@avantf/dsh-plugin-base 0.3.1 → 0.4.0

package/dist/providers/model.js

@@ -3,21 +3,42 @@
  * @module providers/model
  */
 import { createHash } from 'node:crypto';
+import { once } from 'node:events';
+import { createWriteStream } from 'node:fs';
 import { basename, dirname, join, relative, resolve } from 'node:path';
+import { finished } from 'node:stream/promises';
 import { ProvisionError } from '../errors.js';
 import { ATOMIC_TEMP_PREFIX, exists, sweepAtomicTemps } from '../fs.js';
 import { isInside, lockPath } from '../layout.js';
 import { defaultLock } from '../lock.js';
-import { fetchImplOf, readCapped, signalFor } from '../net.js';
+import { METADATA_MAX_BYTES, SPILL_THRESHOLD_BYTES, fetchImplOf, readCapped, readCappedOrSpill, signalFor } from '../net.js';
 export const MODEL_CACHE_KIND = 'model-cache';
 const DEFAULT_ENDPOINT = 'https://huggingface.co';
 const DEFAULT_REVISION = 'main';
-/** Maximum bytes read for a single model file. */
-const MAX_MODEL_BYTES = 4 * 1024 * 1024 * 1024;
+/**
+ * Maximum bytes read for a single model file.
+ *
+ * 2 GiB, not the old 4 GiB. The cap is the number of bytes the MEMORY path would have to hold TWICE
+ * (the received chunks plus the joined copy), so it bounds the worst-case spike directly; the measured
+ * ~2× peak for a body of this size is ~4 GiB, which a 16 GB machine survives and a 4 GiB cap does not.
+ * 2 GiB is also still far above what the framework is for: a real `bge-small` is ~90 MB and even a
+ * multi-billion-parameter checkpoint is a handful of files well under this. Anything larger wants a
+ * different transport, not a bigger heap.
+ *
+ * (The review's "4 GiB is exactly Node's `kMaxLength`" does NOT reproduce on the target runtime:
+ * Node 22.23.2 / linux-x64 reports `buffer.constants.MAX_LENGTH` 2^53−1 and allocates a 4 GiB
+ * `Uint8Array` fine. The rejection boundary is a legitimate design choice here, not a crash we are
+ * ducking — see the report accompanying this change.)
+ */
+export const MAX_MODEL_BYTES = 2 * 1024 * 1024 * 1024;
 /** How long the placement lock waits before reporting `lock/timeout`. */
 const LOCK_TIMEOUT_MS = 15_000;
-/** A placement lock older than this whose pid is gone is reclaimed. */
-const STALE_LOCK_MS = 60_000;
+/**
+ * A placement lock older than this whose pid is gone is reclaimed. It is ALSO the mtime age at which
+ * a waiter warns about a LIVE holder, so it must stay BELOW `LOCK_TIMEOUT_MS`; at `60_000` the
+ * waiter timed out first and the warning was dead code (P15). Live holders are never reclaimed.
+ */
+const STALE_LOCK_MS = 10_000;
 /** A resolved commit id: 40 or 64 lowercase hex. */
 const SHA_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 /** A content-addressed blob name: sha256 lowercase hex. */
@@ -26,6 +47,8 @@ const BLOB_PATTERN = /^[0-9a-f]{64}$/;
 const CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
 /** Monotonic per-process sequence for the same-directory link temps. */
 let linkSequence = 0;
+/** Monotonic per-process sequence for the same-directory spill temps. */
+let spillSequence = 0;
 /** The default layout: the content-addressed snapshot tree. */
 const DEFAULT_LAYOUT = 'hub';
 /** The layout whose files a runtime reads directly at `<root>/<repo>/<file>`. */
@@ -150,7 +173,9 @@ async function resolveRevision(ctx, spec) {
                 problems.push(`${url} → HTTP ${String(response.status)}`);
                 continue;
             }
-            const body = await response.json();
+            // Metadata goes through the METADATA byte cap (not the multi-GB model-data cap): it is parsed
+            // as JSON, so the cap has to bound the parsed size, not just the wire size.
+            const body = JSON.parse(new TextDecoder().decode(await readCapped(response, METADATA_MAX_BYTES)));
             const sha = typeof body === 'object' && body !== null ? body.sha : undefined;
             if (!isSha(sha)) {
                 problems.push(`${url} → 响应 sha 不是 40/64 位小写十六进制`);
@@ -159,6 +184,9 @@ async function resolveRevision(ctx, spec) {
             return sha;
         }
         catch (error) {
+            // Crossing the byte cap is terminal: every endpoint serves the same oversized object.
