@huynle/hub 0.8.4 → 0.8.5

package/src/spoke/launchers.ts

@@ -13,8 +13,16 @@
 // when nothing is there or it is hub's own link, and never when another `hub` is on PATH. ~/.local/bin/hubctl is left
 // to `hubctl setup`: it is the standalone hubctl's install path (a link there would make that install refuse to write
 // through it, and the launchers would exec themselves).
+//
+// On Windows (Phase 2) there are no sh scripts and no symlinks (they need Developer Mode or admin): the hub bin dir
+// gets hub.cmd and hubctl.cmd, which run ~\.local\bin\hubctl.exe when it is installed (decided at plugin start)
+// and the bundle otherwise, with BUN_BE_BUN set only inside the launcher (setlocal). ~\.local\bin\hub.cmd is a cmd
+// shim (packages/cli/src/bootstrap/transaction/shim.ts) to the bin dir's hub.cmd, under the same user-bin rule;
+// hubctl's own hub.cmd (a shim to hubctl.exe, link-hub) is the authority and is never touched. Older plugin versions
+// left POSIX launchers and a ~/.local/bin/hub symlink there; being hub's own, they are removed.
 import { accessSync, chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs"
 import path from "node:path"
+import { cmdShim, cmdWord, parseCmdShim } from "../../packages/cli/src/bootstrap/transaction/shim.ts"
 import { userBinLinkDecision, type UserBinEntry } from "../../packages/cli/src/setup/user-bin.ts"
 
 export const LAUNCHERS = ["hub", "hubctl"] as const
@@ -31,19 +39,35 @@ export interface LauncherOptions {
   readonly bun: boolean
   /** The CLI entry the runtime runs. */
   readonly entry: string
-  /** The standalone hubctl to prefer when it exists (standaloneHubctl(home)). */
+  /**
+   * The standalone hubctl to prefer when it exists (standaloneHubctl(home)). POSIX: checked when the launcher runs;
+   * win32: installLaunchers passes it only when it exists, and launcherScript then runs it unconditionally.
+   */
   readonly standalone?: string
+  /** The platform (default process.platform): "win32" writes cmd launchers. */
+  readonly platform?: string
 }
 
-/** Where `hubctl setup` installs the standalone hubctl (contract user-bin:hubctl). */
-export const standaloneHubctl = (home: string): string => path.join(home, ".local", "bin", "hubctl")
+const isWin = (platform: string | undefined) => (platform ?? process.platform) === "win32"
+
+/** Where `hubctl setup` installs the standalone hubctl (contract user-bin:hubctl, user-bin:hubctl.exe on Windows). */
+export const standaloneHubctl = (home: string, platform: string = process.platform): string => path.join(home, ".local", "bin", platform === "win32" ? "hubctl.exe" : "hubctl")
 
 /** A word quoted for sh. */
 const quote = (word: string) => `'${word.replaceAll("'", `'\\''`)}'`
 
 const LAUNCHER_HEADER = "#!/bin/sh\n# hub CLI launcher"
+const CMD_HEADER = "@rem hub CLI launcher"
+
+/** win32: a cmd file (CRLF, ASCII; every path one quoted word, see cmdWord). */
+function cmdLauncher({ execPath, bun, entry, standalone }: LauncherOptions): string {
+  const lines = standalone ? [`@${cmdWord(standalone)} %*`] : bun ? ["@setlocal", "@set BUN_BE_BUN=1", `@${cmdWord(execPath)} ${cmdWord(entry)} %*`] : [`@${cmdWord(execPath)} ${cmdWord(entry)} %*`]
+  return [`${CMD_HEADER}, written by the hub OpenCode plugin at start (edits are overwritten).`, ...lines, ""].join("\r\n")
+}
 
