freecode-sh 0.1.0-alpha.18 → 0.1.0-alpha.20

package/freecode.mjs

@@ -6,6 +6,7 @@ import { access, readFile, realpath } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { withoutPowerShellModulePath } from './npm-bootstrap-environment.mjs'
 
 const packageDirectory = dirname(fileURLToPath(import.meta.url))
 const bootstrapPath = fileURLToPath(import.meta.url)
@@ -61,12 +62,17 @@ if (nativeVersion && compareAlphaVersions(nativeVersion, packageMetadata.version
         args: ['-NoLogo', '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', join(packageDirectory, 'install.ps1'), '-Version', packageMetadata.version],
       }
     : { command: '/bin/sh', args: [join(packageDirectory, 'install.sh'), '--version', packageMetadata.version] }
-  const installStatus = await run(installer.command, installer.args, {
+  const installerEnvironment = {
     ...process.env,
     FREECODE_INSTALL_ROOT: installRoot,
     FREECODE_BIN_DIR: binDirectory,
     FREECODE_INSTALL_EMBEDDED: 'true',
-  })
+  }
+  const installStatus = await run(
+    installer.command,
+    installer.args,
+    windows ? withoutPowerShellModulePath(installerEnvironment) : installerEnvironment,
+  )
   if (installStatus !== 0) process.exit(installStatus)
   nativeVersion = await managedNativeVersion(nativeExecutable, installRoot, platform)
   if (!nativeVersion || compareAlphaVersions(nativeVersion, packageMetadata.version) < 0) {

package/install.sh

@@ -9,6 +9,14 @@ DEFAULT_CHANNEL="alpha"
 DEFAULT_DOWNLOAD_BASE_URL="https://releases.freecode.sh/releases"
 DEFAULT_CHANNEL_BASE_URL="https://releases.freecode.sh/channels"
 EXPECTED_TEAM_IDENTIFIER="GD597P8KJ2"
+# Apple code requirement language. "anchor apple generic" forces the signing
+# chain to terminate at Apple's root certificate, so only a real Developer ID
+# certificate issued to this team can satisfy it. Text printed by
+# `codesign --display` cannot be trusted for this: Authority and TeamIdentifier
+# lines are read straight out of the certificate, so a self-signed certificate
+# can present any subject and OU it likes.
+RELEASE_CODE_REQUIREMENT="=anchor apple generic and certificate leaf[subject.OU] = \"$EXPECTED_TEAM_IDENTIFIER\""
+CODESIGN_BIN="/usr/bin/codesign"
 LEGACY_ALPHA6_MANIFEST_SHA256="1bf63e0d6114b12d61c07094936bd2606ae82ce87d5b054fbfb01c5f3d3646d8"
 LAUNCHER_RELATIVE_PATH="bin/freecode"
 INTERFACE_RELATIVE_PATH="libexec/freecode/freecode-tui"
@@ -374,6 +382,18 @@ validate_release_security() {
   esac
 }
 
+# Test-only seam. Signature verification runs /usr/bin/codesign by absolute path
+# so nothing on PATH can impersonate it; the installer test suite substitutes a
+# stub, and like every other FREECODE_TEST_* override it is refused unless the
+# release is being read from a local file:// URL.
+resolve_codesign_bin() {
+  [ -n "${FREECODE_TEST_CODESIGN_BIN:-}" ] || return 0
+  case "$DOWNLOAD_BASE_URL" in
+    file://*) CODESIGN_BIN="$FREECODE_TEST_CODESIGN_BIN" ;;
+    *) fail "the test codesign override is permitted only with local file URLs" ;;
+  esac
+}
+
 verify_release_signatures() {
   root=$1
   if [ "$RELEASE_MODE" = "unsigned-override" ]; then
@@ -381,19 +401,15 @@ verify_release_signatures() {
     return
   fi
 
