@danypops/pi-packed 0.19.9 → 0.19.10

package/service/src/registry/registry.ts

@@ -0,0 +1,246 @@
+/**
+ * registry.ts — driven adapter: npm registry over HTTP (web-standard fetch).
+ * Lean mapping = Facade over npm's verbose package documents.
+ */
+
+import type { DownloadObservations, Pkg, PkgInfo, Registry, SearchPage } from "../packages/package.ts";
+import {
+	NPM_REGISTRY_BASE,
+	PAGE_DELAY_MS,
+	REGISTRY_FETCH_TIMEOUT_MS,
+	RETRY_BASE_DELAY_MS,
+	RETRY_MAX_ATTEMPTS,
+	SEARCH_PAGE_SIZE,
+} from "../shared/constants.ts";
+import { createLogger } from "../shared/log.ts";
+
+const log = createLogger("registry");
+
+/** Upstream etiquette: honor Retry-After on 429, exponential backoff
+ * otherwise, give up after RETRY_MAX_ATTEMPTS. */
+async function fetchWithRetry(url: string, init: RequestInit | undefined, baseDelayMs: number): Promise<Response> {
+	let lastErr: Error | undefined;
+	for (let attempt = 1; attempt <= RETRY_MAX_ATTEMPTS; attempt++) {
+		const t0 = Date.now();
+		try {
+			const signal = init?.signal
+				? AbortSignal.any([init.signal, AbortSignal.timeout(REGISTRY_FETCH_TIMEOUT_MS)])
+				: AbortSignal.timeout(REGISTRY_FETCH_TIMEOUT_MS);
+			const res = await fetch(url, { ...init, signal });
+			const ms = Date.now() - t0;
+			if (res.status === 429 && attempt < RETRY_MAX_ATTEMPTS) {
+				const ra = res.headers.get("retry-after");
+				const delayMs =
+					ra !== null && Number(ra) > 0
+						? Number(ra) * 1000 // authoritative only when positive
+						: baseDelayMs * 2 ** (attempt - 1); // npm sends 0: use exponential
+				log.warn("429 rate-limited, backing off", { attempt, delayMs, ms, url: url.slice(0, 120) });
+				await Bun.sleep(delayMs);
+				continue;
+			}
+			log.debug("fetch", { status: res.status, ms, attempt, url: url.slice(0, 120) });
+			return res;
+		} catch (e) {
+			lastErr = e instanceof Error ? e : new Error(String(e));
+			log.warn("fetch error, retrying", { attempt, error: lastErr.message, url: url.slice(0, 120) });
+			if (attempt < RETRY_MAX_ATTEMPTS) await Bun.sleep(baseDelayMs * 2 ** (attempt - 1));
+		}
+	}
+	log.error("retry budget exhausted", { attempts: RETRY_MAX_ATTEMPTS, url: url.slice(0, 120) });
+	throw lastErr ?? new Error("retry budget exhausted");
+}
+
+export class HttpRegistry implements Registry {
+	constructor(
+		private base = NPM_REGISTRY_BASE,
+		private pageSize = SEARCH_PAGE_SIZE,
+		private pageDelayMs = PAGE_DELAY_MS,
+		private retryBaseDelayMs = RETRY_BASE_DELAY_MS,
+		private downloadsBase = "https://api.npmjs.org",
+	) {}
+
+	async search(query: string, limit: number): Promise<SearchPage> {
+		return this.searchPage(query, 0, limit);
+	}
+
+	async searchPage(query: string, from: number, size: number): Promise<SearchPage> {
+		const params = new URLSearchParams({ text: query, size: String(size), from: String(from) });
+		const res = await fetchWithRetry(`${this.base}/-/v1/search?${params}`, undefined, this.retryBaseDelayMs);
+		if (!res.ok) throw new Error(`npm search: HTTP ${res.status}`);
+		const doc = (await res.json()) as {
+			total?: number;
+			objects?: { package?: { name?: string; version?: string; description?: string; date?: string } }[];
+		};
+		const results: Pkg[] = (doc.objects ?? []).flatMap((o) => {
+			const p = o.package;
+			return p?.name
+				? [
+						{
+							name: boundedString(p.name, 214)!,
+							version: boundedString(p.version, 128) ?? "",
+							description: boundedString(p.description, 512),
+							date: boundedString(p.date, 64),
+							packageEvidence: {
+								shape: "keyword-only" as const,
+								verified: false,
+								evidence: ["npm keyword search candidate; tarball not inspected"],
+							},
+						},
+					]
+				: [];
+		});
+		return { results, total: doc.total ?? results.length };
+	}
+
+	async searchAll(query: string): Promise<Pkg[]> {
+		// Map by name: npm's ranking shifts mid-pagination and a package can
+		// appear on two pages — first occurrence wins.