-export function launcherScript({ execPath, bun, entry, standalone }: LauncherOptions): string {
+export function launcherScript(options: LauncherOptions): string {
+  if (isWin(options.platform)) return cmdLauncher(options)
+  const { execPath, bun, entry, standalone } = options
   const command = bun ? `exec env BUN_BE_BUN=1 ${quote(execPath)} ${quote(entry)} "$@"` : `exec node ${quote(entry)} "$@"`
   const prefer = standalone ? `if [ -x ${quote(standalone)} ]; then exec ${quote(standalone)} "$@"; fi\n` : ""
   return `${LAUNCHER_HEADER}, written by the hub OpenCode plugin at start (edits are overwritten).\n${prefer}${command}\n`
@@ -62,6 +86,7 @@ export function cliEntry(root: string, bun: boolean): string | undefined {
  * reads half a file). Returns the names written.
  */
 export function installLaunchers(options: LauncherOptions & { readonly binDir: string }): { written: string[] } {
+  if (isWin(options.platform)) return installCmdLaunchers(options)
   const script = launcherScript(options)
   mkdirSync(options.binDir, { recursive: true, mode: 0o700 })
   const written: string[] = []
@@ -86,6 +111,34 @@ export function installLaunchers(options: LauncherOptions & { readonly binDir: s
   return { written }
 }
 
+/** win32: hub.cmd and hubctl.cmd (no modes); an older plugin's POSIX launchers there are removed. */
+function installCmdLaunchers(options: LauncherOptions & { readonly binDir: string }): { written: string[] } {
+  const { standalone, ...rest } = options
+  const script = launcherScript({ ...rest, ...(standalone && existsSync(standalone) ? { standalone } : {}) })
+  mkdirSync(options.binDir, { recursive: true, mode: 0o700 })
+  const written: string[] = []
+  for (const base of LAUNCHERS) {
+    const stale = path.join(options.binDir, base)
+    if (entryOf(stale) === "file" && isLauncher(stale)) rmSync(stale, { force: true })
+    const name = `${base}.cmd`
+    const file = path.join(options.binDir, name)
+    if (readText(file) === script) continue
+    const tmp = `${file}.${process.pid}.tmp`
+    writeFileSync(tmp, script)
+    renameSync(tmp, file)
+    written.push(name)
+  }
+  return { written }
+}
+
+const readText = (file: string): string | undefined => {
+  try {
+    return readFileSync(file, "latin1")
+  } catch {
+    return undefined
+  }
+}
+
 /** The user's own bin dir (contract root user-bin). */
 export const userBinDir = (home: string): string => path.join(home, ".local", "bin")
 
@@ -98,13 +151,13 @@ function entryOf(file: string): UserBinEntry {
   }
 }
 
-/** A file that starts like the launchers hub writes. */
-function isLauncher(file: string): boolean {
+/** A file that starts like the launchers hub writes (the cmd ones on win32). */
+function isLauncher(file: string, header: string = LAUNCHER_HEADER): boolean {
   let fd: number | undefined
   try {
     fd = openSync(file, "r")
-    const buffer = Buffer.alloc(LAUNCHER_HEADER.length)
-    return readSync(fd, buffer, 0, buffer.length, 0) === buffer.length && buffer.toString("utf8") === LAUNCHER_HEADER
+    const buffer = Buffer.alloc(header.length)
+    return readSync(fd, buffer, 0, buffer.length, 0) === buffer.length && buffer.toString("utf8") === header
   } catch {
     return false
   } finally {
@@ -126,17 +179,100 @@ function onPath(name: string, searchPath: string, skip: string): string | undefi
   return undefined
 }
 
+/** win32: PATH entries compare without case, separator style or a trailing separator. */
+const winKey = (dir: string) => dir.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase()
+
+/** win32: the first `name` with a PATHEXT extension on the ';'-separated `searchPath`, outside `skip`. */
+function onWinPath(name: string, searchPath: string, skip: string): string | undefined {
+  const exts = [".com", ".exe", ".bat", ".cmd"]
+  for (const dir of searchPath.split(";")) {
+    if (!dir || winKey(dir) === winKey(skip)) continue
+    for (const ext of exts) {
+      const file = path.join(dir, `${name}${ext}`)
+      try {
+        if (statSync(file).isFile()) return file
+      } catch {}
+    }
+  }
+  return undefined
+}
+
+/** win32: what a cmd file is, read as the user-bin rule sees links: a hub cmd shim is a link to its target. */
+function cmdEntryOf(file: string): { entry: UserBinEntry; pointsTo?: string } {
+  const entry = entryOf(file)
+  if (entry !== "file") return { entry }
+  let bytes: Uint8Array
+  try {
+    bytes = readFileSync(file)
+  } catch {
+    return { entry }
+  }
+  const target = parseCmdShim(bytes)
+  return target === undefined ? { entry } : { entry: "symlink", pointsTo: target }
+}
+
+/** win32: linkUserBin with cmd shims (see the header). */
+function linkUserBinCmd(options: { readonly home: string; readonly binDir: string; readonly path: string | undefined }): { linked: string[]; hint?: string } {
+  const userBin = userBinDir(options.home)
+  // An older plugin's symlink ~/.local/bin/hub → its POSIX launcher: hub's own, and unusable here.
+  const old = path.join(userBin, "hub")
+  if (entryOf(old) === "symlink") {
+    let to: string | undefined
+    try {
+      to = path.resolve(userBin, readlinkSync(old))
+    } catch {}
+    if (to !== undefined && (winKey(to) === winKey(path.join(options.binDir, "hub")) || isLauncher(to))) rmSync(old, { force: true })
+  }
+  const linkPath = path.join(userBin, "hub.cmd")
+  const target = path.join(options.binDir, "hub.cmd")
+  const { entry, pointsTo } = cmdEntryOf(linkPath)
+  const searchPath = options.path ?? ""
+  const onUserPath = searchPath.split(";").some((dir) => dir && winKey(dir) === winKey(userBin))
+  const pathHint = onUserPath ? undefined : `${userBin} is not on PATH: add it to your user PATH to use \`hub\` in your terminal`
+  // hubctl's link-hub shim to the standalone hubctl.exe: the authority, keep it.
+  if (pointsTo !== undefined && winKey(pointsTo) === winKey(standaloneHubctl(options.home, "win32"))) return { linked: [], ...(pathHint ? { hint: pathHint } : {}) }
+  const foundOnPath = onWinPath("hub", searchPath, options.binDir)
+  const decision = userBinLinkDecision({
+    entry,
+    ...(pointsTo !== undefined ? { pointsTo: winKey(pointsTo) === winKey(target) ? target : pointsTo } : {}),
+    target,
+    linkPath,
+    hubOwned: (p) => isLauncher(p, CMD_HEADER),
+    ...(foundOnPath !== undefined && winKey(foundOnPath) !== winKey(linkPath) ? { foundOnPath } : {}),
+  })
+  if (decision === "foreign") return { linked: [] }
+  if (decision === "shadowed") return { linked: [], hint: `\`hub\` on your PATH is ${foundOnPath}, not hub's CLI; hub's is ${target}` }
+  if (decision === "in-place") return { linked: [], ...(pathHint ? { hint: pathHint } : {}) }
+  mkdirSync(userBin, { recursive: true })
+  const shim = cmdShim(target)
+  // A new shim never replaces what may have appeared meanwhile ("wx"); hub's own is replaced atomically.
+  if (decision === "create") writeFileSync(linkPath, shim, { flag: "wx" })
+  else {
+    const tmp = `${linkPath}.${process.pid}.tmp`
+    rmSync(tmp, { force: true })
+    writeFileSync(tmp, shim)
+    try {
+      renameSync(tmp, linkPath)
+    } catch (cause) {
+      rmSync(tmp, { force: true })
+      throw cause
+    }
+  }
+  return { linked: ["hub.cmd"], ...(pathHint ? { hint: pathHint } : {}) }
+}
+
 /**
  * Links ~/.local/bin/hub to `binDir`/hub (see the header). Returns what it linked, and one hint when the user's
  * terminal will not find it (~/.local/bin not on `path`, or another `hub` comes first). Small synchronous calls,
  * nothing when converged (the plugin runs this at start).
  */
-export function linkUserBin(options: { readonly home: string; readonly binDir: string; readonly path: string | undefined; readonly defaultBinDir?: string | undefined }): { linked: string[]; hint?: string } {
+export function linkUserBin(options: { readonly home: string; readonly binDir: string; readonly path: string | undefined; readonly defaultBinDir?: string | undefined; readonly platform?: string }): { linked: string[]; hint?: string } {
   // Only the default hub bin dir (env-inject.ts defaultHubBinDir: the resolved state dir's bin, default
   // ~/.local/state/hub/bin): a custom HUB_STATE_DIR (tests, containers, a throwaway state) must never leave
   // ~/.local/bin pointing into it.
   const allowed = options.defaultBinDir ?? path.join(options.home, ".local", "state", "hub", "bin")
   if (path.resolve(options.binDir) !== path.resolve(allowed)) return { linked: [] }
+  if (isWin(options.platform)) return linkUserBinCmd(options)
   const userBin = userBinDir(options.home)
   const linkPath = path.join(userBin, "hub")
   const target = path.join(options.binDir, "hub")

