@cocorograph/hub-agent 0.8.69 → 0.8.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.69",
+  "version": "0.8.70",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/scripts/install.ps1

@@ -103,10 +103,49 @@ function Get-LinuxUserName {
   return $u
 }
 
+# Quote a value as ONE PowerShell single-quoted literal, for text that PowerShell
+# itself will parse later (the RunOnce command line below). PowerShell escapes a quote
+# by doubling it: o'hare -> 'o''hare'.
+#
+# WARNING: this is PowerShell quoting. It is NOT bash quoting, and there is deliberately
+# no bash equivalent in this file any more -- everything handed to wsl.exe goes as plain
+# argv tokens instead (see Invoke-WslInstaller).
+#
+# Doubling the ASCII quote is NOT enough on its own. PowerShell also accepts the
+# typographic quotes as string delimiters, so a value containing U+2019 closes the
+# literal early and the rest of it is parsed as code. Measured 2026-09-10 on pwsh:
+#   "'" + "x<U+2019>; Write-Output INJECTED; #" + "'"  ->  Invoke-Expression ran INJECTED.
+# A double quote is just as bad one level out: it ends the -Command "..." region no
+# matter how the inner value is quoted.
+#
+# So this allows printable ASCII only, minus the double quote, and refuses the rest.
+# Enumerating dangerous characters is the losing side of this; an allowlist is not.
+# An enrollment token and a hub URL are both ASCII, so nothing legitimate is lost.
+#
+# WARNING: the end anchor must be \z, not $. In .NET, $ also matches immediately before a
+# final newline, so '...*$' accepts "tok" plus a trailing LF -- and a token pasted out of
+# a browser or a text file carries exactly that. Measured 2026-09-10 on pwsh:
+#   ("tok" + [char]10) -match '^[\x20\x21\x23-\x7e]*$'   -> True   (leaks through)
+#   ("tok" + [char]10) -match '^[\x20\x21\x23-\x7e]*\z'  -> False  (rejected)
+# The empty string still passes, which is what a run without a token needs.
+#
+# WARNING: the rejection must not echo the value. It carries the enrollment token, and
+# an exception goes to the console, to transcripts and into whatever diagnostics get
+# shared afterwards. Name the setting, not its contents.
+function ConvertTo-PowerShellSingleQuoted($name, $value) {
+  $s = [string]$value
+  if ($s -notmatch '^[\x20\x21\x23-\x7e]*\z') {
+    throw "$name contains a character that cannot be safely embedded in the resume command (allowed: printable ASCII except the double quote)"
+  }
+  return "'" + ($s -replace "'", "''") + "'"
+}
+
 # Register "re-run myself with RESUME=1 after reboot", carrying token/url.
 function Set-ResumeOnReboot {
+  $qTok = ConvertTo-PowerShellSingleQuoted "HUB_AGENT_TOKEN" $Token
+  $qUrl = ConvertTo-PowerShellSingleQuoted "HUB_AGENT_URL" $HubUrl
   $cmd = "powershell -NoProfile -ExecutionPolicy Bypass -Command " +
-         "`"`$env:HUB_AGENT_TOKEN='$Token'; `$env:HUB_AGENT_URL='$HubUrl'; " +
+         "`"`$env:HUB_AGENT_TOKEN=$qTok; `$env:HUB_AGENT_URL=$qUrl; " +
          "`$env:HUB_AGENT_RESUME='1'; irm $PS1_URL | iex`""
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce" `
     -Name $RUNONCE_NAME -Value $cmd
@@ -266,44 +305,65 @@ function Register-BootTask($distro, $user) {
   Write-Ok "Logon task '$TASK_NAME' registered (keeps WSL distro alive)"
 }
 