+		const byName = new Map<string, Pkg>();
+		let from = 0;
+		for (;;) {
+			if (from > 0 && this.pageDelayMs > 0) await Bun.sleep(this.pageDelayMs);
+			const { results, total } = await this.searchPage(query, from, this.pageSize);
+			if (results.length === 0 || from >= total) break;
+			for (const p of results) {
+				if (!byName.has(p.name)) byName.set(p.name, p);
+			}
+			from += results.length;
+		}
+		return [...byName.values()];
+	}
+
+	async info(name: string): Promise<PkgInfo> {
+		const encoded = encodeURIComponent(name).replace("%2F", "/");
+		const res = await fetchWithRetry(`${this.base}/${encoded}/latest`, { headers: { accept: "application/json" } }, this.retryBaseDelayMs);
+		if (!res.ok) throw new Error(`npm info ${name}: HTTP ${res.status}`);
+		const v = (await boundedJson(res, 1024 * 1024)) as {
+			name?: string;
+			version?: string;
+			description?: string;
+			homepage?: string;
+			license?: unknown;
+			repository?: unknown;
+			bugs?: unknown;
+			keywords?: string[];
+			pi?: Record<string, unknown>;
+			peerDependencies?: Record<string, string>;
+			scripts?: Record<string, string>;
+			dist?: { unpackedSize?: number; integrity?: string; attestations?: { url?: string; provenance?: unknown } };
+		};
+		const manifestFields = v.pi ? Object.keys(v.pi).filter((key) => ["extensions", "skills", "prompts", "themes"].includes(key)) : [];
+		return {
+			name: boundedString(v.name, 214) ?? boundedString(name, 214)!,
+			version: boundedString(v.version, 128) ?? "",
+			description: boundedString(v.description, 512),
+			homepage: boundedString(v.homepage, 2_048),
+			repository: boundedString(rawToString(v.repository, "url"), 2_048),
+			repositoryDirectory: boundedString(rawToString(v.repository, "directory"), 256),
+			bugs: boundedString(rawToString(v.bugs, "url"), 2_048),
+			license: boundedString(rawToString(v.license, "type"), 128),
+			keywords: v.keywords
+				?.filter((value): value is string => typeof value === "string")
+				.slice(0, 50)
+				.map((value) => value.slice(0, 64)),
+			pi: boundedPiManifest(v.pi),
+			peerDependencies: boundedDependencies(v.peerDependencies),
+			scripts: boundedDependencies(v.scripts),
+			readmeAvailable: false,
+			unpackedSize: v.dist?.unpackedSize,
+			packageEvidence:
+				manifestFields.length > 0
+					? {
+							shape: "manifest",
+							verified: false,
+							evidence: manifestFields.map((field) => `registry package.json pi.${field}; tarball not inspected`),
+						}
+					: { shape: "keyword-only", verified: false, evidence: ["registry metadata has no Pi manifest resources; tarball not inspected"] },
+			publication: {
+				integrity: v.dist?.integrity,
+				provenanceUrl: v.dist?.attestations?.provenance ? v.dist.attestations.url : undefined,
+				trustedPublisher: "unknown",
+			},
+		};
+	}
+
+	/** Uses npm's abbreviated multi-version doc, not `/latest` (which carries
+	 * no `time`/`modified` field at all -- confirmed against the live
+	 * registry). Still bounded well under the full unabbreviated document's
+	 * size, since the abbreviated shape drops readme/changelog content per
+	 * version. */
+	async modifiedAt(name: string): Promise<string | undefined> {
+		const encoded = encodeURIComponent(name).replace("%2F", "/");
+		const res = await fetchWithRetry(
+			`${this.base}/${encoded}`,
+			{ headers: { accept: "application/vnd.npm.install-v1+json" } },
+			this.retryBaseDelayMs,
+		);
