@stll/oxlint-config 2.1.1 → 2.1.3

package/dist/toolchain-inputs.mjs

@@ -5,6 +5,91 @@ import { createHash } from "node:crypto";
 import { subset, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
+//#region src/cloud-setup-shell.ts
+const cloudShellProfilePath = "/etc/profile.d/stll-cloud.sh";
+const cloudShellProfileSource = `. ${cloudShellProfilePath}`;
+const quote$1 = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+/**
+* install, cp and mv place the file inside a target that resolves to a
+* directory and still succeed, so every generated file publish refuses one
+* first. `target` is the exact shell word the publish command uses.
+*/
+const refuseDirectoryTarget = (target) => `[[ ! -d ${target} ]] || fail 'Install target is a directory; remove it and rerun install:' ${target}`;
+const renderCloudShellProfile = ({ nodeVersion, bunVersion, rust }) => {
+	const node = `/opt/stll-cloud/node/${nodeVersion}/bin`;
+	const bun = `/opt/stll-cloud/bun/${bunVersion}`;
+	return `# Generated by stll-cloud-setup; managed cloud shell environment.
+# Remove managed entries before prepending, including repeated shell startup.
+_stll_cloud_remaining="\${PATH-}"
+_stll_cloud_result=''
+_stll_cloud_separator=''
+while :; do
+  case "$_stll_cloud_remaining" in
+    *:*) _stll_cloud_part="\${_stll_cloud_remaining%%:*}"; _stll_cloud_remaining="\${_stll_cloud_remaining#*:}"; _stll_cloud_more=yes ;;
+    *) _stll_cloud_part="$_stll_cloud_remaining"; _stll_cloud_more=no ;;
+  esac
+  case "$_stll_cloud_part" in
+    ${quote$1(node)}|${quote$1(bun)}|/usr/local/bin) ;;
+    *) _stll_cloud_result="$_stll_cloud_result$_stll_cloud_separator$_stll_cloud_part"; _stll_cloud_separator=: ;;
+  esac
+  [ "$_stll_cloud_more" = yes ] || break
+done
+export PATH=${quote$1(`${node}:${bun}:/usr/local/bin`)}"\${_stll_cloud_separator:+:}$_stll_cloud_result"
+unset _stll_cloud_remaining _stll_cloud_result _stll_cloud_separator _stll_cloud_part _stll_cloud_more
+${rust === void 0 ? "" : `export RUSTUP_HOME=/opt/stll-cloud/rustup\nexport CARGO_HOME=/opt/stll-cloud/cargo\nexport RUSTUP_TOOLCHAIN=${quote$1(rust.channel)}\nexport RUSTUP_AUTO_INSTALL=0\n`}`;
+};
+const userStartup = String.raw`
+set -euo pipefail
+for name in .bashrc .profile .bash_profile .bash_login; do
+  file="$HOME/$name"
+  if [[ ! -e "$file" && ! -L "$file" && "$name" != .bashrc && "$name" != .profile ]]; then continue; fi
+  [[ ! -L "$file" ]] || { echo "cloud-setup: shell startup file must not be a symlink: $name" >&2; exit 1; }
+  if [[ -e "$file" ]]; then
+    [[ -f "$file" && "$(stat -c '%h:%u' "$file")" == "1:$(id -u)" ]] || { echo "cloud-setup: shell startup file must be owned and single-link: $name" >&2; exit 1; }
+  fi
+  temporary="$(mktemp "$HOME/.stll-cloud-shell.XXXXXX")"
+  trap 'rm -f -- "$temporary"' EXIT
+  if [[ "$name" == .bashrc ]]; then
+    printf '%s\n' '# stll-cloud: early environment' '@SOURCE@' > "$temporary"
+  fi
+  if [[ -f "$file" ]]; then
+    # Remove only exact managed blocks; preserve unrelated startup lines and permissions.
