@ran-sh/dsh-crew 1.1.0 → 1.2.0-rc.4

package/src/install/official-frontend-assets.mjs

@@ -0,0 +1,78 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { pathToFileURL } from 'node:url';
+
+function plan(home, root) {
+  const bridge = join(root, 'official-web-bridge');
+  const metadata = JSON.parse(readFileSync(join(bridge, 'package.json'), 'utf8'));
+  if (metadata.name !== '@ran-sh/dsh-crew-web-bridge') throw new Error('invalid frontend package');
+  const files = new Map([
+    ['official-web-bridge/entry.mjs', readFileSync(join(bridge, 'overlay-entry.mjs'))],
+    ['official-web-bridge/lib/client.js', readFileSync(join(bridge, 'lib', 'client.js'))],
+    ['src/local-request-guard.mjs', readFileSync(join(root, 'src', 'local-request-guard.mjs'))],
+  ]);
+  const hash = createHash('sha256').update(JSON.stringify(metadata));
+  for (const [name, bytes] of files) hash.update(name).update(bytes);
+  const revision = hash.digest('hex');
+  files.set('official-web-bridge/package.json', Buffer.from(JSON.stringify({ ...metadata,
+    dshCrewManagedFrontend: true, dshCrewFrontendRevision: revision,
+    dsh: { ...metadata.dsh, bundle: undefined },
+  }, null, 2) + '\n'));
+  const frontendRoot = join(home, '.config', 'dsh-crew', 'frontend');
+  const snapshotRoot = join(frontendRoot, 'revisions', revision);
+  const overlayFile = join(frontendRoot, 'official-web.patch.json');
+  const overlay = JSON.stringify([{ insert: [{ id: 'dsh-crew-official-web-bridge',
+    name: pathToFileURL(join(snapshotRoot, 'official-web-bridge', 'entry.mjs')).href,
+  }] }], null, 2) + '\n';
+  return { frontendRoot, snapshotRoot, revision, overlayFile, overlay, files };
+}
+
+function matches(p) {
+  try { return [...p.files].every(([name, bytes]) => {
+    const file = join(p.snapshotRoot, name);
+    return lstatSync(file).isFile() && !lstatSync(file).isSymbolicLink() && readFileSync(file).equals(bytes);
+  }); } catch { return false; }
+}
+
+export function officialFrontendAssetsReady({ home = homedir(), root } = {}) {
+  try {
+    const p = plan(home, root);
+    return matches(p) && readFileSync(p.overlayFile, 'utf8') === p.overlay;
+  } catch { return false; }
+}
+
+export function installOfficialFrontendAssets({ home = homedir(), root } = {}) {
+  let stage;
+  let temp;
+  try {
+    const p = plan(home, root);
+    for (const path of [p.frontendRoot, join(p.frontendRoot, 'revisions'), p.snapshotRoot, p.overlayFile]) {
+      if (existsSync(path) && lstatSync(path).isSymbolicLink()) throw new Error('linked frontend destination');
+    }
+    const already = officialFrontendAssetsReady({ home, root });
+    if (already) return { ok: true, changed: false, revision: p.revision, snapshotRoot: p.snapshotRoot, overlayFile: p.overlayFile };
+    mkdirSync(join(p.frontendRoot, 'revisions'), { recursive: true });
+    if (!existsSync(p.snapshotRoot)) {
+      stage = mkdtempSync(join(p.frontendRoot, '.stage-'));
+      for (const [name, bytes] of p.files) {
+        const file = join(stage, name);
+        mkdirSync(dirname(file), { recursive: true });
+        writeFileSync(file, bytes);
+      }
+      try { renameSync(stage, p.snapshotRoot); stage = null; }
+      catch (error) { if (!matches(p)) throw error; }
+    }
+    if (!matches(p)) throw new Error('frontend snapshot conflicts with its revision');
+    temp = `${p.overlayFile}.${randomUUID()}.tmp`;
+    writeFileSync(temp, p.overlay, { flag: 'wx', mode: 0o600 });
+    renameSync(temp, p.overlayFile); temp = null;
+    return { ok: true, changed: true, revision: p.revision, snapshotRoot: p.snapshotRoot, overlayFile: p.overlayFile };
+  } catch (error) {
+    return { ok: false, code: 'OFFICIAL_FRONTEND_ASSETS_FAILED', error: error.message };
+  } finally {
+    if (stage) rmSync(stage, { recursive: true, force: true });
+    if (temp) rmSync(temp, { force: true });
+  }
+}

