@pcircle/memesh 4.9.0 → 4.9.4

package/scripts/hooks/user-prompt-intent.js

@@ -19,7 +19,62 @@
 // Gated by `autoCapture` flag (same as other memesh write hooks).
 
 import { pathToFileURL } from 'url';
-import { isAutoCaptureEnabled } from './_shared.js';
+import {
+  findAutoUpdateConsent,
+  isAutoCaptureEnabled,
+  parseAutoUpdateConsent,
+  readUpdateCheckCache,
+  resolvePluginRoot,
+  writeAutoUpdateConsent,
+} from './_shared.js';
+import { join } from 'path';
+import { existsSync, readFileSync } from 'fs';
+
+let installChannelMod = null;
+try {
+  const pluginRoot = resolvePluginRoot(import.meta.url);
+  const modulePath = join(pluginRoot, 'dist/core/install-channel.js');
+  if (existsSync(modulePath)) installChannelMod = await import(pathToFileURL(modulePath).href);
+} catch {
+  // Source checkouts without a build remain non-blocking and cannot self-update.
+}
+
+function currentInstallChannel() {
+  try {
+    return installChannelMod?.getCurrentInstallChannel({
+      packageRoot: resolvePluginRoot(import.meta.url),
+    }) ?? 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+function currentInstalledVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(resolvePluginRoot(import.meta.url), 'package.json'), 'utf8'));
+    return typeof pkg.version === 'string' ? pkg.version : null;
+  } catch { return null; }
+}
+
+function recordUpdateConsent(sessionId, prompt) {
+  const current = currentInstalledVersion();
+  if (!current || !sessionId) return null;
+  const channel = currentInstallChannel();
+  // Only npm-global has a hook-owned installer. Other channels receive an
+  // actionable notice at SessionStart and must not turn an "Upgrade" word
+  // into a misleading approval marker for a different installation path.
+  if (channel !== 'npm-global') return null;
+  const cache = readUpdateCheckCache(current);
+  const latest = cache?.latestVersion;
+  if (typeof latest !== 'string' || !latest) return null;
+  const pending = findAutoUpdateConsent(sessionId, current, latest, channel);
+  if (!pending || !['pending'].includes(pending.decision)) return null;
+  const decision = parseAutoUpdateConsent(prompt);
+  if (!decision) return null;
+  return writeAutoUpdateConsent(
+    sessionId, current, latest, pending.channel ?? 'unknown', decision,
+  ) ? decision : null;
+}
 
 // Patterns compiled at module load — invalid regex MUST fail loudly. Do
 // NOT move into a try block "for safety": a regex compile error is a
@@ -121,8 +176,6 @@ if (isMainModule) {
   process.stdin.on('data', (chunk) => { input += chunk; });
   process.stdin.on('end', () => {
     try {
-      if (!isAutoCaptureEnabled(process.env)) return process.exit(0);
-
       // Distinguish empty stdin (legitimate degenerate event) from malformed
       // input (protocol drift). Both stay non-blocking, but only malformed
       // input is logged — empty is normal, garbage indicates a real bug.
@@ -142,14 +195,21 @@ if (isMainModule) {
       // we accept either name to survive a similar rename. If both are absent
       // or non-string, detectRememberIntent's type guard returns false safely.
       const prompt = data.prompt ?? data.user_prompt ?? '';
-      if (!detectRememberIntent(prompt)) return process.exit(0);
-
-      const out = {
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: buildHint(),
-        },
-      };
+      const updateDecision = recordUpdateConsent(data.session_id, prompt);
+      const rememberIntent = detectRememberIntent(prompt);
+      if (!rememberIntent && !updateDecision) return process.exit(0);
+      // Update consent is a user-authorized control decision, not memory
+      // capture; it must still be recorded when auto-capture is disabled.
+      if (!isAutoCaptureEnabled(process.env) && !updateDecision) return process.exit(0);
+
+      const contexts = [];
+      if (updateDecision) {
+        contexts.push(updateDecision === 'approved'
+          ? 'The user explicitly approved the MeMesh upgrade. The Stop hook may now update the consented installation.'
+          : 'The user declined the MeMesh upgrade for this session. Do not install it or ask again in this session.');
+      }
+      if (rememberIntent) contexts.push(buildHint());
+      const out = { hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: contexts.join('\n\n') } };
       process.stdout.write(JSON.stringify(out));
       process.exit(0);
     } catch (err) {

