@scopebond/agent 0.5.6 → 0.6.1

package/dist/ipc.js

@@ -1,7 +1,8 @@
 // The agent's local control channel: HTTP with a random token, over a named pipe on Windows (a random name) or a Unix
-// socket in a folder only this user can open, and for one more release also on 127.0.0.1 at a random port (the PowerShell
-// tray uses it; SCOPEBOND_AGENT_LOOPBACK=0 turns it off). The pipe or socket, the port, the token and the process id are
-// written to agent.json in the Scopebond home, which is how the CLI, the hook's override window and the tray find it.
+// socket in a folder only this user can open. npm installs also listen on 127.0.0.1 at a random port, because the
+// PowerShell tray and hooks before the pipe use it (SCOPEBOND_AGENT_LOOPBACK=0 turns it off); the signed install with the
+// native tray does not (its tray and its hook use the pipe). The pipe or socket, the port, the token and the process id
+// are written to agent.json in the Scopebond home, which is how the CLI, the hook's override window and the tray find it.
 // A loopback port can be reached by any program on the computer; the pipe's name and the socket's folder cannot be found
 // or opened by another user. Every request must carry the token either way.
 import { createServer } from "node:http";
@@ -34,8 +35,10 @@ export function readEndpoint(dir) {
         return null;
     }
 }
-/** Start the control server. `routes` maps "METHOD /path" to a handler. */
-export async function startControl(dir, version, routes) {
+/** Start the control server. `routes` maps "METHOD /path" to a handler. `loopback`: also listen on 127.0.0.1 (default:
+ *  unless SCOPEBOND_AGENT_LOOPBACK=0); it is used anyway when the pipe or socket could not be made, or nothing could reach
+ *  the agent. */
+export async function startControl(dir, version, routes, options = {}) {
     const token = randomBytes(24).toString("base64url");
     const expected = Buffer.from(token);
     const handle = async (req, res) => {
@@ -59,9 +62,11 @@ export async function startControl(dir, version, routes) {
             send(500, { error: error.message.slice(0, 200) });
         }
     };
+    // A caller that drops the connection mid-body rejects the read; that ends the request, never the agent.
+    const listener = (req, res) => { handle(req, res).catch(() => { res.destroy(); }); };
     // The pipe or socket first. A Unix socket's folder is created for this user only, and the socket itself is too.
     const socketPath = localSocketPath(dir);
-    const local = createServer(handle);
+    const local = createServer(listener);
     let socket = socketPath;
     try {
         if (process.platform !== "win32") {
@@ -76,9 +81,10 @@ export async function startControl(dir, version, routes) {
     catch {
         socket = null;
     }
-    // Loopback for one more release (the PowerShell tray), unless turned off; always when the pipe could not be made.
-    const loopback = process.env.SCOPEBOND_AGENT_LOOPBACK !== "0" || socket === null;
-    const server = createServer(handle);
+    // Loopback where something still needs it (the PowerShell tray, older hooks), unless turned off; always when the pipe
+    // could not be made.
+    const loopback = (options.loopback ?? process.env.SCOPEBOND_AGENT_LOOPBACK !== "0") || socket === null;
+    const server = createServer(listener);
     if (loopback)
         await new Promise((resolve, reject) => { server.once("error", reject); server.listen(0, "127.0.0.1", () => resolve()); });
     const address = loopback ? server.address() : null;

package/dist/ipc.js.map

@@ -1 +1 @@
-{"version":3,"file":"ipc.js","sourceRoot":"","sources":["../src/ipc.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,0HAA0H;AAC1H,yHAAyH;AACzH,sHAAsH;AACtH,yHAAyH;AACzH,4EAA4E;AAE5E,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAKtD;;+DAE+D;AAC/D,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,WAA4B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACjI,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,gCAAgC,MAAM,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACpD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAChG,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,MAA+B;IAC9F,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9L,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAAC,GAAG,IAAI,KAAK,CAAC;YAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,CAAC;QACtH,IAAI,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAC/D,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC;IACF,gHAAgH;IAChH,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,GAAkB,UAAU,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1H,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC1B,kHAAkH;IAClH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC;IACjF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ;QAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;IAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,IAAI,QAAQ;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClH,iFAAiF;YACjF,IAAI,CAAC;gBAAC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;oBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChH,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,MAAsB,EAAE,IAAY,EAAE,IAAc,EAAE,SAAS,GAAG,KAAK;IAClH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3H,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,QAAQ,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE;YAClE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC1H,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACpG,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC","sourcesContent":["// The agent's local control channel: HTTP with a random token, over a named pipe on Windows (a random name) or a Unix\n// socket in a folder only this user can open, and for one more release also on 127.0.0.1 at a random port (the PowerShell\n// tray uses it; SCOPEBOND_AGENT_LOOPBACK=0 turns it off). The pipe or socket, the port, the token and the process id are\n// written to agent.json in the Scopebond home, which is how the CLI, the hook's override window and the tray find it.\n// A loopback port can be reached by any program on the computer; the pipe's name and the socket's folder cannot be found\n// or opened by another user. Every request must carry the token either way.\n\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport { randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { requestOverSocket } from \"@scopebond/hook\";\n\nexport const AGENT_FILE = \"agent.json\";\nexport const TOKEN_HEADER = \"x-scopebond-agent-token\";\n\n/** `socket`: the named pipe or Unix socket (absent from agents before it); `port`: 0 when loopback is off. */\nexport interface AgentEndpoint { port: number; socket?: string | null; token: string; pid: number; started_at: number; version: string }\n\n/** Where this start's pipe or socket goes. Windows: a pipe whose name is random, so no other user can guess it or claim it\n *  first. Elsewhere: `run/agent.sock` in the Scopebond home (folder 0700), or a private folder under the temporary folder\n *  when that path is longer than a Unix socket path may be. */\nexport function localSocketPath(dir: string, platform: NodeJS.Platform = process.platform, random = randomBytes(16).toString(\"hex\")): string {\n  if (platform === \"win32\") return `\\\\\\\\.\\\\pipe\\\\scopebond-agent-${random}`;\n  const inHome = join(dir, \"run\", \"agent.sock\");\n  if (Buffer.byteLength(inHome) <= 100) return inHome;\n  return join(mkdtempSync(join(tmpdir(), \"scopebond-\")), \"agent.sock\");\n}\n\nexport type Handler = (body: unknown) => Promise<unknown> | unknown;\n\nexport function readEndpoint(dir: string): AgentEndpoint | null {\n  const file = join(dir, AGENT_FILE);\n  if (!existsSync(file)) return null;\n  try { return JSON.parse(readFileSync(file, \"utf8\")) as AgentEndpoint; } catch { return null; }\n}\n\n/** Start the control server. `routes` maps \"METHOD /path\" to a handler. */\nexport async function startControl(dir: string, version: string, routes: Record<string, Handler>): Promise<{ server: Server; endpoint: AgentEndpoint; close(): Promise<void> }> {\n  const token = randomBytes(24).toString(\"base64url\");\n  const expected = Buffer.from(token);\n  const handle = async (req: IncomingMessage, res: ServerResponse) => {\n    const send = (status: number, body: unknown) => { res.writeHead(status, { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" }); res.end(JSON.stringify(body)); };\n    const offered = Buffer.from(String(req.headers[TOKEN_HEADER] ?? \"\"));\n    if (offered.length !