package/src/install/payload-content.mjs

@@ -0,0 +1,88 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
+import { isAbsolute, join, posix } from 'node:path';
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])]));
+  return value;
+}
+
+function runtimeManifest(manifest) {
+  const normalized = { ...manifest, dependencies: { ...manifest.peerDependencies, ...manifest.dependencies } };
+  delete normalized.devDependencies;
+  delete normalized.peerDependencies;
+  delete normalized.peerDependenciesMeta;
+  return canonical(normalized);
+}
+
+/** Capture bounded first-party package bytes once for both validation and copying. */
+export function capturePayloadContent(root, suppliedManifest) {
+  try {
+    const manifest = suppliedManifest ?? JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    if (!Array.isArray(manifest.files)) return null;
+    const files = new Map();
+    const modes = new Map();
+    const directories = new Set();
+    let bytes = 0;
+    const visit = relative => {
+      let parent = root;
+      for (const segment of posix.dirname(relative).split('/').filter(part => part && part !== '.')) {
+        parent = join(parent, segment);
+        const info = lstatSync(parent);
+        if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('unsupported payload parent');
+      }
+      const file = join(root, relative);
+      const stat = lstatSync(file);
+      if (stat.isSymbolicLink()) throw new Error('unsupported payload symlink');
+      if (stat.isDirectory()) {
+        if (directories.size >= 4096) throw new Error('payload directory limit exceeded');
+        directories.add(relative);
+        for (const name of readdirSync(file)) visit(posix.join(relative, name));
+        return;
+      }
+      if (!stat.isFile() || files.size >= 4096) throw new Error('unsupported payload entry');
+      if (files.has(relative)) return;
+      bytes += stat.size;
+      if (bytes > 64 * 1024 * 1024) throw new Error('payload content limit exceeded');
+      const content = relative === 'package.json'
+        ? Buffer.from(JSON.stringify(runtimeManifest(manifest))) : readFileSync(file);
+      if (content.length > stat.size && relative !== 'package.json') throw new Error('payload changed while being read');
+      files.set(relative, content);
+      modes.set(relative, stat.mode & 0o777);
+    };
+    visit('package.json');
+    for (const entry of manifest.files ?? []) {
+      if (typeof entry !== 'string') throw new Error('invalid payload pattern');
+      const pattern = entry.replaceAll('\\', '/');
+      const segments = pattern.split('/');
+      if (!pattern.trim() || entry.includes('\\') || posix.normalize(pattern) === '.'
+        || isAbsolute(pattern) || pattern.includes(':')
+        || segments.some(segment => ['..', '.git', 'node_modules'].includes(segment.toLowerCase()))) throw new Error('invalid payload path');
+      if (!pattern.includes('*')) {
+        if (existsSync(join(root, pattern))) visit(pattern);
+        continue;
+      }
+      const base = posix.dirname(pattern);
+      if (base.includes('*')) throw new Error('unsupported payload wildcard');
+      const expression = new RegExp('^' + posix.basename(pattern).split('*').map(part => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('[^/]*') + '$');
+      if (existsSync(join(root, base))) {
+        for (const name of readdirSync(join(root, base))) if (expression.test(name)) visit(posix.join(base, name));
+      }
+    }
+    return { files, directories, modes };
+  } catch { return null; }
+}
+
+/** This digest covers first-party shipped files, not dependency tamper attestation. */
+export function payloadContentDigest(root) {
+  const snapshot = capturePayloadContent(root);
+  if (!snapshot) return null;
+  const hashes = [...snapshot.files].map(([name, bytes]) => [name, createHash('sha256').update(bytes).digest('hex')]);
+  return createHash('sha256').update(JSON.stringify(hashes.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))).digest('hex');
+}
+
+export function samePayloadContent(sourceRoot, installedRoot) {
+  const source = payloadContentDigest(sourceRoot);
+  return source !== null && source === payloadContentDigest(installedRoot);
+}

