@zq-silk/yui 0.15.9 → 0.15.12

package/dist/release/releaseHandover.js

@@ -121,6 +121,28 @@ async function activateLocked(ports, locked) {
         };
     }
     void beginResult;
+    try {
+        ports.runPreflight(releaseDir, home);
+    }
+    catch (error) {
+        try {
+            await ports.call(home, "controller.rollback-handover", { handoverId });
+        }
+        catch (rollbackError) {
+            return {
+                outcome: "aborted", phase: "preflight",
+                message: `Host compatibility failed: ${messageOf(error)}; rollback failed: ${messageOf(rollbackError)}`,
+                action: "No candidate was started and the release pointer is unchanged. Preserve the fence and inspect the old Controller.",
+                recoverable: true
+            };
+        }
+        return {
+            outcome: "aborted", phase: "preflight",
+            message: `Fenced compatibility preflight failed: ${messageOf(error)}`,
+            action: "The old Controller is serving again; the active release and Home are unchanged.",
+            recoverable: true
+        };
+    }
     // 5) Start the candidate and wait for its identity read-back.
     ports.spawnCandidate(home, releaseDir, handoverId);
     const candidateReady = await waitForCandidateReady(ports, home, manifest, locked.candidateReadyTimeoutMs, locked.pollIntervalMs);

package/dist/release/releaseWorkflowPorts.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { releaseWorkflowScratchRoot } from "../storage/homeLayout.js";
 import { runUpdate } from "../cli/updateOrchestrator.js";
 import { activatedControllerEntrypoint } from "../cli/updatePorts.js";
 import { restartFileTaskController, stopFileTaskController } from "../controller/clientRuntime.js";
@@ -581,7 +581,7 @@ export function createReleaseWorkflowPorts(deps) {
                 // publish` read THIS snapshot, so a TOCTOU replacement of the
                 // original path after the integrity check cannot change what is
                 // published. The snapshot is removed once publish completes.
-                const snapshot = await writeVerifiedTarballSnapshot(bytes);
+                const snapshot = await writeVerifiedTarballSnapshot(deps.home, bytes);
                 try {
                     // Inspect the tarball manifest before publishing: the actual
                     // package name/version must match the frozen declaration, not
@@ -727,8 +727,12 @@ export function createReleaseWorkflowPorts(deps) {
                 // P2-2 (rr19): Install in a fresh temp directory with an isolated
                 // npm cache, so npx cannot reuse a local node_modules binary. Then
                 // run the installed binary directly and verify the output matches
-                // the pinned version.
-                const smokeDir = await mkdtemp(join(tmpdir(), "yui-smoke-"));
+                // the pinned version. The smoke directory is a Yui-authored release
+                // artifact, so it lands under the Home release-workflow scratch root,
+                // never a shared system temp root.
+                const scratch = releaseWorkflowScratchRoot(deps.home);
+                await mkdir(scratch, { recursive: true, mode: 0o700 });
+                const smokeDir = await mkdtemp(join(scratch, "yui-smoke-"));
                 const smokeCache = join(smokeDir, "npm-cache");
                 try {
                     const install = await run("npm", [
@@ -1642,10 +1646,14 @@ async function queryControllerLifecycle(run, globalYui, home, expectedVersion) {
  * random name and read-only permissions (P1-3, rr22). The manifest
  * inspection and `npm publish` both read this snapshot, so replacing the
  * original path after the integrity check cannot change what is published.
- * The caller removes the snapshot once publish completes.
+ * The caller removes the snapshot once publish completes. The snapshot is a
+ * Yui-authored release artifact, so it lands under the Home release-workflow
+ * scratch root, never a shared system temp root.
  */
-async function writeVerifiedTarballSnapshot(bytes) {
-    const snapshot = join(tmpdir(), `yui-release-snapshot-${randomBytes(12).toString("hex")}.tgz`);
+async function writeVerifiedTarballSnapshot(home, bytes) {
+    const scratch = releaseWorkflowScratchRoot(home);
+    await mkdir(scratch, { recursive: true, mode: 0o700 });
+    const snapshot = join(scratch, `yui-release-snapshot-${randomBytes(12).toString("hex")}.tgz`);
     // "wx" fails if the random name already exists, so a pre-existing file
     // (or symlink) can never be overwritten or followed.
     await writeFile(snapshot, bytes, { flag: "wx" });