+            if (error instanceof ProvisionError && error.code === 'fetch/too-large')
+                throw error;
             problems.push(`${url} → ${error instanceof Error ? error.message : String(error)}`);
         }
     }
@@ -185,7 +213,8 @@ async function listFiles(ctx, spec) {
                 problems.push(`${url} → HTTP ${String(response.status)}`);
                 continue;
             }
-            const body = await response.json();
+            // The siblings list is metadata too: same METADATA cap (parsed as JSON), not the model-data cap.
+            const body = JSON.parse(new TextDecoder().decode(await readCapped(response, METADATA_MAX_BYTES)));
             const siblings = typeof body === 'object' && body !== null ? body.siblings : undefined;
             const names = Array.isArray(siblings)
                 ? siblings.map(row => (typeof row === 'object' && row !== null ? row.rfilename : undefined))
@@ -198,16 +227,88 @@ async function listFiles(ctx, spec) {
             return files;
         }
         catch (error) {
+            // Crossing the byte cap is terminal: every endpoint serves the same oversized object.
+            if (error instanceof ProvisionError && error.code === 'fetch/too-large')
+                throw error;
             problems.push(`${url} → ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     throw new ProvisionError('fetch/failed', `无法列出 ${spec.repo} 的文件：${problems.join('; ')}`);
 }
 /**
- * Download one file, trying each endpoint in order. A length or integrity failure is final: only
- * transport-level failures fall through to the next mirror.
+ * A {@link BodySpill} that streams one response into `<blobs>/.atomic-spill-*` while hashing it, then
+ * renames the temp onto its content-addressed name. Peak memory is a single chunk: the bytes are
+ * never all resident at once, on either side of the write.
+ *
+ * The write itself goes through `node:fs` (`createWriteStream`) because {@link ProvisionFs} has no
+ * streaming writer and this change must not move the interface generation; the temp name carries
+ * {@link ATOMIC_TEMP_PREFIX}, so {@link sweepAtomicTemps} reaps a crashed writer's leftovers, and the
+ * final placement still uses the fs seam (`stat` / `rm` / `rename`).
+ */
+async function openBlobSpill(fs, blobs) {
+    const temp = join(blobs, `${ATOMIC_TEMP_PREFIX}spill-${String(process.pid)}-${String((spillSequence += 1))}`);
+    await fs.rm(temp).catch(() => undefined);
+    const out = createWriteStream(temp);
+    const hash = createHash('sha256');
+    let failure;
+    // A permanent listener: without one, an open/write error would be an unhandled 'error' event.
+    out.on('error', (error) => { failure = error; });
+    return {
+        async write(chunk) {
+            if (failure !== undefined)
+                throw failure;
+            hash.update(chunk);
+            if (!out.write(chunk))
+                await once(out, 'drain');
+        },
+        async finish(total) {
+            if (failure !== undefined)
+                throw failure;
+            out.end();
+            await finished(out);
+            const digest = hash.digest('hex');
+            const blob = join(blobs, digest);
+            const info = await fs.stat(blob);
+            if (info?.isDirectory === true)
+                await fs.rm(blob, { recursive: true });
+            // Content-addressed: a complete blob of the same size is already the right bytes.
+            if (info !== undefined && !info.isDirectory && info.size === total) {
+                await fs.rm(temp).catch(() => undefined);
+            }
+            else {
+                await fs.rename(temp, blob);
+            }
+            return { blob, digest, size: total };
+        },
+        async abort() {
+            out.destroy();
+            await fs.rm(temp).catch(() => undefined);
+        },
+    };
+}
+/**
+ * Download one file, trying each endpoint in order, and land it under `blobs`.
+ *
+ * Below {@link SPILL_THRESHOLD_BYTES} this is the historical path unchanged: read the whole body,
+ * digest it, `atomicWrite` the blob. Above it the body streams through {@link openBlobSpill} to a
+ * same-directory temp and is renamed into place, so a multi-GB model costs one chunk of heap instead
+ * of two copies of itself.
+ *
+ * `readCappedOrSpill` reports the two fetch failure shapes with different codes precisely so this
+ * branch can be exact instead of collapsing them, because they mean different things here:
+ *
+ *   - `fetch/too-large` — the body crosses the hard byte cap. TERMINAL: every mirror serves the same
+ *     oversized object, so the remaining endpoints are not tried.
