@webprodigies/morphite 0.2.1 → 0.2.3

package/app-update.mjs

@@ -0,0 +1,182 @@
+/** SOURCE OF TRUTH KEYWORDS: appUpdateSteps, APP_SWAP, SWAP_HELPER_SCRIPT, verifyApp, STAGE_PREFIX
+ * WHAT: The steps that replace an installed Morphite with a release, for the terminal installer and
+ *   the app's own Update alike: read the release manifest, download the zip for this CPU while
+ *   measuring its SHA-256, unpack it with ditto, check the unpacked app (bundle id, version,
+ *   signature), clear the download mark, and swap it in by renames: the installed app is set aside,
+ *   the new one renamed into place, and on any failure the installed app is put back.
+ * WHY: Both paths must trust and replace an app the same way. After the app quits nothing of it may
+ *   run, and packaged Electron cannot run as Node (hardenPackagedElectron's RunAsNode fuse), so the
+ *   app's swap runs as SWAP_HELPER_SCRIPT under /bin/sh; it repeats swapApps's steps and is tested
+ *   against the same cases. Its inputs are positional arguments; no path is ever put into its text.
+ * WHERE: bin/morphite.mjs (installer) and src/desktop/updates/release-install.ts (STAGED_UPDATE)
+ *   import these; manifest.mjs owns the release format. Plain JavaScript: the installer has no
+ *   build step or dependencies.
+ */
+import { createHash } from 'node:crypto'
+import { createReadStream, createWriteStream } from 'node:fs'
+import { execFile } from 'node:child_process'
+import { rename, stat, readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { once } from 'node:events'
+import { promisify } from 'node:util'
+import { INSTALL_MANIFEST_FILE, latestManifestUrl, parseInstallManifest, releaseFileUrl } from './manifest.mjs'
+
+const run = promisify(execFile)
+/** Folders Morphite creates beside an installed app while updating it; only these are cleaned up. */
+export const STAGE_PREFIX = '.morphite-update-'
+/** The file inside such a folder that proves Morphite made it. */
+export const STAGE_MARK = 'morphite-update.json'
+
+export async function fetchWithRetry(url, { attempts = 3, userAgent = '@webprodigies/morphite installer', signal } = {}) {
+  let failure
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      const response = await fetch(url, { headers: { 'user-agent': userAgent }, redirect: 'follow', signal })
+      if (response.status === 404) return response
+      if (!response.ok) throw Error(`HTTP ${response.status}`)
+      return response
+    } catch (error) {
+      if (signal?.aborted) throw error
+      failure = error
+      await new Promise((resolve) => setTimeout(resolve, 600 * attempt))
+    }
+  }
+  throw Error(`Could not reach GitHub (${failure?.message ?? 'network error'}). Check your connection and run the command again.`)
+}
+
+/** The checked manifest of the newest release, or of the release in the local folder `from`. */
+export async function readManifest(from, options) {
+  if (from) return parseInstallManifest(JSON.parse(await readFile(join(from, INSTALL_MANIFEST_FILE), 'utf8')))
+  const response = await fetchWithRetry(latestManifestUrl(), options)
+  if (response.status === 404) throw Error('No Morphite release is available yet. Try again soon.')
+  return parseInstallManifest(await response.json())
+}
+
+/** Downloads (or copies from `from`) one archive to `destination`, measuring it as it arrives. */
+export async function downloadArchive(manifest, archive, destination, { from, progress, signal, ...options } = {}) {
+  const hash = createHash('sha256')
+  let received = 0
+  const report = () => progress?.(received / archive.size, received)
+  const output = createWriteStream(destination, { mode: 0o600 })
+  const write = async (chunk) => {
+    hash.update(chunk)
+    received += chunk.length
+    if (received > archive.size) throw Error('The download is larger than the release says. Nothing was installed.')
+    if (!output.write(chunk)) await once(output, 'drain')
+  }
+  const timer = progress ? setInterval(report, 120) : undefined
+  try {
+    if (from) {
+      for await (const chunk of createReadStream(join(from, archive.file), { signal })) await write(chunk)
+    } else {
+      const response = await fetchWithRetry(releaseFileUrl(manifest.tag, archive.file), { ...options, signal })
+      if (!response.ok || !response.body) throw Error(`The release file is unavailable (HTTP ${response.status}).`)
+      for await (const chunk of response.body) await write(chunk)
+    }
+    output.end()
+    await once(output, 'finish')
+  } finally {
+    clearInterval(timer)
+    output.destroy()
+  }
+  report()
+  return { path: destination, sha256: hash.digest('hex'), size: received }
+}
+export const archiveMatches = (file, archive) => file.size === archive.size && file.sha256 === archive.sha256
+
+/** Unpacks a release zip (made with ditto --keepParent) into `folder`. */
+export async function unpackApp(zip, folder) {
+  await run('/usr/bin/ditto', ['-x', '-k', zip, folder])
+}
