mcp-pacemaker 2.0.2 → 2.1.1

package/bin/upgrade-dependencies.mjs

@@ -0,0 +1,183 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { isDeepStrictEqual, promisify } from 'node:util';
+import semver from 'semver';
+import { npmCliPath } from './update-check.mjs';
+import { PoolingFiles } from './pooling-files.mjs';
+
+const execute = promisify(execFile);
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/';
+const policies = [
+  'registry', 'replace-registry-host', 'offline', 'prefer-offline', 'strict-ssl', 'ca', 'cafile',
+  'proxy', 'https-proxy', 'noproxy', 'local-address', 'min-release-age', 'min-release-age-exclude',
+  'allow-directory', 'allow-file', 'allow-git', 'allow-remote', 'allow-scripts', 'strict-dep-builds',
+];
+
+export function dependencyInventory(root) {
+  const files = [];
+  const walk = path => {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink()) throw new Error('Linked dependency inputs are unsupported.');
+    if (stat.isDirectory()) {
+      for (const name of readdirSync(path)) walk(join(path, name));
+      return;
+    }
+    if (!stat.isFile() ||
+        stat.nlink !== 1) throw new Error('Unsupported dependency input.');
+    files.push({ path: relative(root, path).replaceAll('\\', '/'),
+      sha256: createHash('sha256').update(readFileSync(path)).digest('hex') });
+  };
+  walk(join(root, 'package-lock.json'));
+  walk(join(root, 'node_modules'));
+  return files;
+}
+
+export function validateDependencyLock(root) {
+  const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const lock = JSON.parse(readFileSync(join(root, 'package-lock.json'), 'utf8'));
+  if (lock.lockfileVersion !== 3 ||
+      lock.name !== pkg.name ||
+      lock.version !== pkg.version ||
+      !isDeepStrictEqual(lock.packages?.['']?.dependencies, pkg.dependencies)) {
+    throw new Error('Target dependency lock does not match the selected package.');
+  }
+  for (const [path, entry] of Object.entries(lock.packages)) {
+    if (!path) continue;
+    if (!path.startsWith('node_modules/') ||
+        path.split('/').some(part => !part || part === '.' || part === '..') ||
+        entry.link ||
+        semver.valid(entry.version) !== entry.version) throw new Error('Unverifiable target dependency lock entry.');
+    if (typeof entry.integrity !== 'string' ||
+        !entry.integrity.startsWith('sha512-')) {
+      const found = typeof entry.integrity === 'string' ? entry.integrity.split('-')[0] : 'no';
+      throw new Error(`Unverifiable target dependency lock entry: ${path}@${entry.version} has ${found} integrity from the registry; SHA-512 is required.`);
+    }
+    const integrity = Buffer.from(entry.integrity.slice(7), 'base64');
+    if (integrity.length !== 64 ||
+        `sha512-${integrity.toString('base64')}` !== entry.integrity) throw new Error('Invalid dependency archive integrity.');
+    const url = new URL(entry.resolved);
+    if (!['https:', 'http:'].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.hash) throw new Error('Unsupported dependency archive source.');
+  }
+  return lock;
+}
+
+// From 2.1.1 a target ships the SHA-512 lock it was released and tested with. npm ci then
+// verifies every archive against it, so registry metadata (SHA-1 on some mirrors) and newer
+// in-range releases cannot change the staged dependency set.
+export function bundledDependencyLock(root) {
+  const capabilityPath = join(root, 'bin', 'upgrade-capability.json');
+  if (!existsSync(capabilityPath)) return null;
+  const capability = JSON.parse(readFileSync(capabilityPath, 'utf8'));
+  if (capability.dependencyLock !== 1) return null;
+  const path = join(root, 'bin', 'dependency-lock.json');
+  const stat = existsSync(path) ? lstatSync(path) : null;
+  if (!stat?.isFile() ||
+      stat.size === 0) throw new Error('Target declares a bundled dependency lock but does not contain it.');
+  return readFileSync(path);
+}
+
+// npm points public-registry lock URLs at the configured registry itself, unless
+// replace-registry-host is "never" or names only another host or URL prefix.
+export function npmMapsPublicRegistry(setting) {
+  const value = String(setting ?? 'npmjs');
+  return ['npmjs', 'always'].includes(value) ||
+    value.includes('registry.npmjs.org');
+}
+
+// The bundled lock names the public registry. When npm will not map those URLs, point each
+// entry at the registry that resolving it would have used: its scope's registry, else the
+// configured one. Integrity covers the archive bytes, not the URL.
