@duckmind/dm-darwin-x64 0.66.5 → 0.66.7

package/extensions/dm-lens/clients/installer/index.js

@@ -1,6 +1,13 @@
 import { spawn } from "node:child_process";
-import { existsSync, statSync, unlinkSync } from "node:fs";
+import {
+  existsSync,
+  readFileSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
 import fs from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
 import https from "node:https";
 import { createRequire } from "node:module";
 import os from "node:os";
@@ -23,6 +30,16 @@ import {
 import { commitDurableStoreAsync } from "../durable-store.js";
 import { getGlobalDmLensDir } from "../file-utils.js";
 import { createGenerationMap } from "../generation-guard.js";
+import {
+  heartbeatIntervalMs,
+  isLockContention,
+  ownsTopGeneration,
+  recordGenerationTakeover,
+  recordLegacyLockHeld,
+  releaseGeneration,
+  startGenerationHeartbeat,
+  tryAcquireGeneration
+} from "../generation-lock.js";
 import { resolveToolCwd } from "../tool-cwd.js";
 import {
   allAvailableGlobalBinDirs,
@@ -43,6 +60,7 @@ import { logSessionStart } from "../sessionstart-logger.js";
 import { resolveGitHubToken } from "../zizmor-config.js";
 const TOOLS_DIR = path.join(getGlobalDmLensDir(), "tools");
 const INSTALL_LOCK_PATH = path.join(TOOLS_DIR, ".install.lock");
+const INSTALL_LOCK_GENERATIONS = `${INSTALL_LOCK_PATH}s`;
 const activeInstallLocks = new Set;
 let installLockExitCleanupRegistered = false;
 export function getManagedToolsDir() {
@@ -56,25 +74,105 @@ function isProcessAlive(pid) {
     return error.code === "EPERM";
   }
 }
+function installLockMaxAgeMs() {
+  return (Number(process.env.DM_LENS_INSTALL_TIMEOUT_MS) || 120000) + 60000;
+}
+function legacyInstallLockIsStale(maxAgeMs) {
+  try {
+    const owner = JSON.parse(readFileSync(INSTALL_LOCK_PATH, "utf8"));
+    const expired = Number.isFinite(owner.createdAt) && Date.now() - owner.createdAt > maxAgeMs;
+    return expired || Number.isInteger(owner.pid) && owner.pid > 0 && !isProcessAlive(owner.pid);
+  } catch {
+    try {
+      return Date.now() - statSync(INSTALL_LOCK_PATH).mtimeMs > maxAgeMs;
+    } catch {
+      return false;
+    }
+  }
+}
+function createLegacyInstallLock(token) {
+  try {
+    writeFileSync(INSTALL_LOCK_PATH, token, { flag: "wx" });
+    return true;
+  } catch (cause) {
+    if (isLockContention(cause))
+      return false;
+    throw cause;
+  }
+}
+function takeLegacyInstallLock(maxAgeMs, token) {
+  if (createLegacyInstallLock(token))
+    return true;
+  if (!legacyInstallLockIsStale(maxAgeMs))
+    return false;
+  try {
+    unlinkSync(INSTALL_LOCK_PATH);
+  } catch {
+    return false;
+  }
+  return createLegacyInstallLock(token);
+}
+function installLockOwner() {
+  try {
+    const owner = JSON.parse(readFileSync(INSTALL_LOCK_PATH, "utf8"));
+    return `pid=${owner.pid} createdAt=${owner.createdAt}`;
+  } catch {
+    return "unknown owner";
+  }
+}
+function tryAcquireInstallLock(maxAgeMs) {
+  const hold = tryAcquireGeneration(INSTALL_LOCK_GENERATIONS, maxAgeMs);
+  if (!hold)
+    return "busy";
+  if (hold.tookOverStale)
+    recordGenerationTakeover(hold);
+  const heartbeat = startGenerationHeartbeat(hold, heartbeatIntervalMs(maxAgeMs));
+  const token = JSON.stringify({
+    pid: process.pid,
+    createdAt: Date.now(),
+    nonce: randomUUID()
+  });
+  let took;
+  try {
+    took = takeLegacyInstallLock(maxAgeMs, token);
+  } catch (cause) {
+    heartbeat.stop();
