fix: deploy verify uses mirrored client, release revoke via Session, remote error tail

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/scripts/verify_release_download.py

@@ -21,15 +21,16 @@ with Session(engine) as db:
     rel = db.query(AgentRelease).filter_by(version=want, platform="windows", architecture="x64").one()
     default = db.query(AgentRelease).filter_by(status="PUBLISHED").order_by(AgentRelease.created_at.desc()).first()
     assert rel.status == "PUBLISHED" and default.id == rel.id, f"default release is {default.version}, expected {want}"
-    tenant = db.query(Tenant).filter_by(name="E2E-PROD-TEST").one_or_none() or Tenant(name="E2E-PROD-TEST")
-    db.add(tenant); db.add(AdminUser(username=user, password_hash=hash_password(PASSWORD), is_active=True, auth_source="LOCAL")); db.flush()
-    tenant_id, release_id, sha, name = tenant.id, rel.id, rel.sha256, rel.filename
+    tenant = db.query(Tenant).filter(Tenant.source == "GTI_GERENCIADOR", Tenant.active.is_(True), Tenant.external_client_id.isnot(None)).order_by(Tenant.id).first()
+    assert tenant, "no active Gerenciador-mirrored client to attach the throwaway installation to"
+    db.add(AdminUser(username=user, password_hash=hash_password(PASSWORD), is_active=True, auth_source="LOCAL")); db.flush()
+    client_id, release_id, sha, name = tenant.external_client_id, rel.id, rel.sha256, rel.filename
     db.commit()
 try:
     c = httpx.Client(follow_redirects=False, timeout=120)
     assert c.post(f"{BASE}/login", data={"username": user, "password": PASSWORD}).status_code == 303
     csrf = c.cookies.get("gti_csrf")
-    r = c.post(f"{BASE}/agents/new", data={"csrf_token": csrf, "tenant_id": tenant_id, "display_name": "E2E-VERIFY Servidor", "release_id": release_id})
+    r = c.post(f"{BASE}/agents/new", data={"csrf_token": csrf, "client_id": client_id, "display_name": "E2E-VERIFY Servidor", "release_id": release_id})
     assert r.status_code == 303, r.status_code
     uuid = r.headers["location"].rsplit("/", 1)[-1]
     d = c.get(f"{BASE}/agents/pending/{uuid}/download")

scripts/deploy_hub_remote.py

@@ -55,7 +55,7 @@ class Remote:
         rc = out.channel.recv_exit_status()
         log(f"$ {cmd}\n{text.rstrip()[-1500:]}")
         if check and rc != 0:
-            raise RuntimeError(f"exit {rc}: {cmd}")
+            raise RuntimeError(f"exit {rc}: {cmd[:120]} :: {text.strip()[-400:]}")
         return text
 
     def put(self, local: Path, remote: str) -> None:
@@ -181,8 +181,8 @@ def main() -> int:
                   check=False)
             log(f"EXPECTED_SHA256={digest} SIZE={installer.stat().st_size}")
             # older Setup installers stop being offered (never deleted); the newest PUBLISHED release is the default
-            r.run(f"docker exec {HUB} python -c \"from central.app.db import engine; from sqlalchemy import text; c=engine.begin().__enter__(); "
-                  f"print('revoked', c.execute(text(\\\"update agent_releases set status='REVOKED' where status='PUBLISHED' and filename like 'GTIFiscalAgent-Setup-%.exe' and version<>'{version}'\\\")).rowcount)\"",
+            r.run(f"docker exec {HUB} python -c \"from central.app.db import engine; from sqlalchemy import text; from sqlalchemy.orm import Session; "
+                  f"s=Session(engine); n=s.execute(text(\\\"update agent_releases set status='REVOKED' where status='PUBLISHED' and filename like 'GTIFiscalAgent-Setup-%.exe' and version<>'{version}'\\\")).rowcount; s.commit(); print('revoked', n)\"",
                   check=False)
             st["stage"] = "verify_download"
             r.run(f"docker exec {HUB} python central/scripts/verify_release_download.py {version}")