aigent-hive 0.13.2-test.2 → 0.14.0-test.1

package/install.cmd

@@ -1,6 +1,6 @@
 @echo off
 setlocal EnableExtensions DisableDelayedExpansion
-set "HIVE_INSTALL_PACKAGE_VERSION=0.13.2-test.2"
+set "HIVE_INSTALL_PACKAGE_VERSION=0.14.0-test.1"
 set "HIVE_INSTALL_URL=https://unpkg.com/aigent-hive@%HIVE_INSTALL_PACKAGE_VERSION%/install.ps1"
 set "HIVE_INSTALL_SCRIPT=%TEMP%\aigent-hive-install-%RANDOM%-%RANDOM%.ps1"
 

package/install.ps1

@@ -1,14 +1,15 @@
 param(
     [ValidatePattern('^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$')]
-    [string]$Version = "0.13.2",
+    [string]$Version = "0.14.0",
     [ValidatePattern('^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-test(\.[1-9][0-9]*)?)?$')]
-    [string]$PackageVersion = "0.13.2-test.2",
-    [string]$Prefix = "$env:LOCALAPPDATA\AigentHive"
+    [string]$PackageVersion = "0.14.0-test.1",
+    [string]$Prefix = "$env:LOCALAPPDATA\AigentHive",
+    [switch]$DeferLockedBackup
 )
 
 $ErrorActionPreference = "Stop"
 $AuthorizedSignerThumbprint = ""
-$ExpectedArchiveSha256 = "3094364940f6d85d6a63aaad349c9180a0d2bb17fab3807369f5db5a7c2b0198"
+$ExpectedArchiveSha256 = "a9c8d30b08748e6ffec2146155b47908cb680182814006c42367806856f422bc"
 if ($AuthorizedSignerThumbprint -like "__AIGENT_HIVE_*") {
     $AuthorizedSignerThumbprint = ""
 }
@@ -110,7 +111,7 @@ function Assert-SafeDirectoryChain {
         if ($component -eq "." -or $component -eq "..") {
             throw "install path contains a reparse point or non-directory"
         }
-        $currentPath = Join-Path $currentPath $component
+        $currentPath = [IO.Path]::Combine($currentPath, $component)
         $item = Get-Item -LiteralPath $currentPath -Force -ErrorAction SilentlyContinue
         if ($null -eq $item) {
             New-Item -ItemType Directory -Path $currentPath -ErrorAction Stop | Out-Null
@@ -209,6 +210,33 @@ function Assert-ExistingDirectInstall {
     }
 }
 
+function New-DirectReplacementRecord {
+    param([string]$Destination,[string]$Backup,[string]$BeforeDigest,[string]$AfterDigest,[string]$Package,[string]$Identity)
+    if ($Identity -notmatch '^sha256:[0-9a-f]{64}$') { throw 'direct replacement prefix identity is missing' }
+    $prefixPath = Split-Path -Parent (Split-Path -Parent $Destination)
+    $sharePath = [IO.Path]::Combine($prefixPath, 'share\aigent-hive')
+    Assert-SafeDirectoryChain -Path $sharePath
+    $previous = Get-ValidatedDirectReceipt -ReceiptPath ([IO.Path]::Combine($sharePath, 'install-receipt.json'))
+    if ((Split-Path -Leaf $Destination) -ne 'hive.exe' -or $previous.artifact_sha256 -ne "sha256:$BeforeDigest") {
+        throw 'retired image does not match the owned direct installation'
+    }
+    $recordPath = [IO.Path]::Combine($sharePath, 'replacement-pending.json')
+    if (Test-Path -LiteralPath $recordPath) { throw 'finish the previous replacement with hive update first' }
+    $temporary = [IO.Path]::Combine($sharePath, ('.replacement-record-' + [Guid]::NewGuid().ToString('N')))
+    $bytes = [Text.UTF8Encoding]::new($false).GetBytes((@{
+        schema_version=1; prefix_identity=$Identity; backup_name=(Split-Path -Leaf $Backup)
+        before_sha256="sha256:$BeforeDigest"; after_sha256="sha256:$AfterDigest"
+        before_package_version=$previous.package_version; after_package_version=$Package
+    } | ConvertTo-Json -Compress))
+    try {
+        $stream=[IO.File]::Open($temporary,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+        try { $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
+        Move-InstallFile -Source $temporary -Destination $recordPath -Replace $false
+    } finally {
+        if(Test-Path -LiteralPath $temporary){Remove-Item -LiteralPath $temporary -Force}
+    }
+}
+
 function Move-InstallFile {
     param(
         [Parameter(Mandatory = $true)]
@@ -216,7 +244,9 @@ function Move-InstallFile {
         [Parameter(Mandatory = $true)]
         [string]$Destination,
         [Parameter(Mandatory = $true)]
-        [bool]$Replace
+        [bool]$Replace,
+        [string]$DeferredPackageVersion = '',
+        [string]$DeferredPrefixIdentity = ''
     )
 
