agenshield 2026.7.23 → 2026.7.24-alpha.30205346

package/bin/install.sh

@@ -52,6 +52,15 @@ set -e
 GITHUB_REPO="${AGENSHIELD_GITHUB_REPO:-agen-co/agenshield}"
 CLI_BINARY="agenshield"
 
+# System log dir + the two files this script touches. MUST stay in sync with
+# SYSTEM_LOG_DIR / INSTALL_LOG_PATH / INSTALLER_LOG_PATH in
+# libs/shield-ipc/src/constants.ts. INSTALL_LOG is the .pkg pre/postinstall's
+# own tee target (we only read + truncate it, to drive the live progress tail);
+# INSTALLER_LOG is this script's capture of `installer(8)` output.
+AGENSHIELD_LOG_DIR="/var/log/agenshield"
+INSTALL_LOG="$AGENSHIELD_LOG_DIR/install.log"
+INSTALLER_LOG="$AGENSHIELD_LOG_DIR/installer.log"
+
 # First-party CDN base URL, baked at npm-prepare time by tools/build/npm-prepare.mts
 # from AGENSHIELD_CDN_BASE_URL (e.g. https://assets.frontegg.com/agenshield). When
 # set, this installer resolves + downloads CDN-first with GitHub Releases as the
@@ -105,6 +114,16 @@ else
 fi
 die()   { error "$1"; exit 1; }
 step()  { printf "\n${BOLD}${CYAN}▸${RESET} ${BOLD}%s${RESET}\n" "$1"; }
+# Create the system log dir before we truncate/tail anything inside it. The
+# .pkg preinstall creates it too, but that runs LATER — this script truncates
+# $INSTALLER_LOG before `installer(8)` is even invoked. 0755 so the desktop's
+# fallback diagnostics collector (host user) can read the results. Best-effort:
+# a failure here must never block an install.
+ensure_log_dir() {
+  sudo mkdir -p "$AGENSHIELD_LOG_DIR" 2>/dev/null || return 0
+  sudo chown root:wheel "$AGENSHIELD_LOG_DIR" 2>/dev/null || true
+  sudo chmod 755 "$AGENSHIELD_LOG_DIR" 2>/dev/null || true
+}
 # Transport/source detail (CDN vs GitHub, per-source retries) stays OUT of the
 # standard output (docs/architecture/install-lifecycle.md#transport-hiding) — opt in with
 # AGENSHIELD_INSTALL_VERBOSE=1. Total-failure errors still name every source.
@@ -532,17 +551,17 @@ EEOF
         else
           step "Installing AgenShield (sudo password may be required)"
         fi
-        INSTALLER_LOG=/var/log/agenshield-installer.log
         if ! sudo -v; then
           die "Administrator rights are required to install AgenShield."
         fi
+        ensure_log_dir
         INSTALL_RC=0
         if sudo -n true 2>/dev/null; then
           # Truncate BOTH logs up front: installer.log is this run's capture,
           # and install.log (the postinstall's tee target) feeds the live
           # 2-line progress tail below — stale lines from a prior run must
           # not appear under this run's spinner.
-          sudo -n sh -c ": > '$INSTALLER_LOG'; : > /var/log/agenshield-install.log; installer -verbose -pkg '$TMPDIR_INSTALL/$PKG_NAME' -target / >> '$INSTALLER_LOG' 2>&1" &
+          sudo -n sh -c ": > '$INSTALLER_LOG'; : > '$INSTALL_LOG'; installer -verbose -pkg '$TMPDIR_INSTALL/$PKG_NAME' -target / >> '$INSTALLER_LOG' 2>&1" &
           INSTALLER_PID=$!
           # Braille spinner + a rolling 2-line dim tail of the postinstall's
           # own step lines — live progress instead of a dead prompt.
@@ -556,7 +575,7 @@ EEOF
               0) SPIN_CH='⠋';; 1) SPIN_CH='⠙';; 2) SPIN_CH='⠹';; 3) SPIN_CH='⠸';; 4) SPIN_CH='⠼';;
               5) SPIN_CH='⠴';; 6) SPIN_CH='⠦';; 7) SPIN_CH='⠧';; 8) SPIN_CH='⠇';; *) SPIN_CH='⠏';;
             esac
-            TAIL_TXT=$(tail -n 2 /var/log/agenshield-install.log 2>/dev/null | tr -d '\r' | cut -c1-"$TAIL_MAXW")
+            TAIL_TXT=$(tail -n 2 "$INSTALL_LOG" 2>/dev/null | tr -d '\r' | cut -c1-"$TAIL_MAXW")
             if [ "$DRAWN" -gt 0 ]; then
               printf '\033[%dA\r\033[0J' "$DRAWN" >/dev/tty 2>/dev/null || true
             fi
@@ -593,8 +612,8 @@ TAILEOF
           sudo tail -n 25 "$INSTALLER_LOG" 2>/dev/null | sed 's/^/  │ /' >&2 || true
           # See the headless branch: the postinstall log's last line is the
           # step that died; the installer log only shows pkg phases.
-          error "Postinstall progress — last 15 lines of /var/log/agenshield-install.log:"
-          sudo tail -n 15 /var/log/agenshield-install.log 2>/dev/null | sed 's/^/  │ /' >&2 || true
+          error "Postinstall progress — last 15 lines of $INSTALL_LOG:"
+          sudo tail -n 15 "$INSTALL_LOG" 2>/dev/null | sed 's/^/  │ /' >&2 || true
           exit 1
         fi
 
