stackbite 0.5.90 → 0.5.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackbite",
-  "version": "0.5.90",
+  "version": "0.5.92",
   "description": "Verified native Stackbite CLI bootstrapper",
   "license": "UNLICENSED",
   "engines": {

package/packaging/npm/lib/bootstrap.js

@@ -82,10 +82,10 @@ function boundedRunner(limit) {
   }
   return task => new Promise((resolve, reject) => { queue.push({ task, resolve, reject }); next(); });
 }
-// Bounded concurrency overlaps file reads; every pinned member is still hashed in full.
+// Bounded concurrency overlaps selected file reads; every selected member is hashed in full.
 const HASH_CONCURRENCY = 8;
 // Walks the payload; every file or in-root link must resolve to a bounded regular file and pinned members must match.
-async function payloadFiles(root, expected, hashes) {
+async function payloadFiles(root, expected, hashes, includePhone) {
   const actual = new Set(), run = boundedRunner(HASH_CONCURRENCY), checks = [];
   let total = 0, entries = 0;
   async function checkHash(relative, resolved) {
@@ -93,6 +93,9 @@ async function payloadFiles(root, expected, hashes) {
   }
   async function visit(directoryPath) {
     for (const name of await fs.readdir(directoryPath)) {
+      // Optional Phone is checked at activation. Do not traverse an unused tree,
+      // including a missing or redirected tree; selected runtime links cannot use it.
+      if (!includePhone && directoryPath === root && name === 'phone') continue;
       if (++entries > LIMITS.members * 2) fail('Cached release has too many entries');
       const target = path.join(directoryPath, name), relative = path.relative(root, target).split(path.sep).join('/');
       memberPath(relative);
@@ -101,6 +104,7 @@ async function payloadFiles(root, expected, hashes) {
       if (!entry.isFile() && !entry.isSymbolicLink()) fail('Release contains a special file');
       const resolved = await fs.realpath(target);
       if (!inside(root, resolved)) fail('Release link escapes the cache root');
+      if (!includePhone && path.relative(root, resolved).split(path.sep)[0] === 'phone') fail('Runtime link resolves into optional Phone payload');
       const resolvedInfo = await fs.lstat(resolved);
       if (!resolvedInfo.isFile() || resolvedInfo.size > LIMITS.member) fail('Release link does not resolve to a bounded regular file');
       total += resolvedInfo.size;
@@ -137,8 +141,8 @@ async function checkProductIdentity(root, spec, metadata) {
         || ((spec.platform === 'darwin' || value.platform !== undefined) && value.platform !== spec.host)) fail('Release product/version/commit identity mismatch');
   }
 }
-async function nativeExecutable(root, spec) {
-  const executable = path.join(root, spec.platform === 'win32' ? 'stackbite.exe' : 'stackbite');
+async function nativeExecutable(root, spec, name = 'stackbite') {
+  const executable = path.join(root, name + (spec.platform === 'win32' ? '.exe' : ''));
   const image = await fs.lstat(executable);
   if (!image.isFile() || image.isSymbolicLink()) fail('Native release executable is missing or a link');
   const file = await fs.open(executable, 'r');
@@ -153,17 +157,40 @@ async function nativeExecutable(root, spec) {
   if (spec.platform !== 'win32' && process.platform !== 'win32' && !(image.mode & 0o111)) fail('Native release executable has no execute permission');
   return executable;
 }
-async function validatePayload(directory, spec) {
+// The release pins the whole payload before this mapping. Old releases keep
+// their original engine; a present native entry is never silently bypassed.