== expected.length || !timingSafeEqual(offered, expected)) return send(401, { error: \"unauthorized\" });\n    const handler = routes[`${req.method} ${(req.url ?? \"/\").split(\"?\")[0]}`];\n    if (!handler) return send(404, { error: \"not found\" });\n    let raw = \"\";\n    for await (const chunk of req) { raw += chunk; if (raw.length > 64 * 1024) return send(413, { error: \"too large\" }); }\n    try { send(200, await handler(raw ? JSON.parse(raw) : null)); }\n    catch (error) { send(500, { error: (error as Error).message.slice(0, 200) }); }\n  };\n  // The pipe or socket first. A Unix socket's folder is created for this user only, and the socket itself is too.\n  const socketPath = localSocketPath(dir);\n  const local = createServer(handle);\n  let socket: string | null = socketPath;\n  try {\n    if (process.platform !== \"win32\") {\n      mkdirSync(join(socketPath, \"..\"), { recursive: true, mode: 0o700 });\n      chmodSync(join(socketPath, \"..\"), 0o700);\n      rmSync(socketPath, { force: true });\n    }\n    await new Promise<void>((resolve, reject) => { local.once(\"error\", reject); local.listen(socketPath, () => resolve()); });\n    if (process.platform !== \"win32\") chmodSync(socketPath, 0o600);\n  } catch { socket = null; }\n  // Loopback for one more release (the PowerShell tray), unless turned off; always when the pipe could not be made.\n  const loopback = process.env.SCOPEBOND_AGENT_LOOPBACK !== \"0\" || socket === null;\n  const server = createServer(handle);\n  if (loopback) await new Promise<void>((resolve, reject) => { server.once(\"error\", reject); server.listen(0, \"127.0.0.1\", () => resolve()); });\n  const address = loopback ? server.address() : null;\n  const port = typeof address === \"object\" && address ? address.port : 0;\n  const endpoint: AgentEndpoint = { port, socket, token, pid: process.pid, started_at: Date.now(), version };\n  const file = join(dir, AGENT_FILE);\n  const temp = `${file}.${process.pid}.tmp`;\n  writeFileSync(temp, JSON.stringify(endpoint, null, 2) + \"\\n\", { mode: 0o600 });\n  renameSync(temp, file);\n  return {\n    server, endpoint,\n    close: () => new Promise<void>((resolve) => {\n      let open = (loopback ? 1 : 0) + (socket ? 1 : 0);\n      const done = () => { if (--open <= 0) resolve(); };\n      if (open === 0) resolve();\n      if (loopback) server.close(done);\n      if (socket) local.close(() => { if (process.platform !== \"win32\") rmSync(socketPath, { force: true }); done(); });\n      // Only remove the file if it is still ours (a newer agent may have replaced it).\n      try { if (readEndpoint(dir)?.pid === process.pid) rmSync(file, { force: true }); } catch { /* best effort */ }\n    }),\n  };\n}\n\n/** Call a running agent, over its pipe or socket when it has one. Returns null when no agent answers. */\nexport async function callAgent(dir: string, method: \"GET\" | \"POST\", path: string, body?: unknown, timeoutMs = 5_000): Promise<unknown | null> {\n  const endpoint = readEndpoint(dir);\n  if (!endpoint) return null;\n  if (typeof endpoint.socket === \"string\" && endpoint.socket) {\n    const answer = await requestOverSocket(endpoint.socket, method, path, { [TOKEN_HEADER]: endpoint.token }, body, timeoutMs);\n    if (answer) return answer.status >= 200 && answer.status < 300 ? answer.body : null;\n    if (!endpoint.port) return null;\n  }\n  try {\n    const res = await fetch(`http://127.0.0.1:${endpoint.port}${path}`, {\n      method, headers: { [TOKEN_HEADER]: endpoint.token, ...(body !== undefined ? { \"content-type\": \"application/json\" } : {}) },\n      body: body !== undefined ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(timeoutMs),\n    });\n    return res.ok ? await res.json() : null;\n  } catch { return null; }\n}\n"]}
+{"version":3,"file":"ipc.js","sourceRoot":"","sources":["../src/ipc.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,kHAAkH;AAClH,0HAA0H;AAC1H,wHAAwH;AACxH,0HAA0H;AAC1H,yHAAyH;AACzH,4EAA4E;AAE5E,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAKtD;;+DAE+D;AAC/D,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,WAA4B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACjI,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,gCAAgC,MAAM,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACpD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC;AAKD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAChG,CAAC;AAED;;iBAEiB;AACjB,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,MAA+B,EAAE,UAAkC,EAAE;IACpI,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9L,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAAC,GAAG,IAAI,KAAK,CAAC;YAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,CAAC;QACtH,IAAI,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAC/D,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC;IACF,wGAAwG;IACxG,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,gHAAgH;IAChH,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,GAAkB,UAAU,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1H,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC1B,sHAAsH;IACtH,qBAAqB;IACrB,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC;IACvG,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;IAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,IAAI,QAAQ;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClH,iFAAiF;YACjF,IAAI,CAAC;gBAAC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;oBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChH,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,MAAsB,EAAE,IAAY,EAAE,IAAc,EAAE,SAAS,GAAG,KAAK;IAClH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3H,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,QAAQ,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE;YAClE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC1H,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACpG,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC","sourcesContent":["// The agent's local control channel: HTTP with a random token, over a named pipe on Windows (a random name) or a Unix\n// socket in a folder only this user can open. npm installs also listen on 127.0.0.1 at a random port, because the\n// PowerShell tray and hooks before the pipe use it (SCOPEBOND_AGENT_LOOPBACK=0 turns it off); the signed install with the\n// native tray does not (its tray and its hook use the pipe). The pipe or socket, the port, the token and the process id\n// are written to agent.json in the Scopebond home, which is how the CLI, the hook's override window and the tray find it.\n// A loopback port can be reached by any program on the computer; the pipe's name and the socket's folder cannot be found\n// or opened by another user. Every request must carry the token either way.\n\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport { randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { requestOverSocket } from \"@scopebond/hook\";\n\nexport const AGENT_FILE = \"agent.json\";\nexport const TOKEN_HEADER = \"x-scopebond-agent-token\";\n\n/** `socket`: the named pipe or Unix socket (absent from agents before it); `port`: 0 when loopback is off. */\nexport interface AgentEndpoint { port: number; socket?: string | null; token: string; pid: number; started_at: number; version: string }\n\n/** Where this start's pipe or socket goes. Windows: a pipe whose name is random, so no other user can guess it or claim it\n *  first. Elsewhere: `run/agent.sock` in the Scopebond home (folder 0700), or a private folder under the temporary folder\n *  when that path is longer than a Unix socket path may be. */\nexport function localSocketPath(dir: string, platform: NodeJS.Platform = process.platform, random = randomBytes(16).toString(\"hex\")): string {\n  if (platform === \"win32\") return `\\\\\\\\.