1.7.0

New command zip-archive-version: publish an immutable version directory, switch a pointer file and wait for the service's reload — in one call, one curl --fail-with-body (#98).

curl --fail-with-body -H "api-key: $DC_AGENT_KEY" --data-binary @"v0.4.1.zip" \
  "https://agents.example.com/dc-agent/zip-archive-version/app-bundle/v0.4.1"

Upgrade notes (read before rolling out)

• New WEB_SERVER_IDLE_TIMEOUT, default 10m — the idle timeout of the agent's connector, for every endpoint. Before, Jetty's own default of 30 s applied. A zip-archive-version config is refused unless its waitTimeout plus the 1 minute lock wait fits in it; a reverse proxy in front needs the same read timeout for that path (nginx proxy_read_timeout, 60 s by default).
• The operator now pins dc-agent-react v1.10.0 (create / view / edit forms for the new command).
• Control-plane create/update responses may carry the new status INVALID with a message (the field, never its value); the operator answers it with 400. An older operator cannot create the new command; a new operator against an older agent reports it as unreachable for this type only.

zip-archive-version

• A transaction with three outcomes: confirmed (200, published|present active <version> sha256 <digest>), rolled back (the service's 409/422/503, or 502 — the pointer is back where it was), unknown (504/500 — a retry of the same command is always safe).
• A version appears complete or not at all: staged next to its place, fsynced, published by one rename; the pointer is replaced atomically, its previous value kept on disk first, so a rollback survives the agent's own restart. Once the service confirms, the previous value is dropped, so a failed retry of a confirmed version does not roll it back.
• Retries are cheap: contents are compared by a digest of the files (not the ZIP bytes) — a rebuilt archive of the same files is present; a tag that now carries other files is 409.
• Archives are checked before anything is written: \ in names (on the raw bytes), absolute names, ./.., duplicates, symlinks and other special entries, encrypted entries; maxUploadBytes (413), maxBytes counted from the bytes actually read, maxEntries; at most two uploads in flight per agent.
• Reload call: bounded by waitTimeout for the whole exchange (a service dripping its answer is cut), body capped at 256 bytes, no redirects; ${version} is allowed in the path and query only, never in the scheme, host or port.
• Files 0644, directories 0755, set explicitly — the reading service runs as another user, so the command is not for secrets. reloadHeaders values are never logged and are masked in the command list.
• Configs are checked on every call right after authorization and when saved through the control plane; readable values: 50mb, 10k, 5m.

Other fixes

• The operator closes its command-list thread pool (it was only shut down).
• GsonApiServlet (control-plane / operator API) is pinned to INFO in logback.xml: at DEBUG it logged whole create/update bodies, api keys included.

Docs: https://evsinev.github.io/dc-agent/commands/zip-archive-version/

---

What's Changed

• feat: zip-archive-version — publish a version, switch the pointer and wait for the service in one call by @evsinev in #102

Full Changelog: 1.6.0...1.7.0