+const infoValue = (app, key) =>
+  run('/usr/bin/plutil', ['-extract', key, 'raw', '-o', '-', join(app, 'Contents/Info.plist')]).then(
+    (result) => result.stdout.trim(),
+    () => null
+  )
+export class AppCheckError extends Error {
+  constructor(reason, message) {
+    super(message)
+    this.reason = reason
+  }
+}
+/** Throws an AppCheckError unless `app` is the expected Morphite build with an intact signature. */
+export async function verifyApp(app, { bundleId, version }) {
+  if ((await infoValue(app, 'CFBundleIdentifier')) !== bundleId)
+    throw new AppCheckError('bundle-id', 'The downloaded app isn’t the expected Morphite build.')
+  if ((await infoValue(app, 'CFBundleShortVersionString')) !== version)
+    throw new AppCheckError('version', 'The downloaded app isn’t the version the release names.')
+  await run('/usr/bin/codesign', ['--verify', '--deep', '--strict', app]).catch(() => {
+    throw new AppCheckError('signature', 'The downloaded app failed its signature check.')
+  })
+}
+/** A file fetched by Morphite carries no download mark; one is cleared defensively all the same. */
+export async function clearQuarantine(app) {
+  await run('/usr/bin/xattr', ['-dr', 'com.apple.quarantine', app]).catch(() => undefined)
+}
+
+/** APP_SWAP: sets every installed copy aside (aside(index)), renames `candidate` to `destination`
+ *  and returns what was set aside; on any failure puts every copy back and throws. */
+export async function swapApps(installed, candidate, destination, aside) {
+  const replaced = []
+  try {
+    for (const previous of installed) {
+      const moved = aside(replaced.length)
+      await rename(previous, moved)
+      replaced.push([previous, moved])
+    }
+    if (await stat(destination).catch(() => null)) throw Error(`${destination} already exists and isn’t Morphite.`)
+    await rename(candidate, destination)
+    return replaced
+  } catch (error) {
+    for (const [original, moved] of replaced.reverse()) await rename(moved, original).catch(() => undefined)
+    throw error
+  }
+}
+
+/** APP_SWAP for the app's own Update, run detached by /bin/sh after Morphite starts quitting:
+ *    sh -c SWAP_HELPER_SCRIPT morphite-update PID CURRENT STAGED ASIDE DESTINATION REOPEN ELEVATE
+ *  Waits (up to 10 minutes) for PID to exit, sets CURRENT aside to ASIDE, renames STAGED to
+ *  DESTINATION, puts CURRENT back on any failure, clears the download mark and, with REOPEN=1,
+ *  opens whichever app is in place. With ELEVATE=1 only the swap runs through macOS's administrator
+ *  prompt: the fixed AppleScript passes this same script (MORPHITE_SWAP_SCRIPT) and the paths as
+ *  arguments, quoted by AppleScript's `quoted form of`. Exit codes: 0 updated, 3 Morphite did not
+ *  quit, 4 nothing staged, 5 aside taken, 6 could not set aside, 7 rolled back, 8 not authorized. */
+export const SWAP_HELPER_SCRIPT = String.raw`
+set -u
+say() { printf '%s %s\n' "$(/bin/date '+%Y-%m-%dT%H:%M:%S')" "$1"; }
+swap() {
+  current=$1 staged=$2 aside=$3 destination=$4
+  if [ ! -d "$staged" ]; then say "The prepared update is missing. Nothing was changed."; return 4; fi
+  if [ -e "$aside" ]; then say "The previous app's place is taken. Nothing was changed."; return 5; fi
+  if ! /bin/mv "$current" "$aside"; then say "The installed app couldn't be set aside. Nothing was changed."; return 6; fi
+  if [ -e "$destination" ] || ! /bin/mv "$staged" "$destination"; then
+    /bin/mv "$aside" "$current" || say "The previous app is at $aside."
+    say "The update couldn't be moved into place; the previous app was put back."
+    return 7
+  fi
+  /usr/bin/xattr -dr com.apple.quarantine "$destination" 2>/dev/null
+  return 0
+}
+if [ "$1" = swap ]; then shift; swap "$@"; exit $?; fi
+pid=$1 current=$2 staged=$3 aside=$4 destination=$5 reopen=$6 elevate=$7
+waited=0
+while /bin/kill -0 "$pid" 2>/dev/null; do
+  if [ "$waited" -ge 1200 ]; then say "Morphite didn't quit. Nothing was changed."; exit 3; fi
+  /bin/sleep 0.5
+  waited=$((waited + 1))
+done
+if [ "$elevate" = 1 ]; then
+  /usr/bin/osascript \
+    -e 'on run argv' \
+    -e 'do shell script "/bin/sh -c " & quoted form of (item 1 of argv) & " morphite-update swap " & quoted form of (item 2 of argv) & " " & quoted form of (item 3 of argv) & " " & quoted form of (item 4 of argv) & " " & quoted form of (item 5 of argv) with prompt "Morphite needs your permission to finish updating." with administrator privileges' \
+    -e 'end run' "$MORPHITE_SWAP_SCRIPT" "$current" "$staged" "$aside" "$destination"
+  result=$?
+  [ "$result" -eq 0 ] || { say "The update wasn't authorized or couldn't be moved into place. The previous app is in place."; result=8; }
+else
+  swap "$current" "$staged" "$aside" "$destination"
+  result=$?
+fi
+if [ "$result" -eq 0 ]; then say "Updated $destination."; opened=$destination; else opened=$current; fi
+if [ "$reopen" = 1 ]; then /usr/bin/open "$opened" || say "Morphite couldn't be reopened."; fi
+exit "$result"
+`

