sneakoscope 8.0.2 → 8.0.3

package/dist/core/codex-app/menubar/global-install.js

@@ -0,0 +1,288 @@
+import path from 'node:path';
+import { exists, nowIso, readJson, readText, runProcess, writeJsonAtomic } from '../../fsx.js';
+import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from '../../managed-path-safety.js';
+const MENU_BAR_EXECUTABLE_SUFFIX = path.join('SKSMenuBar.app', 'Contents', 'MacOS', 'SKSMenuBar');
+export function projectMenuBarDuplicateInstallDirs(input) {
+    const root = path.resolve(input.root);
+    const home = path.resolve(input.paths.home);
+    const canonical = path.resolve(input.paths.install_dir);
+    return [...new Set([
+            path.join(root, '.codex', 'sks-menubar'),
+            path.join(root, '.sneakoscope', 'sks-menubar'),
+            path.join(root, '.sneakoscope', 'codex-app', 'sks-menubar'),
+            path.join(home, '.sneakoscope', 'sks-menubar'),
+            path.join(home, '.sneakoscope', 'codex-app', 'sks-menubar')
+        ].map((candidate) => path.resolve(candidate)).filter((candidate) => candidate !== canonical))];
+}
+export async function verifiedProjectMenuBarDuplicateExecutablePaths(input) {
+    const root = path.resolve(input.root);
+    const home = path.resolve(input.paths.home);
+    const executables = [];
+    const candidates = await discoverProjectMenuBarDuplicateCandidates(input);
+    for (const candidate of candidates.inspected) {
+        const confinementRoot = confinementRootForCandidate(root, home, candidate);
+        const state = await inspectConfinedPath(confinementRoot, candidate).catch(() => null);
+        if (!state?.exists || state.leafSymlink || !state.stat?.isDirectory())
+            continue;
+        const stamp = await readJson(path.join(candidate, 'build-stamp.json'), null);
+        const executable = path.join(candidate, 'SKSMenuBar.app', 'Contents', 'MacOS', 'SKSMenuBar');
+        if (stamp?.schema === 'sks.sks-menubar-build-stamp.v2'
+            && stamp.codesign_identifier === 'com.sneakoscope.sks-menubar'
+            && await exists(executable)) {
+            executables.push(executable);
+        }
+    }
+    return executables;
+}
+export async function inspectProjectMenuBarCanonicalState(input) {
+    const root = path.resolve(input.root);
+    const home = path.resolve(input.paths.home);
+    const discoveredCandidates = await discoverProjectMenuBarDuplicateCandidates(input);
+    const inspected = discoveredCandidates.inspected;
+    const verifiedDuplicates = [];
+    const unverifiedCollisions = [];
+    const blockers = [];
+    for (const candidate of inspected) {
+        const confinementRoot = confinementRootForCandidate(root, home, candidate);
+        const state = await inspectConfinedPath(confinementRoot, candidate).catch(() => null);
+        if (!state) {
+            blockers.push(`menubar_project_duplicate_inspection_failed:${candidate}`);
+            continue;
+        }
+        if (!state.exists)
+            continue;
+        if (state.leafSymlink || !state.stat?.isDirectory()) {
+            unverifiedCollisions.push(candidate);
+            continue;
+        }
+        const stamp = await readJson(path.join(candidate, 'build-stamp.json'), null);
+        const executable = path.join(candidate, 'SKSMenuBar.app', 'Contents', 'MacOS', 'SKSMenuBar');
+        if (stamp?.schema === 'sks.sks-menubar-build-stamp.v2'
+            && stamp.codesign_identifier === 'com.sneakoscope.sks-menubar'
+            && await exists(executable)) {
+            verifiedDuplicates.push(candidate);
+        }
+        else {
+            unverifiedCollisions.push(candidate);
+        }
+    }
+    const candidatePaths = [...new Set([
+            ...discoveredCandidates.discovered,
+            ...verifiedDuplicates,
+            ...unverifiedCollisions
+        ])].sort();
+    const warnings = candidatePaths.map((candidate) => `menubar_duplicate_candidate_detected:${candidate}`);
+    return {
+        canonical_only: candidatePaths.length === 0 && blockers.length === 0,
+        inspected,
+        candidate_paths: candidatePaths,
+        verified_duplicates: verifiedDuplicates,
+        unverified_collisions: unverifiedCollisions,
+        blockers,
+        warnings