+		if (!res.ok) throw new Error(`npm modifiedAt ${name}: HTTP ${res.status}`);
+		const doc = (await boundedJson(res, 512 * 1024)) as { modified?: unknown };
+		return boundedString(doc.modified, 64);
+	}
+
+	async downloads(name: string): Promise<DownloadObservations> {
+		const encoded = encodeURIComponent(name).replace("%2F", "/");
+		const [weekly, monthly] = await Promise.all([
+			fetchWithRetry(`${this.downloadsBase}/downloads/point/last-week/${encoded}`, undefined, this.retryBaseDelayMs),
+			fetchWithRetry(`${this.downloadsBase}/downloads/point/last-month/${encoded}`, undefined, this.retryBaseDelayMs),
+		]);
+		if (!weekly.ok || !monthly.ok) throw new Error(`npm downloads ${name}: HTTP ${weekly.ok ? monthly.status : weekly.status}`);
+		const [weekDoc, monthDoc] = (await Promise.all([boundedJson(weekly, 64 * 1024), boundedJson(monthly, 64 * 1024)])) as [
+			{ downloads?: number },
+			{ downloads?: number },
+		];
+		return { weekly: boundedCount(weekDoc.downloads), monthly: boundedCount(monthDoc.downloads), observedAt: new Date().toISOString() };
+	}
+}
+
+async function boundedJson(response: Response, maxBytes: number): Promise<unknown> {
+	const declared = Number(response.headers.get("content-length") ?? 0);
+	if (declared > maxBytes) throw new Error(`npm response exceeds ${maxBytes} bytes`);
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	if (bytes.byteLength > maxBytes) throw new Error(`npm response exceeds ${maxBytes} bytes`);
+	return JSON.parse(new TextDecoder().decode(bytes));
+}
+
+function boundedString(value: unknown, max: number): string | undefined {
+	return typeof value === "string" ? value.slice(0, max) : undefined;
+}
+
+function boundedPiManifest(value: unknown): Record<string, unknown> | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const source = value as Record<string, unknown>;
+	const result: Record<string, unknown> = {};
+	for (const field of ["extensions", "skills", "prompts", "themes"] as const) {
+		if (Array.isArray(source[field]))
+			result[field] = source[field]
+				.filter((item): item is string => typeof item === "string")
+				.slice(0, 100)
+				.map((item) => item.slice(0, 256));
+	}
+	return Object.keys(result).length > 0 ? result : undefined;
+}
+
+function boundedDependencies(value: unknown): Record<string, string> | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const entries = Object.entries(value as Record<string, unknown>)
+		.filter((entry): entry is [string, string] => typeof entry[1] === "string")
+		.slice(0, 100)
+		.map(([name, range]) => [name.slice(0, 214), range.slice(0, 128)]);
+	return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+
+function boundedCount(value: unknown): number | undefined {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0
+		? Math.min(Math.floor(value), Number.MAX_SAFE_INTEGER)
+		: undefined;
+}
+
+/** npm fields appear as plain string OR object: license: "MIT" | {type:"MIT"}. */
+function rawToString(raw: unknown, objKey: string): string | undefined {
+	if (typeof raw === "string") return raw;
+	if (raw && typeof raw === "object") {
+		const v = (raw as Record<string, unknown>)[objKey];
+		if (typeof v === "string") return v;
+	}
+	return undefined;
+}

package/service/src/security/security.ts

@@ -0,0 +1,128 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonAtomic } from "../shared/atomic-json.ts";
+import { SECURITY_FILE } from "../shared/constants.ts";
+
