pray-cli 1.21.0 → 1.23.0

data/lib/pray/package_spec_paths.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require_relative "path_safety"
+
+module Pray
+  class PackageSpec
+    def validate_relative_paths!
+      files.each { |file| PathSafety.validate_archive_member_path!(file) }
+      exports.each_value do |export|
+        PathSafety.validate_archive_member_path!(export.path)
+        PathSafety.validate_archive_member_path!(export.default_path) if export.default_path
+      end
+      skills.each_value { |skill| PathSafety.validate_archive_member_path!(skill.path) }
+      templates.each_value { |template| PathSafety.validate_archive_member_path!(template.path) }
+      self
+    end
+  end
+end

data/lib/pray/publish.rb

@@ -4,6 +4,7 @@ require "json"
 require "fileutils"
 require "time"
 require "tmpdir"
+require_relative "terminal"
 
 module Pray
   RegistryIndex = Struct.new(:spec, :packages) do
@@ -15,11 +16,14 @@ module Pray
   module Publish
     module_function
 
-    def publish_to_root(project, root, signer: "local", signer_fingerprint: nil)
+    def publish_to_root(project, root, signer: "local", signer_fingerprint: nil, dest_name: nil, target: nil)
       root = File.expand_path(root)
+      dest_name ||= root
+      target ||= root
       index = load_registry_index(root)
       distribution = Distribution.read_settings(root)
       package_names = index.packages.to_set
+      stats = {published: 0, unchanged: 0}
 
       project.packages.each do |package|
         package.spec.require_release_version!
@@ -30,7 +34,9 @@ module Pray
         stored_artifact = stored_package_artifact(root, artifact_path, package, existing, distribution)
         if stored_artifact && stored_publish_matches?(stored_artifact, package, existing)
           package_names << package.declaration.name
-          write_registry_package_metadata(metadata_path, metadata)
+          # Intent: unchanged packages keep on-disk catalog bytes (newline, key order).
+          report_unchanged(package, dest_name, target)
+          stats[:unchanged] += 1
           next
         end
 
@@ -56,14 +62,20 @@ module Pray
         metadata.versions << version_entry
         write_registry_package_metadata(metadata_path, metadata)
         package_names << package.declaration.name
+        report_published(package, dest_name, target, artifact_path)
+        stats[:published] += 1
       end
 
       index.packages = package_names.sort
       write_registry_index(root, index)
+      stats
     end
 
-    def publish_to_server(project, server_url, signer: "local", signer_fingerprint: nil)
+    def publish_to_server(project, server_url, signer: "local", signer_fingerprint: nil, dest_name: nil, target: nil)
+      dest_name ||= server_url
+      target ||= server_url
       distribution = Distribution.fetch_settings(server_url)
+      stats = {published: 0, unchanged: 0}
       project.packages.each do |package|
         archive_bytes = Archive.build_package_archive_bytes(package)
         artifact_path = registry_artifact_path(package.declaration.name, package.spec.version)
@@ -99,9 +111,38 @@ module Pray
           "application/json",
           JSON.pretty_generate(metadata_to_hash(metadata))
         )
+        report_published(package, dest_name, target, artifact_path)
+        stats[:published] += 1
       end
+      stats
     end
 
+    def report_published(package, dest_name, target, artifact_path)
+      Terminal.println_stdout(
+        "published #{package.declaration.name} #{package.spec.version} -> #{redact_publish_target(dest_name)} (#{redact_publish_target(target)})"
+      )
+      Terminal.println_verbose("  artifact #{artifact_path}")
+    end
+
+    def report_unchanged(package, dest_name, target)
+      Terminal.println_stdout(
+        "unchanged #{package.declaration.name} #{package.spec.version} -> #{redact_publish_target(dest_name)} (#{redact_publish_target(target)})"
+      )
+      Terminal.println_verbose("  skip reason: stored publish matches")
+    end
+
+    def redact_publish_target(target)
+      text = target.to_s
+      return text unless text.include?("://")
+
+      scheme, remainder = text.split("://", 2)
+      return text unless remainder&.include?("@")
+
+      _userinfo, host_and_path = remainder.split("@", 2)
+      "#{scheme}://***@#{host_and_path}"
+    end
+    private_class_method :report_published, :report_unchanged
+
     def published_registry_package_version(package, signer, signer_fingerprint, archive_bytes, artifact_path)
       RegistryPackageVersion.new(
         version: package.spec.version,
@@ -114,7 +155,8 @@ module Pray
         signer: signer,
         signer_fingerprint: signer_fingerprint,
         published_at: Time.now.to_i,
-        signature: Registry.registry_artifact_signature(archive_bytes, package.tree_hash, signer)
+        signature: Registry.registry_artifact_signature(archive_bytes, package.tree_hash, signer),
+        derived_metadata: DerivedMetadata.from_package_root(package.root, package.spec)
       )
     end
 
