stackbite 0.5.103 → 0.5.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackbite",
-  "version": "0.5.103",
+  "version": "0.5.105",
   "description": "Verified native Stackbite CLI bootstrapper",
   "license": "UNLICENSED",
   "engines": {

package/packaging/npm/lib/bootstrap.js

@@ -7,7 +7,7 @@ const { createHash } = require('node:crypto');
 const { LIMITS, fail, memberPath, inside, hashFile, readSmall, exists } = require('./common');
 const { download } = require('./download');
 const { extractArchive } = require('./archive');
-const { cacheDirectory, existingCacheDirectory } = require('./cache');
+const { cacheDirectory, existingCacheDirectory, resolveCacheDirectory } = require('./cache');
 const { parseSetup, stageReporter } = require('./setup');
 const timing = require('./startup-timing');
 const packageVersion = require('../../../package.json').version;
@@ -209,12 +209,24 @@ function installationRoot(environment, platform) {
     ? path.resolve(environment.LOCALAPPDATA || home, 'Stackbite')
     : path.resolve(environment.XDG_DATA_HOME || path.join(environment.HOME || home, '.local', 'share'), 'stackbite');
 }
+// Resolve only user-selected directory roots. Managed descendants, including
+// the installation root and update directory, must still be real directories.
+async function selectedDirectory(directory, environment, platform) {
+  const home = environment.USERPROFILE || environment.HOME || os.homedir();
+  const data = platform === 'win32' ? environment.LOCALAPPDATA || home
+    : environment.XDG_DATA_HOME || path.join(environment.HOME || home, '.local', 'share');
+  const roots = [data, home].map(root => path.resolve(root)).sort((a, b) => b.length - a.length);
+  const selected = roots.find(root => directory === root || inside(root, directory));
+  if (!selected) return existingCacheDirectory(directory);
+  const resolved = await resolveCacheDirectory(selected);
+  return existingCacheDirectory(path.join(resolved, path.relative(selected, directory)));
+}
 // Before a runtime is available, read the SAME journal without creating any
 // product directory. The verified bundled engine repeats this under OS locks
 // and owns cache/locator publication. This read is not a JavaScript flock.
 async function admitPublication(environment, platform) {
   const root = installationRoot(environment, platform);
-  if (!await existingCacheDirectory(root)) return;
+  if (!await selectedDirectory(root, environment, platform)) return;
   const journal = path.join(root, '.stackbite-uninstall.json');
   if (!await exists(journal)) return;
   const record = JSON.parse((await readSmall(journal, 8 * 1024 * 1024)).toString('utf8').replace(/^\uFEFF/, ''));
@@ -243,7 +255,7 @@ async function locatorIncarnation(root) {
 // package can continue it. The digest binds the same request bytes until launch.
 async function acceptedRemovalWithoutCapsule(environment, platform) {
   const root = installationRoot(environment, platform);
-  if (!await existingCacheDirectory(root)) return null;
+  if (!await selectedDirectory(root, environment, platform)) return null;
   const journal = path.join(root, '.stackbite-uninstall.json');
   let info;
   try { info = await fs.lstat(journal); } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
@@ -262,8 +274,9 @@ async function acceptedRemovalWithoutCapsule(environment, platform) {
     digest: createHash('sha256').update(bytes).digest('hex') };
 }
 
-async function baselinePin(file) {
-  await existingCacheDirectory(path.dirname(file));
+async function baselinePin(file, environment, platform) {
+  if (environment) await selectedDirectory(path.dirname(file), environment, platform);
+  else await existingCacheDirectory(path.dirname(file));
   let info;
   try { info = await fs.lstat(file, { bigint: true }); }
   catch (error) { if (error.code === 'ENOENT') return null; throw error; }
@@ -296,11 +309,11 @@ async function captureBaseline(environment, platform, cachedHome) {
   for (const selected of homes) {
     for (const name of ['portable.json', platform === 'win32' ? 'stackbite.exe' : 'stackbite', 'stackbite.py']) {
       const file = path.join(selected, name);
-      if (await baselinePin(file) !== null) paths.push(file);
+      if (await baselinePin(file, environment, platform) !== null) paths.push(file);
     }
   }
   const legacy = [];
-  for (const file of new Set(paths)) legacy.push({ path: file, identity: await baselinePin(file) });
+  for (const file of new Set(paths)) legacy.push({ path: file, identity: await baselinePin(file, environment, platform) });
   return legacy.some(pin => pin.identity !== null) ? { root, incarnation: null, legacy } : null;
 }
 