+export const MUTATION_APPROVAL_VALUES = ["always", "never"] as const;
+export type MutationApproval = (typeof MUTATION_APPROVAL_VALUES)[number];
+
+export const PACKAGE_OPERATIONS = [
+	"search",
+	"info",
+	"installed",
+	"catalog",
+	"index.status",
+	"index.build",
+	"updates",
+	"check",
+	"setup.plan",
+	"security.read",
+	"mirror",
+	"setup.export",
+	"setup.update",
+	"install",
+	"install_service",
+	"restart_service",
+	"setup.apply",
+	"update",
+	"update.self",
+	"remove",
+	"resources.list",
+	"resources.toggle",
+	"security.write",
+	"pi.status",
+	"advisories.scan",
+	"doctor",
+] as const;
+export type PackageOperation = (typeof PACKAGE_OPERATIONS)[number];
+export type PackageOperationClassification = "read" | "maintenance" | "code-execution" | "settings-mutation" | "security-mutation";
+
+export interface SecuritySettings {
+	mutationApproval: MutationApproval;
+}
+export interface SecuritySettingsPort {
+	security(): Promise<SecuritySettings>;
+	setMutationApproval(value: MutationApproval, options?: { approved?: boolean }): Promise<SecuritySettings>;
+}
+
+export interface PackagePermissionDecision {
+	operation: PackageOperation;
+	classification: PackageOperationClassification;
+	approvalRequired: boolean;
+}
+
+export const DEFAULT_SECURITY_SETTINGS: SecuritySettings = { mutationApproval: "always" };
+
+const CLASSIFICATIONS: Record<PackageOperation, PackageOperationClassification> = {
+	search: "read",
+	info: "read",
+	installed: "read",
+	catalog: "read",
+	"index.status": "read",
+	"index.build": "maintenance",
+	updates: "read",
+	check: "read",
+	"setup.plan": "read",
+	"security.read": "read",
+	mirror: "maintenance",
+	"setup.export": "maintenance",
+	"setup.update": "maintenance",
+	install: "code-execution",
+	install_service: "code-execution",
+	restart_service: "code-execution",
+	"setup.apply": "code-execution",
+	update: "code-execution",
+	"update.self": "code-execution",
+	remove: "settings-mutation",
+	"resources.list": "read",
+	"resources.toggle": "settings-mutation",
+	"security.write": "security-mutation",
+	"pi.status": "read",
+	"advisories.scan": "read",
+	doctor: "read",
+};
+
+export class PackageApprovalRequiredError extends Error {
+	readonly code = "approval_required";
+	constructor(readonly operation: PackageOperation) {
+		super(`approval required for package operation ${operation}`);
+		this.name = "PackageApprovalRequiredError";
+	}
+}
+
+export function packageOperationClassification(operation: PackageOperation): PackageOperationClassification {
+	return CLASSIFICATIONS[operation];
+}
+
+export function packagePermissionDecision(settings: SecuritySettings, operation: PackageOperation): PackagePermissionDecision {
+	const classification = packageOperationClassification(operation);
+	const guarded = classification === "code-execution" || classification === "settings-mutation" || classification === "security-mutation";
+	return { operation, classification, approvalRequired: guarded && settings.mutationApproval === "always" };
+}
+
+export function assertPackagePermission(settings: SecuritySettings, operation: PackageOperation, approved = false): void {
+	if (packagePermissionDecision(settings, operation).approvalRequired && !approved) {
+		throw new PackageApprovalRequiredError(operation);
+	}
+}
+
+export function readSecuritySettings(stateDir: string): SecuritySettings {
+	try {
+		const value = JSON.parse(readFileSync(join(stateDir, SECURITY_FILE), "utf8")) as {
