@f5-sales-demo/xcsh 22.4.3 → 22.4.5

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "22.4.3",
+	"version": "22.4.5",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -67,13 +67,13 @@
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.4.0",
-		"@f5-sales-demo/pi-agent-core": "22.4.3",
-		"@f5-sales-demo/pi-ai": "22.4.3",
-		"@f5-sales-demo/pi-natives": "22.4.3",
-		"@f5-sales-demo/pi-resource-management": "22.4.3",
-		"@f5-sales-demo/pi-tui": "22.4.3",
-		"@f5-sales-demo/pi-utils": "22.4.3",
-		"@f5-sales-demo/xcsh-stats": "22.4.3",
+		"@f5-sales-demo/pi-agent-core": "22.4.5",
+		"@f5-sales-demo/pi-ai": "22.4.5",
+		"@f5-sales-demo/pi-natives": "22.4.5",
+		"@f5-sales-demo/pi-resource-management": "22.4.5",
+		"@f5-sales-demo/pi-tui": "22.4.5",
+		"@f5-sales-demo/pi-utils": "22.4.5",
+		"@f5-sales-demo/xcsh-stats": "22.4.5",
 		"@mozilla/readability": "^0.6",
 		"@resvg/resvg-wasm": "2.6.2",
 		"@sinclair/typebox": "0.34.52",

package/src/cli/linux-standalone-update.ts

@@ -0,0 +1,118 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+
+const REPO = "f5-sales-demo/xcsh";
+const MAX_INSTALLER_BYTES = 256 * 1024;
+
+export interface LinuxInstallerInput {
+	script: Buffer;
+	installDir: string;
+	version: string;
+}
+
+export interface LinuxStandaloneUpdateOptions {
+	targetPath: string;
+	arch?: string;
+	fetchImpl?(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+	runInstaller?(input: LinuxInstallerInput): Promise<void>;
+}
+
+async function runInstaller(input: LinuxInstallerInput): Promise<void> {
+	const child = Bun.spawn(["/bin/sh", "-s", "--", "--binary", "--ref", `v${input.version}`], {
+		stdin: "pipe",
+		stdout: "inherit",
+		stderr: "inherit",
+		env: { ...process.env, PI_INSTALL_DIR: input.installDir },
+	});
+	try {
+		child.stdin.write(input.script);
+		await child.stdin.end();
+	} catch (error) {
+		child.kill();
+		await child.exited;
+		throw error;
+	}
+	const exitCode = await child.exited;
+	if (exitCode !== 0) throw new Error(`Verified Linux installer exited with status ${exitCode}`);
+}
+
+/** Use the published installer's complete integrity transaction for every Linux replacement. */
+export async function updateLinuxStandalone(version: string, options: LinuxStandaloneUpdateOptions): Promise<void> {
+	if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version))
+		throw new Error("A stable published version is required for Linux standalone updates");
+	if (!path.posix.isAbsolute(options.targetPath) || path.posix.basename(options.targetPath) !== "xcsh")
+		throw new Error("Linux standalone target must be an absolute xcsh executable path");
+	const arch = options.arch ?? process.arch;
+	if (arch !== "x64" && arch !== "arm64") throw new Error("Unsupported Linux standalone update architecture");
+
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const tag = `v${version}`;
+	const api = `https://api.github.com/repos/${REPO}`;
+	const releaseResponse = await fetchImpl(`${api}/releases/tags/${tag}`, {
+		signal: AbortSignal.timeout(30_000),
+	});
+	if (!releaseResponse.ok) throw new Error(`Cannot read immutable release metadata: ${releaseResponse.status}`);
+	const release = (await releaseResponse.json()) as {
+		tag_name?: unknown;
+		draft?: unknown;
+		prerelease?: unknown;
+		immutable?: unknown;
+		assets?: unknown;
+	} | null;
+	if (
+		release?.tag_name !== tag ||
+		release.draft !== false ||
+		release.prerelease !== false ||
+		release.immutable !== true
+	)
+		throw new Error("Linux self-update requires the exact published immutable release");
+	if (!Array.isArray(release.assets)) throw new Error("Linux release is missing integrity assets");
+	const binary = `xcsh-linux-${arch}`;
+	for (const name of [binary, `${binary}.sha256`, `${binary}.provenance.json`, `${binary}.provenance.json.sha256`]) {
+		const matches = release.assets.filter(asset => asset?.name === name);
+		if (
+			matches.length !== 1 ||
+			typeof matches[0].digest !== "string" ||
+			!/^sha256:[a-f0-9]{64}$/.test(matches[0].digest) ||
+			!Number.isInteger(matches[0].size) ||
+			matches[0].size <= 0
+		)
+			throw new Error("Linux release has incomplete or ambiguous integrity assets");
+	}
+
+	const sourceResponse = await fetchImpl(`${api}/contents/scripts/install.sh?ref=${tag}`, {
+		signal: AbortSignal.timeout(30_000),
+	});
+	if (!sourceResponse.ok) throw new Error(`Cannot read tagged installer source: ${sourceResponse.status}`);
+	const source = (await sourceResponse.json()) as {
+		type?: unknown;
+		path?: unknown;
+		encoding?: unknown;
+		size?: unknown;
+		sha?: unknown;
+		content?: unknown;
+	} | null;
+	if (
+		source?.type !== "file" ||
+		source.path !== "scripts/install.sh" ||
+		source.encoding !== "base64" ||
+		typeof source.size !== "number" ||
+		!Number.isInteger(source.size) ||
+		source.size <= 0 ||
+		source.size > MAX_INSTALLER_BYTES ||
+		typeof source.sha !== "string" ||
+		!/^[a-f0-9]{40}$/.test(source.sha) ||
+		typeof source.content !== "string"
+	)
+		throw new Error("Invalid tagged installer source metadata");
+	const script = Buffer.from(source.content, "base64");
+	const blobSha = createHash("sha1").update(`blob ${script.length}\0`).update(script).digest("hex");
+	if (script.length !== source.size || blobSha !== source.sha)
+		throw new Error("Tagged installer source does not match its Git blob identity");
+
+	await (options.runInstaller ?? runInstaller)({
+		script,
+		installDir: path.posix.dirname(options.targetPath),
+		version,
+	});
+}