package/src/install/windows-startup.mjs

@@ -3,15 +3,20 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  renameSync,
   rmSync,
   writeFileSync,
 } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
+import { installOfficialFrontendAssets, officialFrontendAssetsReady } from './official-frontend-assets.mjs';
 
 export const WINDOWS_STARTUP_FILENAME = 'DSH Crew.vbs';
 export const WINDOWS_LAUNCHER_FILENAME = 'start-dsh-crew.cmd';
 export const WINDOWS_HELPER_FILENAME = 'start-dsh-crew.ps1';
+export const WINDOWS_CONTROL_FILENAME = 'supervisor-control.ps1';
+export const WINDOWS_SUPERVISOR_ASSET_MANIFEST = 'supervisor-assets.json';
 
 function defaultStartupDir({ home, env }) {
   if (home === homedir() && env.APPDATA) {
@@ -23,10 +28,14 @@ function defaultStartupDir({ home, env }) {
 function paths({ home, startupDir, env }) {
   const launcherFile = join(home, '.config', 'dsh-crew', 'launchers', WINDOWS_LAUNCHER_FILENAME);
   const helperFile = join(home, '.config', 'dsh-crew', 'launchers', WINDOWS_HELPER_FILENAME);
+  const controlFile = join(home, '.config', 'dsh-crew', 'launchers', WINDOWS_CONTROL_FILENAME);
+  const supervisorManifestFile = join(home, '.config', 'dsh-crew', 'launchers', WINDOWS_SUPERVISOR_ASSET_MANIFEST);
   const resolvedStartupDir = startupDir ?? defaultStartupDir({ home, env });
   return {
     launcherFile,
     helperFile,
+    controlFile,
+    supervisorManifestFile,
     startupFile: join(resolvedStartupDir, WINDOWS_STARTUP_FILENAME),
   };
 }
@@ -50,6 +59,14 @@ function isManagedStartupFile(file, resolved) {
       const text = readFileSync(file, 'utf8');
       return /DSH Crew managed Windows launcher/i.test(text) || /DSHCrewServiceSupervisor/i.test(text);
     }
+    if (file === resolved.controlFile) {
+      const text = readFileSync(file, 'utf8');
+      return /DSH Crew Windows supervisor process control/i.test(text) && /Stop-ExactManagedWatcher/i.test(text);
+    }
+    if (file === resolved.supervisorManifestFile) {
+      const parsed = JSON.parse(readFileSync(file, 'utf8'));
+      return parsed?.schema_version === 1 && parsed.managed_by === 'dsh-crew';
+    }
   } catch {
     return false;
   }
@@ -57,12 +74,13 @@ function isManagedStartupFile(file, resolved) {
 }
 
 function startupTargetConflicts(resolved) {
-  return [resolved.startupFile, resolved.launcherFile, resolved.helperFile]
+  return [resolved.startupFile, resolved.launcherFile, resolved.helperFile, resolved.controlFile, resolved.supervisorManifestFile]
     .filter((file) => existsSync(file) && !isManagedStartupFile(file, resolved));
 }
 