@@ -163,6 +205,7 @@ module Pray
 
       version_entry.yanked = existing.yanked
       version_entry.published_at = existing.published_at if stored_artifact
+      version_entry.derived_metadata ||= existing.derived_metadata
     end
 
     def load_registry_index(root)
@@ -181,7 +224,7 @@ module Pray
 
     def load_registry_package_metadata(path, package_name)
       if File.exist?(path)
-        data = JSON.parse(File.read(path))
+        data = JSON.parse(File.read(path, encoding: "UTF-8"))
         RegistryPackageMetadata.new(
           name: data["name"],
           versions: Array(data["versions"]).map { |entry| Registry.version_from_hash(entry) }
@@ -193,7 +236,7 @@ module Pray
 
     def write_registry_package_metadata(path, metadata)
       FileUtils.mkdir_p(File.dirname(path))
-      File.write(path, JSON.pretty_generate(metadata_to_hash(metadata)))
+      File.write(path, JSON.pretty_generate(metadata_to_hash(metadata)), encoding: "UTF-8")
     end
 
     def metadata_to_hash(metadata)
@@ -217,6 +260,7 @@ module Pray
       hash["signer_fingerprint"] = entry.signer_fingerprint if entry.signer_fingerprint
       hash["published_at"] = entry.published_at if entry.published_at
       hash["signature"] = entry.signature if entry.signature
+      hash["derived_metadata"] = entry.derived_metadata if entry.derived_metadata
       hash
     end
 

data/lib/pray/registry.rb

@@ -15,15 +15,17 @@ require_relative "git_materialize"
 module Pray
   RegistryPackageVersion = Struct.new(
     :version, :artifact, :artifact_hash, :tree_hash, :yanked, :targets, :exports,
-    :signer, :signer_fingerprint, :published_at, :signature
+    :signer, :signer_fingerprint, :published_at, :signature, :derived_metadata
   ) do
     def initialize(
       artifact_hash: nil, tree_hash: nil, yanked: false, targets: [], exports: [],
-      signer: nil, signer_fingerprint: nil, published_at: nil, signature: nil, **kwargs
+      signer: nil, signer_fingerprint: nil, published_at: nil, signature: nil,
+      derived_metadata: nil, **kwargs
     )
       super(**kwargs, artifact_hash: artifact_hash, tree_hash: tree_hash, yanked: yanked,
                       targets: targets, exports: exports, signer: signer,
-                      signer_fingerprint: signer_fingerprint, published_at: published_at, signature: signature)
+                      signer_fingerprint: signer_fingerprint, published_at: published_at,
+                      signature: signature, derived_metadata: derived_metadata)
     end
   end
 
@@ -118,7 +120,7 @@ module Pray
 
       raise Error.resolution(offline_package_error(declaration.name, selected.version)) if offline
 
-      artifact_bytes = read_local_artifact_bytes(source_root, selected.artifact)
+      artifact_bytes = read_local_artifact_bytes(source_root, selected.artifact, offline: offline)
       RegistryInstall.install_artifact_to_cache(
         cache_directory, declaration, selected, artifact_bytes, source_url: source_root
       )
@@ -159,7 +161,8 @@ module Pray
         signer: entry["signer"],
         signer_fingerprint: entry["signer_fingerprint"],
         published_at: entry.key?("published_at") ? publish_timestamp_from_value(entry["published_at"]) : nil,
-        signature: entry["signature"]
+        signature: entry["signature"],
+        derived_metadata: entry["derived_metadata"]
       )
     end
 
