pray-cli 1.9.0 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a25d60eee0adb8e74f902347fc6d429d489803628d96abc8f73c154be9c993d
-  data.tar.gz: 318dcf2ddeeecc69231562f20f6146368c4e68758726e153a7556f2e4a925333
+  metadata.gz: 85c1a7462b69a935d6e9a83d1489c43a445e63190dcebb5481744de051bf562a
+  data.tar.gz: 778142b6ea1ac16ae0762dc9015a30f20ca06cfb3abcb715fa37eea2620a05ff
 SHA512:
-  metadata.gz: a2fa874e166e17456197f6db47d35f64d153867900f1837fd69b5802a6c910a2a9ae3983f035df8b2e0959a0ba9163c6caea9314cd56161a6b6d18fd8fc63448
-  data.tar.gz: 60a8103a9a74e25729619107bfa80e8bbea1e4d85a554bd428e0280ec53600d978bf64afcceac84be37ceaaea7f6a7628dc9efd234e1c29b7388b0d2b3935bf0
+  metadata.gz: 7199ad20e75fd83ad98c97d0bbf9f97ae4c6d91bc2e2a8dca0cf4b14339da30a7396d8b076e0f789d8f17f0334b2b10853c8298e429705ef99ccaccc02b88f09
+  data.tar.gz: 19ea0fb475fdfeabc7ab7729e40d2228eba70be9f52becd2923d9b2c770a31fc146215aa2fa65b04c2e14733114c672f67a906e364841df027fedbcd9ca6f61f

data/CHANGELOG.md

@@ -1,6 +1,19 @@
 # CHANGELOG
 
-## Unreleased
+## 1.9.2 (2026-09-01)
+
+- Fix `.praypkg` unpack for git and registry installs when the Ruby process forces UTF-8 internal encoding.
+- Treat empty or corrupt `.pray/cache/registry` directories as not ready so the next install unpacks again.
+- Reject archive members that escape the package root or exceed size limits; unpack through staging into cache.
+- Resolve packages from a matching source namespace or sole source without an explicit `source:`.
+- Move login sessions to the user Pray home with owner-only permissions and migrate legacy repository sessions.
+- Reject manifest paths outside the project; require registry hashes and recheck cached package trees.
+- Bound server requests, headers, connections, and timeouts; expose a readiness endpoint.
+- Cap registry downloads at 64 MiB; unpack `.praypkg` tar members without system tar; reject absolute artifact URLs.
+
+## 1.9.1 (2026-08-29)
+
+- Rewrite every matching `pray` line when a package constraint is updated, keeping indent and extra keywords.
 
 ## 1.7.0 (2026-07-29)
 

data/bin/pray

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 Encoding.default_external = Encoding::UTF_8
-Encoding.default_internal = Encoding::UTF_8
 
 gemfile = File.expand_path("../Gemfile", __dir__)
 if File.exist?(gemfile)

data/lib/pray/archive.rb

@@ -3,7 +3,7 @@
 require "json"
 require "open3"
 require "fileutils"
-require "tempfile"
+require_relative "archive_unpack"
 
 module Pray
   module Archive
@@ -23,15 +23,20 @@ module Pray
           File.binwrite(destination, File.binread(File.join(package.root, file)))
         end
 
-        tar_bytes, status = Open3.capture2("tar", "-cf", "-", "-C", staging, ".")
-        raise Error.integrity("failed to build package tar archive") unless status.success?
+        with_binary_process_encoding do
+          tar_bytes, status = Open3.capture2(
+            {"COPYFILE_DISABLE" => "1"},
+            "tar", "-cf", "-", "-C", staging, "."
+          )
+          raise Error.integrity("failed to build package tar archive") unless status.success?
 
-        zstd_bytes, status = Open3.capture2("zstd", "-q", "-c", stdin_data: tar_bytes)
-        unless status.success?
-          raise Error.unsupported("zstd is required to build package archives")
-        end
+          zstd_bytes, status = Open3.capture2("zstd", "-q", "-c", stdin_data: tar_bytes)
+          unless status.success?
+            raise Error.unsupported("zstd is required to build package archives")
+          end
 
-        zstd_bytes
+          zstd_bytes
+        end
       end
     end
 
@@ -41,14 +46,7 @@ module Pray
     end
 
     def unpack_praypkg(artifact_bytes, output_directory)
-      FileUtils.mkdir_p(output_directory)
-      tar_bytes, status = Open3.capture2("zstd", "-d", "-q", "-c", stdin_data: artifact_bytes)
-      unless status.success?
-        raise Error.unsupported("zstd is required to unpack package archives")
-      end
-
-      _stdout, _stderr, status = Open3.capture3("tar", "-xf", "-", "-C", output_directory, stdin_data: tar_bytes)
-      raise Error.integrity("failed to unpack package archive") unless status.success?
+      ArchiveUnpack.unpack_praypkg(artifact_bytes, output_directory)
     end
 
     def package_archive_path(package_name, version)
@@ -64,5 +62,9 @@ module Pray
         "exports" => package.selected_exports
       )
     end
+
+    def with_binary_process_encoding(&block)
+      ArchiveUnpack.with_binary_process_encoding(&block)
+    end
   end
 end

