dsh-clean-desktop-shell 0.1.8 → 0.1.10

package/scripts/check-syntax.mjs

@@ -0,0 +1,54 @@
+/**
+ * Syntax gate: `node --check` every JS file that ships in the package
+ * (electron/ main-process modules + lib/ host/client bundle). Previously
+ * only lib/index.js was checked — a syntax slip in any other file shipped
+ * unnoticed.
+ *
+ * The two sandboxed preloads are CommonJS (require/module.exports) while
+ * package.json declares "type": "module", so plain --check on them fails
+ * spuriously; they are validated through a temporary .cjs copy instead.
+ */
+import { spawnSync } from 'node:child_process'
+import { readdirSync, readFileSync, statSync, rmSync, writeFileSync, mkdtempSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)))
+// CJS files relative to electron/ — parsed as CommonJS despite the ESM package.
+const CJS_FILES = new Set(['preload.js', 'progress-preload.js'])
+
+function listJs(dir) {
+  return readdirSync(join(root, dir)).filter((f) => f.endsWith('.js'))
+}
+
+const scratch = mkdtempSync(join(tmpdir(), 'dsh-shell-check-'))
+let bad = 0
+let checked = 0
+
+try {
+  for (const dir of ['electron', 'lib']) {
+    for (const f of listJs(dir)) {
+      const full = join(root, dir, f)
+      if (!statSync(full).isFile()) continue
+      const cjs = CJS_FILES.has(f)
+      const target = cjs ? join(scratch, `${dir}-${f}.cjs`) : full
+      if (cjs) writeFileSync(target, readFileSync(full))
+      const r = spawnSync(process.execPath, ['--check', target], { stdio: 'pipe' })
+      const ok = r.status === 0
+      checked++
+      if (!ok) {
+        bad++
+        console.log(`  FAIL ${dir}/${f}${cjs ? ' (checked as CJS)' : ''}`)
+        if (r.stderr) console.error(r.stderr.toString().trim())
+      } else {
+        console.log(`  ok   ${dir}/${f}${cjs ? ' (checked as CJS)' : ''}`)
+      }
+    }
+  }
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}
+
+console.log(bad === 0 ? `PASS (${checked} files)` : `FAIL (${bad}/${checked} file(s))`)
+process.exit(bad === 0 ? 0 : 1)

package/src/host/common.js

@@ -6,6 +6,7 @@
  * location electron/ and build/ live in the published package.
  */
 import { homedir } from 'node:os'
+import { spawn } from 'node:child_process'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -51,3 +52,23 @@ export function runtimeRoot() {
 export function launchLogPath() {
   return join(dshHome(), 'desktop-shell-launch.log')
 }
+
+/**
+ * Download a file to disk via curl — shared by runtime provisioning and
+ * icon patching. Chosen over native fetch because undici (Node's fetch)
+ * ignores HTTP(S)_PROXY env vars unless a proxy dispatcher is wired in,
+ * while curl honors them out of the box (users behind Clash/v2ray rely on
+ * that). --max-time keeps a stalled proxy from hanging forever; --retry
+ * rides out transient failures.
+ */
+export function fetchFile(url, dest, timeoutSec = 600) {
+  return new Promise((resolve) => {
+    const child = spawn(
+      'curl',
+      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', String(timeoutSec), '-o', dest, url],
+      { windowsHide: true, stdio: 'ignore' },
+    )
+    child.on('error', () => resolve(false))
+    child.on('exit', (code) => resolve(code === 0))
+  })
+}

package/src/host/icon.js

@@ -14,7 +14,7 @@
 import { spawn } from 'node:child_process'
 import { existsSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { PKG_ROOT, isWin, runtimeRoot } from './common.js'
+import { PKG_ROOT, isWin, runtimeRoot, fetchFile } from './common.js'
 
 export async function patchExeIcon(ctx, exe) {
   if (!isWin) return
@@ -49,15 +49,3 @@ export async function patchExeIcon(ctx, exe) {
     ctx.logger.warn('[clean-desktop-shell] rcedit patch failed — taskbar icon stays default')
   }
 }
-
-function fetchFile(url, dest) {
-  return new Promise((resolve) => {
-    const child = spawn(
-      'curl',
-      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', '600', '-o', dest, url],
-      { windowsHide: true, stdio: 'ignore' },
-    )
-    child.on('error', () => resolve(false))
-    child.on('exit', (code) => resolve(code === 0))
-  })
-}