@@ -206,8 +209,8 @@ module Pray
       Gem::Version.new(left) <=> Gem::Version.new(right)
     end
 
-    def read_local_artifact_bytes(source_root, artifact)
-      GitMaterialize.read_local_artifact_bytes(source_root, artifact)
+    def read_local_artifact_bytes(source_root, artifact, offline: false)
+      GitMaterialize.read_local_artifact_bytes(source_root, artifact, offline: offline)
     end
 
     def read_artifact_bytes(source_url, artifact)

data/lib/pray/render.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require "pathname"
 require_relative "render_content"
 require_relative "render_managed"
+require_relative "render_project"
 
 module Pray
   RenderedTarget = Struct.new(:path, :content, :managed_spans) do
@@ -15,16 +16,6 @@ module Pray
   module Render
     module_function
 
-    def render_project(project)
-      rendered = []
-      project.manifest.targets.each do |target|
-        output = target.outputs.first
-        next unless output
-        rendered << render_target(project, target, output)
-      end
-      rendered
-    end
-
     def write_rendered_targets(project, rendered, previous_lockfile = nil)
       Transaction.run(project.project_root) { RenderDest.write_rendered_targets(project, rendered, previous_lockfile) }
     end
@@ -56,7 +47,18 @@ module Pray
           end
         end
       end
-      planned.sort_by(&:path).uniq(&:path)
+      planned.sort_by! { |file| [file.path, file.package, file.export] }
+      planned.each_cons(2) do |left, right|
+        next unless left.path == right.path
+        next if left.package == right.package && left.export == right.export
+
+        raise Error.render(
+          "provisioned destination `#{left.path}` has multiple owners: " \
+          "package `#{left.package}` export `#{left.export}` and " \
+          "package `#{right.package}` export `#{right.export}`"
+        )
+      end
+      planned.uniq(&:path)
     end
 
     PlannedProvisionedFile = Struct.new(:path, :source, :package, :export, keyword_init: true)
@@ -74,12 +76,23 @@ module Pray
       append_header(builder, project, target, output)
       symbols = project.manifest.symbols || {}
       managed_spans = []
+      locals_by_path = project.local_files.to_h { |local| [local.manifest_path, local] }
+      packages_by_name = project.packages.to_h { |package| [package.declaration.name, package] }
 
       (target.entries || []).each do |entry|
         if entry.kind == "local"
-          append_scoped_local(builder, managed_spans, project, target, output, entry.path, symbols)
+          local = locals_by_path[entry.path]
+          append_managed_local(builder, managed_spans, local, target, output, symbols) if local
         else
-          append_scoped_package(builder, managed_spans, project, target, output, entry.name, symbols)
+          package = packages_by_name[entry.name]
+          next unless package
+          next unless Environment.package_matches_environment?(package.declaration.groups, project.environment)
+
+          package.selected_exports.each do |export|
+            next unless should_inline_export?(package, export)
+
+            append_managed_export(builder, managed_spans, package, export, target, output, symbols)
+          end
         end
       end
 
@@ -133,25 +146,6 @@ module Pray
       builder.append_empty_line
     end
 
-    def append_scoped_local(builder, managed_spans, project, target, output, path, symbols)
-      local = project.local_files.find { |candidate| candidate.manifest_path == path }
-      return unless local
-
-      append_managed_local(builder, managed_spans, local, target, output, symbols)
-    end
-
-    def append_scoped_package(builder, managed_spans, project, target, output, package_name, symbols)
-      package = project.packages.find { |candidate| candidate.declaration.name == package_name }
-      return unless package
-      return unless Environment.package_matches_environment?(package.declaration.groups, project.environment)
-
-      package.selected_exports.each do |export|
-        next unless should_inline_export?(package, export)
-
-        append_managed_export(builder, managed_spans, package, export, target, output, symbols)
-      end
-    end
-
     def should_inline_export?(package, export_name)
       export = package.spec.exports[export_name]
       export.nil? || %w[fragment file].include?(export.kind)

