@agent-sh/agent-workspace-linux 0.3.1 → 0.3.3

package/README.md

@@ -19,6 +19,24 @@ then verifies the required `<asset>.sha256` sidecar before installing it.
 > node $(npm root -g)/@agent-sh/agent-workspace-linux/scripts/postinstall.js
 > ```
 
+Release downloads accept absolute or relative HTTPS redirect locations, with
+a maximum of five redirect hops. Malformed URLs and non-HTTPS redirect targets
+fail the download; redirects do not bypass the required checksum verification.
+
+Checksum sidecars must contain a valid 64-hex-digit SHA-256 digest and name the
+expected release asset. Space and tab separators are accepted. A bare digest or
+an entry naming a different asset is rejected.
+
+The postinstall script applies executable permissions to the verified staging
+file before replacing an installed binary. If permission preparation fails, it
+reports failure and leaves the previously installed binary untouched.
+
+Each install uses its own uniquely created staging directory beside the binary.
+Concurrent installs do not remove or overwrite one another's downloads. Normal
+completion and errors clean up the attempt's own staging directory; forced
+termination can leave an abandoned `.staging-*` directory. A later install does
+not delete it automatically, because another installer may still be using it.
+
 ## Usage
 
 Once installed, the server is on your PATH (the command stays unscoped):
@@ -40,6 +58,10 @@ It is an [MCP](https://modelcontextprotocol.io/) server that speaks JSON-RPC ove
 }
 ```
 
+The command-line wrapper preserves the native program's exit code and terminating
+signal. In particular, a child terminated by SIGINT causes the wrapper to
+terminate by SIGINT too, rather than report exit code zero.
+
 ## Source and full documentation
 
 All source code, tool documentation, and issue tracking are at:

package/bin/agent-workspace-linux.js

@@ -37,7 +37,8 @@ if (!fs.existsSync(binaryPath)) {
 // Ignore SIGINT in the launcher: let the child (MCP server) handle its own
 // shutdown. Without this both processes would receive the signal and the child
 // might not get a chance to flush stdio cleanly.
-process.on("SIGINT", () => {});
+const ignoreSigint = () => {};
+process.on("SIGINT", ignoreSigint);
 
 const child = spawn(binaryPath, process.argv.slice(2), {
   stdio: "inherit",
@@ -47,7 +48,10 @@ const child = spawn(binaryPath, process.argv.slice(2), {
 child.on("close", (code, signal) => {
   if (signal) {
     // Propagate signal so the parent's exit looks like a signalled death to
-    // any caller (e.g. npm run scripts that check $?).
+    // any caller (e.g. npm run scripts that check $?). Drop the SIGINT handler
+    // first: while it is installed it would swallow a re-raised SIGINT and the
+    // launcher would exit 0, reporting success for a Ctrl-C'd child.
+    process.removeListener("SIGINT", ignoreSigint);
     process.kill(process.pid, signal);
   } else {
     process.exit(code ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-sh/agent-workspace-linux",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Isolated Linux desktop workspaces for AI agents — MCP server binary wrapper.",
   "license": "MIT",
   "publishConfig": {
@@ -23,13 +23,8 @@
     "workspace",
     "agent"
   ],
-  "os": [
-    "linux"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
-  ],
+  "os": ["linux"],
+  "cpu": ["x64", "arm64"],
   "engines": {
     "node": ">=18"
   },

package/scripts/postinstall.js

@@ -54,8 +54,66 @@ const checksumUrl = `${downloadUrl}.sha256`;
 
 const binDir = path.join(__dirname, "..", "bin");
 const destPath = path.join(binDir, "agent-workspace-linux");
-const tmpPath = destPath + ".tmp";
-const tmpChecksumPath = tmpPath + ".sha256";
+
+// Concurrent installs share bin/, so staging must not use fixed file names: one
+// install would delete or overwrite bytes another one is still verifying.
+// mkdtemp allocates a unique directory atomically, inside bin/ so publishing
+// stays a same-filesystem rename. Only the invocation that created a staging
+// directory ever removes it — never another invocation's files. Catchable
+// signals clean up before exit (below). A forced exit (SIGKILL/power loss)
+// can still leave an abandoned directory, so the next install sweeps staging
+// directories older than STALE_STAGING_MS; a live concurrent install is far
+// younger than that (its download is bounded), so it is never touched.
+let stagingDir = null;
+
+function createStagingDir() {
+  stagingDir = fs.mkdtempSync(path.join(binDir, ".staging-"));
+  return stagingDir;
+}
+
+function cleanupStagingDir() {
+  if (stagingDir === null) return;
+  try {
+    fs.rmSync(stagingDir, { recursive: true, force: true });
+  } catch (_) {}
+  stagingDir = null;
+}
+
+// Catchable termination (Ctrl-C, SIGTERM from a supervisor) must not leak the
+// staging directory. Clean up, then re-raise with default disposition so the
+// exit status still reflects the signal.
