@whyvix/remote 0.3.19 → 0.3.20

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@whyvix/remote",
-      "version": "0.3.19",
+      "version": "0.3.20",
       "dependencies": {
         "@modelcontextprotocol/ext-apps": "^2.0.0",
         "@modelcontextprotocol/sdk": "^1.30.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "private": false,
   "type": "module",
   "files": [
@@ -28,7 +28,7 @@
     "test:r10-gui-window-focus": "node scripts/r10-gui-window-action-contract-test.js && node scripts/r10-gui-window-action-source-test.js && node scripts/r10-gui-window-action-agent-capability-test.js && node scripts/r10-gui-window-action-authorization-test.js && node scripts/r10-gui-window-action-loader-test.js && node scripts/r10-gui-window-action-mcp-schema-test.js && node scripts/r10-gui-window-action-cli-wiring-test.js && node scripts/r10-deployment-certify-authorization-test.js && node scripts/r10-deployment-certify-protocol-test.js && node scripts/r10-deployment-activation-response-test.js",
     "test:r10-documents": "node scripts/r10-precision-document-inspect-test.js && node scripts/r10-precision-document-compare-test.js && node scripts/r10-precision-docx-mutation-test.js && node scripts/r10-precision-xlsx-mutation-test.js && node scripts/r10-precision-pptx-mutation-test.js",
     "test:r10-observability": "node scripts/r10-write-preview-test.js && node scripts/r10-cli-presentation-test.js && node scripts/r10-usage-metering-test.js",
-    "test:r10-self-update": "node scripts/r10-self-update-manager-test.js && node scripts/r10-update-supervisor-test.js && node scripts/r10-update-lifecycle-test.js && node scripts/r10-update-activation-plan-test.js && node scripts/r10-update-bootstrap-executor-test.js && node scripts/r10-update-supervisor-host-test.js && node scripts/r10-update-archive-policy-test.js && node scripts/r10-update-persistence-test.js"
+    "test:r10-self-update": "node scripts/r10-self-update-manager-test.js && node scripts/r10-update-supervisor-test.js && node scripts/r10-update-lifecycle-test.js && node scripts/r10-update-activation-plan-test.js && node scripts/r10-update-bootstrap-executor-test.js && node scripts/r10-update-supervisor-host-test.js && node scripts/r10-update-archive-policy-test.js && node scripts/r10-update-persistence-test.js && node scripts/r10-windows-detached-survival-test.js"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^2.0.0",

package/packages/agent/src/self-update-manager.js

@@ -2,10 +2,10 @@ import os from "node:os";
 import path from "node:path";
 import crypto from "node:crypto";
 import { gunzipSync } from "node:zlib";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { spawn, execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { readUpdateTarEntries, validateUpdateArchiveEntries } from "./update-archive-policy.js";
+import { extractValidatedUpdateTar } from "./update-archive-policy.js";
 const execFileAsync=promisify(execFile);
 
 const PACKAGE_NAME="@whyvix/remote";
@@ -15,6 +15,10 @@ const VERSION=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 function safeVersion(value){const version=String(value||"").trim();if(!VERSION.test(version))fail("UPDATE_VERSION_INVALID","Explicit semver version is required");return version;}
 function digest(buffer){return crypto.createHash("sha512").update(buffer).digest("base64");}
+async function resolveNpmCli(nodeExecPath){
+  const cli=path.join(path.dirname(nodeExecPath),"node_modules","npm","bin","npm-cli.js");
+  try{await access(cli);return cli;}catch{fail("UPDATE_NPM_UNAVAILABLE","Trusted npm CLI was not found beside the active Node runtime");}
+}
 