package/src/cli/update-cli.ts

@@ -5,6 +5,7 @@ import path from "node:path";
 import { pipeline } from "node:stream/promises";
 import { APP_NAME, isEnoent, VERSION } from "@f5-sales-demo/pi-utils";
 import chalk from "chalk";
+import { type LinuxInstallerInput, updateLinuxStandalone } from "./linux-standalone-update";
 import {
 	createInstallReceipt,
 	defaultInstallChannelDependencies,
@@ -76,6 +77,7 @@ export interface StandaloneReplacementOptions {
 	writeFile?(file: string, contents: string): Promise<void>;
 	unlink?(file: string): Promise<void>;
 	validate?(executable: string, expectedVersion: string): Promise<void>;
+	runLinuxInstaller?(input: LinuxInstallerInput): Promise<void>;
 }
 
 async function ignoreMissing(unlink: (file: string) => Promise<void>, file: string): Promise<void> {
@@ -94,6 +96,15 @@ export async function replaceStandaloneExecutable(
 	const targetPath = options.targetPath;
 	const platform = options.platform ?? process.platform;
 	const arch = options.arch ?? process.arch;
+	if (platform === "linux") {
+		if (arch !== "x64" && arch !== "arm64") throw new Error("Unsupported Linux standalone update architecture");
+		return updateLinuxStandalone(expectedVersion, {
+			targetPath,
+			arch,
+			fetchImpl: options.fetchImpl,
+			runInstaller: options.runLinuxInstaller,
+		});
+	}
 	const binaryName = getBinaryName(platform, arch);
 	const url = `https://github.com/${REPO}/releases/download/v${expectedVersion}/${binaryName}`;
 	const tempPath = `${targetPath}.new-${process.pid}`;

package/src/cli.ts

@@ -5,11 +5,14 @@ import { APP_NAME, initI18n, MIN_BUN_VERSION, registerLocales, t, VERSION } from
  * lightweight CLI runner from pi-utils.
  */
 import { CliUsageError, type CommandEntry, run } from "@f5-sales-demo/pi-utils/cli";
+import { installCliOutputHandlers, writeCliOutput } from "@f5-sales-demo/pi-utils/cli-output";
 import { validateInlineFlagSyntax } from "./cli/flag-spec";
 import { findPrefixedCommand, launchFlagScopeMessage } from "./cli/root-command-routing";
 import { sandboxArgs, sandboxFlags, validateSandboxInvocation } from "./cli/sandbox-spec";
 import { locales } from "./locales/index";
 
+installCliOutputHandlers();
+
 registerLocales(locales);
 initI18n();
 
@@ -97,7 +100,7 @@ async function showHelp(config: import("@f5-sales-demo/pi-utils/cli").CliConfig)
 	renderRootHelp(config);
 	const extra = getExtraHelpText();
 	if (extra.trim().length > 0) {
-		process.stdout.write(`\n${extra}\n`);
+		writeCliOutput(process.stdout, `\n${extra}\n`);
 	}
 }