+    releaseGeneration(hold);
+    throw cause;
+  }
+  if (took)
+    return { generation: hold, token, heartbeat };
+  heartbeat.stop();
+  releaseGeneration(hold);
+  return "legacy-held";
+}
+function releaseInstallLock(hold) {
+  activeInstallLocks.delete(hold);
+  hold.heartbeat.stop();
+  try {
+    if (readFileSync(INSTALL_LOCK_PATH, "utf8") === hold.token)
+      unlinkSync(INSTALL_LOCK_PATH);
+  } catch {}
+  releaseGeneration(hold.generation);
+}
 async function acquireInstallLock() {
-  await fs.mkdir(TOOLS_DIR, { recursive: true });
   const timeoutMs = Number(process.env.DM_LENS_INSTALL_LOCK_TIMEOUT_MS) || 150000;
   const deadline = Date.now() + timeoutMs;
-  let lastOwner = "unknown owner";
+  const maxAgeMs = installLockMaxAgeMs();
+  let legacyHeldRecorded = false;
   while (Date.now() < deadline) {
-    try {
-      const handle = await fs.open(INSTALL_LOCK_PATH, "wx");
-      await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: Date.now() }));
-      await handle.close();
-      activeInstallLocks.add(INSTALL_LOCK_PATH);
+    const hold = tryAcquireInstallLock(maxAgeMs);
+    if (hold === "legacy-held" && !legacyHeldRecorded) {
+      legacyHeldRecorded = true;
+      recordLegacyLockHeld(INSTALL_LOCK_PATH);
+    }
+    if (typeof hold === "object") {
+      activeInstallLocks.add(hold);
       if (!installLockExitCleanupRegistered) {
         installLockExitCleanupRegistered = true;
         process.once("exit", () => {
-          for (const lockPath of activeInstallLocks) {
-            try {
-              unlinkSync(lockPath);
-            } catch {}
-          }
+          for (const held of activeInstallLocks)
+            releaseInstallLock(held);
         });
       }
       let released = false;
@@ -83,38 +181,15 @@ async function acquireInstallLock() {
           if (released)
             return;
           released = true;
-          activeInstallLocks.delete(INSTALL_LOCK_PATH);
-          await fs.rm(INSTALL_LOCK_PATH, { force: true });
-        }
+          releaseInstallLock(hold);
+        },
+        ownsLock: () => ownsTopGeneration(hold.generation)
       };
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw error;
-      try {
-        const owner = JSON.parse(await fs.readFile(INSTALL_LOCK_PATH, "utf8"));
-        lastOwner = `pid=${owner.pid} createdAt=${owner.createdAt}`;
-        const maxAgeMs = (Number(process.env.DM_LENS_INSTALL_TIMEOUT_MS) || 120000) + 60000;
-        const expired = Number.isFinite(owner.createdAt) && Date.now() - owner.createdAt > maxAgeMs;
-        if (expired || Number.isInteger(owner.pid) && owner.pid > 0 && !isProcessAlive(owner.pid)) {
-          await fs.rm(INSTALL_LOCK_PATH, { force: true });
-          continue;
-        }
-      } catch (readError) {
-        lastOwner = "unreadable owner";
-        try {
-          const stat = await fs.stat(INSTALL_LOCK_PATH);
-          const maxAgeMs = (Number(process.env.DM_LENS_INSTALL_TIMEOUT_MS) || 120000) + 60000;
-          if (Date.now() - stat.mtimeMs > maxAgeMs) {
-            await fs.rm(INSTALL_LOCK_PATH, { force: true });
-            continue;
-          }
-        } catch {}
-      }
-      await new Promise((resolve) => setTimeout(resolve, 100));
     }
+    await new Promise((resolve) => setTimeout(resolve, 100));
   }
   return {
-    reason: `timed out after ${timeoutMs}ms waiting for shared tools install lock (${lastOwner})`
