@gajae-code/stats 0.11.5 → 0.11.7

package/dist/types/compiled-client-assets.d.ts

@@ -0,0 +1,3 @@
+export declare function createCompiledClientAssetHandler(loadArchiveBytes: () => Uint8Array | null | Promise<Uint8Array | null>): {
+    response(requestPath: string): Promise<Response>;
+};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/stats",
-	"version": "0.11.5",
+	"version": "0.11.7",
 	"description": "Local observability dashboard for pi AI usage statistics",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo",
@@ -37,8 +37,8 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@gajae-code/ai": "0.11.5",
-		"@gajae-code/utils": "0.11.5",
+		"@gajae-code/ai": "0.11.7",
+		"@gajae-code/utils": "0.11.7",
 		"@tailwindcss/node": "^4.2.4",
 		"chart.js": "^4.5.1",
 		"date-fns": "^4.1.0",

package/src/compiled-client-assets.ts

@@ -0,0 +1,96 @@
+import * as path from "node:path";
+
+const INDEX_ASSET = "index.html";
+const UNSAFE_ARCHIVE_NAME = /[\u0000-\u001f\u007f%?#]/u;
+const WINDOWS_ABSOLUTE_PATH = /^[a-zA-Z]:\//;
+
+const CONTENT_TYPES: Readonly<Record<string, string>> = Object.freeze({
+	".css": "text/css; charset=utf-8",
+	".gif": "image/gif",
+	".html": "text/html; charset=utf-8",
+	".ico": "image/x-icon",
+	".jpeg": "image/jpeg",
+	".jpg": "image/jpeg",
+	".js": "text/javascript; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".map": "application/json; charset=utf-8",
+	".png": "image/png",
+	".svg": "image/svg+xml",
+	".ttf": "font/ttf",
+	".webp": "image/webp",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+});
+
+function normalizeArchiveName(archiveName: string): string {
+	const normalized = archiveName.normalize("NFC");
+	const segments = normalized.split("/");
+	if (
+		!normalized ||
+		normalized.startsWith("/") ||
+		WINDOWS_ABSOLUTE_PATH.test(normalized) ||
+		normalized.includes("\\") ||
+		UNSAFE_ARCHIVE_NAME.test(normalized) ||
+		segments.some(segment => !segment || segment === "." || segment === "..")
+	) {
+		throw new Error(`Unsafe compiled stats client archive entry: ${JSON.stringify(archiveName)}`);
+	}
+	return normalized;
+}
+
+function contentType(assetName: string): string {
+	return CONTENT_TYPES[path.posix.extname(assetName).toLowerCase()] ?? "application/octet-stream";
+}
+
+async function parseArchive(archiveBytes: Uint8Array): Promise<ReadonlyMap<string, Blob>> {
+	const files = await new Bun.Archive(archiveBytes).files();
+	const assets = new Map<string, Blob>();
+	for (const [archiveName, file] of files) {
+		const assetName = normalizeArchiveName(archiveName);
+		if (assets.has(assetName)) {
+			throw new Error(`Duplicate compiled stats client archive entry: ${JSON.stringify(assetName)}`);
+		}
+		assets.set(assetName, new Blob([file], { type: contentType(assetName) }));
+	}
+	if (!assets.has(INDEX_ASSET)) {
+		throw new Error("Compiled stats client archive is missing index.html");
+	}
+	return assets;
+}
+
+function responseForPath(assets: ReadonlyMap<string, Blob>, requestPath: string): Response {
+	const assetName = requestPath === "/" ? INDEX_ASSET : requestPath.replace(/^\//, "");
+	const asset = assets.get(assetName);
+	if (asset) return new Response(asset);
+	return new Response(assets.get(INDEX_ASSET));
+}
+
+export function createCompiledClientAssetHandler(
+	loadArchiveBytes: () => Uint8Array | null | Promise<Uint8Array | null>,
+): { response(requestPath: string): Promise<Response> } {
+	let initialization: Promise<ReadonlyMap<string, Blob>> | null = null;
+
+	async function getAssets(): Promise<ReadonlyMap<string, Blob>> {
+		if (initialization) return await initialization;
+		const attempt = (async () => {
+			const archiveBytes = await loadArchiveBytes();
+			if (!archiveBytes) {
+				throw new Error("Compiled stats client bundle missing. Rebuild binary with embedded stats assets.");
+			}
+			return await parseArchive(archiveBytes);
+		})();
+		initialization = attempt;
+		try {
+			return await attempt;
+		} catch (error) {
+			if (initialization === attempt) initialization = null;
+			throw error;
+		}
+	}
+
+	return {
+		async response(requestPath) {
+			return responseForPath(await getAssets(), requestPath);
+		},
+	};
+}

