devrites 4.0.1 → 4.0.2

package/engine/internal/install/install_test.go

@@ -2,6 +2,7 @@ package install
 
 import (
 	"bytes"
+	"context"
 	"crypto/sha256"
 	"fmt"
 	"os"
@@ -14,6 +15,7 @@ import (
 	"time"
 
 	"github.com/devrites/devrites/internal/hostpack"
+	"github.com/devrites/devrites/internal/release"
 	"github.com/devrites/devrites/internal/testutil"
 )
 
@@ -484,6 +486,36 @@ func buildVersionBinary(t *testing.T, version string) string {
 	return binary
 }
 
+func buildUpdateHandoffBinary(t *testing.T, version string) string {
+	t.Helper()
+	dir := t.TempDir()
+	source := filepath.Join(dir, "main.go")
+	testutil.WriteFile(t, source, fmt.Sprintf(`package main
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+func main() {
+	if len(os.Args) == 2 && os.Args[1] == "version" {
+		fmt.Println(%q)
+		return
+	}
+	output := strings.Join(os.Args[1:], "\n") + "\n" +
+		"DEVRITES_UPDATE_HANDOFF=" + os.Getenv("DEVRITES_UPDATE_HANDOFF") + "\n" +
+		"DEVRITES_ENGINE_CLI=" + os.Getenv("DEVRITES_ENGINE_CLI") + "\n"
+	if err := os.WriteFile(os.Getenv("DEVRITES_TEST_UPDATE_HANDOFF"), []byte(output), 0600); err != nil {
+		panic(err)
+	}
+}
+`, version))
+	binary := filepath.Join(dir, engineBinaryName())
+	if out, err := exec.Command("go", "build", "-o", binary, source).CombinedOutput(); err != nil {
+		t.Fatalf("build update handoff engine: %v\n%s", err, out)
+	}
+	return binary
+}
+
 func TestBinaryCandidatesSkipsUnsetBinDir(t *testing.T) {
 	t.Setenv("DEVRITES_BIN_DIR", "")
 
@@ -531,6 +563,7 @@ func TestUpdateInstallsLocalPayload(t *testing.T) {
 	opts.Stderr = &bytes.Buffer{}
 	check := opts
 	check.UpdateCheck = true
+	check.PayloadDir = ""
 	if err := Apply(check); err == nil || !strings.Contains(err.Error(), "update available: 1.0.0 -> 2.0.0") {
 		t.Fatalf("update check error = %v, want local candidate report", err)
 	}
@@ -552,6 +585,84 @@ func TestUpdateInstallsLocalPayload(t *testing.T) {
 	}
 }
 