     $sourceItem = Get-Item -LiteralPath $Source -Force -ErrorAction Stop
@@ -237,10 +267,26 @@ function Move-InstallFile {
         throw "install file target is not a regular leaf"
     }
     if ($Replace -and $null -ne $destinationItem) {
+        $deferred = $DeferredPackageVersion -ne ''
+        if ($deferred) {
+            if ((Split-Path -Leaf $Destination) -ne 'hive.exe' -or
+                (Split-Path -Leaf (Split-Path -Parent $Destination)) -ne 'bin') {
+                throw 'deferred replacement must target the owned bin/hive.exe'
+            }
+            $beforeDigest=Get-FileSha256 -Path $Destination
+            $afterDigest=Get-FileSha256 -Path $Source
+            if ($beforeDigest -eq $afterDigest) {
+                throw 'deferred replacement requires different verified program bytes'
+            }
+        }
         $destinationDirectory = Split-Path -Parent $Destination
-        $backup = Join-Path $destinationDirectory (
+        $backup = [IO.Path]::Combine($destinationDirectory, (
             ".hive-replace-backup-" + [Guid]::NewGuid().ToString("N")
-        )
+        ))
+        if ($deferred) {
+            New-DirectReplacementRecord -Destination $Destination -Backup $backup `
+                -BeforeDigest $beforeDigest -AfterDigest $afterDigest -Package $DeferredPackageVersion -Identity $DeferredPrefixIdentity
+        }
         [IO.File]::Replace($Source, $Destination, $backup)
         $backupItem = Get-Item -LiteralPath $backup -Force -ErrorAction Stop
         if (
@@ -249,7 +295,12 @@ function Move-InstallFile {
         ) {
             throw "install replacement backup is not a regular leaf"
         }
-        Remove-Item -LiteralPath $backup -Force
+        try { Remove-Item -LiteralPath $backup -Force }
+        catch [UnauthorizedAccessException] {
+            if (-not $deferred) { throw }
+            # The exact recorded image is removed after its caller exits.
+            # Do not turn any other filesystem failure into success.
+        }
     } else {
         [IO.File]::Move($Source, $Destination)
     }
@@ -338,15 +389,90 @@ function Assert-AuthorizedAuthenticodeSignature {
     }
 }
 
