blun-king-cli 9.1.615 → 9.1.616

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # BLUN King Changelog
 
+## 9.1.616
+
+- Nach einer bestätigten Telegram-Antwort übernimmt King weitere an dich adressierte Nachrichten am nächsten sicheren Schritt, auch während eines laufenden Zugs. Eine bereits zugestellte Antwort hält die Warteschlange nicht mehr auf. Antworten bleiben ihrem jeweiligen Chat zugeordnet.
+- Brichst du einen Zug ab, bleiben noch nicht übernommene Telegram-Nachrichten für die nächste Zustellung erhalten. King quittiert sie erst, wenn die Sitzung sie tatsächlich übernimmt.
+
 ## 9.1.615
 
 Große Werkzeugkataloge laufen jetzt über Kings vorhandene Werkzeugsuche, statt alle optionalen Werkzeugschemata auf einmal an das Modell zu senden. Meldet der Anbieter ein kleineres Kontextfenster, passt King das Werkzeugbudget an. Neu gefundene Werkzeuge bleiben für den nächsten Schritt verfügbar. Bei der automatischen Auswahl liest King keine Parameterschemata noch nicht ausgewählter MCP-Werkzeuge; lokal registrierte Werkzeuge behalten ihre Parameterhinweise.

package/LIESMICH.txt

@@ -26,7 +26,7 @@ Installation
 ------------
 Die geprüfte Version exakt global installieren:
 
