pantheon-opencode 1.6.0-beta.11 → 1.6.0-beta.13

package/scripts/install/plan.mjs

@@ -30,8 +30,14 @@
  */
 
 import { createHash } from 'node:crypto'
-import { lstatSync, readFileSync } from 'node:fs'
-import { isAbsolute, relative } from 'node:path'
+import { lstatSync, readdirSync, readFileSync, rmdirSync, unlinkSync } from 'node:fs'
+import { isAbsolute, relative, resolve, sep } from 'node:path'
+import {
+  assertNoSymlinkAncestors,
+  assertPathWithin,
+  assertSafeRemoval,
+  verifyPathRemoved,
+} from './verify.mjs'
 
 /** The action vocabulary shared by the recorder, the summary and the formatter. */
 export const ACTIONS = Object.freeze({
@@ -86,6 +92,8 @@ function normalizeChange(change) {
     path: String(change?.path ?? ''),
     action,
     bytes: Number.isFinite(change?.bytes) ? change.bytes : 0,
+    outputFingerprint:
+      typeof change?.outputFingerprint === 'string' ? change.outputFingerprint : null,
     // Scored by default: most writers feed the install summary. Synthetic and
     // state-only entries opt out explicitly with `scored: false`.
     scored: !(change && change.scored === false),
@@ -118,6 +126,11 @@ export function recordChange(change, recorder = NOOP_RECORDER) {
   recorder(normalizeChange(change))
 }
 
+/** Return the non-displayed SHA-256 fingerprint used by reviewed plan artifacts. */
+export function fingerprintOutput(content) {
+  return createHash('sha256').update(content).digest('hex')
+}
+
 /** Sort helper: display order first, then path for determinism. */
 function compareFiles(a, b) {
   const order = DISPLAY_ORDER.indexOf(a.action) - DISPLAY_ORDER.indexOf(b.action)
@@ -156,7 +169,13 @@ export function summarizeChanges(entries = []) {
     const change = normalizeChange(entry)
     let record = byPath.get(change.path)
     if (!record) {
-      record = { path: change.path, action: change.action, bytes: change.bytes, scored: false }
+      record = {
+        path: change.path,
+        action: change.action,
+        bytes: change.bytes,
+        outputFingerprint: change.outputFingerprint,
+        scored: false,
+      }
       byPath.set(change.path, record)
     }
     // The LAST writer decides the net on-disk outcome. A later no-write
@@ -164,6 +183,7 @@ export function summarizeChanges(entries = []) {
     // computed a would-be update (e.g. unregister→register toggling).
     record.action = change.action
     record.bytes = change.bytes
+    record.outputFingerprint = change.outputFingerprint
     // Only a genuine change can score a path; a no-write never does.
     if (isChange(change.action) && change.scored) record.scored = true
   }
@@ -238,6 +258,28 @@ export function snapshot(filePath) {
   } catch {
     return { exists: false, sha256: null, size: 0, mode: null }
   }
+  if (stat.isDirectory()) {
+    // Directory snapshots include the direct child inventory. Descendant
+    // directories/files are snapshotted separately by collectRemovalTree().
+    const entries = readdirSync(filePath, { withFileTypes: true })
+      .map((entry) => [
+        entry.name,
+        entry.isDirectory()
+          ? 'directory'
+          : entry.isFile()
+            ? 'file'
+            : entry.isSymbolicLink()
+              ? 'symlink'
+              : 'other',
+      ])
+      .sort(([left], [right]) => left.localeCompare(right))
+    return {
+      exists: true,
+      sha256: createHash('sha256').update(JSON.stringify(entries)).digest('hex'),
+      size: stat.size,
+      mode: stat.mode,
+    }
+  }
   if (!stat.isFile()) {
     return { exists: true, sha256: null, size: stat.size, mode: stat.mode }
   }
@@ -255,6 +297,126 @@ export function snapshot(filePath) {
   }
 }
 