data/lib/pray/render_content.rb

@@ -3,16 +3,16 @@
 module Pray
   module Render
     class ContentBuilder
+      attr_reader :next_line_number
+
       def initialize
         @content = +""
-      end
-
-      def next_line_number
-        @content.count("\n") + 1
+        @next_line_number = 1
       end
 
       def append_line(line)
         @content << line << "\n"
+        @next_line_number += 1
       end
 
       def append_empty_line

data/lib/pray/render_project.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Pray
+  module Render
+    module_function
+
+    def render_project(project)
+      project.manifest.targets.flat_map do |target|
+        target.outputs.map do |output|
+          rendered = render_target(project, target, output)
+          if target.max_bytes && rendered.content.bytesize > target.max_bytes
+            raise Error.render(
+              "target `#{target.name}` output `#{output}` is #{rendered.content.bytesize} bytes; " \
+              "max_bytes is #{target.max_bytes}"
+            )
+          end
+          rendered
+        end
+      end
+    end
+  end
+end

data/lib/pray/resolve.rb

@@ -154,8 +154,8 @@ module Pray
         project_root, sources, git_sources, user_config, declaration, lockfile, options
       )
       spec_path = find_prayspec_file(root)
-      spec_text = File.read(spec_path)
-      spec = Pray.parse_package_spec(spec_text).canonicalized
+      spec_text = SourcePath.read(root, File.basename(spec_path), "package specification").force_encoding(Encoding::UTF_8)
+      spec = Pray.parse_package_spec(spec_text)
       if spec.name != declaration.name
         raise Error.resolution(
           "package path #{root.inspect} declares #{spec.name.inspect}, expected #{declaration.name.inspect}"
@@ -195,9 +195,11 @@ module Pray
       offline = options.offline
       preferred_version = options.preferred_lock_version(lockfile, declaration.name)
       if (local_path = user_config.local.package[declaration.name])
-        return [File.expand_path(local_path, project_root), nil]
+        return [SourcePath.declared_directory(project_root, local_path, "package directory"), nil]
+      end
+      if declaration.path
+        return [SourcePath.declared_directory(project_root, declaration.path, "package directory"), nil]
       end
-      return [File.expand_path(declaration.path, project_root), nil] if declaration.path
       return [ResolveTarball.package_root(project_root, declaration.tarball, offline: offline), nil] if declaration.tarball
       source_name = ResolveSource.implied_source_name(declaration, sources)
       if source_name
@@ -220,7 +222,8 @@ module Pray
         case source.kind
         when "path"
           directory = LocalPrayer.path_source_package_directory(source_name, declaration.name)
-          return [File.join(project_root, source.url, directory), nil]
+          relative = File.join(source.url, directory)
+          return [SourcePath.declared_directory(project_root, relative, "package directory"), nil]
         when "registry", "static index"
           resolved = Registry.resolve_registry_package_root(
             project_root,
@@ -264,7 +267,8 @@ module Pray
 
       raise Error.unsupported("remote sources are not implemented yet") if declaration.git || declaration.oci
 
-      [File.join(project_root, declaration.name.tr("/", "-")), nil]
+      slug = declaration.name.tr("/", "-")
+      [SourcePath.declared_directory(project_root, slug, "package directory"), nil]
     end
 
     def resolve_package_root(project_root, sources, git_sources, user_config, declaration, lockfile = nil)
@@ -272,9 +276,12 @@ module Pray
     end
 
     def find_prayspec_file(root)
-      files = Dir.children(root).filter_map do |entry|
+      files = []
+      Dir.each_child(root) do |entry|
+        next unless File.extname(entry) == ".prayspec"
+
         path = File.join(root, entry)
-        (File.file?(path) && File.extname(entry) == ".prayspec") ? path : nil
+        files << path if File.file?(path)
       end
       case files.length
       when 1 then files.first
@@ -296,15 +303,7 @@ module Pray
     end
 
     def load_package_file_bytes(root, spec)
-      file_bytes = {}
-      spec.files.each do |file|
-        path = File.join(root, file)
-        raise Error.integrity("package file missing: #{file}") unless File.exist?(path)
-        raise Error.integrity("package file is a directory: #{file}") if File.directory?(path)
-
-        file_bytes[file] = File.binread(path)
-      end
-      file_bytes
+      spec.files.to_h { |file| [file, SourcePath.read(root, file, "package file")] }
     end
 