-  npm install -g blun-king-cli@9.1.615
+  npm install -g blun-king-cli@9.1.616
 
 Start
 -----

package/README.md

@@ -9,7 +9,7 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-npm install -g blun-king-cli@9.1.615
+npm install -g blun-king-cli@9.1.616
 ```
 
 ### Windows: Node.js, npm und Git Bash

package/bin/managed-plugin-selection.cjs

@@ -5,8 +5,10 @@ const path = require('node:path');
 const { ensurePrivateDirectory, securePrivateTree } = require('./private-paths');
 const SCHEMA = 'blun.managed-plugin-selection/v1';
 
-function snapshotPluginTree(root) {
-  const entries = [];
+function snapshotPluginTree(root, expectedEntries = null) {
+  const entries = [];
+  const expectedByPath = expectedEntries === null ? null
+    : new Map(expectedEntries.map(entry => [entry.path, entry]));
   const rootStat = fs.lstatSync(root);
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) return null;
   const visit = (directory, relativeDirectory = '') => {
@@ -14,19 +16,24 @@ function snapshotPluginTree(root) {
       .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0)) {
       const relativePath = path.join(relativeDirectory, entry.name);
       const absolutePath = path.join(directory, entry.name);
-      const stat = fs.lstatSync(absolutePath);
-      if (stat.isSymbolicLink()) return false;
-      if (stat.isDirectory()) {
+      const stat = fs.lstatSync(absolutePath);
+      if (stat.isSymbolicLink()) return false;
+      const expected = expectedByPath?.get(relativePath);
+      if (expectedByPath && !expected) return false;
+      if (stat.isDirectory()) {
+        if (expected && expected.kind !== 'directory') return false;
         entries.push({ kind: 'directory', path: relativePath });
         if (!visit(absolutePath, relativePath)) return false;
-      } else if (stat.isFile()) {
+      } else if (stat.isFile()) {
+        if (expected && (expected.kind !== 'file' || stat.size !== expected.content.length)) return false;
         entries.push({ kind: 'file', path: relativePath, content: fs.readFileSync(absolutePath) });
       } else return false;
     }
     return true;
   };
-  return visit(root) ? entries : null;
-}
+  if (!visit(root) || (expectedByPath && entries.length !== expectedByPath.size)) return null;
+  return entries;
+}
 
 function digestPluginEntries(entries) {
   if (entries === null) throw new Error('Invalid managed plugin tree');

package/bin/plugin-bootstrap.js

@@ -3,7 +3,13 @@
 const { randomUUID } = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
-const { selectedAgentSpineRoot, describeAgentSpineSelection, copySelectedAgentSpinePlugin } = require('./managed-plugin-selection.cjs');
+const {
+  selectedAgentSpineRoot,
+  describeAgentSpineSelection,
+  copySelectedAgentSpinePlugin,
+  snapshotPluginTree,
+  digestPluginEntries,
+} = require('./managed-plugin-selection.cjs');
 
 const {
   ensurePrivateDirectory,
@@ -88,20 +94,37 @@ function installManagedTelegramPlugin({ packageRoot, blunDir, now = new Date().t
 
   ensurePrivateDirectory(pluginsDir);
   if (fs.existsSync(installedFile)) securePrivateFile(installedFile);
-  const installed = readInstalledPlugins(installedFile);
-  const updatedInstalled = updatedInstalledPlugins(installed, pluginRoot, now);
-  ensurePrivateDirectory(managedDir);
-  const nonce = `${process.pid}-${randomUUID()}`;
-  const stagingRoot = path.join(managedDir, `.telegram-${nonce}.tmp`);
-  const backupRoot = path.join(managedDir, `.telegram-${nonce}.bak`);
-  let hadPreviousPlugin = false;
-  let installedNewPlugin = false;
-  try {
-    if (fs.existsSync(pluginRoot)) {
-      ensurePrivateDirectory(pluginRoot);
-      hadPreviousPlugin = true;
-    }
-    fs.cpSync(sourceRoot, stagingRoot, { recursive: true, force: true });
+  const installed = readInstalledPlugins(installedFile);
+  const updatedInstalled = updatedInstalledPlugins(installed, pluginRoot, now);
+  ensurePrivateDirectory(managedDir);
+  const expectedEntries = snapshotPluginTree(sourceRoot);
+  const expectedDigest = digestPluginEntries(expectedEntries);
+  let hadPreviousPlugin = false;
+  if (fs.existsSync(pluginRoot)) {
+    ensurePrivateDirectory(pluginRoot);
+    hadPreviousPlugin = true;
+    const existingEntries = snapshotPluginTree(pluginRoot, expectedEntries);
+    if (existingEntries !== null && digestPluginEntries(existingEntries) === expectedDigest) {
+      const previous = installed.plugins.find((plugin) => plugin.id === 'telegram');
+      const previousUpdate = typeof previous?.updatedAt === 'string' && previous.updatedAt.length > 0
+        ? previous.updatedAt : now;
+      const reusedInstalled = updatedInstalledPlugins(installed, pluginRoot, previousUpdate);
+      if (JSON.stringify(reusedInstalled) !== JSON.stringify(installed)) {
+        writeInstalledPlugins(installedFile, reusedInstalled);
+      }
+      return { installedFile, pluginRoot, reused: true };
+    }
+  }
+  const nonce = `${process.pid}-${randomUUID()}`;
+  const stagingRoot = path.join(managedDir, `.telegram-${nonce}.tmp`);
+  const backupRoot = path.join(managedDir, `.telegram-${nonce}.bak`);
+  let installedNewPlugin = false;
+  try {
+    fs.cpSync(sourceRoot, stagingRoot, { recursive: true, force: true });
+    const stagedEntries = snapshotPluginTree(stagingRoot, expectedEntries);
+    if (stagedEntries === null || digestPluginEntries(stagedEntries) !== expectedDigest) {
+      throw new Error('Telegram source changed during installation');