 export class SelfUpdateManager{
   constructor({fetchFn=fetch,spawnFn=spawn,nodeExecPath=process.execPath,homeDir=os.homedir(),registry=REGISTRY,audit=()=>{}}={}){
@@ -56,15 +60,15 @@ export class SelfUpdateManager{
   async materialize({version}={}){
     const prepared=await this.verifyPrepared({version});version=prepared.version;
     const root=this.updateRoot(version),extractRoot=path.join(root,"extracted");
-    validateUpdateArchiveEntries(readUpdateTarEntries(gunzipSync(await readFile(prepared.artifact))));
+    const tarBytes=gunzipSync(await readFile(prepared.artifact));
     await rm(extractRoot,{recursive:true,force:true});await mkdir(extractRoot,{recursive:true,mode:0o700});
-    try{await execFileAsync("tar",["-xzf",prepared.artifact,"-C",extractRoot],{windowsHide:true,maxBuffer:1024*1024});}
-    catch{await rm(extractRoot,{recursive:true,force:true});fail("UPDATE_EXTRACT_FAILED","Verified package could not be extracted");}
+    try{await extractValidatedUpdateTar(tarBytes,extractRoot);}
+    catch(error){await rm(extractRoot,{recursive:true,force:true});if(String(error?.code||"").startsWith("UPDATE_ARCHIVE_"))throw error;fail("UPDATE_EXTRACT_FAILED","Verified package could not be extracted");}
     const packageRoot=path.join(extractRoot,"package"),meta=JSON.parse(await readFile(path.join(packageRoot,"package.json"),"utf8"));
     if(meta?.name!==PACKAGE_NAME||meta?.version!==version||meta?.bin?.["whyvix-remote"]!=="packages/cli/index.js"){await rm(extractRoot,{recursive:true,force:true});fail("UPDATE_PACKAGE_INVALID","Extracted package identity or launcher is invalid");}
     const launcher=path.join(packageRoot,"packages","cli","index.js");await readFile(launcher);
-    try{await execFileAsync("npm",["ci","--omit=dev","--ignore-scripts","--no-audit","--no-fund"],{cwd:packageRoot,windowsHide:true,maxBuffer:4*1024*1024});}
-    catch{await rm(extractRoot,{recursive:true,force:true});fail("UPDATE_DEPENDENCIES_FAILED","Verified package dependencies could not be installed deterministically");}
+    try{const npmCli=await resolveNpmCli(this.nodeExecPath);await execFileAsync(this.nodeExecPath,[npmCli,"ci","--omit=dev","--ignore-scripts","--no-audit","--no-fund"],{cwd:packageRoot,windowsHide:true,maxBuffer:4*1024*1024});}
+    catch(error){await rm(extractRoot,{recursive:true,force:true});if(error?.code==="UPDATE_NPM_UNAVAILABLE")throw error;fail("UPDATE_DEPENDENCIES_FAILED","Verified package dependencies could not be installed deterministically");}
     this.audit({event:"update.materialized",version});return{...prepared,packageRoot,launcher};
   }
   launchReplacement({version,cwd=process.cwd()}={}){

package/packages/agent/src/update-archive-policy.js

@@ -1,3 +1,6 @@
+import path from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export function validateUpdateArchiveEntries(entries){
@@ -13,7 +16,7 @@ export function validateUpdateArchiveEntries(entries){
   return{valid:true,count:entries.length};
 }
 
-export function readUpdateTarEntries(buffer){
+function readUpdateTarEntryDetails(buffer){
   if(!Buffer.isBuffer(buffer)||buffer.length<512)fail("UPDATE_ARCHIVE_INVALID","Tar archive bytes are required");
   const entries=[];
   for(let offset=0;offset+512<=buffer.length;){
@@ -25,11 +28,30 @@ export function readUpdateTarEntries(buffer){
     if(!Number.isFinite(size)||size<0)fail("UPDATE_ARCHIVE_INVALID","Tar entry size is invalid");
     const typeFlag=String.fromCharCode(header[156]||48);
     if(!["0","1","2","5","\u0000"].includes(typeFlag))fail("UPDATE_ARCHIVE_TYPE_DENIED",`Unsupported tar entry type: ${typeFlag}`);
+    const checksumText=text(148,8).trim();const expectedChecksum=checksumText?Number.parseInt(checksumText,8):NaN;
+    const checksumHeader=Buffer.from(header);checksumHeader.fill(32,148,156);let actualChecksum=0;for(const byte of checksumHeader)actualChecksum+=byte;
+    if(!Number.isFinite(expectedChecksum)||expectedChecksum!==actualChecksum)fail("UPDATE_ARCHIVE_INVALID","Tar header checksum is invalid");
     const type=typeFlag==="2"?"symlink":typeFlag==="1"?"hardlink":typeFlag==="5"?"directory":"file";
-    entries.push({name:full,type});
+    const dataOffset=offset+512;if(dataOffset+size>buffer.length)fail("UPDATE_ARCHIVE_INVALID","Tar entry payload is truncated");
+    entries.push({name:full,type,size,dataOffset});
     offset+=512+Math.ceil(size/512)*512;
   }
   if(entries.length<1)fail("UPDATE_ARCHIVE_INVALID","Tar archive has no entries");
   return entries;
 }
 
