@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.4

package/src/primitives/app_manifest/validation.zig

@@ -657,17 +657,55 @@ pub fn validateSecurity(security: SecurityConfig) ValidationError!void {
 pub fn validateUpdates(updates: UpdateConfig) ValidationError!void {
     if ((updates.feed_url == null) != (updates.public_key == null)) return error.MissingRequiredField;
     if (updates.check_on_start and updates.feed_url == null) return error.MissingRequiredField;
+    if (updates.mode == .app and updates.feed_url == null) return error.MissingRequiredField;
+    if (updates.public_keys.len > 0 and updates.public_key == null) return error.MissingRequiredField;
+    if (updates.public_keys.len > types.max_update_public_keys) return error.MissingRequiredField;
     if (updates.feed_url) |url| {
         if (url.len > 4096) return error.InvalidUrl;
         if (!std.mem.startsWith(u8, url, "https://")) return error.InvalidUrl;
         try validateUrl(url);
+        try validateFeedUrlPlaceholders(url);
+    }
+    if (updates.public_key) |key| try validateUpdatePublicKey(key);
+    for (updates.public_keys, 0..) |key, index| {
+        try validateUpdatePublicKey(key);
+        if (std.mem.eql(u8, key, updates.public_key.?)) return error.MissingRequiredField;
+        for (updates.public_keys[0..index]) |previous| {
+            if (std.mem.eql(u8, key, previous)) return error.MissingRequiredField;
+        }
     }
-    if (updates.public_key) |key| {
-        var decoded: [std.crypto.sign.Ed25519.PublicKey.encoded_length]u8 = undefined;
-        const decoded_len = std.base64.standard.Decoder.calcSizeForSlice(key) catch return error.MissingRequiredField;
-        if (decoded_len != decoded.len) return error.MissingRequiredField;
-        std.base64.standard.Decoder.decode(&decoded, key) catch return error.MissingRequiredField;
-        _ = std.crypto.sign.Ed25519.PublicKey.fromBytes(decoded) catch return error.MissingRequiredField;
+}
+
+fn validateUpdatePublicKey(key: []const u8) ValidationError!void {
+    var decoded: [std.crypto.sign.Ed25519.PublicKey.encoded_length]u8 = undefined;
+    const decoded_len = std.base64.standard.Decoder.calcSizeForSlice(key) catch return error.MissingRequiredField;
+    if (decoded_len != decoded.len) return error.MissingRequiredField;
+    std.base64.standard.Decoder.decode(&decoded, key) catch return error.MissingRequiredField;
+    _ = std.crypto.sign.Ed25519.PublicKey.fromBytes(decoded) catch return error.MissingRequiredField;
+}
+
+/// A feed_url may name `{target}` and `{current_version}`, which each
+/// installed app expands for itself, in its path or query only.
+fn validateFeedUrlPlaceholders(url: []const u8) ValidationError!void {
+    const authority_start = "https://".len;
+    const authority_end = std.mem.findAnyPos(u8, url, authority_start, "/?#") orelse url.len;
+    if (std.mem.findAny(u8, url[0..authority_end], "{}") != null) return error.InvalidUrl;
+    var index = authority_end;
+    while (index < url.len) : (index += 1) {
+        switch (url[index]) {
+            '{' => {
+                const rest = url[index..];
+                const placeholder = if (std.mem.startsWith(u8, rest, "{target}"))
+                    "{target}"
+                else if (std.mem.startsWith(u8, rest, "{current_version}"))
+                    "{current_version}"
+                else
+                    return error.InvalidUrl;
+                index += placeholder.len - 1;
+            },
+            '}' => return error.InvalidUrl,
+            else => {},
+        }
     }
 }
 

package/src/root.zig

@@ -157,6 +157,7 @@ pub const EffectChannelSourceState = runtime.EffectChannelSourceState;
 pub const EffectChannelSourceResult = runtime.EffectChannelSourceResult;
 pub const max_channel_source_payload = runtime.max_channel_source_payload;
 pub const ChannelHandle = runtime.ChannelHandle;
+pub const single_instance = runtime.single_instance;
 pub const max_effect_channels = runtime.max_effect_channels;
 pub const max_effect_channel_bytes = runtime.max_effect_channel_bytes;
 pub const max_effect_channel_pending = runtime.max_effect_channel_pending;

