oh-my-opencode 4.9.1 → 4.10.0

package/packages/omo-codex/plugin/components/bootstrap/src/worker.ts

@@ -0,0 +1,279 @@
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { readState, writeState } from "../../../scripts/auto-update-state.mjs";
+import { bootstrapLocks, resolveBootstrapStatePath, resolveCodexHome } from "./environment.ts";
+import { runSgProvision } from "./provision.ts";
+import type { SgProvisionSeams } from "./provision.ts";
+import { runWorkerSetup } from "./setup.ts";
+
+export const BOOTSTRAP_DOCTOR_HINT = "npx lazycodex-ai doctor";
+
+export type BootstrapRunStatus = "success" | "degraded";
+
+export interface BootstrapDegradedEntry {
+	readonly component: string;
+	readonly reason: string;
+	readonly hint?: string;
+}
+
+export interface BootstrapState {
+	readonly completedForVersion?: string;
+	readonly lastAttemptAt?: number;
+	readonly lastStatus?: BootstrapRunStatus;
+	readonly degraded?: readonly BootstrapDegradedEntry[];
+}
+
+export interface BootstrapWorkerFlags {
+	readonly codexHome?: string;
+	readonly manifestDir?: string;
+	readonly once: boolean;
+	readonly only?: string;
+}
+
+export interface BootstrapWorkerContext {
+	readonly codexHome: string;
+	readonly env: Record<string, string | undefined>;
+	readonly flags: BootstrapWorkerFlags;
+	readonly now: number;
+	readonly platform: NodeJS.Platform;
+	readonly pluginData: string;
+	readonly pluginRoot: string;
+	readonly pluginVersion: string | undefined;
+}
+
+export interface BootstrapStepOutcome {
+	readonly degraded: readonly BootstrapDegradedEntry[];
+}
+
+export interface BootstrapWorkerStep {
+	readonly name: string;
+	readonly run: (context: BootstrapWorkerContext) => Promise<BootstrapStepOutcome>;
+}
+
+export type BootstrapWorkerSkipReason = "locked" | "already-completed";
+
+export type BootstrapWorkerResult =
+	| { readonly ran: false; readonly reason: BootstrapWorkerSkipReason }
+	| {
+			readonly ran: true;
+			readonly status: BootstrapRunStatus;
+			readonly degraded: readonly BootstrapDegradedEntry[];
+			readonly statePath: string;
+	  };
+
+export interface RunBootstrapWorkerOptions {
+	readonly argv?: readonly string[];
+	readonly env?: Record<string, string | undefined>;
+	readonly now?: number;
+	readonly platform?: NodeJS.Platform;
+	readonly steps?: readonly BootstrapWorkerStep[];
+}
+
+export function parseWorkerFlags(argv: readonly string[]): BootstrapWorkerFlags {
+	let codexHome: string | undefined;
+	let manifestDir: string | undefined;
+	let once = false;
+	let only: string | undefined;
+	for (let index = 0; index < argv.length; index += 1) {
+		const flag = argv[index];
+		if (flag === "--once") {
+			once = true;
+			continue;
+		}
+		if (flag === "--codex-home") {
+			codexHome = requireFlagValue(argv, index, flag);
+			index += 1;
+			continue;
+		}
+		if (flag === "--only") {
+			only = requireFlagValue(argv, index, flag);
+			index += 1;
+			continue;
+		}
+		if (flag === "--manifest-dir") {
+			manifestDir = requireFlagValue(argv, index, flag);
+			index += 1;
+			continue;
+		}
+		throw new Error(`unknown worker flag: ${flag}`);
+	}
+	return {
+		once,
+		...(codexHome === undefined ? {} : { codexHome }),
+		...(manifestDir === undefined ? {} : { manifestDir }),
+		...(only === undefined ? {} : { only }),
+	};
+}
+
+export function resolvePluginDataRoot(env: Record<string, string | undefined>): string {
+	const fromEnv = env["PLUGIN_DATA"]?.trim();
+	if (fromEnv !== undefined && fromEnv.length > 0) return fromEnv;
+	return join(homedir(), ".local", "share", "lazycodex");
+}
+
+export async function readPluginVersion(pluginRoot: string): Promise<string | undefined> {
+	try {
+		const parsed: unknown = JSON.parse(await readFile(join(pluginRoot, ".codex-plugin", "plugin.json"), "utf8"));
+		if (typeof parsed !== "object" || parsed === null) return undefined;
+		const version = (parsed as Record<string, unknown>)["version"];
+		if (typeof version !== "string") return undefined;
+		const trimmed = version.trim();
+		return trimmed.length > 0 ? trimmed : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+export async function readBootstrapState(statePath: string): Promise<BootstrapState> {
+	return parseBootstrapState(await readState(statePath));
+}
+
+export function parseBootstrapState(raw: Record<string, unknown>): BootstrapState {
