@astrale-os/cli 1.0.0-beta.14 → 1.0.0-beta.15

package/dist/astrale.js

@@ -2578,7 +2578,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@astrale-os/cli",
-    version: "1.0.0-beta.14",
+    version: "1.0.0-beta.15",
     description: "Astrale CLI — connect to existing Astrale kernels",
     keywords: [
       "astrale",
@@ -83655,7 +83655,10 @@ async function readRegistry(commit, fetcher) {
   return { name: root.name ?? "astrale-ui", homepage: root.homepage, items: installable };
 }
 async function resolveRegistryItems(source2, sourceUrl, commit, fetcher, visited) {
-  const direct = Array.isArray(source2.items) ? source2.items : [];
+  const releaseRoot = RAW + "/" + commit + "/";
+  const sourceRelative = sourceUrl.slice(releaseRoot.length);
+  const sourceDirectory = sourceRelative.slice(0, Math.max(0, sourceRelative.lastIndexOf("/")));
+  const direct = Array.isArray(source2.items) ? source2.items.map((item) => qualifyRegistryItemPaths(item, sourceDirectory)) : [];
   const includes = source2.include ?? [];
   if (!Array.isArray(includes)) {
     throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI registry include must be an array.");
@@ -83664,12 +83667,12 @@ async function resolveRegistryItems(source2, sourceUrl, commit, fetcher, visited
     throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI registry contains too many included documents.");
   }
   const nested = await Promise.all(includes.map(async (include) => {
-    if (typeof include !== "string" || include.startsWith("/") || !include.endsWith("registry.json") || include.split("/").includes("..")) {
+    if (typeof include !== "string" || !isSafeRelative2(include) || !/^[A-Za-z0-9._/-]+$/u.test(include) || !include.endsWith("registry.json") || include === "registry.json") {
       throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI registry contains an unsafe include.");
     }
+    const sourceDirectoryUrl = sourceUrl.slice(0, sourceUrl.lastIndexOf("/") + 1);
     const url3 = new URL(include, sourceUrl).toString();
-    const releaseRoot = RAW + "/" + commit + "/";
-    if (!url3.startsWith(releaseRoot) || visited.has(url3)) {
+    if (url3 !== sourceDirectoryUrl + include || !url3.startsWith(releaseRoot) || !url3.startsWith(sourceDirectoryUrl) || visited.has(url3)) {
       throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI registry include escaped or repeated the release snapshot.");
     }
     visited.add(url3);
@@ -83678,6 +83681,33 @@ async function resolveRegistryItems(source2, sourceUrl, commit, fetcher, visited
   }));
   return direct.concat(nested.flat());
 }
+function qualifyRegistryItemPaths(item, sourceDirectory) {
+  if (!item || typeof item !== "object")
+    return item;
+  const candidate2 = item;
+  if (!Array.isArray(candidate2.files))
+    return item;
+  return {
+    ...candidate2,
+    files: candidate2.files.map((file2) => {
+      if (!file2 || typeof file2 !== "object")
+        return file2;
+      const candidateFile = file2;
+      if (typeof candidateFile.path !== "string")
+        return file2;
+      if (!isSafeRelative2(candidateFile.path) || sourceDirectory !== "" && (candidateFile.path === sourceDirectory || candidateFile.path.startsWith(sourceDirectory + "/"))) {
+        throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI registry contains an invalid installable item path.");
+      }
+      if (sourceDirectory === "")
+        return file2;
+      const qualified = sourceDirectory + "/" + candidateFile.path;
+      if (!isSafeRelative2(qualified)) {
+        throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI registry contains an invalid installable item path.");
+      }
+      return { ...candidateFile, path: qualified };
+    })
+  };
+}
 function isInstallableItem(item) {
   if (!item || typeof item !== "object")
     return false;
@@ -83695,7 +83725,11 @@ async function readUiRegistryItem(release, expected, fetcher = fetch) {
   return item;
 }
 function isSafeRelative2(value3) {
-  return value3.length > 0 && !value3.startsWith("/") && !/^[A-Za-z]:[\\/]/u.test(value3) && !value3.includes("\\") && !value3.split("/").includes("..");
+  const segments = value3.split("/");
+  return value3.length > 0 && !value3.startsWith("/") && !/^[A-Za-z]:[\\/]/u.test(value3) && !value3.includes("\\") && !/[?#%]/u.test(value3) && ![...value3].some((character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code <= 31 || code === 127;
+  }) && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
 function registryItemUrl(release, itemName) {
   return RAW + "/" + release.commit + "/registry/public/r/" + encodeURIComponent(itemName) + ".json";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.14",
+  "version": "1.0.0-beta.15",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",

