@cocorograph/hub-agent 0.8.68 → 0.8.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.68",
+  "version": "0.8.70",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/scripts/install.ps1

@@ -103,10 +103,49 @@ function Get-LinuxUserName {
   return $u
 }
 
+# Quote a value as ONE PowerShell single-quoted literal, for text that PowerShell
+# itself will parse later (the RunOnce command line below). PowerShell escapes a quote
+# by doubling it: o'hare -> 'o''hare'.
+#
+# WARNING: this is PowerShell quoting. It is NOT bash quoting, and there is deliberately
+# no bash equivalent in this file any more -- everything handed to wsl.exe goes as plain
+# argv tokens instead (see Invoke-WslInstaller).
+#
+# Doubling the ASCII quote is NOT enough on its own. PowerShell also accepts the
+# typographic quotes as string delimiters, so a value containing U+2019 closes the
+# literal early and the rest of it is parsed as code. Measured 2026-09-10 on pwsh:
+#   "'" + "x<U+2019>; Write-Output INJECTED; #" + "'"  ->  Invoke-Expression ran INJECTED.
+# A double quote is just as bad one level out: it ends the -Command "..." region no
+# matter how the inner value is quoted.
+#
+# So this allows printable ASCII only, minus the double quote, and refuses the rest.
+# Enumerating dangerous characters is the losing side of this; an allowlist is not.
+# An enrollment token and a hub URL are both ASCII, so nothing legitimate is lost.
+#
+# WARNING: the end anchor must be \z, not $. In .NET, $ also matches immediately before a
+# final newline, so '...*$' accepts "tok" plus a trailing LF -- and a token pasted out of
+# a browser or a text file carries exactly that. Measured 2026-09-10 on pwsh:
+#   ("tok" + [char]10) -match '^[\x20\x21\x23-\x7e]*$'   -> True   (leaks through)
+#   ("tok" + [char]10) -match '^[\x20\x21\x23-\x7e]*\z'  -> False  (rejected)
+# The empty string still passes, which is what a run without a token needs.
+#
+# WARNING: the rejection must not echo the value. It carries the enrollment token, and
+# an exception goes to the console, to transcripts and into whatever diagnostics get
+# shared afterwards. Name the setting, not its contents.
+function ConvertTo-PowerShellSingleQuoted($name, $value) {
+  $s = [string]$value
+  if ($s -notmatch '^[\x20\x21\x23-\x7e]*\z') {
+    throw "$name contains a character that cannot be safely embedded in the resume command (allowed: printable ASCII except the double quote)"
+  }
+  return "'" + ($s -replace "'", "''") + "'"
+}
+
 # Register "re-run myself with RESUME=1 after reboot", carrying token/url.
 function Set-ResumeOnReboot {
+  $qTok = ConvertTo-PowerShellSingleQuoted "HUB_AGENT_TOKEN" $Token
+  $qUrl = ConvertTo-PowerShellSingleQuoted "HUB_AGENT_URL" $HubUrl
   $cmd = "powershell -NoProfile -ExecutionPolicy Bypass -Command " +
-         "`"`$env:HUB_AGENT_TOKEN='$Token'; `$env:HUB_AGENT_URL='$HubUrl'; " +
+         "`"`$env:HUB_AGENT_TOKEN=$qTok; `$env:HUB_AGENT_URL=$qUrl; " +
          "`$env:HUB_AGENT_RESUME='1'; irm $PS1_URL | iex`""
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce" `
     -Name $RUNONCE_NAME -Value $cmd
@@ -267,12 +306,64 @@ function Register-BootTask($distro, $user) {
 }
 
