blun-king-cli 9.1.60 → 9.1.62

package/bin/running-update.cjs

@@ -0,0 +1,389 @@
+'use strict';
+
+const { createHash, randomUUID } = require('node:crypto');
+const fs = require('node:fs');
+const https = require('node:https');
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+
+const { compareSemver, requestTrustedJson } = require('./update-notice');
+const { ensurePrivateDirectory, securePrivateFile, writePrivateFile } = require('./private-paths');
+
+const PACKAGE_NAME = 'blun-king-cli';
+const MANIFEST_URL = 'https://chat.blun.ai/blun-code-version.json';
+const REGISTRY_URL = 'https://registry.npmjs.org/blun-king-cli';
+const ACTIVE_RUNTIME_FILE = 'active-runtime.json';
+const RUNNING_UPDATE_HANDOFF_EXIT_CODE = 76;
+const RUNNING_UPDATE_PREPARED_MESSAGE = 'blun-running-update-prepared';
+const RUNNING_UPDATE_HANDOFF_MESSAGE = 'blun-running-update-handoff';
+const RUNTIME_READY_MESSAGE = 'blun-runtime-session-ready';
+const MAX_TARBALL_BYTES = 128 * 1024 * 1024;
+
+function ownData(value, key) {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor && Object.hasOwn(descriptor, 'value') ? descriptor.value : undefined;
+}
+
+function validIntegrity(value) {
+  if (typeof value !== 'string') return false;
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/u.exec(value);
+  if (!match) return false;
+  try {
+    return Buffer.from(match[1], 'base64').length === 64;
+  } catch {
+    return false;
+  }
+}
+
+function selectRunningUpdateTarget(currentVersion, manifest) {
+  const name = ownData(manifest, 'name');
+  const version = ownData(manifest, 'latest');
+  const integrity = ownData(manifest, 'integrity');
+  const releasedAt = ownData(manifest, 'releasedAt');
+  if (name !== PACKAGE_NAME
+    || typeof version !== 'string'
+    || compareSemver(currentVersion, version) !== -1
+    || !validIntegrity(integrity)
+    || typeof releasedAt !== 'string'
+    || !Number.isFinite(Date.parse(releasedAt))) {
+    return null;
+  }
+  return Object.freeze({ version, integrity });
+}
+
+function isSafeRuntimeBoundary(state) {
+  return state?.isShuttingDown === false
+    && state.streamingPhase === 'idle'
+    && state.isCompacting === false
+    && state.queuedMessages === 0
+    && state.activeToolCalls === 0
+    && state.shellCommands === 0
+    && state.queueCommandRunning === false;
+}
+
+function resumeArgsForHandoff(args, sessionId) {
+  const filtered = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === '-c' || arg === '--continue') continue;
+    if (arg === '-r' || arg === '--resume' || arg === '--session') {
+      index += 1;
+      continue;
+    }
+    if (/^(?:--resume|--session)=/u.test(arg)) continue;
+    filtered.push(arg);
+  }
+  return [...filtered, '--resume', sessionId];
+}
+
+async function handoffRuntime(options) {
+  const handoffArgs = resumeArgsForHandoff(options.args, options.sessionId);
+  if (!await options.probeTarget(options.target)) {
+    return { kind: 'probe-failed', runtime: options.previous };
+  }
+  await options.stopOld();
+  const targetCore = await options.startCore({
+    packageRoot: options.target.packageRoot,
+    args: handoffArgs,
+  });
+  if (targetCore.ready === true) {
+    await options.activateTarget(options.target);
+    return { kind: 'activated', runtime: options.target, core: targetCore };
+  }
+  const fallbackCore = await options.startCore({
+    packageRoot: options.previous.packageRoot,
+    args: handoffArgs,
+  });
+  return { kind: 'rolled-back', runtime: options.previous, core: fallbackCore };
+}
+
+function releasesRoot(sharedHome) {
+  return path.join(path.resolve(sharedHome), 'updates', 'releases');
+}
+
+function activeRuntimePath(sharedHome) {
+  return path.join(path.resolve(sharedHome), 'updates', ACTIVE_RUNTIME_FILE);
+}
+
+function pathWithin(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === '' || (relative !== '..'