+export function readUpdateTarEntries(buffer){return readUpdateTarEntryDetails(buffer).map(({name,type})=>({name,type}));}
+
+export async function extractValidatedUpdateTar(buffer,destination){
+  const entries=readUpdateTarEntryDetails(buffer);validateUpdateArchiveEntries(entries);
+  const root=path.resolve(destination);await mkdir(root,{recursive:true,mode:0o700});
+  for(const entry of entries){
+    const target=path.resolve(root,...entry.name.replaceAll("\\","/").split("/").filter(Boolean));
+    if(target!==root&&!target.startsWith(root+path.sep))fail("UPDATE_ARCHIVE_PATH_DENIED","Archive entry escapes extraction root");
+    if(entry.type==="directory"){await mkdir(target,{recursive:true,mode:0o700});continue;}
+    await mkdir(path.dirname(target),{recursive:true,mode:0o700});
+    await writeFile(target,buffer.subarray(entry.dataOffset,entry.dataOffset+entry.size),{flag:"wx",mode:0o600});
+  }
+  return{count:entries.length};
+}
+

package/packages/agent/src/update-bootstrap-executor.js

@@ -1,18 +1,27 @@
 import path from "node:path";
 import { rm } from "node:fs/promises";
 import { UpdateLifecycle } from "./update-lifecycle.js";
-import { acquireExclusiveLock } from "./update-persistence.js";
+import { acquireExclusiveLock, recoverStaleExclusiveLock } from "./update-persistence.js";
 
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export class UpdateBootstrapExecutor{
-  constructor({manager,activationPlan,supervisor,waitStable,audit=()=>{}}={}){
+  constructor({manager,activationPlan,supervisor,waitStable,recoverLock=recoverStaleExclusiveLock,audit=()=>{}}={}){
     if(!manager||!activationPlan||!supervisor||!waitStable)fail("UPDATE_BOOTSTRAP_INVALID","Complete bootstrap dependencies are required");
-    Object.assign(this,{manager,activationPlan,supervisor,waitStable,audit});
+    Object.assign(this,{manager,activationPlan,supervisor,waitStable,recoverLock,audit});
   }
   async execute(){
     const lockPath=path.join(this.manager.homeDir,".whyvix-remote","update-activation.lock");
-    const release=await acquireExclusiveLock(lockPath);
+    let release;
+    try{release=await acquireExclusiveLock(lockPath);}
+    catch(error){
+      if(error?.code!=="UPDATE_BUSY")throw error;
+      const stateFile=path.join(this.manager.homeDir,".whyvix-remote","update-state.json");
+      const recovery=await this.recoverLock(lockPath,{stateFile});
+      if(!recovery.recovered)throw error;
+      this.audit({event:"update.stale_lock_recovered",reason:recovery.reason});
+      release=await acquireExclusiveLock(lockPath);
+    }
     try{
     const plan=await this.activationPlan.verify();
     const readyFile=path.join(this.manager.updateRoot(plan.targetVersion),"registered.json");

package/packages/agent/src/update-persistence.js

@@ -23,6 +23,19 @@ export async function writeJsonAtomic(file,value){
   return value;
 }
 
+export function isProcessAlive(pid,{probe=process.kill}={}){
+  if(!Number.isInteger(pid)||pid<=0)return false;
+  try{probe(pid,0);return true;}catch{return false;}
+}
+
+export async function recoverStaleExclusiveLock(file,{stateFile,probe=process.kill}={}){
+  const lock=await readJsonStrict(file,{missing:null,invalidCode:"UPDATE_LOCK_INVALID"});if(!lock)return{recovered:false,reason:"missing"};
+  if(isProcessAlive(Number(lock.pid),{probe}))return{recovered:false,reason:"owner_alive"};
+  const state=stateFile?await readJsonStrict(stateFile,{missing:null,invalidCode:"UPDATE_STATE_INVALID"}):null;
+  if(["candidate_started","registered","rollback_started"].includes(String(state?.status||"")))fail("UPDATE_RECOVERY_REQUIRED","Stale lock belongs to an interrupted activation transition");
+  await rm(file,{force:true});return{recovered:true,reason:"owner_dead"};
+}
+
 export async function acquireExclusiveLock(file,{busyCode="UPDATE_BUSY"}={}){
   await mkdir(path.dirname(file),{recursive:true,mode:0o700});
   let handle;