@evandu/super-pi 0.1.96 → 0.1.98

package/scripts/patch-brace-expansion.mjs

@@ -14,21 +14,26 @@
 // in. It is a denial of service, not a privilege escalation, but it is reachable by opening a
 // repository, and a workspace is exactly what Super Pi is pointed at.
 //
-// THE FIX. `brace-expansion@5.0.12` is the patched release, and it has the same file layout as
-// 5.0.9 (both are `tshy` builds with the same `dist/commonjs` + `dist/esm` shape), so replacing the
-// installed copy is a file-level swap with no re-linking and no API change.
+// WHY IT RUNS AT STARTUP AND NOT AT INSTALL. It was a postinstall script, and that was a mistake
+// with teeth: a postinstall that fails fails the INSTALL, and on 2026-10-21 it did exactly that on
+// somebody else's machine - the script was not in the extracted tree, node reported
+// MODULE_NOT_FOUND, and npm refused to finish installing Super Pi at all. An install must not be
+// breakable by a security patch. So the patch runs when the server starts instead: by then the tree
+// is known to be there, the server has already booted, and a failure is a warning rather than a
+// failed install.
 //
-// WHY IT IS A POSTINSTALL AND NOT A DEPENDENCY. A dependency cannot express "a different version of
-// my dependency's dependency", because the shrinkwrap is the whole point of a shrinkwrap. The only
-// place left is the install itself.
+// WHY IT DOES NOT RUN A NESTED `npm install`. The first version staged the patched package with
+// `npm install` in a throwaway directory, which is a full dependency resolution - thirty seconds and
+// a network round trip, inside an install. `npm pack` fetches one tarball and nothing else, and the
+// tarball is read with node's own zlib, so the whole thing needs no network beyond one registry
+// fetch and no tooling beyond node.
 //
-// WHAT IT WILL NOT DO. It never fails an install. A patched copy that cannot be fetched leaves the
-// tree as it was, and the script says so in one line. An install that cannot finish because of a
-// security patch is a worse outcome than an install that finishes with a known advisory, so the script
-// only ever warns.
+// WHAT IT WILL NOT DO. It never fails anything. A patched copy that cannot be fetched leaves the tree
+// as it was, and the script says so in one line.
 import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync, cpSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { gunzipSync } from "node:zlib";
 import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
 
@@ -40,28 +45,6 @@ const VULNERABLE_BELOW = "5.0.12";
 const here = dirname(fileURLToPath(import.meta.url));
 const repositoryRoot = resolve(here, "..");
 
-/** The lockfile-relative path of a directory, in the form a lockfile's keys take. */
-const lockKeyOf = (directory) => relative(repositoryRoot, directory).split(/[\\/]/).filter(Boolean).join("/");
-
-/** Where Pi's package keeps its own `brace-expansion`, if it keeps one. */
-function findVulnerableCopies() {
-  const found = [];
-  const candidates = [
-    join(repositoryRoot, "node_modules", "@earendil-works", "pi-coding-agent", "node_modules", "brace-expansion"),
-    join(repositoryRoot, "node_modules", "brace-expansion"),
-  ];
-  for (const directory of candidates) {
-    const manifest = join(directory, "package.json");
-    if (!existsSync(manifest)) continue;
-    let version = "";
-    try { version = JSON.parse(readFileSync(manifest, "utf8")).version ?? ""; } catch { continue; }
-    if (!version) continue;
-    if (compareVersions(version, VULNERABLE_BELOW) >= 0) continue;
-    found.push({ directory, version, lockKey: lockKeyOf(directory) });
-  }
-  return found;
-}
-
 /** Numeric version comparison that does not care about a leading `v` or a prerelease tag. */
 function compareVersions(a, b) {
   const parts = (value) => String(value).replace(/^v/, "").split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -75,35 +58,78 @@ function compareVersions(a, b) {
 }
 
