aegis-desktop 0.8.19 → 0.8.21

package/vendor/platform.js

@@ -39,6 +39,7 @@
  */
 
 const fs = require('node:fs');
+const os = require('node:os');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 
@@ -80,6 +81,23 @@ function defaultProbe(cmd, args = [], opts = {}) {
   }
 }
 
+function defaultDirExists(dir) {
+  try {
+    return fs.statSync(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/** Read a text file; `null` for every failure (missing, unreadable, not text). */
+function defaultReadText(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
 /** Run a command for its side effect. Never throws; `{ ok, error, output }`. */
 function defaultRun(cmd, args = [], opts = {}) {
   try {
@@ -398,6 +416,243 @@ function hasDisplay(options = {}) {
   return false;
 }
 
+// ---------------------------------------------------------------------------
+// homeDir / resolvePath
+// ---------------------------------------------------------------------------
+
+/**
+ * This user's home directory, `''` when nothing can say what it is.
+ *
+ * `USERPROFILE` leads on win32 and `HOME` on posix because that is the variable
+ * each OS actually sets; the other is accepted second (a Windows git-bash shell
+ * exports `HOME`, and a posix host inheriting `USERPROFILE` is harmless), and
+ * `os.homedir()` is the last word. Reading the env BEFORE `os.homedir()` is what
+ * lets a test point a whole tool run at a temp directory.
+ */
+function homeDir(options = {}) {
+  const { platform, env, o } = seams(options);
+  // An explicit `home` is honoured AS GIVEN, including `''`. That is the seam
+  // for "this machine has no home directory" — a case the env/os fallbacks below
+  // can never produce on a developer's own box, and therefore one that could
+  // not be tested at all if an empty string fell through to them.
+  if (typeof o.home === 'string') return o.home.trim();
+  const keys = platform === 'win32' ? ['USERPROFILE', 'HOME'] : ['HOME', 'USERPROFILE'];
+  for (const key of keys) {
+    const value = envValue(env, key, platform);
+    if (value && String(value).trim()) return String(value).trim();
+  }
+  try {
+    return os.homedir() || '';
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Do the permission bits in `fs.stat().mode` carry real information here?
+ *
+ * On Windows they do not. libuv has no NTFS ACL to report, so it SYNTHESISES the
+ * mode from a single bit — the read-only attribute — and hands back `0o666` for
+ * every writable file and `0o444` for every read-only one, directories included.
+ * Two consequences, and both were live bugs:
+ *
+ *   - `(mode & 0o077) !== 0` — "is this readable by other users?" — is therefore
+ *     ALWAYS TRUE on Windows, for every file, no matter how locked down it is.
+ *     Code that refuses a secret on that test refuses it unconditionally there
+ *     (tools/agent-gate.mjs would not accept an agent key at all), and code that
+ *     reports it as exposure reports the user's whole data directory as exposed
+ *     with no way to fix it (`/doctor` in cli/src/commands.js).
+ *   - `chmodSync(f, 0o600)` cannot make that test pass, so a repair loop that
+ *     re-reads the mode to confirm never converges.
+ *
+ * Where this returns false the boundary is the DIRECTORY's ACL — a per-user
+ * profile directory is already inaccessible to other non-admin accounts — which
+ * is what `client/authorship-key.js` has always done for the key file. The right
+ * behaviour is to skip the judgement and say so, never to assume the worst.
+ */
+function hasPosixModes(options = {}) {
+  const { win32 } = seams(options);
+  return !win32;
+}
+
+/**
+ * This user's real Desktop directory, or `''` when none can be found.
+ *
+ * `~/Desktop` is a GUESS, and it is wrong on both of the hosts this function was
+ * added for:
+ *
+ *   - Windows with OneDrive. Folder redirection moves the live Desktop to
+ *     `%USERPROFILE%\OneDrive\Desktop` and commonly leaves an empty
+ *     `%USERPROFILE%\Desktop` behind, so a write to the obvious path lands in a
+ *     directory the user is not looking at. `%OneDrive%` (set while OneDrive
+ *     runs) is consulted first for exactly this case.
