@seeed-studio/solution-cli 0.0.0-stage → 0.2.0

package/lib/downloader.js

@@ -0,0 +1,219 @@
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { getPlatformInfo, getEngineBinDir, getEngineBinaryPath, getScHome } from './platform.js';
+import { verifyEngineBinary } from './detector.js';
+
+const LATEST_MANIFEST_URL = 'https://sensecraft-statics.seeed.cc/solution-app/engine/latest.json';
+const MAX_ARCHIVE_BYTES = 50 * 1024 * 1024; // 50MB limit
+const NETWORK_TIMEOUT_MS = 60000; // 60s timeout
+
+export const PINNED_MINISIGN_PUBKEY = 'RWTg282IuJHsoMOFZC0DP1q0LrS384gJsCLrXyX3CIzIKLPUHm3GGmBv';
+
+export function verifyManifestSignature(manifestBytes, sigText, pubKeyB64 = PINNED_MINISIGN_PUBKEY) {
+  try {
+    const pubRaw = Buffer.from(pubKeyB64, 'base64').subarray(10);
+    const spkiPrefix = Buffer.from('302a300506032b6570032100', 'hex');
+    const spkiKey = Buffer.concat([spkiPrefix, pubRaw]);
+    const publicKey = crypto.createPublicKey({ key: spkiKey, format: 'der', type: 'spki' });
+
+    const sigLines = sigText.trim().split('\n');
+    if (sigLines.length < 2) return false;
+    const sigRaw = Buffer.from(sigLines[1], 'base64').subarray(10);
+
+    const prehash = crypto.createHash('blake2b512').update(manifestBytes).digest();
+    return crypto.verify(null, prehash, publicKey, sigRaw);
+  } catch {
+    return false;
+  }
+}
+
+export async function fetchManifest() {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 15000);
+  try {
+    const res = await fetch(LATEST_MANIFEST_URL, { signal: controller.signal });
+    if (!res.ok) {
+      throw new Error(`Failed to fetch engine manifest from ${LATEST_MANIFEST_URL}: HTTP ${res.status}`);
+    }
+    const manifestBytes = Buffer.from(await res.arrayBuffer());
+
+    // Fetch and verify detached signature (Codex P1)
+    const sigRes = await fetch(`${LATEST_MANIFEST_URL}.minisig`, { signal: controller.signal });
+    if (!sigRes.ok) {
+      throw new Error(`Failed to fetch manifest signature from ${LATEST_MANIFEST_URL}.minisig: HTTP ${sigRes.status}`);
+    }
+    const sigText = await sigRes.text();
+    const isSigValid = verifyManifestSignature(manifestBytes, sigText);
+    if (!isSigValid) {
+      throw new Error('Engine manifest signature verification failed against trusted Seeed public key');
+    }
+
+    return JSON.parse(manifestBytes.toString('utf8'));
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export async function downloadEngine(options = {}) {
+  const { onProgress = () => {} } = options;
+  const platform = getPlatformInfo();
+
+  if (!platform.supported || !platform.target) {
+    throw new Error(`Cannot download engine: ${platform.note}`);
+  }
+
+  onProgress('Fetching latest release manifest...');
+  const manifest = await fetchManifest();
+  const asset = manifest.assets ? manifest.assets[platform.target] : null;
+
+  if (!asset || !asset.url || !asset.sha256) {
+    throw new Error(`No compatible release asset found for target "${platform.target}" in version ${manifest.version}`);
+  }
+
+  if (asset.size && asset.size > MAX_ARCHIVE_BYTES) {
+    throw new Error(`Declared asset size (${asset.size} bytes) exceeds safety maximum (${MAX_ARCHIVE_BYTES} bytes)`);
+  }
+
+  onProgress(`Downloading sensecraft-engine v${manifest.version}...`);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), NETWORK_TIMEOUT_MS);
+
+  let buffer;
+  try {
+    const response = await fetch(asset.url, { signal: controller.signal });
+    if (!response.ok) {
+      throw new Error(`Failed to download binary from ${asset.url}: HTTP ${response.status}`);
+    }
+
+    // Stream download and enforce byte limit strictly during streaming (Codex Medium 3)
+    if (!response.body) {
+      throw new Error('Response body is empty or not streamable');
