@ahood/cli 0.12.0 → 0.12.1

package/dist/archive-entries.js

@@ -0,0 +1,59 @@
+import { posix } from "node:path";
+import * as tarStream from "tar-stream";
+import { sanitizeForTerminal } from "./terminal-safe.js";
+// AlexKay28/ahood#792 -- the one archive-entry path rule, mirroring the
+// server's lib/publish/entry-path.ts. `SKILL.md` and `././SKILL.md` used to be
+// two entries to the server (which reads the FIRST) but one file to
+// extractTarGz (resolve() collapsed them and the LAST write won), so a hidden
+// later duplicate could overwrite the reviewed file at install. Every
+// extractor now refuses such an archive up front instead.
+/** True when `path` is already a canonical relative POSIX path: non-empty,
+ *  no backslash or NUL, not absolute, no empty / "." / ".." segment, and
+ *  unchanged by posix.normalize. */
+export function isCanonicalEntryPath(path) {
+    if (path === "" || path.includes("\\") || path.includes("\0"))
+        return false;
+    if (posix.isAbsolute(path) || posix.normalize(path) !== path)
+        return false;
+    return path.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+/** A tar header name relative to the archive root. `tar -C dir .` names
+ *  every entry `./x`, so exactly ONE leading "./" is dropped; whatever
+ *  remains must already be canonical (`././x` is rejected, not collapsed). */
+export function tarEntryPath(headerName) {
+    return headerName.startsWith("./") ? headerName.slice(2) : headerName;
+}
+/** Walks every header of an already-decompressed tar and throws unless each
+ *  non-directory entry has a canonical, unique path. Runs before an extractor
+ *  writes or returns anything, so a bad entry anywhere refuses the whole
+ *  archive. Directory entries (`./`, `./scripts/`) are not files and are
+ *  skipped. */
+export async function assertCanonicalEntryPaths(tar) {
+    const seen = new Set();
+    const extract = tarStream.extract();
+    await new Promise((resolvePromise, reject) => {
+        extract.on("entry", (header, stream, next) => {
+            stream.resume();
+            if (header.type === "directory") {
+                next();
+                return;
+            }
+            const path = tarEntryPath(header.name);
+            const problem = !isCanonicalEntryPath(path)
+                ? `Refusing to extract unsafe archive entry: ${sanitizeForTerminal(header.name)} (not a canonical relative path)`
+                : seen.has(path)
+                    ? `Refusing to extract archive: it has more than one entry for "${sanitizeForTerminal(path)}"`
+                    : null;
+            if (problem) {
+                reject(new Error(problem));
+                extract.destroy();
+                return;
+            }
+            seen.add(path);
+            next();
+        });
+        extract.on("finish", () => resolvePromise());
+        extract.on("error", reject);
+        extract.end(tar);
+    });
+}

package/dist/commands/add.js

@@ -8,6 +8,7 @@ import { LOCKFILE_PATH, parseOwnerSkillVersion, skillDir, agentPath, pinnedFileP
 import { readLockfile, withLock, writeFileAtomic, writeJsonFileAtomic, writeLockfileEntryVerifyingChecksum, LockfileChecksumConflictError, } from "../lockfile.js";
 import { promptSecret } from "../secret-prompt.js";
 import { sanitizeForTerminal } from "../terminal-safe.js";
+import { assertCanonicalEntryPaths, tarEntryPath } from "../archive-entries.js";
 import { UsageError } from "../usage-error.js";
 import { assertKind, describeKind, isPinnedFileKind, KINDS, strictKind } from "../kinds.js";
 const USAGE = "Usage: ahood skill add <owner>/<skill>[@version]";
@@ -92,6 +93,10 @@ export async function extractTarGz(buffer, destDir) {
     catch (error) {
         throw new Error(`Archive decompresses to more than ${MAX_EXTRACTED_BYTES / (1024 * 1024)} MB, or is not valid gzip -- refusing to extract.`, { cause: error });
     }
+    // Every entry path is canonical and unique before the first write
+    // (AlexKay28/ahood#792): otherwise `././SKILL.md` lands on SKILL.md and the
+    // last of the two wins, while the server validated the first.
+    await assertCanonicalEntryPaths(decompressed);
     const extract = tarStream.extract();
     const resolvedDest = resolve(destDir);
     let entryCount = 0;
@@ -112,7 +117,7 @@ export async function extractTarGz(buffer, destDir) {
             // segments (and, on Windows, drive-absolute and backslash-separated
             // names) so the comparison catches every escape shape, not just a
             // literal leading "../".
-            const entryPath = header.name.replace(/^\.\//, "");
+            const entryPath = tarEntryPath(header.name);
             const fullPath = resolve(destDir, entryPath);
             if (fullPath !== resolvedDest && !fullPath.startsWith(resolvedDest + sep)) {
                 stream.resume();
@@ -198,27 +203,20 @@ export async function extractSingleFileContent(buffer, entryName) {
     catch (error) {
         throw new Error(`Archive decompresses to more than ${MAX_EXTRACTED_BYTES / (1024 * 1024)} MB, or is not valid gzip -- refusing to extract.`, { cause: error });
     }
+    // A duplicate or non-canonical entry anywhere refuses the archive, rather
+    // than this reader and extractTarGz picking different copies of one file
+    // (AlexKay28/ahood#792; this used to take the first, extractTarGz the last).
+    await assertCanonicalEntryPaths(decompressed);
     const extract = tarStream.extract();
     let found = null;
     await new Promise((resolvePromise, reject) => {
         extract.on("entry", (header, stream, next) => {
-            // Normalize a leading "./" the same way extractTarGz and the server's
-            // extract-and-checksum.ts normalizeEntryPath do -- a plain `tar czf`
-            // commonly prefixes entries with "./", which would otherwise pass
-            // server-side validation/publish but then fail to install here with
-            // "AGENT.md not found" (ahood-cli final review finding #3).
-            const normalizedName = header.name.replace(/^\.\//, "");
-            if (normalizedName !== entryName) {
-                stream.resume();
-                next();
-                return;
-            }
-            // Only take the FIRST matching entry, mirroring the server side's
-            // `files.find(...)` lookup -- otherwise a tar with two entries at the
-            // same normalized name would resolve to whichever one happens to come
-            // last here, diverging from what the server validated against
-            // (ahood-cli final review finding #4).
-            if (found !== null) {
+            // Drop tar's one leading "./" the same way extractTarGz and the server
+            // do -- a plain `tar czf` commonly prefixes entries with "./", which
+            // would otherwise pass server-side validation/publish but then fail to
+            // install here with "AGENT.md not found" (ahood-cli final review
+            // finding #3).
+            if (header.type === "directory" || tarEntryPath(header.name) !== entryName) {
                 stream.resume();
                 next();
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahood/cli",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "CLI for ahood, a registry for installing and publishing Claude Code skills.",
   "license": "MIT",
   "homepage": "https://github.com/AlexKay28/ahood-cli",