devrites 4.0.0 → 4.0.2

package/engine/internal/release/release.go

@@ -0,0 +1,411 @@
+// Package release acquires verified DevRites release artifacts for self-update.
+package release
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"
+)
+
+const (
+	DefaultRepository = "ViktorsBaikers/DevRites"
+	maxAssetBytes     = int64(64) << 20
+	maxJSONBytes      = int64(4) << 20
+	maxChecksumBytes  = int64(4) << 10
+	maxArchiveEntries = 4096
+	maxEntryBytes     = int64(64) << 20
+	maxExtractedBytes = int64(512) << 20
+)
+
+var (
+	apiBaseURL = "https://api.github.com"
+	webBaseURL = "https://github.com"
+	httpClient = &http.Client{
+		Timeout:       2 * time.Minute,
+		CheckRedirect: checkRedirect,
+	}
+	repositoryPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*$`)
+	tagPattern        = regexp.MustCompile(`^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$`)
+)
+
+// Candidate is one verified, extracted release and its platform engine.
+type Candidate struct {
+	SourceDir  string
+	PayloadDir string
+	EnginePath string
+	BundleURL  string
+}
+
+// Latest returns the exact tag of the latest published release.
+func Latest(ctx context.Context, repository string) (string, error) {
+	if !repositoryPattern.MatchString(repository) {
+		return "", fmt.Errorf("invalid DevRites repository %q", repository)
+	}
+	var metadata struct {
+		TagName string `json:"tag_name"`
+	}
+	endpoint := strings.TrimRight(apiBaseURL, "/") + "/repos/" + repository + "/releases/latest"
+	if err := fetchJSON(ctx, endpoint, &metadata); err != nil {
+		return "", fmt.Errorf("resolve latest release: %w", err)
+	}
+	if !validTag(metadata.TagName) {
+		return "", fmt.Errorf("resolve latest release: invalid tag %q", metadata.TagName)
+	}
+	return metadata.TagName, nil
+}
+
+// Acquire downloads, verifies, and extracts the bundle and platform engine.
+func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), error) {
+	if !repositoryPattern.MatchString(repository) {
+		return Candidate{}, func() {}, fmt.Errorf("invalid DevRites repository %q", repository)
+	}
+	if !validTag(tag) {
+		return Candidate{}, func() {}, fmt.Errorf("invalid DevRites release tag %q", tag)
+	}
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		return Candidate{}, func() {}, err
+	}
+	tmp, err := os.MkdirTemp("", "devrites-update-*")
+	if err != nil {
+		return Candidate{}, func() {}, fmt.Errorf("create update directory: %w", err)
+	}
+	cleanup := func() { _ = os.RemoveAll(tmp) }
+	fail := func(err error) (Candidate, func(), error) {
+		cleanup()
+		return Candidate{}, func() {}, err
+	}
+
+	base := strings.TrimRight(webBaseURL, "/") + "/" + repository + "/releases/download/" + tag
+	bundleName := "devrites-" + tag + ".tar.gz"
+	bundleURL := base + "/" + bundleName
+	bundlePath := filepath.Join(tmp, bundleName)
+	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644); err != nil {
+		return fail(fmt.Errorf("download release bundle: %w", err))
+	}
+	source, err := extractBundle(bundlePath, tmp, tag)
+	if err != nil {
+		return fail(err)
+	}
+
+	engineURL := base + "/" + binaryName
+	enginePath := filepath.Join(tmp, binaryName)
+	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755); err != nil {
+		return fail(fmt.Errorf("download engine binary: %w", err))
+	}
+	return Candidate{
+		SourceDir:  source,
+		PayloadDir: filepath.Join(source, "pack", "generated"),
+		EnginePath: enginePath,
+		BundleURL:  bundleURL,
+	}, cleanup, nil
+}
+
+func validTag(tag string) bool {
+	if !tagPattern.MatchString(tag) {
+		return false
+	}
+	version := strings.SplitN(strings.TrimPrefix(tag, "v"), "+", 2)[0]
+	_, prerelease, found := strings.Cut(version, "-")
+	if !found {
+		return true
+	}
+	for _, identifier := range strings.Split(prerelease, ".") {
+		if len(identifier) > 1 && identifier[0] == '0' {
+			numeric := true
+			for _, char := range identifier {
+				if char < '0' || char > '9' {
+					numeric = false
+					break
+				}
+			}
+			if numeric {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func platformBinaryName() (string, error) {
