGET:-0}" -eq 0 ] && [ "${PAST_TARGET:-0}" -gt 0 ] && [ "${UNPUSHED:-0}" -eq 0 ]; then
RESET_TARGET="$BEFORE"
fi
MUTATION_TARGET=""
MUTATION_EXIT=0
if [ "$FORCE_RESET" = "1" ]; then
MUTATION_TARGET="$RESET_TARGET"
elif [ "${TO_TARGET:-0}" -gt 0 ]; then
MUTATION_TARGET="$TARGET"
fi
if [ -n "$MUTATION_TARGET" ]; then
if ! check_ignored_target_conflicts "$MUTATION_TARGET"; then
exit 1
fi
fi
# ── D9 source-OTA attestation ─────────────────────────────────────────
# The selected release tag must carry a release-attestation.json whose commit
# equals the peeled tag commit, signed by the release workflow identity. This
# runs before any stash/reset/merge and before the service restart.
# warn (default): missing attestation/bundle/cosign logs a warning and the
# update proceeds, so existing installs keep working;
# required: missing material refuses the update.
# A present but mismatched or invalid attestation is always fatal.
ATTESTATION_MODE="${WINDSURFAPI_UPDATE_ATTESTATION:-warn}"
case "$ATTESTATION_MODE" in
warn|required) ;;
*)
echo " ! invalid WINDSURFAPI_UPDATE_ATTESTATION='$ATTESTATION_MODE' (expected warn or required); refusing update"
exit 1
;;
esac
if [ -n "$LATEST_TAG" ] && [ "$FORCE_UPDATE" != "1" ] \
&& { [ -z "$MUTATION_TARGET" ] || [ "$MUTATION_TARGET" = "$TARGET" ]; }; then
ATTESTATION_REPOSITORY=""
ORIGIN_URL="$(git remote get-url origin 2>/dev/null || true)"
case "$ORIGIN_URL" in
https://github.com/dwgx/WindsurfAPI|https://github.com/dwgx/WindsurfAPI.git|git@github.com:dwgx/WindsurfAPI.git|ssh://git@github.com/dwgx/WindsurfAPI.git)
ATTESTATION_REPOSITORY="dwgx/WindsurfAPI"
;;
esac
ATTESTATION_ARGS=(--tag "$LATEST_TAG" --commit "$RELEASE_COMMIT" --mode "$ATTESTATION_MODE")
[ -n "$ATTESTATION_REPOSITORY" ] && ATTESTATION_ARGS+=(--repository "$ATTESTATION_REPOSITORY")
[ -n "${WINDSURFAPI_ATTESTATION_DIR:-}" ] && ATTESTATION_ARGS+=(--dir "$WINDSURFAPI_ATTESTATION_DIR")
[ -n "${COSIGN:-}" ] && ATTESTATION_ARGS+=(--cosign "$COSIGN")
if command -v node >/dev/null 2>&1 && [ -f scripts/verify-release-attestation.mjs ]; then
if ! node scripts/verify-release-attestation.mjs "${ATTESTATION_ARGS[@]}"; then
echo " ! release attestation verification failed for $LATEST_TAG; refusing update before any Git mutation"
exit 1
fi
elif [ "$ATTESTATION_MODE" = "required" ]; then
echo " ! node or scripts/verify-release-attestation.mjs is missing; WINDSURFAPI_UPDATE_ATTESTATION=required refuses update"
exit 1
else
echo " ! node or the release attestation verifier is missing; continuing because WINDSURFAPI_UPDATE_ATTESTATION=warn"
fi
fi
if [ "$FORCE_RESET" = "1" ]; then
if [ -n "$DIRTY" ]; then
echo " ! preserving local changes in a stash before forced reset"
STASH_BEFORE=$(git for-each-ref --format='%(objectname)' refs/stash)
STASH_MARKER="windsurfapi-pre-update-${UPDATE_LOCK_TOKEN}"
git stash push --include-untracked -m "$STASH_MARKER"
STASH_LISTING=$(git stash list --format='%H%x09%gs')
OWNED_STASH_OID=$(printf '%s\n' "$STASH_LISTING" | awk -v marker="$STASH_MARKER" '
index($0, marker) { count++; oid=$1 }
END { if (count > 1) exit 2; if (count == 1) print oid }
')
if [ -n "$OWNED_STASH_OID" ] && [[ ! "$OWNED_STASH_OID" =~ ^([0-9a-fA-F]{40}|[0-9a-fA-F]{64})$ ]]; then
echo " ! protective stash resolved to an invalid object ID; refusing reset"
exit 1
fi
if [ -z "$OWNED_STASH_OID" ]; then
STASH_AFTER=$(git for-each-ref --format='%(objectname)' refs/stash)
if [ "$STASH_AFTER" != "$STASH_BEFORE" ]; then
echo " ! refs/stash changed but this updater could not identify its own stash; refusing reset"
exit 1
fi
echo " i no protective stash was created; the working tree was cleaned before stash"
fi
fi
# force-reset normally means "clean my working tree and continue updating".
# If this checkout already contains the release target and is itself on the
# remote branch, resetting to the tag would be an accidental downgrade.
echo " ! forced reset to ${RESET_TARGET:0:7}"
if git reset --hard "$RESET_TARGET"; then
:
else
MUTATION_EXIT=$?