+    reason: `timed out after ${timeoutMs}ms waiting for shared tools install lock (${installLockOwner()})`
   };
 }
 const GITHUB_BIN_DIR = path.join(getGlobalDmLensDir(), "bin");
@@ -364,7 +439,7 @@ export const TOOLS = [
     checkCommand: "jscpd",
     checkArgs: ["--version"],
     installStrategy: "npm",
-    packageName: "jscpd@5.3.0",
+    packageName: "jscpd@5.4.0",
     binaryName: "jscpd"
   },
   {
@@ -795,7 +870,28 @@ export const TOOLS = [
     archive: {
       url: "https://github.com/spotbugs/spotbugs/releases/download/4.10.2/spotbugs-4.10.2.tgz",
       kind: "tgz",
-      launcher: "bin/spotbugs"
+      launcher: "bin/spotbugs",
+      sha256: {
+        "https://github.com/spotbugs/spotbugs/releases/download/4.10.2/spotbugs-4.10.2.tgz": "63d7687c35fba12cbc8e55ec2a889a2bbf1b9be299dea91f2b0d351dc285308a"
+      }
+    }
+  },
+  {
+    id: "kotlin-language-server",
+    name: "Kotlin Language Server",
+    checkCommand: "kotlin-language-server",
+    checkArgs: ["--version"],
+    installStrategy: "archive",
+    binaryName: "kotlin-language-server",
+    verification: "tree-manifest",
+    archive: {
+      url: "https://github.com/fwcd/kotlin-language-server/releases/download/1.3.13/server.zip",
+      kind: "zip",
+      launcher: "bin/kotlin-language-server",
+      runtime: "java",
+      sha256: {
+        "https://github.com/fwcd/kotlin-language-server/releases/download/1.3.13/server.zip": "4fe7d71d087b307c7869036171bd9d8c6a4284cd7c25b89098b0a24eb2d9b6d2"
+      }
     }
   },
   {
@@ -813,7 +909,10 @@ export const TOOLS = [
       url: "https://github.com/PowerShell/PowerShellEditorServices/releases/download/v4.6.0/PowerShellEditorServices.zip",
       kind: "zip",
       stripComponents: 0,
-      treeMarker: "PowerShellEditorServices/Start-EditorServices.ps1"
+      treeMarker: "PowerShellEditorServices/Start-EditorServices.ps1",
+      sha256: {
+        "https://github.com/PowerShell/PowerShellEditorServices/releases/download/v4.6.0/PowerShellEditorServices.zip": "0d91898f73d4faeb64291336f6386f0c890a933df012827571adf7008480a04a"
+      }
     }
   },
   {
@@ -837,7 +936,12 @@ export const TOOLS = [
       },
       kind: "zip",
       stripComponents: 1,
-      treeMarker: "bin"
+      treeMarker: "bin",
+      sha256: {
+        "https://github.com/clangd/clangd/releases/download/22.1.0/clangd-linux-22.1.0.zip": "c54e57dbff3ccc9e8352367ddb7030ad3f624073ec58c7477424e7919f578572",
+        "https://github.com/clangd/clangd/releases/download/22.1.0/clangd-mac-22.1.0.zip": "71eddc5303da9a5bc5e8b509488b5b2c5acf45f20e33b8394e71a12a56d67198",
+        "https://github.com/clangd/clangd/releases/download/22.1.0/clangd-windows-22.1.0.zip": "e31e271fe11f6dcd7cf87ca74be4a12788ff8ce5a0b07762583e335c058e939a"
+      }
     }
   },
   {
@@ -861,7 +965,14 @@ export const TOOLS = [
       },
       kind: (platform) => platform === "win32" ? "zip" : "tgz",
       stripComponents: 0,
-      treeMarker: "bin"
+      treeMarker: "bin",
+      sha256: {
+        "https://github.com/LuaLS/lua-language-server/releases/download/3.18.2/lua-language-server-3.18.2-linux-arm64.tar.gz": "273af33f26f4a1143f27c96d9f9e1188aba619c71e0807042134f66b4bd27f24",
+        "https://github.com/LuaLS/lua-language-server/releases/download/3.18.2/lua-language-server-3.18.2-linux-x64.tar.gz": "ca71415dd19f19e30aaa35a4915aefca9fdb5fec31b98331cc3d77f778d539c5",