+/**
+ * Enumerate a path and its complete subtree as removal operations with
+ * pre-apply snapshots. Symlinks are treated as leaf entries and never followed.
+ *
+ * @param {string} rootPath
+ * @returns {{path: string, snapshot: object}[]}
+ */
+export function collectRemovalTree(rootPath) {
+  const entries = []
+  const visit = (filePath, allowMissing = false) => {
+    let stat
+    try {
+      stat = lstatSync(filePath)
+    } catch (error) {
+      if (allowMissing && error?.code === 'ENOENT') return
+      throw error
+    }
+    entries.push({ path: filePath, snapshot: snapshot(filePath) })
+    if (stat.isDirectory()) {
+      for (const name of readdirSync(filePath).sort()) visit(`${filePath}${sep}${name}`)
+    }
+  }
+  visit(rootPath, true)
+  return entries
+}
+
+/** Record every path that a recursive removal will delete. */
+export function recordRemovalTree(rootPath, recorder, { scored = false } = {}) {
+  const entries = collectRemovalTree(rootPath)
+  for (const entry of entries) {
+    recordChange({ path: entry.path, action: ACTIONS.REMOVE, bytes: 0, scored }, recorder)
+  }
+  return entries
+}
+
+/**
+ * Fail closed unless the exact reviewed subtree and its snapshots still match.
+ *
+ * @param {string} rootPath
+ * @param {Set<string>|null} reviewedRemovals
+ * @param {Map<string, object>|null} reviewedSnapshots
+ */
+export function validateRemovalTree(rootPath, reviewedRemovals, reviewedSnapshots) {
+  if (!reviewedRemovals || !reviewedSnapshots) {
+    throw new Error(`Refusing destructive removal without a reviewed snapshot: ${rootPath}`)
+  }
+  const root = resolve(rootPath)
+  const isWithinRoot = (filePath) => {
+    const rel = relative(root, resolve(filePath))
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
+  }
+  const expected = new Set(
+    [...reviewedRemovals].filter(isWithinRoot).map((filePath) => resolve(filePath)),
+  )
+  const current = collectRemovalTree(rootPath)
+  const actual = new Set(current.map((entry) => resolve(entry.path)))
+  if (actual.size !== expected.size || [...actual].some((filePath) => !expected.has(filePath))) {
+    throw new Error(`Removal set changed after review: ${rootPath}`)
+  }
+  for (const entry of current) {
+    const filePath = resolve(entry.path)
+    const before = reviewedSnapshots.get(filePath)
+    const now = entry.snapshot
+    if (
+      !before ||
+      before.exists !== now.exists ||
+      before.sha256 !== now.sha256 ||
+      before.size !== now.size ||
+      before.mode !== now.mode
+    ) {
+      throw new Error(`Removal target drifted after review: ${entry.path}`)
+    }
+  }
+  return true
+}
+
+/**
+ * Remove only the reviewed entries, without recursive deletion that could
+ * consume a path added after preflight. Directory removal uses rmdir, which
+ * fails closed if any unreviewed entry appears during cleanup.
+ */
+export function removeReviewedTree(rootPath, reviewedRemovals, reviewedSnapshots) {
+  validateRemovalTree(rootPath, reviewedRemovals, reviewedSnapshots)
+  const entries = collectRemovalTree(rootPath)
+  for (const entry of entries.reverse()) {
+    const info = lstatSync(entry.path)
+    if (info.isDirectory()) {
+      assertSafeRemoval(rootPath, entry.path)
+      try {
+        rmdirSync(entry.path)
+      } catch (error) {
+        if (error?.code === 'ENOTEMPTY' || error?.code === 'EEXIST') {
+          throw new Error(`Removal set changed after review: ${entry.path}`, { cause: error })
+        }
+        throw error
+      }
+    } else {
+      // Unlinking a reviewed symlink leaf is safe and preserves historical
+      // cleanup behavior; reject linked ancestors so the parent is never
+      // redirected outside the reviewed root.
+      assertPathWithin(rootPath, entry.path)
+      assertNoSymlinkAncestors(entry.path, { includeLeaf: false })
+      const before = reviewedSnapshots?.get(resolve(entry.path))
+      const now = snapshot(entry.path)
+      if (
+        !before ||
+        before.exists !== now.exists ||
+        before.sha256 !== now.sha256 ||
+        before.size !== now.size ||
+        before.mode !== now.mode
+      ) {
+        throw new Error(`Removal target drifted after review: ${entry.path}`)
+      }
+      unlinkSync(entry.path)
+    }
+    verifyPathRemoved(entry.path)
+  }
+  return true
+}
+
 /**
  * Compare the preview's SCORED change count against this call's install
  * summary delta. Returns a descriptor on mismatch, or `null` when they agree.

