farming-code 2.2.20 → 2.2.22

package/backend/theme-manager.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const storageLayout = require('./storage-layout');
 
 class ThemeManager {
@@ -79,14 +80,27 @@ class ThemeManager {
     )));
   }
   
-  saveUserThemeSettings() {
+  saveUserThemeSettings(settings = this.userThemeSettings) {
+    let temporaryFile = '';
     try {
       if (!fs.existsSync(this.farmingDir)) {
         fs.mkdirSync(this.farmingDir, { recursive: true });
       }
-      fs.writeFileSync(this.themeSettingsFile, JSON.stringify(this.userThemeSettings, null, 2));
+      temporaryFile = `${this.themeSettingsFile}.${process.pid}.${crypto.randomUUID()}.tmp`;
+      fs.writeFileSync(temporaryFile, JSON.stringify(settings, null, 2), { flag: 'wx', mode: 0o600 });
+      fs.renameSync(temporaryFile, this.themeSettingsFile);
+      return true;
     } catch (error) {
       console.error('Failed to save user theme settings:', error.message);
+      return false;
+    } finally {
+      if (temporaryFile) {
+        try {
+          fs.unlinkSync(temporaryFile);
+        } catch {
+          // A successful rename already removed the temporary path.
+        }
+      }
     }
   }
   
@@ -132,12 +146,16 @@ class ThemeManager {
     }
     
     const normalizedSettings = this.normalizeThemeSettings(settings);
-    this.userThemeSettings[themeId] = {
+    const nextUserThemeSettings = {
       ...this.userThemeSettings[themeId],
       ...normalizedSettings
     };
-    
-    this.saveUserThemeSettings();
+    const nextSettings = {
+      ...this.userThemeSettings,
+      [themeId]: nextUserThemeSettings,
+    };
+    if (!this.saveUserThemeSettings(nextSettings)) return false;
+    this.userThemeSettings = nextSettings;
     return true;
   }
 }

package/backend/update-service.js

@@ -5,6 +5,7 @@ const http = require('http');
 const https = require('https');
 const os = require('os');
 const path = require('path');
+const { Transform } = require('stream');
 const { pipeline } = require('stream/promises');
 const storageLayout = require('./storage-layout');
 
@@ -581,7 +582,26 @@ async function downloadFile(url, outputPath, options = {}) {
     ...options,
     accept: 'application/octet-stream',
   });
-  await pipeline(response, fs.createWriteStream(outputPath));
+  const responseLength = Number(response.headers['content-length']);
+  const expectedLength = Number(options.totalBytes);
+  const totalBytes = Number.isFinite(responseLength) && responseLength > 0
+    ? responseLength
+    : (Number.isFinite(expectedLength) && expectedLength > 0 ? expectedLength : 0);
+  let receivedBytes = 0;
+  const trackProgress = new Transform({
+    transform(chunk, _encoding, callback) {
+      receivedBytes += chunk.length;
+      try {
+        if (typeof options.onProgress === 'function') {
+          options.onProgress({ receivedBytes, totalBytes });
+        }
+        callback(null, chunk);
+      } catch (error) {
+        callback(error);
+      }
+    },
+  });
+  await pipeline(response, trackProgress, fs.createWriteStream(outputPath));
 }
 
 function sha256File(filePath) {
@@ -685,6 +705,11 @@ function normalizePathForCompare(filePath) {
   }
 }
 
+function pathIsInside(parentPath, childPath) {
+  const relative = path.relative(path.resolve(parentPath), path.resolve(childPath));
+  return relative !== '' && !relative.startsWith('..') && !path.isAbsolute(relative);
+}
+
 function npmPackageRoot(npmRoot, packageName) {
   return path.join(npmRoot, ...String(packageName || '').split('/').filter(Boolean));
 }
@@ -767,8 +792,10 @@ class FarmingUpdateService {
     this.latestCache = null;
     this.npmCache = null;
     this.installState = { phase: 'idle' };
+    this.installStartPromise = null;
     this.updateStateFile = options.updateStateFile || storageLayout.updateStateFile(this.configDir);
     this.updateLogFile = options.updateLogFile || storageLayout.updateLogFile(this.configDir);
+    this.updateStagingDir = options.updateStagingDir || storageLayout.updateStagingDir(this.configDir);
   }
 