+function Publish-DirectInstall {
+    param([string]$Binary,[string]$Prefix,[string]$Version,[string]$PackageVersion,[switch]$DeferLockedBackup)
+    $stagedBinary=$null; $stagedReceipt=$null; $receiptStream=$null
+    try {
+        $binDirectory = [IO.Path]::Combine($Prefix, 'bin')
+        $shareDirectory = [IO.Path]::Combine($Prefix, 'share\aigent-hive')
+        Assert-SafeDirectoryChain -Path $Prefix
+        Assert-SafeDirectoryChain -Path $binDirectory
+        Assert-SafeDirectoryChain -Path $shareDirectory
+        $destination = [IO.Path]::Combine($binDirectory, 'hive.exe')
+        $receiptPath = [IO.Path]::Combine($shareDirectory, 'install-receipt.json')
+        $pendingReceiptPath = [IO.Path]::Combine($shareDirectory, 'install-receipt.pending.json')
+        if (Test-Path -LiteralPath ([IO.Path]::Combine($shareDirectory, 'replacement-pending.json'))) {
+            throw 'finish the previous replacement with hive update first'
+        }
+        Repair-PendingDirectInstall -Destination $destination -ReceiptPath $receiptPath -PendingReceiptPath $pendingReceiptPath
+        Assert-ExistingDirectInstall -Destination $destination -ReceiptPath $receiptPath
+        $stagedBinary = [IO.Path]::Combine($binDirectory, ('.hive-install-' + [Guid]::NewGuid()))
+        $stagedReceipt = [IO.Path]::Combine($shareDirectory, ('.install-receipt-' + [Guid]::NewGuid()))
+        Assert-SafeDirectoryChain -Path $binDirectory
+        Assert-SafeDirectoryChain -Path $shareDirectory
+        [IO.File]::Copy($Binary, $stagedBinary, $false)
+        $binaryDigest = Get-FileSha256 -Path $Binary
+        $receiptJson = @{
+            schema_version = 1
+            owner = "direct"
+            product = "aigent-hive"
+            version = $Version
+            package_version = $PackageVersion
+            artifact_sha256 = "sha256:$binaryDigest"
+        } | ConvertTo-Json -Compress
+        $receiptBytes = [Text.UTF8Encoding]::new($false).GetBytes($receiptJson)
+        $receiptStream = [IO.File]::Open($stagedReceipt,[IO.FileMode]::CreateNew,[IO.FileAccess]::ReadWrite,
+            ([IO.FileShare]::ReadWrite -bor [IO.FileShare]::Delete))
+        $receiptStream.Lock(0, 1)
+        $receiptStream.Write($receiptBytes, 0, $receiptBytes.Length)
+        $receiptStream.Flush($true)
+        Assert-SafeDirectoryChain -Path $binDirectory
+        Assert-SafeDirectoryChain -Path $shareDirectory
+        if ($null -ne (Get-Item -LiteralPath $pendingReceiptPath -Force -ErrorAction SilentlyContinue)) {
+            throw 'existing hive install transaction is not recoverable'
+        }
+        Move-InstallFile -Source $stagedReceipt -Destination $pendingReceiptPath -Replace $false
+        $stagedReceipt = $null
+        Assert-SafeDirectoryChain -Path $binDirectory
+        Assert-SafeDirectoryChain -Path $shareDirectory
+        $deferredPackage = if ($DeferLockedBackup) { $PackageVersion } else { '' }
+        $deferredIdentity = ''
+        if ($DeferLockedBackup) {
+            $scopeOutput = & $Binary __direct-install-scope --prefix $Prefix
+            if ($LASTEXITCODE -ne 0) { throw 'cannot bind the direct replacement prefix' }
+            $deferredIdentity = ($scopeOutput | ConvertFrom-Json).prefix_identity
+        }
+        Move-InstallFile -Source $stagedBinary -Destination $destination -Replace $true `
+            -DeferredPackageVersion $deferredPackage -DeferredPrefixIdentity $deferredIdentity
+        $stagedBinary = $null
+        Assert-SafeDirectoryChain -Path $binDirectory
+        Assert-SafeDirectoryChain -Path $shareDirectory
+        # Keep the pending receipt locked until publication and removal finish.
+        # ReplaceFile cannot consume that locked stream, so publish the same bytes from a closed copy.
+        $stagedReceipt = [IO.Path]::Combine($shareDirectory, ('.install-receipt-final-' + [Guid]::NewGuid()))
+        $finalStream=[IO.File]::Open($stagedReceipt,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+        try { $finalStream.Write($receiptBytes,0,$receiptBytes.Length);$finalStream.Flush($true) } finally { $finalStream.Dispose() }
+        Move-InstallFile -Source $stagedReceipt -Destination $receiptPath -Replace $true
+        $stagedReceipt = $null
+        [IO.File]::Delete($pendingReceiptPath)
+        Write-Output "installed hive $Version to $binDirectory\hive.exe"
+    } finally {
+        if ($null -ne $receiptStream) { $receiptStream.Dispose() }
+        foreach ($stagedPath in @($stagedBinary, $stagedReceipt)) {
+            if ($null -ne $stagedPath -and (Test-Path -LiteralPath $stagedPath)) {
+                Remove-Item -LiteralPath $stagedPath -Force
+            }
+        }
+    }
+}
+
 $npmPackage = "win32-x64"
 $archive = "$npmPackage-$PackageVersion.tgz"
 $base = "https://registry.npmjs.org/@aigent-hive/$npmPackage/-"
-$work = Join-Path ([IO.Path]::GetTempPath()) ("aigent-hive-install-" + [Guid]::NewGuid())
+$work = [IO.Path]::Combine([IO.Path]::GetTempPath(), ("aigent-hive-install-" + [Guid]::NewGuid()))
 New-Item -ItemType Directory -Path $work | Out-Null
-$stagedBinary = $null
-$stagedReceipt = $null
 try {
-    $archivePath = Join-Path $work $archive
+    $archivePath = [IO.Path]::Combine($work, $archive)
     Invoke-WebRequest -UseBasicParsing -Uri "$base/$archive" -OutFile $archivePath
     $actual = Get-FileSha256 -Path $archivePath
     if ($ExpectedArchiveSha256 -ne $actual) {
@@ -386,7 +512,7 @@ try {
     if ($LASTEXITCODE -ne 0) {
         throw "release archive could not be extracted"
     }
-    $binary = Join-Path $work "package\bin\hive.exe"
+    $binary = [IO.Path]::Combine($work, "package\bin\hive.exe")
     if ($AuthorizedSignerThumbprint -ne "") {
         $signature = Get-AuthenticodeSignature -LiteralPath $binary
         Assert-AuthorizedAuthenticodeSignature `
@@ -401,79 +527,10 @@ try {
         throw "signed binary version differs from requested release"
     }
 