+        "https://github.com/LuaLS/lua-language-server/releases/download/3.18.2/lua-language-server-3.18.2-darwin-arm64.tar.gz": "cec99d70b1f612acec4a10a79a03664e3aa0c229d4d8a586cb3f928ec37d509e",
+        "https://github.com/LuaLS/lua-language-server/releases/download/3.18.2/lua-language-server-3.18.2-darwin-x64.tar.gz": "e26cfefe423dd7326fc7c649539e4d4aaa4f35f34d2fefd8af2ed7090b72c556",
+        "https://github.com/LuaLS/lua-language-server/releases/download/3.18.2/lua-language-server-3.18.2-win32-x64.zip": "a4439a8f5e8e9e6505c11f045a7bf45db602124a1e246371c1dbe34924f3cf71"
+      }
     }
   },
   {
@@ -1691,11 +1802,13 @@ export async function getAllToolStatuses() {
       status.installed = true;
       status.source = "global-path";
       status.path = tool.checkCommand;
-      const probe = await probeToolAsync(tool.checkCommand, ["--version"], {
-        timeout: 5000
-      });
-      status.version = `${probe.stdout}${probe.stderr}`.trim().split(`
+      if (tool.verification !== "tree-manifest") {
+        const probe = await probeToolAsync(tool.checkCommand, ["--version"], {
+          timeout: 5000
+        });
+        status.version = `${probe.stdout}${probe.stderr}`.trim().split(`
 `)[0]?.slice(0, 30) || undefined;
+      }
       statuses.push(status);
       continue;
     }
@@ -1865,6 +1978,8 @@ async function getToolPathResolved(toolId, onTransient) {
   if (await isCommandAvailable(tool.checkCommand)) {
     if (packageEntryVerification(tool) !== undefined)
       return tool.checkCommand;
+    if (tool.verification === "tree-manifest")
+      return tool.checkCommand;
     let probeStalled = false;
     const verified = await verifyToolBinary(tool.checkCommand, undefined, () => {
       probeStalled = true;
@@ -2690,7 +2805,7 @@ async function refreshGitHubManagedTool(tool, known) {
   };
 }
 async function verifyRefreshedArtifact(tool, installedPath) {
-  if (tool.installStrategy === "archive" && !tool.archive?.launcher) {
+  if (tool.installStrategy === "archive" && (!tool.archive?.launcher || tool.verification === "tree-manifest")) {
     await updateProbeCache(tool.id, installedPath);
     return true;
   }
@@ -2892,6 +3007,25 @@ export async function swapExtractedDir(toolId, tmpDir, finalDir) {
     await fs.rm(backupDir, { recursive: true, force: true }).catch(() => {});
   }
 }
+const ARCHIVE_RUNTIME_HOMES = {
+  java: { env: "JAVA_HOME", dir: "bin" }
+};
+function runtimeHomeVerdict(runtime) {
+  const home = ARCHIVE_RUNTIME_HOMES[runtime];
+  const root = home ? process.env[home.env] : undefined;
+  if (!home || !root)
+    return;
+  const windows = installerPlatform() === "win32";
+  const names = windows ? [`${runtime}.exe`, runtime] : [runtime];
+  return names.some((name) => {
+    try {
+      const stat = statSync(path.join(root, home.dir, name));
+      return stat.isFile() && stat.size > 0 && (windows || (stat.mode & 73) !== 0);
+    } catch {
+      return false;
+    }
+  });
+}
 async function installArchiveTool(tool) {
   const spec = tool.archive;
   if (!spec)
@@ -2914,6 +3048,19 @@ async function installArchiveTool(tool) {
     logSessionStart(`archive-install ${tool.id}: download failed: ${err.message}`);
     return;
   }
+  const pinned = spec.sha256?.[url];
+  const digest = createHash("sha256").update(archiveBuffer).digest("hex");
+  if (digest !== pinned) {
+    const reason = pinned === undefined ? "sha256-unpinned" : "sha256-mismatch";
+    recordDegradationOnce({
+      kind: "managed-tool-install",