@@ -610,16 +629,17 @@ TAILEOF
       else
         # Non-interactive (MDM/scripted): use command-line installer
         step "Installing package (headless)"
+        ensure_log_dir
 
         # Show live postinstall progress by tailing the install log
-        sudo pkill -f "tail -F /var/log/agenshield-install.log" 2>/dev/null || true
-        sudo truncate -s 0 /var/log/agenshield-install.log 2>/dev/null || \
-          sudo sh -c 'echo -n "" > /var/log/agenshield-install.log' 2>/dev/null || true
-        sudo tail -F /var/log/agenshield-install.log 2>/dev/null | sed 's/^/  │ /' &
+        sudo pkill -f "tail -F $INSTALL_LOG" 2>/dev/null || true
+        sudo truncate -s 0 "$INSTALL_LOG" 2>/dev/null || \
+          sudo sh -c "echo -n '' > '$INSTALL_LOG'" 2>/dev/null || true
+        sudo tail -F "$INSTALL_LOG" 2>/dev/null | sed 's/^/  │ /' &
         TAIL_PID=$!
         _cleanup_tail() {
           sudo pkill -P $$ 2>/dev/null || true
-          sudo pkill -f "tail -F /var/log/agenshield-install.log" 2>/dev/null || true
+          sudo pkill -f "tail -F $INSTALL_LOG" 2>/dev/null || true
         }
         trap '_cleanup_tail; rm -rf "$TMPDIR_INSTALL"' EXIT INT TERM
 
@@ -629,7 +649,6 @@ TAILEOF
         # via the log-tail above. NB: the installer exit code is now CHECKED —
         # previously a FAILED install fell through and still printed "Package
         # installed", hiding the real error.
-        INSTALLER_LOG=/var/log/agenshield-installer.log
         # Run the installer AND its log redirect inside a single ROOT shell. A plain
         # `sudo installer … >> "$INSTALLER_LOG"` would open the root-owned 0644 log
         # for append as the UNPRIVILEGED user → EACCES, failing the redirect (and the
@@ -648,8 +667,8 @@ TAILEOF
           # scripts…"). Script failures live in the POSTINSTALL log — its last
           # line is the step that died (an abrupt end with no error text means
           # a `set -e` abort on the next command after that line).
-          error "Postinstall progress — last 15 lines of /var/log/agenshield-install.log:"
-          sudo tail -n 15 /var/log/agenshield-install.log 2>/dev/null | sed 's/^/  │ /' >&2 || true
+          error "Postinstall progress — last 15 lines of $INSTALL_LOG:"
+          sudo tail -n 15 "$INSTALL_LOG" 2>/dev/null | sed 's/^/  │ /' >&2 || true
           rm -rf "$TMPDIR_INSTALL"
           exit 1
         fi
@@ -683,7 +702,7 @@ TAILEOF
         printf "  ${BOLD}If macOS prompts, approve the system extension:${RESET}\n"
         printf "     ${DIM}System Settings → General → Login Items & Extensions${RESET}\n"
         printf "  Installation directory: ${DIM}/Library/AgenShield/${RESET}\n"
-        printf "  Install log: ${DIM}/var/log/agenshield-installer.log${RESET}\n"
+        printf "  Install log: ${DIM}$INSTALLER_LOG${RESET}\n"
         printf "  Dashboard: ${CYAN}http://localhost:5200${RESET}\n"
         printf "  ${BOLD}Sign in${RESET} from the AgenShield menubar to link your account.\n\n"
         exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenshield",
-  "version": "2026.7.23",
+  "version": "2026.7.24-alpha.30205346",
   "description": "AgenShield — AI Agent Security Platform",
   "bin": {
     "agenshield": "bin/agenshield"