package/scripts/lib/npm-bin.mjs

@@ -0,0 +1,123 @@
+import { execFileSync, execSync } from 'node:child_process';
+
+/**
+ * Run npm / npx from a build script, on every platform we support.
+ *
+ * Two separate Windows problems, and fixing only the first is what made this
+ * take two attempts:
+ *
+ *   1. npm ships on Windows as `npm.cmd`. `execFileSync('npm', …)` does not
+ *      consult `PATHEXT` — that is a shell behaviour and execFile uses no
+ *      shell — so it fails with `spawnSync npm ENOENT` while the identical
+ *      command typed into a terminal works.
+ *
+ *   2. Naming it `npm.cmd` then fails with `spawnSync npm.cmd EINVAL`. Since
+ *      the fix for CVE-2024-27980, Node refuses to spawn `.cmd` and `.bat`
+ *      files without `shell: true`, because the Windows command interpreter
+ *      re-parses the argument list. On Windows there is no shell-free way to
+ *      invoke npm.
+ *
+ * So `shell: true` is required there, not a shortcut — and it is scoped to
+ * Windows, so macOS and Linux keep passing arguments as an array with no
+ * interpreter in the path at all.
+ *
+ * What `shell: true` costs is argument re-parsing, which matters only for
+ * arguments that are not literals. There is exactly one — the tarball name
+ * `npm pack` prints — and `assertSafeShellArg()` below is how it is made safe
+ * rather than assumed safe. Call it on anything that did not come from this
+ * repository's own source.
+ *
+ * Both scripts on the publish path had written this by hand:
+ *
+ *   check-consumer-audit.mjs  ->  audit:prod  ->  verify:release  ->  prepublishOnly
+ *   run-tests-isolated.mjs    ->  test:isolated                   ->  prepublishOnly
+ *
+ * One owner, so a third caller cannot get it wrong a third way.
+ */
+const isWindows = process.platform === 'win32';
+
+export const NPM = isWindows ? 'npm.cmd' : 'npm';
+export const NPX = isWindows ? 'npx.cmd' : 'npx';
+
+/**
+ * Reject anything that could mean something to a command interpreter.
+ *
+ * Deliberately an allow-list. A deny-list of shell metacharacters has to be
+ * complete to be correct, and `cmd.exe` gives `%`, `^` and `&` meanings that a
+ * POSIX-shaped deny-list would miss.
+ */
+export function assertSafeShellArg(value, what) {
+  // `:` and `~` are here for one reason: Windows absolute paths
+  // (`C:\Users\RUNNER~1\AppData\Local\Temp\...` — 8.3 short names carry the `~`,
+  // and that is literally what `os.tmpdir()` returns on a Windows runner).
+  // `smoke-packed-artifact.mjs` passes an absolute `os.tmpdir()` path to
+  // `npm pack --pack-destination` and to `npm install`, so without it
+  // `npm run test:packaged` throws on Windows before packing anything —
+  // fail-closed, but it means the packaged smoke test cannot run there at all.
+  // Neither has meaning to cmd.exe (`~` is a POSIX-shell nicety, and the POSIX
+  // branch never reaches here — it uses execFileSync with no shell at all).
+  // Every character that DOES mean something to cmd.exe (`%^&|<>"'` and
+  // whitespace) stays excluded.
+  if (typeof value !== 'string' || !/^[A-Za-z0-9._@:~\-+=/\\]+$/.test(value)) {
+    throw new Error(
+      `${what} is not a safe argument to pass through a shell: ${JSON.stringify(value)}`
+    );
+  }
+  return value;
+}
+
+/**
+ * Spawn `bin` with `args`.
+ *
+ * POSIX: no shell, arguments stay an array, nothing is re-parsed.
+ *
+ * Windows: every argument is validated, then the command line is built here and
+ * handed to `execSync`. Passing an ARRAY together with `shell: true` is
+ * deprecated (DEP0190) precisely because the arguments are concatenated without
+ * escaping — doing the concatenation ourselves, after checking each part, is
+ * the same operation with the check that makes it sound, and it does not print
+ * a deprecation warning on every release gate.
+ *
+ * The usual advice — "use execFile with an argument array, never build a shell
+ * string" — is right, and is what the POSIX branch does. It does not apply to
+ * the Windows branch because there is no execFile that works: npm is a `.cmd`,
+ * and Node refuses to exec one without a shell. The choice there is not
+ * array-vs-string, it is checked-vs-unchecked. Every argument reaching the
+ * concatenation has passed `assertSafeShellArg`, which is an allow-list, so no
+ * character with meaning to `cmd.exe` can be in one. `tests/consumer-audit-
+ * gate.test.ts` pins that, including the `%` and `^` forms a POSIX-shaped
+ * deny-list would miss.
+ */
+function runSync(bin, args, opts) {
+  if (!isWindows) return execFileSync(bin, args, opts);
+  const safeArgs = args.map((arg, i) => assertSafeShellArg(arg, `${bin} argument ${i} (${arg})`));
+  return execSync([bin, ...safeArgs].join(' '), opts);
+}
+
+/** `npm <args>`, spawned correctly for the platform. */
+export function npmSync(args, opts = {}) {
+  return runSync(NPM, args, opts);
+}
+
+/** `npx <args>`, spawned correctly for the platform. */
+export function npxSync(args, opts = {}) {
+  return runSync(NPX, args, opts);
+}
+
+/**
+ * `baseEnv` with every spelling of `npm_config_cache` removed and the private
+ * cache set. Windows environment names are case-insensitive and Node keeps
+ * the lexicographically first of two keys that differ only in case (`N`
+ * before `n`); Vitest adds an upper-cased copy of every variable to its
+ * Windows workers. So `{ ...process.env, npm_config_cache }` handed npm the
+ * runner's `NPM_CONFIG_CACHE=C:\npm\cache` and never the private directory —
+ * measured on windows-latest with the fake npm in
+ * `tests/consumer-audit-gate.test.ts`.
+ */
+export function envWithNpmCache(cacheDir, baseEnv = process.env) {
+  const env = Object.fromEntries(
+    Object.entries(baseEnv).filter(([key]) => key.toLowerCase() !== 'npm_config_cache'),
+  );
+  env.npm_config_cache = cacheDir;
+  return env;
+}