+ *   - `fetch/failed` — a truncated body whose declared length did not match. A TRANSPORT failure that
+ *     falls through to the next endpoint. This is the case that matters most here: this is the largest
+ *     model path, the largest thing the framework downloads, and a slow/flaky mirror that truncates
+ *     must not permanently fail the item.
+ *
+ * A complete-but-wrong body stays final, but that is a different failure: the caller's `verifyHub` /
+ * `verifyFlat` sha256-checks the landed snapshot and raises `verify/failed`, which the provisioner does
+ * not retry (another mirror cannot make wrong bytes right).
  */
-async function downloadFile(ctx, endpoints, repo, sha, file) {
+async function landFile(ctx, endpoints, repo, sha, file, blobs, limits) {
     const problems = [];
     for (const endpoint of endpoints) {
         const url = `${endpoint}/${repo}/resolve/${sha}/${file}`;
@@ -217,10 +318,20 @@ async function downloadFile(ctx, endpoints, repo, sha, file) {
                 problems.push(`${url} → HTTP ${String(response.status)}`);
                 continue;
             }
-            return await readCapped(response, MAX_MODEL_BYTES);
+            const landed = await readCappedOrSpill(response, {
+                maxBytes: limits.maxBytes,
+                spillAtBytes: limits.spillAtBytes,
+                spill: () => openBlobSpill(ctx.fs, blobs),
+            });
+            if (!(landed instanceof Uint8Array))
+                return landed;
+            const digest = sha256Hex(landed);
+            const blob = join(blobs, digest);
+            await writeBlob(ctx.fs, blob, landed);
+            return { blob, digest, size: landed.byteLength };
         }
         catch (error) {
-            if (error instanceof ProvisionError)
+            if (error instanceof ProvisionError && error.code === 'fetch/too-large')
                 throw error;
             problems.push(`${url} → ${error instanceof Error ? error.message : String(error)}`);
         }
@@ -276,12 +387,19 @@ function decodeRecord(bytes) {
     }
     return { schemaVersion: RECORD_SCHEMA_VERSION, repo: record['repo'], revision: record['revision'], sha: record['sha'], files, digests };
 }
-/** Run `work` under the core's placement lock. */
-async function withLock(ctx, work) {
-    const lock = ctx.lock ?? defaultLock();
+/** Run `mission` under the core's placement lock. */
+async function withLock(ctx, mission) {
+    const lock = ctx.lock ?? defaultLock({
+        // The lock exists for the GiB-scale placement below (`linkOrWrite`); when that outlives
+        // `staleMs` the waiter must hear WHY it is not reclaiming rather than only seeing a timeout.
+        onSlowHold: info => {
+            ctx.logger.warn(`模型放置锁 ${info.path} 的临界区已持有 ${String(info.heldMs)} ms（超过 staleMs ${String(info.staleMs)} ms），` +
+                `但 pid ${String(info.pid)} 活着，所以不回收；按 timeoutMs 预算继续等待。`, { path: info.path, pid: info.pid, startedAt: info.startedAt, heldMs: info.heldMs, staleMs: info.staleMs, waitedMs: info.waitedMs });
+        },
+    });
     const handle = await lock.acquire(lockPath(ctx.home), { timeoutMs: LOCK_TIMEOUT_MS, staleMs: STALE_LOCK_MS });
     try {
-        return await work();
+        return await mission();
     }
     finally {
         handle.dispose();
@@ -290,7 +408,9 @@ async function withLock(ctx, work) {
 /**
  * Make `destination` resolve to `blob`: keep an existing link that already resolves to the blob,
  * else place a fresh temp symlink and rename it over the destination. When links are unsupported,
- * atomically write the blob's bytes. A destination that is a directory is cleared first.
+ * copy through a same-directory temp and rename it over the destination — the blob is never held in
+ * memory and is never read twice (a GiB-scale model used to be read whole, then written). A
+ * destination that is a directory is cleared first.
