@jonaskahn/relo 0.1.0-beta.19.453b59ee → 0.1.0-beta.20.d7e7f1ef

package/lib/archive.mjs

@@ -0,0 +1,72 @@
+// Reads the daemon binary out of a release tarball. Prereleases publish one
+// versioned archive per platform instead of the raw binary the stable
+// releases carry, so the installer falls back to this when the manifest
+// lists no raw binary.
+//
+// Pure node:zlib plus a minimal tar walk, no dependency and no system tar,
+// so the postinstall behaves the same on every host the package supports.
+import { gunzipSync } from 'node:zlib';
+
+function text(bytes) {
+	return Buffer.from(bytes).toString('utf8').replace(/\0.*$/s, '').trim();
+}
+
+function entryName(header) {
+	const name = text(header.subarray(0, 100));
+	const prefix = text(header.subarray(345, 500));
+	const joined = prefix ? `${prefix}/${name}` : name;
+	return joined.replace(/^\.\//, '');
+}
+
+function entrySize(header) {
+	const size = Number.parseInt(text(header.subarray(124, 136)), 8);
+	if (!Number.isSafeInteger(size) || size < 0) {
+		throw new Error('relo: the release archive has a corrupt entry size');
+	}
+	return size;
+}
+
+function safeName(name) {
+	if (!name || name.startsWith('/') || name.startsWith('\\')) return false;
+	return !name.split(/[\\/]/).includes('..');
+}
+
+// extractBinary returns the bytes of the single archive member whose file
+// name is in names. Pax headers and directories are skipped; anything else
+// that is not that one regular file fails the install instead of writing a
+// wrong executable into the package.
+export function extractBinary(tarball, { names }) {
+	let tar;
+	try {
+		tar = gunzipSync(tarball);
+	} catch {
+		throw new Error('relo: the release archive is not valid gzip');
+	}
+	const found = [];
+	let offset = 0;
+	while (offset + 512 <= tar.length) {
+		const header = tar.subarray(offset, offset + 512);
+		if (header.every((byte) => byte === 0)) break;
+		const name = entryName(header);
+		const size = entrySize(header);
+		const end = offset + 512 + size;
+		if (end > tar.length) {
+			throw new Error(`relo: the release archive truncates ${name || 'an entry'}`);
+		}
+		const type = String.fromCharCode(header[156]);
+		if ((type === '0' || type === '\0') && names.includes(name.split('/').pop())) {
+			if (!safeName(name)) {
+				throw new Error(`relo: the release archive hides an unsafe path (${name})`);
+			}
+			found.push(Buffer.from(tar.subarray(offset + 512, end)));
+		}
+		offset += 512 + Math.ceil(size / 512) * 512;
+	}
+	if (found.length === 0) {
+		throw new Error(`relo: the release archive holds no ${names.join(' or ')}`);
+	}
+	if (found.length > 1) {
+		throw new Error('relo: the release archive holds more than one binary');
+	}
+	return found[0];
+}

package/lib/install.mjs

@@ -22,7 +22,8 @@ import { askStart, quiesce, reloHome } from './daemon.mjs';
 import { findConflictingRelo } from './conflict.mjs';
 import { fetchBytes } from './download.mjs';
 import { target } from './platform.mjs';
-import { assets, checksumsUrl, prereleaseTag, tagFromArgs, url } from './release.mjs';
+import { assets, checksumsUrl, prereleaseTag, selectBundle, tagFromArgs, url } from './release.mjs';
+import { extractBinary } from './archive.mjs';
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const binaryDir = resolve(packageRoot, 'bin');
@@ -42,10 +43,16 @@ async function fromRelease(tag) {
 	const { version } = assets(tag);
 
 	// One manifest lists every asset in the release, so a single fetch
-	// verifies the binary before anything executable is written.
-	const manifest = await fetchBytes(checksumsUrl(tag), 'checksums.txt');
-	const body = await fetchBytes(url(asset.name, tag), asset.name);
-	expect(parse(manifest), asset.name, body);
+	// verifies the binary before anything executable is written. A release
+	// carrying the raw binary uses it; one carrying only the versioned
+	// tarballs falls back to this host's archive, and the binary inside is
+	// what the launcher beside it already expects.
+	const manifest = parse(await fetchBytes(checksumsUrl(tag), 'checksums.txt'));
+	const pick = selectBundle(manifest, asset);
+	const downloaded = await fetchBytes(url(pick.name, tag), pick.name);
+	expect(manifest, pick.name, downloaded);
+	const inner = asset.os === 'windows' ? 'relo.exe' : 'relo';
+	const body = pick.kind === 'raw' ? downloaded : extractBinary(downloaded, { names: [inner] });
 	const destination = resolve(binaryDir, asset.name);
 	// Quiesced first: on windows the rename below fails over a running exe, and
 	// the new daemon cannot bind a port the old one still serves.

package/lib/release.mjs

@@ -53,3 +53,30 @@ export function checksumsUrl(tag = null) {
 export function url(name, tag = null) {
 	return `${assets(tag).base}/${name}`;
 }
+
+// selectBundle names the asset one host downloads from a release manifest:
+// the raw binary when the release carries it, else this host's versioned
+// tarball. It throws naming both when neither is listed, so a failed
+// install says what is missing instead of what a 404 means.
+export function selectBundle(entries, { os, arch, name }) {
+	if (entries.has(name)) return { kind: 'raw', name };
+	const bundle = tarballFor(entries, { os, arch });
+	if (bundle) return { kind: 'tarball', name: bundle };
+	throw new Error(
+		`no ${name} or versioned tarball in the release. ` +
+			'No release may be published yet; rerun the installer with --relo-version <tag> for a published tag, or without it for the latest release.'
+	);
+}
+
+// tarballFor finds the versioned archive a release publishes for one host
+// inside its own checksums manifest. Releases ship one tarball per
+// platform, and the version is read out of the manifest entry itself, so
+// this resolves both a pinned tag and the unpinned latest release without
+// a second fetch.
+export function tarballFor(entries, { os, arch }) {
+	const match = [...entries.keys()].find((name) => {
+		const parts = new RegExp(`^relo-(.+)-${os}-${arch}\\.tar\\.gz$`).exec(name);
+		return parts && version(parts[1]);
+	});
+	return match ?? null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jonaskahn/relo",
-	"version": "0.1.0-beta.19.453b59ee",
+	"version": "0.1.0-beta.20.d7e7f1ef",
 	"description": "One local proxy that lets Codex, Claude Code, Cursor and Grok, etc. Talk to any model, any provider with no config changes",
 	"license": "AGPL-3.0-only",
 	"type": "module",
@@ -40,6 +40,7 @@
 	},
 	"files": [
 		"bin/relo.mjs",
+		"lib/archive.mjs",
 		"lib/checksums.mjs",
 		"lib/conflict.mjs",
 		"lib/daemon.mjs",