\\\\pipe\\\\scopebond-agent-${random}`;\n  const inHome = join(dir, \"run\", \"agent.sock\");\n  if (Buffer.byteLength(inHome) <= 100) return inHome;\n  return join(mkdtempSync(join(tmpdir(), \"scopebond-\")), \"agent.sock\");\n}\n\n/** Returns the answer, or a promise of it. */\nexport type Handler = (body: unknown) => unknown;\n\nexport function readEndpoint(dir: string): AgentEndpoint | null {\n  const file = join(dir, AGENT_FILE);\n  if (!existsSync(file)) return null;\n  try { return JSON.parse(readFileSync(file, \"utf8\")) as AgentEndpoint; } catch { return null; }\n}\n\n/** Start the control server. `routes` maps \"METHOD /path\" to a handler. `loopback`: also listen on 127.0.0.1 (default:\n *  unless SCOPEBOND_AGENT_LOOPBACK=0); it is used anyway when the pipe or socket could not be made, or nothing could reach\n *  the agent. */\nexport async function startControl(dir: string, version: string, routes: Record<string, Handler>, options: { loopback?: boolean } = {}): Promise<{ server: Server; endpoint: AgentEndpoint; close(): Promise<void> }> {\n  const token = randomBytes(24).toString(\"base64url\");\n  const expected = Buffer.from(token);\n  const handle = async (req: IncomingMessage, res: ServerResponse) => {\n    const send = (status: number, body: unknown) => { res.writeHead(status, { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" }); res.end(JSON.stringify(body)); };\n    const offered = Buffer.from(String(req.headers[TOKEN_HEADER] ?? \"\"));\n    if (offered.length !== expected.length || !timingSafeEqual(offered, expected)) return send(401, { error: \"unauthorized\" });\n    const handler = routes[`${req.method} ${(req.url ?? \"/\").split(\"?\")[0]}`];\n    if (!handler) return send(404, { error: \"not found\" });\n    let raw = \"\";\n    for await (const chunk of req) { raw += chunk; if (raw.length > 64 * 1024) return send(413, { error: \"too large\" }); }\n    try { send(200, await handler(raw ? JSON.parse(raw) : null)); }\n    catch (error) { send(500, { error: (error as Error).message.slice(0, 200) }); }\n  };\n  // A caller that drops the connection mid-body rejects the read; that ends the request, never the agent.\n  const listener = (req: IncomingMessage, res: ServerResponse) => { handle(req, res).catch(() => { res.destroy(); }); };\n  // The pipe or socket first. A Unix socket's folder is created for this user only, and the socket itself is too.\n  const socketPath = localSocketPath(dir);\n  const local = createServer(listener);\n  let socket: string | null = socketPath;\n  try {\n    if (process.platform !== \"win32\") {\n      mkdirSync(join(socketPath, \"..\"), { recursive: true, mode: 0o700 });\n      chmodSync(join(socketPath, \"..\"), 0o700);\n      rmSync(socketPath, { force: true });\n    }\n    await new Promise<void>((resolve, reject) => { local.once(\"error\", reject); local.listen(socketPath, () => resolve()); });\n    if (process.platform !== \"win32\") chmodSync(socketPath, 0o600);\n  } catch { socket = null; }\n  // Loopback where something still needs it (the PowerShell tray, older hooks), unless turned off; always when the pipe\n  // could not be made.\n  const loopback = (options.loopback ?? process.env.SCOPEBOND_AGENT_LOOPBACK !== \"0\") || socket === null;\n  const server = createServer(listener);\n  if (loopback) await new Promise<void>((resolve, reject) => { server.once(\"error\", reject); server.listen(0, \"127.0.0.1\", () => resolve()); });\n  const address = loopback ? server.address() : null;\n  const port = typeof address === \"object\" && address ? address.port : 0;\n  const endpoint: AgentEndpoint = { port, socket, token, pid: process.pid, started_at: Date.now(), version };\n  const file = join(dir, AGENT_FILE);\n  const temp = `${file}.${process.pid}.tmp`;\n  writeFileSync(temp, JSON.stringify(endpoint, null, 2) + \"\\n\", { mode: 0o600 });\n  renameSync(temp, file);\n  return {\n    server, endpoint,\n    close: () => new Promise<void>((resolve) => {\n      let open = (loopback ? 1 : 0) + (socket ? 1 : 0);\n      const done = () => { if (--open <= 0) resolve(); };\n      if (open === 0) resolve();\n      if (loopback) server.close(done);\n      if (socket) local.close(() => { if (process.platform !== \"win32\") rmSync(socketPath, { force: true }); done(); });\n      // Only remove the file if it is still ours (a newer agent may have replaced it).\n      try { if (readEndpoint(dir)?.pid === process.pid) rmSync(file, { force: true }); } catch { /* best effort */ }\n    }),\n  };\n}\n\n/** Call a running agent, over its pipe or socket when it has one. Returns null when no agent answers. */\nexport async function callAgent(dir: string, method: \"GET\" | \"POST\", path: string, body?: unknown, timeoutMs = 5_000): Promise<unknown> {\n  const endpoint = readEndpoint(dir);\n  if (!endpoint) return null;\n  if (typeof endpoint.socket === \"string\" && endpoint.socket) {\n    const answer = await requestOverSocket(endpoint.socket, method, path, { [TOKEN_HEADER]: endpoint.token }, body, timeoutMs);\n    if (answer) return answer.status >= 200 && answer.status < 300 ? answer.body : null;\n    if (!endpoint.port) return null;\n  }\n  try {\n    const res = await fetch(`http://127.0.0.1:${endpoint.port}${path}`, {\n      method, headers: { [TOKEN_HEADER]: endpoint.token, ...(body !== undefined ? { \"content-type\": \"application/json\" } : {}) },\n      body: body !== undefined ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(timeoutMs),\n    });\n    return res.ok ? await res.json() : null;\n  } catch { return null; }\n}\n"]}

package/dist/log-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"log-file.js","sourceRoot":"","sources":["../src/log-file.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,yHAAyH;AACzH,uHAAuH;AACvH,kEAAkE;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C;mHACmH;AACnH,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAEjD,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,IAAyB,EAAE,EAAE;QAC3C,IAAI,CAAC;YAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,IAAI,CAAC;gBAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;QAAC,CAAC;IACzH,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,IAAyB,EAAE,QAAkB,EAAE,QAAkB,EAAE,EAAE;YACpF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,IAAI,OAAO,IAAI,KAAK,UAAU;gBAAE,cAAc,CAAC,GAAG,EAAE,CAAE,IAAmB,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC,CAAwB,CAAC;IAC5B,CAAC;IACD,qHAAqH;IACrH,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,mCAAmC,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["// The agent's own log. A launcher redirecting the agent's output into the log would hold the file open for as long as\n// the agent runs, shared for reading only on Windows, and every child of the agent would inherit that handle. Writing it\n// here instead opens the file for each line, shared for reading and writing, so two agents (an old one handing over to\n// its update) can both write to it and no handle outlives a line.\n\nimport { appendFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/** Where lines go while the log itself cannot be opened: an agent started by an older launcher's agent inherits that\n *  launcher's handle on agent.log, which keeps everyone else from writing it until the computer signs in again. */\nexport const FALLBACK_LOG = \"agent-handover.log\";\n\n/** Send everything this process writes to stdout and stderr, and an error that would end it, to `file`. */\nexport function writeOutputTo(file: string): void {\n  const fallback = join(dirname(file), FALLBACK_LOG);\n  const append = (data: string | Uint8Array) => {\n    try { appendFileSync(file, data); }\n    catch { try { appendFileSync(fallback, data); } catch { /* nowhere to write: the line is lost, the agent runs on */ } }\n  };\n  for (const stream of [process.stdout, process.stderr]) {\n    stream.write = ((data: string | Uint8Array, encoding?: unknown, callback?: unknown) => {\n      append(data);\n      const done = typeof encoding === \"function\" ? encoding : callback;\n      if (typeof done === \"function\") queueMicrotask(() => (done as () => void)());\n      return true;\n    }) as typeof stream.write;\n  }\n  // Node prints a fatal error straight to the console, which is nul here: note it in the log, then exit as Node would,\n  // so the launcher restarts the agent.\n  process.on(\"uncaughtException\", (error) => {\n    append(`${new Date().toISOString()} the agent stopped on an error: ${error?.stack ?? String(error)}\\n`);\n    process.exit(1);\n  });\n}\n"]}