   updateUrl() {
@@ -1089,10 +1116,22 @@ class FarmingUpdateService {
   }
 
   async startInstall(options = {}) {
+    if (this.installStartPromise) return this.installStartPromise;
+    const startPromise = this.startInstallUnreserved(options);
+    this.installStartPromise = startPromise;
+    try {
+      return await startPromise;
+    } finally {
+      if (this.installStartPromise === startPromise) this.installStartPromise = null;
+    }
+  }
+
+  async startInstallUnreserved(options = {}) {
     const currentState = this.currentInstallState();
     if (['downloading', 'extracting', 'installing', 'restarting', 'rolling-back'].includes(currentState.phase)) {
       return currentState;
     }
+    if (currentState.phase === 'ready-to-restart') return currentState;
 
     if (this.installMethod === 'npm') return this.startNpmInstall(options);
     if (!installMethodAllowsBundleUpdate(this.installMethod)) {
@@ -1127,6 +1166,8 @@ class FarmingUpdateService {
       version: status.selected.version,
       previousVersion: status.current.releaseVersion || status.current.packageVersion,
       assetName: status.selected.assetName,
+      receivedBytes: 0,
+      totalBytes: Number(status.selected.assetSize) || 0,
       startedAt: new Date(this.now()).toISOString(),
       logPath: path.join(this.configDir, 'farming-update.log'),
     });
@@ -1154,18 +1195,27 @@ class FarmingUpdateService {
     }
 