package/src/host/runtime.js

@@ -13,6 +13,8 @@
  *   4. drop stale electron-v* dirs (no unbounded disk growth)
  */
 import { spawn } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { createReadStream } from 'node:fs'
 import {
   cpSync,
   existsSync,
@@ -23,6 +25,7 @@ import {
   rmSync,
   symlinkSync,
 } from 'node:fs'
+import { pipeline } from 'node:stream/promises'
 import { basename, join } from 'node:path'
 import {
   PKG_ROOT,
@@ -33,6 +36,7 @@ import {
   isWin,
   isMac,
   runtimeRoot,
+  fetchFile,
 } from './common.js'
 
 function electronVersion() {
@@ -124,17 +128,26 @@ function ensureExecutable(ctx, target) {
 async function downloadRuntime(ctx, version, root, dir) {
   const tmpZip = join(root, `.electron-${version}.zip.tmp`)
   rmSync(tmpZip, { force: true })
-  const urls = await runtimeUrls(version)
-  const innerName = zipName(version).replace(/\.zip$/, '')
+  const candidates = await runtimeCandidates(version)
+  const zip = zipName(version)
+  const innerName = zip.replace(/\.zip$/, '')
 
-  for (const url of urls) {
-    ctx.logger.info(`[clean-desktop-shell] downloading electron ${version} from ${url}`)
-    if (!(await fetchFile(url, tmpZip))) {
+  for (const c of candidates) {
+    ctx.logger.info(`[clean-desktop-shell] downloading electron ${version} from ${c.url}`)
+    if (!(await fetchFile(c.url, tmpZip))) {
       // Failed download — drop the partial file so a later run starts clean.
       rmSync(tmpZip, { force: true })
       continue
     }
 
+    // Integrity check against the source's own SHASUMS256.txt (same check
+    // the `electron` package's installer performs). A mismatch means the
+    // bytes are corrupt or tampered — the source is skipped entirely.
+    if (!(await verifySha256(ctx, tmpZip, c.shasums, zip))) {
+      rmSync(tmpZip, { force: true })
+      continue
+    }
+
     // Extract into a scratch dir, never into the shared runtime root: a
     // half-extracted zip there would be indistinguishable from a real
     // runtime, and the sibling electron-v* dirs must not be disturbed.
@@ -142,7 +155,7 @@ async function downloadRuntime(ctx, version, root, dir) {
     const ok = await extractZip(ctx, tmpZip, scratch)
     rmSync(tmpZip, { force: true })
     if (!ok) {
-      ctx.logger.warn(`[clean-desktop-shell] no extractor succeeded for ${url}`)
+      ctx.logger.warn(`[clean-desktop-shell] no extractor succeeded for ${c.url}`)
       rmSync(scratch, { recursive: true, force: true })
       continue
     }
@@ -169,6 +182,54 @@ async function downloadRuntime(ctx, version, root, dir) {
   throw new Error('electron download failed from all sources')
 }
 