-# Quote a value as ONE POSIX-shell word, so a quote inside it cannot end the
-# quoting and turn the rest of the value into shell syntax. `'` becomes `'\''`
-# (close, escaped quote, reopen): o'hare -> 'o'\''hare'.
-#
-# WARNING: this is bash quoting only. Do NOT reuse it for the PowerShell that
-# Register-BootTask generates -- that text is parsed by PowerShell, not by a shell,
-# and these escapes would be passed through literally.
-function ConvertTo-BashSingleQuoted($value) {
-  return "'" + (([string]$value) -replace "'", "'\''") + "'"
-}
-
 # Run the existing install.sh inside WSL.
 #
-# NOTE: do NOT use `curl ... | bash` here. A pipeline's exit status is the LAST
-# command's, so curl failing (DNS, 404, proxy) still leaves $LASTEXITCODE at 0 and
-# the guard below can never fire. That is exactly how this stayed broken: every run
-# printed "[OK] Setup complete" while install.sh had not run at all (2026-09-09).
-# Downloading to a file first makes curl's failure propagate through `&&`, and makes
-# $LASTEXITCODE install.sh's own exit code. It also keeps install.sh's stdin free
-# instead of handing it the script text.
+# WARNING: do not build a shell expression and hand it to wsl.exe. 0.8.69 shipped
+#   bash -lc 't=$(mktemp) || exit 1; trap ...; curl -fsSL <url> -o "$t" && ... bash "$t"'
+# and on a real Windows 11 host install.sh never ran: curl died with
+# `option -o: is badly used here` (2026-09-10).
+#
+# What is measured, and what is not -- keep these apart, the inference below is what
+# sent the first investigation into install.sh, which had not even been downloaded:
+#   - measured: curl 8.5.0 emits that message only when -o gets an empty *quoted*
+#     argument. So by the time bash ran curl, $t was empty.
+#   - measured: in the same failing run, the other `bash -lc` calls in this file
+#     (Set-Systemd, which contains && and ||) went through without error. The only
+#     thing that set the broken call apart was DOUBLE QUOTES inside the argument.
+#   - INFERRED, not confirmed: that the assignment got separated from the curl.
+#   - NOT measured: which layer re-quoted it. Windows PowerShell 5.1 and wsl.exe both
+#     re-quote native arguments and neither can be reproduced on a non-Windows test bed.
+#
+# So do not rely on knowing the rule -- rely on not needing one. One wsl.exe call per
+# step, every argument a plain token, $LASTEXITCODE checked after each. Splitting the
+# steps is also what makes failures propagate at all: the original `curl ... | bash`
+# reported the pipeline's last exit status, so a failed download still left
+# $LASTEXITCODE at 0 and every broken run printed "[OK] Setup complete" (2026-09-09).
 #
-# The EXIT trap removes the temp file when the run is interrupted. That one trap is
-# enough: a bash waiting on a foreground job handles SIGTERM after that job returns,
-# and exits through the normal path, so the EXIT trap runs and the exit code stays
-# non-zero. WARNING: do NOT add `trap ... TERM` on top of it. A TERM trap that only
-# cleans up and returns makes bash exit 0, i.e. a killed run would be reported as
-# success -- the very failure mode fixed above (both measured 2026-09-10, bash 5.2.21).
+# Each throw names its own step, so a download failure cannot be read as install.sh
+# failing. That confusion cost a release.
 function Invoke-WslInstaller($distro, $user) {
   Write-Step "Setting up hub-agent inside WSL (existing install.sh)"
   $tok = if ($Token) { $Token } else { "" }
-  # Single-quoted here so $t stays literal for bash; '' is a literal quote.
-  # `|| exit 1` covers mktemp failing before there is anything to clean up.
-  $fmt = 't=$(mktemp) || exit 1; trap ''rm -f "$t"'' EXIT; curl -fsSL {0} -o "$t" && HUB_AGENT_TOKEN={1} HUB_AGENT_URL={2} bash "$t"'
-  $inner = $fmt -f (ConvertTo-BashSingleQuoted $INSTALL_SH),
-                   (ConvertTo-BashSingleQuoted $tok),
-                   (ConvertTo-BashSingleQuoted $HubUrl)
-  wsl.exe -d $distro -u $user -- bash -lc $inner
-  if ($LASTEXITCODE -ne 0) { throw "install.sh inside WSL failed (exit $LASTEXITCODE)" }
+
+  # Ask the distro where HOME is instead of assuming /home/<user>. Download into HOME,
+  # not /tmp: a name under a world-writable directory can be pre-created by any other
+  # local account, and we are about to execute whatever lands there.
+  $wslHome = (wsl.exe -d $distro -u $user -- printenv HOME | Out-String)
+  if ($LASTEXITCODE -ne 0) { throw "could not resolve HOME for '$user' inside WSL (exit $LASTEXITCODE)" }
+  $wslHome = ($wslHome -replace "`r", "").Trim()
+  if (-not $wslHome) { throw "could not resolve HOME for '$user' inside WSL (empty)" }
+
+  # One name per run. With a fixed name, two concurrent runs corrupt each other: one
+  # curl truncates the file the other is already executing (bash reads a script as it
+  # goes, so the loser runs half an installer), and whichever finishes first deletes
+  # the other's script. HOME is not world-writable, so the only possible collision is
+  # with ourselves -- a GUID settles it without another round trip for mktemp.
+  $script = "$wslHome/.hub-agent-install." + [guid]::NewGuid().ToString("N") + ".sh"
+
+  try {
+    wsl.exe -d $distro -u $user -- curl -fsSL $INSTALL_SH -o $script
+    if ($LASTEXITCODE -ne 0) { throw "downloading install.sh inside WSL failed (exit $LASTEXITCODE)" }
+
+    # `env` carries the settings as plain argv tokens. Interpolating them into a shell
+    # string is what broke above, and argv also keeps the token out of shell history.
+    wsl.exe -d $distro -u $user -- env "HUB_AGENT_TOKEN=$tok" "HUB_AGENT_URL=$HubUrl" bash $script
+    if ($LASTEXITCODE -ne 0) { throw "install.sh inside WSL failed (exit $LASTEXITCODE)" }
+  } finally {
+    # Inside try so a partial download is reclaimed too. Best effort: a run killed from
+    # outside PowerShell leaves one .hub-agent-install.<guid>.sh in the user's own home.
+    # Never delete by wildcard here -- that would collect a concurrent run's script.
+    wsl.exe -d $distro -u $user -- rm -f $script | Out-Null
+  }
 }
 
 # =============================================================================