+	supported := (runtime.GOOS == "darwin" || runtime.GOOS == "linux") && (runtime.GOARCH == "amd64" || runtime.GOARCH == "arm64")
+	if runtime.GOOS == "windows" && runtime.GOARCH == "amd64" {
+		supported = true
+	}
+	if !supported {
+		return "", fmt.Errorf("no DevRites engine release for %s/%s", runtime.GOOS, runtime.GOARCH)
+	}
+	name := "devrites-" + runtime.GOOS + "-" + runtime.GOARCH
+	if runtime.GOOS == "windows" {
+		name += ".exe"
+	}
+	return name, nil
+}
+
+func fetchJSON(ctx context.Context, rawURL string, out any) error {
+	resp, err := get(ctx, rawURL)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+	}
+	if resp.ContentLength > maxJSONBytes {
+		return fmt.Errorf("JSON response exceeds %d bytes", maxJSONBytes)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxJSONBytes+1))
+	if err != nil {
+		return fmt.Errorf("read JSON response: %w", err)
+	}
+	if int64(len(body)) > maxJSONBytes {
+		return fmt.Errorf("JSON response exceeds %d bytes", maxJSONBytes)
+	}
+	if err := json.Unmarshal(body, out); err != nil {
+		return fmt.Errorf("decode JSON response: %w", err)
+	}
+	return nil
+}
+
+func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode) error {
+	if err := download(ctx, rawURL, destination, maxAssetBytes, mode); err != nil {
+		return err
+	}
+	sumPath := destination + ".sha256"
+	if err := download(ctx, rawURL+".sha256", sumPath, maxChecksumBytes, 0o600); err != nil {
+		return fmt.Errorf("missing checksum for %s: %w", filename, err)
+	}
+	sum, err := os.ReadFile(sumPath)
+	if err != nil {
+		return fmt.Errorf("read checksum for %s: %w", filename, err)
+	}
+	fields := strings.Fields(string(sum))
+	if len(fields) != 2 || strings.TrimPrefix(fields[1], "*") != filename {
+		return fmt.Errorf("invalid checksum record for %s", filename)
+	}
+	want, err := hex.DecodeString(fields[0])
+	if err != nil || len(want) != sha256.Size {
+		return fmt.Errorf("invalid SHA-256 for %s", filename)
+	}
+	file, err := os.Open(destination)
+	if err != nil {
+		return fmt.Errorf("open %s for checksum: %w", filename, err)
+	}
+	hash := sha256.New()
+	_, copyErr := io.Copy(hash, file)
+	closeErr := file.Close()
+	if copyErr != nil {
+		return fmt.Errorf("hash %s: %w", filename, copyErr)
+	}
+	if closeErr != nil {
+		return fmt.Errorf("close %s: %w", filename, closeErr)
+	}
+	if !strings.EqualFold(hex.EncodeToString(hash.Sum(nil)), hex.EncodeToString(want)) {
+		return fmt.Errorf("checksum mismatch for %s", filename)
+	}
+	return nil
+}
+
+func download(ctx context.Context, rawURL, destination string, maxBytes int64, mode fs.FileMode) error {
+	resp, err := get(ctx, rawURL)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+	}
+	if resp.ContentLength > maxBytes {
+		return fmt.Errorf("download exceeds %d bytes", maxBytes)
+	}
+	out, err := os.CreateTemp(filepath.Dir(destination), ".download-*")
+	if err != nil {
+		return fmt.Errorf("create download: %w", err)
+	}
+	tmp := out.Name()
+	keep := false
+	defer func() {
+		_ = out.Close()
+		if !keep {
+			_ = os.Remove(tmp)
+		}
+	}()
+	written, err := io.Copy(out, io.LimitReader(resp.Body, maxBytes+1))
+	if err != nil {
+		return fmt.Errorf("write download: %w", err)
+	}
+	if written > maxBytes {
+		return fmt.Errorf("download exceeds %d bytes", maxBytes)
+	}
+	if err := out.Chmod(mode); err != nil {
+		return fmt.Errorf("set download mode: %w", err)
+	}
+	if err := out.Sync(); err != nil {
+		return fmt.Errorf("sync download: %w", err)
+	}
+	if err := out.Close(); err != nil {
+		return fmt.Errorf("close download: %w", err)
+	}
+	if err := os.Rename(tmp, destination); err != nil {
+		return fmt.Errorf("install download: %w", err)
+	}
+	keep = true
+	return nil
+}
+
+func get(ctx context.Context, rawURL string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("build release request: %w", err)
+	}
+	if err := validateURL(req.URL); err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("User-Agent", "devrites-engine")
+	return httpClient.Do(req)
+}
+
+func validateURL(u *url.URL) error {