+    && !relative.startsWith(`..${path.sep}`)
+    && !path.isAbsolute(relative));
+}
+
+function verifyRuntimePackage(packageRoot, version, options = {}) {
+  try {
+    const root = path.resolve(packageRoot);
+    const allowedRoot = path.resolve(options.allowedRoot || releasesRoot(options.sharedHome));
+    if (!pathWithin(allowedRoot, root)) return false;
+    const manifestPath = path.join(root, 'package.json');
+    const bundlePath = path.join(root, 'blun.mjs');
+    const bootstrapPath = path.join(root, 'bin', 'core-bootstrap.js');
+    for (const filePath of [manifestPath, bundlePath, bootstrapPath]) {
+      const stat = fs.lstatSync(filePath);
+      if (!stat.isFile() || stat.isSymbolicLink()) return false;
+    }
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    return ownData(manifest, 'name') === PACKAGE_NAME && ownData(manifest, 'version') === version;
+  } catch {
+    return false;
+  }
+}
+
+function readActiveRuntime(sharedHome) {
+  try {
+    const filePath = activeRuntimePath(sharedHome);
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16 * 1024) return null;
+    const record = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    const version = ownData(record, 'version');
+    const packageRoot = ownData(record, 'packageRoot');
+    const integrity = ownData(record, 'integrity');
+    if (typeof version !== 'string'
+      || typeof packageRoot !== 'string'
+      || !path.isAbsolute(packageRoot)
+      || !validIntegrity(integrity)
+      || !verifyRuntimePackage(packageRoot, version, { sharedHome })) {
+      return null;
+    }
+    return Object.freeze({ version, packageRoot: path.resolve(packageRoot), integrity });
+  } catch {
+    return null;
+  }
+}
+
+function activateRuntime(sharedHome, target) {
+  if (!verifyRuntimePackage(target.packageRoot, target.version, { sharedHome })
+    || !validIntegrity(target.integrity)) {
+    throw new Error('RUNNING_UPDATE_TARGET_INVALID');
+  }
+  const updateRoot = path.join(path.resolve(sharedHome), 'updates');
+  ensurePrivateDirectory(path.resolve(sharedHome));
+  ensurePrivateDirectory(updateRoot);
+  const filePath = activeRuntimePath(sharedHome);
+  const temporaryPath = path.join(updateRoot, `.${ACTIVE_RUNTIME_FILE}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    writePrivateFile(temporaryPath, `${JSON.stringify({
+      version: target.version,
+      packageRoot: path.resolve(target.packageRoot),
+      integrity: target.integrity,
+      activatedAt: new Date().toISOString(),
+    })}\n`);
+    fs.renameSync(temporaryPath, filePath);
+    securePrivateFile(filePath);
+  } catch (error) {
+    fs.rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+}
+
+function registryRelease(registry, version) {
+  const versions = ownData(registry, 'versions');
+  const entry = ownData(versions, version);
+  const dist = ownData(entry, 'dist');
+  const integrity = ownData(dist, 'integrity');
+  const tarball = ownData(dist, 'tarball');
+  if (!validIntegrity(integrity) || typeof tarball !== 'string') return null;
+  let url;
+  try {
+    url = new URL(tarball);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== 'https:'
+    || url.hostname !== 'registry.npmjs.org'
+    || url.username !== ''
+    || url.password !== '') {
+    return null;
+  }
+  return { integrity, tarball: url.href };
+}
+
+function downloadTarball(url, destination, options = {}) {
+  const httpsImpl = options.httpsImpl || https;
+  return new Promise((resolve, reject) => {
+    const request = httpsImpl.get(url, {
+      headers: { 'user-agent': 'blun-king-running-update' },
+      timeout: options.timeoutMs || 30_000,
+    }, (response) => {
+      if (response.statusCode !== 200) {
+        response.resume();
+        reject(new Error(`RUNNING_UPDATE_DOWNLOAD_${String(response.statusCode)}`));
+        return;
+      }
+      let bytes = 0;
+      const handle = fs.openSync(destination, 'wx', 0o600);
+      let settled = false;
+      const fail = (error) => {
+        if (settled) return;
+        settled = true;
+        try { fs.closeSync(handle); } catch {}
+        fs.rmSync(destination, { force: true });
+        reject(error);
+      };