@@ -310,23 +323,23 @@ async function assertBaseline(environment, platform) {
   if (Buffer.byteLength(raw) > 16384) fail('Invalid installation baseline');
   const expected = JSON.parse(raw), root = installationRoot(environment, platform);
   if (expected.preparation !== undefined) {
-    await assertPreparationBaseline(expected, root, platform);
+    await assertPreparationBaseline(expected, root, platform, environment);
     return;
   }
   const current = await locatorInstallationId(root);
   if (expected.root !== root || expected.incarnation !== current) fail('Installation changed while staging');
-  if (current === null) await assertLegacyBaseline(expected, platform);
+  if (current === null) await assertLegacyBaseline(expected, platform, environment);
 }
 // Python-origin restrictions retain FILE_ID_INFO's full volume serial;
 // libuv reports its 32-bit component. The engine still checks the full pin.
 function libuvIdentity(platform, actual, identity) {
   return platform === 'win32' && actual && identity ? { ...identity, device: (BigInt(identity.device) & 0xffffffffn).toString() } : identity;
 }
-async function assertPreparationBaseline(expected, root, platform) {
+async function assertPreparationBaseline(expected, root, platform, environment) {
   const pin = expected.preparation, file = path.join(root, '.stackbite-update', 'update.lock');
   if (Object.keys(expected).sort().join(',') !== 'preparation,root' || expected.root !== root
       || !pin || Object.keys(pin).sort().join(',') !== 'identity,path' || pin.path !== file || !pin.identity) fail('Invalid installation preparation');
-  const actual = await baselinePin(file);
+  const actual = await baselinePin(file, environment, platform);
   if (JSON.stringify(actual) !== JSON.stringify(libuvIdentity(platform, actual, pin.identity))) fail('Installation changed while staging');
 }
 // The first present locator's incarnation; null for a legacy or absent locator.
@@ -339,10 +352,10 @@ async function locatorInstallationId(root) {
   }
   return null;
 }
-async function assertLegacyBaseline(expected, platform) {
+async function assertLegacyBaseline(expected, platform, environment) {
   if (!Array.isArray(expected.legacy) || !expected.legacy.length || expected.legacy.length > 32) fail('Invalid legacy installation baseline');
   for (const pin of expected.legacy) {
-    const actual = await baselinePin(pin.path);
+    const actual = await baselinePin(pin.path, environment, platform);
     if (JSON.stringify(actual) !== JSON.stringify(libuvIdentity(platform, actual, pin.identity))) fail('Installation changed while staging');
   }
 }
@@ -381,12 +394,12 @@ async function settlePreparation(preparation, environment, platform, source) {
     if (!preparation.created || !source || !await source.absent()
         || await captureBaseline(environment, platform, preparation.target)) return;
     for (const [directory, pin] of preparation.directories) {
-      await existingCacheDirectory(directory);
+      await selectedDirectory(directory, environment, platform);
       const current = await fs.lstat(directory, { bigint: true });
       if (current.dev !== pin.dev || current.ino !== pin.ino) return;
     }