package/src/commands/ui/__tests__/commands.test.ts

@@ -135,7 +135,14 @@ function mockFetch(seen: string[] = []): typeof fetch {
       })
     }
     if (url.endsWith('/registry/patterns/chart/registry.json')) {
-      return Response.json({ items: [item] })
+      return Response.json({
+        items: [
+          {
+            ...item,
+            files: item.files.map((file) => ({ ...file, path: 'line-basic.tsx' })),
+          },
+        ],
+      })
     }
     if (url.endsWith('/registry.json')) {
       return Response.json({ include: ['registry/patterns/chart/registry.json'] })

package/src/ui/__tests__/ui.test.ts

@@ -19,7 +19,7 @@ const registry: UiRegistry = {
       description: 'A controlled chart.',
       files: [
         {
-          path: 'registry/patterns/chart/line-basic.tsx',
+          path: 'line-basic.tsx',
           type: 'registry:component',
           target: 'components/astrale/pattern/chart/line-basic.tsx',
         },
@@ -79,6 +79,7 @@ function builtItem(item: UiRegistry['items'][number]) {
     ...item,
     files: item.files.map((file, index) => ({
       ...file,
+      path: `registry/patterns/chart/${file.path}`,
       content: index === 0 ? 'export const Chart = true\n' : 'export const Summary = true\n',
     })),
   }
@@ -152,6 +153,7 @@ describe('UI release and runner contracts', () => {
     expect(release.commit).toBe(commit)
     expect(release.compatibility.base).toBe('base')
     expect(release.registry.items).toHaveLength(1)
+    expect(release.registry.items[0]?.files[0]?.path).toBe('registry/patterns/chart/line-basic.tsx')
     expect(seen.filter((url) => new URL(url).hostname === 'raw.githubusercontent.com')).toEqual(
       expect.arrayContaining([
         expect.stringContaining('/' + commit + '/tooling/compatibility.json'),
@@ -193,6 +195,114 @@ describe('UI release and runner contracts', () => {
     expect(seen.some((url) => url.endsWith('/registry/registry.json'))).toBe(false)
   })
 
