dsh-wechat-remote 1.7.6 → 1.7.9

package/lib/install-profile.js

@@ -3,127 +3,71 @@
 // src/install-profile.ts
 import fs from "node:fs";
 import path from "node:path";
-import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-
-// src/secure-file.ts
-import { execFileSync } from "node:child_process";
-import {
-  chmodSync,
-  closeSync,
-  existsSync,
-  fsyncSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-import { dirname } from "node:path";
-import { userInfo } from "node:os";
-import { randomBytes } from "node:crypto";
-function tightenPrivateFile(file) {
-  try {
-    chmodSync(file, 384);
-  } catch {
-  }
-  if (process.platform !== "win32") return;
-  try {
-    execFileSync("icacls", [file, "/inheritance:r", "/grant:r", `${userInfo().username}:F`], {
-      timeout: 5e3,
-      windowsHide: true,
-      stdio: "ignore"
-    });
-  } catch {
-  }
-}
-function writePrivateJsonAtomic(file, value) {
-  const parent = dirname(file);
-  mkdirSync(parent, { recursive: true, mode: 448 });
-  const temporary = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  try {
-    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}
-`, {
-      encoding: "utf8",
-      mode: 384,
-      flag: "wx"
-    });
-    const fd = openSync(temporary, "r+");
-    try {
-      try {
-        fsyncSync(fd);
-      } catch {
-      }
-    } finally {
-      closeSync(fd);
-    }
-    tightenPrivateFile(temporary);
-    renameSync(temporary, file);
-    tightenPrivateFile(file);
-  } finally {
-    if (existsSync(temporary)) {
-      try {
-        rmSync(temporary, { force: true });
-      } catch {
-      }
-    }
-  }
-}
-
-// src/install-runtime.ts
-var INSTALL_PNPM_VERSION = "11.22.0";
-
-// src/install-profile.ts
+import { createHash, randomBytes } from "node:crypto";
+import { spawn, execFile } from "node:child_process";
 var PLUGIN_PACKAGE = "@harness-remote/dsh-wechat-remote";
 function safeProfileName(value) {
   return /^[A-Za-z0-9_-]{1,80}$/.test(value);
 }
-var hash = (file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
-function assertRelocatableProfile(root) {
-  const walk = (directory) => {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const file = path.join(directory, entry.name);
-      if (entry.isSymbolicLink()) {
-        const relative = path.relative(root, fs.realpathSync(file));
-        if (path.isAbsolute(fs.readlinkSync(file)) || !relative || relative.startsWith("..") || path.isAbsolute(relative)) {
-          throw new Error("\u63D2\u4EF6\u4F9D\u8D56\u5305\u542B\u4E0D\u53EF\u8FC1\u79FB\u7684\u94FE\u63A5\uFF0C\u672A\u4FEE\u6539\u5F53\u524D\u5B89\u88C5\u3002");
-        }
-      } else if (entry.isDirectory()) walk(file);
+function backupProfile(profile, backup) {
+  if (fs.existsSync(backup)) throw new Error("\u672C\u6B21\u5B89\u88C5\u5907\u4EFD\u5DF2\u5B58\u5728\uFF0C\u672A\u8986\u76D6\u3002");
+  fs.cpSync(profile, backup, {
+    recursive: true,
+    dereference: false,
+    verbatimSymlinks: true,
+    mode: fs.constants.COPYFILE_FICLONE,
+    filter(source, target) {
+      if (!fs.lstatSync(source).isSymbolicLink()) return true;
+      const type = process.platform === "win32" ? fs.statSync(source, { throwIfNoEntry: false })?.isDirectory() ? "junction" : "file" : void 0;
+      const link = fs.readlinkSync(source);
+      fs.symlinkSync(type === "junction" ? path.resolve(path.dirname(source), link) : link, target, type);
+      return false;
     }
-  };
-  walk(root);
+  });
 }
 function installToolPath(directory, runtime) {
   const bin = path.join(directory, "tool-bin");
