@axiom-lattice/core 3.1.1 → 3.1.2

package/dist/index.d.mts

@@ -6527,6 +6527,8 @@ declare class FilesystemBackend implements BackendProtocol {
      */
     private resolvePath;
     private assertVirtualParentContained;
+    private assertVirtualOpenedFileContained;
+    private readFileBuffer;
     private validateDeleteTarget;
     /**
      * List files and directories in the specified directory (non-recursive).
@@ -6552,6 +6554,8 @@ declare class FilesystemBackend implements BackendProtocol {
      * @returns Raw file content as FileData
      */
     readRaw(filePath: string): Promise<FileData>;
+    /** Read file content as raw bytes without following symbolic links. */
+    readBinary(filePath: string): Promise<Buffer>;
     /**
      * Create a new file with content.
      * Returns WriteResult. External storage sets filesUpdate=null.

package/dist/index.d.ts

@@ -6527,6 +6527,8 @@ declare class FilesystemBackend implements BackendProtocol {
      */
     private resolvePath;
     private assertVirtualParentContained;
+    private assertVirtualOpenedFileContained;
+    private readFileBuffer;
     private validateDeleteTarget;
     /**
      * List files and directories in the specified directory (non-recursive).
@@ -6552,6 +6554,8 @@ declare class FilesystemBackend implements BackendProtocol {
      * @returns Raw file content as FileData
      */
     readRaw(filePath: string): Promise<FileData>;
+    /** Read file content as raw bytes without following symbolic links. */
+    readBinary(filePath: string): Promise<Buffer>;
     /**
      * Create a new file with content.
      * Returns WriteResult. External storage sets filesUpdate=null.

package/dist/index.js

@@ -18861,6 +18861,51 @@ var FilesystemBackend = class {
       throw new Error(`Path: ${resolvedPath} outside root directory: ${this.cwd}`);
     }
   }
+  async assertVirtualOpenedFileContained(resolvedPath, openedStat) {
+    if (!this.virtualMode) {
+      return;
+    }
+    const [rootPath, realFilePath] = await Promise.all([
+      fs2.realpath(this.cwd),
+      fs2.realpath(resolvedPath)
+    ]);
+    const relative4 = path4.relative(rootPath, realFilePath);
+    if (relative4 === ".." || relative4.startsWith(`..${path4.sep}`) || path4.isAbsolute(relative4)) {
+      throw new Error(`Path: ${resolvedPath} outside root directory: ${this.cwd}`);
+    }
+    const realPathStat = await fs2.stat(realFilePath);
+    if (realPathStat.dev !== openedStat.dev || realPathStat.ino !== openedStat.ino) {
+      throw new Error(`File changed during secure read: ${resolvedPath}`);
+    }
+  }
+  async readFileBuffer(filePath) {
+    const resolvedPath = this.resolvePath(filePath);
+    await this.assertVirtualParentContained(resolvedPath);
+    if (!SUPPORTS_NOFOLLOW) {
+      const initialStat = await fs2.lstat(resolvedPath);
+      if (initialStat.isSymbolicLink()) {
+        throw new Error(`Symlinks are not allowed: ${filePath}`);
+      }
+    }
+    const flags = SUPPORTS_NOFOLLOW ? fsSync.constants.O_RDONLY | fsSync.constants.O_NOFOLLOW : fsSync.constants.O_RDONLY;
+    const fd = await fs2.open(resolvedPath, flags);
+    try {
+      const stat4 = await fd.stat();
+      if (!stat4.isFile()) {
+        throw new Error(`File '${filePath}' not found`);
+      }
+      await this.assertVirtualOpenedFileContained(resolvedPath, stat4);
+      if (!SUPPORTS_NOFOLLOW) {
+        const finalStat = await fs2.lstat(resolvedPath);
+        if (finalStat.isSymbolicLink() || finalStat.dev !== stat4.dev || finalStat.ino !== stat4.ino) {
+          throw new Error(`File changed during secure read: ${resolvedPath}`);
+        }
+      }
+      return { content: await fd.readFile(), stat: stat4 };
+    } finally {
+      await fd.close();
+    }
+  }
   validateDeleteTarget(filePath, stat4) {
     if (stat4.isSymbolicLink()) {
       return `Error: Cannot delete '${filePath}': symlinks are not allowed`;
@@ -18960,32 +19005,8 @@ var FilesystemBackend = class {
    */
   async read(filePath, offset = 0, limit = 2e3) {
     try {
-      const resolvedPath = this.resolvePath(filePath);
-      let content;
-      if (SUPPORTS_NOFOLLOW) {
-        const stat4 = await fs2.stat(resolvedPath);
-        if (!stat4.isFile()) {
-          return `Error: File '${filePath}' not found`;
-        }
-        const fd = await fs2.open(
-          resolvedPath,
-          fsSync.constants.O_RDONLY | fsSync.constants.O_NOFOLLOW
-        );
-        try {
-          content = await fd.readFile({ encoding: "utf-8" });
-        } finally {
-          await fd.close();
-        }
-      } else {
-        const stat4 = await fs2.lstat(resolvedPath);
-        if (stat4.isSymbolicLink()) {
-          return `Error: Symlinks are not allowed: ${filePath}`;
-        }
-        if (!stat4.isFile()) {
-          return `Error: File '${filePath}' not found`;
-        }
-        content = await fs2.readFile(resolvedPath, "utf-8");
-      }
+      const { content: buffer2 } = await this.readFileBuffer(filePath);
+      const content = buffer2.toString("utf-8");
       const emptyMsg = checkEmptyContent(content);
       if (emptyMsg) {
         return emptyMsg;
@@ -19009,35 +19030,19 @@ var FilesystemBackend = class {
    * @returns Raw file content as FileData
    */
   async readRaw(filePath) {
-    const resolvedPath = this.resolvePath(filePath);
-    let content;
-    let stat4;
-    if (SUPPORTS_NOFOLLOW) {
-      stat4 = await fs2.stat(resolvedPath);
-      if (!stat4.isFile()) throw new Error(`File '${filePath}' not found`);
-      const fd = await fs2.open(
-        resolvedPath,
-        fsSync.constants.O_RDONLY | fsSync.constants.O_NOFOLLOW
-      );
-      try {
-        content = await fd.readFile({ encoding: "utf-8" });
-      } finally {
-        await fd.close();
-      }
-    } else {
-      stat4 = await fs2.lstat(resolvedPath);
-      if (stat4.isSymbolicLink()) {
-        throw new Error(`Symlinks are not allowed: ${filePath}`);
-      }
-      if (!stat4.isFile()) throw new Error(`File '${filePath}' not found`);
-      content = await fs2.readFile(resolvedPath, "utf-8");
-    }
+    const { content: buffer2, stat: stat4 } = await this.readFileBuffer(filePath);
+    const content = buffer2.toString("utf-8");
     return {
       content: content.split("\n"),
       created_at: stat4.ctime.toISOString(),
       modified_at: stat4.mtime.toISOString()
     };
   }
+  /** Read file content as raw bytes without following symbolic links. */
+  async readBinary(filePath) {
+    const { content } = await this.readFileBuffer(filePath);
+    return content;
+  }
   /**
    * Create a new file with content.
    * Returns WriteResult. External storage sets filesUpdate=null.