     const { file, identity, handle } = preparation;
-    if (JSON.stringify(await baselinePin(file)) !== JSON.stringify(identity)) return;
+    if (JSON.stringify(await baselinePin(file, environment, platform)) !== JSON.stringify(identity)) return;
     const held = await handle.stat({ bigint: true });
     if (!held.isFile() || held.nlink !== 1n || held.size > 1n) return;
     const bytes = Buffer.alloc(2);
@@ -395,7 +408,7 @@ async function settlePreparation(preparation, environment, platform, source) {
     if (BigInt(bytesRead) !== held.size || bytesRead === 1 && bytes[0] !== 0x30) return;
     await fs.unlink(file);
     for (const [directory, pin] of preparation.directories) {
-      await existingCacheDirectory(directory);
+      await selectedDirectory(directory, environment, platform);
       const current = await fs.lstat(directory, { bigint: true });
       if (current.dev !== pin.dev || current.ino !== pin.ino) break;
       await fs.rmdir(directory);
@@ -441,21 +454,21 @@ async function reservePreparation(environment, platform, target, source) {
   // object identity only; the bundled engine still takes the kernel gates.
   const root = installationRoot(environment, platform), directory = path.join(root, '.stackbite-update');
   await admitPublication(environment, platform);
-  await existingCacheDirectory(directory);
+  await selectedDirectory(directory, environment, platform);
   for (let parent = root; ; parent = path.dirname(parent)) {
     if (await exists(path.join(parent, '.git'))) fail('Refusing installation preparation in a source repository');
     if (parent === path.dirname(parent)) break;
   }
   if (source) await source.validate();
   const firstCreated = await fs.mkdir(directory, { recursive: true, mode: 0o700 });
-  await existingCacheDirectory(directory);
+  await selectedDirectory(directory, environment, platform);
   const directories = await createdDirectories(firstCreated, [directory, root]);
   const file = path.join(directory, 'update.lock');
   const { handle, created } = await openPreparationFile(file);
   let preparation;
   try {
     const held = await handle.stat({ bigint: true });
-    const identity = await baselinePin(file);
+    const identity = await baselinePin(file, environment, platform);
     if (!held.isFile() || held.nlink !== 1n || JSON.stringify(identity) !== JSON.stringify({ device: held.dev.toString(), inode: held.ino.toString() })) fail('Invalid installation preparation');
     preparation = { handle, file, identity, created, directories, target };
     baseline = { root, preparation: { path: file, identity } };
@@ -496,7 +509,7 @@ async function publishCache(payload, target, spec, options) {
 async function ensureBinary(spec, { cache = cacheDirectory(), downloadImpl = download, extractImpl = extractArchive,
   checkOnly = false, reportCached = false, includePhone = false, progress = () => {},
   environment = process.env, publishImpl = publishCache, registrationSource = null, ...options } = {}) {
-  cache = path.resolve(cache);
+  cache = await resolveCacheDirectory(cache);
   environment = { ...environment };
   if (!checkOnly) {
     await admitPublication(environment, spec.platform);