fi
else
if [ -n "$DIRTY" ] || [ "${UNPUSHED:-0}" -gt 0 ]; then
echo " ! local changes or commits detected; refusing destructive update"
echo " review them first, or set WINDSURFAPI_UPDATE_FORCE_RESET=1"
exit 1
fi
if [ "${TO_TARGET:-0}" -gt 0 ]; then
if git merge --ff-only --quiet "$TARGET"; then
:
else
MUTATION_EXIT=$?
fi
fi
fi
if ! AFTER=$(git rev-parse HEAD); then
echo " ! could not verify HEAD after the Git mutation; refusing to continue"
exit 1
fi
if [ -n "$MUTATION_TARGET" ]; then
if ! TRACKED_AFTER=$(git status --porcelain --untracked-files=no --ignore-submodules=none); then
echo " ! could not verify tracked state after the Git mutation; refusing to continue"
exit 1
fi
if [ "$AFTER" != "$MUTATION_TARGET" ] || [ -n "$TRACKED_AFTER" ]; then
echo " ! Git did not reach the expected clean target; refusing to report update success"
echo " expected: $MUTATION_TARGET"
echo " actual: $AFTER"
if [ -n "$TRACKED_AFTER" ]; then
echo " tracked changes remain:"
printf '%s\n' "$TRACKED_AFTER" | head -20
fi
if [ -n "$OWNED_STASH_OID" ]; then
echo " protective stash remains at $OWNED_STASH_OID"
fi
exit 1
fi
if [ "$MUTATION_EXIT" -ne 0 ]; then
echo " ! Git returned exit $MUTATION_EXIT after reaching the verified clean target; continuing"
fi
elif [ "$MUTATION_EXIT" -ne 0 ]; then
echo " ! Git mutation failed with exit $MUTATION_EXIT"
exit "$MUTATION_EXIT"
fi
if [ "$BEFORE" = "$AFTER" ]; then
echo " 已是最新 / Already up to date"
else
echo " $BEFORE → $AFTER"
git log --oneline "$BEFORE..$AFTER" 2>/dev/null | head -10 || true
fi
echo ""
echo "=== [2/5] Update LS binary ==="
LS_PATH="${LS_BINARY_PATH:-/opt/windsurf/language_server_linux_x64}"
if [ -f .env ]; then
_lp="$(awk '
/^[[:space:]]*(export[[:space:]]+)?LS_BINARY_PATH[[:space:]]*=/ {
sub(/^[[:space:]]*(export[[:space:]]+)?LS_BINARY_PATH[[:space:]]*=[[:space:]]*/, "")
if (substr($0, 1, 1) != "\"" && substr($0, 1, 1) != "'\''") {
sub(/[[:space:]]+#.*/, "")
}
sub(/[[:space:]]*$/, "")
if ((substr($0, 1, 1) == "\"" && substr($0, length($0), 1) == "\"") ||
(substr($0, 1, 1) == "'\''" && substr($0, length($0), 1) == "'\''")) {
$0 = substr($0, 2, length($0) - 2)
}
print $0
exit
}
' .env 2>/dev/null || true)"
[ -n "$_lp" ] && LS_PATH="$_lp"
fi
if [ ! -f install-ls.sh ]; then
echo " ! install-ls.sh not found; cannot update LS binary"
exit 1
fi
echo " Updating via install-ls.sh -> $LS_PATH"
if LS_INSTALL_PATH="$LS_PATH" bash install-ls.sh; then
echo " LS binary update finished"
else
_ls_rc=$?