+{"version":3,"file":"log-file.js","sourceRoot":"","sources":["../src/log-file.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,yHAAyH;AACzH,uHAAuH;AACvH,kEAAkE;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C;mHACmH;AACnH,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAEjD,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,IAAyB,EAAE,EAAE;QAC3C,IAAI,CAAC;YAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,IAAI,CAAC;gBAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;QAAC,CAAC;IACzH,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,IAAyB,EAAE,QAAkB,EAAE,QAAkB,EAAE,EAAE;YACpF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,IAAI,OAAO,IAAI,KAAK,UAAU;gBAAE,cAAc,CAAC,GAAG,EAAE,CAAE,IAAmB,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,qHAAqH;IACrH,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,mCAAmC,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["// The agent's own log. A launcher redirecting the agent's output into the log would hold the file open for as long as\n// the agent runs, shared for reading only on Windows, and every child of the agent would inherit that handle. Writing it\n// here instead opens the file for each line, shared for reading and writing, so two agents (an old one handing over to\n// its update) can both write to it and no handle outlives a line.\n\nimport { appendFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/** Where lines go while the log itself cannot be opened: an agent started by an older launcher's agent inherits that\n *  launcher's handle on agent.log, which keeps everyone else from writing it until the computer signs in again. */\nexport const FALLBACK_LOG = \"agent-handover.log\";\n\n/** Send everything this process writes to stdout and stderr, and an error that would end it, to `file`. */\nexport function writeOutputTo(file: string): void {\n  const fallback = join(dirname(file), FALLBACK_LOG);\n  const append = (data: string | Uint8Array) => {\n    try { appendFileSync(file, data); }\n    catch { try { appendFileSync(fallback, data); } catch { /* nowhere to write: the line is lost, the agent runs on */ } }\n  };\n  for (const stream of [process.stdout, process.stderr]) {\n    stream.write = ((data: string | Uint8Array, encoding?: unknown, callback?: unknown) => {\n      append(data);\n      const done = typeof encoding === \"function\" ? encoding : callback;\n      if (typeof done === \"function\") queueMicrotask(() => (done as () => void)());\n      return true;\n    });\n  }\n  // Node prints a fatal error straight to the console, which is nul here: note it in the log, then exit as Node would,\n  // so the launcher restarts the agent.\n  process.on(\"uncaughtException\", (error) => {\n    append(`${new Date().toISOString()} the agent stopped on an error: ${error?.stack ?? String(error)}\\n`);\n    process.exit(1);\n  });\n}\n"]}

package/dist/native-update.d.ts

@@ -4,22 +4,40 @@ export declare const RELEASE_BASE = "https://github.com/avouro-com/scopebond/rel
 export declare const MANIFEST_DOMAIN = "scopebond:agent-release/v1\n";
 /** The publisher an installer must be signed by. */
 export declare const PUBLISHER: RegExp;
-export declare function updaterPublicKey(): string | null;
+/** One trusted updater key: its id (the first 16 hex digits of the SHA-256 of its SPKI bytes), its public half (base64
+ *  SPKI), and the last day it may sign (an ISO date, inclusive), or null for no end. */
+export interface UpdaterKey {
+    kid: string;
+    key: string;
+    not_after: string | null;
+}
+/** A public key's id: the first 16 hex digits of the SHA-256 of its SPKI bytes. */
+export declare function keyId(publicKeyB64: string): string;
+/** The updater keys this build trusts (empty when it has none). */
+export declare function updaterKeys(): UpdaterKey[];
 export type InstallKind = "npm" | "per-user" | "per-machine";
 /** How this agent was installed: from npm, by the installer for this user, or for every user (Program Files). */
 export declare function installKind(execPath?: string, single?: boolean, programFiles?: string): InstallKind;
 export interface ReleaseManifest {
     type: "scopebond:agent-release";
     version: string;
+    kid?: string;
     files: Array<{
         name: string;
         sha256: string;
         size: number;
     }>;
 }
-/** The manifest when its signature is the updater key's over exactly these bytes, else null. */
-export declare function verifyManifest(text: string, signatureB64: string, publicKeyB64: string): ReleaseManifest | null;
+/** The manifest when its signature is one trusted, in-date updater key's over exactly these bytes, else null. A manifest
+ *  that names its key id (`kid`) is checked with that key only. */
+export declare function verifyManifest(text: string, signatureB64: string, keys: string | UpdaterKey[], now?: number): ReleaseManifest | null;
 export declare const installerName: (version: string) => string;
+/** The environment for Windows PowerShell (powershell.exe, 5.1): this one's, without `PSModulePath`, plus `extra`. An
+ *  agent started from PowerShell 7 inherits its module path, and Windows PowerShell then cannot load its own security
+ *  module (Get-AuthenticodeSignature), so every check would fail; without the variable it uses its own default. */
+export declare function powershellEnv(extra: Record<string, string>, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** A Windows tool by its full path under the system folder, never by a name looked up on PATH. */
+export declare function windowsTool(name: "powershell" | "msiexec" | "cmd"): string;
 /** The Authenticode check: Windows' own verdict on the file, and the signer's subject. */
 export declare function authenticode(file: string): {
     valid: boolean;
@@ -29,6 +47,8 @@ export interface VerifiedInstaller {
     ok: true;
     path: string;
     version: string;
+    sha256: string;
+    size: number;
 }
 export interface Refused {
     ok: false;
@@ -38,14 +58,70 @@ export interface Refused {
 export declare function fetchVerifiedInstaller(version: string, o: {
     dir: string;
     fetchImpl?: typeof fetch;
-    publicKey?: string | null;
+    publicKey?: string | UpdaterKey[] | null;
     check?: (file: string) => {
         valid: boolean;
         subject: string;
     };
     base?: string;
+    now?: number;
 }): Promise<VerifiedInstaller | Refused>;
-/** Install it once this agent has exited, then start the agent again through autostart's launcher. A detached helper does it,
- *  because the installer replaces this very file. */
-export declare function installAfterExit(installer: string, pid: number, launcher: string | null): void;
+/** What the helper that installs after this agent exits records, beside the installer. */
+export declare const INSTALL_RESULT = "install-result.json";
+export interface InstallResult {
+    at: string;
+    version: string;
+    installed: boolean;
+    reason: string | null;
+    exit_code: number | null;
+}
+/** The helper's script. It is constant text: every value (the installer, its digest and size, the publisher rule, where to
+ *  record the outcome) reaches it through environment variables, never through the script itself.