+  test('rejects noncanonical and encoded registry includes before fetching them', async () => {
+    const unsafeIncludes = [
+      '%2e%2e/other/registry.json',
+      'registry/%2Fother/registry.json',
+      'registry/other/registry.json?raw=1',
+      'registry/other/registry.json#item',
+      'https://example.invalid/registry.json',
+      './registry/other/registry.json',
+    ]
+
+    for (const include of unsafeIncludes) {
+      const seen: string[] = []
+      const fallback = mockFetch(seen)
+      const fetcher = (async (input: string | URL | Request, init?: RequestInit) => {
+        const url = String(input)
+        if (url.endsWith('/' + commit + '/registry.json')) {
+          return Response.json({ include: [include] })
+        }
+        return fallback(input, init)
+      }) as typeof fetch
+
+      await expect(resolveUiRelease('0.3.0-beta.0', fetcher)).rejects.toMatchObject({
+        code: 'UI_REGISTRY_UNAVAILABLE',
+      })
+      expect(seen.some((url) => url.includes('example.invalid') || url.includes('/other/'))).toBe(
+        false,
+      )
+    }
+  })
+
+  test('rejects malformed and already-qualified family-local item paths', async () => {
+    const unsafePaths = [
+      '',
+      '/absolute.tsx',
+      'C:/windows.tsx',
+      './line-basic.tsx',
+      '../line-basic.tsx',
+      '%2e%2e/line-basic.tsx',
+      'registry/patterns/chart/line-basic.tsx',
+    ]
+
+    for (const unsafePath of unsafePaths) {
+      const supplied = structuredClone(registry)
+      supplied.items[0]!.files[0]!.path = unsafePath
+      await expect(resolveUiRelease('0.3.0-beta.0', mockFetch([], supplied))).rejects.toMatchObject(
+        {
+          code: 'UI_REGISTRY_UNAVAILABLE',
+        },
+      )
+    }
+  })
+
+  test('qualifies every item file relative to its declaring nested registry', async () => {
+    const rootItem = {
+      ...structuredClone(registry.items[0]!),
+      name: 'pattern-chart-root',
+      files: [
+        {
+          ...structuredClone(registry.items[0]!.files[0]!),
+          path: 'registry/root.tsx',
+          target: 'components/astrale/pattern/chart/root.tsx',
+        },
+      ],
+      meta: { canonicalAddress: 'pattern/chart/root' },
+    }
+    const chartItem = {
+      ...structuredClone(registry.items[0]!),
+      files: [
+        structuredClone(registry.items[0]!.files[0]!),
+        {
+          ...structuredClone(registry.items[0]!.files[0]!),
+          path: 'parts/legend.tsx',
+          target: 'components/astrale/pattern/chart/parts/legend.tsx',
+        },
+      ],
+    }
+    const nestedItem = {
+      ...structuredClone(registry.items[0]!),
+      name: 'pattern-chart-nested-line',
+      files: [structuredClone(registry.items[0]!.files[0]!)],
+      meta: { canonicalAddress: 'pattern/chart/nested-line' },
+    }
+    const fallback = mockFetch()
+    const fetcher = (async (input: string | URL | Request, init?: RequestInit) => {
+      const url = String(input)
+      if (url.endsWith('/' + commit + '/registry.json')) {
+        return Response.json({
+          items: [rootItem],
+          include: ['registry/patterns/chart/registry.json'],
+        })
+      }
+      if (url.endsWith('/registry/patterns/chart/registry.json')) {
+        return Response.json({ items: [chartItem], include: ['nested/registry.json'] })
+      }
+      if (url.endsWith('/registry/patterns/chart/nested/registry.json')) {
+        return Response.json({ items: [nestedItem] })
+      }
+      return fallback(input, init)
+    }) as typeof fetch
+
+    const release = await resolveUiRelease('0.3.0-beta.0', fetcher)
+    expect(release.registry.items.map((item) => item.files.map((file) => file.path))).toEqual([
+      ['registry/root.tsx'],
+      ['registry/patterns/chart/line-basic.tsx', 'registry/patterns/chart/parts/legend.tsx'],
+      ['registry/patterns/chart/nested/line-basic.tsx'],
+    ])
+  })
+
   /** @evidence TEST-CLI-UI-BOUNDED-REMOTE-DOCUMENTS */
   test('bounds and normalizes malformed registry responses', async () => {
     const fallback = mockFetch()
@@ -537,7 +647,7 @@ describe('UI source operations', () => {
           files: [
             registry.items[0]!.files[0]!,
             {
-              path: 'registry/patterns/chart/summary.tsx',
+              path: 'summary.tsx',
               type: 'registry:component',
               target: 'components/astrale/pattern/chart/summary.tsx',
             },

