@join-pantheon/cli 0.33.0-rc.1 → 0.33.0-rc.3

package/installer/install.ps1

@@ -186,8 +186,11 @@ function Install-Pantheon {
   # Is a task this user's? Its XML (schtasks /Query /TN <name> /XML) names its
   # principal as DOMAIN\user, a bare user name, or a SID; every one of them must
   # be this user (src/win-host.ts taskIsUsers). A task of the same name that
-  # another person on this PC registered is never ended.
-  function Test-PantheonTaskIsMine([string]$Xml, [string]$UserId, [string]$Sid) {
+  # another person on this PC registered is never ended. A SID is compared as a
+  # SID; a name is first turned into its account's SID ($ToSid) and compared
+  # by that, and only by name when Windows cannot say which account it is.
+  function Test-PantheonTaskIsMine([string]$Xml, [string]$UserId, [string]$Sid,
+    [scriptblock]$ToSid = { param($n) if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) { return '' }; try { ([Security.Principal.NTAccount]$n).Translate([Security.Principal.SecurityIdentifier]).Value } catch { '' } }) {
     if (-not $Xml) { return $false }
     $ids = @([regex]::Matches(($Xml -replace "`0", ''), '<UserId>([^<]*)</UserId>') | ForEach-Object { $_.Groups[1].Value.Trim().ToLowerInvariant() })
     if ($ids.Count -eq 0) { return $false }
@@ -195,14 +198,57 @@ function Install-Pantheon {
     $s = ([string]$Sid).ToLowerInvariant()
     $bare = if ($u.Contains('\')) { $u.Substring($u.LastIndexOf('\') + 1) } else { $u }
     foreach ($id in $ids) {
+      if ($id.StartsWith('s-1-')) { if ($s -and $id -eq $s) { continue }; return $false }
+      $idSid = ''
+      if ($s) { try { $idSid = ([string](& $ToSid $id)).ToLowerInvariant() } catch { $idSid = '' } }
+      if ($idSid) { if ($idSid -eq $s) { continue }; return $false }
       if ($u -and $id -eq $u) { continue }
-      if ($s -and $id -eq $s) { continue }
-      if ($bare -and -not $id.Contains('\') -and -not $id.StartsWith('s-1-') -and $id -eq $bare) { continue }
+      if ($bare -and -not $id.Contains('\') -and $id -eq $bare) { continue }
       return $false
     }
     return $true
   }
 
+  # What schtasks printed, as text. It writes a task's XML as UTF-16 (with or
+  # without a byte order mark); read in the console's code page, a user name
+  # with a letter outside ASCII came out as other letters and never matched.
+  # So the bytes are decoded by what they hold.
+  function ConvertFrom-TaskXmlBytes([byte[]]$Bytes) {
+    if (-not $Bytes -or $Bytes.Length -eq 0) { return '' }
+    if ($Bytes.Length -ge 2 -and $Bytes[0] -eq 0xFF -and $Bytes[1] -eq 0xFE) { return [Text.Encoding]::Unicode.GetString($Bytes, 2, $Bytes.Length - 2) }
+    if ($Bytes.Length -ge 2 -and $Bytes[0] -eq 0xFE -and $Bytes[1] -eq 0xFF) { return [Text.Encoding]::BigEndianUnicode.GetString($Bytes, 2, $Bytes.Length - 2) }
+    if ($Bytes.Length -ge 3 -and $Bytes[0] -eq 0xEF -and $Bytes[1] -eq 0xBB -and $Bytes[2] -eq 0xBF) { return [Text.Encoding]::UTF8.GetString($Bytes, 3, $Bytes.Length - 3) }
+    # No mark: UTF-16LE when most odd bytes of the start are zero ('<', 0, '?', 0, ...).
+    $n = [Math]::Min($Bytes.Length, 64); $odd = 0; $zeros = 0
+    for ($i = 1; $i -lt $n; $i += 2) { $odd++; if ($Bytes[$i] -eq 0) { $zeros++ } }
+    if ($odd -gt 0 -and $zeros * 4 -ge $odd * 3) { return [Text.Encoding]::Unicode.GetString($Bytes) }
+    try { return (New-Object System.Text.UTF8Encoding($false, $true)).GetString($Bytes) } catch { }
+    return [Console]::OutputEncoding.GetString($Bytes)
+  }
+
+  # A task's XML (schtasks /Query /TN <name> /XML), its bytes read as they are
+  # (ConvertFrom-TaskXmlBytes); '' when there is no such task.
+  function Get-PantheonTaskXml([string]$Schtasks, [string]$Name) {
+    $psi = New-Object System.Diagnostics.ProcessStartInfo
+    $psi.FileName = $Schtasks
+    $psi.Arguments = ConvertTo-ArgLine @('/Query', '/TN', $Name, '/XML')
+    $psi.UseShellExecute = $false
+    $psi.CreateNoWindow = $true
+    $psi.RedirectStandardInput = $true
+    $psi.RedirectStandardOutput = $true
+    $psi.RedirectStandardError = $true
+    $p = [System.Diagnostics.Process]::Start($psi)
+    $p.StandardInput.Close()
+    $buf = New-Object System.IO.MemoryStream
+    $copy = $p.StandardOutput.BaseStream.CopyToAsync($buf)
+    $err = $p.StandardError.ReadToEndAsync()
+    $p.WaitForExit()
+    $copy.Wait()
+    $null = $err.Result
+    if ($p.ExitCode -ne 0) { return '' }
+    return ConvertFrom-TaskXmlBytes $buf.ToArray()
+  }
+
   # Before the runtime folder is swapped: Pantheon's background host (the
   # logon task) runs node.exe from it, and Windows will not rename a folder a
   # running program came from. A teammate's request the worker is running
@@ -268,6 +314,68 @@ function Install-Pantheon {
     return @{ code = $p.ExitCode; out = $out.Result; err = $err.Result }
   }
 