   fs.mkdirSync(bin, { mode: 448 });
-  const runner = path.join(bin, "pnpm-run.cjs");
-  fs.writeFileSync(runner, `require('node:child_process').spawnSync(${JSON.stringify(runtime.executable)},[${JSON.stringify(runtime.cli)},...process.argv.slice(2)],{stdio:'inherit',shell:false,windowsHide:true}).status===0?process.exit(0):process.exit(1)
-`, { mode: 384 });
   if (process.platform === "win32") {
-    if (/["\r\n]/.test(runtime.executable)) throw new Error("Node \u5B89\u88C5\u8DEF\u5F84\u4E0D\u53D7\u652F\u6301\u3002");
-    fs.writeFileSync(path.join(bin, "pnpm.cmd"), `@echo off\r
-"${runtime.executable.replace(/%/g, "%%")}" "%~dp0pnpm-run.cjs" %*\r
-`, { mode: 448 });
+    if (/["\r\n]/.test(runtime.executable + runtime.cli)) throw new Error("\u5B89\u88C5\u5DE5\u5177\u8DEF\u5F84\u5305\u542B\u65E0\u6548\u5B57\u7B26\u3002");
+    fs.writeFileSync(path.join(bin, "pnpm.cmd"), '@echo off\r\nsetlocal DisableDelayedExpansion\r\n"%HARNESS_INSTALL_NODE%" "%HARNESS_INSTALL_PNPM%" %*\r\n', { mode: 448 });
   } else {
-    const quote = (s) => "'" + s.replace(/'/g, `'"'"'`) + "'";
-    fs.writeFileSync(path.join(bin, "pnpm"), `#!/bin/sh
-exec ${quote(runtime.executable)} ${quote(runner)} "$@"
-`, { mode: 448 });
+    fs.writeFileSync(path.join(bin, "pnpm"), '#!/bin/sh\nexec "$HARNESS_INSTALL_NODE" "$HARNESS_INSTALL_PNPM" "$@"\n', { mode: 448 });
   }
   return bin;
 }
-function runNativePlugin(cli, profile, home, toolPath, runtime, logFile) {
-  if (!safeProfileName(profile)) throw new Error("\u65E0\u6548\u7684 DSH profile \u540D\u79F0\u3002");
+var NativeInstallError = class extends Error {
+  constructor(message, mayStillBeRunning = false) {
+    super(message);
+    this.mayStillBeRunning = mayStillBeRunning;
+    this.name = "NativeInstallError";
+  }
+};
+function runNativePlugin(cli, profile, home, toolPath, runtime, logFile, archiveName, timeoutMs = 6e5, operation = "add") {
+  if (!safeProfileName(profile) || !/^harness-remote-[\w.+-]+\.tgz$/.test(archiveName)) throw new Error("\u65E0\u6548\u7684\u5B89\u88C5\u76EE\u6807\u3002");
   return new Promise((resolve, reject) => {
     const log = fs.openSync(logFile, "a", 384);
+    const env = { ...process.env };
+    const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path");
+    const inheritedPath = pathKey ? env[pathKey] : "";
+    if (process.platform === "win32") {
+      for (const key of Object.keys(env)) if (key.toLowerCase() === "path") delete env[key];
+    }
+    Object.assign(env, {
+      DSH_HOME: home,
+      PATH: toolPath + path.delimiter + (inheritedPath || ""),
+      HARNESS_INSTALL_NODE: runtime.executable,
+      HARNESS_INSTALL_PNPM: runtime.cli,
+      CI: "true",
+      COREPACK_ENABLE_AUTO_PIN: "0",
+      npm_config_manage_package_manager_versions: "false"
+    });
     const child = spawn(runtime.executable, [
       cli,
       "plugin",
       "--profile",
       profile,
-      "add",
-      "file:harness-remote-update.tgz",
+      ...operation === "install" ? ["install"] : ["add", `file:${archiveName}`],
       "--ignore-scripts",
       "--config.frozen-lockfile=false",
       "--prefer-offline",
@@ -133,78 +77,89 @@ function runNativePlugin(cli, profile, home, toolPath, runtime, logFile) {
       cwd: home,
       shell: false,
       windowsHide: true,
+      detached: process.platform !== "win32",
       stdio: ["ignore", log, log],
-      env: {
-        ...process.env,
-        DSH_HOME: home,
-        PATH: toolPath + path.delimiter + (process.env.PATH || ""),
-        CI: "true",
-        COREPACK_ENABLE_AUTO_PIN: "0",