package/bin/morphite.mjs

@@ -6,20 +6,18 @@
  * WHY: Until Morphite has a Developer ID, a browser download is stopped by Gatekeeper and people must
  *   allow it in Privacy & Security. A file fetched by this program is not marked as downloaded, so the
  *   verified app opens directly. Running the same command again is the update.
- * WHERE: ../manifest.mjs owns the release file format; scripts/release-publish.ts publishes releases;
- *   the desktop app's Update action opens this command in Terminal. User data lives outside the app
- *   bundle and is never touched here.
+ * WHERE: ../manifest.mjs owns the release file format and ../app-update.mjs the download, checks
+ *   and swap (appUpdateSteps), shared with the desktop app's own Update, which offers this command
+ *   only when it cannot prepare an update itself. scripts/release-publish.ts publishes releases.
+ *   User data lives outside the app bundle and is never touched here.
  */
-import { createHash } from 'node:crypto'
-import { createWriteStream } from 'node:fs'
-import { access, constants, lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
+import { access, constants, lstat, mkdir, mkdtemp, readdir, rm } from 'node:fs/promises'
 import { execFile } from 'node:child_process'
 import { homedir, platform, tmpdir, arch as nodeArch } from 'node:os'
 import { join, basename, dirname } from 'node:path'
-import { once } from 'node:events'
 import { createInterface } from 'node:readline'
 import { promisify } from 'node:util'
-import { INSTALL_MANIFEST_FILE, latestManifestUrl, parseInstallManifest, releaseFileUrl } from '../manifest.mjs'
+import { archiveMatches, clearQuarantine, downloadArchive, readManifest, swapApps, unpackApp, verifyApp } from '../app-update.mjs'
 
 const run = promisify(execFile)
 const args = process.argv.slice(2)
@@ -135,59 +133,6 @@ async function moveToTrash(path) {
   )
 }
 