+    }
+
+    const reader = response.body.getReader();
+    const chunks = [];
+    let receivedBytes = 0;
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      receivedBytes += value.length;
+      if (receivedBytes > MAX_ARCHIVE_BYTES) {
+        controller.abort();
+        throw new Error(`Streamed download exceeded maximum allowed size of ${MAX_ARCHIVE_BYTES} bytes (aborted at ${receivedBytes} bytes)`);
+      }
+      chunks.push(value);
+    }
+
+    buffer = Buffer.concat(chunks);
+  } finally {
+    clearTimeout(timeout);
+  }
+
+  onProgress('Verifying cryptographic SHA256 integrity...');
+  const computedHash = crypto.createHash('sha256').update(buffer).digest('hex').toLowerCase();
+  const expectedHash = asset.sha256.toLowerCase();
+
+  if (computedHash !== expectedHash) {
+    throw new Error(`Integrity check failed! Expected SHA256: ${expectedHash}, computed: ${computedHash}`);
+  }
+
+  // Staging extraction to ensure atomicity & verification before replacing
+  const scHome = getScHome();
+  const nonce = crypto.randomBytes(6).toString('hex');
+  const stageDir = path.join(scHome, `.stage-${nonce}`);
+  const binDir = getEngineBinDir();
+  fs.mkdirSync(stageDir, { recursive: true });
+  fs.mkdirSync(binDir, { recursive: true });
+
+  const tempArchive = path.join(stageDir, `engine-archive.${platform.isWindows ? 'zip' : 'tar.gz'}`);
+  fs.writeFileSync(tempArchive, buffer);
+
+  try {
+    onProgress('Extracting engine binary into staging area...');
+    if (platform.isWindows) {
+      execFileSync('powershell', ['-NoProfile', '-Command', '$ProgressPreference="SilentlyContinue"; Expand-Archive -LiteralPath $env:STAGE_ARCHIVE -DestinationPath $env:STAGE_DEST -Force'], {
+        env: {
+          ...process.env,
+          STAGE_ARCHIVE: tempArchive,
+          STAGE_DEST: stageDir
+        },
+        stdio: 'ignore',
+        timeout: 30000
+      });
+    } else {
+      execFileSync('tar', ['-xzf', tempArchive, '-C', stageDir], {
+        stdio: 'ignore',
+        timeout: 30000
+      });
+    }
+
+    const stagedBin = path.join(stageDir, platform.binaryName);
+    if (!fs.existsSync(stagedBin)) {
+      throw new Error(`Archive extraction succeeded but "${platform.binaryName}" was not found in archive.`);
+    }
+
+    if (!platform.isWindows) {
+      fs.chmodSync(stagedBin, 0o755);
+    }
+
+    onProgress('Verifying extracted binary functionality...');
+    const verifyResult = verifyEngineBinary(stagedBin);
+    if (!verifyResult.valid) {
+      throw new Error(`Downloaded engine verification failed: ${verifyResult.reason}`);
+    }
+
+    const finalBin = getEngineBinaryPath();
+    const backupBin = path.join(binDir, `.backup-${platform.binaryName}-${nonce}`);
+
+    if (fs.existsSync(finalBin)) {
+      try { fs.renameSync(finalBin, backupBin); } catch {}
+    }
+
+    try {
+      if (platform.isWindows) {
+        fs.copyFileSync(stagedBin, finalBin);
+      } else {
+        fs.renameSync(stagedBin, finalBin);
+      }
+      if (fs.existsSync(backupBin)) {
+        try { fs.unlinkSync(backupBin); } catch {}
+      }
+    } catch (swapErr) {
+      if (fs.existsSync(backupBin)) {
+        try { fs.renameSync(backupBin, finalBin); } catch {}
+      }
+      throw swapErr;
+    }
+
+    onProgress(`Engine installed successfully to ${finalBin}`);
+    return {
+      version: verifyResult.version,
+      path: finalBin
+    };
+  } finally {
+    if (fs.existsSync(stageDir)) {
+      try { fs.rmSync(stageDir, { recursive: true, force: true }); } catch {}
+    }
+  }
+}
+
+export function pullSolutionContent(binPath, onProgress = () => {}) {
+  onProgress('Pulling official solution definitions from CDN (sensecraft-engine content pull)...');