 export function windowsStartupStatus({
   home = homedir(),
+  root,
   startupDir,
   platform = process.platform,
   env = process.env,
@@ -71,23 +89,72 @@ export function windowsStartupStatus({
   const resolved = paths({ home, startupDir, env });
   const installed = existsSync(resolved.startupFile)
     || existsSync(resolved.launcherFile)
-    || existsSync(resolved.helperFile);
-  let ready = existsSync(resolved.startupFile)
-    && existsSync(resolved.launcherFile)
-    && existsSync(resolved.helperFile);
-  if (ready) {
+    || existsSync(resolved.helperFile)
+    || existsSync(resolved.controlFile)
+    || existsSync(resolved.supervisorManifestFile);
+  const components = {
+    startup_entry_content: false,
+    launcher_content: false,
+    helper_content: false,
+    control_content: false,
+    supervisor_manifest: false,
+  };
+  if (typeof root === 'string' && root.trim()) {
     try {
+      const sourceLauncher = readFileSync(join(root, 'windows', WINDOWS_LAUNCHER_FILENAME), 'utf8');
+      const sourceHelper = readFileSync(join(root, 'windows', WINDOWS_HELPER_FILENAME), 'utf8');
+      if (sourceHelper.includes('Get-OfficialFrontendOverlay')) components.frontend_overlay = officialFrontendAssetsReady({ home, root });
+      const sourceControl = readFileSync(join(root, 'windows', WINDOWS_CONTROL_FILENAME), 'utf8');
+      const sourceVbs = readFileSync(join(root, 'windows', 'start-dsh-crew.vbs'), 'utf8');
       const startup = readFileSync(resolved.startupFile, 'utf16le').replace(/^\uFEFF/, '');
-      const launcher = readFileSync(resolved.launcherFile, 'utf8');
-      const helper = readFileSync(resolved.helperFile, 'utf8');
-      ready = startup.includes(resolved.launcherFile)
-        && startup.includes('--watch')
-        && launcher.includes(WINDOWS_HELPER_FILENAME)
-        && helper.includes('DSH Crew managed Windows launcher')
-        && helper.includes('DSHCrewServiceSupervisor');
-    } catch { ready = false; }
+      components.startup_entry_content = startup === renderVbs(sourceVbs, resolved.launcherFile);
+      components.launcher_content = readFileSync(resolved.launcherFile, 'utf8') === sourceLauncher;
+      components.helper_content = readFileSync(resolved.helperFile, 'utf8') === sourceHelper;
+      components.control_content = readFileSync(resolved.controlFile, 'utf8') === sourceControl;
+      const assets = readWindowsSupervisorAssets({ home });
+      components.supervisor_manifest = assets.ok
+        && assets.helper_hash === sha256File(join(root, 'windows', WINDOWS_HELPER_FILENAME))
+        && assets.control_hash === sha256File(join(root, 'windows', WINDOWS_CONTROL_FILENAME));
+    } catch { /* missing or unreadable content remains false */ }
+  }
+  const missing = Object.entries(components).filter(([, ready]) => !ready).map(([key]) => key);
+  return { supported: true, installed, ready: missing.length === 0, components, missing, ...resolved };
+}
+
+function sha256File(file) {
+  try { return createHash('sha256').update(readFileSync(file)).digest('hex'); } catch { return null; }
+}
+
+function samePath(left, right) {
+  try { return resolve(left).toLowerCase() === resolve(right).toLowerCase(); } catch { return false; }
+}
+
+function writeAtomic(file, content) {
+  const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temp, content, { encoding: 'utf8', flag: 'wx' });
+  try { renameSync(temp, file); } finally { try { rmSync(temp, { force: true }); } catch {} }
+}
+
+export function readWindowsSupervisorAssets({ home = homedir() } = {}) {
+  const resolved = paths({ home, env: process.env });
+  try {
+    const manifest = JSON.parse(readFileSync(resolved.supervisorManifestFile, 'utf8'));
+    const helperHash = sha256File(resolved.helperFile);
+    const controlHash = sha256File(resolved.controlFile);
+    const valid = manifest?.schema_version === 1
+      && manifest.managed_by === 'dsh-crew'
+      && samePath(manifest.helper_path, resolved.helperFile)
+      && samePath(manifest.control_path, resolved.controlFile)
+      && /^[a-f0-9]{64}$/u.test(manifest.helper_hash ?? '')
+      && /^[a-f0-9]{64}$/u.test(manifest.control_hash ?? '')
+      && manifest.helper_hash === helperHash
+      && manifest.control_hash === controlHash;
+    return valid
+      ? { ok: true, helper_path: resolved.helperFile, helper_hash: helperHash, control_path: resolved.controlFile, control_hash: controlHash }
+      : { ok: false, code: 'SUPERVISOR_ASSET_MANIFEST_MISMATCH' };
+  } catch {
+    return { ok: false, code: 'SUPERVISOR_ASSET_MANIFEST_UNAVAILABLE' };
   }
-  return { supported: true, installed, ready, ...resolved };
 }
 
