@devicecloud.dev/dcd 5.7.0 → 5.7.1

package/dist/services/metadata-extractor.service.js

@@ -1,14 +1,9 @@
 import { parseBuffer } from 'bplist-parser';
-import nodeApk from 'node-apk';
 import { readFile, rm } from 'node:fs/promises';
 import * as path from 'node:path';
 import StreamZip from 'node-stream-zip';
 import { parse } from 'plist';
-// node-apk is CJS with no `exports` map; Node's named-export detection for CJS
-// (cjs-module-lexer) is version-dependent, so destructure off the default import
-// instead — that interop is guaranteed on every Node version. bplist-parser 0.5
-// is a real ESM/CJS dual package with named exports, so it imports directly.
-const { Apk } = nodeApk;
+import { readManifestPackage } from '../utils/android-manifest.js';
 /**
  * Parses an Info.plist buffer (XML, UTF-8 BOM'd XML, or binary bplist).
  * Shared by the .app and .zip extractors.
@@ -36,13 +31,13 @@ export class AndroidMetadataExtractor {
         return filePath.endsWith('.apk');
     }
     async extract(filePath) {
-        const apk = new Apk(filePath);
+        const zip = new StreamZip.async({ file: filePath });
         try {
-            const manifest = await apk.getManifestInfo();
-            return { appId: manifest.package, platform: 'android' };
+            const manifest = await zip.entryData('AndroidManifest.xml');
+            return { appId: readManifestPackage(manifest), platform: 'android' };
         }
         finally {
-            apk.close();
+            await zip.close().catch(() => { });
         }
     }
 }

package/dist/utils/android-manifest.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Reads the `package` attribute of the root `<manifest>` element.
+ * @param xml - Contents of the APK's AndroidManifest.xml entry
+ * @returns The application id, e.g. `org.wikipedia`
+ */
+export declare function readManifestPackage(xml: Buffer): string;