  */
 async function linkOrWrite(fs, blob, destination) {
     const parent = dirname(destination);
@@ -315,7 +435,16 @@ async function linkOrWrite(fs, blob, destination) {
             await fs.rm(temp).catch(() => undefined);
         }
     }
-    await fs.atomicWrite(destination, await fs.readFile(blob));
+    const temp = join(parent, `${ATOMIC_TEMP_PREFIX}copy-${String(process.pid)}-${String((linkSequence += 1))}`);
+    await fs.rm(temp).catch(() => undefined);
+    try {
+        await fs.copyFile(blob, temp);
+        await fs.rename(temp, destination);
+    }
+    catch (error) {
+        await fs.rm(temp).catch(() => undefined);
+        throw error;
+    }
 }
 /** Write `bytes` to a content-addressed `blob`, repairing a missing, directory or wrong-sized blob. */
 async function writeBlob(fs, blob, bytes) {
@@ -442,6 +571,10 @@ async function verifyFlat(ctx, item, spec) {
 /** Build the built-in model-cache provider. */
 export function modelCacheProvider(options = {}) {
     const id = options.id ?? '@avantf/dsh-plugin-base/model-cache';
+    const limits = {
+        maxBytes: options.maxBytes ?? MAX_MODEL_BYTES,
+        spillAtBytes: options.spillAtBytes ?? SPILL_THRESHOLD_BYTES,
+    };
     return {
         id,
         kinds: [MODEL_CACHE_KIND],
@@ -489,19 +622,16 @@ export function modelCacheProvider(options = {}) {
                 await ctx.fs.mkdir(blobs);
                 const placements = [];
                 for (const file of files) {
-                    const bytes = await downloadFile(ctx, endpoints, spec.repo, sha, file);
-                    ctx.onProgress?.({ key: `${MODEL_CACHE_KIND}+${spec.repo}`, phase: 'download', loaded: bytes.byteLength, total: bytes.byteLength });
-                    const digest = sha256Hex(bytes);
-                    const blob = join(blobs, digest);
-                    // Content-addressed blobs are written atomically.
-                    await writeBlob(ctx.fs, blob, bytes);
-                    placements.push({ file, blob, digest });
+                    const landed = await landFile(ctx, endpoints, spec.repo, sha, file, blobs, limits);
+                    ctx.onProgress?.({ key: `${MODEL_CACHE_KIND}+${spec.repo}`, phase: 'download', loaded: landed.size, total: landed.size });
+                    placements.push({ file, blob: landed.blob, digest: landed.digest });
                 }
                 // Placement and the completion marker are one critical section.
                 await withLock(ctx, async () => {
                     for (const placement of placements)
                         await linkOrWrite(ctx.fs, placement.blob, fileUnder(dataDir, placement.file));
                     await sweepAtomicTemps(ctx.fs, sidecar);
+                    await sweepAtomicTemps(ctx.fs, blobs);
                     await ctx.fs.atomicWrite(join(sidecar, RECORD_FILE), encodeRecord({
                         schemaVersion: RECORD_SCHEMA_VERSION,
                         repo: spec.repo,
@@ -520,19 +650,16 @@ export function modelCacheProvider(options = {}) {
             await ctx.fs.mkdir(snapshot);
             const placements = [];
             for (const file of files) {
-                const bytes = await downloadFile(ctx, endpoints, spec.repo, sha, file);
-                ctx.onProgress?.({ key: `${MODEL_CACHE_KIND}+${spec.repo}`, phase: 'download', loaded: bytes.byteLength, total: bytes.byteLength });
-                const digest = sha256Hex(bytes);
-                const blob = join(blobs, digest);
-                // Content-addressed blobs are written atomically.
-                await writeBlob(ctx.fs, blob, bytes);
-                placements.push({ file, blob, digest });
+                const landed = await landFile(ctx, endpoints, spec.repo, sha, file, blobs, limits);
+                ctx.onProgress?.({ key: `${MODEL_CACHE_KIND}+${spec.repo}`, phase: 'download', loaded: landed.size, total: landed.size });
+                placements.push({ file, blob: landed.blob, digest: landed.digest });
             }
             // Snapshot links and the ref marker are one critical section.
             await withLock(ctx, async () => {
                 for (const placement of placements)
                     await linkOrWrite(ctx.fs, placement.blob, fileUnder(snapshot, placement.file));
                 await sweepAtomicTemps(ctx.fs, join(root, 'refs'));
+                await sweepAtomicTemps(ctx.fs, blobs);
                 await ctx.fs.mkdir(join(root, 'refs'));
                 await ctx.fs.atomicWrite(join(root, 'refs', revision), new TextEncoder().encode(sha));
             });

package/dist/providers/npm.d.ts

@@ -14,6 +14,11 @@ export interface NpmPackageSpec {
         readonly dir?: string;
     }[];
 }
+/** Walk up from a resolved entry to the owning package directory.
