pray-cli 1.10.0 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d3cea2d193f4cf496417c5098ad4ff57b0a4b55bc7ee26664f72293c2fcbd06
-  data.tar.gz: 89d8dc8a3c5c65062531e175587d3f86f27ca9630679dac925593be231062e8c
+  metadata.gz: cce969add8d5bb73ee6fc4b9910d785a0565e24afaeb6d4b80d9383f9fbe828b
+  data.tar.gz: f96cac68f4cf12079056d0ef300c57ab0efa47f3c9ab1e9967a9fe03cb8a5c37
 SHA512:
-  metadata.gz: aa2d115c1300f177cd4c9dc8c8e4ab2802baf700be3b7124a644f6889ba4138cafe3a6be16d37005f5c2aba95b803740084139171466ebf7ba126e22f82e7d9c
-  data.tar.gz: 1d0c8da737a56bcb21ad6798f6cf59c3fd6ad3384e2d423bb492b37ddf42ccb2c6231b6afebf2b2fc9dc8b7a44e748dd505910a0ceb6835b87006870ae3e68d9
+  metadata.gz: a0ec1da337a61097a65ebd7dc091879a978bbb1f13d6eba41ee4149735e8d37b3d32a7634e5b79fbc426e7ef068cf49ac5437c71b9492fe09f5ab439b1c5645b
+  data.tar.gz: 0ea56f7dd07ddf9be173bc0dd3ed399b91d280c36aaea1f703d0a60b9676dba15398cef53c876f71b3c86347611b9dd5f10af6d716152a69e4bf488d7b82996c

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # CHANGELOG
 
+## Unreleased
+
+## 1.11.0 (2026-09-04)
+
+- Read the whole eight byte tar checksum field so `.praypkg` archives whose checksum is written as seven octal digits unpack instead of failing integrity.
+- Share the source-keyed registry cache path with the Rust and TypeScript CLIs.
+- Add `pray clean --unused` for lockfile-driven registry cache cleanup.
+- Reject unsafe registry package and version path segments.
+
 ## 1.10.0 (2026-09-02)
 
 - Refuse to overwrite exclusive `file:` and `tree:` destinations that already exist with other bytes.

data/lib/pray/cache_clean.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "fileutils"
+
+module Pray
+  module CacheClean
+    module_function
+
+    def clean_unused_registry_cache(project_root)
+      lockfile = Pray.read_lockfile(File.join(project_root, "Prayfile.lock"))
+      validate_lockfile_for_cleanup!(lockfile)
+      registry_root = File.expand_path(".pray/cache/registry", project_root)
+      retained = lockfile.package.filter_map do |package|
+        package_path = File.expand_path(package.path, project_root)
+        package_path if PathSafety.path_under_root?(registry_root, package_path)
+      end
+
+      begin
+        metadata = File.lstat(registry_root)
+      rescue Errno::ENOENT
+        return
+      end
+      if metadata.symlink? || !metadata.directory?
+        remove_path(registry_root)
+        return
+      end
+      prune_directory(registry_root, retained, remove_when_empty: false)
+    end
+
+    def validate_lockfile_for_cleanup!(lockfile)
+      validate_sha256_digest!("manifest_hash", lockfile.manifest_hash)
+      lockfile.package.each do |package|
+        if !package.path.is_a?(String) || package.path.empty?
+          raise Error.parse("lockfile", "package path must not be empty")
+        end
+        validate_sha256_digest!("package tree_hash", package.tree_hash)
+        validate_sha256_digest!("package artifact_hash", package.artifact_hash)
+      end
+    end
+
+    def validate_sha256_digest!(field, value)
+      digest = value.to_s.delete_prefix("sha256:")
+      return if value.is_a?(String) && value.start_with?("sha256:") && digest.match?(/\A[0-9a-f]{64}\z/)
+
+      raise Error.parse("lockfile", "#{field} must be a sha256 digest")
+    end
+
+    def prune_directory(path, retained, remove_when_empty:)
+      Dir.each_child(path) do |name|
+        entry = File.join(path, name)
+        protects_entry = retained.include?(entry)
+        leads_to_retained = retained.any? { |kept| PathSafety.path_under_root?(entry, kept) }
+        next if protects_entry
+
+        metadata = File.lstat(entry)
+        if leads_to_retained && metadata.directory? && !metadata.symlink?
+          prune_directory(entry, retained, remove_when_empty: true)
+        else
+          remove_path(entry)
+        end
+      end
+      Dir.rmdir(path) if remove_when_empty && Dir.empty?(path)
+    end
+
+    def remove_path(path)
+      metadata = File.lstat(path)
+      if metadata.directory? && !metadata.symlink?
+        FileUtils.rm_rf(path)
+      else
+        File.unlink(path)
+      end
+    rescue Errno::ENOENT
+      nil
+    end
+  end
+end

