@nissyai/desktop 0.2.56 → 0.2.63

package/bin/nissy.mjs

@@ -6,36 +6,38 @@
 // installed it, and spawns the self-contained app executable inside it,
 // inheriting stdio and propagating the exit code / signal.
 
-import { execFileSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import {
   existsSync,
-  lstatSync,
   mkdirSync,
   readdirSync,
   readFileSync,
-  realpathSync,
-  renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import {
   cacheRootSegments,
   LAUNCHER_TOOLCHAIN_FILE,
-  needsMacReinstall,
   npxChannelEnv,
   resolveLaunchCommand,
   resolvePayloadSpec,
-  unsafeArchiveEntries,
   UnsupportedPlatformError,
 } from "../src/resolve.mjs";
 import { confirmHealthyStart, prepareStore } from "../src/store.mjs";
-import { launcherCommand, runLauncherCommand } from "../src/cli.mjs";
+import { MAC_STORE_OUTCOME, prepareMacStore, pruneMacStore } from "../src/mac-store.mjs";
+import {
+  launcherCommand,
+  launcherOptions,
+  runLauncherCommand,
+  stripLauncherFlags,
+} from "../src/cli.mjs";
 import { DISTRIBUTION } from "../src/distribution.mjs";
+import { asarBeside, demoPreflight, demoTemplatePath, userDataDir } from "../src/demo-preflight.mjs";
 
 const require = createRequire(import.meta.url);
 
@@ -68,58 +70,31 @@ function fail(message) {
   process.exit(1);
 }
 
-function validateArchive(archivePath) {
-  const listing = execFileSync("tar", ["-tzf", archivePath], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "inherit"],
-  });
-  const entries = listing
-    .split(/\r?\n/u)
-    .map((entry) => entry.trim())
-    .filter((entry) => entry.length > 0);
-  const unsafe = unsafeArchiveEntries(entries);
-  if (unsafe.length > 0) {
-    throw new Error(
-      `payload archive contains unsafe entries: ${unsafe.slice(0, 5).join(", ")}`,
-    );
-  }
-}
-
-function isPathInside(root, candidate) {
-  const escaped = relative(root, candidate);
-  return escaped !== "" && !escaped.startsWith("..") && !isAbsolute(escaped);
-}
-
-function isExtractedBundleInside(tempDir, bundlePath) {
+/** Where the macOS bundle lives and how to read it, for a supported Mac host;
+ *  null anywhere else. Computed without the payload, because the installed
+ *  bundle is what runs and it must be describable when npm's copy is gone. */
+function macContext() {
+  if (process.platform !== "darwin") return null;
+  let macSpec;
   try {
-    const tempRoot = realpathSync(tempDir);
-    const bundleStat = lstatSync(bundlePath);
-    if (bundleStat.isSymbolicLink() || !bundleStat.isDirectory()) return false;
-    const bundleRoot = realpathSync(bundlePath);
-    if (!isPathInside(tempRoot, bundleRoot)) return false;
-
-    // The top-level bundle can be inside the temp directory while an inner
-    // symlink still points outside it. Walk without following directories and
-    // reject every such link before the bundle is moved into Applications.
-    const pending = [bundlePath];
-    while (pending.length > 0) {
-      const current = pending.pop();
-      if (current === undefined) continue;
-      const stat = lstatSync(current);
-      if (stat.isSymbolicLink()) {
-        if (!isPathInside(tempRoot, realpathSync(current))) return false;
-        continue;
-      }
-      if (!stat.isDirectory()) continue;
-      for (const entry of readdirSync(current)) {
-        pending.push(join(current, entry));
-      }
-    }
-    return true;
+    macSpec = resolvePayloadSpec(process.platform, process.arch);
   } catch {
-    return false;
+    return null;
   }
+  const bundleName = macSpec.exe[1]; // e.g. "Nissy.app" (exe[0] is "app")
+  const appsDir = join(homedir(), "Applications");
+  return {
+    bundleName,
+    exeSegments: macSpec.exe,
+    installedApp: join(appsDir, bundleName),
+    exePath: join(appsDir, ...macSpec.exe.slice(1)),
+    markerPath: join(
+      ...cacheRootSegments({ platform: process.platform, home: homedir(), env: process.env }),
+      "applications-darwin.version",
+    ),
+  };
 }
+const mac = macContext();
 