package/src/server.ts

@@ -1,5 +1,4 @@
 import * as fs from "node:fs/promises";
-import * as os from "node:os";
 import * as path from "node:path";
 import { $ } from "bun";
 import {
@@ -14,6 +13,7 @@ import {
 	getTotalMessageCount,
 	syncAllSessions,
 } from "./aggregator";
+import { createCompiledClientAssetHandler } from "./compiled-client-assets";
 import embeddedClientArchiveTxt from "./embedded-client.generated.txt";
 
 const getEmbeddedClientArchive = (() => {
@@ -29,59 +29,7 @@ const IS_BUN_COMPILED =
 	import.meta.url.includes("$bunfs") ||
 	import.meta.url.includes("~BUN") ||
 	import.meta.url.includes("%7EBUN");
-
-const COMPILED_CLIENT_DIR_ROOT = path.join(os.tmpdir(), "gjc-stats-client");
-let compiledClientDirPromise: Promise<string> | null = null;
-
-function sanitizeArchivePath(archivePath: string): string | null {
-	const normalized = archivePath.replaceAll("\\", "/").replace(/^\.\//, "");
-	if (!normalized || normalized === ".") return null;
-	if (normalized.includes("..") || path.isAbsolute(normalized)) return null;
-	return normalized;
-}
-
-async function extractEmbeddedClientArchive(archiveBytes: Buffer, outputDir: string): Promise<void> {
-	const archive = new Bun.Archive(archiveBytes);
-	const files = await archive.files();
-	const extractRoot = path.resolve(outputDir);
-
-	for (const [archivePath, file] of files) {
-		const sanitizedPath = sanitizeArchivePath(archivePath);
-		if (!sanitizedPath) continue;
-		const destinationPath = path.resolve(extractRoot, sanitizedPath);
-		if (!destinationPath.startsWith(extractRoot + path.sep)) {
-			throw new Error(`Archive entry escapes extraction directory: ${archivePath}`);
-		}
-		await Bun.write(destinationPath, file);
-	}
-}
-
-async function getCompiledClientDir(): Promise<string> {
-	if (!IS_BUN_COMPILED) return STATIC_DIR;
-	if (compiledClientDirPromise) return compiledClientDirPromise;
-
-	const archiveBytes = getEmbeddedClientArchive?.();
-	if (!archiveBytes) {
-		throw new Error("Compiled stats client bundle missing. Rebuild binary with embedded stats assets.");
-	}
-
-	compiledClientDirPromise = (async () => {
-		const bundleHash = Bun.hash(archiveBytes).toString(16);
-		const outputDir = path.join(COMPILED_CLIENT_DIR_ROOT, bundleHash);
-		const markerPath = path.join(outputDir, "index.html");
-		try {
-			const marker = await fs.stat(markerPath);
-			if (marker.isFile()) return outputDir;
-		} catch {}
-
-		await fs.rm(outputDir, { recursive: true, force: true });
-		await fs.mkdir(outputDir, { recursive: true });
-		await extractEmbeddedClientArchive(archiveBytes, outputDir);
-		return outputDir;
-	})();
-
-	return compiledClientDirPromise;
-}
+const compiledClientAssets = createCompiledClientAssetHandler(() => getEmbeddedClientArchive?.() ?? null);
 
 async function getLatestMtime(dir: string): Promise<number> {
 	const entries = await fs.readdir(dir, { withFileTypes: true });
@@ -247,9 +195,10 @@ async function handleApi(req: Request): Promise<Response> {
  * Handle static file requests.
  */
 async function handleStatic(requestPath: string): Promise<Response> {
-	const staticDir = IS_BUN_COMPILED ? await getCompiledClientDir() : STATIC_DIR;
+	if (IS_BUN_COMPILED) return await compiledClientAssets.response(requestPath);
+
 	const filePath = requestPath === "/" ? "/index.html" : requestPath;
-	const fullPath = path.join(staticDir, filePath);
+	const fullPath = path.join(STATIC_DIR, filePath);
 
 	const file = Bun.file(fullPath);
 	if (await file.exists()) {
@@ -257,7 +206,7 @@ async function handleStatic(requestPath: string): Promise<Response> {
 	}
 
 	// SPA fallback
-	const index = Bun.file(path.join(staticDir, "index.html"));
+	const index = Bun.file(path.join(STATIC_DIR, "index.html"));
 	if (await index.exists()) {
 		return new Response(index);
 	}