@agent-sh/agent-workspace-linux 0.3.2 → 0.4.0

package/README.md

@@ -19,6 +19,30 @@ then verifies the required `<asset>.sha256` sidecar before installing it.
 > node $(npm root -g)/@agent-sh/agent-workspace-linux/scripts/postinstall.js
 > ```
 
+Release downloads accept absolute or relative HTTPS redirect locations, with
+a maximum of five redirect hops. Malformed URLs and non-HTTPS redirect targets
+fail the download; redirects do not bypass the required checksum verification.
+
+Each binary or checksum download has a 60-second inactivity timeout while waiting
+for response headers or body progress. The timer resets whenever bytes arrive, so
+a slow transfer that is still making progress can continue. A separate 30-minute
+hard ceiling only bounds pathological transfers. Timeout failures close the active
+output and remove its partial file before a retry can begin.
+
+Checksum sidecars must contain a valid 64-hex-digit SHA-256 digest and name the
+expected release asset. Space and tab separators are accepted. A bare digest or
+an entry naming a different asset is rejected.
+
+The postinstall script applies executable permissions to the verified staging
+file before replacing an installed binary. If permission preparation fails, it
+reports failure and leaves the previously installed binary untouched.
+
+Each install uses its own uniquely created staging directory beside the binary.
+Concurrent installs do not remove or overwrite one another's downloads. Normal
+completion and errors clean up the attempt's own staging directory; forced
+termination can leave an abandoned `.staging-*` directory. A later install does
+not delete it automatically, because another installer may still be using it.
+
 ## Usage
 
 Once installed, the server is on your PATH (the command stays unscoped):
@@ -40,6 +64,10 @@ It is an [MCP](https://modelcontextprotocol.io/) server that speaks JSON-RPC ove
 }
 ```
 
+The command-line wrapper preserves the native program's exit code and terminating
+signal. In particular, a child terminated by SIGINT causes the wrapper to
+terminate by SIGINT too, rather than report exit code zero.
+
 ## Source and full documentation
 
 All source code, tool documentation, and issue tracking are at:

package/bin/agent-workspace-linux.js

@@ -37,7 +37,8 @@ if (!fs.existsSync(binaryPath)) {
 // Ignore SIGINT in the launcher: let the child (MCP server) handle its own
 // shutdown. Without this both processes would receive the signal and the child
 // might not get a chance to flush stdio cleanly.
-process.on("SIGINT", () => {});
+const ignoreSigint = () => {};
+process.on("SIGINT", ignoreSigint);
 
 const child = spawn(binaryPath, process.argv.slice(2), {
   stdio: "inherit",
@@ -47,7 +48,10 @@ const child = spawn(binaryPath, process.argv.slice(2), {
 child.on("close", (code, signal) => {
   if (signal) {
     // Propagate signal so the parent's exit looks like a signalled death to
-    // any caller (e.g. npm run scripts that check $?).
+    // any caller (e.g. npm run scripts that check $?). Drop the SIGINT handler
+    // first: while it is installed it would swallow a re-raised SIGINT and the
+    // launcher would exit 0, reporting success for a Ctrl-C'd child.
+    process.removeListener("SIGINT", ignoreSigint);
     process.kill(process.pid, signal);
   } else {
     process.exit(code ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-sh/agent-workspace-linux",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Isolated Linux desktop workspaces for AI agents — MCP server binary wrapper.",
   "license": "MIT",
   "publishConfig": {

package/scripts/postinstall.js

@@ -54,71 +54,214 @@ const checksumUrl = `${downloadUrl}.sha256`;
 
 const binDir = path.join(__dirname, "..", "bin");
 const destPath = path.join(binDir, "agent-workspace-linux");
-const tmpPath = destPath + ".tmp";
-const tmpChecksumPath = tmpPath + ".sha256";
+
+// Concurrent installs share bin/, so staging must not use fixed file names: one
+// install would delete or overwrite bytes another one is still verifying.
+// mkdtemp allocates a unique directory atomically, inside bin/ so publishing
+// stays a same-filesystem rename. Only the invocation that created a staging
+// directory ever removes it — never another invocation's files. Catchable
+// signals clean up before exit (below). A forced exit (SIGKILL/power loss)
+// can still leave an abandoned directory, so the next install sweeps staging
+// directories older than STALE_STAGING_MS; a live concurrent install is far
+// younger than that (its download is bounded), so it is never touched.