+    awk '
+      $0 == "# stll-cloud: early environment" || $0 == "# stll-cloud: session environment" {
+        if ((getline following) <= 0 || following != "@SOURCE@") exit 1
+        next
+      }
+      { print }
+    ' "$file" >> "$temporary" || { echo "cloud-setup: managed shell startup block differs: $name" >&2; exit 1; }
+  fi
+  printf '%s\n' '# stll-cloud: session environment' '@SOURCE@' >> "$temporary"
+  if [[ -f "$file" ]] && cmp -s "$temporary" "$file"; then rm -- "$temporary"; continue; fi
+  if [[ -f "$file" ]]; then chmod --reference="$file" "$temporary"; else chmod 644 "$temporary"; fi
+  mv -f -- "$temporary" "$file"
+done
+`;
+const renderCloudShellInstall = (options) => {
+	const profile = renderCloudShellProfile(options);
+	return `install_shell_environment() (
+  # Subshell scope retains temporary for EXIT cleanup after a failed command.
+  [[ ! -L ${quote$1(cloudShellProfilePath)} ]] || fail 'Managed shell profile must not be a symlink'
+  if [[ -e ${quote$1(cloudShellProfilePath)} ]]; then
+    [[ -f ${quote$1(cloudShellProfilePath)} && "$(stat -c '%h:%u' ${quote$1(cloudShellProfilePath)})" == 1:0 ]] || fail 'Managed shell profile must be a root-owned single-link file'
+  fi
+  temporary="$(mktemp)"
+  trap 'rm -f -- "$temporary"' EXIT
+  cat > "$temporary" <<'STLL_CLOUD_PROFILE'
+${profile}STLL_CLOUD_PROFILE
+  if ! cmp -s "$temporary" ${quote$1(cloudShellProfilePath)}; then install -m 644 "$temporary" ${quote$1(cloudShellProfilePath)}; fi
+  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" bash -c ${quote$1(userStartup.replaceAll("@SOURCE@", cloudShellProfileSource))}
+)
+verify_shell_environment() {
+  [[ -f ${quote$1(cloudShellProfilePath)} && ! -L ${quote$1(cloudShellProfilePath)} && "$(stat -c '%h:%u' ${quote$1(cloudShellProfilePath)})" == 1:0 ]] || fail 'Managed shell environment is unavailable; run install'
+  [[ "$(sha256sum -- ${quote$1(cloudShellProfilePath)} | cut -d ' ' -f1)" == ${quote$1(createHash("sha256").update(profile).digest("hex"))} ]] || fail 'Managed shell environment differs; run install'
+}
+`;
+};
+//#endregion
 //#region src/cloud-setup-install.ts
 const packageInstall = String.raw`
 # Prevent package maintainer scripts from starting unmanaged system services.
@@ -181,6 +266,7 @@ const postgresInstall = String.raw`
       key_fingerprint="$(pgdg_key_fingerprint "$key")"
       [[ "$key_fingerprint" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'
       install -d -m 755 /usr/share/keyrings
+      ${refuseDirectoryTarget("/usr/share/keyrings/stll-pgdg.asc")}
       install -m 644 "$key" /usr/share/keyrings/stll-pgdg.asc
       rm -- "$key"
       printf '%s\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list
@@ -800,85 +886,6 @@ const renderCloudServiceStart = ({ services, postgres, valkey }) => {
 	return `${common}\nstart_services() {\n  local SERVICE_UID file attempt\n  SERVICE_UID="$(id -u stll-cloud)"\n  [[ -d "$STATE" && ! -L "$STATE" && "$(stat -c '%u' "$STATE")" == 0 ]] || fail "Invalid cloud service state directory"\n${bodies.join("")}\n}\n`;
 };
 //#endregion
-//#region src/cloud-setup-shell.ts
-const cloudShellProfilePath = "/etc/profile.d/stll-cloud.sh";
-const cloudShellProfileSource = `. ${cloudShellProfilePath}`;
-const quote$1 = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-const renderCloudShellProfile = ({ nodeVersion, bunVersion, rust }) => {
-	const node = `/opt/stll-cloud/node/${nodeVersion}/bin`;
-	const bun = `/opt/stll-cloud/bun/${bunVersion}`;
-	return `# Generated by stll-cloud-setup; managed cloud shell environment.