+	const completedForVersion = typeof raw["completedForVersion"] === "string" ? raw["completedForVersion"] : undefined;
+	const lastAttemptAt = typeof raw["lastAttemptAt"] === "number" ? raw["lastAttemptAt"] : undefined;
+	const lastStatus = raw["lastStatus"] === "success" || raw["lastStatus"] === "degraded" ? raw["lastStatus"] : undefined;
+	const degraded = parseDegradedEntries(raw["degraded"]);
+	return {
+		...(completedForVersion === undefined ? {} : { completedForVersion }),
+		...(lastAttemptAt === undefined ? {} : { lastAttemptAt }),
+		...(lastStatus === undefined ? {} : { lastStatus }),
+		...(degraded === undefined ? {} : { degraded }),
+	};
+}
+
+export interface DefaultWorkerStepsSeams {
+	readonly sg?: SgProvisionSeams;
+}
+
+export function defaultWorkerSteps(seams: DefaultWorkerStepsSeams = {}): readonly BootstrapWorkerStep[] {
+	return [
+		{
+			name: "setup",
+			run: (context) => runWorkerSetup(context),
+		},
+		{
+			name: "sg",
+			run: (context) => runSgProvision(context, seams.sg),
+		},
+	];
+}
+
+export async function runBootstrapWorker(options: RunBootstrapWorkerOptions = {}): Promise<BootstrapWorkerResult> {
+	const env = options.env ?? process.env;
+	const now = options.now ?? Date.now();
+	const platform = options.platform ?? process.platform;
+	const flags = parseWorkerFlags(options.argv ?? []);
+	const steps = options.steps ?? defaultWorkerSteps();
+	const pluginRoot = resolvePluginRoot(env);
+	const pluginData = resolvePluginDataRoot(env);
+	const statePath = resolveBootstrapStatePath(pluginData);
+	// Pin BOTH lock paths (bootstrap + auto-update) under the resolved plugin
+	// data root even when PLUGIN_DATA is missing from the environment.
+	const lockEnv = { ...env, PLUGIN_DATA: pluginData };
+
+	const locks = await bootstrapLocks({ env: lockEnv, now, pluginData });
+	if (locks === null) return { ran: false, reason: "locked" };
+	try {
+		const pluginVersion = await readPluginVersion(pluginRoot);
+		const marker = await readBootstrapState(statePath);
+		// TOCTOU re-check under lock: another worker may have completed between
+		// the hook's unlocked read and this acquisition.
+		if (!flags.once && pluginVersion !== undefined && marker.completedForVersion === pluginVersion) {
+			await appendBootstrapLog(pluginData, now, "worker-skipped", { reason: "already-completed", version: pluginVersion });
+			return { ran: false, reason: "already-completed" };
+		}
+
+		const codexHome = flags.codexHome ?? (await resolveCodexHome({ env, pluginRoot })).path;
+		const context: BootstrapWorkerContext = { codexHome, env, flags, now, platform, pluginData, pluginRoot, pluginVersion };
+		await appendBootstrapLog(pluginData, now, "worker-started", { version: pluginVersion ?? "unknown" });
+
+		const degraded: BootstrapDegradedEntry[] = [];
+		if (pluginVersion === undefined) {
+			degraded.push({
+				component: "bootstrap",
+				hint: BOOTSTRAP_DOCTOR_HINT,
+				reason: `plugin version unresolved from ${join(pluginRoot, ".codex-plugin", "plugin.json")}`,
+			});
+		}
+		for (const step of steps) {
+			if (flags.only !== undefined && step.name !== flags.only) continue;
+			degraded.push(...(await runStep(step, context)));
+		}
+
+		const status: BootstrapRunStatus = degraded.length === 0 ? "success" : "degraded";
+		const state: BootstrapState = {
+			...(pluginVersion === undefined ? {} : { completedForVersion: pluginVersion }),
+			degraded,
+			lastAttemptAt: now,
+			lastStatus: status,
+		};
+		await writeState(statePath, state);
+		await appendBootstrapLog(pluginData, now, "worker-finished", { degradedCount: degraded.length, status });
+		return { degraded, ran: true, statePath, status };
+	} finally {
+		await locks.release();
+	}
+}
+
+async function runStep(step: BootstrapWorkerStep, context: BootstrapWorkerContext): Promise<readonly BootstrapDegradedEntry[]> {
+	try {
+		return (await step.run(context)).degraded;
+	} catch (error) {
+		return [
+			{
+				component: step.name,
+				hint: BOOTSTRAP_DOCTOR_HINT,
+				reason: error instanceof Error ? error.message : String(error),
+			},
+		];
+	}
+}
+
+function resolvePluginRoot(env: Record<string, string | undefined>): string {
+	const fromEnv = env["PLUGIN_ROOT"]?.trim();
+	if (fromEnv !== undefined && fromEnv.length > 0) return fromEnv;
+	// dist/cli.js lives at <pluginRoot>/components/bootstrap/dist/cli.js.