+      response.on('data', (chunk) => {
+        bytes += chunk.length;
+        if (bytes > MAX_TARBALL_BYTES) {
+          response.destroy(new Error('RUNNING_UPDATE_TARBALL_TOO_LARGE'));
+          return;
+        }
+        try {
+          fs.writeSync(handle, chunk);
+        } catch (error) {
+          response.destroy(error);
+        }
+      });
+      response.once('error', fail);
+      response.once('end', () => {
+        if (settled) return;
+        settled = true;
+        fs.fsyncSync(handle);
+        fs.closeSync(handle);
+        resolve();
+      });
+    });
+    request.once('timeout', () => request.destroy(new Error('RUNNING_UPDATE_DOWNLOAD_TIMEOUT')));
+    request.once('error', reject);
+  });
+}
+
+function resolveNpmCliPath(execPath = process.execPath) {
+  const executableDirectory = path.dirname(path.resolve(execPath));
+  const candidates = [
+    path.join(executableDirectory, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.resolve(executableDirectory, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.resolve(executableDirectory, '..', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.resolve(__dirname, '..', '..', 'npm', 'bin', 'npm-cli.js'),
+  ];
+  for (const candidate of candidates) {
+    try {
+      const resolved = fs.realpathSync(candidate);
+      if (fs.statSync(resolved).isFile() && path.basename(resolved) === 'npm-cli.js') return resolved;
+    } catch {}
+  }
+  throw new Error('TRUSTED_NPM_CLI_NOT_FOUND');
+}
+
+function runProcess(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = (options.spawnImpl || spawn)(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: options.stdio || 'ignore',
+      windowsHide: true,
+    });
+    child.once('error', reject);
+    child.once('exit', (code, signal) => {
+      if (code === 0) resolve();
+      else reject(new Error(`RUNNING_UPDATE_PROCESS_FAILED:${code ?? signal ?? 'unknown'}`));
+    });
+  });
+}
+
+async function defaultInstallTarball(tarballPath, installPrefix, options = {}) {
+  const npmCliPath = resolveNpmCliPath(options.execPath);
+  const env = {
+    ...process.env,
+    TEMP: installPrefix,
+    TMP: installPrefix,
+    TMPDIR: installPrefix,
+    npm_config_registry: 'https://registry.npmjs.org/',
+    npm_config_strict_ssl: 'true',
+  };
+  await runProcess(options.execPath || process.execPath, [
+    npmCliPath,
+    'install',
+    `--prefix=${installPrefix}`,
+    '--ignore-scripts=false',
+    '--package-lock=false',
+    '--audit=false',
+    '--fund=false',
+    tarballPath,
+  ], { cwd: installPrefix, env, spawnImpl: options.spawnImpl });
+}
+
+async function defaultProbeRuntime(packageRoot, options = {}) {
+  try {
+    await runProcess(options.execPath || process.execPath, ['--check', path.join(packageRoot, 'blun.mjs')], options);
+    await runProcess(options.execPath || process.execPath, ['--check', path.join(packageRoot, 'bin', 'core-bootstrap.js')], options);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function prepareRunningUpdate(options) {
+  if (String(options.env?.BLUN_NO_AUTO_UPDATE || '') === '1') return null;
+  const manifest = await (options.loadManifest
+    ? options.loadManifest()
+    : requestTrustedJson(MANIFEST_URL));
+  const target = selectRunningUpdateTarget(options.currentVersion, manifest);
+  if (target === null) return null;
+  const registry = await (options.loadRegistry
+    ? options.loadRegistry()
+    : requestTrustedJson(REGISTRY_URL));
+  const release = registryRelease(registry, target.version);
+  if (release === null || release.integrity !== target.integrity) {
+    throw new Error('RUNNING_UPDATE_INTEGRITY_SOURCE_MISMATCH');
+  }
+  const digest = createHash('sha256').update(target.integrity).digest('hex').slice(0, 16);
+  const releaseDirectory = path.join(releasesRoot(options.sharedHome), target.version, digest);
+  const packageRoot = path.join(releaseDirectory, 'node_modules', PACKAGE_NAME);
+  if (verifyRuntimePackage(packageRoot, target.version, { sharedHome: options.sharedHome })) {
+    return Object.freeze({ ...target, packageRoot });
+  }
+
+  const updateRoot = path.join(path.resolve(options.sharedHome), 'updates');
+  const stagingRoot = path.join(updateRoot, 'staging');