+ *
+ *  Between the download and the install the agent exits and up to a minute passes, so the helper checks the installer again
+ *  right before it runs msiexec, the same way the agent did: its size and SHA-256 are the signed manifest's, its Authenticode
+ *  signature is valid and its signer matches the same anchored publisher rule (PUBLISHER). It holds the file open, denying
+ *  writes and deletes, from that check until msiexec has finished, so the file checked is the file installed. Any mismatch
+ *  installs nothing and records why in INSTALL_RESULT; the agent is started again either way. */
+export declare const INSTALL_HELPER_SCRIPT: string;
+/** The helper's script (INSTALL_HELPER_SCRIPT): stop the native tray, wait for this agent to exit, check the installer
+ *  again, install, then start the tray again (or the agent through autostart's launcher). */
+export declare function installAfterExitScript(): string;
+/** The native Scopebond tray the installer puts beside the single executable (`scopebond-tray.exe`), when it is there. It
+ *  starts the agent at sign-in and keeps it running, so the agent leaves the tray to it. */
+export declare function nativeTrayPath(execPath?: string, single?: boolean, exists?: (path: string) => boolean): string | null;
+/** The helper's program, arguments and environment values (pure, so it can be tested). */
+export declare function installHelper(installer: {
+    path: string;
+    version: string;
+    sha256: string;
+    size: number;
+}, pid: number, launcher: string | null, o?: {
+    msiexec?: string;
+    publisher?: RegExp;
+    tray?: string | null;
+}): {
+    program: string;
+    args: string[];
+    env: Record<string, string>;
+};
+/** Install it once this agent has exited, then start the tray again (or the agent through autostart's launcher). A detached
+ *  helper does it, because the installer replaces this very file; it checks the installer again first (INSTALL_HELPER_SCRIPT). */
+export declare function installAfterExit(installer: {
+    path: string;
+    version: string;
+    sha256: string;
+    size: number;
+}, pid: number, launcher: string | null, tray?: string | null): void;
+/** Whether the installer on disk is still the verified one: same size and SHA-256, and still validly signed by Avouro LLC. */
+export declare function installerUnchanged(installer: Pick<VerifiedInstaller, "path" | "sha256" | "size">, check?: (file: string) => {
+    valid: boolean;
+    subject: string;
+}): boolean;
+/** The helper's check alone: exit 0 when $env:SB_MSI is still the verified installer, 3 when it is not. */
+export declare function installerRecheckScript(): string;
+/** The helper script that installs after this agent exits (INSTALL_HELPER_SCRIPT). */
+export declare function installHelperScript(): string;
+/** What the last install helper recorded, once: the file is removed when read. Null when there is nothing. */
+export declare function takeInstallResult(dir: string): InstallResult | null;
 //# sourceMappingURL=native-update.d.ts.map

package/dist/native-update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-update.d.ts","sourceRoot":"","sources":["../src/native-update.ts"],"names":[],"mappings":"AAcA,+CAA+C;AAC/C,eAAO,MAAM,YAAY,8DAA8D,CAAC;AACxF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAC9D,oDAAoD;AACpD,eAAO,MAAM,SAAS,QAA8B,CAAC;AAKrD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,aAAa,CAAC;AAE7D,iHAAiH;AACjH,wBAAgB,WAAW,CAAC,QAAQ,SAAmB,EAAE,MAAM,UAAuB,EAAE,YAAY,SAAkD,GAAG,WAAW,CAMnK;AAED,MAAM,WAAW,eAAe;IAAG,IAAI,EAAE,yBAAyB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;AAEnJ,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAQ/G;AAED,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,WAAyC,CAAC;AAEvF,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK9E;AAED,MAAM,WAAW,iBAAiB;IAAG,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC9E,MAAM,WAAW,OAAO;IAAG,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAEtD,+GAA+G;AAC/G,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/D,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAChJ,GAAG,OAAO,CAAC,iBAAiB,GAAG,OAAO,CAAC,CA8BvC;AAED;qDACqD;AACrD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAY9F"}
+{"version":3,"file":"native-update.d.ts","sourceRoot":"","sources":["../src/native-update.ts"],"names":[],"mappings":"AAgBA,+CAA+C;AAC/C,eAAO,MAAM,YAAY,8DAA8D,CAAC;AACxF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAC9D,oDAAoD;AACpD,eAAO,MAAM,SAAS,QAA8B,CAAC;AAErD;wFACwF;AACxF,MAAM,WAAW,UAAU;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAMlF,mFAAmF;AACnF,wBAAgB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,mEAAmE;AACnE,wBAAgB,WAAW,IAAI,UAAU,EAAE,CAG1C;AAmBD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,aAAa,CAAC;AAE7D,iHAAiH;AACjH,wBAAgB,WAAW,CAAC,QAAQ,SAAmB,EAAE,MAAM,UAAuB,EAAE,YAAY,SAAkD,GAAG,WAAW,CAMnK;AAED,MAAM,WAAW,eAAe;IAAG,IAAI,EAAE,yBAAyB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;AAEjK;mEACmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,EAAE,GAAG,SAAa,GAAG,eAAe,GAAG,IAAI,CAiBxI;AAED,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,WAAyC,CAAC;AAEvF;;mHAEmH;AACnH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAIrH;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAI1E;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK9E;AAED,MAAM,WAAW,iBAAiB;IAAG,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC5G,MAAM,WAAW,OAAO;IAAG,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAEtD,+GAA+G;AAC/G,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/D,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CAC7K,GAAG,OAAO,CAAC,iBAAiB,GAAG,OAAO,CAAC,CA8BvC;AAED,0FAA0F;AAC1F,eAAO,MAAM,cAAc,wBAAwB,CAAC;AAEpD,MAAM,WAAW,aAAa;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAEnI;;;;;;;iGAOiG;AACjG,eAAO,MAAM,qBAAqB,QA0CtB,CAAC;AAEb;6FAC6F;AAC7F,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;4FAC4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,SAAmB,EAAE,MAAM,UAAuB,EAAE,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAAG,MAAM,GAAG,IAAI,CAIxJ;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAiBxR;AAED;kIACkI;AAClI,wBAAgB,gBAAgB,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,IAAI,CAKnL;AAED,8HAA8H;AAC9H,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,EAAE,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAiB,GAAG,OAAO,CAOvL;AAuBD,2GAA2G;AAC3G,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAQnE"}

package/dist/native-update.js

@@ -1,14 +1,16 @@
 // Updates for the signed Windows install (the single executable from the installer). npm installs keep updating with npm.