+	return resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+}
+
+export async function appendBootstrapLog(
+	pluginData: string,
+	now: number,
+	event: string,
+	details: Record<string, unknown>,
+): Promise<void> {
+	try {
+		const logPath = join(pluginData, "bootstrap", "bootstrap.log");
+		await mkdir(dirname(logPath), { recursive: true });
+		await appendFile(logPath, `${JSON.stringify({ timestamp: new Date(now).toISOString(), event, ...details })}\n`);
+	} catch {
+		// Logging must never fail the worker.
+	}
+}
+
+function parseDegradedEntries(raw: unknown): readonly BootstrapDegradedEntry[] | undefined {
+	if (!Array.isArray(raw)) return undefined;
+	const entries: BootstrapDegradedEntry[] = [];
+	for (const candidate of raw) {
+		if (typeof candidate !== "object" || candidate === null) continue;
+		const record = candidate as Record<string, unknown>;
+		if (typeof record["component"] !== "string" || typeof record["reason"] !== "string") continue;
+		entries.push({
+			component: record["component"],
+			reason: record["reason"],
+			...(typeof record["hint"] === "string" ? { hint: record["hint"] } : {}),
+		});
+	}
+	return entries;
+}
+
+function requireFlagValue(argv: readonly string[], index: number, flag: string): string {
+	const value = argv[index + 1];
+	if (value === undefined || value.startsWith("--")) {
+		throw new Error(`${flag} requires a value`);
+	}
+	return value;
+}

package/packages/omo-codex/plugin/components/bootstrap/test/download.test.ts

@@ -0,0 +1,295 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { createHash } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+
+import {
+	ChecksumMismatchError,
+	DownloadError,
+	downloadChecksummedAsset,
+	downloadFromManifest,
+	loadAssetManifest,
+	UnsupportedPlatformError,
+	type FetchLike,
+} from "../src/download.ts";
+
+const temporaryDirectories: string[] = [];
+
+function createTemporaryDirectory(prefix: string): string {
+	const directory = mkdtempSync(join(tmpdir(), prefix));
+	temporaryDirectories.push(directory);
+	return directory;
+}
+
+afterEach(() => {
+	for (const directory of temporaryDirectories.splice(0)) {
+		rmSync(directory, { recursive: true, force: true });
+	}
+});
+
+function sha256Hex(bytes: Uint8Array): string {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+
+function fetchReturning(bytes: Uint8Array, status = 200): { fetchImpl: FetchLike; calls: string[] } {
+	const calls: string[] = [];
+	const fetchImpl: FetchLike = async (url) => {
+		calls.push(url);
+		return new Response(status === 200 ? bytes : null, { status });
+	};
+	return { calls, fetchImpl };
+}
+
+async function writeManifestFixture(
+	manifestsDir: string,
+	platforms: Record<string, { url: string; sha256: string }>,
+): Promise<void> {
+	await mkdir(manifestsDir, { recursive: true });
+	const manifest = { name: "tool", platforms, version: "1.0.0" };
+	await writeFile(join(manifestsDir, "tool.json"), JSON.stringify(manifest, null, "\t"), "utf8");
+}
+
+describe("downloadChecksummedAsset", () => {
+	it("#given a fetch that returns the pinned bytes #when downloading #then the destination holds exactly those bytes and no partial files remain", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-download-");
+		const payload = new TextEncoder().encode("pinned asset payload");
+		const destination = join(directory, "asset.zip");
+		const { calls, fetchImpl } = fetchReturning(payload);
+
+		// when
+		const written = await downloadChecksummedAsset({
+			destination,
+			fetchImpl,
+			sha256: sha256Hex(payload),
+			url: "https://example.invalid/assets/asset.zip",
+		});
+
+		// then
+		expect(written).toBe(destination);
+		expect(calls).toEqual(["https://example.invalid/assets/asset.zip"]);
+		expect(new Uint8Array(await readFile(destination))).toEqual(payload);
+		expect(await readdir(directory)).toEqual(["asset.zip"]);
+	});
+