-    $binDirectory = Join-Path $Prefix "bin"
-    $shareDirectory = Join-Path $Prefix "share\aigent-hive"
-    Assert-SafeDirectoryChain -Path $Prefix
-    Assert-SafeDirectoryChain -Path $binDirectory
-    Assert-SafeDirectoryChain -Path $shareDirectory
-    $destination = Join-Path $binDirectory "hive.exe"
-    $receiptPath = Join-Path $shareDirectory "install-receipt.json"
-    $pendingReceiptPath = Join-Path $shareDirectory "install-receipt.pending.json"
-    Repair-PendingDirectInstall `
-        -Destination $destination `
-        -ReceiptPath $receiptPath `
-        -PendingReceiptPath $pendingReceiptPath
-    Assert-ExistingDirectInstall -Destination $destination -ReceiptPath $receiptPath
-    $stagedBinary = Join-Path $binDirectory (".hive-install-" + [Guid]::NewGuid())
-    $stagedReceipt = Join-Path $shareDirectory (".install-receipt-" + [Guid]::NewGuid())
-    Assert-SafeDirectoryChain -Path $binDirectory
-    Assert-SafeDirectoryChain -Path $shareDirectory
-    [IO.File]::Copy($binary, $stagedBinary, $false)
-    $binaryDigest = Get-FileSha256 -Path $binary
-    $receiptJson = @{
-        schema_version = 1
-        owner = "direct"
-        product = "aigent-hive"
-        version = $Version
-        package_version = $PackageVersion
-        artifact_sha256 = "sha256:$binaryDigest"
-    } | ConvertTo-Json -Compress
-    $receiptBytes = [Text.UTF8Encoding]::new($false).GetBytes($receiptJson)
-    $receiptStream = [IO.File]::Open(
-        $stagedReceipt,
-        [IO.FileMode]::CreateNew,
-        [IO.FileAccess]::Write,
-        [IO.FileShare]::None
-    )
-    try {
-        $receiptStream.Write($receiptBytes, 0, $receiptBytes.Length)
-    }
-    finally {
-        $receiptStream.Dispose()
-    }
-    Assert-SafeDirectoryChain -Path $binDirectory
-    Assert-SafeDirectoryChain -Path $shareDirectory
-    if ($null -ne (
-        Get-Item -LiteralPath $pendingReceiptPath -Force -ErrorAction SilentlyContinue
-    )) {
-        throw "existing hive install transaction is not recoverable"
-    }
-    Move-InstallFile `
-        -Source $stagedReceipt `
-        -Destination $pendingReceiptPath `
-        -Replace $false
-    $stagedReceipt = $null
-    Assert-SafeDirectoryChain -Path $binDirectory
-    Assert-SafeDirectoryChain -Path $shareDirectory
-    Move-InstallFile `
-        -Source $stagedBinary `
-        -Destination $destination `
-        -Replace $true
-    $stagedBinary = $null
-    Assert-SafeDirectoryChain -Path $binDirectory
-    Assert-SafeDirectoryChain -Path $shareDirectory
-    Move-InstallFile `
-        -Source $pendingReceiptPath `
-        -Destination $receiptPath `
-        -Replace $true
-    Write-Output "installed hive $Version to $binDirectory\hive.exe"
+    Publish-DirectInstall -Binary $binary -Prefix $Prefix -Version $Version `
+        -PackageVersion $PackageVersion -DeferLockedBackup:$DeferLockedBackup
 }
 finally {
-    foreach ($stagedPath in @($stagedBinary, $stagedReceipt)) {
-        if ($null -ne $stagedPath -and (Test-Path -LiteralPath $stagedPath)) {
-            Remove-Item -LiteralPath $stagedPath -Force
-        }
-    }
     if (Test-Path -LiteralPath $work) {
         Remove-Item -LiteralPath $work -Recurse -Force
     }