+async function publicExecutable(root, spec, hashes) {
+  const engine = await nativeExecutable(root, spec);
+  const name = 'stackbite-launcher' + (spec.platform === 'win32' ? '.exe' : '');
+  if (!Object.hasOwn(hashes, name)) {
+    if (await exists(path.join(root, name))) fail('Native entry is present without a release pin');
+    return engine;
+  }
+  const manifest = JSON.parse((await readSmall(path.join(root, 'manifest.json'))).toString('utf8'));
+  const entry = manifest.binaries?.['stackbite-launcher'], info = entry?.build_info;
+  const target = { win32: 'x86_64-pc-windows-msvc', linux: 'x86_64-unknown-linux-gnu', darwin: 'aarch64-apple-darwin' }[spec.platform];
+  if (manifest.schema !== 'stackbite-rust-terminal-build-v1' || manifest.product !== 'Stackbite'
+      || manifest.version !== spec.version || manifest.commit !== spec.commit || manifest.target !== target || manifest.protocol !== 1
+      || !entry || Object.keys(entry).sort().join(',') !== 'build_info,path,sha256'
+      || entry.path !== name || entry.sha256 !== hashes[name] || manifest.artifacts?.[name]?.sha256 !== hashes[name]
+      || manifest.artifacts?.[name]?.kind !== 'binary' || !Number.isSafeInteger(manifest.artifacts?.[name]?.size) || manifest.artifacts[name].size < 1
+      || !info || Object.keys(info).sort().join(',') !== 'binary,commit,product,protocol,target,version'
+      || info.product !== 'Stackbite' || info.binary !== 'stackbite-launcher' || info.version !== spec.version
+      || info.commit !== spec.commit || info.target !== target || info.protocol !== 1) fail('Native entry package identity or pin is invalid');
+  return nativeExecutable(root, spec, 'stackbite-launcher');
+}
+async function validatePayload(directory, spec, { includePhone = true } = {}) {
   const root = await payloadRoot(directory);
   const { hashes, metadata } = await pinnedDocuments(root, spec);
   const expected = expectedMembers(hashes);
-  const actual = await payloadFiles(root, expected, hashes);
+  if (!includePhone) for (const name of expected) if (name.startsWith('phone/')) expected.delete(name);
+  const actual = await payloadFiles(root, expected, hashes, includePhone);
   await checkMemberSet(root, spec, hashes, expected, actual);
   await checkProductIdentity(root, spec, metadata);
-  return nativeExecutable(root, spec);
+  return publicExecutable(root, spec, hashes);
 }
 async function ensureBinary(spec, { cache = cacheDirectory(), downloadImpl = download, extractImpl = extractArchive,
-  checkOnly = false, reportCached = false, progress = () => {} } = {}) {
+  checkOnly = false, reportCached = false, includePhone = false, progress = () => {} } = {}) {
   cache = path.resolve(cache);
   if (checkOnly) {
     if (!await existingCacheDirectory(cache)) fail('Pinned runtime is not cached; run stackbite setup.');
@@ -173,7 +200,7 @@ async function ensureBinary(spec, { cache = cacheDirectory(), downloadImpl = dow
   const target = path.join(cache, `v1-${cacheKey}`);
   if (await exists(target)) {
     if (checkOnly || reportCached) progress('validate');
-    const installed = { home: target, executable: await validatePayload(target, spec) };
+    const installed = { home: target, executable: await validatePayload(target, spec, { includePhone }) };
     if (checkOnly || reportCached) progress('ready');
     return installed;
   }
@@ -231,10 +258,12 @@ async function main(argv = process.argv.slice(2), options = {}) {
   const platform = options.platform || process.platform;
   const environment = options.environment || process.env;
   const spec = releaseSpec(manifest, platform, options.arch || process.arch, options);
-  // Every launch still verifies the full pinned payload; timing only observes it.
+  // First install always verifies everything. Cached TUI/runtime starts defer only
+  // Phone; explicit phone/setup/removal commands retain the full pinned check.