+export function registryLock(bytes, registry, scopes = {}) {
+  const lock = JSON.parse(bytes.toString('utf8'));
+  let changed = false;
+  for (const [path, entry] of Object.entries(lock.packages ?? {})) {
+    const publicEntry = path &&
+      typeof entry.resolved === 'string' &&
+      entry.resolved.startsWith(PUBLIC_REGISTRY);
+    if (!publicEntry) continue;
+    const name = path.slice(path.lastIndexOf('node_modules/') + 'node_modules/'.length);
+    const target = (name.startsWith('@') ? scopes[name.split('/')[0]] : undefined) ?? registry;
+    if (!target) continue;
+    const base = target.endsWith('/') ? target : `${target}/`;
+    if (base === PUBLIC_REGISTRY) continue;
+    entry.resolved = base + entry.resolved.slice(PUBLIC_REGISTRY.length);
+    changed = true;
+  }
+  return changed ? Buffer.from(`${JSON.stringify(lock, null, 2)}\n`) : bytes;
+}
+
+export async function stageCliDependencies(root, { registry, cache, run = execute } = {}) {
+  const cli = npmCliPath();
+  const call = async (args, options = {}) => {
+    try {
+      return await run(process.execPath, [cli, ...args], {
+        encoding: 'utf8', windowsHide: true, timeout: 120000, maxBuffer: 8 * 1024 * 1024, ...options,
+      });
+    } catch {
+      throw new Error('CLI dependencies were refused or unavailable under configured npm policy. No fallback or policy relaxation was attempted.');
+    }
+  };
+  const configuration = JSON.parse((await call(['config', 'list', '--json'])).stdout);
+  const prefix = (await call(['prefix'])).stdout.trim();
+  if (!prefix ||
+      !existsSync(prefix)) throw new Error('Caller npm project context could not be verified.');
+  const env = { ...process.env };
+  for (const [key, value] of Object.entries(configuration)) {
+    const scoped = key.startsWith('@') && key.endsWith(':registry');
+    if (!policies.includes(key) &&
+        !scoped) continue;
+    if (value === null ||
+        value === undefined) continue;
+    if (Array.isArray(value)) continue;
+    env[`npm_config_${key.replaceAll('-', '_')}`] = String(value);
+  }
+  if (configuration['strict-ssl'] === false) throw new Error('Managed dependency staging cannot disable TLS verification.');
+  const projectConfig = join(prefix, '.npmrc');
+  const stagedConfig = join(root, '.npmrc');
+  if (existsSync(stagedConfig)) throw new Error('Unexpected target npm configuration.');
+  const bundled = bundledDependencyLock(root);
+  if (bundled &&
+      existsSync(join(root, 'package-lock.json'))) throw new Error('Unexpected target dependency lock.');
+  const scopes = Object.fromEntries(Object.entries(configuration)
+    .filter(([key, value]) => typeof value === 'string' &&
+      /^@[^:/]+:registry$/.test(key))
+    .map(([key, value]) => [key.slice(0, -':registry'.length), value]));
+  const manifest = readFileSync(join(root, 'package.json'));
+  if (existsSync(projectConfig)) {
+    const files = new PoolingFiles(projectConfig);
+    const identity = files.inspect(projectConfig);
+    files.stage(stagedConfig, projectConfig, identity, readFileSync(projectConfig));
+  }
+  const args = ['--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund', '--bin-links=false',
+    '--cache', cache, '--registry', registry];
+  try {
+    const effective = JSON.parse((await call(['config', 'list', '--json'], { cwd: root, env })).stdout);
+    for (const key of Object.keys(configuration)) {
+      if (!policies.includes(key) &&
+          !(key.startsWith('@') && key.endsWith(':registry'))) continue;
+      if (!isDeepStrictEqual(configuration[key], effective[key])) {
+        throw new Error('Effective npm policy changed in dependency staging; no dependency resolution was attempted.');
+      }
+    }
+    if (bundled) {
+      const staged = npmMapsPublicRegistry(configuration['replace-registry-host'])
+        ? bundled
+        : registryLock(bundled, registry, scopes);
+      writeFileSync(join(root, 'package-lock.json'), staged, { flag: 'wx' });
+    } else await call(['install', '--package-lock-only', ...args], { cwd: root, env });
+    validateDependencyLock(root);
+    const lock = readFileSync(join(root, 'package-lock.json'));