+	if u == nil || u.Hostname() == "" {
+		return errors.New("release URL has no host")
+	}
+	if strings.EqualFold(u.Scheme, "https") {
+		return nil
+	}
+	if strings.EqualFold(u.Scheme, "http") {
+		if ip, err := netip.ParseAddr(u.Hostname()); err == nil && ip.Unmap().IsLoopback() {
+			return nil
+		}
+	}
+	return fmt.Errorf("release URL must use HTTPS: %s", u.Redacted())
+}
+
+func checkRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return errors.New("stopped after 10 redirects")
+	}
+	if err := validateURL(req.URL); err != nil {
+		return err
+	}
+	if len(via) > 0 && !isLoopback(via[0].URL) && isLoopback(req.URL) {
+		return fmt.Errorf("remote release URL cannot redirect to loopback: %s", req.URL.Redacted())
+	}
+	return nil
+}
+
+func isLoopback(u *url.URL) bool {
+	if u == nil {
+		return false
+	}
+	host := strings.TrimSuffix(strings.ToLower(u.Hostname()), ".")
+	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
+		return true
+	}
+	ip, err := netip.ParseAddr(host)
+	return err == nil && ip.Unmap().IsLoopback()
+}
+
+func extractBundle(archive, destination, tag string) (string, error) {
+	if err := extractTarGz(archive, destination); err != nil {
+		return "", fmt.Errorf("extract release bundle: %w", err)
+	}
+	source := filepath.Join(destination, "devrites-"+tag)
+	if _, err := os.Stat(filepath.Join(source, "package.json")); err != nil {
+		return "", fmt.Errorf("release bundle is missing package.json: %w", err)
+	}
+	if info, err := os.Stat(filepath.Join(source, "pack", "generated")); err != nil || !info.IsDir() {
+		return "", fmt.Errorf("release bundle is missing pack/generated")
+	}
+	return source, nil
+}
+
+func extractTarGz(archive, destination string) error {
+	file, err := os.Open(archive)
+	if err != nil {
+		return fmt.Errorf("open archive: %w", err)
+	}
+	defer file.Close()
+	gz, err := gzip.NewReader(file)
+	if err != nil {
+		return fmt.Errorf("open gzip stream: %w", err)
+	}
+	defer gz.Close()
+	reader := tar.NewReader(gz)
+	root, err := filepath.Abs(destination)
+	if err != nil {
+		return fmt.Errorf("resolve extraction directory: %w", err)
+	}
+	entries := 0
+	var total int64
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("read archive: %w", err)
+		}
+		entries++
+		if entries > maxArchiveEntries {
+			return fmt.Errorf("release bundle has more than %d entries", maxArchiveEntries)
+		}
+		if header.Size < 0 || header.Size > maxEntryBytes || header.Size > maxExtractedBytes-total {
+			return fmt.Errorf("release bundle entry %q exceeds extraction limits", header.Name)
+		}
+		total += header.Size
+		name := path.Clean(header.Name)
+		if name != strings.TrimSuffix(header.Name, "/") || !fs.ValidPath(name) || name == "." {
+			return fmt.Errorf("unsafe path in release bundle: %s", header.Name)
+		}
+		target := filepath.Join(root, filepath.FromSlash(name))
+		if target != root && !strings.HasPrefix(target, root+string(os.PathSeparator)) {
+			return fmt.Errorf("unsafe path in release bundle: %s", header.Name)
+		}
+		mode := fs.FileMode(header.Mode & 0o777)
+		switch header.Typeflag {
+		case tar.TypeDir:
+			if err := os.MkdirAll(target, mode); err != nil {
+				return fmt.Errorf("create directory %s: %w", name, err)
+			}
+		case tar.TypeReg:
+			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+				return fmt.Errorf("create directory for %s: %w", name, err)
+			}
+			out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
+			if err != nil {
+				return fmt.Errorf("create %s: %w", name, err)
+			}
+			written, copyErr := io.Copy(out, io.LimitReader(reader, maxEntryBytes+1))
+			closeErr := out.Close()
+			if copyErr != nil {
+				return fmt.Errorf("extract %s: %w", name, copyErr)
+			}
+			if written != header.Size || written > maxEntryBytes {
+				return fmt.Errorf("release bundle entry %q has inconsistent size", header.Name)
+			}
+			if closeErr != nil {
+				return fmt.Errorf("close %s: %w", name, closeErr)
+			}
+		default:
+			return fmt.Errorf("release bundle entry %q has unsupported type", header.Name)
+		}
+	}
+}