+			mutationApproval?: unknown;
+			installApproval?: unknown;
+		};
+		const stored = value.mutationApproval ?? value.installApproval;
+		return MUTATION_APPROVAL_VALUES.includes(stored as MutationApproval)
+			? { mutationApproval: stored as MutationApproval }
+			: { ...DEFAULT_SECURITY_SETTINGS };
+	} catch {
+		return { ...DEFAULT_SECURITY_SETTINGS };
+	}
+}
+
+export async function writeSecuritySettings(stateDir: string, settings: SecuritySettings): Promise<SecuritySettings> {
+	if (!MUTATION_APPROVAL_VALUES.includes(settings.mutationApproval)) throw new Error("mutationApproval must be always or never");
+	await writeJsonAtomic(join(stateDir, SECURITY_FILE), settings, { mode: 0o600 });
+	return { ...settings };
+}

package/service/src/self-update/self-update.ts

@@ -0,0 +1,148 @@
+/**
+ * self-update.ts — updates Packed's own installation and restarts its
+ * supervised systemd service, mirroring pi-version.ts's established
+ * pattern: orchestrate the real package manager's own update command,
+ * never reimplement version resolution.
+ *
+ * Detects how this CLI is actually running first. An npm-global install
+ * (the real end-user case) gets a real `npm install --global` update. A
+ * local git checkout (this repo's own dev setup: the shell wrapper execs
+ * `bun .../packed/packages/packed/src/cli/cli.ts` directly, no npm layer at
+ * all) skips the update step entirely rather than guessing at a git
+ * workflow -- but still restarts the service, which is the actual
+ * point for that case: pick up already-committed local source changes
+ * without a manual `systemctl restart`.
+ */
+import { fileURLToPath } from "node:url";
+import type { Registry } from "../packages/package.ts";
+import { type InteractiveRunResult, runInherited } from "../publish/publish.ts";
+import { VERSION } from "../shared/version.ts";
+
+export const PACKED_PACKAGE_NAME = "@danypops/pi-packed";
+
+export type SelfInstallMethod = { kind: "npm-global" } | { kind: "bun-global" } | { kind: "local-checkout"; path: string };
+
+/** cli.ts's own resolved real path tells us how it's running: Bun's global
+ * install layout is `$BUN_INSTALL/install/global/node_modules/<pkg>/...`
+ * (confirmed live against a real `bun add -g` install -- distinct from a
+ * plain npm-global tree, which has no `install/global` segment at all), an
+ * ordinary node_modules/@danypops/pi-packed tree (npm-managed), or anywhere
+ * else (a plain checkout). Bun-global is checked first since its path also
+ * contains the broader npm-global substring. */
+export function detectSelfInstallMethod(cliUrl: string = import.meta.url): SelfInstallMethod {
+	const path = fileURLToPath(cliUrl);
+	if (path.includes(`/install/global/node_modules/${PACKED_PACKAGE_NAME}/`)) return { kind: "bun-global" };
+	if (path.includes(`node_modules/${PACKED_PACKAGE_NAME}/`)) return { kind: "npm-global" };
+	return { kind: "local-checkout", path };
+}
+
+export interface SelfUpdateReport {
+	ok: boolean;
+	previousVersion: string;
+	latestVersion?: string;
+	updated: boolean;
+	restarted: boolean;
+	message: string;
+}
+
+export interface SelfUpdateDeps {
+	registry: Pick<Registry, "info">;
+	installMethod?: SelfInstallMethod;
+	/** Defaults to `npm install --global @danypops/pi-packed@latest` via
+	 * runInherited -- real npm output, no timeout, matching
+	 * runPiUpdateSelf's exact pattern for pi's own self-update. */
+	runNpmInstall?: (args: string[]) => Promise<InteractiveRunResult>;
