spi-agent-gui 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.1
+
+- Original female-spy silhouette icon for the application window, favicon and platform packages.
+- Owned Linux desktop entry for default personal installs, with icon refresh on update/rollback and conservative uninstall.
+- Preserve unknown/modified desktop entries and refuse symlink directories; validate desktop Exec escaping.
+
 ## 0.1.0
 
 - Initial Pi launcher package and verified native desktop archive installer.

package/dist/spi.cjs

@@ -11,7 +11,7 @@ var __commonJS = (cb, mod) => function __require() {
 var define_SPI_RELEASE_default;
 var init_define_SPI_RELEASE = __esm({
   "<define:__SPI_RELEASE__>"() {
-    define_SPI_RELEASE_default = { version: "0.1.0", repository: "DiamondGo/spi", packageName: "spi-agent-gui" };
+    define_SPI_RELEASE_default = { version: "0.1.1", repository: "DiamondGo/spi", packageName: "spi-agent-gui" };
   }
 });
 
@@ -4608,12 +4608,81 @@ var require_yauzl = __commonJS({
   }
 });
 
+// packages/pi-spi/lib/desktop.cjs
+var require_desktop = __commonJS({
+  "packages/pi-spi/lib/desktop.cjs"(exports2, module2) {
+    init_define_SPI_RELEASE();
+    var fs2 = require("node:fs");
+    var path2 = require("node:path");
+    var crypto2 = require("node:crypto");
+    var digest = (file) => crypto2.createHash("sha256").update(fs2.readFileSync(file)).digest("hex");
+    function exists(file) {
+      try {
+        fs2.lstatSync(file);
+        return true;
+      } catch (error) {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      }
+    }
+    function safeParents(directory) {
+      for (let dir = directory; ; dir = path2.dirname(dir)) {
+        if (exists(dir) && (!fs2.lstatSync(dir).isDirectory() || fs2.lstatSync(dir).isSymbolicLink())) throw Error("Refusing symlink desktop directory");
+        if (dir === path2.dirname(dir)) break;
+      }
+    }
+    function assertDesktopOwned2(record) {
+      if (!record) return;
+      if (!path2.isAbsolute(record.path) || path2.basename(record.path) !== "spi.desktop") throw Error("Invalid desktop entry record");
+      safeParents(path2.dirname(record.path));
+      if (exists(record.path) && (fs2.lstatSync(record.path).isSymbolicLink() || !fs2.lstatSync(record.path).isFile() || digest(record.path) !== record.sha256)) throw Error("Refusing modified desktop entry");
+    }
+    function removeDesktopEntry2(record) {
+      assertDesktopOwned2(record);
+      if (record) fs2.rmSync(record.path, { force: true });
+    }
+    var value = (s) => s.replaceAll("\\", "\\\\").replaceAll("\n", "\\n").replaceAll("\r", "\\r").replaceAll("	", "\\t");
+    function desktopText(command, icon) {
+      if (/[\x00-\x1f\x7f]/.test(command + icon)) throw Error("Unsupported control character in desktop path");
+      const argument = '"' + command.replace(/[\\"`$]/g, "\\$&").replaceAll("%", "%%") + '"';
+      return "[Desktop Entry]\nType=Application\nName=sPi\nComment=Pi Coding Agent GUI\nExec=" + value(argument) + "\nIcon=" + value(icon) + "\nTerminal=false\nCategories=Development;\nStartupWMClass=spi\nStartupNotify=true\n";
+    }
+    function syncDesktopEntry2({ enabled, dataHome, root, command, entryPath, previous }) {
+      if (!enabled) return previous;
+      const icon = path2.join(path2.dirname(entryPath), "resources", "icon.png");
+      if (!exists(icon)) {
+        if (previous) removeDesktopEntry2(previous);
+        return void 0;
+      }
+      if (!path2.isAbsolute(dataHome)) throw Error("XDG data home must be absolute");
+      const directory = path2.join(dataHome, "applications"), file = path2.join(directory, "spi.desktop");
+      safeParents(directory);
+      if (exists(file)) {
+        if (!previous || previous.path !== file) throw Error("Refusing unowned desktop entry");
+        assertDesktopOwned2(previous);
+      }
+      if (previous && previous.path !== file) throw Error("Desktop location changed; existing entry was preserved");
+      if (fs2.lstatSync(icon).isSymbolicLink() || !fs2.lstatSync(icon).isFile() || !fs2.realpathSync(icon).startsWith(fs2.realpathSync(root) + path2.sep)) throw Error("Invalid application icon");
+      const text = desktopText(command, icon), temp = file + "." + crypto2.randomUUID() + ".tmp";