+  # Hand over to pantheon with the person's own arguments (join <invite>,
+  # start): after an install, and also when the update was put off because a
+  # teammate's run was in progress -- a join or a start needs a working
+  # pantheon, not the update. Sets $State.code to pantheon's exit code.
+  function Invoke-PantheonHandoff([string]$nodeExe, [string]$entry, [string[]]$ca, [string[]]$Arguments) {
+    if ($null -eq $ca) { $ca = @() }
+    # node.exe directly, not the .cmd: PowerShell hands arguments to a .cmd
+    # through cmd.exe, which would cut an invite at a & or expand a %. And
+    # Start-Process -NoNewWindow, so pantheon gets this console itself: a real
+    # terminal for the sign-in questions, not a pipe PowerShell reads from.
+    $State.step = 'starting pantheon'
+    # With the same --use-system-ca as npm and pantheon.cmd: this first run is the
+    # one that signs in, and behind a TLS-inspecting proxy the relay's
+    # certificate chains only to the company root in the Windows store.
+    $line = ConvertTo-ArgLine (@($ca) + @($entry) + $Arguments)
+    $noConsole = $false
+    try { $noConsole = [Console]::IsInputRedirected } catch { $noConsole = $false }
+    if (-not $noConsole) {
+      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru
+      $null = $p.Handle   # without this, ExitCode is empty once the process is gone
+      $p.WaitForExit()
+      $State.code = $p.ExitCode
+      return
+    }
+
+    # No console to type into (CI, input piped in). pantheon still runs: it
+    # never asks a question without a terminal (every prompt checks
+    # process.stdin.isTTY) and works on flags alone, so a join to a team's own
+    # relay, or from a machine already signed in, needs no answers. Its input
+    # is an empty file, so nothing can wait on it. What it cannot do here is
+    # sign in: on the hosted relay join and start stop at once, before anything
+    # is changed, with "sign in first" (or the relay's NOT_SIGNED_IN). When that
+    # is how it ended and config.json still has no account, the last line says
+    # the one thing to do; any other failure keeps pantheon's own words last.
+    $quiet = Join-Path ([IO.Path]::GetTempPath()) ('pantheon-' + [Guid]::NewGuid().ToString('N').Substring(0, 8))
+    New-Item -ItemType Directory -Force -Path $quiet | Out-Null
+    try {
+      $in = Join-Path $quiet 'in'; $errFile = Join-Path $quiet 'err'
+      [IO.File]::WriteAllText($in, '')
+      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru -RedirectStandardInput $in -RedirectStandardError $errFile
+      $null = $p.Handle
+      $p.WaitForExit()
+      $State.code = $p.ExitCode
+      $said = if (Test-Path -LiteralPath $errFile) { [IO.File]::ReadAllText($errFile) } else { '' }
+      if ($said) { [Console]::Error.Write($said) }
+      if ($State.code -ne 0 -and $said -match 'sign in first|NOT_SIGNED_IN' -and $Arguments[0] -in @('join', 'start')) {
+        $pantheonHome = if ($env:PANTHEON_HOME) { $env:PANTHEON_HOME } else { Join-Path ([Environment]::GetFolderPath('UserProfile')) '.pantheon' }
+        $signedIn = $false
+        try { $signedIn = [bool]((Get-Content -LiteralPath (Join-Path $pantheonHome 'config.json') -Raw | ConvertFrom-Json).account) } catch { $signedIn = $false }
+        if (-not $signedIn) {
+          # Quoted only where PowerShell needs it, so it reads as typed.
+          $show = ($Arguments | ForEach-Object { if ($_ -match '^[A-Za-z0-9_./:=@+,-]+$') { $_ } else { "'" + ($_ -replace "'", "''") + "'" } }) -join ' '
+          $what = if ($Arguments[0] -eq 'join') { 'joining' } else { 'creating your team' }
+          Say ''
+          Say "Pantheon is installed. To finish $what, open PowerShell and run: pantheon $show"
+        }
+      }
+    } finally {
+      Remove-Item -LiteralPath $quiet -Recurse -Force -ErrorAction SilentlyContinue
+    }
+  }
+
   try {
     if ($PantheonVersion -like '*__*') {
       Fail "this copy of install.ps1 has no version filled in. Use the one the relay serves: irm $Site/install.ps1 | iex"
@@ -457,7 +565,7 @@ function Install-Pantheon {
           $stopped = Stop-PantheonHost -NodeDir $nodeDir -HostDir $hostDir -Tasks $tasks `
             -Holders { param($d) Get-FolderHolders $d } -EndTask { param($t) $null = Invoke-Quiet $schtasks @('/End', '/TN', $t) } `
             -RunRecord (Join-Path $pantheonHomeDir 'worker-run.json') `
-            -TaskIsMine { param($t) Test-PantheonTaskIsMine (Invoke-Quiet $schtasks @('/Query', '/TN', $t, '/XML')).out $meUser $meSid }
+            -TaskIsMine { param($t) Test-PantheonTaskIsMine (Get-PantheonTaskXml $schtasks $t) $meUser $meSid }
           # A teammate's run still going after the wait: nothing was stopped,
           # and the runtime is left exactly as it is (see the catch below).
           if ($stopped.busy) { throw 'PANTHEON_BUSY:' }
@@ -617,57 +725,7 @@ function Install-Pantheon {
       return
     }