package/engine/internal/release/release_test.go

@@ -0,0 +1,167 @@
+package release
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
+	const tag = "v4.1.0"
+	bundleName := "devrites-" + tag + ".tar.gz"
+	bundle := testBundle(t, tag, map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+	})
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		t.Skip(err)
+	}
+	assets := map[string][]byte{
+		bundleName: bundle,
+		binaryName: []byte("test engine"),
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/repos/owner/repo/releases/latest" {
+			_, _ = fmt.Fprintf(w, `{"tag_name":%q}`, tag)
+			return
+		}
+		name := filepath.Base(r.URL.Path)
+		if strings.HasSuffix(name, ".sha256") {
+			assetName := strings.TrimSuffix(name, ".sha256")
+			asset, ok := assets[assetName]
+			if !ok {
+				http.NotFound(w, r)
+				return
+			}
+			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
+			return
+		}
+		asset, ok := assets[name]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		_, _ = w.Write(asset)
+	}))
+	defer server.Close()
+	oldAPI, oldWeb := apiBaseURL, webBaseURL
+	apiBaseURL, webBaseURL = server.URL, server.URL
+	t.Cleanup(func() { apiBaseURL, webBaseURL = oldAPI, oldWeb })
+
+	gotTag, err := Latest(context.Background(), "owner/repo")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotTag != tag {
+		t.Fatalf("latest tag = %q, want %q", gotTag, tag)
+	}
+	candidate, cleanup, err := Acquire(context.Background(), "owner/repo", tag)
+	if err != nil {
+		t.Fatal(err)
+	}
+	root := filepath.Dir(candidate.SourceDir)
+	if _, err := os.Stat(filepath.Join(candidate.PayloadDir, "claude", "skills", "rite", "SKILL.md")); err != nil {
+		t.Fatalf("extracted payload: %v", err)
+	}
+	if got, err := os.ReadFile(candidate.EnginePath); err != nil || string(got) != "test engine" {
+		t.Fatalf("engine = %q, %v", got, err)
+	}
+	cleanup()
+	if _, err := os.Stat(root); !os.IsNotExist(err) {
+		t.Fatalf("cleanup kept %s: %v", root, err)
+	}
+}
+
+func TestValidTag(t *testing.T) {
+	for _, tc := range []struct {
+		tag  string
+		want bool
+	}{
+		{tag: "v4.1.0", want: true},
+		{tag: "v4.1.0-rc.1+build.2", want: true},
+		{tag: "4.1.0", want: false},
+		{tag: "v4.1.0-01", want: false},
+		{tag: "v4.1", want: false},
+	} {
+		if got := validTag(tc.tag); got != tc.want {
+			t.Errorf("validTag(%q) = %t, want %t", tc.tag, got, tc.want)
+		}
+	}
+}
+
+func TestAcquireRejectsChecksumMismatch(t *testing.T) {
+	const tag = "v4.1.0"
+	bundleName := "devrites-" + tag + ".tar.gz"
+	bundle := testBundle(t, tag, map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+	})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, ".sha256") {
+			_, _ = fmt.Fprintf(w, "%064d  %s\n", 0, bundleName)
+			return
+		}
+		_, _ = w.Write(bundle)
+	}))
+	defer server.Close()
+	oldWeb := webBaseURL
+	webBaseURL = server.URL
+	t.Cleanup(func() { webBaseURL = oldWeb })
+