-        npm_config_manage_package_manager_versions: "false"
-      }
+      env
     });
     fs.closeSync(log);
-    const timer = setTimeout(() => {
-      child.kill();
-      reject(new Error("\u4E0B\u8F7D\u6216\u5B89\u88C5\u8D85\u65F6\uFF0C\u539F\u63D2\u4EF6\u672A\u66FF\u6362\u3002"));
-    }, 24e4);
-    child.once("error", () => {
+    let finished = false, terminating = false, closed = false, terminationTimer;
+    const fail = (message, uncertain = false) => finish(new NativeInstallError(`${message} \u5B89\u88C5\u65E5\u5FD7\uFF1A${logFile}`, uncertain));
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
       clearTimeout(timer);
-      reject(new Error("\u65E0\u6CD5\u542F\u52A8 DSH \u539F\u751F\u5B89\u88C5\u7A0B\u5E8F\u3002"));
-    });
-    child.once("close", (code) => {
-      clearTimeout(timer);
-      code === 0 ? resolve() : reject(new Error("\u5B89\u88C5\u672A\u5B8C\u6210\uFF0C\u539F\u63D2\u4EF6\u672A\u66FF\u6362\uFF1B\u8BE6\u60C5\u5DF2\u4FDD\u7559\u5728\u672C\u673A\u5B89\u88C5\u65E5\u5FD7\u3002"));
+      clearTimeout(terminationTimer);
+      error ? reject(error) : resolve();
+    };
+    const timer = setTimeout(() => {
+      if (closed) return;
+      terminating = true;
+      terminationTimer = setTimeout(() => fail("\u5B89\u88C5\u8D85\u65F6\uFF0C\u5C1A\u4E0D\u80FD\u786E\u8BA4\u5B89\u88C5\u8FDB\u7A0B\u5DF2\u9000\u51FA\uFF1B\u672A\u81EA\u52A8\u56DE\u9000\uFF0C\u8BF7\u52FF\u91CD\u590D\u5B89\u88C5\u3002", true), 15e3);
+      if (process.platform === "win32") {
+        if (!child.pid) return fail("\u5B89\u88C5\u7A0B\u5E8F\u672A\u542F\u52A8\u3002");
+        execFile(
+          path.join(process.env.SystemRoot || "C:\\Windows", "System32", "taskkill.exe"),
+          ["/PID", String(child.pid), "/T", "/F"],
+          { windowsHide: true, timeout: 1e4 },
+          (error) => {
+            if (error) fail("\u5B89\u88C5\u8D85\u65F6\uFF0C\u65E0\u6CD5\u786E\u8BA4\u5B89\u88C5\u8FDB\u7A0B\u6811\u5DF2\u9000\u51FA\uFF1B\u672A\u81EA\u52A8\u56DE\u9000\uFF0C\u8BF7\u52FF\u91CD\u590D\u5B89\u88C5\u3002", true);
+            else if (closed) fail("\u4E0B\u8F7D\u6216\u5B89\u88C5\u8D85\u65F6\uFF0C\u5B89\u88C5\u8FDB\u7A0B\u5DF2\u505C\u6B62\u3002");
+            else child.once("close", () => fail("\u4E0B\u8F7D\u6216\u5B89\u88C5\u8D85\u65F6\uFF0C\u5B89\u88C5\u8FDB\u7A0B\u5DF2\u505C\u6B62\u3002"));
+          }
+        );
+      } else {
+        try {
+          if (child.pid) process.kill(-child.pid, "SIGKILL");
+        } catch (error) {
+          if (error.code !== "ESRCH") return fail("\u65E0\u6CD5\u505C\u6B62\u8D85\u65F6\u7684\u5B89\u88C5\u8FDB\u7A0B\uFF1B\u672A\u81EA\u52A8\u56DE\u9000\u3002", true);
+        }
+        if (closed) fail("\u4E0B\u8F7D\u6216\u5B89\u88C5\u8D85\u65F6\uFF0C\u5B89\u88C5\u8FDB\u7A0B\u5DF2\u505C\u6B62\u3002");
+        else child.once("close", () => fail("\u4E0B\u8F7D\u6216\u5B89\u88C5\u8D85\u65F6\uFF0C\u5B89\u88C5\u8FDB\u7A0B\u5DF2\u505C\u6B62\u3002"));
+      }
+    }, timeoutMs);
+    child.once("error", (error) => fail(`\u65E0\u6CD5\u542F\u52A8 DSH \u539F\u751F\u5B89\u88C5\u7A0B\u5E8F\uFF08${error.code || error.name}\uFF09\u3002`));
+    child.once("close", (code, signal) => {
+      closed = true;
+      if (terminating) return;
+      if (code === 0) finish();
+      else fail(`DSH \u539F\u751F\u5B89\u88C5\u672A\u5B8C\u6210\uFF08${signal ? `\u4FE1\u53F7 ${signal}` : `\u9000\u51FA\u7801 ${code}`}\uFF09\u3002`);
     });
   });
 }
-async function stageProfile(job) {
-  const scope = path.basename(job.profile);
-  if (!safeProfileName(scope) || !fs.statSync(job.directory).isDirectory()) throw new Error("\u5B89\u88C5\u76EE\u6807\u4E0D\u660E\u786E\u3002");