-// ── Release ─────────────────────────────────────────────────────────────────
-async function fetchWithRetry(url, attempts = 3) {
-  let failure
-  for (let attempt = 1; attempt <= attempts; attempt++) {
-    try {
-      const response = await fetch(url, { headers: { 'user-agent': `${PACKAGE} installer` }, redirect: 'follow' })
-      if (response.status === 404) return response
-      if (!response.ok) throw Error(`HTTP ${response.status}`)
-      return response
-    } catch (error) {
-      failure = error
-      await new Promise((resolve) => setTimeout(resolve, 600 * attempt))
-    }
-  }
-  throw Error(`Could not reach GitHub (${failure?.message ?? 'network error'}). Check your connection and run the command again.`)
-}
-async function readManifest(from) {
-  if (from) return parseInstallManifest(JSON.parse(await readFile(join(from, INSTALL_MANIFEST_FILE), 'utf8')))
-  const response = await fetchWithRetry(latestManifestUrl())
-  if (response.status === 404) throw Error('No Morphite release is available yet. Try again soon.')
-  return parseInstallManifest(await response.json())
-}
-async function download(manifest, archive, folder, from, progress) {
-  const destination = join(folder, archive.file)
-  const hash = createHash('sha256')
-  let received = 0
-  const report = () => progress(received / archive.size, `${megabytes(received)} of ${megabytes(archive.size)} MB`)
-  const output = createWriteStream(destination, { mode: 0o600 })
-  const write = async (chunk) => {
-    hash.update(chunk)
-    received += chunk.length
-    if (received > archive.size) throw Error('The download is larger than the release says. Nothing was installed.')
-    if (!output.write(chunk)) await once(output, 'drain')
-  }
-  const timer = setInterval(report, 120)
-  try {
-    if (from) {
-      const { createReadStream } = await import('node:fs')
-      for await (const chunk of createReadStream(join(from, archive.file))) await write(chunk)
-    } else {
-      const response = await fetchWithRetry(releaseFileUrl(manifest.tag, archive.file))
-      if (!response.ok || !response.body) throw Error(`The release file is unavailable (HTTP ${response.status}).`)
-      for await (const chunk of response.body) await write(chunk)
-    }
-    output.end()
-    await once(output, 'finish')
-  } finally {
-    clearInterval(timer)
-    output.destroy()
-  }
-  return { path: destination, sha256: hash.digest('hex'), size: received }
-}
-
 // ── Install ─────────────────────────────────────────────────────────────────
 async function writable(folder) {
   return access(folder, constants.W_OK).then(
@@ -282,10 +227,13 @@ async function main() {
   const destination = join(target, `${manifest.name}.app`)
   const work = await mkdtemp(join(tmpdir(), 'morphite-installer-'))
   const cleanup = () => rm(work, { recursive: true, force: true }).catch(() => undefined)
-  process.once('SIGINT', () => {
+  const stopped = () => {
     live.done()
+    note('Stopped. Nothing was changed.', `Run npx ${PACKAGE}@latest again when you’re ready.`)
+    say('')
     void cleanup().then(() => process.exit(130))
-  })
+  }
+  process.once('SIGINT', stopped)
   // A problem after the download started: keep the last line where it stopped, then say what happened.
   const stop = (title, detail) => {
     live.done()
@@ -295,11 +243,15 @@ async function main() {
   try {
     let file
     try {
-      file = await download(manifest, archive, work, from, (ratio, detail) => live.set(progressLine(ratio, detail)))
+      file = await downloadArchive(manifest, archive, join(work, archive.file), {
+        from,
+        userAgent: `${PACKAGE} installer`,
+        progress: (ratio, received) => live.set(progressLine(ratio, `${megabytes(received)} of ${megabytes(archive.size)} MB`))
+      })
     } catch (error) {
       throw stop('The download stopped.', `${error.message} Nothing was changed.`)
     }
-    if (file.size !== archive.size || file.sha256 !== archive.sha256)
+    if (!archiveMatches(file, archive))
       throw stop('The download doesn’t match the release.', 'Nothing was changed. Run the command again.')
     live.done(progressLine(1, `${megabytes(file.size)} MB · verified`))
 