+func TestUpdateAcquiresLatestReleaseAndHandsOff(t *testing.T) {
+	t.Setenv("DEVRITES_NO_BINARY", "1")
+	target := t.TempDir()
+	runInstall(t, target, testPayload(t), func(o *Options) {
+		o.SourceDir = testSource(t, "1.0.0")
+	})
+	source := testSource(t, "2.0.0")
+	payload := testPayload(t)
+	engine := buildUpdateHandoffBinary(t, "2.0.0")
+	marker := filepath.Join(t.TempDir(), "handoff.txt")
+	t.Setenv("DEVRITES_TEST_UPDATE_HANDOFF", marker)
+
+	oldResolve, oldAcquire := resolveLatestRelease, acquireRelease
+	resolveLatestRelease = func(context.Context, string) (string, error) { return "v2.0.0", nil }
+	cleaned := false
+	acquireRelease = func(context.Context, string, string) (release.Candidate, func(), error) {
+		return release.Candidate{
+			SourceDir:  source,
+			PayloadDir: payload,
+			EnginePath: engine,
+			BundleURL:  "https://example.invalid/devrites-v2.0.0.tar.gz",
+		}, func() { cleaned = true }, nil
+	}
+	t.Cleanup(func() {
+		resolveLatestRelease, acquireRelease = oldResolve, oldAcquire
+	})
+
+	var stdout, stderr bytes.Buffer
+	opts := DefaultOptions(ModeUpdate)
+	opts.Target = target
+	opts.Stdout = &stdout
+	opts.Stderr = &stderr
+	if err := Apply(opts); err != nil {
+		t.Fatalf("remote update: %v\n%s", err, stderr.String())
+	}
+	if !cleaned {
+		t.Fatal("remote update did not clean acquired release")
+	}
+	handoff := testutil.ReadFile(t, marker)
+	for _, want := range []string{
+		"update\n",
+		"--target\n" + target + "\n",
+		"--source-dir\n" + source + "\n",
+		"--payload-dir\n" + payload + "\n",
+		"DEVRITES_UPDATE_HANDOFF=1\n",
+		"DEVRITES_ENGINE_CLI=" + engine + "\n",
+	} {
+		if !strings.Contains(handoff, want) {
+			t.Fatalf("handoff missing %q:\n%s", want, handoff)
+		}
+	}
+	if !strings.Contains(stdout.String(), "latest:    2.0.0") || !strings.Contains(stdout.String(), "bundle:   https://example.invalid/") {
+		t.Fatalf("remote update output:\n%s", stdout.String())
+	}
+}
+
+func TestRemoteUpdateCheckDoesNotDownload(t *testing.T) {
+	target := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(target, ManifestName), "# devrites-version: 1.0.0\n")
+	oldResolve, oldAcquire := resolveLatestRelease, acquireRelease
+	resolveLatestRelease = func(context.Context, string) (string, error) { return "v2.0.0", nil }
+	acquireRelease = func(context.Context, string, string) (release.Candidate, func(), error) {
+		t.Fatal("--check downloaded release assets")
+		return release.Candidate{}, func() {}, nil
+	}
+	t.Cleanup(func() {
+		resolveLatestRelease, acquireRelease = oldResolve, oldAcquire
+	})
+	opts := DefaultOptions(ModeUpdate)
+	opts.Target = target
+	opts.UpdateCheck = true
+	opts.Stdout = &bytes.Buffer{}
+	opts.Stderr = &bytes.Buffer{}
+	if err := Apply(opts); err == nil || !strings.Contains(err.Error(), "update available: 1.0.0 -> 2.0.0") {
+		t.Fatalf("remote update check error = %v", err)
+	}
+}
+
 func TestUpdateCleansLegacyCodexHooks(t *testing.T) {
 	t.Setenv("DEVRITES_NO_BINARY", "1")
 	payload := testPayload(t)