 // `--version` / `--rollback` answer and exit FIRST — before the payload is
 // resolved, before the store is prepared, before anything is spawned.
@@ -146,6 +121,7 @@ if (launcherOwnCommand !== null) {
       // alongside it, not something they depend on.
       payloadVersion: readPayloadVersion(),
       launcherVersion: LAUNCHER_VERSION,
+      mac,
       log: (message) => {
         console.log(message);
       },
@@ -153,6 +129,8 @@ if (launcherOwnCommand !== null) {
   );
 }
 
+const { afterPid, applyOnly } = launcherOptions(process.argv.slice(2));
+
 let spec;
 try {
   spec = resolvePayloadSpec(process.platform, process.arch);
@@ -163,32 +141,32 @@ try {
   throw err;
 }
 
-let payloadPkgJson;
+const missingPayloadMessage =
+  `platform payload "${spec.pkg}" is not installed for ${spec.key}. ` +
+  `Reinstall so the matching optional dependency is fetched.`;
+let payloadPkgJson = null;
 try {
   payloadPkgJson = require.resolve(`${spec.pkg}/package.json`);
 } catch {
-  fail(
-    `platform payload "${spec.pkg}" is not installed for ${spec.key}. ` +
-      `Reinstall so the matching optional dependency is fetched.`,
-  );
+  // On macOS an installed bundle still runs without npm's copy — npm drops an
+  // optional dependency whose download failed and exits 0, which is exactly how
+  // a Mac ended up with a launcher and no payload. Everywhere else, and on a Mac
+  // with nothing installed, there is nothing to run.
+  if (mac === null || !existsSync(mac.exePath)) fail(missingPayloadMessage);
 }
 