+let stagingDir = null;
+
+function createStagingDir() {
+  stagingDir = fs.mkdtempSync(path.join(binDir, ".staging-"));
+  return stagingDir;
+}
+
+function cleanupStagingDir() {
+  if (stagingDir === null) return;
+  try {
+    fs.rmSync(stagingDir, { recursive: true, force: true });
+  } catch (_) {}
+  stagingDir = null;
+}
+
+// Catchable termination (Ctrl-C, SIGTERM from a supervisor) must not leak the
+// staging directory. Clean up, then re-raise with default disposition so the
+// exit status still reflects the signal.
+if (require.main === module && typeof process.on === "function") {
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(signal, () => {
+      cleanupStagingDir();
+      process.removeAllListeners(signal);
+      process.kill(process.pid, signal);
+    });
+  }
+}
+
+// SIGKILL and power loss cannot be caught, so bound the leftovers: sweep
+// staging directories that are clearly abandoned (older than STALE_STAGING_MS).
+// Fresh ones may belong to a concurrent installer and are left alone.
+const STALE_STAGING_MS = 60 * 60 * 1000;
+function sweepStaleStagingDirs() {
+  let entries;
+  try {
+    entries = fs.readdirSync(binDir, { withFileTypes: true });
+  } catch (_) {
+    return;
+  }
+  const now = Date.now();
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith(".staging-")) continue;
+    const full = path.join(binDir, entry.name);
+    try {
+      if (now - fs.statSync(full).mtimeMs > STALE_STAGING_MS) {
+        fs.rmSync(full, { recursive: true, force: true });
+      }
+    } catch (_) {}
+  }
+}
 
 // ── Download helper (follows redirects, max 5 hops) ─────────────────────────
 
+// Fail a download after a full minute without useful network progress. This
+// catches missing headers and stalled response bodies without penalizing a slow
+// connection that is still delivering bytes. Keep a separate generous ceiling
+// so a pathological transfer cannot keep npm install alive forever.
+const DOWNLOAD_IDLE_TIMEOUT_MS = 60 * 1000;
+const DOWNLOAD_MAX_DURATION_MS = 30 * 60 * 1000;
+
 /**
  * Download `url` to `tmpFile`, following up to `maxRedirects` 3xx responses.
- * Resolves when the file is fully written, rejects on error or bad status.
+ * Resolves when the file is fully written. Rejects on transport/status errors,
+ * after DOWNLOAD_IDLE_TIMEOUT_MS without headers/body progress, or when the
+ * generous DOWNLOAD_MAX_DURATION_MS hard ceiling is reached.
  */
 function download(url, tmpFile, maxRedirects = 5) {
   return new Promise((resolve, reject) => {
+    let settled = false;
+    let out = null;
+    let idleTimer = null;
+    let maxDurationTimer = null;
+    const requests = new Set();
+    const responses = new Set();
+
+    function settle(err) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(idleTimer);
+      clearTimeout(maxDurationTimer);
+      if (!err) return resolve();
+
+      for (const req of requests) req.destroy();
+      for (const res of responses) res.destroy();
+
+      const removePartial = () => fs.unlink(tmpFile, () => reject(err));
+      if (out && !out.closed) {
+        out.once("close", removePartial);
+        out.destroy();
+      } else {
+        removePartial();
+      }
+    }
+
+    function resetIdleTimer() {
+      if (settled) return;
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(
+        () =>
+          settle(
+            new Error(
+              `No download progress for ${DOWNLOAD_IDLE_TIMEOUT_MS} ms downloading ${url}`
+            )
+          ),
+        DOWNLOAD_IDLE_TIMEOUT_MS
+      );
+    }
+
     function get(currentUrl, hopsLeft) {
-      https
-        .get(currentUrl, { headers: { "User-Agent": "node-fetch/postinstall" } }, (res) => {
-          const { statusCode, headers } = res;
-
-          // Follow redirects (GitHub releases always redirect to S3).