package/scripts/upgrade-plugin.sh

@@ -91,6 +91,11 @@ MARKETPLACE_DIR="$CLAUDE_CONFIG_ROOT/plugins/marketplaces/pcircle-memesh"
 INSTALL_REGISTRY="$CLAUDE_CONFIG_ROOT/plugins/installed_plugins.json"
 CACHE_ROOT="$CLAUDE_CONFIG_ROOT/plugins/cache/pcircle-memesh/memesh"
 LOCK_DIR="$CACHE_ROOT.lock"
+# Use the checker shipped beside this upgrade script, not a file newly staged
+# from the target commit. This keeps upgrades from legacy marketplace commits
+# testable and prevents a target archive from disabling its own validation.
+UPGRADE_SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+PLUGIN_ARTIFACT_CHECKER="$UPGRADE_SCRIPT_DIR/check-plugin-hook-artifact.mjs"
 
 # ─── Pre-flight ────────────────────────────────────────────────────────────
 if [ ! -d "$MARKETPLACE_DIR" ]; then
@@ -514,6 +519,25 @@ echo "==> Installing runtime deps (this may take a minute)..."
   exit 1
 }
 
+# Validate a real staged plugin before moving it into the live cache. The
+# host registry may load hooks immediately after the swap; a manifest that
+# names a missing script would otherwise surface as a frightening `127` in the
+# user's next session. Tiny legacy marketplace fixtures (and genuinely old
+# plugin archives) have no plugin wiring to validate, so preserve their
+# historical cache-refresh behavior; once wiring is present, the checker is
+# mandatory and fail-closed. The checker itself comes from this script's
+# installed release, never from the target archive being validated.
+if [ -f "$STAGE_PATH/hooks/hooks.json" ] || [ -f "$STAGE_PATH/.claude-plugin/plugin.json" ] || [ -f "$STAGE_PATH/.codex-plugin/plugin.json" ]; then
+  if [ ! -f "$PLUGIN_ARTIFACT_CHECKER" ]; then
+    echo "ERROR: plugin artifact checker is missing beside the upgrade script — the live cache at $NEW_INSTALL_PATH was not touched" >&2
+    exit 1
+  fi
+  if ! node "$PLUGIN_ARTIFACT_CHECKER" --root "$STAGE_PATH" --skip-pack; then
+    echo "ERROR: staged plugin artifact integrity check failed — the live cache at $NEW_INSTALL_PATH was not touched" >&2
+    exit 1
+  fi
+fi
+
 # ─── 5. Swap the staged copy in ───────────────────────────────────────────
 if [ -e "$NEW_INSTALL_PATH" ] || [ -L "$NEW_INSTALL_PATH" ]; then
   HAD_LIVE_CACHE=1