 // Resolve the executable to launch. Two payload layouts:
-//   • app/         — Forge output copied verbatim (Windows). Run in place.
-//   • app.tar.gz   — symlink-preserving archive (macOS; npm pack would strip the
-//                    .app's framework symlinks). INSTALL it into ~/Applications
-//                    — a standard, Spotlight-indexed location — so Nissy shows
-//                    in Spotlight / Launchpad / Finder and carries its Dock
-//                    icon, rather than running hidden from a per-user cache.
-//                    Refreshed in place when the payload version changes. Done
-//                    here (not a postinstall hook) so package managers that skip
-//                    lifecycle scripts on cached installs still self-heal.
-const payloadRoot = dirname(payloadPkgJson);
-const archivePath = join(payloadRoot, "app.tar.gz");
+//   • app/         — Forge output copied verbatim (Windows). Seeds the store.
+//   • app.tar.gz   — symlink-preserving archive (macOS). Installed into
+//                    ~/Applications by the macOS store below, and only when
+//                    npm's copy is genuinely newer than what is installed.
+const payloadRoot = payloadPkgJson === null ? null : dirname(payloadPkgJson);
+const archivePath = payloadRoot === null ? null : join(payloadRoot, "app.tar.gz");
 // The version npm currently has on disk. On Windows this is what the store
 // seeds from; it goes STALE the moment the app updates itself, which is why the
 // store only ever seeds from it when it is genuinely newer than `current`.
 const payloadVersionForStore = (() => {
+  if (payloadPkgJson === null) return "";
   try {
     return JSON.parse(readFileSync(payloadPkgJson, "utf8")).version;
   } catch {
@@ -201,79 +179,70 @@ let exePath;
 // the anchor we hand to `open` so LaunchServices dedups. null on Windows
 // (run-in-place), where we exec the binary directly.
 let macBundlePath = null;
-if (existsSync(join(payloadRoot, "app"))) {
-  exePath = join(payloadRoot, ...spec.exe);
-} else if (existsSync(archivePath)) {
-  const { version } = JSON.parse(readFileSync(payloadPkgJson, "utf8"));
-  const appsDir = join(homedir(), "Applications");
-  const bundleName = spec.exe[1]; // e.g. "Nissy.app" (spec.exe[0] is "app")
-  const installedApp = join(appsDir, bundleName);
-  macBundlePath = installedApp;
-  // The exe inside the installed bundle (drop the payload's leading "app/").
-  exePath = join(appsDir, ...spec.exe.slice(1));
-  const cacheRoot = join(
-    ...cacheRootSegments({ platform: process.platform, home: homedir(), env: process.env }),
-  );
-  const markerPath = join(cacheRoot, "applications-darwin.version");
-  const markerVersion = existsSync(markerPath)
-    ? readFileSync(markerPath, "utf8").trim()
-    : null;
-
-  if (needsMacReinstall({ markerVersion, payloadVersion: version, exeExists: existsSync(exePath) })) {
-    const tmp = `${installedApp}.tmp.${process.pid}`;
-    try {
-      rmSync(tmp, { recursive: true, force: true });
-      mkdirSync(tmp, { recursive: true });
-      validateArchive(archivePath);
-      execFileSync("tar", ["-xzf", archivePath, "-C", tmp], { stdio: "inherit" });
-      const tmpApp = join(tmp, bundleName);
-      if (!existsSync(tmpApp) || !isExtractedBundleInside(tmp, tmpApp)) {
-        rmSync(tmp, { recursive: true, force: true });
-        fail(`payload archive ${archivePath} did not contain a safe ${bundleName}`);
-      }
-      mkdirSync(appsDir, { recursive: true });
-      // Swap: move any existing install aside, rename the new one into place,
-      // then best-effort remove the old. RENAMING the old bundle (rather than
-      // deleting it) keeps a currently-running instance's mapped files valid
-      // until it quits; the new version is used on next launch.
-      const old = `${installedApp}.old.${process.pid}`;
-      rmSync(old, { recursive: true, force: true });
-      if (existsSync(installedApp)) renameSync(installedApp, old);
-      renameSync(tmpApp, installedApp);
-      rmSync(tmp, { recursive: true, force: true });
-      rmSync(old, { recursive: true, force: true });
-      mkdirSync(dirname(markerPath), { recursive: true });
-      writeFileSync(markerPath, version);
-      // Best-effort: index the new bundle now so Spotlight/Launchpad pick it up
-      // without waiting for the periodic scan. Never block launch.
-      try {
-        execFileSync("/usr/bin/mdimport", [installedApp], { stdio: "ignore" });
-      } catch {
-        // ignore — Spotlight indexes ~/Applications on its own schedule too
-      }
-    } catch (err) {
-      rmSync(tmp, { recursive: true, force: true });
-      if (!existsSync(exePath)) {
-        fail(`failed to install ${installedApp}: ${err.message}`);
-      }
-      // The previous install is still there, so we CAN carry on — and carrying
-      // on is right: a user with a working app should not be stopped from
-      // opening it because the new version would not unpack.
-      //
-      // But say so. Silence here is what made the validation bug above cost
-      // real users their updates rather than a bug report: the app relaunched
-      // the old version, found the same update waiting, and looped — with
-      // nothing written anywhere to say an install had been attempted at all.
-      console.error(
-        `[nissy] could not install ${version}: ${err.message}\n` +
-          `[nissy] continuing on the installed version at ${installedApp}`,
-      );
-    }
+if (mac !== null) {
+  // macOS: `current` is the bundle in ~/Applications — a standard,
+  // Spotlight-indexed location, so Nissy shows in Spotlight / Launchpad / Finder
+  // and carries its Dock icon. The npm payload ships it as `app.tar.gz`
+  // (symlink-preserving; npm pack would strip the framework symlinks), and the
+  // store decides whether to install it, apply an update the app staged, or roll
+  // back — and never does any of that while Nissy is running. See
+  // src/mac-store.mjs. Done here, not in a postinstall hook, so package managers
+  // that skip lifecycle scripts on cached installs still self-heal.
+  macBundlePath = mac.installedApp;
+  exePath = mac.exePath;
+  const prepared = prepareMacStore({
+    home: homedir(),
+    env: process.env,
+    cacheName: DISTRIBUTION.cacheName,
+    installedApp: mac.installedApp,
+    exePath: mac.exePath,
+    bundleName: mac.bundleName,
+    exeSegments: mac.exeSegments,
+    markerPath: mac.markerPath,
+    payloadVersion: payloadVersionForStore,
+    archivePath,
+    afterPid,
+    willLaunch: !applyOnly,
+    log: (message) => {
+      if (process.env.NISSY_STORE_DEBUG === "1") console.error(`[${DISTRIBUTION.npmCommand}] ${message}`);
+    },
+  });
+  if (prepared.error !== undefined) {
+    // Said out loud, not only logged: a store that silently never updates looks
+    // exactly like one that is working. The installed bundle still opens.
+    console.error(`[${DISTRIBUTION.npmCommand}] could not update: ${prepared.error.message}`);
+  }
+  if (prepared.outcome === MAC_STORE_OUTCOME.stagedForLater) {
+    console.error(
+      `[${DISTRIBUTION.npmCommand}] Nissy is running, so ${prepared.version} is ready and will be ` +
+        `installed when you quit it.`,
+    );
+  } else if (prepared.outcome === MAC_STORE_OUTCOME.deferred && prepared.version !== null && !applyOnly) {
+    console.error(
+      `[${DISTRIBUTION.npmCommand}] Nissy is running, so ${prepared.version} was not installed yet. ` +
+        `Quit Nissy and run ${DISTRIBUTION.npmCommand} again to finish.`,
+    );
+  }
+  if (!existsSync(exePath)) {
+    fail(
+      payloadPkgJson === null
+        ? missingPayloadMessage
+        : `failed to install ${mac.installedApp}; see ${join(
+            ...cacheRootSegments({ platform: process.platform, home: homedir(), env: process.env }),
+            "store",
+            "store.log",
+          )}`,
+    );
   }
+  pruneMacStore({ home: homedir(), env: process.env, cacheName: DISTRIBUTION.cacheName });
+  if (applyOnly) process.exit(0);
 