+if (require.main === module && typeof process.on === "function") {
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(signal, () => {
+      cleanupStagingDir();
+      process.removeAllListeners(signal);
+      process.kill(process.pid, signal);
+    });
+  }
+}
+
+// SIGKILL and power loss cannot be caught, so bound the leftovers: sweep
+// staging directories that are clearly abandoned (older than STALE_STAGING_MS).
+// Fresh ones may belong to a concurrent installer and are left alone.
+const STALE_STAGING_MS = 60 * 60 * 1000;
+function sweepStaleStagingDirs() {
+  let entries;
+  try {
+    entries = fs.readdirSync(binDir, { withFileTypes: true });
+  } catch (_) {
+    return;
+  }
+  const now = Date.now();
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith(".staging-")) continue;
+    const full = path.join(binDir, entry.name);
+    try {
+      if (now - fs.statSync(full).mtimeMs > STALE_STAGING_MS) {
+        fs.rmSync(full, { recursive: true, force: true });
+      }
+    } catch (_) {}
+  }
+}
 
 // ── Download helper (follows redirects, max 5 hops) ─────────────────────────
 
@@ -66,59 +124,77 @@ const tmpChecksumPath = tmpPath + ".sha256";
 function download(url, tmpFile, maxRedirects = 5) {
   return new Promise((resolve, reject) => {
     function get(currentUrl, hopsLeft) {
-      https
-        .get(currentUrl, { headers: { "User-Agent": "node-fetch/postinstall" } }, (res) => {
-          const { statusCode, headers } = res;
+      try {
+        https
+          .get(currentUrl, { headers: { "User-Agent": "node-fetch/postinstall" } }, (res) => {
+            const { statusCode, headers } = res;
+
+            // Follow redirects (GitHub releases always redirect to S3).
+            if (statusCode >= 300 && statusCode < 400 && headers.location) {
+              if (hopsLeft === 0) {
+                res.resume();
+                return reject(new Error(`Too many redirects downloading ${url}`));
+              }
+              res.resume(); // drain and ignore body
+
+              // Location may be relative, query-only or protocol-relative
+              // (RFC 7231 allows all three), so resolve it against the URL we
+              // just requested instead of handing it to https.get verbatim.
+              let nextUrl;
+              try {
+                nextUrl = new URL(headers.location, currentUrl);
+              } catch (_) {
+                return reject(
+                  new Error(`Invalid redirect location downloading ${url}`)
+                );
+              }
+              if (nextUrl.protocol !== "https:") {
+                return reject(
+                  new Error(`Refusing non-HTTPS redirect downloading ${url}`)
+                );
+              }
+              return get(nextUrl.href, hopsLeft - 1);
+            }
 
-          // Follow redirects (GitHub releases always redirect to S3).
-          if (statusCode >= 300 && statusCode < 400 && headers.location) {
-            if (hopsLeft === 0) {
+            if (statusCode !== 200) {
               res.resume();
-              return reject(new Error(`Too many redirects downloading ${url}`));
+              return reject(
+                new Error(
+                  `Failed to download ${url}: HTTP ${statusCode}. ` +
+                    "Check that the release exists, includes the binary and .sha256 sidecar, " +
+                    "and the version in package.json matches."
+                )
+              );
             }
-            res.resume(); // drain and ignore body
-            return get(headers.location, hopsLeft - 1);
-          }
-
-          if (statusCode !== 200) {
-            res.resume();
-            return reject(
-              new Error(
-                `Failed to download ${url}: HTTP ${statusCode}. ` +
-                  "Check that the release exists, includes the binary and .sha256 sidecar, " +
-                  "and the version in package.json matches."
-              )
-            );
-          }
-
-          const out = fs.createWriteStream(tmpFile);
-          res.pipe(out);
-          out.on("finish", () => out.close(resolve));
-          out.on("error", (err) => {
-            fs.unlink(tmpFile, () => {}); // best-effort cleanup
-            reject(err);
-          });
-          res.on("error", (err) => {
+
+            const out = fs.createWriteStream(tmpFile);
+            res.pipe(out);
+            out.on("finish", () => out.close(resolve));
+            out.on("error", (err) => {
+              fs.unlink(tmpFile, () => {}); // best-effort cleanup
+              reject(err);
+            });
+            res.on("error", (err) => {
+              fs.unlink(tmpFile, () => {});
+              reject(err);
+            });
+          })
+          .on("error", (err) => {
             fs.unlink(tmpFile, () => {});
             reject(err);
           });
-        })
-        .on("error", (err) => {
-          fs.unlink(tmpFile, () => {});
-          reject(err);
-        });
+      } catch (err) {
+        // https.get throws synchronously on an unusable target; from inside a
+        // response callback that would be an uncaught exception, so reject.