 export function installWindowsStartup({
@@ -101,8 +168,9 @@ export function installWindowsStartup({
   if (!root) return { ok: false, supported: true, code: 'STARTUP_SOURCE_REQUIRED' };
   const sourceLauncher = join(root, 'windows', WINDOWS_LAUNCHER_FILENAME);
   const sourceHelper = join(root, 'windows', WINDOWS_HELPER_FILENAME);
+  const sourceControl = join(root, 'windows', WINDOWS_CONTROL_FILENAME);
   const sourceVbs = join(root, 'windows', 'start-dsh-crew.vbs');
-  if (!existsSync(sourceLauncher) || !existsSync(sourceHelper) || !existsSync(sourceVbs)) {
+  if (!existsSync(sourceLauncher) || !existsSync(sourceHelper) || !existsSync(sourceControl) || !existsSync(sourceVbs)) {
     return { ok: false, supported: true, code: 'STARTUP_ASSET_MISSING' };
   }
   const resolved = paths({ home, startupDir, env });
@@ -110,17 +178,37 @@ export function installWindowsStartup({
   if (conflicts.length > 0) {
     return { ok: false, supported: true, code: 'STARTUP_TARGET_COLLISION', conflicts, ...resolved };
   }
+  const needsFrontend = readFileSync(sourceHelper, 'utf8').includes('Get-OfficialFrontendOverlay');
+  const frontend = needsFrontend ? installOfficialFrontendAssets({ home, root }) : null;
+  if (frontend && !frontend.ok) return { ...frontend, supported: true };
   mkdirSync(dirname(resolved.launcherFile), { recursive: true });
   mkdirSync(dirname(resolved.startupFile), { recursive: true });
   const beforeLauncher = existsSync(resolved.launcherFile) ? readFileSync(resolved.launcherFile) : null;
   const beforeHelper = existsSync(resolved.helperFile) ? readFileSync(resolved.helperFile) : null;
+  const beforeControl = existsSync(resolved.controlFile) ? readFileSync(resolved.controlFile) : null;
+  const beforeManifest = existsSync(resolved.supervisorManifestFile) ? readFileSync(resolved.supervisorManifestFile) : null;
   const beforeStartup = existsSync(resolved.startupFile) ? readFileSync(resolved.startupFile) : null;
   copyFileSync(sourceLauncher, resolved.launcherFile);
   copyFileSync(sourceHelper, resolved.helperFile);
+  copyFileSync(sourceControl, resolved.controlFile);
+  const supervisorManifest = {
+    schema_version: 1,
+    managed_by: 'dsh-crew',
+    helper_path: resolved.helperFile,
+    helper_hash: sha256File(resolved.helperFile),
+    control_path: resolved.controlFile,
+    control_hash: sha256File(resolved.controlFile),
+  };
+  writeAtomic(resolved.supervisorManifestFile, `${JSON.stringify(supervisorManifest, null, 2)}\n`);
+  if (!readWindowsSupervisorAssets({ home }).ok) {
+    return { ok: false, supported: true, code: 'SUPERVISOR_ASSET_MANIFEST_VERIFY_FAILED', ...resolved };
+  }
   const rendered = renderVbs(readFileSync(sourceVbs, 'utf8'), resolved.launcherFile);
   writeFileSync(resolved.startupFile, `\uFEFF${rendered}`, 'utf16le');
-  const changed = !beforeLauncher?.equals(readFileSync(resolved.launcherFile))
+  const changed = frontend?.changed === true || !beforeLauncher?.equals(readFileSync(resolved.launcherFile))
     || !beforeHelper?.equals(readFileSync(resolved.helperFile))
+    || !beforeControl?.equals(readFileSync(resolved.controlFile))
+    || !beforeManifest?.equals(readFileSync(resolved.supervisorManifestFile))
     || !beforeStartup?.equals(readFileSync(resolved.startupFile));
   return { ok: true, supported: true, changed, ...resolved };
 }
@@ -135,7 +223,7 @@ export function uninstallWindowsStartup({
   const resolved = paths({ home, startupDir, env });
   let removed = false;
   const preserved = [];
-  for (const file of [resolved.startupFile, resolved.launcherFile, resolved.helperFile]) {
+  for (const file of [resolved.startupFile, resolved.launcherFile, resolved.helperFile, resolved.controlFile, resolved.supervisorManifestFile]) {
     if (!existsSync(file)) continue;
     if (!isManagedStartupFile(file, resolved)) {
       preserved.push(file);