     def build_skill_file_index(spec)
@@ -331,12 +330,7 @@ module Pray
     end
 
     def skill_relative_file(file, skill_prefix)
-      return nil unless file.start_with?(skill_prefix)
-
-      relative = file.delete_prefix(skill_prefix).delete_prefix("/")
-      return nil if relative.empty? || file == skill_prefix
-
-      relative
+      file.delete_prefix("#{skill_prefix.delete_suffix("/")}/") if file.start_with?("#{skill_prefix.delete_suffix("/")}/")
     end
   end
 end

data/lib/pray/resolve_local.rb

@@ -11,6 +11,7 @@ module Pray
 
     def resolve_local_file(project_root, declaration)
       path = File.join(project_root, declaration.path)
+      SourcePath.reject_symlinks!(project_root, declaration.path, "local source")
       unless File.exist?(path)
         if declaration.optional
           return ResolvedLocalFile.new(

data/lib/pray/serve.rb

@@ -118,7 +118,7 @@ module Pray
         return html_response("<h1>Pray distribution</h1>")
       end
 
-      file_path = PathSafety.join_under_root(root, path.delete_prefix("/"))
+      file_path = public_distribution_path(root, path)
       return not_found unless file_path
       return not_found unless File.file?(file_path)
       return payload_too_large if File.size(file_path) > ResourceLimits::MAX_HTTP_RESPONSE_BYTES
@@ -129,6 +129,20 @@ module Pray
       ranged_response(status, content_type, ranged_body, content_range)
     end
 
+    def public_distribution_path(root, request_path)
+      relative = PathSafety.sanitize_relative_path(request_path)
+      exact = %w[v1/index.json v1/distribution.json v1/trust.json]
+      return nil unless exact.include?(relative) || relative.start_with?("v1/packages/", "v1/artifacts/")
+
+      file_path = PathSafety.join_under_root(root, relative)
+      return nil unless file_path
+
+      SourcePath.reject_symlinks!(root, relative, "distribution file")
+      file_path
+    rescue Error
+      nil
+    end
+
     def content_type_for(path)
       case File.extname(path)
       when ".json" then "application/json"

data/lib/pray/serve_federation.rb

@@ -51,6 +51,7 @@ module Pray
 
     def package_response(root, path)
       name = path.delete_prefix("/v1/sync/package/")
+      PathSafety.validate_registry_cache_identity!(name, "metadata")
       metadata_path = Publish.registry_metadata_path(root, name)
       return Serve.not_found unless File.file?(metadata_path)
 
@@ -61,6 +62,8 @@ module Pray
         "versions" => metadata.versions.map { |version| transport_version(version) }
       }
       Serve.ok_response("application/json", JSON.pretty_generate(body))
+    rescue Error
+      Serve.not_found
     end
 
     def append_confession(root, body)

data/lib/pray/source_path.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "pathname"
+
+module Pray
+  module SourcePath
+    module_function
+
+    def declared_directory(root, relative, label)
+      reject_symlinks!(root, relative, label)
+      File.expand_path(relative, root)
+    end
+
+    def reject_symlinks!(root, relative, label)
+      current = Pathname(relative).absolute? ? File::SEPARATOR : root
+      status = nil
+      Pathname(relative).each_filename do |component|
+        current = File.join(current, component)
+        status = File.lstat(current)
+        raise Error.integrity("#{label} uses a symbolic link: #{relative}") if status.symlink?
+      rescue Errno::ENOENT
+        return nil
+      end
+      status
+    end
+
+    def read(root, relative, label)
+      status = reject_symlinks!(root, relative, label)
+      raise Error.integrity("#{label} missing: #{relative}") unless status
+      raise Error.integrity("#{label} is a directory: #{relative}") if status.directory?
+
+      File.binread(File.join(root, relative))
+    end
+  end
+end

data/lib/pray/statement_surface.rb

@@ -7,6 +7,7 @@ module Pray
     def expand_statement_surface(statement)
       trimmed = statement.strip
       return [] if trimmed.empty?
+      return [normalize_keyword_call(trimmed)] unless trimmed.include?(";") || trimmed.include?("{")
 
       Literal.split_top_level(trimmed, ";").flat_map { |segment| expand_one_surface(segment) }
     end
@@ -15,7 +16,7 @@ module Pray
       trimmed = statement.strip
       return [] if trimmed.empty?
 
-      braced = expand_brace_block(trimmed)
+      braced = expand_brace_block(trimmed) if trimmed.include?("{")
       return braced if braced
 
       [normalize_keyword_call(trimmed)]
@@ -71,6 +72,7 @@ module Pray
     def normalize_keyword_call(statement)
       spaced = normalize_spaced_block_opener(statement)
       return spaced if spaced
+      return statement unless statement.include?("(")
 
       keyword = leading_identifier(statement)
       return statement unless keyword

data/lib/pray/sync.rb

@@ -205,10 +205,7 @@ module Pray
     end
 
     def fetch_bytes(peer_source, artifact)
-      if artifact.start_with?("http://", "https://")
-        return Registry.http_get(artifact).b
-      end
-
+      Registry.reject_absolute_artifact!(artifact)
       Registry.http_get("#{trim_slash(peer_source)}/#{artifact.delete_prefix("/")}").b
     end
 

data/lib/pray/tar_validation.rb

@@ -38,6 +38,8 @@ module Pray
 
     def process_entry(header, data, size, state, output_directory)
       type = header.byteslice(156, 1)
+      # git archive emits a pax global header (`g`); ignore without applying path.
+      return if type == "g"
       if type == "x"
         state.pending_path = pax_path(data)
         return

data/lib/pray/terminal.rb

@@ -20,6 +20,34 @@ module Pray
       env_truthy?("PRAY_NO_INPUT")
     end
 
+    def quiet?
+      env_truthy?("PRAY_QUIET")
+    end
+
+    def verbose?
+      level = ENV.fetch("PRAY_VERBOSE", "0").to_i
+      level > 0
+    end
+
+    def configure_output!(quiet:, verbose:)
+      ENV["PRAY_QUIET"] = "1" if quiet
+      if verbose > 0
+        ENV["PRAY_VERBOSE"] = verbose.to_s
+      end
+    end
+
+    def println_stdout(message)
+      return if quiet?
+
+      puts message
+    end
+
+    def println_verbose(message)
+      return if quiet? || !verbose?
+
+      puts message
+    end
+
     def env_truthy?(name)
       value = ENV.fetch(name, nil)
       return false if value.nil?

data/lib/pray/trust.rb

@@ -110,10 +110,11 @@ module Pray
     end
 
     def prepare_source_host_keys(sources)
-      policy = load_policy_or_default
-      sources.each_with_object({}) do |source, host_keys|
-        next unless source.kind == "pray_ssh"
+      ssh_sources = sources.select { |source| source.kind == "pray_ssh" }
+      return {} if ssh_sources.empty?
 
+      policy = load_policy_or_default
+      ssh_sources.each_with_object({}) do |source, host_keys|
         rule = best_rule(policy, source.url)
         fingerprint = rule.allowed_host_keys.first
         host_keys[source.name] = fingerprint if fingerprint

data/lib/pray/upstream_merge.rb

@@ -39,13 +39,15 @@ module Pray
       when [false, true, false]
         (local == old) ? :omit : :conflict
       when [false, false, true]
-        (old == new) ? :omit : new
+        (old == new) ? :omit : :conflict
       when [true, false, true]
         new
       when [true, true, false]
         local
       when [true, false, false]
         (local == new) ? new : :conflict
+      when [false, true, true]
+        :omit
       else
         :conflict
       end
@@ -67,7 +69,9 @@ module Pray
 
     def merge_conflict_message(fork, upstream_name, old_version, new_version, paths)
       "upstream merge conflict in #{fork} while refreshing #{upstream_name} " \
-        "#{old_version} to #{new_version}: #{paths.join(", ")}"
+        "#{old_version} to #{new_version}: #{paths.join(", ")}. " \
+        "Reset those content files to the locked upstream tree, run `pray update --latest`, " \
+        "re-apply intentional overlays, then bump the fork version (upstream_merge_conflict)."
     end
 
     def next_upstream_constraint(current, new_version)