+    await call(['ci', ...args], { cwd: root, env });
+    if (!readFileSync(join(root, 'package.json')).equals(manifest) ||
+        !readFileSync(join(root, 'package-lock.json')).equals(lock)) throw new Error('Dependency staging changed the verified manifest or lock.');
+    await call(['ls', '--omit=dev', '--json'], { cwd: root, env });
+    return dependencyInventory(root);
+  } finally {
+    if (existsSync(stagedConfig)) unlinkSync(stagedConfig);
+  }
+}

package/bin/upgrade-package.mjs

@@ -0,0 +1,205 @@
+import { execFile } from 'node:child_process';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { promisify } from 'node:util';
+import { gunzipSync } from 'node:zlib';
+import semver from 'semver';
+import { npmCliPath, readNpmMetadata, validateRegistry } from './update-check.mjs';
+
+const runFile = promisify(execFile);
+const required = [
+  'bin/cli.mjs', 'bin/cli-main.mjs', 'bin/cli-dispatch.mjs', 'bin/mcp-bridge.mjs', 'bin/service-control.mjs',
+  'supervisor/supervise.mjs', 'supervisor/bridge-child.mjs',
+  'bin/upgrade-capability.json', 'ui/dist/index.html',
+];
+
+export function exactVersion(value) {
+  if (typeof value !== 'string' ||
+      semver.valid(value) !== value ||
+      semver.prerelease(value)) {
+    throw new Error('--to requires a canonical stable version, for example 2.1.0 (not a tag or range).');
+  }
+  return value;
+}
+
+export function verifyArchive(bytes, integrity) {
+  if (!Buffer.isBuffer(bytes) ||
+      bytes.length === 0 ||
+      bytes.length > 32 * 1024 * 1024) throw new Error('Invalid package archive size.');
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/.exec(integrity ?? '');
+  if (!match) throw new Error('An exact SHA-512 package integrity is required.');
+  const actual = createHash('sha512').update(bytes).digest();
+  const expected = Buffer.from(match[1], 'base64');
+  if (actual.length !== expected.length ||
+      !timingSafeEqual(actual, expected)) throw new Error('Package archive integrity mismatch.');
+}
+
+export function unpackUpgrade(bytes, version, destination, nodeVersion = process.versions.node) {
+  exactVersion(version);
+  const tar = gunzipSync(bytes, { maxOutputLength: 128 * 1024 * 1024 });
+  const files = new Map();
+  const seen = new Set();
+  let offset = 0;
+  let ended = false;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every(value => value === 0)) {
+      if (!tar.subarray(offset).every(value => value === 0)) throw new Error('Data after archive terminator.');
+      ended = true;
+      break;
+    }
+    const text = (start, size) => header.subarray(start, start + size).toString('utf8').replace(/\0.*$/s, '');
+    const octal = (start, size) => {
+      const value = text(start, size).trim();
+      if (!/^[0-7]+$/.test(value)) throw new Error('Invalid archive numeric field.');
+      return Number.parseInt(value, 8);
+    };
+    const checksum = [...header].reduce((sum, byte, index) => sum + (index >= 148 && index < 156 ? 32 : byte), 0);
+    if (octal(148, 8) !== checksum) throw new Error('Archive checksum mismatch.');
+    const prefix = text(345, 155);
+    const path = `${prefix ? `${prefix}/` : ''}${text(0, 100)}`;
+    const type = text(156, 1);
+    const size = octal(124, 12);
+    if (path === 'package/' &&
+        type === '5' &&
+        size === 0) {
+      offset += 512;
+      continue;
+    }
+    if (!['', '0', '5'].includes(type) ||
+        !/^package\/[A-Za-z0-9_./@+-]+$/.test(path)) throw new Error('Unsafe archive entry.');
+    const relative = path.slice(8).replace(/\/$/, '');
+    const parts = relative.split('/');
+    if (parts.some(part => !part || part === '.' || part === '..') ||
+        seen.has(relative.toLowerCase()) ||
+        /(^|\/)(?:node_modules|\.npmrc|\.git)(\/|$)/i.test(relative)) throw new Error('Unsafe or duplicate archive path.');
+    seen.add(relative.toLowerCase());
+    offset += 512;
+    if (offset + size > tar.length) throw new Error('Truncated archive.');
+    if (type !== '5') files.set(relative, { bytes: tar.subarray(offset, offset + size), mode: octal(100, 8) });
+    else if (size !== 0) throw new Error('Invalid archive directory.');
+    offset += Math.ceil(size / 512) * 512;
+  }