if [ -s "$LS_PATH" ]; then
echo " ! LS binary update failed (exit $_ls_rc); keeping existing binary at $LS_PATH"
else
echo " ! LS binary update failed and no existing binary exists at $LS_PATH"
exit "$_ls_rc"
fi
fi
echo ""
echo "=== [3/5] Stop service ==="
pm2 stop "$NAME" >/dev/null 2>&1 || true
pm2 delete "$NAME" >/dev/null 2>&1 || true
# Never fall back to a command-line substring kill here: another checkout or
# an unrelated service can also contain `src/index.js`. PM2 owns the named app;
# the remaining fallback is bounded to this deployment's configured port.
fuser -k "$PORT"/tcp >/dev/null 2>&1 || true
PORT_RELEASED=0
for i in $(seq 1 30); do
# `set -e` must not turn the probe's meaningful 1 (free) or 2 (unknown)
# result into an unverified process exit before the state machine handles it.
if port_listener_probe; then
probe_rc=0
else
probe_rc=$?
fi
if [ "$probe_rc" -eq 1 ]; then
PORT_RELEASED=1
break
fi
if [ "$probe_rc" -ne 0 ]; then
echo " ! could not verify whether service port $PORT is free; entering verified rollback"
SERVICE_STOP_FAILED=1
break
fi
sleep 1
done
if [ "$PORT_RELEASED" -ne 1 ]; then
if [ "$SERVICE_STOP_FAILED" -eq 0 ]; then
echo " ! service port $PORT remains occupied after stop; entering verified rollback"
fi
SERVICE_STOP_FAILED=1
fi
echo ""
echo "=== [4/5] Start service ==="
PM2_START_EXIT=0
if [ "$SERVICE_STOP_FAILED" -eq 1 ]; then
PM2_START_EXIT=125
else
if pm2 start src/index.js --name "$NAME" --cwd "$(pwd)"; then
pm2 save >/dev/null 2>&1 || true
if ! pm2_process_is_live; then
PM2_START_EXIT=126
echo " ! pm2 reported success but the named app has no live process; entering verified rollback"
fi
else
PM2_START_EXIT=$?
echo " ! pm2 start failed with exit $PM2_START_EXIT; entering verified rollback"
fi
fi
echo ""
echo "=== [5/5] Health check + rollback on failure ==="
# audit #5: `curl -sf ... | head` returned head's exit code (always 0), so a 500
# /health or an unbound port passed the check. Capture first — curl -sf's own
# exit code (nonzero on HTTP >=400 / connection failure) is now authoritative.
HEALTH_OUT=""
HEALTH_OK=0
if [ "$PM2_START_EXIT" -eq 0 ]; then
sleep 3
if HEALTH_OUT="$(curl -sf --connect-timeout 5 --max-time 15 "http://localhost:$PORT/health")" \
&& health_response_matches_commit "$HEALTH_OUT" "$AFTER" "$PM2_LIVE_PID"; then
HEALTH_OK=1
else
HEALTH_OK=0
echo " ! /health did not identify the expected running commit ${AFTER:0:12}"
fi
fi
if [ "$HEALTH_OK" = 1 ]; then
echo "$HEALTH_OUT" | head -200
echo ""
echo ""
echo "✓ Update complete. Dashboard: http://\$YOUR_IP:$PORT/dashboard"
else
echo ""
echo "✗ Health check failed after update. Auto-rolling back to $BEFORE ..."
# Stop/delete the failed target before changing the checkout. A bare
# `pm2 start --name` retry is not a rollback: real PM2 can reject a duplicate
# name, reuse the old process identity, or leave the target code resident in
# memory after Git has moved back. Keep the proof separate from the initial
# stop gate so a health failure is audited again on its own path.
ROLLBACK_SERVICE_STOP_FAILED=0
pm2 stop "$NAME" >/dev/null 2>&1 || true
pm2 delete "$NAME" >/dev/null 2>&1 || true
if ! pm2_named_process_is_absent; then
echo " ! could not prove that the failed PM2 app $NAME is absent"
ROLLBACK_SERVICE_STOP_FAILED=1
fi
fuser -k "$PORT"/tcp >/dev/null 2>&1 || true
ROLLBACK_PORT_RELEASED=0
for i in $(seq 1 30); do
if port_listener_probe; then
rollback_probe_rc=0
else
rollback_probe_rc=$?
fi
if [ "$rollback_probe_rc" -eq 1 ]; then
ROLLBACK_PORT_RELEASED=1
break
fi
if [ "$rollback_probe_rc" -ne 0 ]; then
echo " ! could not verify whether service port $PORT is free during rollback"
ROLLBACK_SERVICE_STOP_FAILED=1
break
fi
sleep 1
done
if [ "$ROLLBACK_PORT_RELEASED" -ne 1 ]; then
if [ "$ROLLBACK_SERVICE_STOP_FAILED" -eq 0 ]; then
echo " ! service port $PORT remains occupied during rollback"
fi
ROLLBACK_SERVICE_STOP_FAILED=1
fi
if [ "$ROLLBACK_SERVICE_STOP_FAILED" -eq 0 ] && ! pm2_named_process_is_absent; then
echo " ! the failed PM2 app $NAME reappeared while waiting for its listener to stop"
ROLLBACK_SERVICE_STOP_FAILED=1
fi
if [ "$ROLLBACK_SERVICE_STOP_FAILED" -eq 1 ]; then
echo "✗ Automatic rollback refused before changing Git because the failed service could not be proven stopped."