+    };
+}
+export async function cleanupProjectMenuBarDuplicates(input) {
+    const root = path.resolve(input.root);
+    const canonical = path.resolve(input.paths.install_dir);
+    const discovered = await discoverProjectMenuBarDuplicateCandidates(input);
+    const retainedCandidates = (input.candidateExecutablePaths || [])
+        .map((executable) => duplicateInstallDirForExecutable(executable, canonical))
+        .filter((candidate) => Boolean(candidate));
+    const inspected = [...new Set([...discovered.inspected, ...retainedCandidates])];
+    const removed = [];
+    const preserved = [];
+    const blockers = [];
+    const warnings = [];
+    for (const candidate of inspected) {
+        const confinementRoot = confinementRootForCandidate(root, input.paths.home, candidate);
+        const state = await inspectConfinedPath(confinementRoot, candidate).catch(() => null);
+        if (!state) {
+            blockers.push(`menubar_project_duplicate_inspection_failed:${candidate}`);
+            continue;
+        }
+        if (!state.exists)
+            continue;
+        if (state.leafSymlink || !state.stat?.isDirectory()) {
+            preserved.push(candidate);
+            warnings.push(`menubar_project_duplicate_unmanaged_collision_preserved:${candidate}`);
+            continue;
+        }
+        const stamp = await readJson(path.join(candidate, 'build-stamp.json'), null);
+        if (stamp?.schema !== 'sks.sks-menubar-build-stamp.v2'
+            || stamp.codesign_identifier !== 'com.sneakoscope.sks-menubar'
+            || !await exists(path.join(candidate, 'SKSMenuBar.app', 'Contents', 'MacOS', 'SKSMenuBar'))) {
+            preserved.push(candidate);
+            warnings.push(`menubar_project_duplicate_unverified_preserved:${candidate}`);
+            continue;
+        }
+        if (isProtectedDuplicateRemovalTarget(candidate, root, input.paths.home)) {
+            preserved.push(candidate);
+            warnings.push(`menubar_project_duplicate_protected_path_preserved:${candidate}`);
+            continue;
+        }
+        try {
+            await removeManagedPathVerified(confinementRoot, candidate);
+            removed.push(candidate);
+        }
+        catch {
+            blockers.push(`menubar_project_duplicate_remove_failed:${candidate}`);
+        }
+    }
+    if (preserved.length > 0)
+        warnings.push('menubar_strict_canonical_only_unmet');
+    let receiptPath = null;
+    if (removed.length > 0 || preserved.length > 0 || blockers.length > 0) {
+        try {
+            await ensureConfinedDirectory(input.paths.install_dir, input.paths.duplicate_receipts_dir);
+            receiptPath = path.join(input.paths.duplicate_receipts_dir, `${Date.now()}-${process.pid}.json`);
+            await writeJsonAtomic(receiptPath, {
+                schema: 'sks.menubar-project-duplicate-cleanup-receipt.v1',
+                generated_at: nowIso(),
+                canonical_install_dir: canonical,
+                project_root: root,
+                inspected,
+                removed,
+                preserved,
+                blockers,
+                warnings
+            }, { mode: 0o600 });
+        }
+        catch {
+            blockers.push('menubar_project_duplicate_receipt_write_failed');
+        }
+    }
+    const canonicalOnly = preserved.length === 0 && blockers.length === 0;
+    return {
+        schema: 'sks.menubar-project-duplicate-cleanup.v1',
+        ok: blockers.length === 0,
+        canonical_only: canonicalOnly,
+        canonical_install_dir: canonical,
+        inspected,
+        removed,
+        preserved,
+        receipt_path: receiptPath,
+        blockers,
+        warnings
+    };
+}
+async function discoverProjectMenuBarDuplicateCandidates(input) {
+    const canonical = path.resolve(input.paths.install_dir);
+    const fixed = projectMenuBarDuplicateInstallDirs(input);
+    const discovered = [...new Set([
+            ...await runningMenuBarDuplicateInstallDirs(canonical, input.env || process.env),
+            ...await launchAgentDuplicateInstallDirs(input.paths.launch_agent_path, canonical)
+        ])].sort();
+    return {
+        inspected: [...new Set([...fixed, ...discovered])],