package/scripts/install/plugin.mjs

@@ -4,8 +4,15 @@
 
 import { execSync } from 'node:child_process'
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:fs'
-import { isAbsolute, join, resolve } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
+import { ACTIONS, recordChange, recordRemovalTree, removeReviewedTree, snapshot } from './plan.mjs'
 import { ROOT, writeIfChanged } from './shared.mjs'
+import {
+  assertNoSymlinkAncestors,
+  assertPathWithin,
+  assertSafeRemoval,
+  verifyPathRemoved,
+} from './verify.mjs'
 
 /**
  * Copy a plugin's runtime payload (the root TUI loader, bundled dist/*,
@@ -18,22 +25,37 @@ import { ROOT, writeIfChanged } from './shared.mjs'
  * @param {boolean} [options.dryRun=false] - If true, don't write files
  * @param {'v1'|'v2'} [options.version='v1'] - Host plugin generation
  * @param {(change: object) => void} [options.recorder] - optional change recorder for preview
+ * @param {Set<string>|null} [options.reviewedRemovals] - paths approved by the current plan
+ * @param {Map<string, object>|null} [options.reviewedSnapshots] - pre-apply path snapshots
  * @returns {{ created: number, skipped: number }}
  */
 export function copyPluginFiles(
   srcDir,
   dstDir,
-  { dryRun = false, version = 'v1', recorder = null } = {},
+  {
+    dryRun = false,
+    version = 'v1',
+    recorder = null,
+    reviewedRemovals = null,
+    reviewedSnapshots = null,
+  } = {},
 ) {
   const result = { created: 0, skipped: 0 }
+  const distDir = join(dstDir, 'dist')
 
-  if (!dryRun) mkdirSync(dstDir, { recursive: true })
-  if (!dryRun) mkdirSync(join(dstDir, 'dist'), { recursive: true })
+  if (!dryRun) {
+    assertNoSymlinkAncestors(dstDir)
+    mkdirSync(dstDir, { recursive: true })
+    assertNoSymlinkAncestors(dstDir)
+    assertPathWithin(dstDir, distDir)
+    assertNoSymlinkAncestors(distDir)
+    mkdirSync(distDir, { recursive: true })
+    assertNoSymlinkAncestors(distDir)
+  }
 
   // Drop legacy raw copies from previous installs (root index.tsx + dist/tui.tsx).
-  if (!dryRun) {
-    rmSync(join(dstDir, 'index.tsx'), { force: true })
-    rmSync(join(dstDir, 'dist', 'tui.tsx'), { force: true })
+  for (const legacyPath of [join(dstDir, 'index.tsx'), join(distDir, 'tui.tsx')]) {
+    removeLegacyFile(legacyPath, dstDir, { dryRun, recorder, reviewedRemovals, reviewedSnapshots })
   }
 
   // Copy dist/* files
@@ -41,7 +63,9 @@ export function copyPluginFiles(
   if (existsSync(distSrc)) {
     for (const f of readdirSync(distSrc)) {
       const c = readFileSync(join(distSrc, f), 'utf8')
-      const status = writeIfChanged(join(dstDir, 'dist', f), c, dryRun, { recorder })
+      const destination = join(distDir, f)
+      assertPathWithin(dstDir, destination)
+      const status = writeIfChanged(destination, c, dryRun, { recorder })
       if (status === 'created') result.created++
       else result.skipped++
     }
@@ -88,8 +112,13 @@ export function copyPluginFiles(
     )
     if (entryStatus === 'created') result.created++
     else result.skipped++
-  } else if (!dryRun) {
-    rmSync(v2ServerDestination, { force: true })
+  } else {
+    removeLegacyFile(v2ServerDestination, dstDir, {
+      dryRun,
+      recorder,
+      reviewedRemovals,
+      reviewedSnapshots,
+    })
   }
 