package/src/runtime/channel_sources.zig

@@ -1,19 +1,67 @@
 //! Explicit native external-producer capabilities. Portable app state and
-//! channel lifecycle stay in the app; this source owns a detached OS sampler.
+//! channel lifecycle stay in the app; `native-sdk.process.samples` owns a
+//! detached OS sampler, `native-sdk.app.launches` hands the channel to
+//! the single-instance listener (single_instance.zig), and
+//! `native-sdk.updates` receives the updater's status records
+//! (updater/engine.zig).
 const std = @import("std");
 const builtin = @import("builtin");
 const effects = @import("effects.zig");
 const clock = @import("clock.zig");
+const single_instance = @import("single_instance.zig");
+const update_engine = @import("../updater/engine.zig");
 const sample_interval_ms = 500;
 const max_line_bytes = 96;
 
 pub fn start(name: []const u8, payload: []const u8, handle: effects.ChannelHandle) !void {
+    if (std.mem.eql(u8, name, single_instance.source_name)) return single_instance.attach(payload, handle);
+    if (std.mem.eql(u8, name, update_engine.channel_source)) return attachUpdates(payload, handle);
     if (!std.mem.eql(u8, name, "native-sdk.process.samples")) return error.UnknownChannelSource;
     if (payload.len != 0) return error.InvalidChannelSourceArguments;
     if (comptime builtin.single_threaded) return error.UnsupportedChannelSource;
     try startSamplerThread(handle);
 }
 
+/// The open `native-sdk.updates` channels, each the engine's sink. A slot
+/// frees itself when its channel answers `.closed`.
+const UpdateChannel = struct {
+    handle: effects.ChannelHandle = undefined,
+    used: std.atomic.Value(bool) = .init(false),
+
+    fn post(context: *anyopaque, bytes: []const u8) update_engine.Posted {
+        const self: *UpdateChannel = @ptrCast(@alignCast(context));
+        return switch (self.handle.post(bytes)) {
+            .accepted => .delivered,
+            .dropped_full, .dropped_oversized => .dropped,
+            .closed => {
+                self.used.store(false, .release);
+                return .closed;
+            },
+        };
+    }
+};
+var update_channels: [4]UpdateChannel = .{UpdateChannel{}} ** 4;
+
+comptime {
+    // Every status record fits one post; notes travel by request.
+    std.debug.assert(update_engine.max_status_bytes <= effects.max_effect_channel_bytes);
+}
+
+fn attachUpdates(payload: []const u8, handle: effects.ChannelHandle) !void {
+    if (payload.len != 0) return error.InvalidChannelSourceArguments;
+    for (&update_channels) |*channel| {
+        if (channel.used.cmpxchgStrong(false, true, .acq_rel, .acquire) == null) {
+            channel.handle = handle;
+            update_engine.attach(.{ .context = channel, .post = UpdateChannel.post }) catch {
+                channel.used.store(false, .release);
+                return error.UnsupportedChannelSource;
+            };
+            return;
+        }
+    }
+    return error.UnsupportedChannelSource;
+}
+
 fn startSamplerThread(handle: effects.ChannelHandle) std.Thread.SpawnError!void {
     const thread = try std.Thread.spawn(.{}, samplerMain, .{handle});
     thread.detach();

package/src/runtime/effects.zig

@@ -79,6 +79,7 @@ const relational_store = @import("relational_store.zig");
 const credentials_store = @import("credentials_store.zig");
 const file_access = @import("file_access.zig");
 const pty_transport = @import("pty.zig");
+const update_engine = @import("../updater/engine.zig");
 