+    }
     if (hadPreviousPlugin) fs.renameSync(pluginRoot, backupRoot);
     try {
       fs.renameSync(stagingRoot, pluginRoot);
@@ -119,8 +142,8 @@ function installManagedTelegramPlugin({ packageRoot, blunDir, now = new Date().t
     fs.rmSync(stagingRoot, { recursive: true, force: true });
   }
 
-  return { installedFile, pluginRoot };
-}
+  return { installedFile, pluginRoot, reused: false };
+}
 
 function installManagedAgentSpinePlugin({ packageRoot, blunDir, now = new Date().toISOString() }) {
   const installedFile = path.join(blunDir, 'plugins', 'installed.json');

package/bin/private-paths.js

@@ -667,8 +667,16 @@ public static class BlunPrivateAclNative
             VerifyHandlePath(handle, fullTarget);
             HashSet<string> expectedSids = ExpectedSids(userSid);
             string owner = ValidateOwner(handle, expectedSids);
-            SetExactDacl(handle, userSid, true);
-            VerifyExactDacl(handle, userSid, true, owner);
+            // Avoid rewriting an exact directory DACL on every launcher start.
+            try
+            {
+                VerifyExactDacl(handle, userSid, true, owner);
+            }
+            catch (UnauthorizedAccessException)
+            {
+                SetExactDacl(handle, userSid, true);
+                VerifyExactDacl(handle, userSid, true, owner);
+            }
             VerifyHandlePath(handle, fullTarget);
         }
     }

package/bin/profile-launch.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
-const path = require('node:path');
+const path = require('node:path');
+const fs = require('node:fs');
 
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,31}$/u;
 const RESERVED = new Set(['doctor', 'export', 'help', 'login', 'mcp', 'server', 'tools', 'update', 'upgrade', 'version']);
@@ -35,8 +36,85 @@ function parseProfileLaunchArgs(args, mode) {
   return { args: remaining, name: undefined };
 }
 
-function resolveSelectedProfile(sharedHome, name, pathImpl = path) {
-  return pathImpl.join(sharedHome, 'profile', profileName(name));
-}
-
-module.exports = { parseProfileLaunchArgs, resolveSelectedProfile };
+function resolveSelectedProfile(sharedHome, name, pathImpl = path) {
+  return pathImpl.join(sharedHome, 'profile', profileName(name));
+}
+
+function catalogUnavailable() {
+  return Object.assign(new Error('PROFILE_CATALOG_UNAVAILABLE'), { code: 'PROFILE_CATALOG_UNAVAILABLE' });
+}
+
+function directoryIdentity(target, fsImpl) {
+  let stat;
+  try { stat = fsImpl.lstatSync(target, { bigint: true }); }
+  catch (error) {
+    if (error.code === 'ENOENT') return undefined;
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw catalogUnavailable();
+  return stat;
+}
+
+function homeIdentity(home, fsImpl) {
+  const root = path.parse(home).root;
+  let current = root;
+  let stat = directoryIdentity(current, fsImpl);
+  for (const part of home.slice(root.length).split(path.sep).filter(Boolean)) {
+    if (stat === undefined) return undefined;
+    current = path.join(current, part);
+    stat = directoryIdentity(current, fsImpl);
+  }
+  return stat;
+}
+
+function sameDirectory(before, after) {
+  return before !== undefined && after !== undefined && before.dev === after.dev && before.ino === after.ino;
+}
+
+/** Directory names only; selection must revalidate them before changing owner. */
+function listExistingProfiles(sharedHome, options = {}) {
+  const fsImpl = options.fsImpl || fs;
+  try {
+    if (typeof sharedHome !== 'string' || !path.isAbsolute(sharedHome)) throw catalogUnavailable();
+    const home = path.resolve(sharedHome);
+    if (process.platform === 'win32' && home.startsWith('\\\\')) throw catalogUnavailable();
+    const beforeHome = homeIdentity(home, fsImpl);
+    if (beforeHome === undefined) return [];
+    const profileRoot = path.join(home, 'profile');
+    const beforeProfiles = directoryIdentity(profileRoot, fsImpl);
+    if (beforeProfiles === undefined) {
+      if (!sameDirectory(beforeHome, homeIdentity(home, fsImpl))) throw catalogUnavailable();
+      return [];
+    }
+    const rows = [];
+    const dir = fsImpl.opendirSync(profileRoot);
+    try {
+      let count = 0;
+      for (let entry; (entry = dir.readSync()) !== null;) {
+        if (++count > 4096) throw catalogUnavailable();
+        const name = entry.name;
+        if (!PROFILE_NAME.test(name)) continue;
+        const target = resolveSelectedProfile(home, name);
+        let stat;
+        try { stat = fsImpl.lstatSync(target, { bigint: true }); }
+        catch (error) {
+          if (error.code === 'ENOENT') continue;
+          throw error;
+        }
+        if (stat.isDirectory() && !stat.isSymbolicLink()) rows.push({ name, target, stat });
+      }
+    } finally { dir.closeSync(); }
+    if (!sameDirectory(beforeHome, homeIdentity(home, fsImpl))
+      || !sameDirectory(beforeProfiles, directoryIdentity(profileRoot, fsImpl))) throw catalogUnavailable();
+    for (const row of rows) {
+      if (!sameDirectory(row.stat, directoryIdentity(row.target, fsImpl))) throw catalogUnavailable();
+    }
+    if (!sameDirectory(beforeHome, homeIdentity(home, fsImpl))
+      || !sameDirectory(beforeProfiles, directoryIdentity(profileRoot, fsImpl))) throw catalogUnavailable();
+    return rows.map(row => row.name).sort();
+  } catch {
+    throw catalogUnavailable();
+  }
+}
+
+module.exports = { parseProfileLaunchArgs, resolveSelectedProfile, listExistingProfiles };