     const startedAt = new Date(this.now()).toISOString();
+    fs.mkdirSync(this.updateStagingDir, { recursive: true });
+    const stagingPrefix = fs.mkdtempSync(path.join(this.updateStagingDir, `npm-${status.selected.version}.`));
+    const stagingPackageRoot = npmPackageRoot(
+      path.join(stagingPrefix, 'lib', 'node_modules'),
+      this.npmPackageName,
+    );
     const state = this.persistInstallState({
       method: 'npm',
       phase: 'installing',
       version: status.selected.version,
       previousVersion: status.current.releaseVersion || status.current.packageVersion,
       packageName: this.npmPackageName,
+      stagingPrefix,
+      stagingPackageRoot,
       startedAt,
       logPath: this.updateLogFile,
     });
     const helperPath = path.join(__dirname, 'npm-update-helper.js');
     const nodePath = process.env.FARMING_NODE_BIN || process.execPath;
     const payload = {
+      action: 'prepare',
       packageName: this.npmPackageName,
       targetVersion: status.selected.version,
       previousVersion: status.current.releaseVersion || status.current.packageVersion,
@@ -1177,6 +1227,8 @@ class FarmingUpdateService {
       nodePath,
       npmCommand: process.env.FARMING_NPM_COMMAND || 'npm',
       npmPrefix: status.target.npmPrefix,
+      stagingPrefix,
+      stagingPackageRoot,
       npmFallbackRegistryUrl: this.npmRegistryUrl,
       serverPid: process.pid,
       configDir: this.configDir,
@@ -1186,7 +1238,7 @@ class FarmingUpdateService {
       disableAuth: /^(1|true|yes|on)$/i.test(String(process.env.FARMING_DISABLE_AUTH || '')),
     };
     const helperInvocation = nodeScriptInvocation(nodePath, helperPath);
-    const child = this.spawn(helperInvocation.command, helperInvocation.args, {
+    const spawnOptions = {
       cwd: this.configDir,
       detached: true,
       stdio: 'ignore',
@@ -1194,7 +1246,169 @@ class FarmingUpdateService {
         ...process.env,
         FARMING_NPM_UPDATE_PAYLOAD: JSON.stringify(payload),
       },
+    };
+    let child;
+    try {
+      child = this.spawn(helperInvocation.command, helperInvocation.args, spawnOptions);
+    } catch (error) {
+      fs.rmSync(stagingPrefix, { recursive: true, force: true });
+      this.persistInstallState({
+        ...state,
+        phase: 'failed',
+        error: error.message || String(error),
+        completedAt: new Date(this.now()).toISOString(),
+      });
+      throw error;
+    }
+    if (child && typeof child.once === 'function') {
+      child.once('error', (error) => {
+        fs.rmSync(stagingPrefix, { recursive: true, force: true });
+        this.persistInstallState({
+          ...state,
+          phase: 'failed',
+          error: error.message || String(error),
+          completedAt: new Date(this.now()).toISOString(),
+        });
+      });
+    }
+    if (child && typeof child.unref === 'function') child.unref();
+    return state;
+  }
+
+  async applyPreparedUpdate() {
+    if (this.installStartPromise) return this.installStartPromise;
+    const applyPromise = this.applyPreparedUpdateUnreserved();
+    this.installStartPromise = applyPromise;
+    try {
+      return await applyPromise;
+    } finally {
+      if (this.installStartPromise === applyPromise) this.installStartPromise = null;
+    }
+  }
+
+  async applyPreparedUpdateUnreserved() {
+    const prepared = this.currentInstallState();
+    if (prepared.phase !== 'ready-to-restart') {
+      throw new Error('No prepared Farming update is ready to restart');
+    }
+    const current = this.currentVersion();
+    const currentVersion = normalizeVersion(current.releaseVersion || current.packageVersion);
+    if (normalizeVersion(prepared.previousVersion) !== currentVersion) {
+      const error = 'Prepared update no longer matches the running Farming version';
+      this.persistInstallState({ ...prepared, phase: 'failed', error, completedAt: new Date(this.now()).toISOString() });
+      throw new Error(error);
+    }
+
+    const nodePath = process.env.FARMING_NODE_BIN || process.execPath;
+    let helperPath;
+    let payload;
+    let env;
+    if (this.installMethod === 'npm') {
+      const target = await this.npmUpdateTarget();
+      if (!target.proven) throw new Error(target.error);
+      if (!path.isAbsolute(String(prepared.stagingPrefix || '')) || !path.isAbsolute(String(prepared.stagingPackageRoot || ''))) {
+        throw new Error('Prepared npm update is missing its staging identity');
+      }
+      const stagingPrefix = normalizePathForCompare(prepared.stagingPrefix);
+      if (!pathIsInside(normalizePathForCompare(this.updateStagingDir), stagingPrefix)) {
+        throw new Error('Prepared npm update is outside the Farming staging directory');
+      }
+      if (path.resolve(prepared.stagingPackageRoot) !== path.resolve(npmPackageRoot(
+        path.join(prepared.stagingPrefix, 'lib', 'node_modules'),
+        this.npmPackageName,
+      ))) {
+        throw new Error('Prepared npm update has an invalid package root');
+      }
+      const stagingPackageRoot = normalizePathForCompare(prepared.stagingPackageRoot);
+      const stagedMetadata = readJsonFile(path.join(stagingPackageRoot, 'package.json')) || {};
+      if (normalizeVersion(stagedMetadata.version) !== normalizeVersion(prepared.version)) {
+        throw new Error('Prepared npm update is no longer available; prepare it again');
+      }
+      helperPath = path.join(__dirname, 'npm-update-helper.js');
+      payload = {
+        action: 'apply',
+        packageName: this.npmPackageName,
+        targetVersion: prepared.version,
+        previousVersion: prepared.previousVersion,
+        startedAt: prepared.startedAt,
+        preparedAt: prepared.preparedAt,
+        stateFile: this.updateStateFile,
+        logPath: prepared.logPath || this.updateLogFile,
+        cliPath: path.join(this.rootDir, 'bin', 'farming'),
+        packageRoot: target.packageRoot,
+        nodePath,
+        npmCommand: process.env.FARMING_NPM_COMMAND || 'npm',
+        npmPrefix: target.npmPrefix,
+        npmFallbackRegistryUrl: this.npmRegistryUrl,
+        stagingPrefix,
+        stagingPackageRoot,
+        serverPid: process.pid,
+        configDir: this.configDir,