   // Best-effort: reclaim space from the OLD version-keyed cache layout earlier
   // launcher versions used (~140 MB each). Never block launch.
   try {
+    const cacheRoot = join(
+      ...cacheRootSegments({ platform: process.platform, home: homedir(), env: process.env }),
+    );
     for (const entry of readdirSync(cacheRoot)) {
       if (entry.startsWith(`${DISTRIBUTION.cacheName}-app-darwin-`)) {
         rmSync(join(cacheRoot, entry), { recursive: true, force: true });
@@ -282,6 +251,8 @@ if (existsSync(join(payloadRoot, "app"))) {
   } catch {
     // ignore — cleanup is non-essential
   }
+} else if (existsSync(join(payloadRoot, "app"))) {
+  exePath = join(payloadRoot, ...spec.exe);
 } else {
   fail(`payload "${spec.pkg}" contains neither app/ nor app.tar.gz`);
 }
@@ -350,8 +321,9 @@ if (staged !== null) {
 // own persistent log (electron-log → ~/Library/Logs/Nissy/main.log on macOS),
 // so dropping stdio here loses nothing. Pass --foreground to stay attached and
 // mirror the app's stdio + exit code, which is what you want when debugging.
-const forwardedArgs = process.argv.slice(2).filter((a) => a !== "--foreground");
-const foreground = forwardedArgs.length !== process.argv.slice(2).length;
+const userArgs = stripLauncherFlags(process.argv.slice(2));
+const forwardedArgs = userArgs.filter((a) => a !== "--foreground");
+const foreground = forwardedArgs.length !== userArgs.length;
 
 // On macOS, launch through `/usr/bin/open <bundle>` so LaunchServices enforces
 // single-instance: a `nissy`/`npx` run while Nissy is already up just activates
@@ -395,6 +367,36 @@ try {
   // Ignore: self-update falls back to the env/persisted value or the manual command.
 }
 