+  try {
+    execFileSync(binPath, ['content', 'pull'], {
+      encoding: 'utf8',
+      timeout: 120000,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    onProgress('Solution content successfully pulled and verified.');
+    return { success: true };
+  } catch (err) {
+    const msg = err.stderr ? err.stderr.toString().trim() : err.message;
+    onProgress(`Notice: content pull completed with warning: ${msg}`);
+    return { success: false, warning: msg };
+  }
+}

package/lib/installer.js

@@ -0,0 +1,375 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import {
+  getPlatformInfo,
+  getEngineBinaryPath,
+  getContentDir,
+  setConfiguredEnginePath,
+  getConfiguredEnginePath
+} from './platform.js';
+import { detectExistingEngine, detectDesktopApp, verifyEngineBinary } from './detector.js';
+import { downloadEngine, pullSolutionContent } from './downloader.js';
+import { scanLocalAgents, promptAgentSelection } from './agent.js';
+import {
+  recordInstallation,
+  removeInstallation,
+  loadLedger,
+  computeFileHash,
+  withLedgerLock,
+  isSafePathInside
+} from './ledger.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const BUNDLED_SKILLS_SRC = path.resolve(__dirname, '..', 'skills', 'sensecraft');
+
+export async function runInstall(options = {}) {
+  const {
+    agent = null,
+    yes = false,
+    dryRun = false,
+    skipContent = false,
+    force = false,
+    enginePath = null,
+    logger = console.log
+  } = options;
+
+  logger('\x1b[1m\x1b[34m====================================================\x1b[0m');
+  logger('\x1b[1m\x1b[34m  SenseCraft Engine & AI Agent Skill Installer     \x1b[0m');
+  logger('\x1b[1m\x1b[34m====================================================\x1b[0m\n');
+
+  const platform = getPlatformInfo();
+  if (!platform.supported) {
+    throw new Error(`Unsupported host: ${platform.note}`);
+  }
+
+  // --- Step 0: Pre-validate agent targets before ANY download/side-effects (Codex Medium 11) ---
+  const scanned = scanLocalAgents();
+  const selectedAgents = await promptAgentSelection(scanned, agent, yes);
+
+  if (selectedAgents.length === 0) {
+    logger('\nNo agents selected. Installation halted with no filesystem modifications.');
+    return { success: true, engineBin: null, installedAgents: [] };
+  }
+
+  // --- Step 1: Detect & Verify Engine Candidate ---
+  logger('🔍 Phase 1: Inspecting host environment for existing Engine/App...');
+  let engineBin = null;
+  let engineVersion = null;
+  let reusedSource = null;
+
+  if (enginePath) {
+    const resolvedPath = path.resolve(enginePath);
+    logger(`Checking user-specified engine at: ${resolvedPath}`);
+    const check = verifyEngineBinary(resolvedPath);
+    if (!check.valid) {
+      throw new Error(`Specified engine at ${resolvedPath} is not valid: ${check.reason}`);
+    }
+    engineBin = resolvedPath;
+    engineVersion = check.version;
+    reusedSource = 'custom';
+  } else if (!force) {
+    // 1.1 Check default / PATH engine
+    const existing = detectExistingEngine();
+    if (existing) {
+      logger(`✔ Found existing compatible Engine v${existing.version} (${existing.path})`);
+      engineBin = path.resolve(existing.path);
+      engineVersion = existing.version;
+      reusedSource = existing.source;
+    } else {
+      // 1.2 Check Desktop App
+      const app = detectDesktopApp();
+      if (app.detected && app.compatible) {
+        logger(`✔ Found compatible SenseCraft Desktop App at: ${app.appPath || app.binPath}`);
+        logger(`  Engine binary inside App: ${app.binPath} (v${app.version})`);
+
+        const targetBin = path.resolve(getEngineBinaryPath());
+        if (!dryRun) {
+          fs.mkdirSync(path.dirname(targetBin), { recursive: true });
