@indigoai-us/hq-cli 5.289.0 → 5.291.0

package/dist/utils/self-update.js

@@ -57,10 +57,13 @@
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
 import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
 import semver from "semver";
 import chalk from "chalk";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, checkUpdateConvergence, isLocalDependencyInstall, isPrefixWritable, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, checkUpdateConvergence, derivePnpmHome, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, isPrefixWritable, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, } from "./version-gate.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
 import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
@@ -71,6 +74,211 @@ import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install
 export const REEXEC_GUARD_ENV = "HQ_RESCUE_SELF_UPDATED";
 const REGISTRY_URL = `https://registry.npmjs.org/${encodeURIComponent(CLI_NAME)}/latest`;
 const FETCH_TIMEOUT_MS = 3_000;
+/**
+ * Move the working CLI package beside itself before asking the package manager
+ * to replace it. If the move is unavailable, the caller proceeds without
+ * rollback protection. pnpm's .pnpm package tree is immutable store content,
+ * so only its selecting public link is moved.
+ */
+function findPnpmPublicLink(packageRoot) {
+    const home = derivePnpmHome({ manager: "pnpm", prefix: null, packageRoot });
+    if (!home)
+        return null;
+    let resolvedPackageRoot;
+    let storeVersions;
+    try {
+        resolvedPackageRoot = fs.realpathSync(packageRoot);
+        storeVersions = fs.readdirSync(path.join(home, "global"));
+    }
+    catch {
+        return null;
+    }
+    const packageSegments = CLI_NAME.split("/");
+    for (const storeVersion of storeVersions) {
+        const storeRoot = path.join(home, "global", storeVersion);
+        const candidates = [path.join(storeRoot, "node_modules", ...packageSegments)];
+        if (/^v\d+$/.test(storeVersion)) {
+            try {
+                for (const hash of fs.readdirSync(storeRoot)) {
+                    candidates.push(path.join(storeRoot, hash, "node_modules", ...packageSegments));
+                }
+            }
+            catch {
+                // Ignore inaccessible pnpm store versions and try the remaining roots.
+            }
+        }
+        for (const candidate of candidates) {
+            if (candidate === packageRoot)
+                continue;
+            try {
+                if (!fs.lstatSync(candidate).isSymbolicLink())
+                    continue;
+                if (fs.realpathSync(candidate) !== resolvedPackageRoot)
+                    continue;
+                return { path: candidate, target: fs.readlinkSync(candidate) };
+            }
+            catch {
+                // A missing or dangling candidate is not the public link for this install.
+            }
+        }
+    }
+    return null;
+}
+function isPathInside(candidate, parent) {
+    const relative = path.relative(path.resolve(parent), path.resolve(candidate));
+    return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function isInsideNodeModules(candidate) {
+    const segments = path.resolve(candidate).replace(/\\/g, "/").split("/").filter(Boolean);
+    const index = process.platform === "win32"
+        ? segments.map((segment) => segment.toLowerCase()).lastIndexOf("node_modules")
+        : segments.lastIndexOf("node_modules");
+    return index >= 0 && index < segments.length - 1;
+}
+function isRecognizedGlobalInstall(install, packageRoot) {
+    if (!isInsideNodeModules(packageRoot))
+        return false;
+    if (install.manager === "pnpm")
+        return isPnpmManagedPackageDir(packageRoot, true);
+    if (install.manager === "bun")
+        return isBunManagedPackageDir(packageRoot);
+    if (!install.prefix)
+        return false;
+    const globalNodeModules = process.platform === "win32"
+        ? path.join(install.prefix, "node_modules")
+        : path.join(install.prefix, "lib", "node_modules");
+    return isPathInside(packageRoot, globalNodeModules);
+}
+function snapshotPathsAreSafe(snapshot) {
+    const paths = [
+        snapshot.installPath,
+        snapshot.backupPath,
+        snapshot.movedPath,
+        snapshot.resolvedTarget,
+        snapshot.publicLinkPath,
+    ].filter((value) => value !== undefined);
+    return paths.every(isInsideNodeModules);
+}
+function snapshotInstall(install, renamePath = fs.renameSync) {
+    const packageRoot = install.packageRoot;
+    if (!packageRoot)
+        return null;
+    let movedPath;
+    let backupPath;
+    let didMove = false;
+    try {
+        const entry = fs.lstatSync(packageRoot);
+        let sourcePath = packageRoot;
+        let symlinkTarget;
+        let resolvedTarget;
+        if (entry.isSymbolicLink()) {
+            symlinkTarget = fs.readlinkSync(packageRoot);
+            resolvedTarget = fs.realpathSync(packageRoot);
+            sourcePath = resolvedTarget;
+        }
+        else if (!entry.isDirectory()) {
+            return null;
+        }
+        // The running package root can be a source checkout (for example `npm
+        // link` or `node dist/...`). Only recognized global layouts are safe to
+        // move; the package manager update itself still proceeds without rollback.
