Keep stale version check within existing store flow

docs/framey-loader.md

@@ -103,7 +103,10 @@ The store verifies each downloaded archive and the headset applies it with a
 rollback if Decky cannot start. The panel remembers the current job ID for this
 browser session, so **Check result** can resume polling after a navigation or
 temporary connection error. Refresh the installed list before starting another
-operation after an error. If Frame Control restarts, it cannot recover the old
+operation after an error. The headset panel and desktop app send the hash of
+the version you saw; if the official store changes that version before the job
+starts, Frame Control stops before downloading or changing the headset. Refresh
+the store and review the new version before retrying. If Frame Control restarts, it cannot recover the old
 job result. The panel clears that job ID and asks you to refresh the installed
 list before making another change.
 

tests/e2e/test_framey.py

@@ -142,6 +142,11 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
         self.assertFalse(job.get('error'), job)
         self.assertEqual(ok('POST', '/api/framey/method',
                             {'id':999,'method':'get_setting','args':['theme','dark']})['result'], 'light')
+        stale = finished(ok('POST', '/api/decky/plugin',
+                            {'action':'update','id':999,'sha256':HASHES[0],
+                             'acknowledged':True}))
+        self.assertIn('version changed', stale.get('error', ''))
+        self.assertEqual(ok('GET', '/api/decky')['plugins'][0]['version'], '1.1.0')
 
     def test_pinned_official_api_v1_and_v2_plugins_install_and_remove(self):
         self.backend()

tests/page/framey_store.mjs

@@ -48,14 +48,14 @@ el('deckySearch').value='no matching plugin'; el('deckySearch').oninput();
 assert.equal(el('deckyStoreList').textContent,'No plugins match this search.');
 
 // The page polls the actual job endpoint and keeps a separate visible result.
-ctx.mockApi=async path => {
-  if(path==='/api/decky/plugin')return {job:'job-1'};
+ctx.mockApi=async (path,body) => {
+  if(path==='/api/decky/plugin'){assert.equal(body.sha256,'a'.repeat(64));return {job:'job-1'};}
   if(path.startsWith('/api/job'))return {done:true,message:'Installed Plugin 2'};
   if(path==='/api/decky')return {running:true,plugins:[{storeId:2,name:'Plugin 2',version:'1.0'}]};
   throw Error(`unexpected ${path}`);
 };
 vm.runInContext('api=mockApi',ctx);
-await vm.runInContext('deckyChange("install",{id:2,name:"Plugin 2"})',ctx);
+await vm.runInContext('deckyChange("install",{id:2,name:"Plugin 2",sha256:"a".repeat(64)})',ctx);
 assert.equal(el('deckyJobStatus').textContent,'Installed Plugin 2');
 assert.equal(el('deckyJobProgress').value,100);
 assert.equal(el('deckyJobCheck').hidden,true);
@@ -70,14 +70,14 @@ assert.equal(el('deckyInstalled').children[0].children[2].disabled,false);
 el('deckySearch').value='';el('deckyStoreFilter').value='all';
 vm.runInContext('showDeckyStore()',ctx);
 assert.equal(el('deckyStoreList').children[1].children[1].disabled,true);
-ctx.mockApi=async path => {
-  if(path==='/api/decky/plugin')return {job:'job-2'};
+ctx.mockApi=async (path,body) => {
+  if(path==='/api/decky/plugin'){assert.equal(body.sha256,'b'.repeat(64));return {job:'job-2'};}
   if(path.startsWith('/api/job'))return {done:true,error:'archive digest mismatch'};
   if(path==='/api/decky')return {running:true,plugins:[]};
   throw Error(`unexpected ${path}`);
 };
 vm.runInContext('api=mockApi',ctx);
-await vm.runInContext('deckyChange("update",{id:2,name:"Plugin 2"})',ctx);
+await vm.runInContext('deckyChange("update",{id:2,name:"Plugin 2",sha256:"b".repeat(64)})',ctx);
 assert.match(el('deckyJobStatus').textContent,/Error: archive digest mismatch/);
 assert.equal(session.has('frameyPluginJob'),false);
 

tests/test_frame_decky_store.py

@@ -183,6 +183,18 @@ class StoreTransaction(unittest.TestCase):
 
 
 class StoreHost(unittest.TestCase):
+    def test_reviewed_archive_changed_before_install_does_not_download(self):
+        state = {'managed': True, 'running': True, 'plugins': []}
+        catalog = [{'id': 42, 'name': 'Example', 'root': False,
+                    'sha256': 'b' * 64, 'version': '2.0'}]
+        with patch.object(frame_decky_store.frame_decky, 'status', return_value=state), \
+             patch.object(frame_decky_store, 'catalog', return_value=catalog), \
+             patch.object(frame_decky_store.urllib.request, 'urlopen',
+                          side_effect=AssertionError('No download expected')):
+            with self.assertRaisesRegex(ValueError, 'version changed'):
+                frame_decky_store.change(lambda *args, **kwargs: self.fail('No headset write expected'),
+                                         'install', 42, reviewed_hash='a' * 64)
+
     def test_stopped_managed_service_allows_removing_owned_plugin(self):
         state = {'managed': True, 'running': False, 'plugins':
                  [{'storeId': 42, 'folder': 'Example', 'name': 'Example', 'version': '1.0'}]}

ui/frame_decky_store.py

@@ -193,9 +193,12 @@ finally:
 '''
 