data/lib/pray/cli/commands/meta.rb

@@ -6,10 +6,15 @@ module Pray
       puts "pray #{Pray::VERSION}"
     end
 
-    def clean_command
-      remove_path_if_exists(".pray/cache")
-      remove_path_if_exists(".pray/vendor")
-      remove_path_if_exists(".pray/state.json")
+    def clean_command(unused: false)
+      project_root = Invocation.project_root
+      if unused
+        CacheClean.clean_unused_registry_cache(project_root)
+        return
+      end
+      remove_path_if_exists(File.join(project_root, ".pray/cache"))
+      remove_path_if_exists(File.join(project_root, ".pray/vendor"))
+      remove_path_if_exists(File.join(project_root, ".pray/state.json"))
     end
   end
 end

data/lib/pray/cli/help.rb

@@ -117,7 +117,7 @@ module Pray
         "remove" => "remove a package from Prayfile\n\nUsage: pray remove <name>",
         "unlock" => "clear a locked package pin\n\nUsage: pray unlock <package>",
         "vendor" => "copy resolved packages locally\n\nUsage: pray vendor",
-        "clean" => "remove local cache and vendor trees\n\nUsage: pray clean",
+        "clean" => "remove local cache and vendor trees, or only unused registry entries\n\nUsage: pray clean [--unused]",
         "publish" => <<~TEXT.strip,
           upload packages to a registry or local root
 

data/lib/pray/cli/parse.rb

@@ -67,7 +67,7 @@ module Pray
       when "outdated" then [:outdated, arguments]
       when "explain" then [:explain, arguments.shift]
       when "vendor" then [:vendor]
-      when "clean" then [:clean]
+      when "clean" then [:clean, parse_clean_arguments(arguments, flags)]
       when "tree" then [:tree]
       when "sync" then [:sync, parse_sync_arguments(arguments)]
       when "trust" then parse_trust_command(arguments)
@@ -83,6 +83,24 @@ module Pray
       found
     end
 
+    def parse_clean_arguments(arguments, flags)
+      if flags.values_at(:check, :strict, :semantic, :locked, :frozen, :offline).any?
+        raise Error.unsupported("unknown clean flag")
+      end
+
+      unused = false
+      arguments.each do |argument|
+        if argument == "--unused" && !unused
+          unused = true
+        elsif argument.start_with?("--")
+          raise Error.unsupported("unknown clean flag: #{argument}")
+        else
+          raise Error.unsupported("unexpected clean argument: #{argument}")
+        end
+      end
+      {unused: unused}
+    end
+
     def parse_add_arguments(arguments)
       name = arguments.shift
       raise Error.unsupported("add requires a package name") unless name

data/lib/pray/cli.rb

@@ -3,6 +3,7 @@
 require "fileutils"
 