   // Copy the lockfile so dependency installation is reproducible. A missing
@@ -109,6 +138,49 @@ export function copyPluginFiles(
   return result
 }
 
+function removeLegacyFile(
+  filePath,
+  rootDir,
+  { dryRun, recorder, reviewedRemovals, reviewedSnapshots },
+) {
+  assertSafeRemoval(rootDir, filePath)
+  const present = existsSync(filePath)
+  if (dryRun) {
+    recordChange(
+      {
+        path: filePath,
+        action: present ? ACTIONS.REMOVE : ACTIONS.UNCHANGED,
+        bytes: 0,
+        scored: false,
+      },
+      recorder,
+    )
+    return
+  }
+  if (!present) return
+
+  const normalizedPath = resolve(filePath)
+  if (reviewedRemovals && !reviewedRemovals.has(normalizedPath)) {
+    throw new Error(`Refusing unreviewed plugin removal: ${filePath}`)
+  }
+  const expected = reviewedSnapshots?.get(normalizedPath)
+  if (reviewedSnapshots && (!expected || !sameSnapshot(snapshot(filePath), expected))) {
+    throw new Error(`Plugin removal target drifted after review: ${filePath}`)
+  }
+  rmSync(filePath, { force: true })
+  verifyPathRemoved(filePath)
+  recordChange({ path: filePath, action: ACTIONS.REMOVE, bytes: 0, scored: false }, recorder)
+}
+
+function sameSnapshot(left, right) {
+  return (
+    left.exists === right.exists &&
+    left.sha256 === right.sha256 &&
+    left.size === right.size &&
+    left.mode === right.mode
+  )
+}
+
 /**
  * Install a plugin from source to destination.
  * @param {string} srcDir - Source plugin directory (e.g. ROOT/src/plugins/tui)
@@ -122,17 +194,49 @@ export function copyPluginFiles(
 export function installPlugin(
   srcDir,
   dstDir,
-  { dryRun = false, clean = false, version = 'v1', recorder = null } = {},
+  {
+    dryRun = false,
+    clean = false,
+    version = 'v1',
+    recorder = null,
+    reviewedRemovals = null,
+    reviewedSnapshots = null,
+  } = {},
 ) {
   const result = { created: 0, skipped: 0, errors: 0 }
+  const cleanTargetExisted = clean && existsSync(dstDir)
 
-  if (clean && existsSync(dstDir) && !dryRun) {
-    rmSync(dstDir, { recursive: true, force: true })
+  assertNoSymlinkAncestors(dstDir)
+  if (cleanTargetExisted) {
+    assertSafeRemoval(dirname(dstDir), dstDir)
+    if (dryRun) {
+      recordRemovalTree(dstDir, recorder)
+    } else {
+      removeReviewedTree(dstDir, reviewedRemovals, reviewedSnapshots)
+    }
   }
 
-  const copyResult = copyPluginFiles(srcDir, dstDir, { dryRun, version, recorder })
+  const copyResult = copyPluginFiles(srcDir, dstDir, {
+    dryRun,
+    version,
+    recorder,
+    reviewedRemovals,
+    reviewedSnapshots,
+  })
   result.created += copyResult.created
   result.skipped += copyResult.skipped
+  if (cleanTargetExisted) {
+    // The clean pass removes these directories before rebuilding their files;
+    // keep the net plan truthful while the separate removal review still lists
+    // every path actually cleared.
+    recordChange({ path: dstDir, action: ACTIONS.UNCHANGED, bytes: 0, scored: false }, recorder)
+    if (existsSync(join(srcDir, 'dist'))) {
+      recordChange(
+        { path: join(dstDir, 'dist'), action: ACTIONS.UNCHANGED, bytes: 0, scored: false },
+        recorder,
+      )
+    }
+  }
 
   // Install plugin dependencies (@opentui/core, @opentui/solid, solid-js).
   // Lockfile installation is the only accepted dependency path.

package/scripts/install/prompt-result.mjs

@@ -0,0 +1,2 @@
+/** Sentinel returned when the user cancels an interactive authorization prompt. */
+export const PROMPT_CANCELED = Symbol('pantheon-prompt-canceled')