     Say ''
-    # node.exe directly, not the .cmd: PowerShell hands arguments to a .cmd
-    # through cmd.exe, which would cut an invite at a & or expand a %. And
-    # Start-Process -NoNewWindow, so pantheon gets this console itself: a real
-    # terminal for the sign-in questions, not a pipe PowerShell reads from.
-    $State.step = 'starting pantheon'
-    $line = ConvertTo-ArgLine (@($entry) + $Arguments)
-    $noConsole = $false
-    try { $noConsole = [Console]::IsInputRedirected } catch { $noConsole = $false }
-    if (-not $noConsole) {
-      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru
-      $null = $p.Handle   # without this, ExitCode is empty once the process is gone
-      $p.WaitForExit()
-      $State.code = $p.ExitCode
-      return
-    }
-
-    # No console to type into (CI, input piped in). pantheon still runs: it
-    # never asks a question without a terminal (every prompt checks
-    # process.stdin.isTTY) and works on flags alone, so a join to a team's own
-    # relay, or from a machine already signed in, needs no answers. Its input
-    # is an empty file, so nothing can wait on it. What it cannot do here is
-    # sign in: on the hosted relay join and start stop at once, before anything
-    # is changed, with "sign in first" (or the relay's NOT_SIGNED_IN). When that
-    # is how it ended and config.json still has no account, the last line says
-    # the one thing to do; any other failure keeps pantheon's own words last.
-    $quiet = Join-Path ([IO.Path]::GetTempPath()) ('pantheon-' + [Guid]::NewGuid().ToString('N').Substring(0, 8))
-    New-Item -ItemType Directory -Force -Path $quiet | Out-Null
-    try {
-      $in = Join-Path $quiet 'in'; $errFile = Join-Path $quiet 'err'
-      [IO.File]::WriteAllText($in, '')
-      $p = Start-Process -FilePath $nodeExe -ArgumentList $line -NoNewWindow -PassThru -RedirectStandardInput $in -RedirectStandardError $errFile
-      $null = $p.Handle
-      $p.WaitForExit()
-      $State.code = $p.ExitCode
-      $said = if (Test-Path -LiteralPath $errFile) { [IO.File]::ReadAllText($errFile) } else { '' }
-      if ($said) { [Console]::Error.Write($said) }
-      if ($State.code -ne 0 -and $said -match 'sign in first|NOT_SIGNED_IN' -and $Arguments[0] -in @('join', 'start')) {
-        $pantheonHome = if ($env:PANTHEON_HOME) { $env:PANTHEON_HOME } else { Join-Path ([Environment]::GetFolderPath('UserProfile')) '.pantheon' }
-        $signedIn = $false
-        try { $signedIn = [bool]((Get-Content -LiteralPath (Join-Path $pantheonHome 'config.json') -Raw | ConvertFrom-Json).account) } catch { $signedIn = $false }
-        if (-not $signedIn) {
-          # Quoted only where PowerShell needs it, so it reads as typed.
-          $show = ($Arguments | ForEach-Object { if ($_ -match '^[A-Za-z0-9_./:=@+,-]+$') { $_ } else { "'" + ($_ -replace "'", "''") + "'" } }) -join ' '
-          $what = if ($Arguments[0] -eq 'join') { 'joining' } else { 'creating your team' }
-          Say ''
-          Say "Pantheon is installed. To finish $what, open PowerShell and run: pantheon $show"
-        }
-      }
-    } finally {
-      Remove-Item -LiteralPath $quiet -Recurse -Force -ErrorAction SilentlyContinue
-    }
+    Invoke-PantheonHandoff $nodeExe $entry $ca $Arguments
   } catch {
     $m = $_.Exception.Message
     if ($m -like 'PANTHEON_BUSY:*') {
@@ -675,6 +733,22 @@ function Install-Pantheon {
       # is none that runs is the exit code non-zero.
       $have = ''
       if ($installedCli) { try { $have = & $installedCli } catch { $have = '' } }
+      if ($have -and $Arguments.Count -gt 0) {
+        # The person's join or start still happens, on the Pantheon that is
+        # here: it does not touch the runtime folder the run is using.
+        Write-Host "Pantheon was not updated to $PantheonVersion because a teammate's run was in progress; Pantheon $have is still installed and working, so your command runs on it now. Run the same line again in a few minutes to update." -ForegroundColor Yellow
+        if ($State.lock) { $State.lock.Dispose(); $State.lock = $null }
+        $caNow = @()
+        try { if ((Invoke-Quiet $nodeExe @('--use-system-ca', '-e', '0')).code -eq 0) { $caNow = @('--use-system-ca') } } catch { $caNow = @() }
+        try {
+          Say ''
+          Invoke-PantheonHandoff $nodeExe $entry $caNow $Arguments
+        } catch {
+          Write-Host "pantheon install failed: it stopped while starting pantheon ($($_.Exception.Message)). Open a new terminal and run your pantheon command again." -ForegroundColor Red
+          $State.code = 1
+        }
+        return
+      }
       $kept = if ($have) { " Pantheon $have is still installed and working." } else { '' }
       Write-Host "Pantheon was not updated because a teammate's run was in progress; run the same line again in a few minutes.$kept" -ForegroundColor Yellow
       $State.code = if ($have) { 0 } else { 1 }