package/engine/internal/release/release.go

@@ -0,0 +1,411 @@
+// Package release acquires verified DevRites release artifacts for self-update.
+package release
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"
+)
+
+const (
+	DefaultRepository = "ViktorsBaikers/DevRites"
+	maxAssetBytes     = int64(64) << 20
+	maxJSONBytes      = int64(4) << 20
+	maxChecksumBytes  = int64(4) << 10
+	maxArchiveEntries = 4096
+	maxEntryBytes     = int64(64) << 20
+	maxExtractedBytes = int64(512) << 20
+)
+
+var (
+	apiBaseURL = "https://api.github.com"
+	webBaseURL = "https://github.com"
+	httpClient = &http.Client{
+		Timeout:       2 * time.Minute,
+		CheckRedirect: checkRedirect,
+	}
+	repositoryPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*$`)
+	tagPattern        = regexp.MustCompile(`^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$`)
+)
+
+// Candidate is one verified, extracted release and its platform engine.
+type Candidate struct {
+	SourceDir  string
+	PayloadDir string
+	EnginePath string
+	BundleURL  string
+}
+
+// Latest returns the exact tag of the latest published release.
+func Latest(ctx context.Context, repository string) (string, error) {
+	if !repositoryPattern.MatchString(repository) {
+		return "", fmt.Errorf("invalid DevRites repository %q", repository)
+	}
+	var metadata struct {
+		TagName string `json:"tag_name"`
+	}
+	endpoint := strings.TrimRight(apiBaseURL, "/") + "/repos/" + repository + "/releases/latest"
+	if err := fetchJSON(ctx, endpoint, &metadata); err != nil {
+		return "", fmt.Errorf("resolve latest release: %w", err)
+	}
+	if !validTag(metadata.TagName) {
+		return "", fmt.Errorf("resolve latest release: invalid tag %q", metadata.TagName)
+	}
+	return metadata.TagName, nil
+}
+
+// Acquire downloads, verifies, and extracts the bundle and platform engine.
+func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), error) {
+	if !repositoryPattern.MatchString(repository) {
+		return Candidate{}, func() {}, fmt.Errorf("invalid DevRites repository %q", repository)
+	}
+	if !validTag(tag) {
+		return Candidate{}, func() {}, fmt.Errorf("invalid DevRites release tag %q", tag)
+	}
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		return Candidate{}, func() {}, err
+	}
+	tmp, err := os.MkdirTemp("", "devrites-update-*")
+	if err != nil {
+		return Candidate{}, func() {}, fmt.Errorf("create update directory: %w", err)
+	}
+	cleanup := func() { _ = os.RemoveAll(tmp) }
+	fail := func(err error) (Candidate, func(), error) {
+		cleanup()
+		return Candidate{}, func() {}, err
+	}
+
+	base := strings.TrimRight(webBaseURL, "/") + "/" + repository + "/releases/download/" + tag
+	bundleName := "devrites-" + tag + ".tar.gz"
+	bundleURL := base + "/" + bundleName
+	bundlePath := filepath.Join(tmp, bundleName)
+	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644); err != nil {
+		return fail(fmt.Errorf("download release bundle: %w", err))
+	}
+	source, err := extractBundle(bundlePath, tmp, tag)
+	if err != nil {
+		return fail(err)
+	}
+
+	engineURL := base + "/" + binaryName
+	enginePath := filepath.Join(tmp, binaryName)
+	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755); err != nil {
+		return fail(fmt.Errorf("download engine binary: %w", err))
+	}
+	return Candidate{
+		SourceDir:  source,
+		PayloadDir: filepath.Join(source, "pack", "generated"),
+		EnginePath: enginePath,
+		BundleURL:  bundleURL,
+	}, cleanup, nil
+}
+
+func validTag(tag string) bool {
+	if !tagPattern.MatchString(tag) {
+		return false
+	}
+	version := strings.SplitN(strings.TrimPrefix(tag, "v"), "+", 2)[0]
+	_, prerelease, found := strings.Cut(version, "-")
+	if !found {
+		return true
+	}
+	for _, identifier := range strings.Split(prerelease, ".") {
+		if len(identifier) > 1 && identifier[0] == '0' {
+			numeric := true
+			for _, char := range identifier {
+				if char < '0' || char > '9' {
+					numeric = false
+					break
+				}
+			}
+			if numeric {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func platformBinaryName() (string, error) {