-          if (statusCode >= 300 && statusCode < 400 && headers.location) {
-            if (hopsLeft === 0) {
-              res.resume();
-              return reject(new Error(`Too many redirects downloading ${url}`));
+      if (settled) return;
+      try {
+        const req = https.get(
+          currentUrl,
+          { headers: { "User-Agent": "node-fetch/postinstall" } },
+          (res) => {
+            responses.add(res);
+            res.once("close", () => responses.delete(res));
+            res.on("error", settle);
+            if (settled) {
+              res.destroy();
+              return;
             }
-            res.resume(); // drain and ignore body
-            return get(headers.location, hopsLeft - 1);
-          }
 
-          if (statusCode !== 200) {
-            res.resume();
-            return reject(
-              new Error(
-                `Failed to download ${url}: HTTP ${statusCode}. ` +
-                  "Check that the release exists, includes the binary and .sha256 sidecar, " +
-                  "and the version in package.json matches."
-              )
-            );
+            // Response headers are progress. A successful body must continue to
+            // reset this timer whenever bytes arrive.
+            resetIdleTimer();
+
+            try {
+              const { statusCode, headers } = res;
+
+              if (statusCode >= 300 && statusCode < 400 && headers.location) {
+                res.resume();
+                if (hopsLeft === 0) {
+                  settle(new Error(`Too many redirects downloading ${url}`));
+                  return;
+                }
+
+                // Keep #98 intact: resolve relative redirects against the
+                // current URL and never permit a downgrade away from HTTPS.
+                let nextUrl;
+                try {
+                  nextUrl = new URL(headers.location, currentUrl);
+                } catch (_) {
+                  settle(new Error(`Invalid redirect location downloading ${url}`));
+                  return;
+                }
+                if (nextUrl.protocol !== "https:") {
+                  settle(new Error(`Refusing non-HTTPS redirect downloading ${url}`));
+                  return;
+                }
+                get(nextUrl.href, hopsLeft - 1);
+                return;
+              }
+
+              if (statusCode !== 200) {
+                res.resume();
+                settle(
+                  new Error(
+                    `Failed to download ${url}: HTTP ${statusCode}. ` +
+                      "Check that the release exists, includes the binary and .sha256 sidecar, " +
+                      "and the version in package.json matches."
+                  )
+                );
+                return;
+              }
+
+              out = fs.createWriteStream(tmpFile);
+              out.on("error", settle);
+              out.on("finish", () => out.close((err) => settle(err || null)));
+              res.on("data", resetIdleTimer);
+              res.pipe(out);
+            } catch (err) {
+              settle(err);
+            }
           }
-
-          const out = fs.createWriteStream(tmpFile);
-          res.pipe(out);
-          out.on("finish", () => out.close(resolve));
-          out.on("error", (err) => {
-            fs.unlink(tmpFile, () => {}); // best-effort cleanup
-            reject(err);
-          });
-          res.on("error", (err) => {
-            fs.unlink(tmpFile, () => {});
-            reject(err);
-          });
-        })
-        .on("error", (err) => {
-          fs.unlink(tmpFile, () => {});
-          reject(err);
-        });
+        );
+        requests.add(req);
+        req.once("close", () => requests.delete(req));
+        req.on("error", settle);
+      } catch (err) {
+        settle(err);
+      }
     }
 
+    maxDurationTimer = setTimeout(
+      () =>
+        settle(
+          new Error(
+            `Download exceeded ${DOWNLOAD_MAX_DURATION_MS} ms downloading ${url}`
+          )
+        ),
+      DOWNLOAD_MAX_DURATION_MS
+    );
+    resetIdleTimer();
     get(url, maxRedirects);
   });
 }
 
-function removeFileQuietly(file) {
-  try {
-    fs.unlinkSync(file);
-  } catch (_) {}
-}
-
 function parseSha256Sidecar(contents, expectedAssetName) {
   const lines = contents
     .split(/\r?\n/)
@@ -137,18 +280,18 @@ function parseSha256Sidecar(contents, expectedAssetName) {
     if (!/^[a-fA-F0-9]{64}(\s+\*?(\S.*)?)?$/.test(trimmed)) {
       throw new Error(`invalid checksum sidecar line: ${line}`);
     }
-    const spaceIdx = trimmed.indexOf(' ');
-    let checksum, fileNamePart;
-    if (spaceIdx === -1) {
-      checksum = trimmed;
-      fileNamePart = null;
-    } else {
-      checksum = trimmed.slice(0, spaceIdx);
-      fileNamePart = trimmed.slice(spaceIdx + 1).replace(/^\*?\s*/, '');
-    }
+    // The line matched above, so the first 64 chars are the checksum; the rest
+    // is "<whitespace>[*]<filename>". Scan forward (no regex backtracking) so
+    // any whitespace delimiter works, not just a single space.