+      subject: `${tool.id}:${archiveKind}:integrity`,
+      reason: `archive integrity ${reason}`
+    });
+    installFailureReasons.set(tool.id, `archive integrity ${reason} (${archiveBuffer.length} bytes from ${url})`);
+    logSessionStart(`archive-install ${tool.id}: refused ${reason} (got ${digest}, pinned ${pinned ?? "none"}) — keeping installed version`);
+    return;
+  }
   const extractName = tool.id;
   const tmpExtractName = `${extractName}.refresh-tmp`;
   const archiveName = `${tool.id}.download.${archiveKind === "zip" ? "zip" : "tgz"}`;
@@ -2972,7 +3119,7 @@ async function installArchiveTool(tool) {
         return;
       }
       await swapExtractedDir(tool.id, tmpExtractDir, extractDir);
-      logSessionStart(`archive-install ${tool.id}: installed tree bundle → ${extractDir} (extracted ${archiveBuffer.length} bytes)`);
+      logSessionStart(`archive-install ${tool.id}: installed tree bundle → ${extractDir} (extracted ${archiveBuffer.length} bytes, sha256 verified ${digest})`);
       debugLog(`[archive] installed ${tool.name} bundle → ${extractDir}`);
       return extractDir;
     }
@@ -2989,6 +3136,16 @@ async function installArchiveTool(tool) {
     }
     if (!isWindows)
       await fs.chmod(tmpResolvedInner, 488).catch(() => {});
+    const launcherStat = await fs.stat(tmpResolvedInner).catch(() => {
+      return;
+    });
+    const launcherRunnable = launcherStat?.isFile() === true && launcherStat.size > 0 && (isWindows || (launcherStat.mode & 73) !== 0);
+    if (!launcherRunnable) {
+      recordArchiveExtractionDegradation(tool.id, archiveKind, "launcher-invalid");
+      logSessionStart(`archive-install ${tool.id}: ${archiveKind} launcher is empty or not executable — keeping installed version`);
+      await fs.rm(tmpExtractDir, { recursive: true, force: true }).catch(() => {});
+      return;
+    }
     await swapExtractedDir(tool.id, tmpExtractDir, extractDir);
     const innerLauncher = path.join(extractDir, ...launcherParts);
     const resolvedInner = isWindows ? `${innerLauncher}.bat` : innerLauncher;
@@ -3004,7 +3161,7 @@ call "${resolvedInner}" %*\r
 exec "${resolvedInner}" "$@"
 `, { bestEffort: false, mode: 488 });
     }
-    logSessionStart(`archive-install ${tool.id}: installed → ${shimPath} (extracted ${archiveBuffer.length} bytes)`);
+    logSessionStart(`archive-install ${tool.id}: installed → ${shimPath} (extracted ${archiveBuffer.length} bytes, sha256 verified ${digest})`);
     debugLog(`[archive] installed ${tool.name} → ${shimPath}`);
     return shimPath;
   } catch (err) {
@@ -3026,7 +3183,20 @@ function boundInstallError(value, limit = INSTALL_ERROR_LINE_LIMIT) {
   const line = value.replace(/[\r\n]+/g, " ").trim();
   return line.length > limit ? `${line.slice(0, limit - 3)}...` : line;
 }
-async function installNpmTool(toolId, packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 1e4, packageEntryOf) {
+
+class InstallLockLostError extends Error {
+}
+async function installNpmTool(toolId, packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 1e4, packageEntryOf, ownsLock) {
+  const assertOwnsLock = (context) => {
+    if (ownsLock && !ownsLock()) {
+      recordDegradationOnce({
+        kind: "install-lock-lost-mid-install",
+        subject: toolId,
+        reason: `install lock generation lost before ${context}; aborting rather than risk a second writer in TOOLS_DIR`
+      });
+      throw new InstallLockLostError(`install lock lost before ${context} for ${packageName} (#3515)`);