+	supported := (runtime.GOOS == "darwin" || runtime.GOOS == "linux") && (runtime.GOARCH == "amd64" || runtime.GOARCH == "arm64")
+	if runtime.GOOS == "windows" && runtime.GOARCH == "amd64" {
+		supported = true
+	}
+	if !supported {
+		return "", fmt.Errorf("no DevRites engine release for %s/%s", runtime.GOOS, runtime.GOARCH)
+	}
+	name := "devrites-" + runtime.GOOS + "-" + runtime.GOARCH
+	if runtime.GOOS == "windows" {
+		name += ".exe"
+	}
+	return name, nil
+}
+
+func fetchJSON(ctx context.Context, rawURL string, out any) error {
+	resp, err := get(ctx, rawURL)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+	}
+	if resp.ContentLength > maxJSONBytes {
+		return fmt.Errorf("JSON response exceeds %d bytes", maxJSONBytes)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxJSONBytes+1))
+	if err != nil {
+		return fmt.Errorf("read JSON response: %w", err)
+	}
+	if int64(len(body)) > maxJSONBytes {
+		return fmt.Errorf("JSON response exceeds %d bytes", maxJSONBytes)
+	}
+	if err := json.Unmarshal(body, out); err != nil {
+		return fmt.Errorf("decode JSON response: %w", err)
+	}
+	return nil
+}
+
+func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode) error {
+	if err := download(ctx, rawURL, destination, maxAssetBytes, mode); err != nil {
+		return err
+	}
+	sumPath := destination + ".sha256"
+	if err := download(ctx, rawURL+".sha256", sumPath, maxChecksumBytes, 0o600); err != nil {
+		return fmt.Errorf("missing checksum for %s: %w", filename, err)
+	}
+	sum, err := os.ReadFile(sumPath)
+	if err != nil {
+		return fmt.Errorf("read checksum for %s: %w", filename, err)
+	}
+	fields := strings.Fields(string(sum))
+	if len(fields) != 2 || strings.TrimPrefix(fields[1], "*") != filename {
+		return fmt.Errorf("invalid checksum record for %s", filename)
+	}
+	want, err := hex.DecodeString(fields[0])
+	if err != nil || len(want) != sha256.Size {
+		return fmt.Errorf("invalid SHA-256 for %s", filename)
+	}
+	file, err := os.Open(destination)
+	if err != nil {
+		return fmt.Errorf("open %s for checksum: %w", filename, err)
+	}
+	hash := sha256.New()
+	_, copyErr := io.Copy(hash, file)
+	closeErr := file.Close()
+	if copyErr != nil {
+		return fmt.Errorf("hash %s: %w", filename, copyErr)
+	}
+	if closeErr != nil {
+		return fmt.Errorf("close %s: %w", filename, closeErr)
+	}
+	if !strings.EqualFold(hex.EncodeToString(hash.Sum(nil)), hex.EncodeToString(want)) {
+		return fmt.Errorf("checksum mismatch for %s", filename)
+	}
+	return nil
+}
+
+func download(ctx context.Context, rawURL, destination string, maxBytes int64, mode fs.FileMode) error {
+	resp, err := get(ctx, rawURL)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+	}
+	if resp.ContentLength > maxBytes {
+		return fmt.Errorf("download exceeds %d bytes", maxBytes)
+	}
+	out, err := os.CreateTemp(filepath.Dir(destination), ".download-*")
+	if err != nil {
+		return fmt.Errorf("create download: %w", err)
+	}
+	tmp := out.Name()
+	keep := false
+	defer func() {
+		_ = out.Close()
+		if !keep {
+			_ = os.Remove(tmp)
+		}
+	}()
+	written, err := io.Copy(out, io.LimitReader(resp.Body, maxBytes+1))
+	if err != nil {
+		return fmt.Errorf("write download: %w", err)
+	}
+	if written > maxBytes {
+		return fmt.Errorf("download exceeds %d bytes", maxBytes)
+	}
+	if err := out.Chmod(mode); err != nil {
+		return fmt.Errorf("set download mode: %w", err)
+	}
+	if err := out.Sync(); err != nil {
+		return fmt.Errorf("sync download: %w", err)
+	}
+	if err := out.Close(); err != nil {
+		return fmt.Errorf("close download: %w", err)
+	}
+	if err := os.Rename(tmp, destination); err != nil {
+		return fmt.Errorf("install download: %w", err)
+	}
+	keep = true
+	return nil
+}
+
+func get(ctx context.Context, rawURL string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("build release request: %w", err)
+	}
+	if err := validateURL(req.URL); err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("User-Agent", "devrites-engine")
+	return httpClient.Do(req)
+}
+
+func validateURL(u *url.URL) error {