+        if (!isRecognizedGlobalInstall(install, sourcePath))
+            return null;
+        const publicLink = install.manager === "pnpm" && !entry.isSymbolicLink()
+            ? findPnpmPublicLink(packageRoot)
+            : null;
+        if (!fs.statSync(sourcePath).isDirectory())
+            return null;
+        // pnpm's .pnpm tree contains the package store. Moving a package directory
+        // out of that tree can invalidate pnpm's global project, so back up only
+        // the public link that selects the running store package.
+        const isPnpmStorePath = sourcePath.split(path.sep).includes(".pnpm");
+        const backupKind = install.manager === "pnpm" && isPnpmStorePath ? "pnpm-public-link" : "package";
+        const pnpmPublicLinkPath = publicLink?.path ?? (entry.isSymbolicLink() ? packageRoot : undefined);
+        if (backupKind === "pnpm-public-link" && !pnpmPublicLinkPath)
+            return null;
+        movedPath = backupKind === "pnpm-public-link" ? pnpmPublicLinkPath : sourcePath;
+        backupPath = path.join(path.dirname(movedPath), `.hq-cli-backup-${process.pid}-${randomBytes(8).toString("hex")}`);
+        renamePath(movedPath, backupPath);
+        didMove = true;
+        return {
+            installPath: packageRoot,
+            backupPath,
+            movedPath: backupKind === "pnpm-public-link" ? pnpmPublicLinkPath : sourcePath,
+            backupKind,
+            symlinkTarget,
+            resolvedTarget,
+            publicLinkPath: backupKind === "pnpm-public-link" ? pnpmPublicLinkPath : publicLink?.path,
+            publicLinkTarget: backupKind === "pnpm-public-link"
+                ? publicLink?.target ?? symlinkTarget
+                : publicLink?.target,
+        };
+    }
+    catch {
+        if (didMove && movedPath && backupPath) {
+            try {
+                fs.renameSync(backupPath, movedPath);
+            }
+            catch {
+                // The update may proceed without rollback if the move cannot be undone.
+            }
+        }
+        return null;
+    }
+}
+function restoreInstall(snapshot, renamePath = fs.renameSync) {
+    if (!snapshotPathsAreSafe(snapshot)) {
+        reportFailedRestore(snapshot);
+        return false;
+    }
+    try {
+        if (snapshot.backupKind === "pnpm-public-link") {
+            const publicLinkPath = snapshot.publicLinkPath ?? snapshot.movedPath;
+            fs.rmSync(publicLinkPath, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(publicLinkPath), { recursive: true });
+            renamePath(snapshot.backupPath, publicLinkPath);
+            return true;
+        }
+        fs.rmSync(snapshot.installPath, { recursive: true, force: true });
+        if (snapshot.symlinkTarget !== undefined && snapshot.resolvedTarget !== undefined) {
+            fs.rmSync(snapshot.resolvedTarget, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(snapshot.resolvedTarget), { recursive: true });
+            renamePath(snapshot.backupPath, snapshot.resolvedTarget);
+            fs.mkdirSync(path.dirname(snapshot.installPath), { recursive: true });
+            const target = process.platform === "win32" ? snapshot.resolvedTarget : snapshot.symlinkTarget;
+            fs.symlinkSync(target, snapshot.installPath, process.platform === "win32" ? "junction" : "dir");
+        }
+        else {
+            fs.mkdirSync(path.dirname(snapshot.installPath), { recursive: true });
+            renamePath(snapshot.backupPath, snapshot.installPath);
+        }
+        if (snapshot.publicLinkPath && snapshot.publicLinkTarget !== undefined) {
+            fs.rmSync(snapshot.publicLinkPath, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(snapshot.publicLinkPath), { recursive: true });
+            fs.symlinkSync(snapshot.publicLinkTarget, snapshot.publicLinkPath, process.platform === "win32" ? "junction" : "dir");
+        }
+        return true;