+          if (platform.isWindows) {
+            fs.copyFileSync(app.binPath, targetBin);
+          } else {
+            if (fs.existsSync(targetBin)) fs.unlinkSync(targetBin);
+            fs.symlinkSync(app.binPath, targetBin);
+          }
+          engineBin = targetBin;
+        } else {
+          engineBin = app.binPath;
+        }
+        engineVersion = app.version;
+        reusedSource = 'desktop_app';
+      } else if (app.detected && !app.compatible) {
+        logger(`ℹ Detected existing App but its engine is outdated/incompatible: ${app.reason}. Falling back to fresh engine download.`);
+      }
+    }
+  }
+
+  // 1.3 If no compatible local candidate, download standalone binary
+  if (!engineBin) {
+    if (dryRun) {
+      logger('ℹ [dry-run] Would download standalone engine from CDN...');
+      engineBin = path.resolve(getEngineBinaryPath());
+      engineVersion = '0.0.3';
+      reusedSource = 'download';
+    } else {
+      logger('⬇ Downloading latest standalone engine binary from CDN...');
+      const dl = await downloadEngine({
+        onProgress: msg => logger(`  ${msg}`)
+      });
+      engineBin = path.resolve(dl.path);
+      engineVersion = dl.version;
+      reusedSource = 'download';
+    }
+  }
+
+  // Persist configured engine pointer
+  if (!dryRun) {
+    setConfiguredEnginePath(engineBin, engineVersion, reusedSource);
+  }
+
+  logger(`\n📦 Engine ready: ${engineBin} (v${engineVersion}) [Source: ${reusedSource}]`);
+
+  // --- Step 2: Content Cache ---
+  if (!skipContent && !dryRun) {
+    logger('\n🔄 Phase 2: Ensuring IoT solutions catalog is populated...');
+    pullSolutionContent(engineBin, msg => logger(`  ${msg}`));
+  } else if (skipContent) {
+    logger('\n🔄 Phase 2: Skipped solution pull (--skip-content).');
+  }
+
+  // --- Step 3: Inject Skills with Modification Protection inside Lock (Codex High 1, 2 & Medium 6) ---
+  logger(`\n🤖 Phase 3: AI Agent Skills Configuration (Targets: ${selectedAgents.map(a => a.name).join(', ')})...`);
+
+  const installedAgents = [];
+
+  const runWithLock = dryRun ? fn => fn() : withLedgerLock;
+
+  runWithLock(() => {
+    const ledger = dryRun ? { installations: {} } : loadLedger();
+
+    for (const a of selectedAgents) {
+      const destDir = path.resolve(path.join(a.skillsDir, 'sensecraft'));
+      logger(`\nConfiguring ${a.name} at: ${destDir}...`);
+
+      if (dryRun) {
+        logger(`  [dry-run] Would write SKILL.md and references to ${destDir}`);
+        installedAgents.push({ id: a.id, name: a.name, path: destDir });
+        continue;
+      }
+
+      fs.mkdirSync(destDir, { recursive: true });
+
+      const priorRecord = ledger.installations ? ledger.installations[a.id] : null;
+      const priorFiles = priorRecord ? priorRecord.files : {};
+
+      const filesWritten = {};
+      const copyResult = copyFolderSafely(BUNDLED_SKILLS_SRC, destDir, destDir, priorFiles, force, logger);
+
+      Object.assign(filesWritten, copyResult.filesWritten);
+
+      // Customize SKILL.md only if actually copied by this install and not an external symlink (Codex P1)
+      const skillMdPath = path.join(destDir, 'SKILL.md');
+      if (fs.existsSync(skillMdPath) && copyResult.updatedFiles.includes('SKILL.md')) {
+        const skillStat = fs.lstatSync(skillMdPath, { throwIfNoEntry: false });
+        if (skillStat && !skillStat.isSymbolicLink()) {
+          let content = fs.readFileSync(skillMdPath, 'utf8');
+          const escapedBinPath = engineBin.replace(/\\/g, '/');
+          const instructionBlock = `\n> **SenseCraft Runtime**: All steps run via \`${escapedBinPath}\`. If shell $PATH does not contain \`sensecraft-engine\`, always invoke using the full absolute path: \`"${escapedBinPath}" <subcommand>\`.\n\n`;