 require_relative "invocation"
+require_relative "cache_clean"
 require_relative "cli/parse"
 require_relative "cli/help"
 require_relative "cli/suggest"
@@ -97,7 +98,7 @@ module Pray
       in [:outdated, arguments] then outdated_command(arguments)
       in [:explain, name] then explain_command(name)
       in [:vendor] then raise Error.unsupported("vendor is not implemented yet in pray-cli Ruby")
-      in [:clean] then clean_command
+      in [:clean, options] then clean_command(**options)
       in [:tree] then tree_command
       in [:trust_list, options] then trust_list_command(**options)
       in [:trust_show] then trust_show_command

data/lib/pray/path_safety.rb

@@ -80,5 +80,25 @@ module Pray
 
       validate_project_relative_path!(value)
     end
+
+    def validate_registry_cache_identity!(package_name, version)
+      namespace, name, extra_segment = package_name.to_s.split("/", -1)
+      unless extra_segment.nil? && registry_cache_segment_safe?(namespace) && registry_cache_segment_safe?(name)
+        raise Error.integrity("invalid registry package name: #{package_name}")
+      end
+      unless registry_cache_segment_safe?(version)
+        raise Error.integrity("invalid registry package version: #{version}")
+      end
+
+      [namespace, name]
+    end
+
+    def registry_cache_segment_safe?(value)
+      value.is_a?(String) &&
+        !value.empty? &&
+        ![".", ".."].include?(value) &&
+        !value.match?(%r{[/\\\0]})
+    end
+    private_class_method :registry_cache_segment_safe?
   end
 end

data/lib/pray/registry.rb

@@ -47,8 +47,7 @@ module Pray
         project_root,
         source_url,
         declaration.name,
-        selected.version,
-        selected.artifact_hash
+        selected.version
       )
 
       if cache_ready?(cache_directory, selected)
@@ -91,8 +90,7 @@ module Pray
         project_root,
         source_key,
         declaration.name,
-        selected.version,
-        selected.artifact_hash
+        selected.version
       )
 
       if cache_ready?(cache_directory, selected)
@@ -238,15 +236,10 @@ module Pray
       )
     end
 
-    def registry_cache_directory(project_root, source_key, package_name, version, artifact_hash)
-      identifier = [
-        source_key,
-        package_name,
-        version,
-        artifact_hash || "no-artifact-hash"
-      ].join(":")
-      digest = Hashing.sha256_hex(identifier)[0, 16]
-      File.join(project_root, ".pray", "cache", "registry", package_name.tr("/", "-"), version, digest)
+    def registry_cache_directory(project_root, source_key, package_name, version)
+      namespace, name = PathSafety.validate_registry_cache_identity!(package_name, version)
+      source_hash = Hashing.sha256_hex(source_key)[0, 16]
+      File.join(project_root, ".pray", "cache", "registry", namespace, name, version, source_hash)
     end
 
     def offline_package_error(package_name, version)

data/lib/pray/tar_validation.rb

@@ -102,7 +102,10 @@ module Pray
     end
 
     def verify_checksum!(header)
-      stored = parse_octal(header.byteslice(148, 6), "checksum")
+      # The checksum field is eight bytes. Writers fill it differently: six octal
+      # digits then NUL and space, seven digits then NUL, or space padding. Read the
+      # whole field and let parse_octal strip the terminator.
+      stored = parse_octal(header.byteslice(148, 8), "checksum")
       sum = 0
       header.bytes.each_with_index do |byte, index|
         sum += (index >= 148 && index < 156) ? 32 : byte

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.10.0"
-  GENERATED_BY = "pray 1.10.0"
+  VERSION = "1.11.0"
+  GENERATED_BY = "pray 1.11.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.10.0
+  version: 1.11.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -99,6 +99,7 @@ files:
 - lib/pray/archive.rb
 - lib/pray/archive_unpack.rb
 - lib/pray/auth_client.rb
+- lib/pray/cache_clean.rb
 - lib/pray/cli.rb
 - lib/pray/cli/commands/auth.rb
 - lib/pray/cli/commands/distribution.rb