   const installed = await timing.phase(environment, 'launcher.ensure', () => ensureBinary(spec, { ...options,
     cache: options.cache || cacheDirectory(environment, platform),
     checkOnly: removing || setup?.checkOnly || false, reportCached: Boolean(setup),
+    includePhone: removing || Boolean(setup) || argv[0] === 'phone',
     progress: options.progress || stageReporter(options.stderr || process.stderr) }));
   if (setup) return { code: 0, signal: null };
   timing.mark(environment, 'launcher.exec');

package/packaging/npm/release.json

@@ -1,35 +1,35 @@
 {
   "schema": 1,
-  "version": "0.5.90",
-  "commit": "56d4ca6cf772afab8755bb24be9d0b5d7acb9820",
+  "version": "0.5.92",
+  "commit": "cc476a31b6ff0464f623372fe15fff3ff311d942",
   "repository": "Shinick-Han/stackbite",
   "platforms": {
     "win32-x64": {
-      "asset": "stackbite-0.5.90-windows-x64-56d4ca6cf772.zip",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.90/stackbite-0.5.90-windows-x64-56d4ca6cf772.zip",
-      "sha256": "e9ba7356d2b4ad2fbcd60e5280b5e66a9d67fdad7b6c3390e151df593b5b5eac",
-      "size": 94778285,
-      "root": "stackbite-0.5.90-windows-x64-56d4ca6cf772",
-      "manifestSha256": "611a5a174ab0188b1f14ceaf267c99f443fa81244c66b636e27ec252a9e49e99",
-      "metadataSha256": "c382fc7a1defe257d6415ba3085d141a5b83b8dcf1189d09937df7fc2084bf54"
+      "asset": "stackbite-0.5.92-windows-x64-cc476a31b6ff.zip",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.92/stackbite-0.5.92-windows-x64-cc476a31b6ff.zip",
+      "sha256": "e27e3f909e93965412cfae83a8eea6a2bdbe49126104f452464a7913f2aa03d9",
+      "size": 95304318,
+      "root": "stackbite-0.5.92-windows-x64-cc476a31b6ff",
+      "manifestSha256": "b784ca757ac89eb62c3226f81e71e5467b99259bfa46f1c785fff8f457b8e152",
+      "metadataSha256": "5414656b14f65921506b664123e9b0526cdd33f253c27ef122f0e335d6dda736"
     },
     "linux-x64": {
-      "asset": "stackbite-0.5.90-linux-x86_64-56d4ca6cf772.tar.gz",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.90/stackbite-0.5.90-linux-x86_64-56d4ca6cf772.tar.gz",
-      "sha256": "6243c30e23b037e1449db96cf819b7c38cbc0e2b38b2d2ac8ff1b9d9237a83d7",
-      "size": 74714723,
-      "root": "stackbite-0.5.90-linux-x86_64-56d4ca6cf772",
-      "manifestSha256": "a02b4e350870584b16e6bbd544abf7eaa75b24a6314eadad84252ab1b9c0b424",
-      "metadataSha256": "f238756ab3e80411e7260cf55b224ee64d78bb34ee8c624bb8fa6b8e31582b34"
+      "asset": "stackbite-0.5.92-linux-x86_64-cc476a31b6ff.tar.gz",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.92/stackbite-0.5.92-linux-x86_64-cc476a31b6ff.tar.gz",
+      "sha256": "15b82d52a8e1b1636fb0d69af27c881259a7b8efe3a808789020adbe0090698c",
+      "size": 75399110,
+      "root": "stackbite-0.5.92-linux-x86_64-cc476a31b6ff",
+      "manifestSha256": "ac8ece054b13ab8b8dd4f4994fa18c6aee7de70e0bf5617346de90a3abc320df",
+      "metadataSha256": "61c66bab03bd7ee73ca425c814f02740c1f72c0d47391fe85bbb778a81aaf273"
     },
     "darwin-arm64": {
-      "asset": "stackbite-0.5.90-macos-arm64-56d4ca6cf772.tar.gz",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.90/stackbite-0.5.90-macos-arm64-56d4ca6cf772.tar.gz",
-      "sha256": "3f8b9b59cad56e0b1b6b6f0ab265ce73c5a3b351a3e42e3684b697c86926205a",
-      "size": 35916960,
-      "root": "stackbite-0.5.90-macos-arm64-56d4ca6cf772",
-      "manifestSha256": "ce23b7ea6725e31914a13e516942272a68885ab09798729bb9539c1af3f2a9e2",
-      "metadataSha256": "845a416ab9f82bc0edcff61c2f971d279f5bb05342e284c45978d9e96891ad23"
+      "asset": "stackbite-0.5.92-macos-arm64-cc476a31b6ff.tar.gz",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.92/stackbite-0.5.92-macos-arm64-cc476a31b6ff.tar.gz",
+      "sha256": "c12210996e9ad9431f40db11abc57f4e14207285509164577da087b7e368f198",
+      "size": 30498979,
+      "root": "stackbite-0.5.92-macos-arm64-cc476a31b6ff",
+      "manifestSha256": "d4c4d72b78bd456de8fb9623cc8f658d79c0d75724a9250008bf0f2a0df0f025",
+      "metadataSha256": "d3d4f7903aab26562b91603c123d4817ebcb8a398e55c8063f756ca06ddf9a37"
     }
   }
 }