+  if (!ended) throw new Error('Missing archive terminator.');
+  const pkg = JSON.parse(files.get('package.json')?.bytes.toString('utf8') ?? 'null');
+  if (pkg?.name !== 'mcp-pacemaker' ||
+      pkg.version !== version ||
+      pkg.bin?.['mcp-pacemaker'] !== 'bin/cli.mjs' ||
+      pkg.bin?.['mcp-bridge'] !== 'bin/mcp-bridge.mjs' ||
+      typeof pkg.engines?.node !== 'string' ||
+      !semver.satisfies(nodeVersion, pkg.engines.node)) throw new Error('Package name, exact version or Node engine mismatch.');
+  for (const path of required) {
+    if (!files.get(path)?.bytes.length) throw new Error(`Target lacks managed upgrade capability: ${path}. No service was stopped.`);
+  }
+  const capability = JSON.parse(files.get('bin/upgrade-capability.json').bytes.toString('utf8'));
+  if (capability.protocol !== 1 ||
+      capability.portZero !== true ||
+      capability.admission !== true ||
+      capability.cli !== true) throw new Error('Target does not support managed readiness/admission/port allocation/CLI dispatch.');
+  if (capability.dependencyLock === 1 &&
+      !files.get('bin/dependency-lock.json')?.bytes.length) throw new Error('Target declares a bundled dependency lock but does not contain it.');
+  for (const file of files.values()) {
+    if (![0o644, 0o755].includes(file.mode)) throw new Error('Unexpected package file mode.');
+  }
+  for (const [path, file] of files) {
+    if (!path.endsWith('.exe')) continue;
+    if (file.bytes[0] !== 0x4d ||
+        file.bytes[1] !== 0x5a) throw new Error('Invalid packaged native binary.');
+  }
+  const native = ['bin/windows/PoolingSecurityHelper', 'bin/windows-lifetime/ProcessLifetimeHelper'];
+  if (capability.legacyRestartProtocol === 1) {
+    for (const path of [
+      'bin/legacy-upgrade.mjs', 'bin/legacy-installation.mjs', 'bin/legacy-task.mjs', 'bin/legacy-1.3.json',
+      'bin/windows-legacy-process.mjs', 'autostart/windows/legacy-task.ps1',
+    ]) {
+      if (!files.get(path)?.bytes.length) throw new Error(`Target legacy recovery dependency is missing: ${path}.`);
+    }
+    native.push('bin/windows-legacy/LegacyProcessBroker');
+  }
+  if (capability.accountWorkerProtocol === 1) {
+    for (const path of [
+      'bin/account-upgrade-controller.mjs', 'bin/account-upgrade-worker.mjs', 'bin/account-worker-session.mjs',
+      'bin/account-task-adapter.mjs', 'bin/task-only-controller.mjs', 'bin/task-scope.mjs',
+      'bin/task-transaction-protocol.mjs', 'bin/windows-task-channel.mjs', 'autostart/windows/account-task.ps1',
+      'autostart/windows/inspect-worker-process-sessions.ps1',
+    ]) {
+      if (!files.get(path)?.bytes.length) throw new Error(`Target account worker dependency is missing: ${path}.`);
+    }
+    native.push('bin/windows-task-channel/TaskChannelGuard');
+  }
+  for (const base of native) {
+    const binary = files.get(`${base}.exe`);
+    const metadata = files.get(`${base}.build.json`);
+    if (!binary ||
+        !metadata) throw new Error('Missing packaged native binary identity.');
+    const build = JSON.parse(metadata.bytes.toString('utf8'));
+    if (createHash('sha256').update(binary.bytes).digest('hex') !== build.binarySha256) {
+      throw new Error('Packaged native binary hash mismatch.');
+    }
+  }
+  if (readdirSync(destination).length) throw new Error('Package destination is not empty.');
+  for (const [path, file] of files) {
+    const output = join(destination, path);
+    mkdirSync(dirname(output), { recursive: true, mode: 0o700 });
+    writeFileSync(output, file.bytes, { flag: 'wx', mode: file.mode });
+  }
+  return { version, files: [...files].map(([path, file]) => ({
+    path, sha256: createHash('sha256').update(file.bytes).digest('hex'),
+  })) };
+}
+
+export async function acquireUpgrade(version, directory, { registry, run = runFile } = {}) {
+  exactVersion(version);
+  registry = validateRegistry(registry);
+  const cache = join(directory, 'cache');
+  const metadata = await readNpmMetadata(`mcp-pacemaker@${version}`, undefined, { registry, cache, run });
+  if (metadata.name !== 'mcp-pacemaker' ||
+      metadata.version !== version ||
+      metadata.deprecated) throw new Error('Exact target metadata was not verified.');