 //
 // A per-user install updates itself, but only with an installer it has checked three ways: the release manifest is signed
-// with the updater key (a separate Ed25519 key; its public half is built into this program), the installer's SHA-256 and
-// size are the manifest's, and the installer's Authenticode signature is valid and names Avouro LLC. Anything else and
-// nothing is installed: the agent says the update could not be verified. An install for every user (Program Files) never
-// updates itself; the organisation that deployed it updates it.
+// with an updater key (a separate Ed25519 key; the public halves it trusts are built into this program, each with a key id
+// and an optional last day of use, so the key can be rotated), the installer's SHA-256 and size are the manifest's, and
+// the installer's Authenticode signature is valid and names Avouro LLC. The helper that runs msiexec after this agent has
+// exited checks the digest, size and signature again from a handle that keeps the file from being changed, and only then
+// starts msiexec. Anything else and nothing is installed: the agent says the update could not be verified. An install for
+// every user (Program Files) never updates itself; the organisation that deployed it updates it.
 import { createHash, createPublicKey, verify } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
-import { mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, win32 } from "node:path";
 import { isSingleExecutable } from "@scopebond/hook";
 /** Where the signed releases are published. */
 export const RELEASE_BASE = "https://github.com/avouro-com/scopebond/releases/download";
@@ -16,8 +18,39 @@ export const RELEASE_BASE = "https://github.com/avouro-com/scopebond/releases/do
 export const MANIFEST_DOMAIN = "scopebond:agent-release/v1\n";
 /** The publisher an installer must be signed by. */
 export const PUBLISHER = /(^|,\s*)O=Avouro LLC(,|$)/;
-export function updaterPublicKey() {
-    return typeof __SCOPEBOND_UPDATER_KEY__ === "string" && __SCOPEBOND_UPDATER_KEY__ ? __SCOPEBOND_UPDATER_KEY__ : null;
+/** A public key's id: the first 16 hex digits of the SHA-256 of its SPKI bytes. */
+export function keyId(publicKeyB64) {
+    return createHash("sha256").update(Buffer.from(publicKeyB64, "base64")).digest("hex").slice(0, 16);
+}
+/** The updater keys this build trusts (empty when it has none). */
+export function updaterKeys() {
+    if (typeof __SCOPEBOND_UPDATER_KEYS__ !== "string" || !__SCOPEBOND_UPDATER_KEYS__)
+        return [];
+    try {
+        return normalizeKeys(JSON.parse(__SCOPEBOND_UPDATER_KEYS__));
+    }
+    catch {
+        return [];
+    }
+}
+function normalizeKeys(value) {
+    if (typeof value === "string")
+        return value ? [{ kid: keyId(value), key: value, not_after: null }] : [];
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((k) => {
+        const e = k;
+        if (!e || typeof e.key !== "string" || !e.key)
+            return [];
+        return [{ kid: typeof e.kid === "string" && e.kid ? e.kid : keyId(e.key), key: e.key, not_after: typeof e.not_after === "string" ? e.not_after : null }];
+    });
+}
+/** Whether a key may still sign at `now`: no end, or `now` is on or before its last day. An unreadable date counts as past. */
+function inDate(key, now) {
+    if (key.not_after === null)
+        return true;
+    const end = /^\d{4}-\d{2}-\d{2}$/.test(key.not_after) ? Date.parse(`${key.not_after}T23:59:59.999Z`) : Date.parse(key.not_after);
+    return Number.isFinite(end) && now <= end;
 }
 /** How this agent was installed: from npm, by the installer for this user, or for every user (Program Files). */
 export function installKind(execPath = process.execPath, single = isSingleExecutable(), programFiles = process.env.ProgramFiles ?? "C:\\Program Files") {
@@ -29,26 +62,58 @@ export function installKind(execPath = process.execPath, single = isSingleExecut
         folder = folder.slice(0, -1);
     return execPath.toLowerCase().startsWith(`${folder}\\`) ? "per-machine" : "per-user";
 }
-/** The manifest when its signature is the updater key's over exactly these bytes, else null. */
-export function verifyManifest(text, signatureB64, publicKeyB64) {
+/** The manifest when its signature is one trusted, in-date updater key's over exactly these bytes, else null. A manifest
+ *  that names its key id (`kid`) is checked with that key only. */
+export function verifyManifest(text, signatureB64, keys, now = Date.now()) {
     try {
-        const key = createPublicKey({ key: Buffer.from(publicKeyB64, "base64"), format: "der", type: "spki" });
-        if (!verify(null, Buffer.from(MANIFEST_DOMAIN + text, "utf8"), key, Buffer.from(signatureB64.trim(), "base64")))
+        const ring = normalizeKeys(keys).filter((k) => inDate(k, now));
+        if (!ring.length)
+            return null;
+        const parsed = JSON.parse(text);
+        const named = typeof parsed?.kid === "string" ? parsed.kid : null;
+        const candidates = named === null ? ring : ring.filter((k) => k.kid === named);
+        const message = Buffer.from(MANIFEST_DOMAIN + text, "utf8");
+        const signature = Buffer.from(signatureB64.trim(), "base64");
+        const signed = candidates.some((k) => {
+            try {
+                return verify(null, message, createPublicKey({ key: Buffer.from(k.key, "base64"), format: "der", type: "spki" }), signature);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!signed)
             return null;
-        const manifest = JSON.parse(text);
-        if (manifest.type !== "scopebond:agent-release" || typeof manifest.version !== "string" || !Array.isArray(manifest.files))
+        if (parsed.type !== "scopebond:agent-release" || typeof parsed.version !== "string" || !Array.isArray(parsed.files))
             return null;
-        return manifest;
+        return parsed;
     }
     catch {
         return null;
     }
 }
 export const installerName = (version) => `scopebond-agent-${version}-x64.msi`;
+/** The environment for Windows PowerShell (powershell.exe, 5.1): this one's, without `PSModulePath`, plus `extra`. An
+ *  agent started from PowerShell 7 inherits its module path, and Windows PowerShell then cannot load its own security
+ *  module (Get-AuthenticodeSignature), so every check would fail; without the variable it uses its own default. */
+export function powershellEnv(extra, base = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(base))
+        if (key.toLowerCase() !== "psmodulepath")
+            env[key] = value;
+    return { ...env, ...extra };
+}
+/** A Windows tool by its full path under the system folder, never by a name looked up on PATH. */
+export function windowsTool(name) {
+    const root = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+    if (name === "powershell")
