create-principles-disciple 1.133.13 → 1.134.1

package/dist/installer.js

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, statSync, readFileSync, writeFileSync, mkdirSync, rmSync, copyFileSync, cpSync, renameSync, chmodSync, symlinkSync } from 'fs';
+import { existsSync, lstatSync, readdirSync, realpathSync, statSync, readFileSync, writeFileSync, mkdirSync, rmSync, copyFileSync, cpSync, renameSync, chmodSync, symlinkSync } from 'fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { pathToFileURL } from 'node:url';
 import fse from 'fs-extra';
@@ -16,7 +16,9 @@ import { mergeInstallManifestWorkspaces, parseInstallManifest } from '@principle
 import { detectOpenClawMainWorkspaceDivergence } from './utils/workspace-divergence.js';
 import { applySkillLanguageSelection } from './skill-language.js';
 import { parseReleaseAssetIdentity, parseReleaseAssetManifest, ReleaseAssetManifestError, verifyReleaseAssetManifestAsync, verifyReleaseAssetTarget, } from './update/release-asset-manifest.js';
-import { appendJournalTransition } from './update/transaction-journal.js';
+import { mergeIntoInstallJson, readInstallJsonRecord, resolvePdHomePaths, } from './update/install-layout.js';
+import { RELEASE_METADATA_URL_ENV, normalizeReleaseMetadataUrl } from './update/release-metadata-source.js';
+import { appendJournalTransition, readActiveRecord, writeActiveRecord, } from './update/transaction-journal.js';
 /** PRI-343: Keep in sync with @principles/core CONVERSATION_ACCESS_CONFIG_KEY */
 export const CONVERSATION_ACCESS_CONFIG_KEY = 'allowConversationAccess';
 function isRecord(value) {
@@ -155,7 +157,90 @@ function resolveInstallManifestWorkspaces(workspaceDir) {
 }
 function writeInstallManifest(hosts, workspaces) {
     mkdirSync(getPdDir(), { recursive: true });
-    writeFileSync(getInstallManifestPath(), JSON.stringify({ layoutVersion: 1, mode: 'canonical', hosts, workspaces }, null, 2) + '\n', 'utf8');
+    // PRI-709 P0-1: merge into the existing record. This file has more than one
+    // writer (the update side owns `channel` / `autoCheck` / `releaseMetadataUrl`);
+    // a wholesale replace silently deleted those fields.
+    const existing = readInstallJsonRecord(getInstallManifestPath());
+    const payload = {
+        ...(existing ?? {}),
+        layoutVersion: 1,
+        mode: 'canonical',
+        hosts,
+        workspaces,
+    };
+    writeFileSync(getInstallManifestPath(), JSON.stringify(payload, null, 2) + '\n', 'utf8');
+}
+export function commitInstallerActiveRecord(journal) {
+    const paths = resolvePdHomePaths(getPdDir());
+    let previous = null;
+    let previousWarning = null;
+    try {
+        previous = readActiveRecord(paths.activeRecordPath);
+    }
+    catch (error) {
+        // A corrupt previous record must not block committing the new identity —
+        // overwriting it with a valid record is strictly an improvement.
+        previousWarning = error instanceof Error ? error.message : String(error);
+        logger.warn(`active.json was unreadable and is being replaced (${paths.activeRecordPath}): ${previousWarning}`);
+    }
+    // Generation continuity: never move backwards. A standalone install already
+    // carries generation 1, but re-installing over an existing deployment must
+    // advance past it — otherwise the deployment identity source would regress.
+    const generation = Math.max(journal.generation, previous === null ? 1 : previous.generation + 1);
+    try {
+        writeActiveRecord(paths.activeRecordPath, {
+            generation,
+            releaseId: journal.releaseId,
+            releaseMetadataDigest: journal.releaseMetadataDigest,
+            previousReleaseId: previous?.releaseId ?? null,
+            transactionId: journal.transactionId,
+            productVersion: journal.productVersion,
+        });
+        return {
+            written: true,
+            activeRecordPath: paths.activeRecordPath,
+            generation,
+            previousReleaseId: previous?.releaseId ?? null,
+            ...(previousWarning !== null ? { reason: `previous_record_unreadable: ${previousWarning}` } : {}),
+        };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        logger.error(`active.json could not be written after a committed install (${paths.activeRecordPath}): ${reason}. `
+            + `Deployment identity is out of sync with the transaction ${journal.transactionId}; re-run the installer to repair it.`);
+        return {
+            written: false,
+            activeRecordPath: paths.activeRecordPath,
+            generation,
+            previousReleaseId: previous?.releaseId ?? null,
+            reason,
+        };
+    }
+}
+/**
+ * PRI-709 P0-1 — installer supply path for the release metadata source.
