refactor: share managed binary installation

Author: navedmerchant

src/core/tools/ExecuteCommandTool.ts

@@ -142,6 +142,9 @@ export class ExecuteCommandTool extends BaseTool<"execute_command"> {
 				// Resolve through the managed installer on use so an extension update
 				// automatically installs the newly pinned and verified DCG version.
 				const binaryPath = await ensureDcgInstalled(provider.context.globalStorageUri.fsPath)
+				if (!binaryPath) {
+					throw new Error(t("common:errors.destructiveCommandGuard.unavailable"))
+				}
 				const workingDirectory = customCwd
 					? path.isAbsolute(customCwd)
 						? customCwd

src/core/tools/__tests__/executeCommandTool.spec.ts

@@ -308,6 +308,30 @@ describe("executeCommandTool", () => {
 			expect(executeCommandModule.executeCommandInTerminal).not.toHaveBeenCalled()
 		})
 
+		it("fails closed when DCG is unavailable for the current platform", async () => {
+			const provider = await mockCline.providerRef.deref()
+			provider.context = { globalStorageUri: { fsPath: "/test/storage" } }
+			provider.getState.mockResolvedValue({
+				destructiveCommandGuardEnabled: true,
+				terminalShellIntegrationDisabled: true,
+			})
+			mockEnsureDcgInstalled.mockResolvedValue(undefined)
+
+			await executeCommandTool.handle(mockCline as unknown as Task, mockToolUse, {
+				askApproval: mockAskApproval as unknown as AskApproval,
+				handleError: mockHandleError as unknown as HandleError,
+				pushToolResult: mockPushToolResult as unknown as PushToolResult,
+			})
+
+			expect(mockHandleError).toHaveBeenCalledWith(
+				"executing command",
+				expect.objectContaining({ message: "errors.destructiveCommandGuard.unavailable" }),
+			)
+			expect(mockRunDcg).not.toHaveBeenCalled()
+			expect(mockAskApproval).not.toHaveBeenCalled()
+			expect(executeCommandModule.executeCommandInTerminal).not.toHaveBeenCalled()
+		})
+
 		it("should handle missing command parameter", async () => {
 			// Setup
 			mockToolUse.params.command = undefined

src/core/webview/__tests__/webviewMessageHandler.spec.ts

@@ -1134,6 +1134,23 @@ describe("webviewMessageHandler - destructiveCommandGuardEnabled", () => {
 		)
 	})
 
+	it("disables the setting when DCG is unavailable for the current platform", async () => {
+		vi.mocked(ensureDcgInstalled).mockResolvedValue(undefined)
+
+		await webviewMessageHandler(mockClineProvider, {
+			type: "updateSettings",
+			updatedSettings: { destructiveCommandGuardEnabled: true },
+		})
+
+		expect(mockClineProvider.contextProxy.setValue).toHaveBeenCalledWith("destructiveCommandGuardEnabled", false)
+		expect(t).toHaveBeenCalledWith("common:errors.destructive_command_guard_enable_failed", {
+			error: "common:errors.destructiveCommandGuard.unavailable",
+		})
+		expect(vscode.window.showErrorMessage).toHaveBeenCalledWith(
+			"common:errors.destructive_command_guard_enable_failed",
+		)
+	})
+
 	it("reports non-Error installation failures", async () => {
 		vi.mocked(ensureDcgInstalled).mockRejectedValue("download unavailable")
 

src/core/webview/webviewMessageHandler.ts

@@ -684,7 +684,10 @@ export const webviewMessageHandler = async (
 				if (message.updatedSettings.destructiveCommandGuardEnabled === true) {
 					try {
 						const { ensureDcgInstalled } = await import("../../services/destructive-command-guard")
-						await ensureDcgInstalled(provider.context.globalStorageUri.fsPath)
+						const binaryPath = await ensureDcgInstalled(provider.context.globalStorageUri.fsPath)
+						if (!binaryPath) {
+							throw new Error(t("common:errors.destructiveCommandGuard.unavailable"))
+						}
 					} catch (error) {
 						message.updatedSettings.destructiveCommandGuardEnabled = false
 						vscode.window.showErrorMessage(

src/eslint-suppressions.json

@@ -1499,11 +1499,6 @@
 			"count": 3
 		}
 	},
-	"services/code-index/semble/semble-downloader.ts": {
-		"@typescript-eslint/no-explicit-any": {
-			"count": 1
-		}
-	},
 	"services/code-index/shared/__tests__/validation-helpers.spec.ts": {
 		"@typescript-eslint/no-explicit-any": {
 			"count": 4

src/services/code-index/semble/__tests__/semble-downloader.spec.ts

@@ -263,12 +263,14 @@ describe("semble-downloader", () => {
 				)
 				// Version file should be written
 				expect(fs.writeFile).toHaveBeenCalledWith(
-					path.join("/storage", "semble", ".semble-version"),
+					path.join("/storage", "semble.new", ".semble-version"),
 					"v0.4.1",
 					"utf-8",
 				)
 				// Archive should be cleaned up (version-prefixed local cache path)
-				expect(fs.unlink).toHaveBeenCalledWith(path.join("/storage", "v0.4.1-semble-linux-x64-fast.tar.gz"))
+				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "v0.4.1-semble-linux-x64-fast.tar.gz"), {
+					force: true,
+				})
 			} finally {
 				if (originalPlatform) Object.defineProperty(process, "platform", originalPlatform)
 				if (originalArch) Object.defineProperty(process, "arch", originalArch)
@@ -325,7 +327,9 @@ describe("semble-downloader", () => {
 
 			try {
 				await expect(downloadSemble("/storage")).rejects.toThrow("Failed to download semble")
-				expect(fs.unlink).toHaveBeenCalledWith(path.join("/storage", "v0.4.1-semble-linux-arm64-fast.tar.gz"))
+				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "v0.4.1-semble-linux-arm64-fast.tar.gz"), {
+					force: true,
+				})
 				// Should clean up staging directory, not the original
 				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "semble.new"), {
 					recursive: true,
@@ -589,7 +593,7 @@ describe("semble-downloader", () => {
 			})
 