+	_, _, err := Acquire(context.Background(), "owner/repo", tag)
+	if err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("Acquire error = %v, want checksum mismatch", err)
+	}
+}
+
+func TestExtractBundleRejectsPathTraversal(t *testing.T) {
+	const tag = "v4.1.0"
+	archive := filepath.Join(t.TempDir(), "unsafe.tar.gz")
+	data := testBundle(t, tag, map[string]string{"../escape": "bad"})
+	if err := os.WriteFile(archive, data, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	_, err := extractBundle(archive, t.TempDir(), tag)
+	if err == nil || !strings.Contains(err.Error(), "unsafe path") {
+		t.Fatalf("extractBundle error = %v, want unsafe path", err)
+	}
+}
+
+func testBundle(t *testing.T, tag string, files map[string]string) []byte {
+	t.Helper()
+	var raw bytes.Buffer
+	gz := gzip.NewWriter(&raw)
+	tw := tar.NewWriter(gz)
+	for name, body := range files {
+		data := []byte(body)
+		header := &tar.Header{
+			Name:     "devrites-" + tag + "/" + name,
+			Mode:     0o644,
+			Size:     int64(len(data)),
+			Typeflag: tar.TypeReg,
+		}
+		if err := tw.WriteHeader(header); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := tw.Write(data); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return raw.Bytes()
+}

package/engine/tests/meta_test.go

@@ -1,6 +1,6 @@
 package main_test
 
-// Cross-cutting assertion: first-party packages do not import forbidden network packages.
+// Cross-cutting assertion: release acquisition is the only engine network boundary.
 
 import (
 	"os/exec"
@@ -8,10 +8,9 @@ import (
 	"testing"
 )
 
-// TestFirstPartyMakesNoNetworkCalls asserts that no first-party Go package imports
-// a forbidden network package. This keeps the engine a network-free control plane
-// that makes zero model/API calls (PRD: "zero API").
-func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
+// TestNetworkImportsStayInReleaseBoundary keeps update networking isolated from
+// workspace state, policy, proof, and installation logic.
+func TestNetworkImportsStayInReleaseBoundary(t *testing.T) {
 	if _, err := exec.LookPath("go"); err != nil {
 		t.Skip("go toolchain unavailable")
 	}
@@ -22,6 +21,7 @@ func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
 		t.Fatalf("go list: %v", err)
 	}
 	forbidden := map[string]bool{"net": true, "net/http": true, "net/rpc": true, "net/smtp": true}
+	allowed := map[string]bool{"github.com/devrites/devrites/internal/release": true}
 	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
 		fields := strings.Fields(line)
 		if len(fields) == 0 {
@@ -29,7 +29,7 @@ func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
 		}
 		pkg, imports := fields[0], fields[1:]
 		for _, imp := range imports {
-			if forbidden[imp] {
+			if forbidden[imp] && !allowed[pkg] {
 				t.Errorf("first-party package %s imports forbidden network package %q", pkg, imp)
 			}
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",