+// `--demo` against a missing or stale template: say so here, in the terminal
+// the user typed the command into. The app would refuse it too, but from a
+// detached process whose output this launcher has already let go of, so the
+// only trace would be a dialog. Advisory by design: every path the check cannot
+// decide lets the launch proceed and leaves the verdict to the app, and a fault
+// in the check itself must never be what stops Nissy starting.
+try {
+  const userData = userDataDir({
+    platform: process.platform,
+    home: homedir(),
+    env: process.env,
+    userDataName: DISTRIBUTION.userDataName,
+  });
+  if (userData !== null) {
+    const launchedVersion = staged !== null ? staged.version : payloadVersionForStore;
+    const verdict = demoPreflight({
+      args: forwardedArgs,
+      templatePath: demoTemplatePath({ userData, flavor: DISTRIBUTION.flavor, env: process.env }),
+      asarPath: asarBeside(exePath, existsSync),
+      appLabel: launchedVersion === "" ? DISTRIBUTION.appName : `${DISTRIBUTION.appName} ${launchedVersion}`,
+      command: DISTRIBUTION.npmCommand,
+      exists: existsSync,
+      readText: (path, encoding) => readFileSync(path, encoding),
+    });
+    if (!verdict.ok) fail(verdict.message);
+  }
+} catch (err) {
+  storeLog(`demo pre-flight skipped: ${err.message}`);
+}
+
 if (foreground) {
   const child = spawn(command, args, { stdio: "inherit", env: childEnv });
   child.on("error", (err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nissyai/desktop",
-  "version": "0.2.56",
+  "version": "0.2.63",
   "type": "module",
   "description": "Launcher for the Nissy desktop app. Resolves the host's app payload and spawns it. Run via `npx @nissyai/desktop`; a global install (`npm i -g @nissyai/desktop`) exposes the `nissy` command.",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,8 +20,8 @@
     "src/"
   ],
   "optionalDependencies": {
-    "@nissyai/app-win32-x64": "0.2.56",
-    "@nissyai/app-darwin-arm64": "0.2.56",
-    "@nissyai/app-darwin-x64": "0.2.56"
+    "@nissyai/app-win32-x64": "0.2.63",
+    "@nissyai/app-darwin-arm64": "0.2.63",
+    "@nissyai/app-darwin-x64": "0.2.63"
   }
 }

package/src/cli.d.mts

@@ -0,0 +1,13 @@
+// Types for the launcher-only flags the DESKTOP hands the launcher.
+//
+// The app builds these arguments and the launcher parses them; they share no
+// code, so `launcher-handoff.test.ts` imports both sides through this
+// declaration and fails if the names drift.
+
+export declare const AFTER_PID_FLAG: "--nissy-after-pid";
+export declare const APPLY_ONLY_FLAG: "--nissy-apply-only";
+export declare function launcherOptions(argv: readonly string[]): {
+  afterPid: number | null;
+  applyOnly: boolean;
+};
+export declare function stripLauncherFlags(argv: readonly string[]): string[];

package/src/cli.mjs

@@ -23,10 +23,47 @@ import {
   versionDir,
   clearPending,
 } from "./store.mjs";
+import {
+  bundleProcesses,
+  installedMacVersion,
+  isStagedMacVersion,
+  swapInBundle,
+} from "./mac-store.mjs";
 
 export const VERSION_FLAG = "--version";
 export const ROLLBACK_FLAG = "--rollback";
 