data/lib/pray/archive_unpack.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "open3"
+require "fileutils"
+require "find"
+require_relative "path_safety"
+require_relative "resource_limits"
+require_relative "tar_validation"
+
+module Pray
+  module ArchiveUnpack
+    module_function
+
+    def unpack_praypkg(artifact_bytes, output_directory)
+      if artifact_bytes.bytesize > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+        raise Error.integrity(
+          "package archive exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} bytes"
+        )
+      end
+
+      tar_bytes = decompress_zstd(artifact_bytes)
+      if tar_bytes.bytesize > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+        raise Error.integrity(
+          "package archive exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} decompressed bytes"
+        )
+      end
+
+      TarValidation.extract!(tar_bytes, output_directory)
+      reject_unsafe_extracted_tree!(output_directory)
+    end
+
+    def with_binary_process_encoding
+      previous = Encoding.default_internal
+      verbose = $VERBOSE
+      $VERBOSE = nil
+      Encoding.default_internal = nil
+      yield
+    ensure
+      Encoding.default_internal = previous
+      $VERBOSE = verbose
+    end
+
+    def decompress_zstd(artifact_bytes)
+      with_binary_process_encoding do
+        tar_bytes, status = Open3.capture2("zstd", "-d", "-q", "-c", stdin_data: artifact_bytes)
+        unless status.success?
+          raise Error.unsupported("zstd is required to unpack package archives")
+        end
+
+        tar_bytes
+      end
+    end
+
+    def reject_unsafe_extracted_tree!(output_directory)
+      Find.find(output_directory) do |path|
+        next if path == output_directory
+        next if File.directory?(path)
+
+        if File.symlink?(path)
+          raise Error.integrity("unsupported package archive entry type")
+        end
+        unless PathSafety.path_under_root?(output_directory, path)
+          raise Error.integrity("package path escapes package root: #{path}")
+        end
+      end
+    end
+  end
+end

data/lib/pray/http_body.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "resource_limits"
+
+module Pray
+  module HttpBody
+    module_function
+
+    def reject_oversized_content_length!(content_length, max_bytes = ResourceLimits::MAX_HTTP_RESPONSE_BYTES)
+      return if content_length.nil?
+      return if content_length <= max_bytes
+
+      raise Error.resolution("HTTP response exceeds #{max_bytes} bytes")
+    end
+
+    def append_chunk!(body, chunk, max_bytes = ResourceLimits::MAX_HTTP_RESPONSE_BYTES)
+      body << chunk
+      return body if body.bytesize <= max_bytes
+
+      raise Error.resolution("HTTP response exceeds #{max_bytes} bytes")
+    end
+
+    def read_response!(response, max_bytes = ResourceLimits::MAX_HTTP_RESPONSE_BYTES)
+      length = response["content-length"]
+      parsed = length && Integer(length, exception: false)
+      reject_oversized_content_length!(parsed, max_bytes)
+      body = +"".b
+      response.read_body do |chunk|
+        append_chunk!(body, chunk, max_bytes)
+      end
+      body
+    end
+  end
+end

data/lib/pray/manifest.rb

@@ -5,6 +5,7 @@ require_relative "manifest_formatter"
 require_relative "manifest_parser_helpers"
 require_relative "manifest_parser_blocks"
 require_relative "manifest_parser"
+require_relative "path_safety"
 
 module Pray
   RenderPolicy = Struct.new(
@@ -118,7 +119,22 @@ module Pray
 
     def parse_manifest(text)
       lines = Literal.prepare_parser_lines(text)
-      BlockParser.new(lines).parse_root
+      manifest = BlockParser.new(lines).parse_root
+      validate_manifest_paths!(manifest)
+      manifest
+    end
+
+    def validate_manifest_paths!(manifest)
+      manifest.targets.each do |target|
+        (target.outputs + target.skills + target.commands + target.rules).each do |path|
+          PathSafety.validate_project_relative_path!(path)
+        end
+      end
+      manifest.packages.each do |package|
+        PathSafety.validate_project_relative_path!(package.path) if package.path
+        PathSafety.validate_project_relative_path!(package.file) if package.file
+      end
+      manifest.local.each { |local| PathSafety.validate_project_relative_path!(local.path) }
     end
   end
 

data/lib/pray/manifest_constraint.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Pray
+  module ManifestMethods
+    module_function
+
+    PACKAGE_KEYWORDS = %w[pray use include agent package].freeze
+
+    def rewrite_constraint_on_line(line, constraint)
+      indent = line[/\A\s*/]
+      trimmed = line.lstrip
+      after_keyword = skip_package_keyword(trimmed)
+      raise Error.manifest("package declaration is missing a keyword") unless after_keyword
+
+      after_keyword = after_keyword.lstrip
+      parsed_name = parse_quoted(after_keyword)
+      raise Error.manifest("package declaration is missing a quoted name") unless parsed_name
+
+      name, after_name = parsed_name
+      quoted_constraint = "\"#{constraint}\""
+      keyword_and_name = trimmed[0, trimmed.length - after_name.length]
+      remainder = after_name.lstrip
+      return "#{indent}#{keyword_and_name}, #{quoted_constraint}" if remainder.empty?
+      unless remainder.start_with?(",")
+        raise Error.manifest("package #{name} declaration is missing a comma after the name")
+      end
+
+      after_comma = remainder[1..].lstrip
+      if after_comma.start_with?("\"", "'")
+        parsed_constraint = parse_quoted(after_comma)
+        unless parsed_constraint
+          raise Error.manifest("package #{name} declaration has an unclosed constraint")
+        end
+
+        return "#{indent}#{keyword_and_name}, #{quoted_constraint}#{parsed_constraint[1]}"
+      end
+
+      "#{indent}#{keyword_and_name}, #{quoted_constraint}, #{after_comma}"
+    end
+
+    def skip_package_keyword(input)
+      PACKAGE_KEYWORDS.each do |keyword|
+        next unless input.start_with?(keyword)
+
+        rest = input[keyword.length..]
+        next_character = rest[0]
+        whitespace_or_quote = next_character.nil? ||
+          next_character.match?(/\s/) ||
+          next_character == "\"" ||
+          next_character == "'"
+        return rest if whitespace_or_quote
+      end
+      nil
+    end
+
+    def parse_quoted(input)
+      quote = input[0]
+      return unless quote == "\"" || quote == "'"
+
+      rest = input[1..]
+      ending = rest.index(quote)
+      return unless ending
+
+      [rest[0, ending], rest[(ending + 1)..]]
+    end
+  end
+end

data/lib/pray/manifest_formatter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "manifest_constraint"
+
 module Pray
   module ManifestMethods
     module_function
@@ -37,13 +39,15 @@ module Pray
         "package \"#{name}\"", "package '#{name}'"
       ]
       lines = text.lines.map(&:chomp)
-      index = lines.index { |line|
-        trimmed = line.lstrip
-        prefixes.any? { |prefix| trimmed.start_with?(prefix) }
-      }
-      raise Error.manifest("package #{name} not found in manifest") unless index
+      replaced = 0
+      lines.each_index do |index|
+        trimmed = lines[index].lstrip
+        next unless prefixes.any? { |prefix| trimmed.start_with?(prefix) }
 
-      lines[index] = format_package_declaration(package)
+        lines[index] = rewrite_constraint_on_line(lines[index], package.constraint)
+        replaced += 1
+      end
+      raise Error.manifest("package #{name} not found in manifest") if replaced.zero?
       output = lines.join("\n")
       output += "\n" if text.end_with?("\n") && !output.end_with?("\n")
       output

data/lib/pray/path_safety.rb

@@ -37,5 +37,39 @@ module Pray
 
       cleaned
     end
+
+    def validate_archive_member_path!(path)
+      cleaned = path.to_s.delete_prefix("./")
+      if cleaned.empty? || Pathname.new(cleaned).absolute? || cleaned.start_with?("/")
+        raise Error.integrity("package path must be relative: #{path}")
+      end
+
+      cleaned.split("/").each do |part|
+        next if part.empty? || part == "."
+
+        if part == ".." || part.include?("\0")
+          raise Error.integrity("package path escapes package root: #{path}")
+        end
+      end
+
+      cleaned
+    end
+
+    def validate_project_relative_path!(value)
+      path = value.to_s.strip
+      windows_absolute = path.match?(/\A(?:[A-Za-z]:[\\\/]|[\\\/]{2})/)
+      if path.empty? || Pathname.new(path).absolute? || windows_absolute
+        raise Error.manifest("project path must be repository-relative: #{value}")
+      end
+      parts = path.tr("\\", "/").split("/")
+      if parts.include?("..") || path.include?("\0")
+        raise Error.manifest("project path escapes repository root: #{value}")
+      end
+      if parts.all? { |part| part.empty? || part == "." }
+        raise Error.manifest("project path must be repository-relative: #{value}")
+      end
+
+      path
+    end
   end
 end

data/lib/pray/registry.rb

@@ -6,6 +6,7 @@ require "uri"
 require "fileutils"
 require "pathname"
 require_relative "path_safety"
+require_relative "http_body"
 
 module Pray
   RegistryPackageVersion = Struct.new(
@@ -33,12 +34,15 @@ module Pray
   )
 
   module Registry
+    extend RegistryIntegrity
+
     module_function
 
     def resolve_registry_package_root(project_root, source_url, declaration, preferred_version: nil, offline: false)
       metadata = fetch_package_metadata(source_url, declaration.name)
       registry_latest_version = registry_latest_version_label(metadata)
       selected = select_package_version(metadata, declaration.constraint, preferred_version)
+      require_integrity_fields!(declaration.name, selected)
       cache_directory = registry_cache_directory(
         project_root,
         source_url,
@@ -57,11 +61,10 @@ module Pray
 
       raise Error.resolution(offline_package_error(declaration.name, selected.version)) if offline
 
-      FileUtils.rm_rf(cache_directory) if File.exist?(cache_directory)
-      FileUtils.mkdir_p(cache_directory)
-
       artifact_bytes = read_artifact_bytes(source_url, selected.artifact)
-      validate_and_unpack(cache_directory, declaration, selected, artifact_bytes, source_url: source_url)
+      RegistryInstall.install_artifact_to_cache(
+        cache_directory, declaration, selected, artifact_bytes, source_url: source_url
+      )
 
       RegistryPackageResolution.new(
         root: cache_directory,
@@ -83,6 +86,7 @@ module Pray
       metadata = parse_metadata(File.read(metadata_path, encoding: "UTF-8"))
       registry_latest_version = registry_latest_version_label(metadata)
       selected = select_package_version(metadata, declaration.constraint, preferred_version)
+      require_integrity_fields!(declaration.name, selected)
       cache_directory = registry_cache_directory(
         project_root,
         source_key,
@@ -101,11 +105,10 @@ module Pray
 
       raise Error.resolution(offline_package_error(declaration.name, selected.version)) if offline
 
-      FileUtils.rm_rf(cache_directory) if File.exist?(cache_directory)
-      FileUtils.mkdir_p(cache_directory)
-
       artifact_bytes = read_local_artifact_bytes(source_root, selected.artifact)
-      validate_and_unpack(cache_directory, declaration, selected, artifact_bytes, source_url: source_root)
+      RegistryInstall.install_artifact_to_cache(
+        cache_directory, declaration, selected, artifact_bytes, source_url: source_root
+      )
 
       RegistryPackageResolution.new(
         root: cache_directory,
@@ -177,51 +180,13 @@ module Pray
       Gem::Version.new(left) <=> Gem::Version.new(right)
     end
 
-    def validate_and_unpack(cache_directory, declaration, selected, artifact_bytes, source_url: nil)
-      if selected.artifact_hash
-        artifact_hash = Hashing.sha256_prefixed(artifact_bytes)
-        if artifact_hash != selected.artifact_hash
-          raise Error.integrity(
-            "package artifact hash mismatch for #{declaration.name} #{selected.version}"
-          )
-        end
-      end
-
-      verify_registry_signature!(declaration, selected, artifact_bytes)
-      Trust.verify_publisher_fingerprint!(source_url, selected) if source_url
-
-      Archive.unpack_praypkg(artifact_bytes, cache_directory)
-      spec_path = Resolve.find_prayspec_file(cache_directory)
-      spec = Pray.parse_package_spec(File.read(spec_path)).canonicalized
-      if spec.name != declaration.name
-        raise Error.resolution(
-          "package path #{cache_directory.inspect} declares #{spec.name.inspect}, expected #{declaration.name.inspect}"
-        )
-      end
-      if spec.version != selected.version
-        raise Error.resolution(
-          "package #{declaration.name} version #{spec.version} does not match registry version #{selected.version}"
-        )
-      end
-      if selected.tree_hash
-        actual_tree_hash = spec.tree_hash_for_root(cache_directory)
-        if actual_tree_hash != selected.tree_hash
-          raise Error.integrity(
-            "package tree hash mismatch for #{declaration.name} #{selected.version}"
-          )
-        end
-      end
-    end
-
     def read_local_artifact_bytes(source_root, artifact)
-      if artifact.start_with?("http://", "https://")
-        return http_get(artifact)
-      end
       if artifact.start_with?("file://")
         path = PathSafety.join_under_root(source_root, artifact.delete_prefix("file://"))
         raise Error.resolution("package artifact path escapes distribution root") unless path
         return File.binread(path)
       end
+      reject_absolute_artifact!(artifact)
 
       path = PathSafety.join_under_root(source_root, artifact)
       raise Error.resolution("package artifact path escapes distribution root") unless path
@@ -233,17 +198,14 @@ module Pray
     def read_artifact_bytes(source_url, artifact)
       return read_local_artifact_bytes(source_url, artifact) if local_source?(source_url)
 
+      reject_absolute_artifact!(artifact)
       http_get(join_url(source_url, artifact))
     end
 
-    def cache_ready?(cache_directory, selected)
-      return false unless File.directory?(cache_directory)
+    def reject_absolute_artifact!(artifact)
+      return unless artifact.match?(%r{\A[a-z][a-z0-9+.-]*:}i)
 
-      spec_path = Resolve.find_prayspec_file(cache_directory)
-      spec = Pray.parse_package_spec(File.read(spec_path)).canonicalized
-      spec.version == selected.version
-    rescue Errno::ENOENT, Errno::ENOTDIR, SystemCallError
-      false
+      raise Error.integrity("remote artifact path must be relative: #{artifact}")
     end
 
     def registry_metadata_path(source_root, package_name)
@@ -301,12 +263,7 @@ module Pray
 
     def http_get(url)
       uri = URI(url)
-      response = http_request(uri) { |http| http.get(uri.request_uri) }
-      unless response.is_a?(Net::HTTPSuccess)
-        raise Error.resolution("HTTP request failed for #{url}: #{response.code}")
-      end
-
-      response.body
+      bounded_http_exchange(uri, Net::HTTP::Get.new(uri), "HTTP request failed for #{url}")
     end
 
     def http_put(url, content_type, body)
@@ -314,12 +271,7 @@ module Pray
       request = Net::HTTP::Put.new(uri)
       request["Content-Type"] = content_type
       request.body = body
-      response = http_request(uri) { |http| http.request(request) }
-      unless response.is_a?(Net::HTTPSuccess)
-        raise Error.resolution("HTTP upload failed for #{url}: #{response.code}")
-      end
-
-      response.body
+      bounded_http_exchange(uri, request, "HTTP upload failed for #{url}")
     end
 
     def http_post(url, content_type, body)
@@ -327,12 +279,23 @@ module Pray
       request = Net::HTTP::Post.new(uri)
       request["Content-Type"] = content_type
       request.body = body
-      response = http_request(uri) { |http| http.request(request) }
-      unless response.is_a?(Net::HTTPSuccess)
-        raise Error.resolution("HTTP request failed for #{url}: #{response.code}")
+      bounded_http_exchange(uri, request, "HTTP request failed for #{url}")
+    end
+
+    def bounded_http_exchange(uri, request, failure_message)
+      body = nil
+      code = nil
+      success = false
+      http_request(uri) do |http|
+        http.request(request) do |response|
+          success = response.is_a?(Net::HTTPSuccess)
+          code = response.code
+          body = HttpBody.read_response!(response)
+        end
       end
+      raise Error.resolution("#{failure_message}: #{code}") unless success
 
-      response.body
+      body
     end
 
     def http_request(uri)

data/lib/pray/registry_install.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "fileutils"
+
+module Pray
+  module RegistryInstall
+    module_function
+
+    def install_artifact_to_cache(cache_directory, declaration, selected, artifact_bytes, source_url: nil)
+      staging_directory = "#{cache_directory}.staging"
+      FileUtils.rm_rf(staging_directory)
+      FileUtils.mkdir_p(staging_directory)
+      unpacked_directory = File.join(staging_directory, "unpacked")
+      FileUtils.mkdir_p(unpacked_directory)
+
+      begin
+        Registry.validate_and_unpack(
+          unpacked_directory, declaration, selected, artifact_bytes, source_url: source_url
+        )
+        FileUtils.rm_rf(cache_directory) if File.exist?(cache_directory)
+        FileUtils.mv(unpacked_directory, cache_directory)
+      rescue
+        FileUtils.rm_rf(staging_directory)
+        raise
+      else
+        FileUtils.rm_rf(staging_directory)
+      end
+    end
+  end
+end

data/lib/pray/registry_integrity.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Pray
+  module RegistryIntegrity
+    def validate_and_unpack(cache_directory, declaration, selected, artifact_bytes, source_url: nil)
+      require_integrity_fields!(declaration.name, selected)
+      artifact_hash = Hashing.sha256_prefixed(artifact_bytes)
+      if artifact_hash != selected.artifact_hash
+        raise Error.integrity(
+          "package artifact hash mismatch for #{declaration.name} #{selected.version}"
+        )
+      end
+
+      verify_registry_signature!(declaration, selected, artifact_bytes)
+      Trust.verify_publisher_fingerprint!(source_url, selected) if source_url
+      Archive.unpack_praypkg(artifact_bytes, cache_directory)
+      spec_path = Resolve.find_prayspec_file(cache_directory)
+      spec = Pray.parse_package_spec(File.read(spec_path)).canonicalized
+      validate_package_identity!(cache_directory, declaration, selected, spec)
+      actual_tree_hash = spec.tree_hash_for_root(cache_directory)
+      if actual_tree_hash != selected.tree_hash
+        raise Error.integrity(
+          "package tree hash mismatch for #{declaration.name} #{selected.version}"
+        )
+      end
+    end
+
+    def require_integrity_fields!(package_name, selected)
+      if selected.artifact_hash.to_s.empty?
+        raise Error.integrity("package #{package_name} #{selected.version} is missing artifact_hash")
+      end
+      if selected.tree_hash.to_s.empty?
+        raise Error.integrity("package #{package_name} #{selected.version} is missing tree_hash")
+      end
+    end
+
+    def cache_ready?(cache_directory, selected)
+      return false unless File.directory?(cache_directory)
+
+      spec_path = Resolve.find_prayspec_file(cache_directory)
+      spec = Pray.parse_package_spec(File.read(spec_path)).canonicalized
+      spec.version == selected.version && !selected.tree_hash.to_s.empty? &&
+        spec.tree_hash_for_root(cache_directory) == selected.tree_hash
+    rescue Error, SystemCallError
+      false
+    end
+
+    private
+
+    def validate_package_identity!(cache_directory, declaration, selected, spec)
+      if spec.name != declaration.name
+        raise Error.resolution(
+          "package path #{cache_directory.inspect} declares #{spec.name.inspect}, expected #{declaration.name.inspect}"
+        )
+      end
+      return if spec.version == selected.version
+
+      raise Error.resolution(
+        "package #{declaration.name} version #{spec.version} does not match registry version #{selected.version}"
+      )
+    end
+  end
+end

data/lib/pray/render.rb

@@ -18,7 +18,6 @@ module Pray
       project.manifest.targets.each do |target|
         output = target.outputs.first
         next unless output
-
         rendered << render_target(project, target, output)
       end
       rendered
@@ -26,6 +25,7 @@ module Pray
 
     def write_rendered_targets(project, rendered)
       rendered.each do |target|
+        PathSafety.validate_project_relative_path!(target.path)
         path = File.join(project.project_root, target.path)
         FileUtils.mkdir_p(File.dirname(path))
         File.write(path, target.content)
@@ -36,6 +36,7 @@ module Pray
     def materialize_provisioned_exports(project)
       symbols = project.manifest.symbols || {}
       planned_provisioned_files(project).each do |file|
+        PathSafety.validate_project_relative_path!(file.path)
         destination = File.join(project.project_root, file.path)
         FileUtils.mkdir_p(File.dirname(destination))
         write_provisioned_file(file.source, destination, symbols)
@@ -76,7 +77,6 @@ module Pray
       if target.scoped && target.mode == "compose"
         return render_scoped_compose(project, target, output)
       end
-
       render_legacy_compose(project, target, output)
     end
 

data/lib/pray/resolve.rb

@@ -187,16 +187,16 @@ module Pray
         return [File.expand_path(local_path, project_root), nil]
       end
       return [File.expand_path(declaration.path, project_root), nil] if declaration.path
+      source_name = ResolveSource.implied_source_name(declaration, sources)
+      if source_name
+        source = sources[source_name]
+        raise Error.resolution("unknown source: #{source_name}") unless source
 
-      if declaration.source
-        source = sources[declaration.source]
-        raise Error.resolution("unknown source: #{declaration.source}") unless source
-
-        if (local_path = user_config.local.source[declaration.source])
+        if (local_path = user_config.local.source[source_name])
           source_root = File.expand_path(local_path, project_root)
           resolved = Registry.resolve_local_registry_package_root(
             project_root,
-            "local:#{declaration.source}",
+            "local:#{source_name}",
             source_root,
             declaration,
             preferred_version: lockfile_preferred_version(lockfile, declaration.name),

data/lib/pray/resolve_source.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Pray
+  module ResolveSource
+    module_function
+
+    def implied_source_name(declaration, sources)
+      return declaration.source if declaration.source
+
+      namespace = package_namespace(declaration.name)
+      return namespace if namespace && sources.key?(namespace)
+
+      case sources.length
+      when 0 then nil
+      when 1 then sources.keys.first
+      else
+        raise Error.resolution(
+          "package #{declaration.name} requires source: when multiple sources are declared " \
+          "and the package namespace does not match a source"
+        )
+      end
+    end
+
+    def package_namespace(name)
+      name.include?("/") ? name.split("/", 2).first : nil
+    end
+  end
+end

data/lib/pray/resource_limits.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Pray
+  module ResourceLimits
+    MAX_ARCHIVE_ENTRIES = 10_000
+    MAX_ARCHIVE_ENTRY_BYTES = 32 * 1024 * 1024
+    MAX_ARCHIVE_TOTAL_BYTES = 64 * 1024 * 1024
+    MAX_HTTP_RESPONSE_BYTES = 64 * 1024 * 1024
+    MAX_SERVE_BODY_BYTES = 16 * 1024 * 1024
+    MAX_SERVE_HEADER_BYTES = 64 * 1024
+    MAX_SERVE_CONCURRENT_CONNECTIONS = 32
+    SERVE_SOCKET_TIMEOUT_SECONDS = 30
+  end
+end

data/lib/pray/serve.rb

@@ -4,12 +4,14 @@ require "socket"
 require "fileutils"
 require "pathname"
 require "json"
+require "timeout"
 require_relative "path_safety"
+require_relative "resource_limits"
 require_relative "serve_federation"
 
 module Pray
   module Serve
-    DEFAULT_MAX_CONNECTIONS = 8
+    DEFAULT_MAX_CONNECTIONS = ResourceLimits::MAX_SERVE_CONCURRENT_CONNECTIONS
 
     module_function
 
@@ -39,7 +41,14 @@ module Pray
     end
 
     def serve_connection(root, socket, connection_slots)
-      handle_connection(root, socket)
+      Timeout.timeout(ResourceLimits::SERVE_SOCKET_TIMEOUT_SECONDS) do
+        handle_connection(root, socket)
+      end
+    rescue Timeout::Error
+      socket.print(request_timeout) unless socket.closed?
+    rescue Error => error
+      response = error.message.include?("request body exceeds") ? payload_too_large : bad_request
+      socket.print(response) unless socket.closed?
     ensure
       connection_slots << true unless connection_slots.closed?
       socket.close unless socket.closed?
@@ -51,7 +60,9 @@ module Pray
 
       method, path, = request_line.split
       headers = read_headers(socket)
-      body_length = headers["content-length"].to_i
+      body_length = Integer(headers.fetch("content-length", "0"), exception: false)
+      raise Error.parse("request", "invalid content length") unless body_length
+      validate_body_length!(body_length)
       body = body_length.positive? ? socket.read(body_length) : ""
 
       response = dispatch_request(root, method, path, body)
@@ -60,9 +71,14 @@ module Pray
 
     def read_headers(socket)
       headers = {}
+      header_bytes = 0
       loop do
         line = socket.gets
         break if line.nil? || line.strip.empty?
+        header_bytes += line.bytesize
+        if header_bytes > ResourceLimits::MAX_SERVE_HEADER_BYTES
+          raise Error.parse("request", "request headers exceed server limit")
+        end
 
         name, value = line.split(":", 2)
         headers[name.strip.downcase] = value.strip if name && value
@@ -70,10 +86,20 @@ module Pray
       headers
     end
 
+    def validate_body_length!(body_length)
+      return if body_length <= ResourceLimits::MAX_SERVE_BODY_BYTES
+
+      raise Error.unsupported(
+        "request body exceeds #{ResourceLimits::MAX_SERVE_BODY_BYTES} bytes"
+      )
+    end
+
     def dispatch_request(root, method, path, body = "")
       path = path.split("?", 2).first
 
       case [method, path]
+      when ["GET", "/health"]
+        return ok_response("text/plain", "ok")
       when ["GET", "/.well-known/pray-federation.json"]
         return ServeFederation.discovery_response(root)
       when ["GET", "/v1/sync/index"]
@@ -89,12 +115,13 @@ module Pray
       return not_found unless method == "GET"
 
       if path == "/"
-        return html_response("<h1>Pray distribution</h1><p>Root: #{root}</p>")
+        return html_response("<h1>Pray distribution</h1>")
       end
 
       file_path = PathSafety.join_under_root(root, path.delete_prefix("/"))
       return not_found unless file_path
       return not_found unless File.file?(file_path)
+      return payload_too_large if File.size(file_path) > ResourceLimits::MAX_HTTP_RESPONSE_BYTES
 
       content_type = content_type_for(file_path)
       file_body = File.binread(file_path)
@@ -126,5 +153,20 @@ module Pray
       body = "too many connections"
       "HTTP/1.1 503 Service Unavailable\r\nContent-Type: text/plain\r\nContent-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}"
     end
+
+    def request_timeout
+      body = "request timed out"
+      "HTTP/1.1 408 Request Timeout\r\nContent-Type: text/plain\r\nContent-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}"
+    end
+
+    def payload_too_large
+      body = "request exceeds server limit"
+      "HTTP/1.1 413 Payload Too Large\r\nContent-Type: text/plain\r\nContent-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}"
+    end
+
+    def bad_request
+      body = "bad request"
+      "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}"
+    end
   end
 end

data/lib/pray/session.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "fileutils"
+require_relative "trust"
 
 module Pray
   SessionFile = Struct.new(
@@ -12,13 +13,14 @@ module Pray
   module Session
     module_function
 
-    def session_file_path(root)
-      File.join(root, ".pray", "session.json")
+    def session_file_path(_root)
+      File.join(Trust.trust_home, "session.json")
     end
 
     def persist(root, session)
       path = session_file_path(root)
       FileUtils.mkdir_p(File.dirname(path))
+      migrate_legacy_session(root, path)
       sessions = load_sessions(path)
       existing = sessions.find { |entry| entry.server_url == session.server_url }
       if existing
@@ -34,12 +36,14 @@ module Pray
       else
         {"sessions" => sessions.map { |entry| session_to_hash(entry) }}
       end
-      File.write(path, JSON.pretty_generate(document))
+      write_document(path, document)
       session
     end
 
     def load_latest(root)
-      sessions = load_sessions(session_file_path(root))
+      path = session_file_path(root)
+      migrate_legacy_session(root, path)
+      sessions = load_sessions(path)
       sessions.reverse.find { |session| !session.email.to_s.strip.empty? }
     end
 
@@ -86,5 +90,33 @@ module Pray
         signer_fingerprint: entry["signer_fingerprint"]
       )
     end
+
+    def migrate_legacy_session(root, path)
+      legacy_path = File.join(root, ".pray", "session.json")
+      return unless File.file?(legacy_path)
+      return if File.expand_path(legacy_path) == File.expand_path(path)
+
+      sessions = load_sessions(path)
+      load_sessions(legacy_path).each do |legacy|
+        sessions << legacy unless sessions.any? { |entry| entry.server_url == legacy.server_url }
+      end
+      document = (sessions.length == 1) ? session_to_hash(sessions.first) : {
+        "sessions" => sessions.map { |entry| session_to_hash(entry) }
+      }
+      FileUtils.mkdir_p(File.dirname(path))
+      write_document(path, document)
+      File.delete(legacy_path)
+    end
+
+    def write_document(path, document)
+      temporary_path = "#{path}.tmp-#{Process.pid}"
+      File.open(temporary_path, File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |file|
+        file.write("#{JSON.pretty_generate(document)}\n")
+        file.flush
+        file.fsync
+      end
+      File.chmod(0o600, temporary_path)
+      File.rename(temporary_path, path)
+    end
   end
 end

data/lib/pray/tar_validation.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require_relative "path_safety"
+require_relative "resource_limits"
+
+module Pray
+  module TarValidation
+    BLOCK_BYTES = 512
+    State = Struct.new(:paths, :entry_count, :total_bytes, :pending_path, keyword_init: true)
+
+    module_function
+
+    def extract!(bytes, output_directory)
+      FileUtils.mkdir_p(output_directory)
+      validate!(bytes, output_directory: output_directory)
+    end
+
+    def validate!(bytes, output_directory: nil)
+      offset = 0
+      state = State.new(paths: {}, entry_count: 0, total_bytes: 0)
+
+      while offset + BLOCK_BYTES <= bytes.bytesize
+        header = bytes.byteslice(offset, BLOCK_BYTES)
+        return if header.bytes.all?(&:zero?)
+
+        verify_checksum!(header)
+        size = parse_octal(header.byteslice(124, 12), "entry size")
+        data_start = offset + BLOCK_BYTES
+        data_end = data_start + size
+        raise Error.integrity("truncated package archive entry") if data_end > bytes.bytesize
+
+        process_entry(header, bytes.byteslice(data_start, size), size, state, output_directory)
+        offset = data_start + ((size + BLOCK_BYTES - 1) / BLOCK_BYTES * BLOCK_BYTES)
+      end
+      raise Error.integrity("package archive is missing its end marker")
+    end
+
+    def process_entry(header, data, size, state, output_directory)
+      type = header.byteslice(156, 1)
+      if type == "x"
+        state.pending_path = pax_path(data)
+        return
+      end
+      if type == "L"
+        state.pending_path = c_string(data).delete_suffix("\n")
+        return
+      end
+
+      raw_path = state.pending_path || header_path(header)
+      state.pending_path = nil
+      return if type == "5" && [".", "./"].include?(raw_path)
+
+      path = PathSafety.validate_archive_member_path!(raw_path)
+      return if File.basename(path).start_with?("._")
+      if type == "5"
+        write_extracted_directory(output_directory, path) if output_directory
+        return
+      end
+      validate_regular_entry!(type, path, size, state)
+      write_extracted_file(output_directory, path, data) if output_directory
+    end
+
+    def validate_regular_entry!(type, path, size, state)
+      raise Error.integrity("unsupported package archive entry type") unless ["0", "\0"].include?(type)
+
+      state.entry_count += 1
+      if state.entry_count > ResourceLimits::MAX_ARCHIVE_ENTRIES
+        raise Error.integrity("package archive exceeds #{ResourceLimits::MAX_ARCHIVE_ENTRIES} entries")
+      end
+      raise Error.integrity("duplicate package archive path: #{path}") if state.paths.key?(path)
+
+      state.paths[path] = true
+      if size > ResourceLimits::MAX_ARCHIVE_ENTRY_BYTES
+        raise Error.integrity("package archive entry exceeds #{ResourceLimits::MAX_ARCHIVE_ENTRY_BYTES} bytes: #{path}")
+      end
+      state.total_bytes += size
+      if state.total_bytes > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+        raise Error.integrity("package archive exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} decompressed bytes")
+      end
+    end
+
+    def write_extracted_directory(output_directory, path)
+      FileUtils.mkdir_p(extracted_destination(output_directory, path))
+    end
+
+    def write_extracted_file(output_directory, path, data)
+      destination = extracted_destination(output_directory, path)
+      FileUtils.mkdir_p(File.dirname(destination))
+      File.open(destination, File::WRONLY | File::CREAT | File::EXCL | File::BINARY) do |file|
+        file.write(data)
+      end
+    end
+
+    def extracted_destination(output_directory, path)
+      destination = File.join(output_directory, path)
+      unless PathSafety.path_under_root?(output_directory, destination)
+        raise Error.integrity("package path escapes package root: #{path}")
+      end
+
+      destination
+    end
+
+    def verify_checksum!(header)
+      stored = parse_octal(header.byteslice(148, 6), "checksum")
+      sum = 0
+      header.bytes.each_with_index do |byte, index|
+        sum += (index >= 148 && index < 156) ? 32 : byte
+      end
+      return if sum == stored
+
+      raise Error.integrity("invalid package archive checksum")
+    end
+
+    def header_path(header)
+      name = c_string(header.byteslice(0, 100))
+      prefix = c_string(header.byteslice(345, 155))
+      prefix.empty? ? name : "#{prefix}/#{name}"
+    end
+
+    def c_string(bytes)
+      bytes.to_s.split("\0", 2).first.to_s.force_encoding(Encoding::UTF_8).tap do |text|
+        raise Error.integrity("invalid package archive path encoding") unless text.valid_encoding?
+      end
+    end
+
+    def parse_octal(bytes, label)
+      value = c_string(bytes).strip
+      raise Error.integrity("invalid package archive #{label}") unless value.match?(/\A[0-7]+\z/)
+
+      value.to_i(8)
+    end
+
+    def pax_path(data)
+      cursor = 0
+      path = nil
+      while cursor < data.bytesize
+        separator = data.index(" ".b, cursor)
+        length = separator && Integer(data.byteslice(cursor, separator - cursor), exception: false)
+        record_end = cursor + length.to_i
+        if !length || length <= 0 || record_end > data.bytesize
+          raise Error.integrity("invalid package archive pax header")
+        end
+        record = data.byteslice(separator + 1, record_end - separator - 2)
+        equals = record.index("=".b)
+        if equals && record.byteslice(0, equals) == "path"
+          value = record.byteslice(equals + 1, record.bytesize - equals - 1).force_encoding(Encoding::UTF_8)
+          raise Error.integrity("invalid package archive path encoding") unless value.valid_encoding?
+
+          path = value
+        end
+        cursor = record_end
+      end
+      path
+    end
+  end
+end

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.9.0"
-  GENERATED_BY = "pray 1.9.0"
+  VERSION = "1.9.2"
+  GENERATED_BY = "pray 1.9.2"
 end

data/lib/pray.rb

@@ -19,12 +19,18 @@ require_relative "pray/dotenv"
 require_relative "pray/project_context"
 require_relative "pray/environment"
 require_relative "pray/resolve_context"
+require_relative "pray/resolve_source"
 require_relative "pray/invocation"
 require_relative "pray/resolve"
 require_relative "pray/render"
 require_relative "pray/verify_position"
 require_relative "pray/verify"
+require_relative "pray/resource_limits"
+require_relative "pray/http_body"
+require_relative "pray/registry_install"
+require_relative "pray/registry_integrity"
 require_relative "pray/registry"
+require_relative "pray/archive_unpack"
 require_relative "pray/archive"
 require_relative "pray/plan"
 require_relative "pray/git_sources"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.9.2
 platform: ruby
 authors:
 - Andrei Makarov
@@ -97,6 +97,7 @@ files:
 - lib/pray-cli.rb
 - lib/pray.rb
 - lib/pray/archive.rb
+- lib/pray/archive_unpack.rb
 - lib/pray/auth_client.rb
 - lib/pray/cli.rb
 - lib/pray/cli/commands/auth.rb
@@ -123,11 +124,13 @@ files:
 - lib/pray/format_serialize.rb
 - lib/pray/git_sources.rb
 - lib/pray/hashing.rb
+- lib/pray/http_body.rb
 - lib/pray/invocation.rb
 - lib/pray/literal.rb
 - lib/pray/lockfile.rb
 - lib/pray/lockfile_serialize.rb
 - lib/pray/manifest.rb
+- lib/pray/manifest_constraint.rb
 - lib/pray/manifest_formatter.rb
 - lib/pray/manifest_json.rb
 - lib/pray/manifest_parser.rb
@@ -140,9 +143,13 @@ files:
 - lib/pray/project_context.rb
 - lib/pray/publish.rb
 - lib/pray/registry.rb
+- lib/pray/registry_install.rb
+- lib/pray/registry_integrity.rb
 - lib/pray/render.rb
 - lib/pray/resolve.rb
 - lib/pray/resolve_context.rb
+- lib/pray/resolve_source.rb
+- lib/pray/resource_limits.rb
 - lib/pray/serve.rb
 - lib/pray/serve_federation.rb
 - lib/pray/session.rb
@@ -150,6 +157,7 @@ files:
 - lib/pray/statement_surface.rb
 - lib/pray/substitute.rb
 - lib/pray/sync.rb
+- lib/pray/tar_validation.rb
 - lib/pray/terminal.rb
 - lib/pray/trust.rb
 - lib/pray/trust_feed.rb