+/**
+ * Verify a downloaded zip against the source's SHASUMS256.txt — the same
+ * integrity check the `electron` package's own installer performs. Returns
+ * false on a checksum mismatch (fatal for that source); a temporarily
+ * unreachable SHASUMS file only warns, so a reachable zip is not wasted
+ * over an unrelated blocker.
+ */
+async function verifySha256(ctx, file, shasumsUrl, name) {
+  let expected = null
+  let reason = ''
+  try {
+    const res = await fetch(shasumsUrl, { signal: AbortSignal.timeout(10000) })
+    if (!res.ok) {
+      reason = `HTTP ${res.status}`
+    } else {
+      const text = await res.text()
+      for (const line of text.split('\n')) {
+        const m = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i)
+        if (m && m[2].trim() === name) {
+          expected = m[1].toLowerCase()
+          break
+        }
+      }
+      if (!expected) reason = 'entry not found'
+    }
+  } catch (err) {
+    reason = err?.message || 'fetch failed'
+  }
+  if (!expected) {
+    ctx.logger.warn(
+      `[clean-desktop-shell] SHASUMS256.txt unavailable from ${shasumsUrl} (${reason}) — skipping integrity check`,
+    )
+    return true
+  }
+  // Stream the hash — the zip can be ~270 MB and must not be read whole
+  // into memory.
+  const hash = createHash('sha256')
+  await pipeline(createReadStream(file), hash)
+  const actual = hash.digest('hex')
+  if (actual !== expected) {
+    ctx.logger.warn(
+      `[clean-desktop-shell] checksum mismatch for ${name}: expected ${expected}, got ${actual}`,
+    )
+    return false
+  }
+  return true
+}
+
 /** The dir that directly holds the electron payload right after extraction. */
 function findPayload(scratch, wrapper) {
   if (existsSync(join(wrapper, EXE_TOP))) return wrapper
@@ -212,21 +273,25 @@ function clearQuarantine(ctx, target) {
  * (direct connection, 3s each). The fastest reachable source goes first —
  * this naturally prefers the domestic npmmirror mirror on CN networks,
  * the official GitHub source on international/well-proxied networks, and
- * never wastes a full download on a dead source.
+ * never wastes a full download on a dead source. Each candidate carries
+ * its own SHASUMS256.txt location for the post-download integrity check.
  */
-async function runtimeUrls(version) {
+async function runtimeCandidates(version) {
+  const base = (name, urlBase) => ({
+    name,
+    url: `${urlBase}/${zipName(version)}`,
+    shasums: `${urlBase}/SHASUMS256.txt`,
+  })
   const candidates = [
-    { name: 'github', url: `https://github.com/electron/electron/releases/download/v${version}/${zipName(version)}` },
-    { name: 'npmmirror', url: `https://npmmirror.com/mirrors/electron/${version}/${zipName(version)}` },
+    base('github', `https://github.com/electron/electron/releases/download/v${version}`),
+    base('npmmirror', `https://npmmirror.com/mirrors/electron/${version}`),
   ]
   const results = await Promise.all(
     candidates.map(async (c) => {
       const t0 = Date.now()
       try {
-        const ctrl = new AbortController()
-        const timer = setTimeout(() => ctrl.abort(), 3000)
-        const res = await fetch(c.url, { signal: ctrl.signal, method: 'HEAD' })
-        clearTimeout(timer)
+        // AbortSignal.timeout — the standard self-cleaning probe timeout.
+        const res = await fetch(c.url, { signal: AbortSignal.timeout(3000), method: 'HEAD' })
         if (res.status < 500) return { ...c, ms: Date.now() - t0 }
       } catch {
         // unreachable — drop
@@ -237,26 +302,10 @@ async function runtimeUrls(version) {
   const ok = results.filter(Boolean).sort((a, b) => a.ms - b.ms)
   if (ok.length === 0) {
     // Probes all failed (offline?) — still try both, mirror first (cheap).
-    return [candidates[1].url, candidates[0].url]
+    return [candidates[1], candidates[0]]
   }
-  const rest = candidates.map((c) => c.url).filter((u) => u !== ok[0].url)
-  return [ok[0].url, ...rest]
-}
-
-function fetchFile(url, dest) {
-  return new Promise((resolve) => {
-    // curl is available on Windows 10+; streams to disk, honors proxy env.
-    // --max-time keeps a stalled download from hanging forever (a proxy
-    // stall previously left a half-written .zip.tmp and blocked the shell
-    // launch); --retry 2 rides out transient failures.
-    const child = spawn(
-      'curl',
-      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', '600', '-o', dest, url],
-      { windowsHide: true, stdio: 'ignore' },
-    )
-    child.on('error', () => resolve(false))
-    child.on('exit', (code) => resolve(code === 0))
-  })
+  const rest = candidates.filter((c) => c.url !== ok[0].url)
+  return [ok[0], ...rest]
 }
 
 /**

package/version.txt

@@ -1 +1 @@
-0.1.8
+0.1.10