From 95d199c2f2aa8731148a091c0d0fb96ccefa59b4 Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Mon, 7 Sep 2026 22:28:55 +0200
Subject: [PATCH] fix(theseus/addons): windows-tar fixes for the addon updater,
 verified end-to-end
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An end-to-end drive of the update flow against a local HTTP server hit
two Windows-only tar quirks that a first-cut MVP wouldn't catch:

1. Git-Bash tar (MSYS2), which comes first on PATH when Git-for-Windows
   is installed, treats drive-letter paths as `host:file` remote-archive
   syntax. Sidestepped with --force-local (also silently accepted by
   Win10's built-in bsdtar and by GNU tar).

2. Even with --force-local, MSYS2's argv-conversion layer mangles
   backslashes in Windows paths, so `C:\Users\...\tmp\dir` arrives at
   tar as `C:\Users...\dir` and it can't open the path. Passing
   forward-slash paths (`C:/Users/.../tmp/dir`) dodges the mangler;
   bsdtar and GNU tar accept them as-is.

3. sign-addon-update.mjs was tar'ing the addon directory as a subfolder
   (`screenshot/addon.json` inside the archive), so the client
   extracted to `<tmp>/screenshot/` and then failed the id+version
   re-check because addon.json wasn't at the root. Now the signer
   tars the CONTENTS of the addon dir via `tar -C <addon-dir> .`, so
   entries live at the archive root where the client expects them.

All three surfaced from `scratchpad/decoupling-test/run-test.mjs`, which
now walks the full path — sign, serve, fetch, verify, download,
extract, stage, promote, backup — plus three signature-tamper negatives
and the empty-pubkey short-circuit. 15/15 checks pass.
---
 addon-updater.js              | 11 ++++++++++-
 scripts/sign-addon-update.mjs | 13 +++++++++----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/addon-updater.js b/addon-updater.js
index 36de880..12c4bad 100644
--- a/addon-updater.js
+++ b/addon-updater.js
@@ -189,7 +189,16 @@ async function stageOne({ id, currentVer, updateURL, stagedDir, pubkeysHex, log,
     await fsp.mkdir(tmpDir, { recursive: true });
     // Refuses `..` entries by default in modern tar. -P NOT passed = paths
     // stay stripped/relative.
-    execFileSync("tar", ["-x", "-z", "-f", tmpFile, "-C", tmpDir], { stdio: "ignore" });
+    // Two Windows tar quirks we sidestep with one small trick:
+    //   1. Git-Bash tar (MSYS2) sees drive letters as host:file remote syntax
+    //      without --force-local.
+    //   2. Even with --force-local, MSYS2's argument-conversion layer mangles
+    //      backslashes it doesn't understand, so `C:\Users\...\Temp\dir`
+    //      arrives at tar as `C:\\Users...\\dir` and it can't open the path.
+    // Forward-slash paths dodge both — bsdtar (Win10 built-in), GNU tar,
+    // and MSYS2 tar all accept `C:/Users/...` as a plain path.
+    const posix = (p) => p.replace(/\\/g, "/");
+    execFileSync("tar", ["--force-local", "-x", "-z", "-f", posix(tmpFile), "-C", posix(tmpDir)], { stdio: "ignore" });
   } catch (e) {
     log(`updates: extract ${id}@${best.version} failed:`, e.message);
     try { fs.rmSync(tmpFile, { force: true }); } catch {}
diff --git a/scripts/sign-addon-update.mjs b/scripts/sign-addon-update.mjs
index c04c60f..12d2b2a 100644
--- a/scripts/sign-addon-update.mjs
+++ b/scripts/sign-addon-update.mjs
@@ -55,11 +55,16 @@ fs.mkdirSync(outDir, { recursive: true });
 const tarName = `${id}-${version}.tar.gz`;
 const tarPath = path.join(outDir, tarName);
 
-// Tar the addon folder from its parent so archived paths are addon-relative.
-const parent = path.dirname(path.resolve(addonDir));
-const folder = path.basename(path.resolve(addonDir));
+// Tar the CONTENTS of the addon folder (not the folder itself) so entries
+// live at the archive root: `addon.json`, `editor.html`, etc. The client
+// extracts into a fresh dir and expects to find addon.json directly there.
 try {
-  execFileSync("tar", ["-c", "-z", "-f", tarPath, "-C", parent, folder], { stdio: "inherit" });
+  // On Windows, Git-Bash tar (MSYS2) both mistakes drive letters for
+  // host:file remote-archive syntax AND mangles backslashes on its way to
+  // tar's argv. --force-local kills the first, forward-slash paths kill
+  // the second. Win10 built-in bsdtar and GNU tar both accept the flag.
+  const posix = (p) => p.replace(/\\/g, "/");
+  execFileSync("tar", ["--force-local", "-c", "-z", "-f", posix(tarPath), "-C", posix(path.resolve(addonDir)), "."], { stdio: "inherit" });
 } catch (e) { die(`tar failed: ${e.message}`); }
 
 const tarBytes = fs.readFileSync(tarPath);