@adrouter/agent 0.1.0-beta.5 → 0.1.0-beta.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/lib/installer.mjs +24 -5
  2. package/lib/manifest.mjs +1 -1
  3. package/package.json +1 -1
  4. package/release-manifest.json +13 -13
package/lib/installer.mjs CHANGED
@@ -79,13 +79,21 @@ export function assertSafeArchiveEntries(entries, archiveRoot = 'AdRouter Agent.
79
79
  typeof entry !== 'string' ||
80
80
  entry.includes('\0') ||
81
81
  entry.startsWith('/') ||
82
+ /^[A-Za-z]:/.test(entry) ||
82
83
  entry.startsWith('\\') ||
83
84
  entry.split(/[\\/]/).includes('..')
84
85
  ) {
85
86
  throw new Error(`Unsafe ZIP entry: ${JSON.stringify(entry)}`);
86
87
  }
87
88
  const normalized = entry.replaceAll('\\', '/').replace(/\/$/, '');
88
- if (normalized !== archiveRoot && !normalized.startsWith(`${archiveRoot}/`)) {
89
+ if (!normalized || normalized.split('/').some((segment) => segment === '' || segment === '.')) {
90
+ throw new Error(`Unsafe ZIP entry: ${JSON.stringify(entry)}`);
91
+ }
92
+ if (
93
+ archiveRoot !== '.' &&
94
+ normalized !== archiveRoot &&
95
+ !normalized.startsWith(`${archiveRoot}/`)
96
+ ) {
89
97
  throw new Error(`Unexpected ZIP layout entry: ${entry}`);
90
98
  }
91
99
  }
@@ -103,8 +111,15 @@ export function assertSafeArchiveSymlink(entry, target, archiveRoot = 'AdRouter
103
111
  ) {
104
112
  throw new Error(`Unsafe ZIP symbolic link target: ${JSON.stringify(target)}`);
105
113
  }
106
- const resolved = posix.resolve('/', posix.dirname(entry), target);
107
- const root = `/${archiveRoot}`;
114
+ const root = archiveRoot === '.' ? '/_archive' : `/${archiveRoot}`;
115
+ const relativeEntry =
116
+ archiveRoot === '.'
117
+ ? entry.split(String.fromCodePoint(92)).join('/')
118
+ : entry
119
+ .split(String.fromCodePoint(92))
120
+ .join('/')
121
+ .slice(archiveRoot.length + 1);
122
+ const resolved = posix.resolve(root, posix.dirname(relativeEntry), target);
108
123
  if (resolved !== root && !resolved.startsWith(`${root}/`)) {
109
124
  throw new Error(`ZIP symbolic link escapes ${archiveRoot}: ${entry} -> ${target}`);
110
125
  }
@@ -252,7 +267,10 @@ async function verifyExtractedTree(root, appPath, archiveRoot) {
252
267
  for (const entry of await readdir(path)) await visit(join(path, entry));
253
268
  }
254
269
  const topLevel = await readdir(root);
255
- if (topLevel.length !== 1 || topLevel[0] !== archiveRoot) {
270
+ if (archiveRoot === '.' && topLevel.length === 0) {
271
+ throw new Error('Release archive is empty after extraction.');
272
+ }
273
+ if (archiveRoot !== '.' && (topLevel.length !== 1 || topLevel[0] !== archiveRoot)) {
256
274
  throw new Error(`Release archive must contain exactly ${archiveRoot}.`);
257
275
  }
258
276
  await visit(appPath);
@@ -518,7 +536,8 @@ export async function install(manifest, options = {}) {
518
536
  const staging = await mkdtemp(join(paths.applicationsDirectory, '.adrouter-agent-staging-'));
519
537
  const archive = join(staging, basename(artifact.assetName));
520
538
  const extracted = join(staging, 'extracted');
521
- const stagedApp = join(extracted, artifact.archiveRoot);
539
+ const stagedApp =
540
+ artifact.archiveRoot === '.' ? extracted : join(extracted, artifact.archiveRoot);
522
541
  const backupPath = join(
523
542
  paths.applicationsDirectory,
524
543
  `.adrouter-agent-backup-${process.pid}-${Date.now()}`
package/lib/manifest.mjs CHANGED