+ *   - A localised Linux desktop. XDG translates the directory ITSELF, not just
+ *     its label: a Swedish session has `~/Skrivbord` and no `~/Desktop` at all.
+ *     `$XDG_DESKTOP_DIR` answers it, and `~/.config/user-dirs.dirs` is where
+ *     that variable is defined when the session did not export it.
+ *
+ * macOS is the one host where `~/Desktop` is simply correct.
+ *
+ * Seams: `dirExists` (default: a real statSync isDirectory probe) and `readText`
+ * (default: a real utf8 read, `null` on any failure), so all three branches are
+ * exercised on one host.
+ */
+function desktopDir(options = {}) {
+  const { platform, env, win32, o } = seams(options);
+  const P = win32 ? path.win32 : path.posix;
+  const home = homeDir(options);
+  const dirExists = typeof o.dirExists === 'function' ? o.dirExists : defaultDirExists;
+  const readText = typeof o.readText === 'function' ? o.readText : defaultReadText;
+
+  const candidates = [];
+  const push = (value) => {
+    if (value && String(value).trim()) candidates.push(String(value).trim());
+  };
+
+  if (win32) {
+    const oneDrive = envValue(env, 'OneDrive', platform) || envValue(env, 'OneDriveConsumer', platform);
+    if (oneDrive) push(P.join(oneDrive, 'Desktop'));
+    if (home) push(P.join(home, 'OneDrive', 'Desktop'));
+    if (home) push(P.join(home, 'Desktop'));
+  } else if (platform === 'darwin') {
+    if (home) push(P.join(home, 'Desktop'));
+  } else {
+    push(envValue(env, 'XDG_DESKTOP_DIR', platform));
+    // user-dirs.dirs holds lines like: XDG_DESKTOP_DIR="$HOME/Skrivbord"
+    if (home) {
+      const conf = readText(P.join(home, '.config', 'user-dirs.dirs'));
+      const match = conf && /^\s*XDG_DESKTOP_DIR\s*=\s*"?([^"\n]+)"?\s*$/m.exec(conf);
+      if (match) push(match[1].replace(/\$HOME\b|\${HOME}/g, home));
+    }
+    if (home) push(P.join(home, 'Desktop'));
+  }
+
+  for (const candidate of candidates) {
+    if (dirExists(candidate)) return candidate;
+  }
+  // Nothing on disk. The conventional path is still a better answer than '' for
+  // a machine whose Desktop simply has not been created yet — but only where the
+  // name is not localised, which is the one case we would be guessing at.
+  if (home && (win32 || platform === 'darwin')) return P.join(home, 'Desktop');
+  return '';
+}
+
+/** `C:\…` / `C:/…` — a drive-qualified Windows path. */
+const WIN_DRIVE_RE = /^[A-Za-z]:[\\/]/;
+/** `C:` with nothing after it — drive-relative, and never what a model means. */
+const WIN_BARE_DRIVE_RE = /^[A-Za-z]:$/;
+/** `\\server\share` — a UNC path, which IS absolute and stays allowed. */
+const WIN_UNC_RE = /^\\\\[^\\?.]/;
+
+/**
+ * Turn a path a MODEL produced into a path this machine really has.
+ *
+ *   { ok, path, error, expandedHome }
+ *
+ * Why this exists. The tool layer used to pass `file_path` straight to `fs`,
+ * which quietly made two very common model outputs write to the wrong place:
+ *
+ *   - `~/Desktop/notes.txt`. Node does not expand `~`; nothing in the tool
+ *     layer did either. `fs.mkdirSync(path.dirname(…))` therefore created a
+ *     directory literally NAMED `~` under the process cwd and wrote inside it —
+ *     and `writeFile` reported "Wrote 14 bytes to ~/Desktop/notes.txt", so the
+ *     model told the user it had saved a file to their Desktop that was not
+ *     there. A wrong write that reports success is worse than a refusal.
+ *   - `/home/user/Desktop/notes.txt` ON WINDOWS. A leading-slash path there is
+ *     relative to the current DRIVE, so that write succeeds — at
+ *     `C:\home\user\Desktop\notes.txt`. Same silent success, same missing file.
+ *     This is why the bug read as "the tools only work on Linux": on Linux a
+ *     model's posix guess happens to be right, and off Linux it is accepted
+ *     anyway. Windows is also where a model reaches for `~` most, because it
+ *     cannot guess `C:\Users\<name>` and the prompt only names the home dir.
+ *
+ * So: `~` and `~/…` are expanded (`~other/…` is refused — another user's home
+ * is not ours to guess), a path that is absolute for a DIFFERENT OS than this