@@ -308,44 +260,66 @@ async function main() {
     // Stage beside the destination so the final move is a rename on the same disk.
     const stage = await mkdtemp(join(target, '.morphite-install-'))
     try {
-      await run('/usr/bin/ditto', ['-x', '-k', file.path, stage])
+      await unpackApp(file.path, stage)
       const candidate = join(stage, `${manifest.name}.app`)
-      if ((await bundleIdOf(candidate)) !== manifest.bundleId) throw stop('The downloaded app isn’t the expected Morphite build.', 'Nothing was changed.')
-      await run('/usr/bin/codesign', ['--verify', '--deep', '--strict', candidate]).catch(() => {
-        throw stop('The downloaded app failed its signature check.', 'Nothing was changed.')
+      await verifyApp(candidate, { bundleId: manifest.bundleId, version: manifest.version }).catch((error) => {
+        throw stop(error.message, 'Nothing was changed.')
       })
-      // Fetched by this program, the app carries no download mark; clear one defensively all the same.
-      await run('/usr/bin/xattr', ['-dr', 'com.apple.quarantine', candidate]).catch(() => undefined)
+      await clearQuarantine(candidate)
 
-      // Morphite must be closed before its app is replaced; the person closes it, never this script.
+      // Morphite must be closed before its app is replaced. The person quits it from its menu, or
+      // presses Enter and the installer asks it to quit the normal way (never a forced stop, so its
+      // work ends cleanly). No keyboard shortcut is suggested: ⌘Q here would quit Terminal.
       let open = await runningFrom([...installed, ...earlier])
       if (open.length) {
         const names = open.map((app) => basename(app, '.app')).join(' and ')
-        live.set(`${bold(`Quit ${names} to continue`)} ${grey('(⌘Q)')}`)
-        while (open.length) {
-          await new Promise((resolve) => setTimeout(resolve, 700))
-          open = await runningFrom([...installed, ...earlier])
+        live.clear()
+        note(
+          `${names} is open.`,
+          `Quit it from its menu bar (${names} → Quit), and this ${current ? 'update' : 'install'} continues on its own.`,
+          tty ? 'Or press Return to quit it now. Control-C stops without changing anything.' : 'Control-C stops without changing anything.'
+        )
+        say('')
+        const input = tty && process.stdin.isTTY ? process.stdin : null
+        const key = (data) => {
+          const text = String(data)
+          if (text.includes('\u0003')) return stopped()
+          if (!/[\r\n]/.test(text)) return
+          live.set(grey(`Quitting ${names}…`))
+          for (const app of open) {
+            const id = earlier.includes(app) ? EARLIER_APP_ID : manifest.bundleId
+            void run('/usr/bin/osascript', ['-e', `tell application id ${JSON.stringify(id)} to quit`]).catch(() => undefined)
+          }
+        }
+        if (input) {
+          input.setRawMode(true)
+          input.resume()
+          input.on('data', key)
         }
+        live.set(grey(`Waiting for ${names} to quit…`))
+        try {
+          while (open.length) {
+            await new Promise((resolve) => setTimeout(resolve, 700))
+            open = await runningFrom([...installed, ...earlier])
+          }
+        } finally {
+          if (input) {
+            input.off('data', key)
+            input.setRawMode(false)
+            input.pause()
+          }
+        }
+        live.done(grey(`${names} quit`))
         live.set(grey(`${current ? 'Updating' : 'Installing'} in ${place}…`))
       }
 