+
+          if (!content.includes('SenseCraft Runtime:')) {
+            content = content.replace(/(---[\s\S]*?---\n)/, `$1${instructionBlock}`);
+            fs.writeFileSync(skillMdPath, content, 'utf8');
+          }
+          filesWritten['SKILL.md'] = computeFileHash(skillMdPath);
+        }
+      }
+
+      // Write installation marker safely without following external symlinks (Codex P2)
+      const markerPath = path.join(destDir, '.installed-by-sensecraft');
+      if (isSafePathInside(markerPath, destDir)) {
+        const markerStat = fs.lstatSync(markerPath, { throwIfNoEntry: false });
+        if (markerStat && markerStat.isSymbolicLink()) {
+          try { fs.unlinkSync(markerPath); } catch {}
+        }
+        fs.writeFileSync(
+          markerPath,
+          `version=${engineVersion}\ninstalled_at=${new Date().toISOString()}\nengine_bin=${engineBin}\n`,
+          'utf8'
+        );
+      }
+
+      // Record into ledger
+      recordInstallation(a.id, a.skillsDir, destDir, engineVersion, filesWritten);
+      logger(`  ✔ Skill successfully installed to: ${destDir}`);
+      installedAgents.push({ id: a.id, name: a.name, path: destDir });
+    }
+  });
+
+  logger('\n\x1b[1m\x1b[32m====================================================\x1b[0m');
+  logger('\x1b[1m\x1b[32m  🎉 SenseCraft Setup Completed Successfully!      \x1b[0m');
+  logger('\x1b[1m\x1b[32m====================================================\x1b[0m');
+  logger(`\n🔧 Engine Binary: ${engineBin}`);
+  logger(`🤖 Configured Agents:`);
+  installedAgents.forEach(a => logger(`   - ${a.name}: ${a.path}`));
+  logger('\n👉 You can now open Work Buddy or your chosen Agent and ask:');
+  logger('   "帮我把边缘安全方案 (edge_security) 部署到 Jetson (192.168.1.100)"');
+  logger('   "查看当前有哪些可部署的物联网方案"');
+  logger('----------------------------------------------------\n');
+
+  return {
+    success: true,
+    engineBin,
+    engineVersion,
+    installedAgents
+  };
+}
+
+export function runStatus(options = {}) {
+  const { json = false, logger = console.log } = options;
+  const binPath = getConfiguredEnginePath();
+  const engineCheck = verifyEngineBinary(binPath);
+  const ledger = loadLedger();
+  const scannedAgents = scanLocalAgents();
+
+  const statusObj = {
+    engine: {
+      path: binPath,
+      exists: fs.existsSync(binPath),
+      version: engineCheck.version || null,
+      valid: engineCheck.valid,
+      deployersCount: engineCheck.deployers?.length || 0
+    },
+    content: {
+      dir: getContentDir(),
+      manifestExists: fs.existsSync(path.join(getContentDir(), 'manifest.json'))
+    },
+    ledger: ledger.installations || {},
+    agents: scannedAgents.map(a => ({
+      id: a.id,
+      name: a.name,
+      detected: a.detected,
+      installed: a.installed,
+      skillsDir: a.skillsDir
+    }))
+  };
+
+  if (json) {
+    logger(JSON.stringify(statusObj, null, 2));
+    return statusObj;
+  }
+
+  logger('\n📊 SenseCraft System Status:\n');
+  logger(`  Engine Binary: ${binPath}`);
+  logger(`  Engine Version: ${engineCheck.version || 'Not installed'} (${engineCheck.valid ? 'Valid' : 'Invalid'})`);
+  logger(`  Deployers Available: ${engineCheck.deployers?.length || 0}`);
+  logger(`  Content Directory: ${getContentDir()} (${statusObj.content.manifestExists ? 'Ready' : 'Not cached'})`);
+  logger('\n  Configured Agent Skills:');
+
+  scannedAgents.forEach(a => {
+    const isTracked = Boolean(ledger.installations && ledger.installations[a.id]);
+    const tag = a.installed ? '\x1b[32m[Installed]\x1b[0m' : '\x1b[90m[Not Installed]\x1b[0m';
+    const ledgerTag = isTracked ? ' (Managed by CLI)' : '';
+    logger(`   - ${a.name}: ${tag}${ledgerTag}`);
+  });
+  logger('');
+
+  return statusObj;