+        port: process.env.FARMING_PORT || process.env.PORT || '6694',
+        basePath: process.env.FARMING_BASE_PATH || '/farming',
+        serverHome: process.env.FARMING_SERVER_HOME || '',
+        disableAuth: /^(1|true|yes|on)$/i.test(String(process.env.FARMING_DISABLE_AUTH || '')),
+      };
+      env = { ...process.env, FARMING_NPM_UPDATE_PAYLOAD: JSON.stringify(payload) };
+    } else {
+      if (!installMethodAllowsBundleUpdate(this.installMethod)) {
+        throw new Error(installMethodBlockedReason(this.installMethod));
+      }
+      if (!path.isAbsolute(String(prepared.releaseDir || '')) || !path.isAbsolute(String(prepared.installer || '')) || !fs.existsSync(prepared.installer)) {
+        throw new Error('Prepared bundle update is no longer available; prepare it again');
+      }
+      const releaseDir = normalizePathForCompare(prepared.releaseDir);
+      const installer = normalizePathForCompare(prepared.installer);
+      if (!pathIsInside(normalizePathForCompare(os.tmpdir()), releaseDir)
+        || !path.basename(path.dirname(releaseDir)).startsWith('farming-update.')
+        || installer !== normalizePathForCompare(path.join(releaseDir, 'scripts', 'install-release.sh'))) {
+        throw new Error('Prepared bundle update has an invalid staging identity');
+      }
+      const releaseMetadata = readJsonFile(path.join(releaseDir, 'RELEASE.json')) || {};
+      const preparedVersion = normalizeVersion(releaseMetadata.releaseVersion || releaseMetadata.packageVersion);
+      if (preparedVersion && preparedVersion !== normalizeVersion(prepared.version)) {
+        throw new Error('Prepared bundle version does not match the selected update');
+      }
+      if (!assetMatchesRuntime(releaseMetadata, this.runtime)) {
+        throw new Error(`Prepared bundle is not compatible with ${this.runtime.platform}-${this.runtime.arch}`);
+      }
+      helperPath = path.join(__dirname, 'bundle-update-helper.js');
+      payload = {
+        method: this.installMethod,
+        targetMethod: prepared.targetMethod,
+        version: prepared.version,
+        previousVersion: prepared.previousVersion,
+        startedAt: prepared.startedAt,
+        preparedAt: prepared.preparedAt,
+        stateFile: this.updateStateFile,
+        logPath: prepared.logPath || this.updateLogFile,
+        releaseDir,
+        installer,
+      };
+      env = { ...this.installEnvironment(), FARMING_BUNDLE_UPDATE_PAYLOAD: JSON.stringify(payload) };
+    }
+
+    const state = this.persistInstallState({ ...prepared, phase: 'restarting', error: '' });
+    const helperInvocation = nodeScriptInvocation(nodePath, helperPath);
+    const spawnOptions = {
+      cwd: this.configDir,
+      detached: true,
+      stdio: 'ignore',
+      env,
+    };
+    const restorePreparedState = (error) => this.persistInstallState({
+      ...prepared,
+      phase: 'ready-to-restart',
+      error: error.message || String(error),
     });
+    let child;
+    try {
+      child = this.spawn(helperInvocation.command, helperInvocation.args, spawnOptions);
+    } catch (error) {
+      restorePreparedState(error);
+      throw error;
+    }
+    if (child && typeof child.once === 'function') child.once('error', restorePreparedState);
     if (child && typeof child.unref === 'function') child.unref();
     return state;
   }
@@ -1207,8 +1421,28 @@ class FarmingUpdateService {
     fs.mkdirSync(this.configDir, { recursive: true });
     const tempRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'farming-update.'));
     const archivePath = path.join(tempRoot, asset.name || 'farming-update.tar.gz');
+    let lastProgressPercent = -1;
+    let lastProgressBytes = 0;
     await this.downloadFile(asset.browser_download_url, archivePath, {
       authToken: this.authToken,
+      totalBytes: Number(asset.size) || Number(this.installState.totalBytes) || 0,
+      onProgress: ({ receivedBytes, totalBytes }) => {
+        const safeReceivedBytes = Math.max(0, Number(receivedBytes) || 0);
+        const safeTotalBytes = Math.max(0, Number(totalBytes) || 0);
+        if (safeTotalBytes > 0) {
+          const percent = Math.min(100, Math.floor((safeReceivedBytes / safeTotalBytes) * 100));
+          if (percent === lastProgressPercent && safeReceivedBytes < safeTotalBytes) return;
+          lastProgressPercent = percent;
+        } else if (safeReceivedBytes - lastProgressBytes < 1024 * 1024) {
+          return;
+        }
+        lastProgressBytes = safeReceivedBytes;
+        this.persistInstallState({
+          ...this.installState,
+          receivedBytes: safeReceivedBytes,
+          totalBytes: safeTotalBytes,
+        });
+      },
     });
     let expectedSha256 = normalizeSha256(asset.sha256);
     const checksumUrl = asset.checksum_url || asset.checksumUrl || '';
@@ -1249,37 +1483,15 @@ class FarmingUpdateService {
     }
     const logPath = this.installState.logPath || path.join(this.configDir, 'farming-update.log');
     const targetMethod = String(releaseMetadata.updateMethod || releaseMetadata.type || this.installMethod);
-    const helperPath = path.join(__dirname, 'bundle-update-helper.js');
-    const nodePath = process.env.FARMING_NODE_BIN || process.execPath;
-    const helperInvocation = nodeScriptInvocation(nodePath, helperPath);
-    const payload = {
-      method: this.installMethod,
-      targetMethod,
-      version: this.installState.version,
-      previousVersion: this.installState.previousVersion,
-      startedAt: this.installState.startedAt,
-      stateFile: this.updateStateFile,
-      logPath,
-      releaseDir,
-      installer,
-    };
     this.persistInstallState({
       ...this.installState,
-      phase: 'installing',
+      phase: 'ready-to-restart',
       targetMethod,
       releaseDir,
+      installer,
       logPath,
+      preparedAt: new Date(this.now()).toISOString(),
     });
-    const child = this.spawn(helperInvocation.command, helperInvocation.args, {
-      cwd: this.configDir,
-      detached: true,
-      stdio: 'ignore',
-      env: {
-        ...this.installEnvironment(),
-        FARMING_BUNDLE_UPDATE_PAYLOAD: JSON.stringify(payload),
-      },
-    });
-    if (child && typeof child.unref === 'function') child.unref();
   }
 }
 