+	it("#given a fetch that returns corrupted bytes #when downloading #then a checksum mismatch error names both hashes and the partial file is deleted", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-download-");
+		const pinned = new TextEncoder().encode("pinned asset payload");
+		const corrupted = new TextEncoder().encode("corrupted asset payload");
+		const destination = join(directory, "asset.zip");
+		const expectedSha256 = sha256Hex(pinned);
+		const actualSha256 = sha256Hex(corrupted);
+
+		// when
+		const failure = downloadChecksummedAsset({
+			destination,
+			fetchImpl: fetchReturning(corrupted).fetchImpl,
+			sha256: expectedSha256,
+			url: "https://example.invalid/assets/asset.zip",
+		});
+
+		// then
+		const error = (await failure.then(
+			() => {
+				throw new Error("expected downloadChecksummedAsset to reject");
+			},
+			(caught: unknown) => caught,
+		)) as ChecksumMismatchError;
+		expect(error).toBeInstanceOf(ChecksumMismatchError);
+		expect(error.code).toBe("checksum-mismatch");
+		expect(error.message).toMatch(/checksum mismatch/i);
+		expect(error.message).toContain(expectedSha256);
+		expect(error.message).toContain(actualSha256);
+		expect(error.expectedSha256).toBe(expectedSha256);
+		expect(error.actualSha256).toBe(actualSha256);
+		expect(await readdir(directory)).toEqual([]);
+	});
+
+	it("#given a non-2xx response #when downloading #then a typed download-failed error is thrown and nothing is written", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-download-");
+		const destination = join(directory, "asset.zip");
+
+		// when
+		const failure = downloadChecksummedAsset({
+			destination,
+			fetchImpl: fetchReturning(new Uint8Array(), 404).fetchImpl,
+			sha256: sha256Hex(new Uint8Array()),
+			url: "https://example.invalid/assets/missing.zip",
+		});
+
+		// then
+		const error = (await failure.then(
+			() => {
+				throw new Error("expected downloadChecksummedAsset to reject");
+			},
+			(caught: unknown) => caught,
+		)) as DownloadError;
+		expect(error).toBeInstanceOf(DownloadError);
+		expect(error.code).toBe("download-failed");
+		expect(error.message).toContain("404");
+		expect(await readdir(directory)).toEqual([]);
+	});
+
+	it("#given HTTPS_PROXY is set #when the direct download attempt fails #then the error names the v1 proxy limitation", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-download-");
+		const calls: string[] = [];
+		const fetchImpl: FetchLike = async (url) => {
+			calls.push(url);
+			throw new Error("connect ETIMEDOUT 203.0.113.7:443");
+		};
+
+		// when
+		const failure = downloadChecksummedAsset({
+			destination: join(directory, "asset.zip"),
+			env: { HTTPS_PROXY: "http://proxy.corp.example:3128" },
+			fetchImpl,
+			sha256: sha256Hex(new Uint8Array()),
+			url: "https://example.invalid/assets/asset.zip",
+		});
+
+		// then
+		const error = (await failure.then(
+			() => {
+				throw new Error("expected downloadChecksummedAsset to reject");
+			},
+			(caught: unknown) => caught,
+		)) as DownloadError;
+		expect(calls).toHaveLength(1);
+		expect(error).toBeInstanceOf(DownloadError);
+		expect(error.code).toBe("download-failed");
+		expect(error.message).toContain("ETIMEDOUT");
+		expect(error.message).toContain("HTTPS_PROXY");
+		expect(error.message).toMatch(/does not tunnel through/i);
+		expect(await readdir(directory)).toEqual([]);
+	});
+
+	it("#given no proxy env #when the direct download attempt fails #then the error does not mention proxies", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-download-");
+		const fetchImpl: FetchLike = async () => {
+			throw new Error("getaddrinfo ENOTFOUND example.invalid");
+		};
+
+		// when
+		const failure = downloadChecksummedAsset({
+			destination: join(directory, "asset.zip"),
+			env: {},
+			fetchImpl,
+			sha256: sha256Hex(new Uint8Array()),
+			url: "https://example.invalid/assets/asset.zip",
+		});
+
+		// then
+		const error = (await failure.then(
+			() => {
+				throw new Error("expected downloadChecksummedAsset to reject");
+			},
+			(caught: unknown) => caught,