 /// Maximum in-flight effects (spawn slots / worker threads).
 pub const max_effects: usize = 16;
@@ -9665,7 +9666,8 @@ pub fn Effects(comptime Msg: type) type {
             return @import("desktop_files.zig").isName(name) or std.mem.startsWith(u8, name, "core.store.") or
                 std.mem.eql(u8, name, "native-sdk.launch-at-login.status") or
                 std.mem.eql(u8, name, "native-sdk.launch-at-login.set") or
-                std.mem.eql(u8, name, "native-sdk.time.formatLocal");
+                std.mem.eql(u8, name, "native-sdk.time.formatLocal") or
+                std.mem.startsWith(u8, name, update_engine.request_prefix);
         }
 
         fn isNativeHostSendName(name: []const u8) bool {
@@ -9826,6 +9828,15 @@ pub fn Effects(comptime Msg: type) type {
                 self.performBoundSystemRequest(name, key, payload);
                 return;
             }
+            if (std.mem.startsWith(u8, name, update_engine.request_prefix)) {
+                // The updater answers at once; its work runs off the loop
+                // and reports through the `native-sdk.updates` channel.
+                var output: [update_engine.max_response_bytes]u8 = undefined;
+                const response = update_engine.handleRequest(name, payload, &output);
+                self.feedHostResult(key, response.ok, response.bytes) catch {};
+                if (response.quit) if (self.services) |services| services.quitApp() catch {};
+                return;
+            }
             const services = self.services orelse {
                 self.feedHostResult(key, false, "unsupported") catch {};
                 return;

package/src/runtime/flow.zig

@@ -30,6 +30,7 @@ const app_manifest = @import("app_manifest");
 const platform = @import("../platform/root.zig");
 const host_flow = @import("host_flow_policy.zig");
 const native_reference = @import("flow_reference.zig");
+const update_engine = @import("../updater/engine.zig");
 const HostEventPump = @import("host_event_pump.zig").HostEventPump;
 const security = @import("../security/root.zig");
 
@@ -455,6 +456,11 @@ pub fn RuntimeFlow(comptime Runtime: type) type {
                 },
                 .mark_stop => {
                     self.app_stop_delivered = true;
+                    // A release the app staged but did not restart into
+                    // installs as the app quits, where the platform
+                    // installs on exit (macOS); hosts may exit the process
+                    // right after this event, so it cannot wait for run().
+                    update_engine.finish();
                 },
                 .stop => {
                     try app.stop(self);

package/src/runtime/flow_reference.zig

@@ -12,6 +12,7 @@ const runtime_automation_snapshot = @import("automation_snapshot.zig");
 const runtime_automation_widget_dispatch = @import("automation_widget_dispatch.zig");
 const automation_commands = @import("automation_command_policy.zig");
 const launch_timing = @import("launch_timing.zig");
+const update_engine = @import("../updater/engine.zig");
 const runtime_clock = @import("clock.zig");
 const runtime_state = @import("state.zig");
 const shell_layout = @import("shell_layout.zig");
@@ -524,6 +525,11 @@ pub fn RuntimeFlow(comptime Runtime: type) type {
                 .app_shutdown => {
                     try dispatchEvent(self, app, .{ .lifecycle = .stop });
                     if (self.options.extensions) |registry| try registry.stopAll(extensionContext(self));
+                    // A release the app staged but did not restart into
+                    // installs as the app quits, where the platform
+                    // installs on exit (macOS); hosts may exit the process
+                    // right after this event, so it cannot wait for run().
+                    update_engine.finish();
                     // Marked delivered BEFORE the call: if the hook itself
                     // errors, the run loop's exit path must not invoke it a
                     // second time (the hook contract is exactly-once).

package/src/runtime/root.zig

@@ -241,6 +241,10 @@ pub const max_session_journal_bytes = runtime_session_journal.max_session_journa
 pub const max_session_record_bytes = runtime_session_journal.max_session_record_bytes;
 pub const max_session_event_bytes = runtime_session_journal.max_session_event_bytes;
 
+/// Manifest `single_instance` ownership; the launcher claims it before
+/// startup and the `native-sdk.app.launches` source delivers launches.
+pub const single_instance = @import("single_instance.zig");
+
 const runtime_clock = @import("clock.zig");
 pub const Clock = runtime_clock.Clock;
 pub const TestClock = runtime_clock.TestClock;