+/**
+ * Flags that are for the launcher alone and are never forwarded to the app.
+ *
+ * Both are set by the APP, not by people. `--nissy-after-pid=<pid>` is how the
+ * app hands over when it restarts or quits with an update staged: the launcher
+ * waits for that process (and everything running from its bundle) to be gone
+ * before it swaps anything, which is the Squirrel.Mac / Sparkle contract.
+ * `--nissy-apply-only` asks for the swap and nothing else — the quit path, where
+ * the user asked to quit, not to see the app again.
+ */
+export const AFTER_PID_FLAG = "--nissy-after-pid";
+export const APPLY_ONLY_FLAG = "--nissy-apply-only";
+
+/** The launcher-only options in an argv. A malformed pid is ignored rather than
+ *  trusted: waiting on the wrong process is worse than not waiting. */
+export function launcherOptions(argv) {
+  let afterPid = null;
+  for (const arg of argv) {
+    if (arg.startsWith(`${AFTER_PID_FLAG}=`)) {
+      const pid = Number(arg.slice(AFTER_PID_FLAG.length + 1));
+      if (Number.isInteger(pid) && pid > 0) afterPid = pid;
+    }
+  }
+  return { afterPid, applyOnly: argv.includes(APPLY_ONLY_FLAG) };
+}
+
+/** The argv with the launcher-only flags removed, for forwarding to the app. */
+export function stripLauncherFlags(argv) {
+  return argv.filter((arg) => arg !== APPLY_ONLY_FLAG && !arg.startsWith(`${AFTER_PID_FLAG}=`));
+}
+
 /** Which command, if any, the argv asks for. */
 export function launcherCommand(argv) {
   if (argv.includes(ROLLBACK_FLAG)) return "rollback";
@@ -129,14 +166,17 @@ export function planRollback({ currentVersion, previousVersion, versionExists })
  */
 export function runLauncherCommand(
   command,
-  { platform, home, env, cacheName, payloadVersion, launcherVersion, log },
+  { platform, home, env, cacheName, payloadVersion, launcherVersion, log, mac = null },
 ) {
   const layout = storeLayout({ platform, home, env, ...(cacheName ? { cacheName } : {}) });
+  // On macOS `current` is the installed bundle, not a junction.
+  const readCurrent = () =>
+    mac === null ? readCurrentVersion(layout) : installedMacVersion(mac);
 
   if (command === "version") {
     log(
       describeVersions({
-        storeVersion: readCurrentVersion(layout),
+        storeVersion: readCurrent(),
         previousVersion: readPreviousVersion(layout),
         payloadVersion,
         launcherVersion,
@@ -146,17 +186,35 @@ export function runLauncherCommand(
   }
 
   const plan = planRollback({
-    currentVersion: readCurrentVersion(layout),
+    currentVersion: readCurrent(),
     previousVersion: readPreviousVersion(layout),
     versionExists: (version) =>
-      listVersions(layout).includes(version) && isCompleteVersion(versionDir(layout, version)),
+      mac === null
+        ? listVersions(layout).includes(version) && isCompleteVersion(versionDir(layout, version))
+        : isStagedMacVersion(layout, version, mac.exeSegments),
   });
   if (!plan.ok) {
     log(`cannot roll back: ${plan.reason}`);
     return 1;
   }
   try {
-    pointCurrentAt(layout, plan.to);
+    if (mac === null) {
+      pointCurrentAt(layout, plan.to);
+    } else {
+      // The same rule as every other macOS swap: never under a running app.
+      const running = bundleProcesses(mac.installedApp, mac.list);
+      if (running === null || running.length > 0) {
+        log("cannot roll back while Nissy is running. Quit it, then run this again.");
+        return 1;
+      }
+      swapInBundle({
+        layout,
+        version: plan.to,
+        bundleName: mac.bundleName,
+        installedApp: mac.installedApp,
+        markerPath: mac.markerPath,
+      });
+    }
     // Whatever was pending was asking for the version we have just moved away
     // from. Leaving it would let the next launch apply it again and undo this.
     clearPending(layout);

package/src/demo-preflight.d.mts

@@ -0,0 +1,35 @@
+// Types for the launcher's Demo Mode pre-flight.
+//
+// The launcher mirrors two decisions the desktop owns: where the demo template
+// lives, and how the installed app's migrations are named. They share no code,
+// so `demo-preflight-parity.test.ts` in the desktop imports both sides through
+// this declaration and fails if they drift.
+
+export declare const DEMO_FLAG: "--demo";
+
+export declare function userDataDir(input: {
+  platform: NodeJS.Platform;
+  home: string;
+  env: NodeJS.ProcessEnv;
+  userDataName: string;
+}): string | null;
+
+export declare function demoTemplatePath(input: {
+  userData: string;
+  flavor: string;
+  env: NodeJS.ProcessEnv;
+}): string;
+
+export declare function asarBeside(exePath: string, exists: (path: string) => boolean): string | null;
+
+export declare function embeddedMigrations(asarText: string): string[];
+
+export declare function demoPreflight(input: {
+  args: readonly string[];
+  templatePath: string;
+  asarPath: string | null;
+  appLabel: string;
+  command: string;
+  exists: (path: string) => boolean;
+  readText: (path: string, encoding: BufferEncoding) => string;
+}): { ok: true } | { ok: false; message: string };