+ *
+ * The installer is the only component that legitimately knows the metadata
+ * repository at install time, so it persists `PD_RELEASE_METADATA_URL` into
+ * `~/.pd/install.json` (the durable `install_config` tier). Without this the
+ * variable had to be exported in every shell that wanted a governed update
+ * check (PRI-698 audit F-4).
+ *
+ * Absent env is a no-op — an install with no metadata source stays
+ * unconfigured rather than persisting a guessed URL. A malformed env value is
+ * reported and skipped: it must never be written into install.json, where the
+ * strict reader would then fail loud and mark the install corrupt.
+ */
+export function persistReleaseMetadataSource() {
+    const raw = process.env[RELEASE_METADATA_URL_ENV];
+    if (raw === undefined || raw.trim().length === 0)
+        return;
+    const normalized = normalizeReleaseMetadataUrl(raw);
+    if (normalized === null) {
+        logger.warn(`${RELEASE_METADATA_URL_ENV} is not a valid http(s) URL and was not persisted to install.json: ${JSON.stringify(raw)}. Release metadata source stays unconfigured.`);
+        return;
+    }
+    mergeIntoInstallJson(getInstallManifestPath(), { releaseMetadataUrl: normalized });
 }
 function installBundledLayoutPackage(pluginDir) {
     const source = path.join(pluginDir, 'install-layout');
@@ -1444,6 +1529,85 @@ function installBundledCodexAdapter(pluginDir) {
     rmSync(codexAdapterDest, { recursive: true, force: true });
     cpSync(codexAdapterSrc, codexAdapterDest, { recursive: true });
 }
+/**
+ * PRI-711: materialize node_modules links for the INSTALLED codex-adapter so
+ * its declared `file:../<component>` dependencies resolve under ESM realpath
+ * rules. The adapter's dist imports @principles/host-runtime and
+ * @principles/core, and pd-cli's eager import graph (health-codex) statically
+ * imports the adapter — without these links every pd command dies with
+ * ERR_MODULE_NOT_FOUND at startup (observed 2026-09-09: the 1.231.2 full
+ * update swapped in Slice-D pd-cli while the deployed adapter, laid down by
+ * older installers, had no node_modules at all).
+ *
+ * Data-driven from the deployed adapter manifest: every dependency whose ref
+ * starts with `file:../` names a sibling runtime component directory. An
+ * existing correct link is kept; a stale physical copy (self-contained
+ * payloads ship materialized node_modules) or a wrong-target link is
+ * replaced with the canonical junction/symlink, mirroring syncPdCli.
+ * Idempotent. MUST run after installBundledCodexAdapter AND the
+ * core/host-runtime/install-layout installs — the manifest declares all
+ * three as file:../ siblings, and a missing sibling means a corrupted
+ * payload or a call-order regression, which fails the install loudly.
+ */
+export function ensureCodexAdapterResolution() {
+    const codexAdapterDir = getInstalledCodexAdapterDir();
+    const manifestPath = path.join(codexAdapterDir, 'package.json');
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+    }
+    catch (error) {
+        throw new Error(`Installed @principles/codex-adapter package.json is missing or malformed (${manifestPath}): ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (!isRecord(manifest)) {
+        throw new Error(`Installed @principles/codex-adapter package.json must contain an object (${manifestPath}).`);
+    }
+    if (manifest.dependencies !== undefined && !isRecord(manifest.dependencies)) {
+        throw new Error(`Installed @principles/codex-adapter package.json dependencies must be an object (${manifestPath}).`);
+    }
+    const runtimeDir = getPdRuntimeDir();
+    for (const [name, ref] of Object.entries(manifest.dependencies ?? {})) {
+        if (typeof ref !== 'string' || !ref.startsWith('file:../'))
+            continue;
+        const siblingName = ref.slice('file:../'.length);
+        // rc-1: the manifest is untrusted input — only accept single-path segment
+        // siblings so a crafted ref cannot escape the runtime dir.
+        if (!/^[A-Za-z0-9._-]+$/.test(siblingName) || siblingName === '.' || siblingName === '..') {
+            throw new Error(`Installed @principles/codex-adapter declares an unsupported file dependency ref "${ref}" for ${name}.`);
+        }
+        const siblingDir = path.join(runtimeDir, siblingName);
+        if (!existsSync(siblingDir)) {
+            throw new Error(`@principles/codex-adapter depends on ${ref} but the sibling runtime component is missing: ${siblingDir}`);
+        }
+        const linkPath = path.join(codexAdapterDir, 'node_modules', name);
+        let stat;
+        try {
+            stat = lstatSync(linkPath);
+        }
+        catch {
+            stat = undefined; // ENOENT — create below
+        }
+        if (stat !== undefined) {
+            if (stat.isSymbolicLink()) {
+                try {
+                    if (realpathSync(linkPath) === realpathSync(siblingDir))
+                        continue;
+                }
+                catch {
+                    // Unreadable link target — fall through to replace.