+	/** Defaults to `bun add --global @danypops/pi-packed@latest` via
+	 * runInherited -- Bun's own documented way to force-update a global
+	 * install (re-adding with an explicit version); `bun update` has no
+	 * --global flag at all. */
+	runBunInstall?: (args: string[]) => Promise<InteractiveRunResult>;
+	/** Undefined when the current platform has no supported restart
+	 * mechanism (only Linux/systemd today, matching `packed service`'s
+	 * own Linux-only scope) -- never guessed at. */
+	restartService?: () => Promise<InteractiveRunResult>;
+	isServiceInstalled?: () => boolean;
+}
+
+export async function runSelfUpdate(deps: SelfUpdateDeps): Promise<SelfUpdateReport> {
+	const previousVersion = VERSION;
+	const method = deps.installMethod ?? detectSelfInstallMethod();
+	let latestVersion: string | undefined;
+	let updated = false;
+	let updateNote: string;
+
+	if (method.kind === "local-checkout") {
+		updateNote = `skipped update: running from a local checkout at ${method.path} (update it with your own git workflow, e.g. git pull)`;
+	} else {
+		try {
+			latestVersion = (await deps.registry.info(PACKED_PACKAGE_NAME)).version;
+		} catch {
+			/* best-effort; the package manager's own install resolves latest either way */
+		}
+		if (method.kind === "bun-global") {
+			const runBunInstall = deps.runBunInstall ?? ((args) => runInherited(["bun", ...args]));
+			const install = await runBunInstall(["add", "--global", `${PACKED_PACKAGE_NAME}@latest`]);
+			if (!install.ok) {
+				return {
+					ok: false,
+					previousVersion,
+					latestVersion,
+					updated: false,
+					restarted: false,
+					message: `bun add --global ${PACKED_PACKAGE_NAME}@latest failed (exit ${install.code})`,
+				};
+			}
+			updated = true;
+			updateNote = "updated via bun";
+		} else {
+			const runNpmInstall = deps.runNpmInstall ?? ((args) => runInherited(["npm", ...args]));
+			const install = await runNpmInstall(["install", "--global", `${PACKED_PACKAGE_NAME}@latest`]);
+			if (!install.ok) {
+				return {
+					ok: false,
+					previousVersion,
+					latestVersion,
+					updated: false,
+					restarted: false,
+					message: `npm install --global ${PACKED_PACKAGE_NAME}@latest failed (exit ${install.code})`,
+				};
+			}
+			updated = true;
+			updateNote = "updated via npm";
+		}
+	}
+
+	const isServiceInstalled = deps.isServiceInstalled ?? (() => false);
+	if (!isServiceInstalled()) {
+		return {
+			ok: true,
+			previousVersion,
+			latestVersion,
+			updated,
+			restarted: false,
+			message: `${updateNote}; no supervised pi-packed service was found -- restart any running daemon manually`,
+		};
+	}
+	if (!deps.restartService) {
+		return {
+			ok: true,
+			previousVersion,
+			latestVersion,
+			updated,
+			restarted: false,
+			message: `${updateNote}; restarting the service isn't supported on this platform yet -- restart it manually: systemctl --user restart pi-packed.service`,
+		};
+	}
+	const restart = await deps.restartService();
+	if (!restart.ok) {
+		return {
+			ok: updated,
+			previousVersion,
+			latestVersion,
+			updated,
+			restarted: false,
+			message: `${updateNote}; restarting pi-packed.service failed (exit ${restart.code}) -- restart it manually: systemctl --user restart pi-packed.service`,
+		};
+	}
+	return { ok: true, previousVersion, latestVersion, updated, restarted: true, message: `${updateNote}; restarted the pi-packed service` };
+}