+ * one is refused with the correct form named, a relative path resolves against
+ * `cwd`, and anything already native is normalised. A refusal is the useful
+ * outcome: the model gets the real home directory back in the error and retries
+ * correctly in the next round, where before it got "success" and stopped.
+ *
+ * Idempotent — the output of one call is unchanged by the next — so a caller
+ * may normalise early (before a guard inspects the path) without worrying that
+ * a later layer will resolve it a second time.
+ *
+ * Path SEMANTICS follow the `platform` asked about, not the host, exactly as in
+ * `resolveExecutable` above: that is what lets test/platform.test.mjs prove the
+ * win32 branch on this Linux CI.
+ */
+function resolvePath(input, options = {}) {
+  const { platform, win32, o } = seams(options);
+  const P = win32 ? path.win32 : path.posix;
+  const refuse = (error) => ({ ok: false, path: null, error, expandedHome: false });
+
+  if (typeof input !== 'string' || !input.trim()) {
+    return refuse(`a path is required (got ${JSON.stringify(input)})`);
+  }
+  const raw = input.trim();
+
+  // ── the home shorthand ────────────────────────────────────────────────────
+  let work = raw;
+  let expandedHome = false;
+  const tildeRoot = raw === '~' || raw.startsWith('~/') || (win32 && raw.startsWith('~\\'));
+  if (tildeRoot) {
+    const home = homeDir(options);
+    if (!home) {
+      return refuse(
+        `cannot expand "~" in ${JSON.stringify(raw)}: this machine reports no home directory. ` +
+          'Pass a full absolute path instead.',
+      );
+    }
+    work = raw === '~' ? home : P.join(home, raw.slice(2));
+    expandedHome = true;
+  } else if (raw.startsWith('~')) {
+    return refuse(
+      `${JSON.stringify(raw)} names another user's home directory, which cannot be resolved from ` +
+        'here. Use "~" for this user, or pass a full absolute path.',
+    );
+  }
+
+  // ── absolute-for-the-wrong-OS ─────────────────────────────────────────────
+  // Skipped after a `~` expansion: that result is native by construction.
+  if (!expandedHome) {
+    const home = homeDir(options);
+    const hint = home ? ` This machine's home directory is ${home}.` : '';
+    if (win32) {
+      // A leading slash on Windows is drive-relative, not absolute. Accepted
+      // only as a UNC share, which genuinely is absolute.
+      if ((work.startsWith('/') || work.startsWith('\\')) && !WIN_UNC_RE.test(work)) {
+        return refuse(
+          `${JSON.stringify(raw)} is not an absolute path on this machine, which runs ${platform}. ` +
+            `A leading slash here means "the root of the current drive", so writing to it would ` +
+            `silently land somewhere other than where you meant. Use a drive-qualified path ` +
+            `(C:\\Users\\you\\Desktop\\file.txt) or "~/…".${hint}`,
+        );
+      }
+    } else if (WIN_DRIVE_RE.test(work) || WIN_BARE_DRIVE_RE.test(work) || WIN_UNC_RE.test(work)) {
+      return refuse(
+        `${JSON.stringify(raw)} is a Windows path, but this machine runs ${platform}. ` +
+          `Use a posix path (/home/you/file.txt) or "~/…".${hint}`,
+      );
+    }
+  }
+
+  // ── relative → the working directory ──────────────────────────────────────
+  const cwd = typeof o.cwd === 'string' && o.cwd.trim() ? o.cwd.trim() : process.cwd();
+  const resolved = P.isAbsolute(work) ? P.resolve(work) : P.resolve(cwd, work);
+
+  // `P.resolve` falls back to the HOST's cwd when nothing it was given is
+  // absolute, which on a foreign-platform query yields a path of the wrong
+  // shape. Say so rather than hand back something unusable.
+  if (!P.isAbsolute(resolved)) {
+    return refuse(
+      `${JSON.stringify(raw)} is relative and the working directory (${JSON.stringify(cwd)}) is ` +
+        'not absolute, so it cannot be resolved. Pass an absolute path.',
+    );
+  }
+
+  return { ok: true, path: resolved, error: null, expandedHome };
+}
+
 const api = {
   IS_WIN32,
   resolveExecutable,
@@ -405,6 +660,10 @@ const api = {
   killTree,
   isAlive,
   hasDisplay,
+  homeDir,
+  desktopDir,
+  resolvePath,
+  hasPosixModes,
 };
 
 module.exports = api;