@standardagents/code 0.14.1-issue.658.a1599e → 0.14.1-issue.663.d242d1

package/lib/artifact.mjs

@@ -84,6 +84,24 @@ export function verifyArtifactTree(root, files, metadata = ['manifest.json', 'ma
   }
 }
 
+// Check a native signed archive's listing before extraction: `names` from
+// `tar -tzf` and the entry type letters from `tar -tvzf`. The archive must be
+// exactly one of the signed layouts, with only regular files and the
+// directories those files need. Returns the matching file list.
+export function nativeArchiveLayout(names, types) {
+  const listed = names.map(name => name.replace(/^\.\//, '')).sort()
+  const layout = [ARTIFACT_FILES, BUNDLE_ARTIFACT_FILES, RUNNER_ARTIFACT_FILES, BUNDLE_RUNNER_ARTIFACT_FILES].find(files => {
+    const expected = [...artifactDirectories(files).map(path => `${path}/`), ...files, 'manifest.json', 'manifest.sig'].sort()
+    return listed.join('\n') === expected.join('\n')
+  })
+  if (!layout) throw new Error('native artifact archive has unexpected paths')
+  const expectedTypes = '-'.repeat(layout.length + 2) + 'd'.repeat(artifactDirectories(layout).length)
+  if ([...types].sort().join('') !== expectedTypes) {
+    throw new Error('native artifact archive must contain only regular files and expected directories')
+  }
+  return layout
+}
+
 // The four native targets the launcher has ever installed. The two deferred
 // ones stay so their published history verifies.
 export const NATIVE_ARTIFACT_TARGETS = Object.freeze([

package/lib/install.mjs

@@ -0,0 +1,93 @@
+import { spawnSync } from 'node:child_process'
+import { createHash, randomUUID } from 'node:crypto'
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { artifactBinaryPath, nativeArchiveLayout, verifyNativeArtifact } from './artifact.mjs'
+
+// A release's root package names each native target's signed archive in
+// `standardArtifacts`; npm only selects the platform. The archive downloads
+// from the build coordinator, which serves it from R2, and installs under this
+// package's `native/<target>/` once its size, digest, layout, and signed
+// manifest all check out. The daemon's launcher repair finds it there too.
+export const ARTIFACT_ORIGIN = 'https://builds.standardcode.ai'
+const MAX_ARCHIVE = 128 * 1024 * 1024
+const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url))
+
+export function nativeDirectory(target, root = PACKAGE_ROOT) {
+  return join(root, 'native', target)
+}
+
+export function packageMetadata(root = PACKAGE_ROOT) {
+  return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+}
+
+// The signed archive a package names for `target`, or null when its binaries
+// install as an npm platform package instead.
+export function artifactPointer(metadata, target) {
+  const artifacts = metadata.standardArtifacts
+  if (artifacts === undefined) return null
+  const pointer = artifacts?.schema === 1 ? artifacts.targets?.[target] : undefined
+  if (!pointer
+    || pointer.url !== `${ARTIFACT_ORIGIN}/artifacts/${metadata.version}/${target}.tar.gz`
+    || !/^[0-9a-f]{64}$/.test(pointer.sha256 ?? '')
+    || !Number.isSafeInteger(pointer.size) || pointer.size < 1 || pointer.size > MAX_ARCHIVE) {
+    throw new Error(`This package names no valid native archive for ${target}`)
+  }
+  return pointer
+}
+
+// The installed, verified artifact directory for `target`, or null.
+export function installedArtifact(target, root = PACKAGE_ROOT, publicKey = undefined) {
+  const directory = nativeDirectory(target, root)
+  try {
+    return { directory, manifest: verifyNativeArtifact(directory, { version: packageMetadata(root).version, target }, publicKey) }
+  } catch {
+    return null
+  }
+}
+
+function tar(run, args) {
+  const result = run('tar', args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 })
+  if (result.error) throw result.error
+  if (result.status !== 0) throw new Error(`tar ${args[0]} failed: ${result.stderr}`)
+  return result.stdout
+}
+
+export async function installNativeArtifact({ target, root = PACKAGE_ROOT, fetchImplementation = fetch, run = spawnSync, publicKey = undefined }) {
+  const installed = installedArtifact(target, root, publicKey)
+  if (installed) return installed.directory
+  const metadata = packageMetadata(root)
+  const pointer = artifactPointer(metadata, target)
+  if (!pointer) throw new Error(`This package carries no native archive for ${target}`)
+  const response = await fetchImplementation(pointer.url)
+  if (!response.ok) throw new Error(`Downloading the native archive failed with HTTP ${response.status}`)
+  const bytes = Buffer.from(await response.arrayBuffer())
+  if (bytes.length !== pointer.size || createHash('sha256').update(bytes).digest('hex') !== pointer.sha256) {
+    throw new Error('The downloaded native archive does not match its published size and digest')
+  }
+  const work = join(root, 'native', `.install-${randomUUID()}`)
+  mkdirSync(work, { recursive: true, mode: 0o700 })
+  try {
+    const archive = join(work, 'archive.tar.gz')
+    writeFileSync(archive, bytes, { mode: 0o600, flag: 'wx' })
+    nativeArchiveLayout(
+      tar(run, ['-tzf', archive]).trim().split('\n'),
+      tar(run, ['-tvzf', archive]).trim().split('\n').map(line => line[0]),
+    )
+    const extracted = join(work, 'artifact')
+    mkdirSync(extracted, { mode: 0o700 })
+    tar(run, ['-xzf', archive, '-C', extracted])
+    const manifest = verifyNativeArtifact(extracted, { version: metadata.version, target }, publicKey)
+    for (const command of ['standard', 'standardd', 'tmux']) {
+      chmodSync(join(extracted, artifactBinaryPath(manifest, command)), 0o755)
+    }
+    const destination = nativeDirectory(target, root)
+    rmSync(destination, { recursive: true, force: true })
+    renameSync(extracted, destination)
+    return destination
+  } finally {
+    rmSync(work, { recursive: true, force: true })
+  }
+}