+ *
+ *  The candidate is checked BEFORE stepping up (the entry usually sits directly in the package), and
+ *  `dirnameImpl` is the platform `dirname` so the win32 separator path is covered from Linux. */
+export declare function packageDirOf(entry: string, name: string, dirnameImpl?: (path: string) => string): string | undefined;
 /** Build the built-in npm provider. */
 export declare function npmPackageProvider(options?: {
     readonly id?: string;

package/dist/providers/npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/providers/npm.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA+B,QAAQ,EAAuE,MAAM,aAAa,CAAA;AAE7I,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAM7C,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC1G;AAyRD,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CA4JnF"}
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/providers/npm.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA+B,QAAQ,EAAuE,MAAM,aAAa,CAAA;AAE7I,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAM7C,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC1G;AA4KD;;;iGAGiG;AACjG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAgB,GAAG,MAAM,GAAG,SAAS,CAS7H;AAgID,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CAqKnF"}

package/dist/providers/npm.js

@@ -8,9 +8,9 @@ import { pathToFileURL } from 'node:url';
 import { ProvisionError } from '../errors.js';
 import { exists, linkOrCopy } from '../fs.js';
 import { verifyIntegrity } from '../integrity.js';
-import { isInside } from '../layout.js';
+import { isInside, assertSafeRelativePath } from '../layout.js';
 import { decodeJson, readInstallManifest } from '../manifest.js';
-import { DEFAULT_MAX_BYTES, candidateUrls, fetchImplOf, readCapped, signalFor } from '../net.js';
+import { DEFAULT_MAX_BYTES, METADATA_MAX_BYTES, candidateUrls, fetchImplOf, readCapped, signalFor } from '../net.js';
 import { assertPackageName } from '../package-name.js';
 import { parseRange, parseVersion, satisfiesRange, selectVersion } from '../semver.js';
 import { extractTarGz } from '../tar.js';
@@ -45,7 +45,10 @@ async function fetchPackument(ctx, spec) {
     }
     if (!response.ok)
         throw new ProvisionError('fetch/failed', `packument ${url} 返回 HTTP ${String(response.status)}`);
-    const body = await response.json();
+    // Metadata read through a hard byte cap of its own (`METADATA_MAX_BYTES`, not the 256 MiB archive
+    // cap): a hostile or broken mirror must not OOM the host with an unbounded `response.json()`, and
+    // because a packument is `JSON.parse`d its cap has to bound the PARSED size, not just the wire size.
+    const body = JSON.parse(new TextDecoder().decode(await readCapped(response, METADATA_MAX_BYTES)));
     const versions = typeof body === 'object' && body !== null ? body.versions : undefined;
     if (typeof versions !== 'object' || versions === null) {
         throw new ProvisionError('fetch/failed', `packument ${url} 没有 versions`);
@@ -168,39 +171,66 @@ async function packageVersionOf(ctx, dir) {
         return undefined;
     }
 }
-/** Walk up from a resolved entry to the owning package directory. */
-function packageDirOf(entry, name) {
-    let dir = dirname(entry);
+/** Does `dir` end with the package's path segments? Compares segments, not a raw string suffix.
+ *
+ *  `dir.endsWith(name)` never matched a scoped peer on Windows (`…\node_modules\@scope\pkg` does not
+ *  end with `@scope/pkg`), so peer resolution silently fell through. Comparing the trailing segments
+ *  on forward slashes works with either separator; no match stays a `peer/unsatisfied` (fail-closed). */
+function dirIsPackage(dir, name) {
+    const wanted = name.split('/');
+    const got = dir.replaceAll('\\', '/').replace(/\/+$/, '').split('/');
+    if (got.length < wanted.length)
+        return false;
+    const tail = got.slice(got.length - wanted.length);
+    return tail.every((segment, index) => segment === wanted[index]);
+}
+/** Walk up from a resolved entry to the owning package directory.
