@mriekki/project-forge 4.26.0 → 4.26.1

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.26.0",
+  "version": "4.26.1",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -13,8 +13,8 @@
   },
   "components": {
     "core": {
-      "revision": "39bc7661db49266743317e9dfedab800674f9c30",
-      "version": "4.3.0",
+      "revision": "670b84af788323ce361a49677aff772c0d1541c4",
+      "version": "4.3.1",
       "distribution": "greenfield-workspace",
       "descriptor": "assets/core/distribution.json",
       "sourceRoot": "assets/generated/core",

package/assets/generated/ASSEMBLY.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.26.0",
+  "version": "4.26.1",
   "components": {
     "core": {
-      "revision": "39bc7661db49266743317e9dfedab800674f9c30",
-      "version": "4.3.0",
+      "revision": "670b84af788323ce361a49677aff772c0d1541c4",
+      "version": "4.3.1",
       "distribution": "greenfield-workspace",
       "files": [
         {
@@ -376,7 +376,7 @@
         {
           "source": "tools/setup_maintenance/maintenance.py",
           "destination": "tools/project-forge-setup/maintenance.py",
-          "sha256": "55d22445834108d2fb7f2ac8aa4a5c5b0326c01f67e5f305b8284e4f15a0dcd8"
+          "sha256": "15292e1059bc017139a11692346234fe34d98e5745acdfff2197d1232ce57c34"
         },
         {
           "source": "core/process/WORKSTATION_MAINTENANCE.md",

package/assets/generated/core/tools/setup_maintenance/maintenance.py

@@ -2,13 +2,18 @@
 """Project Forge catalog-bound workstation updates. Status/preview never mutate."""
 from __future__ import annotations
 import argparse
+from contextlib import ExitStack
 import datetime as dt
 import hashlib
 import json
+import os
 import re
+import secrets
 import shutil
+import stat
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 TOOL_ID = re.compile(r"^[a-z0-9][a-z0-9-]*$")
@@ -125,6 +130,160 @@ def make_plan(root: Path, selected: list[str]) -> dict:
     return {"plan": plan, "sha256": digest}
 