package/src/win-acl.ts

@@ -0,0 +1,154 @@
+// Owner-only files on Windows (Phase 2 contract "Secrets on win32"). Windows has no POSIX modes: a file that is 0600
+// on macOS/Linux (config.json with the machine token, cli.json, a saved setup preview) gets an ACL instead. It is
+// created empty, restricted with `icacls <file> /inheritance:r /grant:r *<current user SID>:(F)` before the secret
+// is written, then moved into place (a rename on the same volume keeps the ACL). Checks that refuse `mode & 0o077`
+// on POSIX verify on Windows that the DACL allows no one but the current user, SYSTEM and Administrators.
+//
+// Shared by src/ (config.json), packages/cli (cli.json, the credential store, previews) and packages/node (the
+// password-file check); it lives in src/ because both of the others already import from it. No native addons (it
+// runs inside a Bun-compiled hubctl.exe): icacls and whoami are run by absolute path under %SystemRoot%, and tests
+// inject the runner.
+import { spawnSync } from "node:child_process"
+import { randomBytes } from "node:crypto"
+import { closeSync, fsyncSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs"
+import { tmpdir } from "node:os"
+import path from "node:path"
+
+/** Runs icacls or whoami with exactly these arguments (no shell). */
+export type WinAclRunner = (program: "icacls" | "whoami", args: readonly string[]) => { status: number | null; stdout: string; stderr: string }
+
+export interface WinAcl {
+  /** The current user's SID (resolved once). */
+  sid(): string
+  /** Removes inherited entries and grants only the current user full control. Throws when icacls fails. */
+  restrictToOwner(nativePath: string): void
+  /** Whether the file's DACL allows only the current user, SYSTEM and Administrators. */
+  check(nativePath: string): { ok: true } | { ok: false; problem: string }
+}
+
+export interface WinAclOptions {
+  readonly run?: WinAclRunner
+  /** The current user's SID without a subprocess (tests, or a caller that already knows it). */
+  readonly sid?: () => string
+  readonly env?: Readonly<Record<string, string | undefined>>
+}
+
+const SYSTEM32 = (env: Readonly<Record<string, string | undefined>>) => `${env.SystemRoot || env.SYSTEMROOT || "C:\\Windows"}\\System32`
+
+function systemRunner(env: Readonly<Record<string, string | undefined>>): WinAclRunner {
+  return (program, args) => {
+    const r = spawnSync(`${SYSTEM32(env)}\\${program}.exe`, [...args], { encoding: "utf8", windowsHide: true, timeout: 30_000 })
+    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? (r.error ? String(r.error.message) : "") }
+  }
+}
+
+const SID = /^S-1-[0-9]+(-[0-9]+)+$/
+
+/** The SID in `whoami /user /fo csv /nh` output (`"host\user","S-1-5-21-…"`). */
+export function parseWhoamiSid(stdout: string): string | undefined {
+  const fields = [...stdout.matchAll(/"([^"]*)"/g)].map((m) => m[1]!)
+  const sid = fields.at(-1)
+  return sid && SID.test(sid) ? sid : undefined
+}
+
+/** SYSTEM and Administrators, by SDDL alias and by SID. */
+const TRUSTED = new Set(["SY", "S-1-5-18", "BA", "S-1-5-32-544"])
+const ALLOW = new Set(["A", "OA", "XA", "ZA"])
+
+/**
+ * Why a DACL (SDDL, as `icacls /save` writes it) is not owner-only, or undefined when it allows no one but `sid`,
+ * SYSTEM and Administrators. Deny entries and inherit-only entries (which do not apply to the file) are ignored.
+ */
+export function sddlProblem(sddl: string, sid: string): string | undefined {
+  const dacl = /D:([A-Z]*)((?:\([^)]*\))*)/.exec(sddl)
+  if (!dacl || /D:NO_ACCESS_CONTROL/.test(sddl)) return "it has no access control list (no access control: everyone may read it)"
+  const others: string[] = []
+  for (const ace of dacl[2]!.matchAll(/\(([^)]*)\)/g)) {