+        return win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    return win32.join(root, "System32", `${name}.exe`);
+}
 /** The Authenticode check: Windows' own verdict on the file, and the signer's subject. */
 export function authenticode(file) {
     const script = `$s = Get-AuthenticodeSignature -LiteralPath $env:SB_FILE; [Console]::Out.Write((@{ status = "$($s.Status)"; subject = "$($s.SignerCertificate.Subject)" } | ConvertTo-Json -Compress))`;
-    const run = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", env: { ...process.env, SB_FILE: file }, windowsHide: true, timeout: 60_000 });
+    const run = spawnSync(windowsTool("powershell"), ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", env: powershellEnv({ SB_FILE: file }), windowsHide: true, timeout: 60_000 });
     try {
         const r = JSON.parse(run.stdout);
         return { valid: r.status === "Valid", subject: r.subject };
@@ -59,8 +124,8 @@ export function authenticode(file) {
 }
 /** Download the installer for `version` and check it three ways. Nothing is kept unless every check passes. */
 export async function fetchVerifiedInstaller(version, o) {
-    const publicKey = o.publicKey === undefined ? updaterPublicKey() : o.publicKey;
-    if (!publicKey)
+    const keys = o.publicKey === undefined ? updaterKeys() : o.publicKey === null ? [] : normalizeKeys(o.publicKey);
+    if (!keys.length)
         return { ok: false, reason: "this build has no updater key" };
     if (!/^\d+\.\d+\.\d+$/.test(version))
         return { ok: false, reason: "not a version" };
@@ -78,7 +143,7 @@ export async function fetchVerifiedInstaller(version, o) {
     const [text, signature] = await Promise.all([get(`scopebond-agent-${version}.manifest.json`), get(`scopebond-agent-${version}.manifest.json.sig`)]);
     if (!text || !signature)
         return { ok: false, reason: "the release has no signed manifest" };
-    const manifest = verifyManifest(text.toString("utf8"), signature.toString("utf8"), publicKey);
+    const manifest = verifyManifest(text.toString("utf8"), signature.toString("utf8"), keys, o.now);
     if (!manifest)
         return { ok: false, reason: "the release manifest is not signed by the updater key" };
     if (manifest.version !== version)
@@ -100,21 +165,153 @@ export async function fetchVerifiedInstaller(version, o) {
         return { ok: false, reason: "the installer's signature is not valid" };
     if (!PUBLISHER.test(signed.subject))
         return { ok: false, reason: `the installer is signed by ${signed.subject || "someone else"}, not Avouro LLC` };
-    return { ok: true, path, version };
-}
-/** Install it once this agent has exited, then start the agent again through autostart's launcher. A detached helper does it,
- *  because the installer replaces this very file. */
-export function installAfterExit(installer, pid, launcher) {
-    const script = [
-        "$ErrorActionPreference = 'SilentlyContinue'",
-        "Wait-Process -Id ([int]$env:SB_PID) -Timeout 60",
-        "Start-Process -FilePath msiexec.exe -ArgumentList @('/i', ('\"' + $env:SB_MSI + '\"'), '/qn', '/norestart') -Wait",
-        "if ($env:SB_LAUNCHER) { Start-Process -FilePath cmd.exe -ArgumentList @('/d', '/s', '/c', ('\"\"' + $env:SB_LAUNCHER + '\"\"')) -WindowStyle Hidden }",
-    ].join("; ");
-    const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", script], {
-        detached: true, stdio: "ignore", windowsHide: true, env: { ...process.env, SB_PID: String(pid), SB_MSI: installer, SB_LAUNCHER: launcher ?? "" },
-    });
+    return { ok: true, path, version, sha256: entry.sha256, size: entry.size };
+}
+/** What the helper that installs after this agent exits records, beside the installer. */
+export const INSTALL_RESULT = "install-result.json";
+/** The helper's script. It is constant text: every value (the installer, its digest and size, the publisher rule, where to
+ *  record the outcome) reaches it through environment variables, never through the script itself.
+ *
+ *  Between the download and the install the agent exits and up to a minute passes, so the helper checks the installer again
+ *  right before it runs msiexec, the same way the agent did: its size and SHA-256 are the signed manifest's, its Authenticode
+ *  signature is valid and its signer matches the same anchored publisher rule (PUBLISHER). It holds the file open, denying
+ *  writes and deletes, from that check until msiexec has finished, so the file checked is the file installed. Any mismatch
+ *  installs nothing and records why in INSTALL_RESULT; the agent is started again either way. */
+export const INSTALL_HELPER_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    "function Write-Result([bool] $installed, $reason, $code) {",
+    "  try {",
+    "    $json = [ordered]@{ at = [DateTime]::UtcNow.ToString('o'); version = $env:SB_VERSION; installed = $installed; reason = $reason; exit_code = $code } | ConvertTo-Json -Compress",
+    "    [IO.File]::WriteAllText($env:SB_RESULT, $json, (New-Object Text.UTF8Encoding $false))",
+    "  } catch { }",
+    "}",
+    // The native tray first: it would start the old agent again, and the installer replaces its file. Only this install's.
+    "if ($env:SB_TRAY) { try { Get-Process -Name scopebond-tray -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $env:SB_TRAY } | Stop-Process -Force -ErrorAction SilentlyContinue } catch { } }",
+    "try { Wait-Process -Id ([int]$env:SB_PID) -Timeout 60 -ErrorAction SilentlyContinue } catch { }",
+    "$lock = $null",
+    "$reason = $null",
+    "try {",
+    "  $lock = New-Object IO.FileStream($env:SB_MSI, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::Read)",
+    "  if ($lock.Length -ne [long]$env:SB_SIZE) { $reason = \"the installer is $($lock.Length) bytes, not the manifest's $($env:SB_SIZE)\" }",
+    "  else {",
+    "    $sha = [Security.Cryptography.SHA256]::Create()",
+    "    $digest = ([BitConverter]::ToString($sha.ComputeHash($lock)) -replace '-', '').ToLowerInvariant()",
+    "    if ($digest -cne $env:SB_SHA256.ToLowerInvariant()) { $reason = 'the installer changed after it was checked: its SHA-256 is not the manifest''s' }",
+    "    else {",
+    "      $sig = Get-AuthenticodeSignature -LiteralPath $env:SB_MSI",
+    "      $subject = \"$($sig.SignerCertificate.Subject)\"",
+    "      if (\"$($sig.Status)\" -ne 'Valid') { $reason = \"the installer's signature is not valid ($($sig.Status))\" }",
+    "      elseif (-not ($subject -cmatch $env:SB_PUBLISHER)) { $reason = \"the installer is signed by $subject, not the expected publisher\" }",
+    "    }",
+    "  }",
+    "} catch { $reason = \"the installer could not be checked: $($_.Exception.Message)\" }",
+    "try {",
+    "  if ($reason) { Write-Result $false $reason $null }",
+    "  else {",
+    "    try {",
+    // Windows' own msiexec by its full path (SB_MSIEXEC only replaces it in tests).