+                }
+            }
+            rmSync(linkPath, { recursive: stat.isDirectory() && !stat.isSymbolicLink(), force: true });
+        }
+        mkdirSync(path.dirname(linkPath), { recursive: true });
+        if (isWindows()) {
+            symlinkSync(siblingDir, linkPath, 'junction');
+        }
+        else {
+            symlinkSync(path.relative(path.dirname(linkPath), siblingDir), linkPath, 'dir');
+        }
+    }
+}
 function ensureCoreDependency(_targetDir) {
     const coreDir = getInstalledCoreDir();
     if (!existsSync(coreDir)) {
@@ -1888,6 +2052,18 @@ async function runHostInstallers(host, ctx) {
 function sha256File(filePath) {
     return createHash('sha256').update(readFileSync(filePath)).digest('hex');
 }
+function readPackageVersion(pkgPath) {
+    if (!existsSync(pkgPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        return typeof parsed.version === 'string' && parsed.version.length > 0 ? parsed.version : null;
+    }
+    catch {
+        // Identity falls back; journaling must not brick install.
+        return null;
+    }
+}
 /**
  * Identity of the payload being installed. Prefers the self-contained asset
  * manifest (covers the whole payload); falls back to the bundled pd-cli
@@ -1896,20 +2072,19 @@ function sha256File(filePath) {
  * legacy-migration.ts). The last-resort fallback hashes the literal reason
  * string only to satisfy the journal's 64-hex format requirement; it is not
  * part of any release-metadata identity chain.
+ *
+ * PRI-709 P0-2 (PRI-698 audit F-1): `productVersion` is the PRODUCT version —
+ * the plugin package manifest. It previously read `pd-cli/package.json`, but
+ * the two packages version independently (on the Owner machine: plugin
+ * 1.230.2 vs pd-cli 1.147.5), so every confirmed journal recorded a version
+ * that no runtime state could ever match. That is why active.json could not
+ * serve as the deployment identity source.
  */
 function resolveInstallerPayloadIdentity(pluginDir) {
-    let productVersion = 'unknown';
+    const productVersion = readPackageVersion(path.join(pluginDir, 'package.json'))
+        ?? readPackageVersion(path.join(pluginDir, 'pd-cli', 'package.json'))
+        ?? 'unknown';
     const pdCliPkgPath = path.join(pluginDir, 'pd-cli', 'package.json');
-    if (existsSync(pdCliPkgPath)) {
-        try {
-            const parsed = JSON.parse(readFileSync(pdCliPkgPath, 'utf8'));
-            if (typeof parsed.version === 'string' && parsed.version.length > 0)
-                productVersion = parsed.version;
-        }
-        catch {
-            // Identity falls back to 'unknown'; journaling must not brick install.
-        }
-    }
     const assetManifestPath = path.join(pluginDir, '_release', 'manifest.json');
     let releaseMetadataDigest;
     let releaseMetadataDigestSource;
@@ -2213,6 +2388,11 @@ transaction) {
         installBundledCodexAdapter(pluginDir);
         stepIndex++;
         installBundledLayoutPackage(pluginDir);
+        // PRI-711: the adapter's own file: deps must resolve or pd-cli's eager
+        // import graph crashes on every command. Runs only once ALL adapter
+        // siblings exist — the manifest declares file:../core, file:../host-runtime
+        // AND file:../install-layout, and install-layout lands just above.
+        ensureCodexAdapterResolution();
         if (spinner)
             updateProgress(spinner, stepIndex, 'Installing release-manager authority module...');
         installBundledReleaseManagerPackage(pluginDir);
@@ -2405,6 +2585,9 @@ transaction) {
             throw new Error(`Host installation failed: ${hostFailures.join(' | ')}`);
         }
         writeInstallManifest(installManifestHosts, resolveInstallManifestWorkspaces(options.workspaceDir));
+        // PRI-709 P0-1: persist the metadata source after the manifest write, so
+        // the durable tier cannot be clobbered by the same install.
+        persistReleaseMetadataSource();
         // ADR-0024 D-2: host installers completed and the install manifest is
         // written — the new installation is fully activated (backups not yet
         // discarded, so a crash here still recovers via the backup).
@@ -2412,6 +2595,9 @@ transaction) {
         cleanupBackup(backupDir, runtimeBackupDir);
         // ADR-0024 D-2: backup cleanup is the commit point of the transaction.
         journalInstallerTransitionDegrading(journal, journal.lastState, 'confirmed', 'backup cleaned up; install complete');
+        // PRI-709 P0-2: active.json is the deployment identity source, written
+        // journal-first — after `confirmed`, never before it.
+        commitInstallerActiveRecord(journal);
         if (spinner) {
             spinner.succeed('Install complete!');
         }