echo " The failed target remains checked out at $AFTER; no stash was restored."
if [ -n "$OWNED_STASH_OID" ]; then
echo " Protective stash remains at $OWNED_STASH_OID."
fi
exit 1
fi
if ! check_ignored_target_conflicts "$BEFORE"; then
echo "✗ Automatic rollback refused because checking out $BEFORE could overwrite ignored owner data."
echo " The failed target remains checked out; preserve the reported paths and recover manually."
if [ -n "$OWNED_STASH_OID" ]; then
echo " Protective stash remains at $OWNED_STASH_OID."
fi
exit 1
fi
ROLLBACK_MUTATION_EXIT=0
if git reset --hard "$BEFORE"; then
:
else
ROLLBACK_MUTATION_EXIT=$?
fi
if ! ROLLBACK_HEAD=$(git rev-parse HEAD); then
echo "✗ Could not verify HEAD after automatic rollback; manual recovery required."
[ -n "$OWNED_STASH_OID" ] && echo " Protective stash remains at $OWNED_STASH_OID."
exit 1
fi
if ! ROLLBACK_TRACKED=$(git status --porcelain --untracked-files=no --ignore-submodules=none); then
echo "✗ Could not verify tracked state after automatic rollback; manual recovery required."
[ -n "$OWNED_STASH_OID" ] && echo " Protective stash remains at $OWNED_STASH_OID."
exit 1
fi
if [ "$ROLLBACK_HEAD" != "$BEFORE" ] || [ -n "$ROLLBACK_TRACKED" ]; then
echo "✗ Automatic rollback did not reach the expected clean target; manual recovery required."
echo " expected: $BEFORE"
echo " actual: $ROLLBACK_HEAD"
if [ -n "$ROLLBACK_TRACKED" ]; then
echo " tracked changes remain:"
printf '%s\n' "$ROLLBACK_TRACKED" | head -20
fi
[ -n "$OWNED_STASH_OID" ] && echo " Protective stash remains at $OWNED_STASH_OID."
exit 1
fi
if [ "$ROLLBACK_MUTATION_EXIT" -ne 0 ]; then
echo " ! Git returned exit $ROLLBACK_MUTATION_EXIT after reaching the verified clean rollback target; continuing"
fi
STASH_RESTORE_OK=1
if [ -n "$OWNED_STASH_OID" ]; then
echo " restoring exact protective stash ${OWNED_STASH_OID:0:12} (backup remains in git stash)"
if ! git stash apply "$OWNED_STASH_OID" 2>/dev/null; then
STASH_RESTORE_OK=0
echo " ! local changes were NOT restored; backup remains at $OWNED_STASH_OID"
fi
fi
if pm2 start src/index.js --name "$NAME" --cwd "$(pwd)" >/dev/null 2>&1; then
pm2 save >/dev/null 2>&1 || true
if ! pm2_process_is_live; then
ROLLBACK_PM2_START_EXIT=126
echo "✗ Code rolled back to $BEFORE, but the named PM2 app has no live process; manual recovery required."
exit 1
fi
else
ROLLBACK_PM2_START_EXIT=$?
echo "✗ Code rolled back to $BEFORE, but PM2 restart failed with exit $ROLLBACK_PM2_START_EXIT; manual recovery required."
exit 1
fi
sleep 3
if ROLLBACK_OUT="$(curl -sf --connect-timeout 5 --max-time 15 "http://localhost:$PORT/health")" \
&& health_response_matches_commit "$ROLLBACK_OUT" "$BEFORE" "$PM2_LIVE_PID"; then
ROLLBACK_OK=1
else
ROLLBACK_OK=0
echo " ! rollback /health did not identify the expected commit ${BEFORE:0:12}"
fi
if [ "$ROLLBACK_OK" = 1 ]; then
echo "$ROLLBACK_OUT" | head -200
echo ""
if [ "$STASH_RESTORE_OK" != 1 ]; then
echo "✗ Code rolled back to $BEFORE and the service is healthy, but local changes still require manual recovery from $OWNED_STASH_OID."
exit 1
fi
echo "✓ Rolled back to $BEFORE — service healthy. Check 'pm2 logs $NAME' for the original failure."
exit 0
fi
echo "✗ Rollback also failed. Manual intervention required. Check 'pm2 logs $NAME'."
exit 1
fi