package/src/ui/release.ts

@@ -152,7 +152,12 @@ async function resolveRegistryItems(
   fetcher: Fetch,
   visited: Set<string>,
 ): Promise<unknown[]> {
-  const direct = Array.isArray(source.items) ? source.items : []
+  const releaseRoot = RAW + '/' + commit + '/'
+  const sourceRelative = sourceUrl.slice(releaseRoot.length)
+  const sourceDirectory = sourceRelative.slice(0, Math.max(0, sourceRelative.lastIndexOf('/')))
+  const direct = Array.isArray(source.items)
+    ? source.items.map((item) => qualifyRegistryItemPaths(item, sourceDirectory))
+    : []
   const includes = source.include ?? []
   if (!Array.isArray(includes)) {
     throw new UiError('UI_REGISTRY_UNAVAILABLE', 'UI registry include must be an array.')
@@ -167,15 +172,21 @@ async function resolveRegistryItems(
     includes.map(async (include) => {
       if (
         typeof include !== 'string' ||
-        include.startsWith('/') ||
+        !isSafeRelative(include) ||
+        !/^[A-Za-z0-9._/-]+$/u.test(include) ||
         !include.endsWith('registry.json') ||
-        include.split('/').includes('..')
+        include === 'registry.json'
       ) {
         throw new UiError('UI_REGISTRY_UNAVAILABLE', 'UI registry contains an unsafe include.')
       }
+      const sourceDirectoryUrl = sourceUrl.slice(0, sourceUrl.lastIndexOf('/') + 1)
       const url = new URL(include, sourceUrl).toString()
-      const releaseRoot = RAW + '/' + commit + '/'
-      if (!url.startsWith(releaseRoot) || visited.has(url)) {
+      if (
+        url !== sourceDirectoryUrl + include ||
+        !url.startsWith(releaseRoot) ||
+        !url.startsWith(sourceDirectoryUrl) ||
+        visited.has(url)
+      ) {
         throw new UiError(
           'UI_REGISTRY_UNAVAILABLE',
           'UI registry include escaped or repeated the release snapshot.',
@@ -189,6 +200,40 @@ async function resolveRegistryItems(
   return direct.concat(nested.flat())
 }
 
+function qualifyRegistryItemPaths(item: unknown, sourceDirectory: string): unknown {
+  if (!item || typeof item !== 'object') return item
+  const candidate = item as { files?: unknown }
+  if (!Array.isArray(candidate.files)) return item
+  return {
+    ...candidate,
+    files: candidate.files.map((file) => {
+      if (!file || typeof file !== 'object') return file
+      const candidateFile = file as { path?: unknown }
+      if (typeof candidateFile.path !== 'string') return file
+      if (
+        !isSafeRelative(candidateFile.path) ||
+        (sourceDirectory !== '' &&
+          (candidateFile.path === sourceDirectory ||
+            candidateFile.path.startsWith(sourceDirectory + '/')))
+      ) {
+        throw new UiError(
+          'UI_REGISTRY_UNAVAILABLE',
+          'UI registry contains an invalid installable item path.',
+        )
+      }
+      if (sourceDirectory === '') return file
+      const qualified = sourceDirectory + '/' + candidateFile.path
+      if (!isSafeRelative(qualified)) {
+        throw new UiError(
+          'UI_REGISTRY_UNAVAILABLE',
+          'UI registry contains an invalid installable item path.',
+        )
+      }
+      return { ...candidateFile, path: qualified }
+    }),
+  }
+}
+
 function isInstallableItem(item: unknown): item is UiRegistry['items'][number] {
   if (!item || typeof item !== 'object') return false
   const candidate = item as Partial<UiRegistry['items'][number]>
@@ -256,12 +301,18 @@ export async function readUiRegistryItem(
 }
 
 function isSafeRelative(value: string): boolean {
+  const segments = value.split('/')
   return (
     value.length > 0 &&
     !value.startsWith('/') &&
     !/^[A-Za-z]:[\\/]/u.test(value) &&
     !value.includes('\\') &&
-    !value.split('/').includes('..')
+    !/[?#%]/u.test(value) &&
+    ![...value].some((character) => {
+      const code = character.codePointAt(0) ?? 0
+      return code <= 31 || code === 127
+    }) &&
+    segments.every((segment) => segment.length > 0 && segment !== '.' && segment !== '..')
   )
 }