@autodevjapan/godd-mcp-alpha 2.9.4 → 2.10.1

package/scripts/postinstall-godd-tk.js

@@ -12,8 +12,8 @@
  * レビューを通った manifest の digest である（Issue #1474）。
  */
 
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, unlinkSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
 import { homedir, platform, arch } from "node:os";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -23,6 +23,16 @@ import {
   getGoddTkTarget,
   verifyGoddTkArtifact,
 } from "./godd-tk-assets.js";
+import {
+  AtomicInstallCleanupError,
+  AtomicInstallIntegrityError,
+  AtomicInstallRollbackError,
+  beginAtomicBinaryInstall,
+  finishAtomicBinaryInstall,
+  publishAtomicBinary,
+  recoverAtomicBinaryInstall,
+  recoverInterruptedAtomicFinish,
+} from "./atomic-binary-install.js";
 
 const REPO = "AutoDevJapan/GoDD-MCP-Alpha";
 const BINARY_NAME = "godd-tk";
@@ -73,8 +83,8 @@ function defaultDownload(tag, artifact, directory) {
  *   - "installed" / "already-installed" … 検証済みバイナリが所定の場所にある
  *   - "skipped"                        … そもそも取得しない（exit 0、install 継続）。
  *                                        既存の未検証バイナリが居た場合は必ず隔離済み
- *   - "integrity-failure"              … 検証を通らないバイナリを実行経路から
- *                                        外せなかった（exit 65 で fail-closed）
+ *   - "integrity-failure"              … integrity / atomic recovery 境界の失敗。
+ *                                        rollback成功時もexit 65でfail-closed
  */
 export function installGoddTk({
   currentPlatform = platform(),
@@ -85,13 +95,13 @@ export function installGoddTk({
   verify = verifyGoddTkArtifact,
   exists = existsSync,
   makeDir = (path) => mkdirSync(path, { recursive: true }),
-  // staging は必ず install 先と同じファイルシステム上に作る。
-  // os.tmpdir() を使うと /tmp が tmpfs / $HOME が別デバイスの環境で
-  // rename が常に EXDEV になり、検証機能そのものが無言で死ぬ。
-  makeTempDir = (parent) => mkdtempSync(join(parent, ".godd-tk-")),
-  removeTree = (path) => rmSync(path, { recursive: true, force: true }),
+  makeTempDir,
+  removeTree,
+  publishOperations,
+  isProcessAlive,
+  recoverInterruptedFinish =
+    process.env.GODD_RECOVER_GODD_TK_INSTALL === "1",
   move = renameSync,
-  removeFile = unlinkSync,
   chmod = chmodSync,
   now = () => Date.now(),
   log = console.log,
@@ -105,19 +115,86 @@ export function installGoddTk({
   }
 