 /**
- * Replaces one installed copy with the patched release.
+ * Reads a gzipped tar into a map of path -> contents.
  *
- * The patched copy is fetched with `npm install` into a throwaway directory - npm's own
- * fetch-and-verify path - rather than `npm pack` plus `tar`, which needs a `tar` on PATH whose flags
- * differ between platforms. It is laid out exactly the way npm would have laid it out.
+ * The tar format is simple enough to read here: 512-byte blocks, a name in the first hundred bytes, a
+ * size in the next twelve (octal), and the payload after the header. Long names arrive as their own
+ * entry with the type flag `L`, and the real name follows in the payload.
  */
-function patch(directory) {
+function readTarGz(buffer) {
+  const files = new Map();
+  const tar = gunzipSync(buffer);
+  let offset = 0;
+  let longName = "";
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    offset += 512;
+    // Two consecutive zero blocks end the archive.
+    if (header.every((byte) => byte === 0)) break;
+    const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    const sizeText = header.subarray(124, 136).toString("utf8").replace(/\0.*$/, "").trim();
+    const size = sizeText ? Number.parseInt(sizeText, 8) : 0;
+    const type = String.fromCharCode(header[156]);
+    const prefix = header.subarray(345, 500).toString("utf8").replace(/\0.*$/, "");
+    const payload = tar.subarray(offset, offset + size);
+    offset += Math.ceil(size / 512) * 512;
+    if (type === "L") { longName = payload.toString("utf8").replace(/\0.*$/, ""); continue; }
+    if (type !== "0" && type !== "\0" && type !== "") continue;
+    const full = longName || (prefix ? `${prefix}/${name}` : name);
+    longName = "";
+    files.set(full, payload);
+  }
+  return files;
+}
+
+/**
+ * Fetches the patched package and writes it over the vulnerable copy.
+ *
+ * One registry fetch, and the tarball is read here rather than by an external `tar` - which is not the
+ * same tar on every platform, and whose flags differ.
+ */
+async function patch(directory) {
   const scratch = join(tmpdir(), `super-pi-brace-${process.pid}-${Date.now()}`);
   try {
     mkdirSync(scratch, { recursive: true });
-    const stage = join(scratch, "stage");
-    mkdirSync(stage, { recursive: true });
-    writeFileSync(join(stage, "package.json"), JSON.stringify({ name: "super-pi-brace-stage", version: "0.0.0", private: true }));
-    execFileSync("npm", ["install", `brace-expansion@${PATCHED_VERSION}`, "--no-audit", "--no-fund", "--silent", "--omit=dev"], {
-      cwd: stage,
-      stdio: ["ignore", "ignore", "pipe"],
-      shell: process.platform === "win32",
-    });
-    const unpacked = join(stage, "node_modules", "brace-expansion");
-    if (!existsSync(join(unpacked, "package.json"))) throw new Error("the staged install produced no package");
+    const tarball = join(scratch, "brace.tgz");
+    // `npm pack` prints the filename it wrote; the URL is asked for directly so that nothing has to be
+    // parsed out of npm's own output format.
+    const url = execFileSync("npm", ["view", `brace-expansion@${PATCHED_VERSION}`, "dist.tarball", "--silent"], {
+      stdio: ["ignore", "pipe", "pipe"], encoding: "utf8", shell: process.platform === "win32",
+    }).trim();
+    if (!url.startsWith("http")) throw new Error(`npm did not report a tarball URL (${url})`);
+    const response = await fetch(url);
+    if (!response.ok) throw new Error(`fetching the tarball failed with HTTP ${response.status}`);
+    writeFileSync(tarball, Buffer.from(await response.arrayBuffer()));
+    const entries = readTarGz(readFileSync(tarball));
+    const wanted = new Map();
+    for (const [path, contents] of entries) {
+      const relative = path.replace(/^package\//, "");
+      if (!relative || relative.endsWith("/")) continue;
+      wanted.set(relative, contents);
+    }
+    if (!wanted.has("package.json")) throw new Error("the tarball had no package.json");
     // The old copy is moved aside rather than deleted first, so a failure mid-swap cannot leave the
     // tree with half a package in it.
     const previous = `${directory}.super-pi-backup`;
     rmSync(previous, { recursive: true, force: true });
     renameSync(directory, previous);
     try {
-      cpSync(unpacked, directory, { recursive: true });
+      for (const [relative, contents] of wanted) {
+        const target = join(directory, relative);
+        mkdirSync(dirname(target), { recursive: true });
+        writeFileSync(target, contents);
+      }
     } catch (error) {
-      // The swap failed halfway: put the old copy back rather than leaving the tree broken.
       rmSync(directory, { recursive: true, force: true });
       renameSync(previous, directory);
       throw error;
@@ -116,15 +142,13 @@ function patch(directory) {
 }
 