package/lib/launcher.mjs

@@ -6,6 +6,7 @@ import process from 'node:process'
 
 import { platformPackage } from './platform.mjs'
 import { artifactBinaryPath, requireCompatibleGlibc, verifyNativeArtifact } from './artifact.mjs'
+import { artifactPointer, installNativeArtifact, installedArtifact, packageMetadata } from './install.mjs'
 
 const require = createRequire(import.meta.url)
 const COMMANDS = new Set(['standard', 'standardd'])
@@ -33,11 +34,18 @@ function resolvePackagedBinary(command, options) {
     options.report,
   )
   const resolve = options.resolve ?? require.resolve
+  const report = options.report ?? process.report
+  // A release that carries no binaries on npm installs its signed R2 archive
+  // under this package instead (see install.mjs).
+  const downloaded = installedArtifact(platform.rustTarget, options.packageRoot)
+  if (downloaded) {
+    requireCompatibleGlibc(downloaded.manifest, report?.getReport()?.header?.glibcVersionRuntime)
+    return join(downloaded.directory, artifactBinaryPath(downloaded.manifest, command))
+  }
   try {
     const root = dirname(realpathSync(resolve(`${platform.packageName}/manifest.json`)))
     const version = JSON.parse(readFileSync(new URL('../package.json', import.meta.url))).version
     const artifact = verifyNativeArtifact(root, { version, target: platform.rustTarget })
-    const report = options.report ?? process.report
     requireCompatibleGlibc(artifact, report?.getReport()?.header?.glibcVersionRuntime)
     return join(root, artifactBinaryPath(artifact, command))
   } catch (error) {
@@ -57,8 +65,27 @@ export function spawnBinary(command, args, options = {}) {
   })
 }
 
-export function main(command) {
+// Install this platform's signed R2 archive when the package names one and
+// has no binaries installed yet. Package managers that skip install scripts
+// (pnpm by default) reach this on the first launch instead of postinstall.
+export async function ensureNativeBinaries(options = {}) {
+  if (options.environment?.STANDARD_CODE_BINARY_DIR ?? process.env.STANDARD_CODE_BINARY_DIR) return
+  const platform = platformPackage(options.platform, options.architecture, options.report)
+  if (installedArtifact(platform.rustTarget, options.packageRoot)) return
+  if (!artifactPointer(packageMetadata(options.packageRoot), platform.rustTarget)) return
+  try {
+    const resolve = options.resolve ?? require.resolve
+    resolve(`${platform.packageName}/manifest.json`)
+    return
+  } catch {
+    // No npm platform package: download the archive.
+  }
+  await installNativeArtifact({ target: platform.rustTarget, root: options.packageRoot, fetchImplementation: options.fetchImplementation })
+}
+
+export async function main(command) {
   try {
+    await ensureNativeBinaries()
     const result = spawnBinary(command, process.argv.slice(2))
     if (result.error) throw result.error
     if (result.signal) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardagents/code",
-  "version": "0.14.1-issue.658.a1599e",
+  "version": "0.14.1-issue.663.d242d1",
   "description": "Platform launcher for the Standard universal terminal network.",
   "type": "module",
   "license": "UNLICENSED",
@@ -27,9 +27,20 @@
   "scripts": {
     "postinstall": "node postinstall.mjs"
   },
-  "optionalDependencies": {
-    "@standardagents/code-darwin-arm64": "npm:@standardagents/code@0.14.1-issue.658.a1599e-darwin-arm64",
-    "@standardagents/code-linux-x64-gnu": "npm:@standardagents/code@0.14.1-issue.658.a1599e-linux-x64-gnu"
+  "standardArtifacts": {
+    "schema": 1,
+    "targets": {
+      "aarch64-apple-darwin": {
+        "url": "https://builds.standardcode.ai/artifacts/0.14.1-issue.663.d242d1/aarch64-apple-darwin.tar.gz",
+        "sha256": "d58162d7f9026e37502fcc2e621027015288840f6c4973a53377fad0f61cc8bd",
+        "size": 22595079
+      },
+      "x86_64-unknown-linux-gnu": {
+        "url": "https://builds.standardcode.ai/artifacts/0.14.1-issue.663.d242d1/x86_64-unknown-linux-gnu.tar.gz",
+        "sha256": "af952fb65cb663f69e120884d85546502f4a8725e5ce85c41c72b423cb1ed13f",
+        "size": 28080928
+      }
+    }
   },
   "standardUpgrade": {
     "schema": 1,

package/postinstall.mjs

@@ -1,7 +1,14 @@
 import { chmodSync } from 'node:fs'
 
-import { resolveBinary } from './lib/launcher.mjs'
+import { ensureNativeBinaries, resolveBinary } from './lib/launcher.mjs'
 
+try {
+  await ensureNativeBinaries()
+} catch (error) {
+  // The first launch retries the download.
+  const detail = error instanceof Error ? error.message : String(error)
+  console.warn(`@standardagents/code: ${detail}`)
+}
 for (const command of ['standard', 'standardd']) {
   try {
     chmodSync(resolveBinary(command), 0o755)