+    }
+    catch {
+        reportFailedRestore(snapshot);
+        return false;
+    }
+}
+function discardInstallSnapshot(snapshot) {
+    if (!snapshotPathsAreSafe(snapshot)) {
+        console.error(chalk.yellow(`⚠ Could not remove the hq-cli install backup at ${snapshot.backupPath}.`));
+        return;
+    }
+    try {
+        fs.rmSync(snapshot.backupPath, { recursive: true, force: true });
+    }
+    catch {
+        console.error(chalk.yellow(`⚠ Could not remove the hq-cli install backup at ${snapshot.backupPath}.`));
+    }
+}
+function reportFailedRestore(snapshot) {
+    console.error(chalk.yellow(`⚠ Could not restore the previous hq-cli install; its backup is at ${snapshot.backupPath}.`));
+}
 /** npm `latest` for this package, or null on any failure (offline, 5xx, bad body). */
 async function fetchLatestVersion() {
     try {
@@ -209,6 +417,11 @@ async function updateAndReexec(argv, flavor, known, deps) {
     const releaseLock = flavor.lock ? (deps.acquireLock ?? acquireUpdateLock)() : () => { };
     if (!releaseLock)
         return { action: "skipped", latest };
+    const renamePath = deps.renamePath ?? fs.renameSync;
+    const installSnapshot = snapshotInstall(install, renamePath);
+    if (!installSnapshot) {
+        console.error(chalk.dim("  No backup could be made for this hq-cli install; proceeding without rollback protection."));
+    }
     let result;
     const plan = buildSelfUpdatePlan(install);
     // A pnpm global install needs PNPM_HOME to find its global bin dir. A
@@ -219,6 +432,7 @@ async function updateAndReexec(argv, flavor, known, deps) {
     // regardless of the parent environment. No-op for npm/bun and when the
     // parent already sets PNPM_HOME.
     const updateEnv = pnpmUpdateEnv(install, env);
+    let restoredAfterFailure = false;
     try {
         console.error(chalk.dim(`Updating hq-cli ${current} → ${latest}…`));
         const defaultRunner = flavor.verbose ? runUpdateCommand : runUpdateQuiet;
@@ -230,11 +444,26 @@ async function updateAndReexec(argv, flavor, known, deps) {
             updateEnv === undefined
                 ? runner(plan.cmd, plan.args)
                 : runner(plan.cmd, plan.args, updateEnv);
+        if (!result.ok && installSnapshot) {
+            restoredAfterFailure = restoreInstall(installSnapshot, renamePath);
+            if (restoredAfterFailure)
+                discardInstallSnapshot(installSnapshot);
+        }
+    }
+    catch (error) {
+        if (installSnapshot) {
+            if (restoreInstall(installSnapshot, renamePath))
+                discardInstallSnapshot(installSnapshot);
+        }
+        throw error;
     }
     finally {
         releaseLock();
     }
     if (!result.ok) {
+        if (restoredAfterFailure) {
+            console.error(chalk.dim("  The previous hq-cli install was restored."));
+        }
         // The one case that still warrants the old yellow banner: we could not get
         // the user onto the new version, so they need to know it exists and how to
         // install it by hand.
@@ -259,6 +488,8 @@ async function updateAndReexec(argv, flavor, known, deps) {
         console.error(chalk.dim(`  Continuing the ${flavor.noun} on ${current}.`));
         return { action: "update-failed", latest };
     }
+    if (installSnapshot)
+        discardInstallSnapshot(installSnapshot);
     // Read-your-writes: a "successful" `npm install -g` proves only that the
     // prefix was rewritten, NOT that the `hq` this user's PATH resolves is the
     // copy we just wrote. When a ghost/shadowing install keeps winning PATH

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.289.0",
+  "version": "5.291.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -44,7 +44,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "~6.18.13",
+    "@indigoai-us/hq-cloud": "~6.18.17",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",