+}
+
+export function runUninstall(options = {}) {
+  const { agent = null, force = false, dryRun = false, logger = console.log } = options;
+  const ledger = loadLedger();
+  const installedIds = Object.keys(ledger.installations || {});
+
+  if (installedIds.length === 0) {
+    logger('No managed SenseCraft skills are currently recorded in the ledger.');
+    return;
+  }
+
+  let targets = installedIds;
+  if (agent && agent.toLowerCase() !== 'all') {
+    targets = agent.split(',').map(s => s.trim().toLowerCase());
+  }
+
+  for (const id of targets) {
+    if (!ledger.installations[id]) {
+      logger(`⚠️ Target "${id}" is not tracked in ledger. Skipping.`);
+      continue;
+    }
+    logger(`Uninstalling skill for agent: ${id}${dryRun ? ' [dry-run]' : ''}...`);
+    const res = removeInstallation(id, { force, dryRun });
+    if (res.success) {
+      if (dryRun) {
+        logger(`  [dry-run] Would remove ${res.actions?.length || 0} items from ${res.targetDir}`);
+      } else {
+        logger(`  ✔ Removed ${res.removedCount} files from ${res.targetDir}. (Preserved ${res.preservedCount} modified files).`);
+      }
+    } else {
+      logger(`  ⚠️ ${res.reason}`);
+    }
+  }
+}
+
+// Copy with modification safety (Codex High 1: preserve original hash baseline!)
+function copyFolderSafely(srcDir, destDir, baseDestDir, priorFiles, force, logger) {
+  const filesWritten = {};
+  const updatedFiles = [];
+  const entries = fs.readdirSync(srcDir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const srcPath = path.join(srcDir, entry.name);
+    const destPath = path.join(destDir, entry.name);
+    const relPath = path.relative(baseDestDir, destPath);
+
+    // Symlink escape protection (Codex High 2)
+    if (!isSafePathInside(destPath, baseDestDir)) {
+      logger(`  ⚠️ Refused copying to potential symlink escape target: ${destPath}`);
+      continue;
+    }
+
+    if (entry.isDirectory()) {
+      fs.mkdirSync(destPath, { recursive: true });
+      const sub = copyFolderSafely(srcPath, destPath, baseDestDir, priorFiles, force, logger);
+      Object.assign(filesWritten, sub.filesWritten);
+      updatedFiles.push(...sub.updatedFiles);
+    } else {
+      let shouldCopy = true;
+
+      if (fs.existsSync(destPath)) {
+        const destHash = computeFileHash(destPath);
+        const recordedBaselineHash = priorFiles[relPath];
+
+        if (recordedBaselineHash) {
+          // File was previously installed. Check if user modified it.
+          if (destHash !== recordedBaselineHash && !force) {
+            logger(`  ⚠️ Preserved user-modified file: ${relPath} (use --force to overwrite)`);
+            shouldCopy = false;
+            // CRUCIAL (Codex High 1): Keep the ORIGINAL baseline hash in the ledger!
+            // Do NOT record destHash, otherwise future uninstall will consider it unmodified!
+            filesWritten[relPath] = recordedBaselineHash;
+          }
+        } else {
+          // File exists on disk but was never in ledger (unmanaged foreign file)
+          if (!force) {
+            logger(`  ⚠️ Refused overwriting unmanaged pre-existing file: ${relPath} (use --force)`);
+            shouldCopy = false;
+          }
+        }
+      }
+
+      if (shouldCopy) {
+        // If destPath is a symlink, unlink it first to avoid writing through it (Codex P2)
+        const destStat = fs.lstatSync(destPath, { throwIfNoEntry: false });
+        if (destStat && destStat.isSymbolicLink()) {
+          try { fs.unlinkSync(destPath); } catch {}
+        }
+        fs.copyFileSync(srcPath, destPath);
+        filesWritten[relPath] = computeFileHash(destPath);
+        updatedFiles.push(relPath);
+      }
+    }
+  }
+
+  return { filesWritten, updatedFiles };
+}