package/backend/workspace-file-router.js

@@ -286,7 +286,9 @@ function createWorkspaceFileRouter(agentManager, fileService, options = {}) {
       const rootRef = workspaceRef(body);
       assertWritableWorkspaceAgent(rootRef);
       const { root, rootId } = resolveRequestRoot(body);
-      const move = await fileService.moveEntry(root, body.sourcePath || '', body.targetDirectory || '');
+      const move = await fileService.moveEntry(root, body.sourcePath || '', body.targetDirectory || '', {
+        expectedVersion: body.expectedVersion,
+      });
       res.json({ rootId, root, move });
     } catch (error) {
       sendWorkspaceFileError(res, error);
@@ -312,7 +314,9 @@ function createWorkspaceFileRouter(agentManager, fileService, options = {}) {
       const rootRef = workspaceRef(body);
       assertWritableWorkspaceAgent(rootRef);
       const { root, rootId } = resolveRequestRoot(body);
-      const move = await fileService.renameEntry(root, body.path || '', body.name || '');
+      const move = await fileService.renameEntry(root, body.path || '', body.name || '', {
+        expectedVersion: body.expectedVersion,
+      });
       res.json({ rootId, root, move });
     } catch (error) {
       sendWorkspaceFileError(res, error);
@@ -327,7 +331,9 @@ function createWorkspaceFileRouter(agentManager, fileService, options = {}) {
       assertWritableWorkspaceAgent(rootRef);
       const workspaceRoot = rootRegistry.resolve(rootRef);
       const { canonicalPath: root, rootId } = workspaceRoot;
-      const deleted = await fileService.deleteEntry(root, targetPath);
+      const deleted = await fileService.deleteEntry(root, targetPath, {
+        expectedVersion: body.expectedVersion || req.query.expectedVersion,
+      });
       res.json({ rootId, root, deleted });
     } catch (error) {
       sendWorkspaceFileError(res, error);