-  [ -x /usr/bin/codesign ] || fail "/usr/bin/codesign is required to verify this release"
+  [ -x "$CODESIGN_BIN" ] || fail "$CODESIGN_BIN is required to verify this release"
   for executable in \
     "$root/$LAUNCHER_RELATIVE_PATH" \
     "$root/$INTERFACE_RELATIVE_PATH" \
     "$root/$ENGINE_RELATIVE_PATH"
   do
-    /usr/bin/codesign --verify --strict --verbose=2 "$executable" \
-      || fail "Apple signature verification failed for $executable"
-    SIGNATURE_DETAILS=$(/usr/bin/codesign --display --verbose=4 "$executable" 2>&1) \
-      || fail "could not inspect Apple signature for $executable"
-    TEAM_IDENTIFIER=$(printf '%s\n' "$SIGNATURE_DETAILS" | sed -n 's/^TeamIdentifier=//p' | head -n 1)
-    [ "$TEAM_IDENTIFIER" = "$EXPECTED_TEAM_IDENTIFIER" ] \
-      || fail "unexpected Apple TeamIdentifier for $executable (expected $EXPECTED_TEAM_IDENTIFIER, received ${TEAM_IDENTIFIER:-missing})"
+    # Without -R this only proves the seal is intact, not who signed it.
+    "$CODESIGN_BIN" --verify --strict --verbose=2 -R "$RELEASE_CODE_REQUIREMENT" "$executable" \
+      || fail "Apple signature verification failed for $executable; it must be Developer ID signed by Apple team $EXPECTED_TEAM_IDENTIFIER"
   done
 }
 
@@ -466,6 +482,8 @@ DOWNLOAD_BASE_URL=${DOWNLOAD_BASE_URL%/}
 CHANNEL_BASE_URL=${CHANNEL_BASE_URL%/}
 validate_channel "$CHANNEL"
 
+resolve_codesign_bin
+
 TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/freecode-install.XXXXXX")
 RELEASE_PUBLIC_KEY="$TEMP_DIR/release-signing-public.pem"
 write_release_public_key "$RELEASE_PUBLIC_KEY"
@@ -627,16 +645,38 @@ printf '\nUninstall:\n'
 printf '  rm -f "%s/freecode" && rm -rf "%s"\n' "$BIN_DIR" "$INSTALL_ROOT"
 
 if [ "$LAUNCH_AFTER_INSTALL" = "true" ]; then
-  TTY_DEVICE="${FREECODE_TEST_TTY_FILE:-}"
-  if [ -z "$TTY_DEVICE" ] && [ -t 1 ]; then
-    TTY_DEVICE="/dev/tty"
+  if [ -n "${FREECODE_TEST_TTY_FILE:-}" ]; then
+    if [ -r "$FREECODE_TEST_TTY_FILE" ]; then
+      CAN_LAUNCH="true"
+    else
+      CAN_LAUNCH="false"
+    fi
+  elif [ -t 1 ]; then
+    CAN_LAUNCH="true"
+  else
+    CAN_LAUNCH="false"
   fi
-  if [ -n "$TTY_DEVICE" ] && [ -r "$TTY_DEVICE" ]; then
+
+  if [ "$CAN_LAUNCH" = "true" ]; then
     printf '\nStarting Free Code...\n'
-    if ! "$BIN_DIR/freecode" < "$TTY_DEVICE"; then
-      printf '\nFree Code closed before startup finished. The installation is still ready.\n' >&2
+    if [ -n "${FREECODE_TEST_TTY_FILE:-}" ]; then
+      if "$BIN_DIR/freecode" < "$FREECODE_TEST_TTY_FILE"; then
+        LAUNCH_SUCCEEDED="true"
+      else
+        LAUNCH_SUCCEEDED="false"
+      fi
+    elif "$BIN_DIR/freecode" 0<&1; then
+      LAUNCH_SUCCEEDED="true"
+    else
+      LAUNCH_SUCCEEDED="false"
+    fi
+
+    if [ "$LAUNCH_SUCCEEDED" != "true" ]; then
+      printf '\nFree Code could not start automatically, but the installation succeeded.\n' >&2
+      printf 'Open a Terminal and run:\n  "%s/freecode"\n' "$BIN_DIR" >&2
     fi
   else
-    printf '\nFree Code is installed. Open a Terminal and run freecode when you are ready.\n'
+    printf '\nFree Code is installed. Open a Terminal and run:\n'
+    printf '  "%s/freecode"\n' "$BIN_DIR"
   fi
 fi

package/npm-bootstrap-environment.mjs

@@ -0,0 +1,7 @@
+export function withoutPowerShellModulePath(environment) {
+  const clean = { ...environment }
+  for (const key of Object.keys(clean)) {
+    if (key.toLowerCase() === 'psmodulepath') delete clean[key]
+  }
+  return clean
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freecode-sh",
-  "version": "0.1.0-alpha.18",
+  "version": "0.1.0-alpha.20",
   "description": "A free coding agent for your terminal.",
   "license": "UNLICENSED",
   "author": "Free Code",
@@ -27,6 +27,7 @@
   "files": [
     "check-platform.mjs",
     "freecode.mjs",
+    "npm-bootstrap-environment.mjs",
     "install.sh",
     "install.ps1"
   ],