+  ensurePrivateDirectory(path.resolve(options.sharedHome));
+  ensurePrivateDirectory(updateRoot);
+  ensurePrivateDirectory(stagingRoot);
+  const temporaryRoot = fs.mkdtempSync(path.join(stagingRoot, 'runtime-'));
+  ensurePrivateDirectory(temporaryRoot);
+  const tarballPath = path.join(temporaryRoot, `${PACKAGE_NAME}.tgz`);
+  const installPrefix = path.join(temporaryRoot, 'install');
+  ensurePrivateDirectory(installPrefix);
+  try {
+    await (options.downloadTarball || downloadTarball)(release.tarball, tarballPath);
+    const actualIntegrity = `sha512-${createHash('sha512').update(fs.readFileSync(tarballPath)).digest('base64')}`;
+    if (actualIntegrity !== target.integrity) throw new Error('RUNNING_UPDATE_TARBALL_INTEGRITY_FAILED');
+    await (options.installTarball || defaultInstallTarball)(tarballPath, installPrefix, options);
+    const installedRoot = path.join(installPrefix, 'node_modules', PACKAGE_NAME);
+    if (!verifyRuntimePackage(installedRoot, target.version, { allowedRoot: installPrefix })) {
+      throw new Error('RUNNING_UPDATE_PACKAGE_INVALID');
+    }
+    if (!await (options.probeRuntime || defaultProbeRuntime)(installedRoot, options)) {
+      throw new Error('RUNNING_UPDATE_PROBE_FAILED');
+    }
+    ensurePrivateDirectory(releasesRoot(options.sharedHome));
+    ensurePrivateDirectory(path.dirname(releaseDirectory));
+    if (fs.existsSync(releaseDirectory)) fs.rmSync(releaseDirectory, { recursive: true, force: true });
+    fs.renameSync(installPrefix, releaseDirectory);
+    if (!verifyRuntimePackage(packageRoot, target.version, { sharedHome: options.sharedHome })) {
+      throw new Error('RUNNING_UPDATE_ACTIVATION_PACKAGE_INVALID');
+    }
+    return Object.freeze({ ...target, packageRoot });
+  } finally {
+    fs.rmSync(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+module.exports = {
+  ACTIVE_RUNTIME_FILE,
+  RUNNING_UPDATE_HANDOFF_EXIT_CODE,
+  RUNNING_UPDATE_HANDOFF_MESSAGE,
+  RUNNING_UPDATE_PREPARED_MESSAGE,
+  RUNTIME_READY_MESSAGE,
+  activateRuntime,
+  activeRuntimePath,
+  defaultProbeRuntime,
+  handoffRuntime,
+  isSafeRuntimeBoundary,
+  prepareRunningUpdate,
+  readActiveRuntime,
+  resumeArgsForHandoff,
+  selectRunningUpdateTarget,
+  verifyRuntimePackage,
+};

package/bin/update-notice.js

@@ -54,8 +54,18 @@ const LEGACY_MANIFEST_KEYS = Object.freeze([
   'notesUrl',
   'releasedAt',
 ]);
+const RELEASE_NOTES_MANIFEST_KEYS = Object.freeze([
+  'install',
+  'latest',
+  'minSupported',
+  'name',
+  'notesUrl',
+  'releaseNotes',
+  'releasedAt',
+]);
 const MANIFEST_KEYS = Object.freeze([
   'install',
+  'integrity',
   'latest',
   'minSupported',
   'name',
@@ -214,8 +224,20 @@ function parseReleaseNotes(value) {
   return Object.freeze(notes);
 }
 
+function validIntegrity(value) {
+  if (typeof value !== 'string') return false;
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/u.exec(value);
+  if (!match) return false;
+  try {
+    return Buffer.from(match[1], 'base64').length === 64;
+  } catch {
+    return false;
+  }
+}
+
 function parseFallbackManifest(value) {
   const record = exactDataRecord(value, MANIFEST_KEYS)
+    || exactDataRecord(value, RELEASE_NOTES_MANIFEST_KEYS)
     || exactDataRecord(value, LEGACY_MANIFEST_KEYS);
   const notesUrl = record ? canonicalOfficialNotesUrl(record.notesUrl) : undefined;
   const releaseNotes = record && Object.hasOwn(record, 'releaseNotes')
@@ -228,6 +250,7 @@ function parseFallbackManifest(value) {
     || compareSemver(record.minSupported, record.latest) === 1
     || !isIsoTimestamp(record.releasedAt)
     || !notesUrl
+    || (Object.hasOwn(record, 'integrity') && !validIntegrity(record.integrity))
     || (Object.hasOwn(record, 'releaseNotes') && releaseNotes === undefined)
     || !isBoundedText(record.install, 256)) {
     return undefined;
@@ -238,6 +261,7 @@ function parseFallbackManifest(value) {
     minSupported: record.minSupported,
     releasedAt: record.releasedAt,
     notesUrl,
+    ...(Object.hasOwn(record, 'integrity') ? { integrity: record.integrity } : {}),
     ...(releaseNotes === undefined ? {} : { releaseNotes }),
     install: record.install,
   });