-# Remove managed entries before prepending, including repeated shell startup.
-_stll_cloud_remaining="\${PATH-}"
-_stll_cloud_result=''
-_stll_cloud_separator=''
-while :; do
-  case "$_stll_cloud_remaining" in
-    *:*) _stll_cloud_part="\${_stll_cloud_remaining%%:*}"; _stll_cloud_remaining="\${_stll_cloud_remaining#*:}"; _stll_cloud_more=yes ;;
-    *) _stll_cloud_part="$_stll_cloud_remaining"; _stll_cloud_more=no ;;
-  esac
-  case "$_stll_cloud_part" in
-    ${quote$1(node)}|${quote$1(bun)}|/usr/local/bin) ;;
-    *) _stll_cloud_result="$_stll_cloud_result$_stll_cloud_separator$_stll_cloud_part"; _stll_cloud_separator=: ;;
-  esac
-  [ "$_stll_cloud_more" = yes ] || break
-done
-export PATH=${quote$1(`${node}:${bun}:/usr/local/bin`)}"\${_stll_cloud_separator:+:}$_stll_cloud_result"
-unset _stll_cloud_remaining _stll_cloud_result _stll_cloud_separator _stll_cloud_part _stll_cloud_more
-${rust === void 0 ? "" : `export RUSTUP_HOME=/opt/stll-cloud/rustup\nexport CARGO_HOME=/opt/stll-cloud/cargo\nexport RUSTUP_TOOLCHAIN=${quote$1(rust.channel)}\nexport RUSTUP_AUTO_INSTALL=0\n`}`;
-};
-const userStartup = String.raw`
-set -euo pipefail
-for name in .bashrc .profile .bash_profile .bash_login; do
-  file="$HOME/$name"
-  if [[ ! -e "$file" && ! -L "$file" && "$name" != .bashrc && "$name" != .profile ]]; then continue; fi
-  [[ ! -L "$file" ]] || { echo "cloud-setup: shell startup file must not be a symlink: $name" >&2; exit 1; }
-  if [[ -e "$file" ]]; then
-    [[ -f "$file" && "$(stat -c '%h:%u' "$file")" == "1:$(id -u)" ]] || { echo "cloud-setup: shell startup file must be owned and single-link: $name" >&2; exit 1; }
-  fi
-  temporary="$(mktemp "$HOME/.stll-cloud-shell.XXXXXX")"
-  trap 'rm -f -- "$temporary"' EXIT
-  if [[ "$name" == .bashrc ]]; then
-    printf '%s\n' '# stll-cloud: early environment' '@SOURCE@' > "$temporary"
-  fi
-  if [[ -f "$file" ]]; then
-    # Remove only exact managed blocks; preserve unrelated startup lines and permissions.
-    awk '
-      $0 == "# stll-cloud: early environment" || $0 == "# stll-cloud: session environment" {
-        if ((getline following) <= 0 || following != "@SOURCE@") exit 1
-        next
-      }
-      { print }
-    ' "$file" >> "$temporary" || { echo "cloud-setup: managed shell startup block differs: $name" >&2; exit 1; }
-  fi
-  printf '%s\n' '# stll-cloud: session environment' '@SOURCE@' >> "$temporary"
-  if [[ -f "$file" ]] && cmp -s "$temporary" "$file"; then rm -- "$temporary"; continue; fi
-  if [[ -f "$file" ]]; then chmod --reference="$file" "$temporary"; else chmod 644 "$temporary"; fi
-  mv -f -- "$temporary" "$file"
-done
-`;
-const renderCloudShellInstall = (options) => {
-	const profile = renderCloudShellProfile(options);
-	return `install_shell_environment() (
-  # Subshell scope retains temporary for EXIT cleanup after a failed command.