 			// Archive cleanup fails but should not throw (only archive removal after extraction)
-			;(fs.unlink as any).mockRejectedValue(new Error("unlink cleanup failed"))
+			;(fs.rm as any).mockRejectedValueOnce(new Error("archive cleanup failed"))
 
 			try {
 				const result = await downloadSemble("/storage")
@@ -641,7 +645,7 @@ describe("semble-downloader", () => {
 				expect(https.get).toHaveBeenCalledWith(expect.stringContaining("v0.4.1"), expect.any(Function))
 				// Should write the new version file
 				expect(fs.writeFile).toHaveBeenCalledWith(
-					path.join("/storage", "semble", ".semble-version"),
+					path.join("/storage", "semble.new", ".semble-version"),
 					"v0.4.1",
 					"utf-8",
 				)
@@ -700,19 +704,23 @@ describe("semble-downloader", () => {
 				)
 				// The stale archive is removed before the fresh download to guarantee
 				// a clean package is verified against the new checksum.
-				expect(fs.unlink).toHaveBeenCalledWith(versionedArchive)
+				expect(fs.rm).toHaveBeenCalledWith(versionedArchive, { force: true })
 				// The prior-version archive (v0.4.0-*) is swept by cleanupStaleArchives
 				// after a successful install, so a version upgrade doesn't accumulate
 				// orphaned packages on disk.
-				expect(fs.unlink).toHaveBeenCalledWith(path.join("/storage", "v0.4.0-semble-linux-x64-fast.tar.gz"))
+				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "v0.4.0-semble-linux-x64-fast.tar.gz"), {
+					force: true,
+				})
 				// The legacy unversioned archive (pre-v0.4.0 cache layout) is also
 				// swept, covering the v0.3.1 → v0.4.1 upgrade path.
-				expect(fs.unlink).toHaveBeenCalledWith(path.join("/storage", "semble-linux-x64-fast.tar.gz"))
+				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "semble-linux-x64-fast.tar.gz"), {
+					force: true,
+				})
 				// Unrelated files in the storage dir must not be touched.
 				expect(fs.unlink).not.toHaveBeenCalledWith(path.join("/storage", "unrelated-file.txt"))
 				// The new version file is recorded
 				expect(fs.writeFile).toHaveBeenCalledWith(
-					path.join("/storage", "semble", ".semble-version"),
+					path.join("/storage", "semble.new", ".semble-version"),
 					"v0.4.1",
 					"utf-8",
 				)
@@ -789,7 +797,7 @@ describe("semble-downloader", () => {
 				)
 				// Should write version file again
 				expect(fs.writeFile).toHaveBeenCalledWith(
-					path.join("/storage", "semble", ".semble-version"),
+					path.join("/storage", "semble.new", ".semble-version"),
 					"v0.4.1",
 					"utf-8",
 				)
@@ -831,7 +839,7 @@ describe("semble-downloader", () => {
 				)
 				// Should write version file
 				expect(fs.writeFile).toHaveBeenCalledWith(
-					path.join("/storage", "semble", ".semble-version"),
+					path.join("/storage", "semble.new", ".semble-version"),
 					"v0.4.1",
 					"utf-8",
 				)
@@ -903,8 +911,12 @@ describe("semble-downloader", () => {
 
 				const currentArchive = path.join("/storage", "v0.4.1-semble-linux-x64-fast.tar.gz")
 				// Stale versioned + legacy unversioned archives are swept
-				expect(fs.unlink).toHaveBeenCalledWith(path.join("/storage", "v0.4.0-semble-linux-x64-fast.tar.gz"))
-				expect(fs.unlink).toHaveBeenCalledWith(path.join("/storage", "semble-linux-x64-fast.tar.gz"))
+				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "v0.4.0-semble-linux-x64-fast.tar.gz"), {
+					force: true,
+				})
+				expect(fs.rm).toHaveBeenCalledWith(path.join("/storage", "semble-linux-x64-fast.tar.gz"), {
+					force: true,
+				})
 				// The current archive is never swept by cleanupStaleArchives (it is
 				// excluded by the currentArchivePath guard). It is unlinked only by
 				// the pre-download partial-archive cleanup and the post-install
@@ -913,8 +925,8 @@ describe("semble-downloader", () => {
 				// Sanity: the current archive path is never passed to the stale sweep.
 				// It is unlinked exactly twice (pre-download cleanup + post-install
 				// archive cleanup), never via cleanupStaleArchives.
-				const currentUnlinks = (fs.unlink as any).mock.calls.filter((c: any[]) => c[0] === currentArchive)
-				expect(currentUnlinks.length).toBe(2)
+				const currentRemovals = (fs.rm as any).mock.calls.filter((c: any[]) => c[0] === currentArchive)
+				expect(currentRemovals.length).toBe(2)
 			} finally {
 				if (originalPlatform) Object.defineProperty(process, "platform", originalPlatform)
 				if (originalArch) Object.defineProperty(process, "arch", originalArch)