@@ -22,7 +22,7 @@ const ARTIFACTS = Object.freeze({
22
22
  'win32-x64': {
23
23
  platform: 'win32',
24
24
  architectures: ['x64'],
25
- archiveRoot: 'AdRouter Agent-win32-x64',
25
+ archiveRoot: '.',
26
26
  executablePath: 'AdRouter Agent.exe',
27
27
  verificationMode: 'portable-checksum',
28
28
  suffix: 'win32-x64',
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@adrouter/agent",
3
- "version": "0.1.0-beta.5",
3
+ "version": "0.1.0-beta.6",
4
4
  "description": "Verified installer and launcher for the AdRouter Agent desktop application.",
5
5
  "license": "Apache-2.0",
6
6
  "type": "module",
package/release-manifest.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "schema": 3,
3
3
  "distributionMode": "credential-free-portable",
4
- "releaseVersion": "0.1.0-beta.5",
5
- "releaseTag": "v0.1.0-beta.5",
4
+ "releaseVersion": "0.1.0-beta.6",
5
+ "releaseTag": "v0.1.0-beta.6",
6
6
  "repository": "adrouter/adrouterAgent",
7
7
  "bundleIdentifier": "com.adrouter.agent",
8
8
  "bundleShortVersion": "0.1.0",
9
- "bundleVersion": "10005",
9
+ "bundleVersion": "10006",
10
10
  "artifacts": [
11
11
  {
12
12
  "key": "darwin-universal",
@@ -18,9 +18,9 @@
18
18
  "archiveRoot": "AdRouter Agent.app",
19
19
  "executablePath": "Contents/MacOS/AdRouter Agent",
20
20
  "verificationMode": "macos-adhoc",
21
- "assetName": "AdRouter-Agent-0.1.0-beta.5-darwin-universal.zip",
22
- "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.5/AdRouter-Agent-0.1.0-beta.5-darwin-universal.zip",
23
- "sha256": "aeadd409a8173390ef8a02507c557dd979c76e3f11f6cd72a9463fcaf0bca9df"
21
+ "assetName": "AdRouter-Agent-0.1.0-beta.6-darwin-universal.zip",
22
+ "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.6/AdRouter-Agent-0.1.0-beta.6-darwin-universal.zip",
23
+ "sha256": "0b2b2526188e653d9f81daffb5e022508eafe18b4e333021774adf032c22755b"
24
24
  },
25
25
  {
26
26
  "key": "linux-x64",
@@ -31,9 +31,9 @@
31
31
  "archiveRoot": "AdRouter Agent-linux-x64",
32
32
  "executablePath": "AdRouter Agent",
33
33
  "verificationMode": "portable-checksum",
34
- "assetName": "AdRouter-Agent-0.1.0-beta.5-linux-x64.zip",
35
- "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.5/AdRouter-Agent-0.1.0-beta.5-linux-x64.zip",
36
- "sha256": "b9bac9988637fb14b005af2614b2c16ad3301d00b189d38261297d78259402a9"
34
+ "assetName": "AdRouter-Agent-0.1.0-beta.6-linux-x64.zip",
35
+ "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.6/AdRouter-Agent-0.1.0-beta.6-linux-x64.zip",
36
+ "sha256": "d15631c4687f82fecdf1e3b5fb4e669ce2b6358058b8ad53663fcbca376bd646"
37
37
  },
38
38
  {
39
39
  "key": "win32-x64",
@@ -41,12 +41,12 @@
41
41
  "architectures": [
42
42
  "x64"
43
43
  ],
44
- "archiveRoot": "AdRouter Agent-win32-x64",
44
+ "archiveRoot": ".",
45
45
  "executablePath": "AdRouter Agent.exe",
46
46
  "verificationMode": "portable-checksum",
47
- "assetName": "AdRouter-Agent-0.1.0-beta.5-win32-x64.zip",
48
- "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.5/AdRouter-Agent-0.1.0-beta.5-win32-x64.zip",
49
- "sha256": "e6eae7321991e8f661f937a057a64fe77bcd69ff9b263ef9a754f466fd36ff94"
47
+ "assetName": "AdRouter-Agent-0.1.0-beta.6-win32-x64.zip",
48
+ "assetUrl": "https://github.com/adrouter/adrouterAgent/releases/download/v0.1.0-beta.6/AdRouter-Agent-0.1.0-beta.6-win32-x64.zip",
49
+ "sha256": "03ed2ccaef279befdd333a2a577f3f9f8efe5265f136450097cd4bd0981aa57a"
50
50
  }
51
51
  ]
52
52
  }