+	if u == nil || u.Hostname() == "" {
+		return errors.New("release URL has no host")
+	}
+	if strings.EqualFold(u.Scheme, "https") {
+		return nil
+	}
+	if strings.EqualFold(u.Scheme, "http") {
+		if ip, err := netip.ParseAddr(u.Hostname()); err == nil && ip.Unmap().IsLoopback() {
+			return nil
+		}
+	}
+	return fmt.Errorf("release URL must use HTTPS: %s", u.Redacted())
+}
+
+func checkRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return errors.New("stopped after 10 redirects")
+	}
+	if err := validateURL(req.URL); err != nil {
+		return err
+	}
+	if len(via) > 0 && !isLoopback(via[0].URL) && isLoopback(req.URL) {
+		return fmt.Errorf("remote release URL cannot redirect to loopback: %s", req.URL.Redacted())
+	}
+	return nil
+}
+
+func isLoopback(u *url.URL) bool {
+	if u == nil {
+		return false
+	}
+	host := strings.TrimSuffix(strings.ToLower(u.Hostname()), ".")
+	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
+		return true
+	}
+	ip, err := netip.ParseAddr(host)
+	return err == nil && ip.Unmap().IsLoopback()
+}
+
+func extractBundle(archive, destination, tag string) (string, error) {
+	if err := extractTarGz(archive, destination); err != nil {
+		return "", fmt.Errorf("extract release bundle: %w", err)
+	}
+	source := filepath.Join(destination, "devrites-"+tag)
+	if _, err := os.Stat(filepath.Join(source, "package.json")); err != nil {
+		return "", fmt.Errorf("release bundle is missing package.json: %w", err)
+	}
+	if info, err := os.Stat(filepath.Join(source, "pack", "generated")); err != nil || !info.IsDir() {
+		return "", fmt.Errorf("release bundle is missing pack/generated")
+	}
+	return source, nil
+}
+
+func extractTarGz(archive, destination string) error {
+	file, err := os.Open(archive)
+	if err != nil {
+		return fmt.Errorf("open archive: %w", err)
+	}
+	defer file.Close()
+	gz, err := gzip.NewReader(file)
+	if err != nil {
+		return fmt.Errorf("open gzip stream: %w", err)
+	}
+	defer gz.Close()
+	reader := tar.NewReader(gz)
+	root, err := filepath.Abs(destination)
+	if err != nil {
+		return fmt.Errorf("resolve extraction directory: %w", err)
+	}
+	entries := 0
+	var total int64
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("read archive: %w", err)
+		}
+		entries++
+		if entries > maxArchiveEntries {
+			return fmt.Errorf("release bundle has more than %d entries", maxArchiveEntries)
+		}
+		if header.Size < 0 || header.Size > maxEntryBytes || header.Size > maxExtractedBytes-total {
+			return fmt.Errorf("release bundle entry %q exceeds extraction limits", header.Name)
+		}
+		total += header.Size
+		name := path.Clean(header.Name)
+		if name != strings.TrimSuffix(header.Name, "/") || !fs.ValidPath(name) || name == "." {
+			return fmt.Errorf("unsafe path in release bundle: %s", header.Name)
+		}
+		target := filepath.Join(root, filepath.FromSlash(name))
+		if target != root && !strings.HasPrefix(target, root+string(os.PathSeparator)) {
+			return fmt.Errorf("unsafe path in release bundle: %s", header.Name)
+		}
+		mode := fs.FileMode(header.Mode & 0o777)
+		switch header.Typeflag {
+		case tar.TypeDir:
+			if err := os.MkdirAll(target, mode); err != nil {
+				return fmt.Errorf("create directory %s: %w", name, err)
+			}
+		case tar.TypeReg:
+			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+				return fmt.Errorf("create directory for %s: %w", name, err)
+			}
+			out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
+			if err != nil {
+				return fmt.Errorf("create %s: %w", name, err)
+			}
+			written, copyErr := io.Copy(out, io.LimitReader(reader, maxEntryBytes+1))
+			closeErr := out.Close()
+			if copyErr != nil {
+				return fmt.Errorf("extract %s: %w", name, copyErr)
+			}
+			if written != header.Size || written > maxEntryBytes {
+				return fmt.Errorf("release bundle entry %q has inconsistent size", header.Name)
+			}
+			if closeErr != nil {
+				return fmt.Errorf("close %s: %w", name, closeErr)
+			}
+		default:
+			return fmt.Errorf("release bundle entry %q has unsupported type", header.Name)
+		}
+	}
+}