0.2.0: the undo promise

The undo promise. UNDO-PROMISE.md now says exactly what --restore guarantees, in 13 lines. Each line has its own test in test/promise.test.js, and if undo ever breaks one, that's the first bug I fix. There's an Undo didn't work issue form for it.

Writing the promise down meant trying to break it first, on a real cPanel host. That found real gaps, all fixed in this release:

• Never half a file. Files go up as .shipback-part-<name> beside the live file and are swapped in whole with posix-rename, keeping the old file's permissions. Before, a deploy cut off mid-upload left a truncated file live, and undo then refused because the file looked like a live edit.
• A dropped connection fails out loud. ssh2 drops pending SFTP callbacks when the line goes. In 0.1 that made the CLI exit 0 with nothing printed, and the MCP tool call never returned. Now every pending operation fails, and the error says how many files went up and how to undo them.
• Cut-off runs are handled. .backup.json says saving until every backup copy is made, so a run cut off before that is known to have changed nothing. A restore that is cut off is finished by running --restore again.
• Checked backup copies. Records now carry a SHA-256 of every saved copy, and a copy that has been damaged since is never written back, even with --force.
• One run at a time. Deploy, upload, restore and prune hold .shipback-lock (O_EXCL, refreshed every 30 s) while they write. A second run is turned away with nothing changed and exits with code 5. A lock left by a cut-off run clears itself: straight away if its process on this computer has ended, otherwise after 2 minutes.
• Undo stays inside the site. A backup record naming any path outside the site folder, or one that can't be read, is refused instead of being restored without checks.

119 tests on Linux, macOS and Windows × Node 18, 20 and 22. Each safeguard was checked by breaking it on purpose and watching its promise test fail. The whole set also ran on a real cPanel host, including a connection cut mid-deploy and two deploys started at once.

Backups made with 0.1 still restore, but they don't carry the checksums behind P4 and P8.

npm install -g shipback-sftp@0.2.0