package/dist/utils/android-manifest.js

@@ -0,0 +1,97 @@
+// Reads the package name out of an APK's compiled AndroidManifest.xml (Android
+// binary XML). This replaced node-apk, whose node-forge dependency carried an
+// unpatched advisory for certificate code the CLI never used. Layouts follow
+// the ResChunk_header / ResStringPool_header / ResXMLTree_* structs in AOSP's
+// libandroidfw ResourceTypes.h; every integer is little-endian.
+const RES_STRING_POOL_TYPE = 0x0001;
+const RES_XML_TYPE = 0x0003;
+const RES_XML_START_ELEMENT_TYPE = 0x0102;
+const UTF8_FLAG = 0x0100;
+const TYPE_STRING = 0x03;
+const NO_INDEX = 0xffff_ffff;
+const CHUNK_HEADER_SIZE = 8;
+/**
+ * Returns a lookup for the strings in the string pool chunk at `offset`.
+ * Strings are decoded on demand, so a malformed entry the manifest never
+ * refers to can't fail the parse.
+ */
+function stringPool(xml, offset) {
+    const headerSize = xml.readUInt16LE(offset + 2);
+    const count = xml.readUInt32LE(offset + 8);
+    const utf8 = (xml.readUInt32LE(offset + 16) & UTF8_FLAG) !== 0;
+    const stringsStart = offset + xml.readUInt32LE(offset + 20);
+    return (index) => {
+        if (index >= count) {
+            throw new Error(`String index ${index} is out of range`);
+        }
+        let pos = stringsStart + xml.readUInt32LE(offset + headerSize + index * 4);
+        if (utf8) {
+            // Two lengths, each 1 byte or 2 when the high bit is set: the UTF-16
+            // length (unused here), then the UTF-8 byte length.
+            pos += xml[pos] & 0x80 ? 2 : 1;
+            let length = xml[pos++];
+            if (length & 0x80)
+                length = ((length & 0x7f) << 8) | xml[pos++];
+            return xml.toString('utf8', pos, pos + length);
+        }
+        // UTF-16 length in code units: 2 bytes, or 4 when the high bit is set.
+        let length = xml.readUInt16LE(pos);
+        pos += 2;
+        if (length & 0x80_00) {
+            length = ((length & 0x7f_ff) << 16) | xml.readUInt16LE(pos);
+            pos += 2;
+        }
+        return xml.toString('utf16le', pos, pos + length * 2);
+    };
+}
+/**
+ * Reads the `package` attribute of the root `<manifest>` element.
+ * @param xml - Contents of the APK's AndroidManifest.xml entry
+ * @returns The application id, e.g. `org.wikipedia`
+ */
+export function readManifestPackage(xml) {
+    if (xml.length < CHUNK_HEADER_SIZE || xml.readUInt16LE(0) !== RES_XML_TYPE) {
+        throw new Error('AndroidManifest.xml is not Android binary XML');
+    }
+    const end = Math.min(xml.length, xml.readUInt32LE(4));
+    let offset = xml.readUInt16LE(2);
+    let stringAt;
+    while (offset + CHUNK_HEADER_SIZE <= end) {
+        const type = xml.readUInt16LE(offset);
+        const headerSize = xml.readUInt16LE(offset + 2);
+        const size = xml.readUInt32LE(offset + 4);
+        if (size < CHUNK_HEADER_SIZE) {
+            throw new Error(`Malformed binary XML chunk at offset ${offset}`);
+        }
+        if (type === RES_STRING_POOL_TYPE) {
+            stringAt = stringPool(xml, offset);
+        }
+        else if (type === RES_XML_START_ELEMENT_TYPE) {
+            // The first element is the document root.
+            if (!stringAt)
+                throw new Error('Binary XML has no string pool');
+            const ext = offset + headerSize;
+            if (stringAt(xml.readUInt32LE(ext + 4)) !== 'manifest') {
+                throw new Error('Root element of AndroidManifest.xml is not <manifest>');
+            }
+            const attributeStart = ext + xml.readUInt16LE(ext + 8);
+            const attributeSize = xml.readUInt16LE(ext + 10);
+            const attributeCount = xml.readUInt16LE(ext + 12);
+            for (let i = 0; i < attributeCount; i++) {
+                const attr = attributeStart + i * attributeSize;
+                if (stringAt(xml.readUInt32LE(attr + 4)) !== 'package')
+                    continue;
+                // Use the typed string value when there is one, else the raw string
+                // the attribute was compiled from.
+                const raw = xml.readUInt32LE(attr + 8);
+                const index = xml[attr + 15] === TYPE_STRING ? xml.readUInt32LE(attr + 16) : raw;
+                if (index === NO_INDEX)
+                    break;
+                return stringAt(index);
+            }
+            throw new Error('<manifest> has no package attribute');
+        }
+        offset += size;
+    }
+    throw new Error('AndroidManifest.xml has no <manifest> element');
+}

package/package.json

@@ -6,13 +6,12 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@supabase/supabase-js": "^2.108.2",
     "bplist-parser": "^0.5.0",
     "chalk": "^6.0.0",
     "citty": "^0.2.2",
     "js-yaml": "^5.2.2",
-    "node-apk": "^1.2.1",
     "node-stream-zip": "^1.15.0",
     "plist": "^5.0.0",
     "tar": "^7.5.16",
@@ -69,7 +68,7 @@
     "test:unit": "node scripts/test-runner.mjs --unit",
     "typecheck": "tsc --noEmit -p tsconfig.test.json"
   },
-  "version": "5.7.0",
+  "version": "5.7.1",
   "bugs": {
     "url": "https://discord.gg/gm3mJwcNw8"
   },
@@ -112,12 +111,14 @@
       "qs@<6.16.0": "6.16.0",
       "fast-uri@>=3.0.0 <3.1.8": "3.1.8",
       "hono@>=4.0.0 <4.13.7": "4.13.7",
+      "source-map-js@<1.2.2": "1.2.2",
       "micromatch>picomatch": "^2.3.2",
       "tinyglobby>picomatch": "^4.0.4"
     },
     "auditConfig": {
       "ignoreGhsas": [
-        "GHSA-frvp-7c67-39w9"
+        "GHSA-frvp-7c67-39w9",
+        "GHSA-vfj7-8cjw-p6xm"
       ]
     }
   }