+  const args = [npmCliPath(), 'pack', `mcp-pacemaker@${version}`, '--json', '--ignore-scripts',
+    '--pack-destination', directory, '--cache', cache];
+  if (registry !== undefined) args.push('--registry', registry);
+  let stdout;
+  try {
+    ({ stdout } = await run(process.execPath, args, {
+      cwd: process.cwd(), encoding: 'utf8', windowsHide: true, timeout: 120000, maxBuffer: 4 * 1024 * 1024,
+    }));
+  } catch {
+    throw new Error('Package acquisition failed under the configured npm policy. No registry or policy fallback was attempted.');
+  }
+  const result = normalizePackResult(JSON.parse(stdout), version);
+  const bytes = readFileSync(join(directory, result.filename));
+  verifyArchive(bytes, metadata.dist?.integrity);
+  return { bytes, integrity: metadata.dist.integrity };
+}
+
+export function normalizePackResult(value, version) {
+  let result;
+  if (Array.isArray(value) &&
+      value.length === 1) result = value[0];
+  else if (value &&
+      typeof value === 'object' &&
+      Object.keys(value).length === 1 &&
+      Object.hasOwn(value, 'mcp-pacemaker')) result = value['mcp-pacemaker'];
+  if (!result ||
+      Array.isArray(result) ||
+      result.name !== 'mcp-pacemaker' ||
+      result.version !== version ||
+      result.filename !== `mcp-pacemaker-${version}.tgz`) throw new Error('Unexpected npm pack result.');
+  return result;
+}
+
+export async function configuredRegistry(registry) {
+  if (registry !== undefined) return validateRegistry(registry);
+  try {
+    const { stdout } = await runFile(process.execPath, [
+      npmCliPath(), 'config', 'get', 'registry', '--logs-max=0', '--update-notifier=false',
+    ], {
+      encoding: 'utf8', windowsHide: true, timeout: 10000, maxBuffer: 16384,
+    });
+    return validateRegistry(stdout.trim());
+  } catch {
+    throw new Error('Effective npm registry could not be read. Set --registry explicitly; no fallback selected.');
+  }
+}

package/bin/windows-legacy/LegacyProcessBroker.build.json

@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 1,
+  "binary": "LegacyProcessBroker.exe",
+  "binarySha256": "64323058e9c0437409522b6cca6d1a47c32e125980b83a07021932d1d5a317ef",
+  "inputs": {
+    "targetFramework": ".NETFramework,Version=v4.6.2",
+    "platform": "AnyCPU",
+    "compilerVersion": "5.9.0-1.26357.3 (35d9211b841e7613c1d2f8f5af6d628ace696c4c)",
+    "compilerSha256": "3aafb7b9c54fa31a7092af35148971ee616965e7f9a0b80fb7fdc4bdd1d1a555",
+    "compilerArguments": [
+      "/nologo",
+      "/noconfig",
+      "/nostdlib+",
+      "/target:exe",
+      "/platform:anycpu",
+      "/langversion:7.3",
+      "/optimize+",
+      "/debug-",
+      "/deterministic+",
+      "/checked-",
+      "/unsafe-",
+      "/warn:4",
+      "/warnaserror+",
+      "/utf8output"
+    ],
+    "pathMap": "/_/mcp-pacemaker/windows-legacy",
+    "sourceEncoding": "UTF-8 without BOM, LF line endings",
+    "sourceSha256": {
+      "AssemblyInfo.cs": "09f672607b66aff39c457899d270688972e440aafaa43b2cb56c1a2367576356",
+      "LegacyNative.cs": "28f496cba02ebfbbe07102bc70133198b40846838c0189e0bfcdb91d2e0a95c6",
+      "LegacyProcessBroker.cs": "2edd5f77787498d5323185e00b663084e140c9aec6ebca3921d66078bbc66c2a"
+    },
+    "buildScriptSha256": "2ffa31155f6aa8f6b4239facb0f062df167a01ac7a7ce6d9ae0be60e60fd0201",
+    "referenceSha256": {
+      "mscorlib.dll": "7118fe658567606fa0538f7b5a2071e4606756c07e9062e1e5b24fa49e97d1f6",
+      "System.dll": "b76822f9c08aff597120e3167b3e0fbda836d6bc6f14bc4bc2eeffab5b2c6125",
+      "System.Core.dll": "774e965a6c25891a96d6d3b838ae10226ed9963a73b09e4be7c2ec275ffb5886",
+      "System.Management.dll": "bc35cddea6226db4d428a9fb70fcefe321a2af003c947edb812f3e911f8e4094",
+      "System.Web.Extensions.dll": "7a32bf3263aebed93c3a0847294aebdde15f7427541ed223a4cc4eb93c36d556"
+    }
+  }
+}

package/bin/windows-legacy/src/AssemblyInfo.cs

@@ -0,0 +1,8 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyTitle("MCP Legacy Process Broker")]
+[assembly: AssemblyDescription("Verified held-identity stop of a selected legacy observed process set")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: ComVisible(false)]