 
-def change(ssh, action, plugin_id, report=lambda stage, percent=None: None):
+def change(ssh, action, plugin_id, report=lambda stage, percent=None: None, reviewed_hash=None):
     if action not in ('install', 'update', 'remove') or type(plugin_id) is not int or plugin_id <= 0:
         raise ValueError('Choose a valid store plugin action')
+    if reviewed_hash is not None and (action == 'remove' or not isinstance(reviewed_hash, str)
+                                      or not SHA.fullmatch(reviewed_hash)):
+        raise ValueError('Invalid reviewed store version')
     report('Checking installed plugins', 5)
     state = frame_decky.status(ssh)
     if not state['managed']:
@@ -215,6 +218,8 @@ def change(ssh, action, plugin_id, report=lambda stage, percent=None: None):
         plugin = next((item for item in catalog() if item['id'] == plugin_id), None)
         if not plugin:
             raise ValueError('Plugin is not in the official Decky store')
+        if reviewed_hash is not None and plugin['sha256'] != reviewed_hash:
+            raise ValueError('The official store version changed; refresh the store and review it again')
         if plugin['root']:
             raise ValueError('Root plugins are not supported by the Frame user service')
         existing_name = [p for p in state['plugins'] if p.get('name') == plugin['name']]

ui/headset.html

@@ -169,7 +169,8 @@ async function followDeckyJob(job,action,name){
 async function deckyChange(action,plugin){if(deckyBusy||!confirm(`${action} ${plugin.name}? Store plugins run code as your Frame user.`))return;
   deckyBusy=true;showDeckyStore();
   deckyJobView(`${action} ${plugin.name}`,'Starting…',0);
-  try{const started=await api('/api/decky/plugin',{action,id:plugin.id,acknowledged:true});
+  try{const started=await api('/api/decky/plugin',{action,id:plugin.id,
+    sha256:action==='remove'?undefined:plugin.sha256,acknowledged:true});
     if(!started.job)throw Error('The server did not return a job ID');
     sessionStorage.setItem('frameyPluginJob',JSON.stringify({job:started.job,action,name:plugin.name}));
     await followDeckyJob(started.job,action,plugin.name);
@@ -191,7 +192,7 @@ function openFrameyPanel(id,name){
   byId('frameyFrame').src=`/framey/panel/${id}#${frameySession}`;
   byId('frameyPanel').hidden=false;byId('frameyPanel').scrollIntoView();
   setTimeout(()=>{if(activeFrameyId===id&&byId('frameyPanelStatus').textContent==='Loading plugin panel…')
-    byId('frameyPanelStatus').textContent='No compatible API v2 panel loaded. This plugin may need Steam UI features Framey cannot provide.';},12000);
+    byId('frameyPanelStatus').textContent='No compatible panel loaded. This plugin may need Steam UI features Framey cannot provide.';},12000);
 }
 byId('frameyClose').onclick=()=>{activeFrameyId=null;frameySession=null;byId('frameyFrame').removeAttribute('src');byId('frameyPanel').hidden=true;};
 function frameyCacheKey(id){return `framey-plugin-cache-v1:${id}`;}

ui/index.html

@@ -2244,7 +2244,8 @@ function showDeckyStore() {
 }
 async function changeDeckyPlugin(action, plugin) {
   if (!$('deckyAck').checked || !confirm(`${action} ${plugin.name}? This official store plugin runs code as your Frame user.`)) return;
-  try { await runJob(`${action} ${plugin.name}`, 'decky-plugin', () => api('/api/decky/plugin', {action,id:plugin.id,acknowledged:true}));
+  try { await runJob(`${action} ${plugin.name}`, 'decky-plugin', () => api('/api/decky/plugin',
+    {action,id:plugin.id,sha256:action==='remove'?undefined:plugin.sha256,acknowledged:true}));
     await loadDecky(); showDeckyStore(); } catch(error) { $('deckyStoreState').textContent=error.message; }
 }
 function deckyButtons() {

ui/server.py

@@ -571,8 +571,10 @@ def decky_plugin(body):
         raise Failure('Choose an official store plugin and action', 400)
     if body.get('acknowledged') is not True:
         raise Failure('Confirm that store plugins run code as your Frame user', 400)
+    reviewed_hash = body.get('sha256')
     return start_job('Decky plugin ' + action,
-                     lambda report: frame_decky_store.change(ssh, action, plugin_id, report), progress=True)
+                     lambda report: frame_decky_store.change(ssh, action, plugin_id, report,
+                                                            reviewed_hash=reviewed_hash), progress=True)
 
 
 def framey_method_action(body):