+        discovered
+    };
+}
+async function runningMenuBarDuplicateInstallDirs(canonicalInstallDir, env) {
+    const pgrep = await processTool(env, 'SKS_MENUBAR_PGREP', '/usr/bin/pgrep');
+    if (!pgrep)
+        return [];
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const result = await runProcess(pgrep, [
+        ...(uid === null ? [] : ['-U', String(uid)]),
+        '-f',
+        'SKSMenuBar\\.app/Contents/MacOS/SKSMenuBar'
+    ], { timeoutMs: 2_000, maxOutputBytes: 32 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
+    if (result.code !== 0)
+        return [];
+    const rows = String(result.stdout || '').split(/\r?\n/).filter(Boolean).map((line) => ({
+        line,
+        executable: runningExecutablePath(line)
+    }));
+    const executablePaths = rows.map((row) => row.executable).filter((value) => Boolean(value));
+    const unresolvedPids = rows
+        .filter((row) => !row.executable)
+        .map((row) => Number(row.line.trim()))
+        .filter((pid) => Number.isInteger(pid) && pid > 0)
+        .slice(0, 128);
+    if (unresolvedPids.length > 0) {
+        const ps = await processTool(env, 'SKS_MENUBAR_PS', '/bin/ps');
+        if (ps) {
+            const processList = await runProcess(ps, [
+                '-p',
+                unresolvedPids.join(','),
+                '-o',
+                'pid=,command='
+            ], { timeoutMs: 2_000, maxOutputBytes: 64 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
+            if (processList.code === 0) {
+                executablePaths.push(...String(processList.stdout || '')
+                    .split(/\r?\n/)
+                    .map((line) => runningExecutablePath(line))
+                    .filter((value) => Boolean(value)));
+            }
+        }
+    }
+    return [...new Set(executablePaths
+            .map((executable) => duplicateInstallDirForExecutable(executable, canonicalInstallDir))
+            .filter((candidate) => Boolean(candidate)))].sort();
+}
+async function launchAgentDuplicateInstallDirs(launchAgentPath, canonicalInstallDir) {
+    const source = await readText(launchAgentPath, '');
+    const block = source.match(/<key>\s*ProgramArguments\s*<\/key>\s*<array>([\s\S]*?)<\/array>/i)?.[1] || '';
+    const encoded = block.match(/<string>([\s\S]*?)<\/string>/i)?.[1];
+    if (!encoded)
+        return [];
+    const executable = decodeXml(encoded.trim());
+    const candidate = duplicateInstallDirForExecutable(executable, canonicalInstallDir);
+    return candidate ? [candidate] : [];
+}
+function runningExecutablePath(line) {
+    const command = line.replace(/^\s*\d+\s+/, '').trim();
+    const suffixIndex = command.indexOf(MENU_BAR_EXECUTABLE_SUFFIX);
+    if (suffixIndex < 0)
+        return null;
+    const suffixEnd = suffixIndex + MENU_BAR_EXECUTABLE_SUFFIX.length;
+    const firstSlash = command.indexOf('/');
+    if (firstSlash < 0 || firstSlash > suffixIndex)
+        return null;
+    return command.slice(firstSlash, suffixEnd);
+}
+function duplicateInstallDirForExecutable(executablePath, canonicalInstallDir) {
+    if (!path.isAbsolute(executablePath))
+        return null;
+    const executable = path.resolve(executablePath);
+    const suffix = `${path.sep}${MENU_BAR_EXECUTABLE_SUFFIX}`;
+    if (!executable.endsWith(suffix))
+        return null;
+    if (isWithin(path.resolve(canonicalInstallDir), executable))
+        return null;
+    return executable.slice(0, -suffix.length);
+}
+function confinementRootForCandidate(rootInput, homeInput, candidate) {
+    const root = path.resolve(rootInput);
+    const home = path.resolve(homeInput);
+    if (isWithin(root, candidate))
+        return root;
+    if (isWithin(home, candidate))
+        return home;
+    return path.parse(path.resolve(candidate)).root;
+}
+function isProtectedDuplicateRemovalTarget(candidateInput, rootInput, homeInput) {
+    const candidate = path.resolve(candidateInput);
+    return candidate === path.resolve(rootInput)
+        || candidate === path.resolve(homeInput)
+        || candidate === path.parse(candidate).root;
+}
+async function processTool(env, key, fallback) {
+    const injected = env.SKS_MENUBAR_TEST_PROCESS_TOOLS === '1' ? env[key] : null;
+    if (injected)