   const binaryPath = getBinaryPath(installDir, currentPlatform);
+  let transaction;
+  try {
+    makeDir(installDir);
+    if (recoverInterruptedFinish) {
+      const recovery = recoverInterruptedAtomicFinish({
+        binaryPath,
+        ...(isProcessAlive ? { isProcessAlive } : {}),
+      });
+      if (recovery.status === "blocked") {
+        logError(
+          `[godd-tk] SECURITY: explicit install recovery was rejected (${recovery.reason}).`,
+        );
+        return { status: "integrity-failure", reason: recovery.reason };
+      }
+      if (recovery.status === "recovered") {
+        log(`[godd-tk] Recovered an interrupted install owner release.`);
+      }
+    }
+    transaction = beginAtomicBinaryInstall({
+      installDir,
+      binaryPath,
+      ...(makeTempDir ? { makeTempDir: (prefix) => makeTempDir(prefix) } : {}),
+      ...(isProcessAlive ? { isProcessAlive } : {}),
+    });
+  } catch {
+    logError(
+      `[godd-tk] SECURITY: could not create the atomic install transaction.`,
+    );
+    return { status: "integrity-failure", reason: "transaction-unavailable" };
+  }
+  if (transaction.status === "busy") {
+    log(`[godd-tk] Another verified install transaction is active; skipping this attempt.`);
+    return { status: "skipped", reason: "install-busy" };
+  }
+  if (transaction.status === "blocked") {
+    logError(`[godd-tk] SECURITY: install lock could not be validated (${transaction.reason}).`);
+    return { status: "integrity-failure", reason: transaction.reason };
+  }
+
+  let result;
+  let retainTransaction = false;
+  try {
+    recoverAtomicBinaryInstall(transaction, (path) => verify(path, target));
+  } catch {
+    logError(`[godd-tk] SECURITY: interrupted install recovery failed.`);
+    result = { status: "integrity-failure", reason: "recovery-failed" };
+  }
+  if (!result) {
+    try {
+      result = runLockedInstall();
+    } catch {
+      logError(`[godd-tk] Unexpected installer error.`);
+      result = { status: "integrity-failure", reason: "unexpected-error" };
+    }
+  }
+
+  if (retainTransaction) return result;
+  const cleanup = finishAtomicBinaryInstall(
+    transaction,
+    removeTree ? { removeTree } : undefined,
+  );
+  if (!cleanup.ok) {
+    logError(`[godd-tk] SECURITY: install transaction cleanup failed.`);
+    return { status: "integrity-failure", reason: cleanup.reason };
+  }
+  return result;
+
+  function runLockedInstall() {
   let unverifiedExisting = false;
   if (exists(binaryPath)) {
     try {
       verify(binaryPath, target);
-      log(`[godd-tk] Already installed and verified: ${binaryPath} (${GODD_TK_RELEASE_TAG})`);
+      log(`[godd-tk] Already installed and verified (${GODD_TK_RELEASE_TAG}).`);
       return { status: "already-installed", binaryPath };
-    } catch (error) {
+    } catch {
       // 既存バイナリが pinned release と違う（自前ビルド・旧バージョン・改竄）。
       // 「検証済み」と偽らず、pinned release での置き換えを試みる。
       unverifiedExisting = true;
       logError(
-        `[godd-tk] Existing binary does not match the pinned release ${GODD_TK_RELEASE_TAG}: ` +
-          `${error instanceof Error ? error.message : error}`,
+        `[godd-tk] Existing binary does not match the pinned release ${GODD_TK_RELEASE_TAG}.`,
       );
       log(`[godd-tk] Reinstalling the pinned, digest-verified release.`);
     }
@@ -142,7 +219,7 @@ export function installGoddTk({
     for (let suffix = 1; exists(quarantinePath); suffix += 1) {
       if (suffix > 1000) {
         logError(
-          `[godd-tk] SECURITY: could not find a free quarantine path for ${binaryPath}.`,
+          `[godd-tk] SECURITY: quarantine namespace is exhausted.`,
         );
         return { status: "integrity-failure", reason: "unverified-existing-binary" };
       }
@@ -150,35 +227,26 @@ export function installGoddTk({
     }
     try {
       move(binaryPath, quarantinePath);
-    } catch (error) {
-      logError(
-        `[godd-tk] SECURITY: could not quarantine the unverified binary at ${binaryPath} — ` +
-          `${error instanceof Error ? error.message : error}`,
-      );
+    } catch {
+      logError(`[godd-tk] SECURITY: could not quarantine the unverified binary.`);
       return { status: "integrity-failure", reason: "unverified-existing-binary" };
     }
     logError(
-      `[godd-tk] Quarantined the unverified binary to ${quarantinePath}; ` +
+      `[godd-tk] Quarantined the unverified binary as ${basename(quarantinePath)}; ` +
         `it is no longer on the install path. Delete it once you have confirmed its origin.`,
     );
     return { status: "skipped", reason };
   }
-
-  // 想定外の例外が `unverifiedExisting === true` のまま escape すると、
-  // 未検証バイナリを隔離しないまま install が続いてしまう（M2 と同じクラスの穴）。
-  // 取得〜配置の全体を包み、必ず finishWithoutInstall を通す。
-  // `integrity-failure` は throw ではなく return なので、この catch で降格することはない。
-  try {
-    return runDownloadAndInstall();
-  } catch (error) {
-    logError(
-      `[godd-tk] Unexpected installer error: ${error instanceof Error ? error.message : error}`,
-    );
-    return finishWithoutInstall("unexpected-error");
-  }
-
-  function runDownloadAndInstall() {
-    if (!isGhAvailable()) {
+    let ghAvailable;
+    try {
+      ghAvailable = isGhAvailable();
+    } catch {
+      logError(
+        `[godd-tk] Unexpected installer error.`,
+      );
+      return finishWithoutInstall("unexpected-error");
+    }
+    if (!ghAvailable) {
       log(`[godd-tk] GitHub CLI (gh) not found — required for private repo download.`);
       log(`[godd-tk] Install gh: https://cli.github.com/ then run this script again.`);
       log(`[godd-tk] Or build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
@@ -186,30 +254,16 @@ export function installGoddTk({
     }
 