+        fs.unlink(tmpFile, () => {});
+        reject(err);
+      }
     }
 
     get(url, maxRedirects);
   });
 }
 
-function removeFileQuietly(file) {
-  try {
-    fs.unlinkSync(file);
-  } catch (_) {}
-}
-
 function parseSha256Sidecar(contents, expectedAssetName) {
   const lines = contents
     .split(/\r?\n/)
@@ -137,18 +213,18 @@ function parseSha256Sidecar(contents, expectedAssetName) {
     if (!/^[a-fA-F0-9]{64}(\s+\*?(\S.*)?)?$/.test(trimmed)) {
       throw new Error(`invalid checksum sidecar line: ${line}`);
     }
-    const spaceIdx = trimmed.indexOf(' ');
-    let checksum, fileNamePart;
-    if (spaceIdx === -1) {
-      checksum = trimmed;
-      fileNamePart = null;
-    } else {
-      checksum = trimmed.slice(0, spaceIdx);
-      fileNamePart = trimmed.slice(spaceIdx + 1).replace(/^\*?\s*/, '');
-    }
+    // The line matched above, so the first 64 chars are the checksum; the rest
+    // is "<whitespace>[*]<filename>". Scan forward (no regex backtracking) so
+    // any whitespace delimiter works, not just a single space.
+    const checksum = trimmed.slice(0, 64);
+    let i = 64;
+    while (i < trimmed.length && /\s/.test(trimmed[i])) i++;
+    if (trimmed[i] === '*') i++; // sha256sum binary-mode marker
+    while (i < trimmed.length && /\s/.test(trimmed[i])) i++;
+    const fileNamePart = trimmed.slice(i);
     candidates.push({
       checksum: checksum.toLowerCase(),
-      fileName: fileNamePart && fileNamePart.length ? fileNamePart.trim() : null,
+      fileName: fileNamePart.length ? fileNamePart : null,
     });
   }
 
@@ -196,9 +272,11 @@ async function main() {
   // be defensive for edge-case installs).
   fs.mkdirSync(binDir, { recursive: true });
 
-  // Remove stale tmp file from a previous interrupted install.
-  removeFileQuietly(tmpPath);
-  removeFileQuietly(tmpChecksumPath);
+  // Staging owned by this invocation only.
+  sweepStaleStagingDirs();
+  const stagingRoot = createStagingDir();
+  const tmpPath = path.join(stagingRoot, assetName);
+  const tmpChecksumPath = `${tmpPath}.sha256`;
 
   console.log(
     `agent-workspace-linux: downloading ${assetName} v${version}…`
@@ -209,7 +287,7 @@ async function main() {
     await download(downloadUrl, tmpPath);
   } catch (err) {
     // Clean up in case the file was partially created.
-    removeFileQuietly(tmpPath);
+    cleanupStagingDir();
     // The download error text embeds the request URL (built from
     // package.json's version + the target triple). Log a fixed message rather
     // than interpolating that value, to avoid a log-injection sink; the URL
@@ -229,8 +307,7 @@ async function main() {
     await download(checksumUrl, tmpChecksumPath);
     await verifyChecksum(tmpPath, tmpChecksumPath, assetName);
   } catch (err) {
-    removeFileQuietly(tmpPath);
-    removeFileQuietly(tmpChecksumPath);
+    cleanupStagingDir();
     // Do not interpolate raw err.message (from untrusted sidecar/network) into logs.
     // This was flagged as log-injection (js/log-injection).
     console.error(
@@ -238,40 +315,54 @@ async function main() {
     );
     process.exit(1);
   }
-  removeFileQuietly(tmpChecksumPath);
 
-  // Atomic rename: avoids leaving a half-written binary.
+  // Mark the verified staging file executable *before* publishing it. Doing
+  // this after the rename would expose a window where readers see a
+  // non-executable binary at destPath, and a chmod failure there would already
+  // have destroyed the previously installed, runnable binary.
   try {
-    fs.renameSync(tmpPath, destPath);
+    fs.chmodSync(tmpPath, 0o755);
   } catch (err) {
+    cleanupStagingDir();
     console.error(
-      `agent-workspace-linux: could not move binary into place — ${err.message}`
+      `agent-workspace-linux: chmod failed — ${err.message}. ` +
+        "The previously installed binary (if any) was left untouched; " +
+        "re-run installation."
     );
     process.exit(1);
   }
 
-  // Mark executable.
+  // Atomic rename: avoids leaving a half-written binary, and publishes a file
+  // that is already executable.
   try {
-    fs.chmodSync(destPath, 0o755);
+    fs.renameSync(tmpPath, destPath);
   } catch (err) {
+    cleanupStagingDir();
     console.error(
-      `agent-workspace-linux: chmod failed — ${err.message}. ` +
-        `Try: chmod 755 ${destPath}`
+      `agent-workspace-linux: could not move binary into place — ${err.message}`
     );
     process.exit(1);
   }
 
+  cleanupStagingDir();
+
   console.log(`agent-workspace-linux: binary installed at ${destPath}`);
 }
 
 if (require.main === module) {
   main().catch((err) => {
+    // process.exit() is immediate, so staging must be removed before it: every
+    // error path above cleans up synchronously, and this handles unexpected
+    // throws in between.
+    cleanupStagingDir();
     console.error(`agent-workspace-linux: postinstall failed — ${err.message}`);
     process.exit(1);
   });
 }
 
 module.exports = {
+  sweepStaleStagingDirs,
+  STALE_STAGING_MS,
   parseSha256Sidecar,
   fileSha256,
   verifyChecksum,