+    const checksum = trimmed.slice(0, 64);
+    let i = 64;
+    while (i < trimmed.length && /\s/.test(trimmed[i])) i++;
+    if (trimmed[i] === '*') i++; // sha256sum binary-mode marker
+    while (i < trimmed.length && /\s/.test(trimmed[i])) i++;
+    const fileNamePart = trimmed.slice(i);
     candidates.push({
       checksum: checksum.toLowerCase(),
-      fileName: fileNamePart && fileNamePart.length ? fileNamePart.trim() : null,
+      fileName: fileNamePart.length ? fileNamePart : null,
     });
   }
 
@@ -196,9 +339,11 @@ async function main() {
   // be defensive for edge-case installs).
   fs.mkdirSync(binDir, { recursive: true });
 
-  // Remove stale tmp file from a previous interrupted install.
-  removeFileQuietly(tmpPath);
-  removeFileQuietly(tmpChecksumPath);
+  // Staging owned by this invocation only.
+  sweepStaleStagingDirs();
+  const stagingRoot = createStagingDir();
+  const tmpPath = path.join(stagingRoot, assetName);
+  const tmpChecksumPath = `${tmpPath}.sha256`;
 
   console.log(
     `agent-workspace-linux: downloading ${assetName} v${version}…`
@@ -209,7 +354,7 @@ async function main() {
     await download(downloadUrl, tmpPath);
   } catch (err) {
     // Clean up in case the file was partially created.
-    removeFileQuietly(tmpPath);
+    cleanupStagingDir();
     // The download error text embeds the request URL (built from
     // package.json's version + the target triple). Log a fixed message rather
     // than interpolating that value, to avoid a log-injection sink; the URL
@@ -229,8 +374,7 @@ async function main() {
     await download(checksumUrl, tmpChecksumPath);
     await verifyChecksum(tmpPath, tmpChecksumPath, assetName);
   } catch (err) {
-    removeFileQuietly(tmpPath);
-    removeFileQuietly(tmpChecksumPath);
+    cleanupStagingDir();
     // Do not interpolate raw err.message (from untrusted sidecar/network) into logs.
     // This was flagged as log-injection (js/log-injection).
     console.error(
@@ -238,40 +382,54 @@ async function main() {
     );
     process.exit(1);
   }
-  removeFileQuietly(tmpChecksumPath);
 
-  // Atomic rename: avoids leaving a half-written binary.
+  // Mark the verified staging file executable *before* publishing it. Doing
+  // this after the rename would expose a window where readers see a
+  // non-executable binary at destPath, and a chmod failure there would already
+  // have destroyed the previously installed, runnable binary.
   try {
-    fs.renameSync(tmpPath, destPath);
+    fs.chmodSync(tmpPath, 0o755);
   } catch (err) {
+    cleanupStagingDir();
     console.error(
-      `agent-workspace-linux: could not move binary into place — ${err.message}`
+      `agent-workspace-linux: chmod failed — ${err.message}. ` +
+        "The previously installed binary (if any) was left untouched; " +
+        "re-run installation."
     );
     process.exit(1);
   }
 
-  // Mark executable.
+  // Atomic rename: avoids leaving a half-written binary, and publishes a file
+  // that is already executable.
   try {
-    fs.chmodSync(destPath, 0o755);
+    fs.renameSync(tmpPath, destPath);
   } catch (err) {
+    cleanupStagingDir();
     console.error(
-      `agent-workspace-linux: chmod failed — ${err.message}. ` +
-        `Try: chmod 755 ${destPath}`
+      `agent-workspace-linux: could not move binary into place — ${err.message}`
     );
     process.exit(1);
   }
 
+  cleanupStagingDir();
+
   console.log(`agent-workspace-linux: binary installed at ${destPath}`);
 }
 
 if (require.main === module) {
   main().catch((err) => {
+    // process.exit() is immediate, so staging must be removed before it: every
+    // error path above cleans up synchronously, and this handles unexpected
+    // throws in between.
+    cleanupStagingDir();
     console.error(`agent-workspace-linux: postinstall failed — ${err.message}`);
     process.exit(1);
   });
 }
 
 module.exports = {
+  sweepStaleStagingDirs,
+  STALE_STAGING_MS,
   parseSha256Sidecar,
   fileSha256,
   verifyChecksum,