 /**
- * The integrity hash npm recorded for the patched version, so the lockfile still describes a tree npm
+ * The integrity hash npm recorded for the patched version, so a lockfile still describes a tree npm
  * can verify. It comes from the registry metadata npm itself trusts.
  */
 function readIntegrity() {
   try {
     const output = execFileSync("npm", ["view", `brace-expansion@${PATCHED_VERSION}`, "dist.integrity", "--silent"], {
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: process.platform === "win32",
-      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32", encoding: "utf8",
     });
     return output.trim() || undefined;
   } catch {
@@ -133,16 +157,43 @@ function readIntegrity() {
 }
 
 /**
- * Rewrites the lockfile's entry for a patched package.
+ * The lockfiles that describe the tree Super Pi is installed in.
+ *
+ * NOT Super Pi's own `package-lock.json`. A dependency is not recorded in its dependent's lockfile, so
+ * the entry for `brace-expansion` lives in the lockfile of whatever npm tree Super Pi is IN - which is
+ * a different file depending on how Super Pi was installed:
+ *
+ * - as a Pi extension: `~/.pi/agent/npm/package-lock.json` (Pi's own npm root)
+ * - as a global npm install: `<prefix>/node_modules/.package-lock.json` (npm's hidden lockfile)
  *
- * WITHOUT THIS THE PATCH IS INVISIBLE. `npm audit` reads the LOCKFILE, not the files on disk - it
- * compares the resolved versions against the advisory database. So a tree that is genuinely patched
- * still reports "1 high severity vulnerability", and the person who installed Super Pi is left looking
- * at a warning that no amount of reinstalling will clear.
+ * `npm audit` reads whichever one describes the tree, so both are worth updating: a tree that is
+ * genuinely patched but whose lockfile still says 5.0.9 keeps reporting the vulnerability, and the
+ * person who installed Super Pi is left looking at a warning that no amount of reinstalling clears.
  */
-function updateLockfile(lockKey, version, integrity) {
-  const lockPath = join(repositoryRoot, "package-lock.json");
-  if (!existsSync(lockPath)) return false;
+function findDescribingLockfiles() {
+  const found = [];
+  // Super Pi's root is `<npmRoot>/node_modules/@evandu/super-pi`, so the npm root is three levels up.
+  let dir = repositoryRoot;
+  for (let depth = 0; depth < 4; depth += 1) {
+    const candidate = join(dir, "package-lock.json");
+    if (existsSync(candidate)) found.push(candidate);
+    const hidden = join(dir, "node_modules", ".package-lock.json");
+    if (existsSync(hidden)) found.push(hidden);
+    const parent = resolve(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return [...new Set(found)];
+}
+
+/**
+ * Rewrites a lockfile's entry for the patched package.
+ *
+ * The KEY is the path of the vulnerable copy relative to the lockfile's own tree, which is why the
+ * lockfile has to be found first: the same file is `node_modules/...` in one tree and a deeper path in
+ * another.
+ */
+function updateLockfile(lockPath, lockKey, version, integrity) {
   let lock;
   try { lock = JSON.parse(readFileSync(lockPath, "utf8")); }
   catch { return false; }
@@ -155,25 +206,55 @@ function updateLockfile(lockKey, version, integrity) {
   return true;
 }
 