+ *
+ *  The candidate is checked BEFORE stepping up (the entry usually sits directly in the package), and
+ *  `dirnameImpl` is the platform `dirname` so the win32 separator path is covered from Linux. */
+export function packageDirOf(entry, name, dirnameImpl = dirname) {
+    let dir = dirnameImpl(entry);
     for (let depth = 0; depth < 6; depth += 1) {
-        if (dir === dirname(dir))
-            return undefined;
-        dir = dirname(dir);
-        if (dir.endsWith(name))
+        if (dirIsPackage(dir, name))
             return dir;
+        const parent = dirnameImpl(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
     }
     return undefined;
 }
-/** Resolve a peer directory from the caller's tree, falling back to an entry walk-up. */
-function resolvePeerDir(peer) {
-    const roots = [join(process.cwd(), 'noop.js'), import.meta.url];
-    for (const root of roots) {
+/** Resolve a peer directory from this module's tree, falling back to the host CWD with a warning.
+ *
+ *  The order matters: `import.meta.url` is the tree that actually loaded this provider, while the CWD
+ *  is wherever the host happened to start. A peer resolved from the CWD becomes an ABSOLUTE symlink
+ *  inside the published version directory (see {@link linkPeers}); it dangles the moment the host
+ *  starts elsewhere or that tree is removed, and it made "one zod" depend on the launch directory.
+ *  The CWD stays as a last resort, but never silently. */
+function resolvePeerDir(peer, ctx) {
+    const from = (root) => {
         try {
             return dirname(createRequire(root).resolve(`${peer}/package.json`));
         }
         catch {
             // fall through to the entry walk-up
         }
-    }
-    for (const root of roots) {
         try {
             const entry = createRequire(root).resolve(peer);
-            const dir = packageDirOf(entry, peer);
-            if (dir !== undefined)
-                return dir;
+            return packageDirOf(entry, peer);
         }
         catch {
-            // not resolvable from this root
+            return undefined;
         }
+    };
+    const own = from(import.meta.url);
+    if (own !== undefined)
+        return own;
+    const cwd = join(process.cwd(), 'noop.js');
+    const fromCwd = from(cwd);
+    if (fromCwd !== undefined) {
+        ctx.logger.warn(`peer ${peer} 只能从宿主启动目录解析到（${process.cwd()} → ${fromCwd}）；发布物里嵌的是该位置的绝对链接，换目录/卸载后会悬空`);
+        return fromCwd;
     }
     return undefined;
 }
@@ -215,7 +245,7 @@ async function linkPeers(pkgDir, spec, staging, ctx) {
         assertPackageName(peer, 'peer 名');
         const declared = spec.peers?.find(candidate => candidate.name === peer);
         const optional = meta[peer]?.optional === true || declared?.optional === true;
-        const dir = declared?.dir ?? resolvePeerDir(peer);
+        const dir = declared?.dir ?? resolvePeerDir(peer, ctx);
         if (dir === undefined) {
             if (optional)
                 continue;
@@ -342,7 +372,18 @@ export function npmPackageProvider(options = {}) {
                     ctx.logger.warn(`unverifiable: ${versionDir} 的 install.json 没有 integrity；按可用处理`);
                 }
                 const relativeEntry = manifest.entryDir ?? `node_modules/${spec.name}`;
+                // The read-back side of the same check `publish()` runs on write: an `install.json` whose
+                // entryDir is absolute or `..`-escaping must not be joined into a path at all.
+                try {
+                    assertSafeRelativePath(relativeEntry);
+                }
+                catch {
+                    ctx.logger.warn(`install.json 的 entryDir 不安全，已跳过：${relativeEntry}（${versionDir}）`);
+                    continue;
+                }
                 const entryDir = join(versionDir, ...relativeEntry.split('/'));
+                if (!isInside(versionDir, entryDir))
+                    continue;
                 // A copy whose entry directory is missing is not usable.
                 if (!(await exists(ctx.fs, entryDir)))
                     continue;

package/dist/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,SAAS,EACT,KAAK,EAeL,aAAa,EAMb,WAAW,EAEX,kBAAkB,EAMnB,MAAM,YAAY,CAAA;AAEnB,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAA6C,CAAA;AAEvF,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AASpC,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACtB;AAED;;;iFAGiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,iBAAiB,CAKvF;AAwCD;cACc;AACd,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAm5B1E"}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,SAAS,EACT,KAAK,EAeL,aAAa,EAMb,WAAW,EAEX,kBAAkB,EAMnB,MAAM,YAAY,CAAA;AAEnB,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAA6C,CAAA;AAEvF,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAepC,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACtB;AAED;;;iFAGiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,iBAAiB,CAKvF;AA0DD;cACc;AACd,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAk+B1E"}