package/install.sh

@@ -1,16 +1,16 @@
 #!/bin/sh
 set -eu
 
-embedded_product_version='0.13.2'
-embedded_package_version='0.13.2-test.2'
+embedded_product_version='0.14.0'
+embedded_package_version='0.14.0-test.1'
 version=${AIGENT_HIVE_VERSION:-$embedded_product_version}
 package_version=${AIGENT_HIVE_PACKAGE_VERSION:-$embedded_package_version}
 prefix=${AIGENT_HIVE_PREFIX:-"${HOME:?HOME is required}/.local"}
 authorized_team_id=''
-sha_aarch64_apple_darwin='574c667885808a849fefe6e27fd67f202424dad55f1b7b809112f785c1b02112'
-sha_x86_64_apple_darwin='a9eae4f2a1f1758378d03eff5fb5517e4d6c2175b1a5515854a49aad18d7631a'
-sha_aarch64_linux_musl='27f451fc7361e90ce566ac592a3d625874332e20a56f29c8c476f1543d782349'
-sha_x86_64_linux_musl='13ced41f3f49747a7c7b60fb9eea319a6577dc9fb2eaca3ee1cdfe3ed9b223fd'
+sha_aarch64_apple_darwin='7f67a68ba25daae8b85bd9f1688dc7b009a83566212ff02fcc6314b8ff27a020'
+sha_x86_64_apple_darwin='88441766c9b162323babaa73074c7edbd5b5626d0a5fb5686d6acdec5d0c82e0'
+sha_aarch64_linux_musl='3457754ed8cdc4130587f2e2a6a5823d9d84eb747cb1ad934132547f3ba56d6f'
+sha_x86_64_linux_musl='6132e080eab9ae4567aa28f8c30033fb8ffd97a533468b080a80be2cc085885a'
 
 if ! printf '%s\n' "$version" | awk -F. '
   NF != 3 { exit 1 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "aigent-hive",
-  "version": "0.13.2-test.2",
+  "version": "0.14.0-test.1",
   "aigentHive": {
-    "productVersion": "0.13.2"
+    "productVersion": "0.14.0"
   },
   "description": "Provider-neutral local agent harness for subscription-authenticated hosts",
   "license": "Apache-2.0",
@@ -31,10 +31,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@aigent-hive/darwin-arm64": "0.13.2-test.2",
-    "@aigent-hive/darwin-x64": "0.13.2-test.2",
-    "@aigent-hive/linux-arm64": "0.13.2-test.2",
-    "@aigent-hive/linux-x64": "0.13.2-test.2",
-    "@aigent-hive/win32-x64": "0.13.2-test.2"
+    "@aigent-hive/darwin-arm64": "0.14.0-test.1",
+    "@aigent-hive/darwin-x64": "0.14.0-test.1",
+    "@aigent-hive/linux-arm64": "0.14.0-test.1",
+    "@aigent-hive/linux-x64": "0.14.0-test.1",
+    "@aigent-hive/win32-x64": "0.14.0-test.1"
   }
 }