-  const stagingHome = path.join(job.directory, "staging-home"), staged = path.join(stagingHome, "profiles", scope);
-  fs.mkdirSync(staged, { recursive: true, mode: 448 });
-  if (fs.existsSync(job.profile)) {
-    if (fs.lstatSync(job.profile).isSymbolicLink() || fs.realpathSync(job.profile) !== path.resolve(job.profile)) throw new Error("\u4E0D\u652F\u6301\u81EA\u52A8\u66FF\u6362\u94FE\u63A5\u5F62\u5F0F\u7684 profile\u3002");
-    fs.cpSync(job.profile, staged, {
-      recursive: true,
-      dereference: false,
-      filter: (p) => !["node_modules", ".harness-remote-update.lock"].includes(path.basename(p))
-    });
-  }
-  let before = null;
-  const filename = path.join(staged, "package.json");
-  if (fs.existsSync(filename)) {
-    before = JSON.parse(fs.readFileSync(filename, "utf8"));
-    for (const [name, spec] of Object.entries(before.dependencies || {})) {
-      if (name !== PLUGIN_PACKAGE && !/^[~^]?\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(String(spec))) throw new Error("\u5176\u4ED6\u63D2\u4EF6\u4F7F\u7528\u4E86\u672C\u5730\u94FE\u63A5\u6216\u7279\u6B8A\u6765\u6E90\uFF0C\u672A\u4FEE\u6539\u5F53\u524D\u5B89\u88C5\u3002");
-    }
-    for (const e of fs.readdirSync(staged, { withFileTypes: true })) if (e.isSymbolicLink()) throw new Error("profile \u914D\u7F6E\u5305\u542B\u94FE\u63A5\uFF0C\u672A\u4FEE\u6539\u5F53\u524D\u5B89\u88C5\u3002");
-    if (before.packageManager && !/^pnpm@\d+\.\d+\.\d+(?:\+.*)?$/.test(before.packageManager)) throw new Error("\u5F53\u524D profile \u4F7F\u7528\u4E86\u5176\u4ED6\u5305\u7BA1\u7406\u5668\uFF0C\u672A\u4FEE\u6539\u5B89\u88C5\u3002");
-    writePrivateJsonAtomic(filename, { ...before, dependencies: {
-      ...before.dependencies,
-      [PLUGIN_PACKAGE]: "file:harness-remote-update.tgz"
-    }, packageManager: `pnpm@${INSTALL_PNPM_VERSION}` });
-  }
-  fs.copyFileSync(path.join(job.directory, "release.tgz"), path.join(staged, "harness-remote-update.tgz"));
+async function installProfile(job) {
+  const scope = path.basename(job.profile), home = path.dirname(path.dirname(job.profile));
+  if (!safeProfileName(scope) || path.dirname(job.profile) !== path.join(home, "profiles") || !/^[\w.+-]{1,80}$/.test(job.targetVersion)) throw new Error("\u5B89\u88C5\u76EE\u6807\u4E0D\u660E\u786E\u3002");
+  fs.mkdirSync(job.profile, { recursive: true, mode: 448 });
+  const archive = path.join(job.directory, "release.tgz");
+  const digest = createHash("sha256").update(fs.readFileSync(archive)).digest("hex");
+  const archiveBase = `harness-remote-${job.targetVersion}-${digest}`;
+  const suffix = fs.existsSync(path.join(job.profile, `${archiveBase}.tgz`)) ? `-${randomBytes(8).toString("hex")}` : "";
+  const archiveName = `${archiveBase}${suffix}.tgz`;
+  fs.copyFileSync(archive, path.join(job.profile, archiveName), fs.constants.COPYFILE_EXCL);
   const tools = installToolPath(job.directory, job.runtime);
-  await runNativePlugin(job.cli, scope, stagingHome, tools, job.runtime, path.join(job.directory, "install.log"));
-  const installed = fs.realpathSync(path.join(staged, "node_modules", PLUGIN_PACKAGE));
-  const relative = path.relative(staged, installed);
-  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("\u6682\u5B58\u63D2\u4EF6\u4E0D\u5728\u5B89\u88C5\u76EE\u5F55\u5185\u3002");
+  const logFile = path.join(job.directory, "install.log");
+  const deadline = Date.now() + 6e5;
+  const run = (operation = "add") => runNativePlugin(job.cli, scope, home, tools, job.runtime, logFile, archiveName, Math.max(1, deadline - Date.now()), operation);