 # Run the existing install.sh inside WSL.
+#
+# WARNING: do not build a shell expression and hand it to wsl.exe. 0.8.69 shipped
+#   bash -lc 't=$(mktemp) || exit 1; trap ...; curl -fsSL <url> -o "$t" && ... bash "$t"'
+# and on a real Windows 11 host install.sh never ran: curl died with
+# `option -o: is badly used here` (2026-09-10).
+#
+# What is measured, and what is not -- keep these apart, the inference below is what
+# sent the first investigation into install.sh, which had not even been downloaded:
+#   - measured: curl 8.5.0 emits that message only when -o gets an empty *quoted*
+#     argument. So by the time bash ran curl, $t was empty.
+#   - measured: in the same failing run, the other `bash -lc` calls in this file
+#     (Set-Systemd, which contains && and ||) went through without error. The only
+#     thing that set the broken call apart was DOUBLE QUOTES inside the argument.
+#   - INFERRED, not confirmed: that the assignment got separated from the curl.
+#   - NOT measured: which layer re-quoted it. Windows PowerShell 5.1 and wsl.exe both
+#     re-quote native arguments and neither can be reproduced on a non-Windows test bed.
+#
+# So do not rely on knowing the rule -- rely on not needing one. One wsl.exe call per
+# step, every argument a plain token, $LASTEXITCODE checked after each. Splitting the
+# steps is also what makes failures propagate at all: the original `curl ... | bash`
+# reported the pipeline's last exit status, so a failed download still left
+# $LASTEXITCODE at 0 and every broken run printed "[OK] Setup complete" (2026-09-09).
+#
+# Each throw names its own step, so a download failure cannot be read as install.sh
+# failing. That confusion cost a release.
 function Invoke-WslInstaller($distro, $user) {
   Write-Step "Setting up hub-agent inside WSL (existing install.sh)"
   $tok = if ($Token) { $Token } else { "" }
-  $inner = "curl -fsSL '$INSTALL_SH' | HUB_AGENT_TOKEN='$tok' HUB_AGENT_URL='$HubUrl' bash"
-  wsl.exe -d $distro -u $user -- bash -lc $inner
-  if ($LASTEXITCODE -ne 0) { throw "install.sh inside WSL failed (exit $LASTEXITCODE)" }
+
+  # Ask the distro where HOME is instead of assuming /home/<user>. Download into HOME,
+  # not /tmp: a name under a world-writable directory can be pre-created by any other
+  # local account, and we are about to execute whatever lands there.
+  $wslHome = (wsl.exe -d $distro -u $user -- printenv HOME | Out-String)
+  if ($LASTEXITCODE -ne 0) { throw "could not resolve HOME for '$user' inside WSL (exit $LASTEXITCODE)" }
+  $wslHome = ($wslHome -replace "`r", "").Trim()
+  if (-not $wslHome) { throw "could not resolve HOME for '$user' inside WSL (empty)" }
+
+  # One name per run. With a fixed name, two concurrent runs corrupt each other: one
+  # curl truncates the file the other is already executing (bash reads a script as it
+  # goes, so the loser runs half an installer), and whichever finishes first deletes
+  # the other's script. HOME is not world-writable, so the only possible collision is
+  # with ourselves -- a GUID settles it without another round trip for mktemp.
+  $script = "$wslHome/.hub-agent-install." + [guid]::NewGuid().ToString("N") + ".sh"
+
+  try {
+    wsl.exe -d $distro -u $user -- curl -fsSL $INSTALL_SH -o $script
+    if ($LASTEXITCODE -ne 0) { throw "downloading install.sh inside WSL failed (exit $LASTEXITCODE)" }
+
+    # `env` carries the settings as plain argv tokens. Interpolating them into a shell
+    # string is what broke above, and argv also keeps the token out of shell history.
+    wsl.exe -d $distro -u $user -- env "HUB_AGENT_TOKEN=$tok" "HUB_AGENT_URL=$HubUrl" bash $script
+    if ($LASTEXITCODE -ne 0) { throw "install.sh inside WSL failed (exit $LASTEXITCODE)" }
+  } finally {
+    # Inside try so a partial download is reclaimed too. Best effort: a run killed from
+    # outside PowerShell leaves one .hub-agent-install.<guid>.sh in the user's own home.
+    # Never delete by wildcard here -- that would collect a concurrent run's script.
+    wsl.exe -d $distro -u $user -- rm -f $script | Out-Null
+  }
 }
 
 # =============================================================================

package/scripts/install.sh

@@ -1443,12 +1443,26 @@ main() {
 }
 
 # このファイルが source されたか（実行されたか）を判定する。
-#   - `bash -c "$(curl ...)"` / `curl ... | bash` : BASH_SOURCE が空 → 実行
-#   - `bash install.sh` / `./install.sh`          : BASH_SOURCE[0] == $0 → 実行
-#   - `source install.sh`（test/install-sh.test.mjs）: BASH_SOURCE[0] != $0 → source
+#   - `bash -c "$(curl ...)"` / `curl ... | bash` / `bash -s`   : 実行
+#   - `bash install.sh` / `./install.sh`                        : 実行
+#   - `source install.sh`（test/install-sh.test.mjs）            : source
+#
+# ⚠️ `BASH_SOURCE[0]` と `$0` の比較で判定してはいけない。関数の中で見る
+# `BASH_SOURCE[0]` は「その関数が定義されたファイル」を指すが、標準入力から読ませた
+# ときの値は bash の版で割れる: bash 5.2 系は文字列 `main`、bash 3.2 / 5.3 は空。
+# 5.2 系では `main` != `bash` が成立して **source と誤判定**され、
+# `curl ... | bash` のワンライナーが main を呼ばずに無言・exit 0 で終わっていた
+# （2026-09-09 実測。Ubuntu 24.04 の 5.2.21 / Debian trixie の 5.2.37 で再現し、
+# macOS の 3.2.57 / 5.3.15 では再現しない。開発機だけで確かめると気づけない）。
+#
+# FUNCNAME はコールスタックで、bash は source したファイルのトップレベルを `source`
+# という枠として積む。したがってこの関数をトップレベルから呼ぶと、source されたときだけ
+# `FUNCNAME[1]` が `source` になる。3.2 / 5.2 / 5.3 のいずれでも一致する。
+# ⚠️ この関数は**トップレベルから直接呼ぶこと**。別の関数を挟むと `FUNCNAME[1]` が
+# その関数名になり、判定が壊れる。
 # 環境変数で切り替えると、変数が残ったシェルや CI でワンライナーが無言の no-op になるため使わない。
 _install_sh_is_sourced() {
-  [[ -n "${BASH_SOURCE[0]:-}" && "${BASH_SOURCE[0]}" != "$0" ]]
+  [[ "${FUNCNAME[1]:-}" == "source" ]]
 }
 
 if ! _install_sh_is_sourced; then