 
+def _marker_payload() -> str:
+    return json.dumps({"checkedAtUtc": dt.datetime.now(dt.timezone.utc).isoformat()}) + "\n"
+
+
+def _marker_read_value(handle) -> str | None:
+    value = json.load(handle)
+    if not isinstance(value, dict):
+        raise ValueError("expected object in setup maintenance marker")
+    return value.get("checkedAtUtc")
+
+
+def _posix_marker_check(root: Path, record: bool) -> str | None:
+    """Use directory handles and O_NOFOLLOW throughout: no path-based write races."""
+    flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+    with ExitStack() as closing:
+        parent = os.open(root, flags)
+        closing.callback(os.close, parent)
+        for name in (".project-forge", "setup-maintenance"):
+            try:
+                child = os.open(name, flags, dir_fd=parent)
+            except FileNotFoundError:
+                if not record:
+                    return None
+                try:
+                    os.mkdir(name, 0o700, dir_fd=parent)
+                except FileExistsError:
+                    pass
+                try:
+                    child = os.open(name, flags, dir_fd=parent)
+                except OSError as error:
+                    raise ValueError(
+                        f"unsafe setup maintenance marker directory: {name} (symlink or non-directory)"
+                    ) from error
+            except OSError as error:
+                raise ValueError(
+                    f"unsafe setup maintenance marker directory: {name} (symlink or non-directory)"
+                ) from error
+            closing.callback(os.close, child)
+            parent = child
+
+        name = "last-check.json"
+        try:
+            info = os.stat(name, dir_fd=parent, follow_symlinks=False)
+        except FileNotFoundError:
+            info = None
+        if info is not None and not stat.S_ISREG(info.st_mode):
+            raise ValueError("unsafe setup maintenance marker file: symlink or non-regular file")
+
+        previous = None
+        if info is not None:
+            # Re-open through the pinned directory handle and check the final
+            # inode too, so a swapped symlink or special file cannot be read.
+            with os.fdopen(
+                os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent),
+                "r", encoding="utf-8"
+            ) as handle:
+                if not stat.S_ISREG(os.fstat(handle.fileno()).st_mode):
+                    raise ValueError("unsafe setup maintenance marker file: non-regular file")
+                previous = _marker_read_value(handle)
+
+        if record:
+            # Atomic replacement instead of truncating the existing inode:
+            # neither a symlink nor a hard link can redirect the marker write.
+            temporary = f".last-check-{secrets.token_hex(12)}.tmp"
+            created = False
+            try:
+                fd = os.open(
+                    temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+                    0o600, dir_fd=parent
+                )
+                created = True
+                with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                    handle.write(_marker_payload())
+                    handle.flush()
+                    os.fsync(handle.fileno())
+                os.replace(temporary, name, src_dir_fd=parent, dst_dir_fd=parent)
+                created = False
+            finally:
+                if created:
+                    os.unlink(temporary, dir_fd=parent)
+        return previous
+
+
+def _windows_marker_component(path: Path, *, directory: bool) -> os.stat_result | None:
+    """Refuse symlinks, junctions and other Windows reparse points."""
+    try:
+        info = os.lstat(path)
+    except FileNotFoundError:
+        return None
+    if (
+        stat.S_ISLNK(info.st_mode)
+        or getattr(info, "st_file_attributes", 0)
+        & getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
+        or (directory and not stat.S_ISDIR(info.st_mode))
+        or (not directory and not stat.S_ISREG(info.st_mode))
+    ):
+        raise ValueError(f"unsafe setup maintenance marker path: symlink, reparse point or unexpected type at {path}")
+    return info
+
+
+def _windows_marker_check(root: Path, record: bool) -> str | None:
+    """Conservative native Windows checks with an atomic final-file replacement.
+
+    Native Windows Python has no POSIX dir_fd/O_NOFOLLOW operations. Check each
+    component for reparse points, retain its identity, and recheck before the
+    final atomic replace. Never use write_text() on the destination.
+    """
+    parent = root
+    identities = []
+    for name in (".project-forge", "setup-maintenance"):
+        parent = parent / name
+        info = _windows_marker_component(parent, directory=True)
+        if info is None:
+            if not record:
+                return None
+            try:
+                parent.mkdir(mode=0o700)
+            except FileExistsError:
+                pass
+            info = _windows_marker_component(parent, directory=True)
+            if info is None:
+                raise ValueError(f"unable to establish safe setup maintenance directory: {parent}")
+        identities.append((parent, info.st_dev, info.st_ino))
+
+    marker = parent / "last-check.json"
+    existing = _windows_marker_component(marker, directory=False)
+    previous = None
+    if existing is not None:
+        with marker.open("r", encoding="utf-8") as handle:
+            previous = _marker_read_value(handle)
+    if record:
+        fd, tmp = tempfile.mkstemp(prefix=".last-check-", suffix=".tmp", dir=parent)
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                handle.write(_marker_payload())
+                handle.flush()
+                os.fsync(handle.fileno())
+            for directory, dev, ino in identities:
+                current = _windows_marker_component(directory, directory=True)
+                if current is None or (current.st_dev, current.st_ino) != (dev, ino):
+                    raise ValueError(f"unsafe setup maintenance directory changed before marker replacement: {directory}")
+            _windows_marker_component(marker, directory=False)
+            os.replace(tmp, marker)
+        finally:
+            if os.path.lexists(tmp):
+                os.unlink(tmp)
+    return previous
+
+
+def marker_check(root: Path, *, record: bool) -> str | None:
+    """Read and optionally store a check timestamp only in a safe checkout path."""
+    return _windows_marker_check(root, record) if os.name == "nt" else _posix_marker_check(root, record)
+
+
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("action", choices=["status", "update"])
@@ -144,12 +303,9 @@ def main() -> int:
     try:
         if args.action == "status":
             result = {"platform": platform(), "tools": inventory(root)}
-            marker = root / ".project-forge/setup-maintenance/last-check.json"
-            if marker.is_file():
-                result["previousCheckUtc"] = load(marker).get("checkedAtUtc")
-            if args.record_check:
-                marker.parent.mkdir(parents=True, exist_ok=True)
-                marker.write_text(json.dumps({"checkedAtUtc": dt.datetime.now(dt.timezone.utc).isoformat()}) + "\n", encoding="utf-8")
+            previous = marker_check(root, record=args.record_check)
+            if previous is not None:
+                result["previousCheckUtc"] = previous
             print(json.dumps(result, indent=2))
             return 0
         result = make_plan(root, args.tool)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.26.0",
+  "version": "4.26.1",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {