| 1 | import fs from "node:fs"; |
| 2 | import os from "node:os"; |
| 3 | import path from "node:path"; |
| 4 | import crypto from "node:crypto"; |
| 5 | import { spawn, spawnSync } from "node:child_process"; |
| 6 | import { fileURLToPath } from "node:url"; |
| 7 | import { inflateRawSync } from "node:zlib"; |
| 8 | import { replaceMacBundle, verifyReleaseBundle } from "./install-macos.mjs"; |
| 9 | import { APP_VERSION, APP_NAME, newerVersion } from "../src/app-socket.mjs"; |
| 10 | import { stateDir } from "../src/registry.mjs"; |
| 11 | |
| 12 | const repository="https://github.com/Hmbown/codewhale-cu-plugin"; |
| 13 | const limit=256*1024*1024; |
| 14 | const updateResultPath=()=>path.join(stateDir(),"update-result.json"); |
| 15 | export function readUpdateResult() { |
| 16 | try { |
| 17 | if(fs.statSync(updateResultPath()).size>4096) return null; |
| 18 | const result=JSON.parse(fs.readFileSync(updateResultPath(),"utf8")); |
| 19 | if(typeof result.ok!=="boolean"||typeof result.message!=="string"||result.message.length>1000) return null; |
| 20 | return {available:false,message:result.message}; |
| 21 | } catch { return null; } |
| 22 | } |
| 23 | async function responseBytes(response, maximum) { |
| 24 | const chunks=[]; let size=0; |
| 25 | for await(const chunk of response.body) { size+=chunk.length; if(size>maximum) throw new Error("The update service exceeded its response size limit."); chunks.push(chunk); } |
| 26 | return Buffer.concat(chunks); |
| 27 | } |
| 28 | export { newerVersion }; |
| 29 | export function releaseUpdate(release,current=APP_VERSION) { |
| 30 | const version=release?.tag_name?.replace(/^v/,""); |
| 31 | if(!version||release.draft||release.prerelease||!newerVersion(version,current)) return {available:false,message:`You have Computer Use ${current}. No newer stable installer is available.`}; |
| 32 | const name=`Codewhale-Computer-Use-${version}-macos-universal.zip`; |
| 33 | const asset=release.assets?.find(asset=>asset.name===name); |
| 34 | const url=`${repository}/releases/download/v${version}/${name}`; |
| 35 | if(!asset||asset.browser_download_url!==url||!/^sha256:[a-f0-9]{64}$/.test(asset.digest)||!Number.isSafeInteger(asset.size)||asset.size<=0||asset.size>limit) return {available:false,message:`Version ${version} has no verified macOS installer yet.`}; |
| 36 | return {available:true,version,url,sha256:asset.digest.slice(7),size:asset.size,message:`Computer Use ${version} is available. Install it to restart the helper; existing computer sessions will stop.`}; |
| 37 | } |
| 38 | export async function checkForUpdate() { |
| 39 | const response=await fetch("https://api.github.com/repos/Hmbown/codewhale-cu-plugin/releases/latest",{redirect:"error",headers:{Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(10_000)}); |
| 40 | if(response.status===404) return {available:false,message:"No stable installer has been published yet. Your current app is unchanged."}; |
| 41 | if(!response.ok) throw new Error(`The update service is unavailable (${response.status}). Try again later.`); |
| 42 | return releaseUpdate(JSON.parse((await responseBytes(response,1024*1024)).toString("utf8"))); |
| 43 | } |
| 44 | |
| 45 | /** Inspect both ZIP headers before extraction: no links, traversal or bombs. */ |
| 46 | export function validateReleaseZip(bytes) { |
| 47 | const minimum=Math.max(0,bytes.length-65557); let end=-1; |
| 48 | for(let i=bytes.length-22;i>=minimum;i--) if(bytes.readUInt32LE(i)===0x06054b50&&i+22+bytes.readUInt16LE(i+20)===bytes.length) { end=i; break; } |
| 49 | if(end<0||bytes.readUInt16LE(end+4)||bytes.readUInt16LE(end+6)) throw new Error("Invalid update archive."); |
| 50 | const count=bytes.readUInt16LE(end+10); let position=bytes.readUInt32LE(end+16),total=0; |
| 51 | if(!count||count>2000||bytes.readUInt16LE(end+8)!==count||position+bytes.readUInt32LE(end+12)!==end) throw new Error("Invalid update archive index."); |
| 52 | const seen=new Set(); |
| 53 | for(let i=0;i<count;i++) { |
| 54 | if(position+46>end||bytes.readUInt32LE(position)!==0x02014b50) throw new Error("Invalid update entry."); |
| 55 | const flags=bytes.readUInt16LE(position+8),method=bytes.readUInt16LE(position+10),length=bytes.readUInt16LE(position+28),extra=bytes.readUInt16LE(position+30),comment=bytes.readUInt16LE(position+32); |
| 56 | const name=bytes.subarray(position+46,position+46+length).toString("utf8"); |
| 57 | const kind=(bytes.readUInt32LE(position+38)>>>16)&0xf000,offset=bytes.readUInt32LE(position+42),compressed=bytes.readUInt32LE(position+20); |
| 58 | const size=bytes.readUInt32LE(position+24); total+=size; |
| 59 | if(flags&1||![0,8].includes(method)||![0,0x4000,0x8000].includes(kind)||total>512*1024*1024||position+46+length+extra+comment>end) throw new Error("Unsupported update entry."); |
| 60 | if(!name.startsWith(`${APP_NAME}.app/`)||name.includes("\\")||name.includes(":")||name.includes("\0")||name.split("/").some(part=>part===".."||part===".")||seen.has(name)) throw new Error("Unsafe update path."); |
| 61 | seen.add(name); |
| 62 | if(offset+30>position||bytes.readUInt32LE(offset)!==0x04034b50) throw new Error("Invalid update file header."); |
| 63 | const localLength=bytes.readUInt16LE(offset+26),localExtra=bytes.readUInt16LE(offset+28); |
| 64 | if(offset+30+localLength+localExtra+compressed>bytes.readUInt32LE(end+16)||bytes.subarray(offset+30,offset+30+localLength).toString("utf8")!==name) throw new Error("Inconsistent update file header."); |
| 65 | if(bytes.readUInt16LE(offset+8)!==method||bytes.readUInt16LE(offset+6)!==flags||(!(flags&8)&&(bytes.readUInt32LE(offset+18)!==compressed||bytes.readUInt32LE(offset+22)!==size))) throw new Error("Inconsistent update sizes or compression."); |
| 66 | const start=offset+30+localLength+localExtra; |
| 67 | // Header sizes are untrusted. Bound actual expansion before ditto writes |
| 68 | // anything, including a compressed payload whose headers understate size. |
| 69 | const payload=bytes.subarray(start,start+compressed); |
| 70 | let expanded; |
| 71 | try { expanded=method===0?payload.length:inflateRawSync(payload,{maxOutputLength:Math.max(size,1)}).length; } |
| 72 | catch { throw new Error("Invalid or oversized compressed update entry."); } |
| 73 | if(expanded!==size) throw new Error("The update entry size did not match its contents."); |
| 74 | position+=46+length+extra+comment; |
| 75 | } |
| 76 | if(position!==end) throw new Error("Invalid update archive length."); |
| 77 | return count; |
| 78 | } |
| 79 | |
| 80 | export async function prepareUpdate(update) { |
| 81 | if(!update?.available) throw new Error("Check for an available update first."); |
| 82 | if(!newerVersion(update.version,APP_VERSION)||update.url!==`${repository}/releases/download/v${update.version}/Codewhale-Computer-Use-${update.version}-macos-universal.zip`||!Number.isSafeInteger(update.size)||update.size<=0||update.size>limit) throw new Error("The update identity is invalid."); |
| 83 | // Only GitHub's fixed release URL and its asset CDN can serve the bytes. |
| 84 | let url=update.url, response; |
| 85 | for(let redirects=0;redirects<4;redirects++) { |
| 86 | response=await fetch(url,{redirect:"manual",signal:AbortSignal.timeout(60_000)}); |
| 87 | if(![301,302,303,307,308].includes(response.status)) break; |
| 88 | const next=new URL(response.headers.get("location"),url); |
| 89 | if(next.protocol!=="https:"||!["github.com","release-assets.githubusercontent.com","objects.githubusercontent.com"].includes(next.hostname)) throw new Error("The update download redirected to an unexpected host."); |
| 90 | url=next.href; |
| 91 | } |
| 92 | if(!response?.ok) throw new Error("The update could not be downloaded. Your current app is unchanged."); |
| 93 | const bytes=await responseBytes(response,update.size); |
| 94 | if(bytes.length!==update.size||crypto.createHash("sha256").update(bytes).digest("hex")!==update.sha256) throw new Error("The update checksum did not match. Your current app is unchanged."); |
| 95 | validateReleaseZip(bytes); |
| 96 | const stage=fs.mkdtempSync(path.join(os.tmpdir(),"codewhale-cu-release-")); |
| 97 | try { |
| 98 | const archive=path.join(stage,"release.zip"); fs.writeFileSync(archive,bytes,{mode:0o600}); |
| 99 | const result=spawnSync("ditto",["-x","-k",archive,stage],{encoding:"utf8"}); |
| 100 | if(result.status!==0) throw new Error("The update could not be unpacked."); |
| 101 | const bundle=path.join(stage,`${APP_NAME}.app`); verifyReleaseBundle(bundle); |
| 102 | const version=spawnSync("/usr/libexec/PlistBuddy",["-c","Print :CFBundleShortVersionString",path.join(bundle,"Contents","Info.plist")],{encoding:"utf8"}); |
| 103 | if(version.status!==0||version.stdout.trim()!==update.version) throw new Error("The downloaded app has a different version."); |
| 104 | return {stage,bundle}; |
| 105 | } catch(error) { fs.rmSync(stage,{recursive:true,force:true}); throw error; } |
| 106 | } |
| 107 | |
| 108 | export async function restartWithUpdate(prepared,destination) { |
| 109 | const logDir=path.join(os.homedir(),"Library","Logs",APP_NAME); fs.mkdirSync(logDir,{recursive:true}); |
| 110 | const log=fs.openSync(path.join(logDir,"update.log"),"a",0o600); |
| 111 | const child=spawn(process.execPath,[fileURLToPath(import.meta.url),"--apply",prepared.bundle,destination,String(process.pid),String(process.ppid)],{detached:true,stdio:["ignore",log,log]}); |
| 112 | try { await new Promise((resolve,reject)=>{child.once("spawn",resolve);child.once("error",reject);}); child.unref(); } |
| 113 | finally { fs.closeSync(log); } |
| 114 | } |
| 115 | |
| 116 | if(process.argv[1]===fileURLToPath(import.meta.url)&&process.argv[2]==="--apply") { |
| 117 | const [source,destination,owner,launcher]=process.argv.slice(3); |
| 118 | let result; |
| 119 | try { |
| 120 | verifyReleaseBundle(source); |
| 121 | process.kill(Number(owner),"SIGTERM"); |
| 122 | for(let i=0;i<100;i++) { try { process.kill(Number(owner),0); } catch { break; } await new Promise(resolve=>setTimeout(resolve,100)); } |
| 123 | try { process.kill(Number(owner),0); throw new Error("The running helper did not stop; update cancelled."); } catch(error) { if(error.code!=="ESRCH") throw error; } |
| 124 | // LaunchServices must not send Reopen to the retiring menu-bar process. |
| 125 | for(let i=0;i<100;i++) { try { process.kill(Number(launcher),0); } catch { break; } await new Promise(resolve=>setTimeout(resolve,100)); } |
| 126 | try { process.kill(Number(launcher),0); throw new Error("The menu-bar app did not exit; update cancelled."); } catch(error) { if(error.code!=="ESRCH") throw error; } |
| 127 | const receipt=replaceMacBundle(source,destination,{verify:verifyReleaseBundle}); |
| 128 | const installed=spawnSync("/usr/libexec/PlistBuddy",["-c","Print :CFBundleShortVersionString",path.join(destination,"Contents","Info.plist")],{encoding:"utf8"}); |
| 129 | if(installed.status!==0) throw new Error("The installed version could not be read."); |
| 130 | console.log(JSON.stringify({version:installed.stdout.trim(),...receipt,installedAt:new Date().toISOString()})); |
| 131 | result={ok:true,message:`Updated to ${installed.stdout.trim()}. Choose Allow new sessions when you are ready.`}; |
| 132 | } catch(error) { |
| 133 | console.error(error.message); process.exitCode=1; |
| 134 | result={ok:false,message:`The update could not be completed: ${String(error.message).slice(0,600)} Computer sessions remain stopped.`}; |
| 135 | } finally { |
| 136 | // The apply process outlives the menu app. Carry its result into the next |
| 137 | // launch so a failed install is visible without hunting for update.log. |
| 138 | try { |
| 139 | fs.mkdirSync(stateDir(),{recursive:true}); |
| 140 | const temporary=`${updateResultPath()}.${process.pid}.tmp`; |
| 141 | fs.writeFileSync(temporary,JSON.stringify({...result,completedAt:new Date().toISOString()})+"\n",{mode:0o600}); |
| 142 | fs.renameSync(temporary,updateResultPath()); |
| 143 | } catch(error) { console.error(`Could not save the update result: ${error.message}`); } |
| 144 | if(destination&&fs.existsSync(destination)) spawnSync("open",["-g","-a",destination]); |
| 145 | } |
| 146 | } |
| 147 |