+    }
+  };
   try {
     await fs.mkdir(TOOLS_DIR, { recursive: true });
     const packageJsonPath = path.join(TOOLS_DIR, "package.json");
@@ -3056,12 +3226,14 @@ async function installNpmTool(toolId, packageName, binaryName, verificationArgs
         stderr: result.error?.message ?? result.stderr
       };
     };
+    assertOwnsLock(`spawning ${pmCommand} install`);
     let outcome = await runInstallAttempt([
       ...testNpmScript ? [testNpmScript] : [],
       ...baseInstallArgs
     ]);
     const erResolve = outcome.ok === false && /npm\s+error\s+ERESOLVE|\bERESOLVE\b|could not resolve/i.test(outcome.stderr);
     if (pm === "npm" && erResolve) {
+      assertOwnsLock(`retrying ${pmCommand} install with --legacy-peer-deps`);
       const retryArgs = installArgs(pm, packageName, {
         ignoreScripts: !needsScripts,
         legacyPeerDeps: true
@@ -3406,7 +3578,7 @@ async function finishInstallAttempt(toolId, ok, startedAt) {
   }
   return ok;
 }
-export async function installTool(toolId) {
+export async function installTool(toolId, ownsLock) {
   if (process.env.DM_LENS_DISABLE_TOOL_INSTALL === "1") {
     installFailureReasons.set(toolId, "installation disabled by DM_LENS_DISABLE_TOOL_INSTALL=1");
     noteInstallAttempt(toolId, "declined", "installation disabled by DM_LENS_DISABLE_TOOL_INSTALL=1");
@@ -3426,7 +3598,7 @@ export async function installTool(toolId) {
       case "npm": {
         if (!tool.packageName || !tool.binaryName)
           return false;
-        const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool), packageEntryVerification(tool));
+        const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool), packageEntryVerification(tool), ownsLock);
         if (npmPath !== undefined) {
           await import("./managed-tool-refresh.js").then((m) => m.stampManagedToolInstalled(tool.id, tool.packageName)).catch(() => {});
         }
@@ -3471,6 +3643,14 @@ export async function installTool(toolId) {
           logSessionStart(`auto-install ${tool.id}: ${reason}`);
           return false;
         }
+        const runtime = tool.archive.runtime;
+        const viaHome = runtime ? runtimeHomeVerdict(runtime) : undefined;
+        if (runtime && !(viaHome ?? await isCommandAvailable(runtime))) {
+          const reason = viaHome === undefined ? `runtime ${runtime} not found on PATH` : `runtime ${runtime} is not an executable file under ${ARCHIVE_RUNTIME_HOMES[runtime]?.env}`;
+          noteInstallAttempt(tool.id, "unavailable", reason);
+          logSessionStart(`auto-install ${tool.id}: ${reason}`);
+          return false;
+        }
         const archivePath = await installArchiveTool(tool);
         return finishInstallAttempt(tool.id, archivePath !== undefined, startedAt);
       }
@@ -3535,7 +3715,7 @@ async function ensureToolResolved(toolId, opts) {
     }
     let installed;
     try {
-      installed = await installTool(toolId);
+      installed = await installTool(toolId, lock.ownsLock);
     } finally {
       await lock.release();
     }
@@ -3631,7 +3811,7 @@ async function ensureToolResolved(toolId, opts) {
         updateProbeCache(toolId, installedByPeer, wasLastResolveTransient(toolId));
         return installedByPeer;
       }
-      installed = await installTool(toolId);
+      installed = await installTool(toolId, lock.ownsLock);
     } finally {
       await lock.release();
     }