-const copies = findVulnerableCopies();
-if (copies.length === 0) {
-  console.log("[super-pi] brace-expansion is not a vulnerable version here; nothing to patch.");
-} else {
+/** Where a vulnerable copy might be, relative to Super Pi's own tree. */
+function findVulnerableCopies() {
+  const found = [];
+  const candidates = [
+    join(repositoryRoot, "node_modules", "@earendil-works", "pi-coding-agent", "node_modules", "brace-expansion"),
+    join(repositoryRoot, "node_modules", "brace-expansion"),
+  ];
+  for (const directory of candidates) {
+    const manifest = join(directory, "package.json");
+    if (!existsSync(manifest)) continue;
+    let version = "";
+    try { version = JSON.parse(readFileSync(manifest, "utf8")).version ?? ""; } catch { continue; }
+    if (!version) continue;
+    if (compareVersions(version, VULNERABLE_BELOW) >= 0) continue;
+    found.push({ directory, version, lockKey: lockKeyOf(directory) });
+  }
+  return found;
+}
+
+/**
+ * Applies the patch, and reports what it did. Never throws: this runs beside a server that is starting,
+ * and a security patch is not a reason to fail a boot.
+ */
+export async function patchBraceExpansion() {
+  const copies = findVulnerableCopies();
+  if (copies.length === 0) return { patched: 0 };
+  const lockfiles = findDescribingLockfiles();
+  const integrity = readIntegrity();
   let patched = 0;
   for (const copy of copies) {
     try {
-      if (!patch(copy.directory)) continue;
+      if (!await patch(copy.directory)) continue;
       patched += 1;
-      console.log(`[super-pi] patched brace-expansion ${copy.version} -> ${PATCHED_VERSION} (${copy.directory})`);
-      // And the lockfile, so `npm audit` stops reporting a tree that is no longer vulnerable.
-      if (updateLockfile(copy.lockKey, PATCHED_VERSION, readIntegrity())) {
-        console.log("[super-pi] the lockfile now records the patched version, so `npm audit` stops reporting it.");
+      console.warn(`[super-pi] patched brace-expansion ${copy.version} -> ${PATCHED_VERSION} (${copy.directory})`);
+      for (const lockPath of lockfiles) {
+        // The key is the copy's path relative to the lockfile's own tree.
+        const lockKey = relative(dirname(lockPath), copy.directory).split(/[\\/]/).filter(Boolean).join("/");
+        if (updateLockfile(lockPath, lockKey, PATCHED_VERSION, integrity)) {
+          console.warn(`[super-pi] ${lockPath} now records the patched version, so \`npm audit\` stops reporting it.`);
+        }
       }
     } catch (error) {
-      // NEVER fail the install over this. An install that cannot finish is worse than an install that
-      // finishes with a known advisory, and the advisory is reported by `npm audit` either way.
-      console.warn(`[super-pi] could not patch brace-expansion in ${copy.directory}: ${error instanceof Error ? error.message : String(error)}. Run \`npm audit fix\` or reinstall to try again.`);
+      console.warn(`[super-pi] could not patch brace-expansion in ${copy.directory}: ${error instanceof Error ? error.message : String(error)}. It is Pi's own pinned dependency tree; \`npm audit\` will keep reporting it.`);
     }
   }
-  if (patched === 0) console.warn("[super-pi] brace-expansion is still at a vulnerable version; `npm audit` will keep reporting it. This is Pi's own pinned dependency tree.");
+  return { patched };
+}
+
+// Run directly (`node scripts/patch-brace-expansion.mjs`) rather than imported.
+if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
+  await patchBraceExpansion();
 }