     log(`[godd-tk] Downloading ${target.artifact} (${GODD_TK_RELEASE_TAG}) via gh CLI...`);
-
-    let tmpDir;
-    try {
-      makeDir(installDir);
-      tmpDir = makeTempDir(installDir);
-    } catch (error) {
-      log(
-        `[godd-tk] Could not prepare a staging directory under ${installDir}: ` +
-          `${error instanceof Error ? error.message : error}`,
-      );
-      return finishWithoutInstall("staging-unavailable");
-    }
-
-    const downloadedPath = join(tmpDir, target.artifact);
-    try {
+    const downloadedPath = join(transaction.tempDir, target.artifact);
       try {
-        download(GODD_TK_RELEASE_TAG, target.artifact, tmpDir);
-      } catch (error) {
-        log(`[godd-tk] Download failed: ${error instanceof Error ? error.message : error}`);
+        download(GODD_TK_RELEASE_TAG, target.artifact, transaction.tempDir);
+      } catch {
+        log(`[godd-tk] Download failed.`);
         log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
         return finishWithoutInstall("download-failed");
       }
       if (!exists(downloadedPath)) {
-        log(`[godd-tk] Downloaded file not found at ${downloadedPath}`);
+        log(`[godd-tk] Downloaded artifact is missing (${target.artifact}).`);
         log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
         return finishWithoutInstall("download-failed");
       }
@@ -217,56 +271,69 @@ export function installGoddTk({
       // ここから先は「取得できた」ケース。digest 不一致は skip ではなく失敗。
       try {
         verify(downloadedPath, target);
-      } catch (error) {
+      } catch {
         logError(
-          `[godd-tk] SECURITY: downloaded artifact failed integrity verification — ` +
-            `${error instanceof Error ? error.message : error}`,
+          `[godd-tk] SECURITY: downloaded artifact failed integrity verification.`,
         );
         logError(
           `[godd-tk] The artifact published at ${GODD_TK_RELEASE_TAG} does not match the digest ` +
             `committed in godd-mcp-alpha/godd-tk-assets.json. Installation is aborted and nothing was installed.`,
         );
+        if (unverifiedExisting && exists(binaryPath)) {
+          const quarantine = finishWithoutInstall("digest-mismatch");
+          if (quarantine.status === "integrity-failure") return quarantine;
+        }
         return { status: "integrity-failure", reason: "digest-mismatch" };
       }
 
       try {
-        if (exists(binaryPath)) removeFile(binaryPath);
-        move(downloadedPath, binaryPath);
+        if (currentPlatform !== "win32") chmod(downloadedPath, 0o755);
+        publishAtomicBinary(
+          transaction,
+          downloadedPath,
+          (path) => verify(path, target),
+          undefined,
+          publishOperations,
+        );
       } catch (error) {
-        log(`[godd-tk] Installation failed: ${error instanceof Error ? error.message : error}`);
+        if (error instanceof AtomicInstallCleanupError) {
+          retainTransaction = true;
+          logError(
+            `[godd-tk] SECURITY: verified publish cleanup is pending; transaction retained.`,
+          );
+          return {
+            status: "integrity-failure",
+            reason: "publish-cleanup-pending",
+          };
+        }
+        if (error instanceof AtomicInstallIntegrityError) {
+          logError(`[godd-tk] SECURITY: published artifact failed integrity verification.`);
+          return {
+            status: "integrity-failure",
+            reason: "post-publish-integrity-failed",
+          };
+        }
+        if (error instanceof AtomicInstallRollbackError) {
+          retainTransaction = true;
+          logError(`[godd-tk] SECURITY: publish rollback failed; transaction retained.`);
+          return { status: "integrity-failure", reason: "rollback-failed" };
+        }
+        log(`[godd-tk] Installation failed.`);
         log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
         return finishWithoutInstall("install-failed");
       }
       // ここまで来た時点で、置かれているのは検証済み bytes だけ。
       unverifiedExisting = false;
 
-      if (currentPlatform !== "win32") {
-        try {
-          chmod(binaryPath, 0o755);
-        } catch (error) {
-          logError(
-            `[godd-tk] Installed verified bytes but could not set the executable bit on ${binaryPath}: ` +
-              `${error instanceof Error ? error.message : error}`,
-          );
-        }
-      }
-
-      log(`[godd-tk] Installed and verified (sha256 ${target.sha256}): ${binaryPath}`);
+      log(`[godd-tk] Installed and verified (${GODD_TK_RELEASE_TAG}).`);
       log(`[godd-tk] Run 'godd-tk init --agent cursor' to set up hooks`);
       if (currentPlatform === "win32") {
         const pathDirs = (process.env.PATH || "").toLowerCase().split(";");
         if (!pathDirs.includes(installDir.toLowerCase())) {
-          log(`[godd-tk] Add ${installDir} to your PATH for global access`);
+          log(`[godd-tk] Add the godd-tk install directory to PATH for global access`);
         }
       }
       return { status: "installed", binaryPath };
-    } finally {
-      try {
-        removeTree(tmpDir);
-      } catch {
-        // best effort
-      }
-    }
   }
 }