-  [[ ! -L ${quote$1(cloudShellProfilePath)} ]] || fail 'Managed shell profile must not be a symlink'
-  if [[ -e ${quote$1(cloudShellProfilePath)} ]]; then
-    [[ -f ${quote$1(cloudShellProfilePath)} && "$(stat -c '%h:%u' ${quote$1(cloudShellProfilePath)})" == 1:0 ]] || fail 'Managed shell profile must be a root-owned single-link file'
-  fi
-  temporary="$(mktemp)"
-  trap 'rm -f -- "$temporary"' EXIT
-  cat > "$temporary" <<'STLL_CLOUD_PROFILE'
-${profile}STLL_CLOUD_PROFILE
-  if ! cmp -s "$temporary" ${quote$1(cloudShellProfilePath)}; then install -m 644 "$temporary" ${quote$1(cloudShellProfilePath)}; fi
-  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" bash -c ${quote$1(userStartup.replaceAll("@SOURCE@", cloudShellProfileSource))}
-)
-verify_shell_environment() {
-  [[ -f ${quote$1(cloudShellProfilePath)} && ! -L ${quote$1(cloudShellProfilePath)} && "$(stat -c '%h:%u' ${quote$1(cloudShellProfilePath)})" == 1:0 ]] || fail 'Managed shell environment is unavailable; run install'
-  [[ "$(sha256sum -- ${quote$1(cloudShellProfilePath)} | cut -d ' ' -f1)" == ${quote$1(createHash("sha256").update(profile).digest("hex"))} ]] || fail 'Managed shell environment differs; run install'
-}
-`;
-};
-//#endregion
 //#region src/cloud-setup-toolchains.ts
 const record$2 = (input) => typeof input === "object" && input !== null && !Array.isArray(input);
 /** Resolve the same tracked snapshot for generation and the mandatory drift check. */
@@ -1033,6 +1040,7 @@ install_rust() (
     # Launchers persist the system homes in fresh shells without profile sourcing.
     printf '%s\n' '#!/bin/sh' 'export RUSTUP_HOME=/opt/stll-cloud/rustup' 'export CARGO_HOME=/opt/stll-cloud/cargo' 'export RUSTUP_AUTO_INSTALL=0' 'export RUSTUP_TOOLCHAIN=@RUST@' "exec /opt/stll-cloud/cargo/bin/$tool \"\$@\"" > "$scratch/$tool"
     if ! cmp -s "$scratch/$tool" "/usr/local/bin/$tool"; then
+      ${refuseDirectoryTarget("\"/usr/local/bin/$tool\"")}
       install -m 755 "$scratch/$tool" "/usr/local/bin/$tool"
     fi
   done
@@ -1078,7 +1086,7 @@ install_${tool.replaceAll("-", "_")}() (
     tar -xzf "$scratch/archive.tar.gz" -C "$scratch"
     install -d -m 755 ${quote(directory)}
     case "$ARCH" in
-${["amd64", "arm64"].map((arch) => `      ${arch})\n${Object.entries(release[arch].binaries).map(([binary, path]) => `        install -m 755 "$scratch/${path}" ${quote(`${directory}/${binary}`)}`).join("\n")}\n        ;;`).join("\n")}
+${["amd64", "arm64"].map((arch) => `      ${arch})\n${Object.entries(release[arch].binaries).map(([binary, path]) => `        ${refuseDirectoryTarget(quote(`${directory}/${binary}`))}\n        install -m 755 "$scratch/${path}" ${quote(`${directory}/${binary}`)}`).join("\n")}\n        ;;`).join("\n")}
     esac
     verify_${tool.replaceAll("-", "_")} || fail ${quote(`Installed ${tool} version differs from its pin`)}
   fi
@@ -1300,6 +1308,7 @@ install_runtimes() (
     (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
     unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
     install -d -m 755 "$BUN_DIR"
+    ${refuseDirectoryTarget("\"$BUN_DIR/bun\"")}
     install -m 755 "$scratch/bun/$bun_folder/bun" "$BUN_DIR/bun"
   fi
   runtime_ready
@@ -1654,6 +1663,52 @@ $cloud_shell_exports"
 fi`
 	}]
 });
+const releasedSnapshotHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    cloud_session_exports="$(${script} session)" || cloud_setup_incomplete 'startup failed; run install'