+        return injected;
+    return exists(fallback).then((available) => available ? fallback : null);
+}
+function decodeXml(value) {
+    return value
+        .replace(/&apos;/g, "'")
+        .replace(/&quot;/g, '"')
+        .replace(/&gt;/g, '>')
+        .replace(/&lt;/g, '<')
+        .replace(/&amp;/g, '&');
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}

package/dist/core/codex-app/menubar/installer.js

@@ -8,7 +8,8 @@ import { aggregateFileHashes, createSksMenuBarBuildStamp, menuBarBuildStampsEqua
 import { MENU_ITEMS, SKS_MENUBAR_LABEL } from './constants.js';
 import { resolveCodexBundleId, writeDefaultMenuBarConfig } from './config.js';
 import { applyMenuBarGenerationTransaction, commitMenuBarGenerationTransaction, installGenerationPairs, MenuBarGenerationTransactionError, recoverMenuBarGenerationTransaction, rollbackGenerationPairs } from './generation-transaction.js';
-import { launchAgentSource, launchMenuBar, seedMenuBarPreferredPosition } from './launch-agent.js';
+import { launchAgentSource, launchMenuBar, inspectRunningMenuBarProcess, seedMenuBarPreferredPosition, stopMenuBarForReplacement, terminateMenuBarProcesses } from './launch-agent.js';
+import { cleanupProjectMenuBarDuplicates, verifiedProjectMenuBarDuplicateExecutablePaths } from './global-install.js';
 import { cleanupMacLaunchSecretEnvironment, cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings } from './migration.js';
 import { sksMenuBarPaths } from './paths.js';
 import { infoPlistSource, inspectInstalledResources, loadNativeMenuBarSources, nativeResourceHashes } from './resources.js';
@@ -56,6 +57,12 @@ export async function installSksMenuBar(opts = {}) {
         const result = baseResult(paths, false, 'planned', status?.ok !== false, status?.installed ? ['menubar_app_present'] : ['menubar_app_install_available'], status?.warnings || []);
         result.codex_bundle_id = status?.codex_sync.bundle_id || null;
         result.build_stamp = status?.build_stamp || null;
+        if (status) {
+            result.installed_version = status.installed_version;
+            result.running_process = status.running_process;
+            result.menubar_version_probe = status.menubar_version_probe;
+        }
+        result.duplicate_install_candidates = status?.duplicate_install_candidates || [];
         result.blockers = status?.blockers || [];
         result.launch = { requested: false, method: 'skipped', ok: true };
         return result;
@@ -198,6 +205,19 @@ export async function installSksMenuBar(opts = {}) {
         ? await inspectSignature(paths.app_path, { ...env, SKS_MENUBAR_CODESIGN: codesign })
         : { checked: false, identifier: null, ok: false, error: 'app_missing' };
     const installedInfoPlist = await readText(paths.info_plist_path, '');
+    const restartDeferred = sksMenuBarRestartDeferred(env);
+    const launchWanted = opts.launch !== false
+        && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1'
+        && !restartDeferred;
+    if (restartDeferred && opts.launch !== false && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1') {
+        warnings.push('launch_deferred_until_parent_operation_completes');
+    }
+    const launchAllowed = path.resolve(paths.home) === realUserHome()
+        && !isMenuBarInstallPathUnderTempDir(paths.executable_path, env);
+    if (launchWanted && path.resolve(paths.home) !== realUserHome())
+        warnings.push('launch_skipped_non_user_home');
+    if (launchWanted && isMenuBarInstallPathUnderTempDir(paths.executable_path, env))
+        warnings.push('launch_skipped_temp_install');
     const upToDate = bundleExists
         && currentAction === actionScript
         && menuBarBuildStampsEqual(previous, stamp)
@@ -273,6 +293,50 @@ export async function installSksMenuBar(opts = {}) {
                 return blocked(error.blocker, error.message);
             return blocked('menubar_build_failed', error instanceof Error ? error.message : String(error));
         }
+    }
+    const duplicateExecutablePaths = await verifiedProjectMenuBarDuplicateExecutablePaths({
+        paths,
+        root: paths.root,
+        env
+    });
+    const mustStopCanonical = !upToDate || (launchWanted && launchAllowed);