package/installer/install.sh

@@ -508,6 +508,17 @@ add_block() {
     note "the pantheon block in $f has a marker line without its pair, so $f was left as it is; put $BIN_DIR at the front of PATH there yourself"
     return 0
   fi
+  # One of each, but the end before the begin (edited by hand): the rewrite
+  # below would skip from the begin marker to the end of the file and drop
+  # everything after it, so the file is not touched either.
+  if [ "${begins:-0}" -eq 1 ]; then
+    bline=$(grep -nxF "$BEGIN_MARK" "$f" | head -n 1 | cut -d: -f1)
+    eline=$(grep -nxF "$END_MARK" "$f" | head -n 1 | cut -d: -f1)
+    if [ "${bline:-0}" -gt "${eline:-0}" ]; then
+      note "the pantheon block in $f has its end marker before its begin marker, so $f was left as it is; put $BIN_DIR at the front of PATH there yourself"
+      return 0
+    fi
+  fi
   if [ "${begins:-0}" -eq 1 ]; then
     awk -v b="$BEGIN_MARK" -v e="$END_MARK" '$0 == b { keep = 1 } keep { print } $0 == e { keep = 0 }' "$f" >"$TMP_DIR/old"
     same "$TMP_DIR/old" "$TMP_DIR/block" && return 0
@@ -531,10 +542,13 @@ add_block() {
 }
 
 login_shell=$(basename "${SHELL:-sh}")
-# ~/.profile: read by sh and dash logins, by bash when it has no .bash_profile,
+# ~/.profile: read by sh and dash logins, by bash when it has no .bash_profile or .bash_login,
 # and by the `sh -lc` Pantheon itself uses to find programs.
 add_block "$HOME/.profile"
 [ -f "$HOME/.bash_profile" ] && add_block "$HOME/.bash_profile"
+# bash logins read the first of .bash_profile, .bash_login and .profile: with
+# no .bash_profile, an existing .bash_login is the one read, not .profile.
+[ -f "$HOME/.bash_login" ] && add_block "$HOME/.bash_login"
 { [ -f "$HOME/.bashrc" ] || [ "$login_shell" = bash ]; } && add_block "$HOME/.bashrc"
 { [ -f "$HOME/.zshrc" ] || [ "$login_shell" = zsh ]; } && add_block "$HOME/.zshrc"
 [ -f "$HOME/.zprofile" ] && add_block "$HOME/.zprofile"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.33.0-rc.1",
+  "version": "0.33.0-rc.3",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {