@adrouter/agent 0.1.0-beta.4 → 0.1.0-beta.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/lib/installer.mjs +30 -7
  2. package/lib/manifest.mjs +1 -1
  3. package/package.json +1 -1
  4. package/release-manifest.json +13 -13
package/lib/installer.mjs CHANGED
@@ -79,13 +79,21 @@ export function assertSafeArchiveEntries(entries, archiveRoot = 'AdRouter Agent.
79
79
  typeof entry !== 'string' ||
80
80
  entry.includes('\0') ||
81
81
  entry.startsWith('/') ||
82
+ /^[A-Za-z]:/.test(entry) ||
82
83
  entry.startsWith('\\') ||
83
84
  entry.split(/[\\/]/).includes('..')
84
85
  ) {
85
86
  throw new Error(`Unsafe ZIP entry: ${JSON.stringify(entry)}`);
86
87
  }
87
88
  const normalized = entry.replaceAll('\\', '/').replace(/\/$/, '');
88
- if (normalized !== archiveRoot && !normalized.startsWith(`${archiveRoot}/`)) {
89
+ if (!normalized || normalized.split('/').some((segment) => segment === '' || segment === '.')) {
90
+ throw new Error(`Unsafe ZIP entry: ${JSON.stringify(entry)}`);
91
+ }
92
+ if (
93
+ archiveRoot !== '.' &&
94
+ normalized !== archiveRoot &&
95
+ !normalized.startsWith(`${archiveRoot}/`)
96
+ ) {
89
97
  throw new Error(`Unexpected ZIP layout entry: ${entry}`);
90
98
  }
91
99
  }
@@ -103,8 +111,15 @@ export function assertSafeArchiveSymlink(entry, target, archiveRoot = 'AdRouter
103
111
  ) {
104
112
  throw new Error(`Unsafe ZIP symbolic link target: ${JSON.stringify(target)}`);
105
113
  }
106
- const resolved = posix.resolve('/', posix.dirname(entry), target);
107
- const root = `/${archiveRoot}`;
114
+ const root = archiveRoot === '.' ? '/_archive' : `/${archiveRoot}`;
115
+ const relativeEntry =
116
+ archiveRoot === '.'
117
+ ? entry.split(String.fromCodePoint(92)).join('/')
118
+ : entry
119
+ .split(String.fromCodePoint(92))
120
+ .join('/')
121
+ .slice(archiveRoot.length + 1);
122
+ const resolved = posix.resolve(root, posix.dirname(relativeEntry), target);
108
123
  if (resolved !== root && !resolved.startsWith(`${root}/`)) {
109
124
  throw new Error(`ZIP symbolic link escapes ${archiveRoot}: ${entry} -> ${target}`);
110
125
  }
@@ -252,7 +267,10 @@ async function verifyExtractedTree(root, appPath, archiveRoot) {
252
267
  for (const entry of await readdir(path)) await visit(join(path, entry));
253
268
  }
254
269
  const topLevel = await readdir(root);
255
- if (topLevel.length !== 1 || topLevel[0] !== archiveRoot) {
270
+ if (archiveRoot === '.' && topLevel.length === 0) {
271
+ throw new Error('Release archive is empty after extraction.');
272
+ }
273
+ if (archiveRoot !== '.' && (topLevel.length !== 1 || topLevel[0] !== archiveRoot)) {
256
274
  throw new Error(`Release archive must contain exactly ${archiveRoot}.`);
257
275
  }
258
276
  await visit(appPath);
@@ -315,8 +333,10 @@ async function download(manifest, artifact, destination, fetchImpl = fetch) {
315
333
  async function archiveEntries(zipPath, artifact, executeImpl = execute) {
316
334
  if (artifact.platform === 'win32') {
317
335
  const script =
336
+ '& { param([string]$zipPath) ' +
318
337
  'Add-Type -AssemblyName System.IO.Compression.FileSystem; ' +
319
- '$z=[IO.Compression.ZipFile]::OpenRead($args[0]); try {$z.Entries.FullName} finally {$z.Dispose()}';
338
+ '$z=[IO.Compression.ZipFile]::OpenRead($zipPath); ' +
339
+ 'try {$z.Entries.FullName} finally {$z.Dispose()} }';
320
340
  const { stdout } = await executeImpl('powershell.exe', [
321
341
  '-NoProfile',
322
342
  '-NonInteractive',
@@ -348,7 +368,9 @@ async function extractArchive(archive, extracted, artifact, executeImpl) {
348
368
  } else if (artifact.platform === 'linux') {
349
369
  await executeImpl('/usr/bin/unzip', ['-q', archive, '-d', extracted]);
350
370
  } else {
351
- const script = 'Expand-Archive -LiteralPath $args[0] -DestinationPath $args[1] -Force';
371
+ const script =
372
+ '& { param([string]$archive, [string]$destination) ' +
373
+ 'Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }';
352
374
  await executeImpl('powershell.exe', [
353
375
  '-NoProfile',
354
376
  '-NonInteractive',
@@ -514,7 +536,8 @@ export async function install(manifest, options = {}) {
514
536
  const staging = await mkdtemp(join(paths.applicationsDirectory, '.adrouter-agent-staging-'));
515
537
  const archive = join(staging, basename(artifact.assetName));
516
538
  const extracted = join(staging, 'extracted');
517
- const stagedApp = join(extracted, artifact.archiveRoot);
539
+ const stagedApp =
540
+ artifact.archiveRoot === '.' ? extracted : join(extracted, artifact.archiveRoot);
518
541
  const backupPath = join(
519
542
  paths.applicationsDirectory,
520
543
  `.adrouter-agent-backup-${process.pid}-${Date.now()}`
package/lib/manifest.mjs CHANGED
@@ -22,7 +22,7 @@ const ARTIFACTS = Object.freeze({
22
22
  'win32-x64': {
23
23
  platform: 'win32',
24
24
  architectures: ['x64'],
25
- archiveRoot: 'AdRouter Agent-win32-x64',
25
+ archiveRoot: '.',
26
26
  executablePath: 'AdRouter Agent.exe',
27
27
  verificationMode: 'portable-checksum',
28
28
  suffix: 'win32-x64',
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@adrouter/agent",
3
- "version": "0.1.0-beta.4",
3
+ "version": "0.1.0-beta.6",
4
4
  "description": "Verified installer and launcher for the AdRouter Agent desktop application.",
5
5
  "license": "Apache-2.0",
6
6
  "type": "module",
package/release-manifest.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "schema": 3,
3
3
  "distributionMode": "credential-free-portable",
4
- "releaseVersion": "0.1.0-beta.4",
5
- "releaseTag": "v0.1.0-beta.4",
4
+ "releaseVersion": "0.1.0-beta.6",
5
+ "releaseTag": "v0.1.0-beta.6",
6
6
  "repository": "adrouter/adrouterAgent",
7
7
  "bundleIdentifier": "com.adrouter.agent",
8
8
  "bundleShortVersion": "0.1.0",
9
- "bundleVersion": "10004",
9
+ "bundleVersion": "10006",
10
10
  "artifacts": [
11
11
  {
12
12
  "key": "darwin-universal",
@@ -18,9 +18,9 @@
18
18
  "archiveRoot": "AdRouter Agent.app",
19
19
  "executablePath": "Contents/MacOS/AdRouter Agent",
20
20
  "verificationMode": "macos-adhoc",
21
- "assetName": "AdRouter-Agent-0.1.0-beta.4-darwin-universal.zip",
22
- "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.4/AdRouter-Agent-0.1.0-beta.4-darwin-universal.zip",
23
- "sha256": "8ef05bc2098f4ac9c8ecff943ee64e0e76389c5e69e3a2fd165a42edad7df48d"
21
+ "assetName": "AdRouter-Agent-0.1.0-beta.6-darwin-universal.zip",
22
+ "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.6/AdRouter-Agent-0.1.0-beta.6-darwin-universal.zip",
23
+ "sha256": "0b2b2526188e653d9f81daffb5e022508eafe18b4e333021774adf032c22755b"
24
24
  },
25
25
  {
26
26
  "key": "linux-x64",
@@ -31,9 +31,9 @@
31
31
  "archiveRoot": "AdRouter Agent-linux-x64",
32
32
  "executablePath": "AdRouter Agent",
33
33
  "verificationMode": "portable-checksum",
34
- "assetName": "AdRouter-Agent-0.1.0-beta.4-linux-x64.zip",
35
- "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.4/AdRouter-Agent-0.1.0-beta.4-linux-x64.zip",
36
- "sha256": "85b81bab36458938f74afd2d0de30150cbd1bd7c5e92f20f6cc65cb1d36e2346"
34
+ "assetName": "AdRouter-Agent-0.1.0-beta.6-linux-x64.zip",
35
+ "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.6/AdRouter-Agent-0.1.0-beta.6-linux-x64.zip",
36
+ "sha256": "d15631c4687f82fecdf1e3b5fb4e669ce2b6358058b8ad53663fcbca376bd646"
37
37
  },
38
38
  {
39
39
  "key": "win32-x64",
@@ -41,12 +41,12 @@
41
41
  "architectures": [
42
42
  "x64"
43
43
  ],
44
- "archiveRoot": "AdRouter Agent-win32-x64",
44
+ "archiveRoot": ".",
45
45
  "executablePath": "AdRouter Agent.exe",
46
46
  "verificationMode": "portable-checksum",
47
- "assetName": "AdRouter-Agent-0.1.0-beta.4-win32-x64.zip",
48
- "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.4/AdRouter-Agent-0.1.0-beta.4-win32-x64.zip",
49
- "sha256": "f5cefd74b561511642832aa9e17b00a2dc3034bbb00467b09aaeca0818e4c443"
47
+ "assetName": "AdRouter-Agent-0.1.0-beta.6-win32-x64.zip",
48
+ "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.6/AdRouter-Agent-0.1.0-beta.6-win32-x64.zip",
49
+ "sha256": "03ed2ccaef279befdd333a2a577f3f9f8efe5265f136450097cd4bd0981aa57a"
50
50
  }
51
51
  ]
52
52
  }