package/packaging/npm/lib/cache.js

@@ -20,4 +20,24 @@ async function existingCacheDirectory(directory) {
   if (!info.isDirectory() || info.isSymbolicLink()) fail('Cache directory contains a link or non-directory');
   return true;
 }
-module.exports = { cacheDirectory, existingCacheDirectory };
+// Resolve the selected cache path once, including an absent suffix. Internal
+// payload paths still use the link checks and pinned hashes in bootstrap.
+async function resolveCacheDirectory(directory) {
+  directory = path.resolve(directory);
+  const missing = [];
+  let current = directory;
+  for (;;) {
+    try {
+      const resolved = await fs.realpath(current);
+      if (!(await fs.stat(resolved)).isDirectory()) fail('Cache directory contains a non-directory');
+      return path.join(resolved, ...missing.reverse());
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      const parent = path.dirname(current);
+      if (parent === current) throw error;
+      missing.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+module.exports = { cacheDirectory, existingCacheDirectory, resolveCacheDirectory };

package/packaging/npm/release.json

@@ -1,35 +1,35 @@
 {
   "schema": 1,
-  "version": "0.5.103",
-  "commit": "47aa8fd060382de0a8da2ad206279067293cbd50",
+  "version": "0.5.105",
+  "commit": "235f6efe68c2db92ecbda776f27ffc55c28bbac7",
   "repository": "Shinick-Han/stackbite",
   "platforms": {
     "win32-x64": {
-      "asset": "stackbite-0.5.103-windows-x64-47aa8fd06038.zip",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.103/stackbite-0.5.103-windows-x64-47aa8fd06038.zip",
-      "sha256": "9a539580a612d930e8624649b07300f7926c43da8cbab21cee281acd22180c1e",
-      "size": 96002066,
-      "root": "stackbite-0.5.103-windows-x64-47aa8fd06038",
-      "manifestSha256": "37eda9211d27e94c0baed4a17f9f1b64d9bb73a7cb5771101c6cb1a4e6af6a9d",
-      "metadataSha256": "e457c7c510598b36563a7532e5a306451a9b0982e948ef621dd7ed871a36ce5d"
+      "asset": "stackbite-0.5.105-windows-x64-235f6efe68c2.zip",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.105/stackbite-0.5.105-windows-x64-235f6efe68c2.zip",
+      "sha256": "58b55180386fec481c87f8f95f3b12b066c7cd552f26c2d97908626648fdfb0f",
+      "size": 96306228,
+      "root": "stackbite-0.5.105-windows-x64-235f6efe68c2",
+      "manifestSha256": "90065bde2ddb6092a5f70b6f2d6c263e84db201847e17bd22498d717f2b8b00a",
+      "metadataSha256": "fd100b25335a5bd372bca12c30d9077a12571281bc38b98e614cda19aad277b7"
     },
     "linux-x64": {
-      "asset": "stackbite-0.5.103-linux-x86_64-47aa8fd06038.tar.gz",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.103/stackbite-0.5.103-linux-x86_64-47aa8fd06038.tar.gz",
-      "sha256": "8ece6fdc4fff9946f8d2dcb200ef9d3ef80c87209f64d20c949a0c070adb3d5b",
-      "size": 77198058,
-      "root": "stackbite-0.5.103-linux-x86_64-47aa8fd06038",
-      "manifestSha256": "d5495675ebe13bc89e58d4e03d2b19e9619f7a4c93591079f60e54fd4a5190c2",
-      "metadataSha256": "c858b20ab6a696eb756d2881d4657731b0f0eb56855fc078a2d6f027c0151de7"
+      "asset": "stackbite-0.5.105-linux-x86_64-235f6efe68c2.tar.gz",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.105/stackbite-0.5.105-linux-x86_64-235f6efe68c2.tar.gz",
+      "sha256": "26c730fad6c9288d897df8613aa554f0c6e0551e1247bc1caa247335a7f31b8e",
+      "size": 77521818,
+      "root": "stackbite-0.5.105-linux-x86_64-235f6efe68c2",
+      "manifestSha256": "3f22af3a8ee9cf7bf1bc80a2e01c07ba74b1836059309cb2ac063289e5194a2d",
+      "metadataSha256": "47feca72039402ff23d697778d24f8b763015a3cda62c1b2e978f7cd8c169dd2"
     },
     "darwin-arm64": {
-      "asset": "stackbite-0.5.103-macos-arm64-47aa8fd06038.tar.gz",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.103/stackbite-0.5.103-macos-arm64-47aa8fd06038.tar.gz",
-      "sha256": "61a795cddb426f694a7b6a0d11f416151e0dd6d43191ca1303c150be2feb0206",
-      "size": 33230555,
-      "root": "stackbite-0.5.103-macos-arm64-47aa8fd06038",
-      "manifestSha256": "d22dfdd857f2be54f9f97d74305d9de2e0957177e8d3da5b878fdd7160d2c912",
-      "metadataSha256": "e33be6949b9c047dfbe0f67c2b44cced26faeaa52fc5bd4f1a5380252eb03367"
+      "asset": "stackbite-0.5.105-macos-arm64-235f6efe68c2.tar.gz",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.105/stackbite-0.5.105-macos-arm64-235f6efe68c2.tar.gz",
+      "sha256": "568e50444ae47669b379aefc8b0c45e3d284ea1db456a344701e2a9ad87e4bd8",
+      "size": 33495757,
+      "root": "stackbite-0.5.105-macos-arm64-235f6efe68c2",
+      "manifestSha256": "632b645611bed771f4d8a47f1a22e9a5952b9ac27c6741dff150409256349083",
+      "metadataSha256": "b411b8de8f99ec000c751278dbbd1d5b58193086e4876343e931ab91e1411277"
     }
   }
 }