+  try {
+    await run();
+  } catch (error) {
+    const layoutError = /^\s*(?:\[ERR_PNPM_|ERR_PNPM_)(?:UNEXPECTED_VIRTUAL_STORE|UNEXPECTED_STORE|MODULES_BREAKING_CHANGE|VIRTUAL_STORE_DIR_MAX_LENGTH_DIFF|PUBLIC_HOIST_PATTERN_DIFF|HOIST_PATTERN_DIFF)(?:\]|\s)/m;
+    if (!(error instanceof NativeInstallError) || error.mayStillBeRunning || !layoutError.test(fs.readFileSync(logFile, "utf8"))) throw error;
+    fs.appendFileSync(logFile, "\nRestoring native pnpm layout with dsh plugin install.\n");
+    await run("install");
+    await run();
+  }
+  const installed = path.join(job.profile, "node_modules", PLUGIN_PACKAGE);
   if (JSON.parse(fs.readFileSync(path.join(installed, "package.json"), "utf8")).version !== job.targetVersion) throw new Error("\u5B89\u88C5\u540E\u63D2\u4EF6\u7248\u672C\u4E0D\u5339\u914D\u3002");
-  const after = JSON.parse(fs.readFileSync(filename, "utf8"));
+  const after = JSON.parse(fs.readFileSync(path.join(job.profile, "package.json"), "utf8"));
   if (!after.dsh?.profile?.bundles?.includes(PLUGIN_PACKAGE)) throw new Error("DSH \u5C1A\u672A\u5C06\u63D2\u4EF6\u6CE8\u518C\u4E3A\u539F\u751F profile \u5C42\u3002");
-  for (const name of Object.keys(before?.dependencies || {})) if (name !== PLUGIN_PACKAGE) {
-    if (hash(path.join(job.profile, "node_modules", name, "package.json")) !== hash(path.join(staged, "node_modules", name, "package.json"))) throw new Error("\u5B89\u88C5\u8BD5\u56FE\u6539\u53D8\u5176\u4ED6\u63D2\u4EF6\uFF0C\u539F\u5B89\u88C5\u4FDD\u6301\u4E0D\u53D8\u3002");
-  }
-  assertRelocatableProfile(staged);
-  return staged;
 }
 export {
+  NativeInstallError,
   PLUGIN_PACKAGE,
-  assertRelocatableProfile,
+  backupProfile,
+  installProfile,
   installToolPath,
   runNativePlugin,
-  safeProfileName,
-  stageProfile
+  safeProfileName
 };

package/lib/install-runtime.js

@@ -6,6 +6,22 @@ import path from "node:path";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 var INSTALL_PNPM_VERSION = "11.22.0";
+async function pinInstallRuntime(runtime, directory) {
+  let root = path.dirname(runtime.cli);
+  while (!fs.existsSync(path.join(root, "package.json"))) {
+    const parent = path.dirname(root);
+    if (parent === root) throw new Error("\u65E0\u6CD5\u5B9A\u4F4D\u5B89\u88C5\u5DE5\u5177\u5305\u3002");
+    root = parent;
+  }
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+  if (manifest.name !== "pnpm" || manifest.version !== runtime.version) throw new Error("\u5B89\u88C5\u5DE5\u5177\u7248\u672C\u4E0D\u4E00\u81F4\u3002");
+  const target = path.join(directory, "install-runtime");
+  if (fs.existsSync(target)) throw new Error("\u672C\u6B21\u5B89\u88C5\u5DE5\u5177\u76EE\u5F55\u5DF2\u5B58\u5728\u3002");
+  fs.cpSync(root, target, { recursive: true, dereference: false, verbatimSymlinks: true, mode: fs.constants.COPYFILE_FICLONE });
+  const pinned = { ...runtime, cli: path.join(target, path.relative(root, runtime.cli)) };
+  await verifyInstallRuntime(pinned);
+  return pinned;
+}
 function resolveInstallRuntime(owner, executable = process.execPath, nodeVersion = process.versions.node) {
   const [major, minor] = nodeVersion.split(".").map(Number);
   if (!(major > 22 || major === 22 && minor >= 13)) throw new Error("\u5F53\u524D Node.js \u7248\u672C\u4E0D\u6EE1\u8DB3\u5B89\u88C5\u8981\u6C42\uFF0822.13 \u6216\u66F4\u9AD8\uFF09\uFF0C\u672A\u4FEE\u6539\u63D2\u4EF6\u3002");
@@ -59,6 +75,7 @@ function verifyInstallRuntime(runtime) {
 }
 export {
   INSTALL_PNPM_VERSION,
+  pinInstallRuntime,
   resolveInstallRuntime,
   verifyInstallRuntime
 };