+  else
+    ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+    exit 0
+  fi
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      [ -f "$CLAUDE_ENV_FILE" ] && [ ! -L "$CLAUDE_ENV_FILE" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'
+    fi
+    cloud_env_snapshot="\${CLAUDE_ENV_FILE}.stll-cloud"
+    case "$cloud_env_snapshot" in
+      *"'"*) cloud_setup_incomplete 'session environment path must not contain a single quote; check its path and rerun start' ;;
+    esac
+    if [ -n "$cloud_session_exports" ]; then
+      cloud_session_exports="$cloud_session_exports
+$cloud_shell_exports"
+    else
+      cloud_session_exports="$cloud_shell_exports"
+    fi
+    cloud_env_temporary="$(umask 077; mktemp "\${cloud_env_snapshot}.XXXXXX")" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'
+    printf '%s\\n' "$cloud_session_exports" > "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }
+    mv -f -- "$cloud_env_temporary" "$cloud_env_snapshot" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }
+    cloud_env_source=". '$cloud_env_snapshot'"
+    if [ ! -f "$CLAUDE_ENV_FILE" ] || ! grep -Fqx -- "$cloud_env_source" "$CLAUDE_ENV_FILE"; then
+      printf '\\n%s\\n' "$cloud_env_source" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+    fi
+  fi
+fi`
+	}]
+});
 const sessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
@@ -1683,6 +1738,9 @@ const sessionStartHook = (script) => ({
     case "$cloud_env_snapshot" in
       *"'"*) cloud_setup_incomplete 'session environment path must not contain a single quote; check its path and rerun start' ;;
     esac
+    if [ -e "$cloud_env_snapshot" ] || [ -L "$cloud_env_snapshot" ]; then
+      [ -f "$cloud_env_snapshot" ] && [ ! -L "$cloud_env_snapshot" ] || cloud_setup_incomplete "session environment snapshot must be a regular file; remove $cloud_env_snapshot and rerun start"
+    fi
     if [ -n "$cloud_session_exports" ]; then
       cloud_session_exports="$cloud_session_exports
 $cloud_shell_exports"
@@ -1692,6 +1750,7 @@ $cloud_shell_exports"
     cloud_env_temporary="$(umask 077; mktemp "\${cloud_env_snapshot}.XXXXXX")" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'
     printf '%s\\n' "$cloud_session_exports" > "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }
     mv -f -- "$cloud_env_temporary" "$cloud_env_snapshot" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }
+    [ -f "$cloud_env_snapshot" ] && [ ! -L "$cloud_env_snapshot" ] || cloud_setup_incomplete "session environment snapshot must be a regular file; remove $cloud_env_snapshot and rerun start"
     cloud_env_source=". '$cloud_env_snapshot'"
     if [ ! -f "$CLAUDE_ENV_FILE" ] || ! grep -Fqx -- "$cloud_env_source" "$CLAUDE_ENV_FILE"; then
       printf '\\n%s\\n' "$cloud_env_source" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
@@ -1727,7 +1786,8 @@ const previousCloudSessionStartHooks = [
 	releasedSessionStartHook(`bash ${cloudSetupPath}`),
 	releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
 	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
-	releasedTemporaryFileHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
+	releasedTemporaryFileHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
+	releasedSnapshotHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
 ];
 const cloudAttribution = {
 	commit: "",