+    const [type, flags = "", , , , who = ""] = ace[1]!.split(";")
+    if (!ALLOW.has(type!) || /IO/.test(flags)) continue
+    if (who === sid || TRUSTED.has(who)) continue
+    others.push(who)
+  }
+  return others.length ? `its access list allows users other than you, SYSTEM and Administrators (${[...new Set(others)].join(", ")})` : undefined
+}
+
+export function winAcl(options: WinAclOptions = {}): WinAcl {
+  const run = options.run ?? systemRunner(options.env ?? process.env)
+  let sid: string | undefined
+  const self: WinAcl = {
+    sid() {
+      if (sid) return sid
+      if (options.sid) return (sid = options.sid())
+      const r = run("whoami", ["/user", "/fo", "csv", "/nh"])
+      const found = r.status === 0 ? parseWhoamiSid(r.stdout) : undefined
+      if (!found) throw new Error(`cannot determine the current Windows user (whoami exited ${r.status})`)
+      return (sid = found)
+    },
+    restrictToOwner(nativePath) {
+      const r = run("icacls", [nativePath, "/inheritance:r", "/grant:r", `*${self.sid()}:(F)`])
+      if (r.status !== 0) throw new Error(`cannot restrict ${nativePath} to the current user (icacls exited ${r.status}${r.stderr.trim() ? `: ${r.stderr.trim()}` : ""})`)
+    },
+    check(nativePath) {
+      const dir = mkdtempSync(path.join(tmpdir(), "hub-acl-"))
+      try {
+        const saved = path.join(dir, "acl.txt")
+        const r = run("icacls", [nativePath, "/save", saved])
+        let text: string
+        try {
+          text = r.status === 0 ? readFileSync(saved).toString("utf16le") : ""
+        } catch {
+          text = ""
+        }
+        if (!text) return { ok: false, problem: `cannot read the access list of ${nativePath} (icacls exited ${r.status})` }
+        const problem = sddlProblem(text, self.sid())
+        return problem ? { ok: false, problem } : { ok: true }
+      } catch (cause) {
+        return { ok: false, problem: `cannot read the access list of ${nativePath}: ${(cause as Error).message}` }
+      } finally {
+        rmSync(dir, { recursive: true, force: true })
+      }
+    },
+  }
+  return self
+}
+
+/** Where a secret file is written: the platform (default process.platform) and, on win32, the ACL helper. */
+export interface SecretFileOptions {
+  readonly platform?: string
+  readonly acl?: WinAcl
+}
+
+let shared: WinAcl | undefined
+/** The process-wide helper (the SID is resolved once). */
+export const defaultWinAcl = (): WinAcl => (shared ??= winAcl())
+
+/** Whether `options` (default: this process) are for Windows. */
+export const isWin32 = (options?: SecretFileOptions): boolean => (options?.platform ?? process.platform) === "win32"
+
+/** The Windows form of a drive path for icacls ("C:/a/b" → "C:\a\b"); anything else as it is. */
+export const nativeWinPath = (p: string): string => (/^[A-Za-z]:[\\/]/.test(p) ? p.replace(/\//g, "\\") : p)
+
+/**
+ * Writes `content` to `file` owner-only on Windows: a temporary file next to it is created empty, restricted to the
+ * current user, written and fsynced, then renamed over `file` (the ACL moves with it). A failure removes the
+ * temporary file and leaves `file` as it was.
+ */
+export function writeOwnerOnlyFile(file: string, content: string, acl: WinAcl): void {
+  mkdirSync(path.dirname(file), { recursive: true })
+  const tmp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`
+  let fd: number | undefined
+  try {
+    closeSync(openSync(tmp, "wx"))
+    acl.restrictToOwner(nativeWinPath(tmp))
+    fd = openSync(tmp, "r+")
+    writeSync(fd, content)
+    fsyncSync(fd)
+    closeSync(fd)
+    fd = undefined
+    renameSync(tmp, file)
+  } catch (cause) {
+    if (fd !== undefined) closeSync(fd)
+    rmSync(tmp, { force: true })
+    throw cause
+  }
+}