+    let canonicalStopped = false;
+    if (mustStopCanonical) {
+        const stopped = await stopMenuBarForReplacement({
+            launchctl,
+            paths,
+            executablePaths: [paths.executable_path, ...duplicateExecutablePaths],
+            env
+        });
+        if (!stopped.ok) {
+            return blocked(stopped.error || 'menubar_stop_before_replace_failed', 'Menu Bar process shutdown could not be verified before replacement.');
+        }
+        canonicalStopped = true;
+        actions.push('booted out Menu Bar and verified all canonical/project duplicate processes stopped');
+    }
+    else {
+        const duplicateStop = await terminateMenuBarProcesses(duplicateExecutablePaths, env);
+        if (!duplicateStop.ok) {
+            return blocked('menubar_project_duplicate_stop_failed', `Remaining PIDs: ${duplicateStop.remaining_pids.join(',')}`);
+        }
+    }
+    const duplicateCleanup = await cleanupProjectMenuBarDuplicates({
+        paths,
+        root: paths.root,
+        env,
+        candidateExecutablePaths: duplicateExecutablePaths
+    });
+    warnings.push(...duplicateCleanup.warnings);
+    if (!duplicateCleanup.ok) {
+        return blocked(duplicateCleanup.blockers[0] || 'menubar_project_duplicate_cleanup_failed', 'Project-local Menu Bar duplicate cleanup could not be completed safely.');
+    }
+    if (duplicateCleanup.removed.length > 0) {
+        actions.push(`removed ${duplicateCleanup.removed.length} verified project-local Menu Bar duplicate(s)`);
+    }
+    if (duplicateCleanup.receipt_path)
+        actions.push(`wrote duplicate cleanup receipt ${duplicateCleanup.receipt_path}`);
+    if (!upToDate) {
+        const preservingPrevious = await exists(paths.app_path);
         try {
             transaction = await applyMenuBarGenerationTransaction({
                 purpose: 'install', journalPath: paths.install_transaction_path, pairs: installPairs, env
@@ -325,23 +389,19 @@ export async function installSksMenuBar(opts = {}) {
             transaction = committed;
         }
     }
-    const restartDeferred = sksMenuBarRestartDeferred(env);
-    const launchWanted = opts.launch !== false
-        && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1'
-        && !restartDeferred;
-    if (restartDeferred && opts.launch !== false && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1') {
-        warnings.push('launch_deferred_until_parent_operation_completes');
-    }
-    const launchAllowed = path.resolve(paths.home) === realUserHome() && !isMenuBarInstallPathUnderTempDir(paths.executable_path, env);
-    if (launchWanted && path.resolve(paths.home) !== realUserHome())
-        warnings.push('launch_skipped_non_user_home');
-    if (launchWanted && isMenuBarInstallPathUnderTempDir(paths.executable_path, env))
-        warnings.push('launch_skipped_temp_install');
     let launch = { requested: false, method: 'skipped', ok: true };
     if (launchWanted && launchAllowed) {
         if (await seedMenuBarPreferredPosition(env))
             actions.push('seeded SKS menu bar preferred position');
-        launch = await launchMenuBar({ launchctl, open, paths, env });
+        launch = await launchMenuBar({
+            launchctl,
+            open,
+            paths,
+            env,
+            alreadyStopped: canonicalStopped,
+            expectedVersion: stamp.package_version,
+            executablePaths: [paths.executable_path, ...duplicateExecutablePaths]
+        });
     }
     const rollbackCandidateExists = !upToDate && await exists(paths.backup_app_path);
     const rollback = shouldAutoRollbackMenuBarLaunch({ launch, upToDate, rollbackCandidateExists })
@@ -362,6 +422,11 @@ export async function installSksMenuBar(opts = {}) {
         : stamp;
     result.secret_env_cleanup = cleanup;
     result.launch = launch;
+    result.installed_version = result.build_stamp?.package_version || null;
+    if (launch.version_probe) {
+        result.menubar_version_probe = launch.version_probe;
+        result.running_process = await inspectRunningMenuBarProcess(paths, launch.version_probe.pid, env);
+    }
     result.rollback = rollback;
     result.transaction = transaction;
     result.blockers = ok ? [] : [