+    "      $msiexec = if ($env:SB_MSIEXEC) { $env:SB_MSIEXEC } else { Join-Path $env:SystemRoot 'System32\\msiexec.exe' }",
+    "      $p = Start-Process -FilePath $msiexec -ArgumentList @('/i', ('\"' + $env:SB_MSI + '\"'), '/qn', '/norestart') -Wait -PassThru",
+    "      $code = [int]$p.ExitCode",
+    "      if ($code -eq 0 -or $code -eq 3010) { Write-Result $true $null $code } else { Write-Result $false \"msiexec ended with exit code $code\" $code }",
+    "    } catch { Write-Result $false \"msiexec could not start: $($_.Exception.Message)\" $null }",
+    "  }",
+    "} finally { if ($lock) { $lock.Dispose() } }",
+    // Installed or not, the tray starts again (it starts the agent), or else the agent through autostart's launcher.
+    "if ($env:SB_TRAY) { Start-Process -FilePath $env:SB_TRAY } elseif ($env:SB_LAUNCHER) { Start-Process -FilePath (Join-Path $env:SystemRoot 'System32\\cmd.exe') -ArgumentList @('/d', '/s', '/c', ('\"\"' + $env:SB_LAUNCHER + '\"\"')) -WindowStyle Hidden }",
+].join("\n");
+/** The helper's script (INSTALL_HELPER_SCRIPT): stop the native tray, wait for this agent to exit, check the installer
+ *  again, install, then start the tray again (or the agent through autostart's launcher). */
+export function installAfterExitScript() {
+    return INSTALL_HELPER_SCRIPT;
+}
+/** The native Scopebond tray the installer puts beside the single executable (`scopebond-tray.exe`), when it is there. It
+ *  starts the agent at sign-in and keeps it running, so the agent leaves the tray to it. */
+export function nativeTrayPath(execPath = process.execPath, single = isSingleExecutable(), exists = existsSync) {
+    if (!single)
+        return null;
+    const tray = win32.join(win32.dirname(execPath), "scopebond-tray.exe");
+    return exists(tray) ? tray : null;
+}
+/** The helper's program, arguments and environment values (pure, so it can be tested). */
+export function installHelper(installer, pid, launcher, o = {}) {
+    return {
+        program: windowsTool("powershell"),
+        args: ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", INSTALL_HELPER_SCRIPT],
+        env: {
+            SB_PID: String(pid),
+            SB_MSI: installer.path,
+            SB_VERSION: installer.version,
+            SB_SHA256: installer.sha256,
+            SB_SIZE: String(installer.size),
+            SB_PUBLISHER: (o.publisher ?? PUBLISHER).source,
+            SB_RESULT: join(dirname(installer.path), INSTALL_RESULT),
+            SB_MSIEXEC: o.msiexec ?? windowsTool("msiexec"),
+            SB_LAUNCHER: launcher ?? "",
+            SB_TRAY: o.tray ?? "",
+        },
+    };
+}
+/** Install it once this agent has exited, then start the tray again (or the agent through autostart's launcher). A detached
+ *  helper does it, because the installer replaces this very file; it checks the installer again first (INSTALL_HELPER_SCRIPT). */
+export function installAfterExit(installer, pid, launcher, tray = null) {
+    const helper = installHelper(installer, pid, launcher, { tray });
+    const child = spawn(helper.program, helper.args, { detached: true, stdio: "ignore", windowsHide: true, env: powershellEnv(helper.env) });
     child.on("error", () => { });
     child.unref();
 }
+/** Whether the installer on disk is still the verified one: same size and SHA-256, and still validly signed by Avouro LLC. */
+export function installerUnchanged(installer, check = authenticode) {
+    try {
+        const bytes = readFileSync(installer.path);
+        if (bytes.length !== installer.size || createHash("sha256").update(bytes).digest("hex") !== installer.sha256)
+            return false;
+        const signed = check(installer.path);
+        return signed.valid && PUBLISHER.test(signed.subject);
+    }
+    catch {
+        return false;
+    }
+}
+/** PowerShell that opens $env:SB_MSI so nobody can change it while the handle is open, checks its size ($env:SB_SIZE),
+ *  SHA-256 ($env:SB_SHA256) and Authenticode signature (valid, Avouro LLC), and runs `whenGood` only if all hold. */
+function recheck(whenGood) {
+    return [
+        "$ok = $false",
+        "$f = $null",
+        "try {",
+        "  $f = [System.IO.File]::Open($env:SB_MSI, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read)",
+        "  if ($f.Length -eq [int64]$env:SB_SIZE) {",
+        "    $sha = [System.Security.Cryptography.SHA256]::Create()",
+        "    $h = -join ($sha.ComputeHash($f) | ForEach-Object { $_.ToString('x2') })",
+        "    if ($h -eq $env:SB_SHA256) {",
+        "      $s = Get-AuthenticodeSignature -LiteralPath $env:SB_MSI",
+        "      $ok = (\"$($s.Status)\" -eq 'Valid') -and (\"$($s.SignerCertificate.Subject)\" -match '(^|,\\s*)O=Avouro LLC(,|$)')",
+        "    }",
+        "  }",
+        ...whenGood.map((line) => `  if ($ok) { ${line} }`),
+        "} catch { $ok = $false } finally { if ($f) { $f.Dispose() } }",
+    ];
+}
+/** The helper's check alone: exit 0 when $env:SB_MSI is still the verified installer, 3 when it is not. */
+export function installerRecheckScript() {
+    return [...recheck([]), "if ($ok) { exit 0 } else { exit 3 }"].join("\n");
+}
+/** The helper script that installs after this agent exits (INSTALL_HELPER_SCRIPT). */
+export function installHelperScript() {
+    return INSTALL_HELPER_SCRIPT;
+}
+/** What the last install helper recorded, once: the file is removed when read. Null when there is nothing. */
+export function takeInstallResult(dir) {
+    const file = join(dir, "updates", INSTALL_RESULT);
+    try {
+        const raw = readFileSync(file, "utf8").replace(/^\uFEFF/, "");
+        rmSync(file, { force: true });
+        const r = JSON.parse(raw);
+        return { at: String(r.at ?? ""), version: String(r.version ?? ""), installed: r.installed === true, reason: typeof r.reason === "string" ? r.reason : null, exit_code: typeof r.exit_code === "number" ? r.exit_code : null };
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=native-update.js.map