package/web/dist/assets/ArtifactPage-Dq7VW-bU.js

@@ -0,0 +1 @@
+import{At as e,Et as t,ft as n,i as r,r as i,yt as a}from"./ui-j5FFk90B.js";import{r as o}from"./preload-helper-DqrJTq0t.js";import{L as s,R as c}from"./index-D9SP3_0z.js";import{t as l}from"./ArtifactWorkbench-vrgIfncX.js";var u=a(`<div class="feature-page av-page">`),d=a(`<a class="icon-btn av-back"href=/artifacts aria-label="All artifacts"title="All artifacts">`);function f(a){return(()=>{var f=u();return n(f,e(l,{get id(){return a.id},layout:`page`,get lead(){return[e(t,{get when(){return s()},get children(){return e(r,{icon:`menu`,label:`Open sidebar`,onClick:c})}}),(()=>{var t=d();return n(t,e(i,{name:`back`})),t})()]},get actions(){return e(r,{class:`av-wide`,icon:`split`,label:`Open in pane`,onClick:()=>o(a.id)})}})),f})()}export{f as default};

package/web/dist/assets/{ArtifactPane-XTnwXl-Y.js → ArtifactPane-DKwbMTX9.js}

@@ -1 +1 @@
-import{At as e,Pt as t,ft as n,ht as r,r as i,yt as a}from"./ui-Qo2Pd9-O.js";import{t as o}from"./ArtifactWorkbench-C37tZZ3e.js";var s=a(`<a class=icon-btn aria-label="Full page"title="Open the artifact's full page">`);function c(a){return e(o,{get id(){return a.artifactID},layout:`pane`,onArtifact:e=>a.onTitle?.(e.title||`Untitled`),get actions(){return(()=>{var o=s();return n(o,e(i,{name:`expand`})),t(()=>r(o,`href`,`/artifacts/${encodeURIComponent(a.artifactID)}`)),o})()},get trailing(){return a.paneTools}})}export{c as ArtifactPane};
+import{At as e,Pt as t,ft as n,ht as r,r as i,yt as a}from"./ui-j5FFk90B.js";import{t as o}from"./ArtifactWorkbench-vrgIfncX.js";var s=a(`<a class=icon-btn aria-label="Full page"title="Open the artifact's full page">`);function c(a){return e(o,{get id(){return a.artifactID},layout:`pane`,onArtifact:e=>a.onTitle?.(e.title||`Untitled`),get actions(){return(()=>{var o=s();return n(o,e(i,{name:`expand`})),t(()=>r(o,`href`,`/artifacts/${encodeURIComponent(a.artifactID)}`)),o})()},get trailing(){return a.paneTools}})}export{c as ArtifactPane};