+		)) as DownloadError;
+		expect(error.code).toBe("download-failed");
+		expect(error.message).not.toContain("HTTPS_PROXY");
+	});
+});
+
+describe("downloadFromManifest", () => {
+	it("#given a manifest with a platform entry #when downloading for that platform #then the asset lands under its URL basename in the destination dir", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-manifest-");
+		const manifestsDir = join(directory, "manifests");
+		const destinationDir = join(directory, "downloads");
+		const payload = new TextEncoder().encode("tool binary zip bytes");
+		await writeManifestFixture(manifestsDir, {
+			"darwin-arm64": {
+				sha256: sha256Hex(payload),
+				url: "https://example.invalid/releases/tool-1.0.0-darwin-arm64.zip",
+			},
+		});
+		const { calls, fetchImpl } = fetchReturning(payload);
+
+		// when
+		const destination = await downloadFromManifest({
+			destinationDir,
+			fetchImpl,
+			manifestName: "tool",
+			manifestsDir,
+			platformKey: "darwin-arm64",
+		});
+
+		// then
+		expect(destination).toBe(join(destinationDir, "tool-1.0.0-darwin-arm64.zip"));
+		expect(calls).toEqual(["https://example.invalid/releases/tool-1.0.0-darwin-arm64.zip"]);
+		expect(new Uint8Array(await readFile(destination))).toEqual(payload);
+		expect(basename(destination)).toBe("tool-1.0.0-darwin-arm64.zip");
+	});
+
+	it("#given a manifest without the requested platform #when downloading #then a typed unsupported-platform error is thrown before any fetch", async () => {
+		// given
+		const directory = createTemporaryDirectory("omo-bootstrap-manifest-");
+		const manifestsDir = join(directory, "manifests");
+		await writeManifestFixture(manifestsDir, {
+			"darwin-arm64": { sha256: sha256Hex(new Uint8Array()), url: "https://example.invalid/tool.zip" },
+		});
+		const { calls, fetchImpl } = fetchReturning(new Uint8Array());
+
+		// when
+		const failure = downloadFromManifest({
+			destinationDir: join(directory, "downloads"),
+			fetchImpl,
+			manifestName: "tool",
+			manifestsDir,
+			platformKey: "linux-x64",
+		});
+
+		// then
+		const error = (await failure.then(
+			() => {
+				throw new Error("expected downloadFromManifest to reject");
+			},
+			(caught: unknown) => caught,
+		)) as UnsupportedPlatformError;
+		expect(error).toBeInstanceOf(UnsupportedPlatformError);
+		expect(error.code).toBe("unsupported-platform");
+		expect(error.platformKey).toBe("linux-x64");
+		expect(error.message).toContain('"linux-x64"');
+		expect(error.message).toContain("darwin-arm64");
+		expect(calls).toEqual([]);
+	});
+});
+
+describe("committed manifests", () => {
+	it("#given the committed ast-grep manifest #when loaded #then every required platform pins an https URL and a sha256", async () => {
+		// given / when
+		const manifest = await loadAssetManifest("ast-grep");
+
+		// then
+		expect(manifest.name).toBe("ast-grep");
+		expect(manifest.version).toMatch(/^\d+\.\d+\.\d+$/);
+		for (const platformKey of ["darwin-arm64", "darwin-x64", "linux-x64", "win32-x64"]) {
+			const asset = manifest.platforms[platformKey];
+			if (asset === undefined) throw new Error(`missing platform ${platformKey}`);
+			expect(asset.url).toStartWith("https://");
+			expect(asset.url).toContain(manifest.version);
+			expect(asset.sha256).toMatch(/^[a-f0-9]{64}$/);
+		}
+	});
+
+	it("#given the committed node manifest #when loaded #then the win32-x64 LTS zip pins an https URL and a sha256", async () => {
+		// given / when
+		const manifest = await loadAssetManifest("node");
+
+		// then
+		expect(manifest.name).toBe("node");
+		expect(manifest.version).toMatch(/^\d+\.\d+\.\d+$/);
+		const asset = manifest.platforms["win32-x64"];
+		if (asset === undefined) throw new Error("missing platform win32-x64");
+		expect(asset.url).toStartWith("https://nodejs.org/dist/");
+		expect(asset.url).toEndWith("-win-x64.zip");
+		expect(asset.url).toContain(manifest.version);
+		expect(asset.sha256).toMatch(/^[a-f0-9]{64}$/);
+	});
+});