+      fs2.mkdirSync(directory, { recursive: true });
+      try {
+        fs2.writeFileSync(temp, text, { mode: 420, flag: "wx" });
+        fs2.renameSync(temp, file);
+      } finally {
+        fs2.rmSync(temp, { force: true });
+      }
+      return { path: file, sha256: digest(file) };
+    }
+    module2.exports = { syncDesktopEntry: syncDesktopEntry2, assertDesktopOwned: assertDesktopOwned2, removeDesktopEntry: removeDesktopEntry2, desktopText };
+  }
+});
+
 // package.json
 var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "spi",
-      version: "0.1.0",
+      version: "0.1.1",
       description: "sPi - Simple Pi Agent GUI",
       private: true,
       license: "UNLICENSED",
@@ -4626,6 +4695,8 @@ var require_package = __commonJS({
         dev: "electron-vite dev",
         postinstall: "electron-builder install-app-deps",
         build: "electron-vite build",
+        "build:icons": "node scripts/icons.cjs",
+        "test:icons": "node scripts/icons.test.cjs",
         start: "electron-vite preview",
         dist: "node scripts/build-portable.cjs",
         "dist:linux": "node scripts/build-portable.cjs",
@@ -4657,6 +4728,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@electron/asar": "^3.4.1",
+        "@resvg/resvg-js": "2.6.2",
         "@types/react": "^18.3.12",
         "@types/react-dom": "^18.3.1",
         "@vitejs/plugin-react": "^4.3.4",
@@ -4695,6 +4767,7 @@ var { spawn } = require("node:child_process");
 var { pipeline } = require("node:stream/promises");
 var tar = require_index_min();
 var yauzl = require_yauzl();
+var { syncDesktopEntry, assertDesktopOwned, removeDesktopEntry } = require_desktop();
 var BUILD = typeof define_SPI_RELEASE_default === "undefined" ? { version: require_package().version, repository: require_release_config().repository, packageName: require_release_config().npmPackage } : define_SPI_RELEASE_default;
 var OWNER = "sPi-installer-v1";
 var MAX_ARCHIVE = 700 * 1024 * 1024;
@@ -5009,7 +5082,13 @@ function register(root, options2 = {}) {
   fs.renameSync(temp, dest);
   const shims = (oldState.shims || []).filter((s) => s.path !== dest);
   shims.push({ path: dest, sha256: hash(dest) });
-  atomicJSON(path.join(root, "install-state.json"), { owner: OWNER, shims, launcher: { sha256: hash(cli) } });
+  let desktop = oldState.desktop;
+  if (process.platform === "linux" && root === path.resolve(defaultRoot())) try {
+    desktop = syncDesktopEntry({ enabled: true, dataHome: process.env.XDG_DATA_HOME || path.join(os.homedir(), ".local/share"), root, command: dest, entryPath: cur.entryPath, previous: desktop });
+  } catch (error) {
+    console.warn("[sPi] Desktop entry unchanged: " + error.message);
+  }
+  atomicJSON(path.join(root, "install-state.json"), { owner: OWNER, shims, desktop, launcher: { sha256: hash(cli) } });
   console.log("sPi command: " + dest);
   if (!(process.env.PATH || "").split(path.delimiter).some((d) => path.resolve(d) === dir)) console.log("Add this directory to your PATH: " + dir + " (shell configuration was not changed)");
 }
@@ -5157,9 +5236,11 @@ async function uninstall(options2) {
     if (fs.existsSync(launcher) && fs.lstatSync(launcher).isSymbolicLink()) fail("Refusing symlink launcher");
     const cli = path.join(launcher, "spi.cjs");
     if (fs.existsSync(cli) && (!state.launcher || hash(cli) !== state.launcher.sha256 || fs.lstatSync(cli).isSymbolicLink())) fail("Refusing modified launcher");
+    assertDesktopOwned(state.desktop);
     for (const s of state.shims || []) if (fs.existsSync(s.path)) {
       if (fs.lstatSync(s.path).isSymbolicLink() || hash(s.path) !== s.sha256) fail("Refusing to remove a modified command");
     }
+    removeDesktopEntry(state.desktop);
     for (const s of state.shims || []) fs.rmSync(s.path, { force: true });
     for (const dir of owned) fs.rmSync(dir, { recursive: true, force: true });
     fs.rmSync(path.join(launcher, "spi.cjs"), { force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spi-agent-gui",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "sPi - Simple Pi Agent GUI installer and Pi launcher",
   "type": "module",
   "license": "UNLICENSED",