-      const replaced = []
       try {
         // Set the old app aside in the staging folder; it is removed with that folder only once the
-        // new app is in place, as any Mac updater does. The bundle holds no data: projects, settings
-        // and sign-in live outside it.
-        for (const previous of installed) {
-          const aside = join(stage, `previous-${replaced.length}.app`)
-          await rename(previous, aside)
-          replaced.push([previous, aside])
-        }
-        if (await stat(destination).catch(() => null)) throw Error(`${tilde(destination)} already exists and isn’t ${manifest.name}.`)
-        await rename(candidate, destination)
+        // new app is in place, as any Mac updater does. On failure every earlier copy is put back
+        // (APP_SWAP). The bundle holds no data: projects, settings and sign-in live outside it.
+        await swapApps(installed, candidate, destination, (index) => join(stage, `previous-${index}.app`))
       } catch (error) {
-        // Put every earlier copy back where it was; the install did not happen.
-        for (const [original, moved] of replaced.reverse()) await rename(moved, original).catch(() => undefined)
-        if (error.reported) throw error
-        throw stop(`${manifest.name} couldn’t be installed.`, `${error.message} Nothing was changed.`)
+        throw stop(`${manifest.name} couldn’t be installed.`, `${error.message.replace(destination, tilde(destination))} Nothing was changed.`)
       }
       live.done(grey(`${current ? 'Updated' : 'Installed'} in ${place}`))
     } finally {

package/manifest.mjs

@@ -4,10 +4,16 @@
  * WHY: The installer trusts nothing it has not checked: it installs only releases that carry this
  *   file (earlier releases without it are never picked up), checks every field before a path or URL
  *   is built from it, and refuses an archive whose size or hash differs.
- * WHERE: scripts/release-publish.ts writes it beside the zips; bin/morphite.mjs reads it from the
- *   releases repository (or a local folder with --from). Plain JavaScript so the published installer
- *   has no dependencies.
+ * WHERE: writeReleaseFiles writes it beside the zips (scripts/release-publish.ts, and the local
+ *   update test kit scripts/update-try.ts); bin/morphite.mjs and the app's own Update
+ *   (app-update.mjs readManifest → src/desktop/updates/release-install.ts) read it from the releases
+ *   repository or a local folder. Plain JavaScript so the published installer has no dependencies.
  */
+import { createHash } from 'node:crypto'
+import { createReadStream } from 'node:fs'
+import { stat, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+
 export const INSTALL_MANIFEST_FILE = 'morphite-install.json'
 export const RELEASES_REPOSITORY = 'webprodigies-org/morphite-releases'
 export const MAC_ARCHES = ['arm64', 'x64']
@@ -47,3 +53,24 @@ export const releaseFileUrl = (tag, file) =>
   `https://github.com/${RELEASES_REPOSITORY}/releases/download/${encodeURIComponent(tag)}/${encodeURIComponent(file)}`
 export const latestManifestUrl = () =>
   `https://github.com/${RELEASES_REPOSITORY}/releases/latest/download/${INSTALL_MANIFEST_FILE}`
+
+/** Describes the zips already in `folder` for a release: measures each, writes morphite-install.json
+ *  and SHA256SUMS beside them and returns the checked manifest. Used by release:publish and the
+ *  local update test kit (update:try), so a local release has the published format. */
+export async function writeReleaseFiles(folder, { files, ...release }) {
+  const archives = {}
+  for (const arch of MAC_ARCHES) {
+    const file = files[arch]
+    if (!file) continue
+    const hash = createHash('sha256')
+    for await (const chunk of createReadStream(join(folder, file))) hash.update(chunk)
+    archives[arch] = { file, sha256: hash.digest('hex'), size: (await stat(join(folder, file))).size }
+  }
+  const manifest = parseInstallManifest({ format: 1, ...release, archives })
+  await writeFile(join(folder, INSTALL_MANIFEST_FILE), JSON.stringify(manifest, null, 2) + '\n')
+  await writeFile(
+    join(folder, 'SHA256SUMS'),
+    Object.values(manifest.archives).map((entry) => `${entry.sha256}  ${entry.file}`).join('\n') + '\n'
+  )
+  return manifest
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webprodigies/morphite",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Install or update Morphite on your Mac: npx @webprodigies/morphite",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "bin/morphite.mjs",
     "manifest.mjs",
+    "app-update.mjs",
     "README.md"
   ],
   "engines": {