@limrun/ui 0.13.3-rc.1 → 0.13.4

package/src/core/device-install/apple/client.ts

@@ -29,9 +29,7 @@ export type AppleIDLoginResult = {
   close: () => Promise<void>;
 };
 
-type TwoFactorMethod =
-  | { type: 'trustedDevice' }
-  | { type: 'phone'; phoneNumberId: number; mode: string };
+type TwoFactorMethod = { type: 'trustedDevice' } | { type: 'phone'; phoneNumberId: number; mode: string };
 
 export async function startBrowserOwnedAppleIDLogin({
   limbuildApiUrl,
@@ -44,7 +42,9 @@ export async function startBrowserOwnedAppleIDLogin({
     const srp = new AppleGsaSrpClient(accountName);
     const initResponse = await proxySrpInit(limbuildApiUrl, appleSessionId, await srp.init(), token);
     if (initResponse.status < 200 || initResponse.status >= 300) {
-      throw new Error(`Apple SRP init failed: HTTP ${initResponse.status} ${initResponse.rawBody ?? ''}`.trim());
+      throw new Error(
+        `Apple SRP init failed: HTTP ${initResponse.status} ${initResponse.rawBody ?? ''}`.trim(),
+      );
     }
     if (!initResponse.body) {
       throw new Error('Apple SRP init response did not include a body.');
@@ -66,17 +66,20 @@ export async function startBrowserOwnedAppleIDLogin({
     if (requiresTwoFactor) {
       twoFactorChallengeResponse = await triggerTrustedDeviceTwoFactor(limbuildApiUrl, appleSessionId, token);
       const phone = trustedPhoneNumberFromChallenge(twoFactorChallengeResponse.body);
-      if (phone) {
+      // Only route codes through the phone/SMS endpoint when Apple actually
+      // falls back to phone verification (HTTP 412). The trusted-device
+      // challenge body frequently includes trusted-phone metadata even for a
+      // normal device push; routing those codes to the phone endpoint breaks
+      // trusted-device login.
+      if (twoFactorChallengeResponse.status === 412) {
+        if (!phone) {
+          throw new Error('Apple requested phone verification but did not include a trusted phone number.');
+        }
         twoFactorMethod = {
           type: 'phone',
           phoneNumberId: phone.id,
           mode: phone.pushMode ?? 'sms',
         };
-      }
-      if (twoFactorChallengeResponse.status === 412) {
-        if (!phone) {
-          throw new Error('Apple requested phone verification but did not include a trusted phone number.');
-        }
         twoFactorChallengeResponse = await triggerPhoneTwoFactor(
           limbuildApiUrl,
           appleSessionId,
@@ -93,7 +96,9 @@ export async function startBrowserOwnedAppleIDLogin({
         );
       }
     } else if (completeResponse.status < 200 || completeResponse.status >= 300) {
-      throw new Error(`Apple SRP complete failed: HTTP ${completeResponse.status} ${completeResponse.rawBody ?? ''}`.trim());
+      throw new Error(
+        `Apple SRP complete failed: HTTP ${completeResponse.status} ${completeResponse.rawBody ?? ''}`.trim(),
+      );
     }
     return {
       appleSessionId,
@@ -102,18 +107,20 @@ export async function startBrowserOwnedAppleIDLogin({
       requiresTwoFactor,
       finishTwoFactor: async (code) => {
         const response =
-          twoFactorMethod.type === 'phone'
-            ? await proxyPhoneTwoFactorCode(
-                limbuildApiUrl,
-                appleSessionId,
-                twoFactorMethod.phoneNumberId,
-                code,
-                twoFactorMethod.mode,
-                token,
-              )
-            : await proxyTwoFactorCode(limbuildApiUrl, appleSessionId, code, token);
+          twoFactorMethod.type === 'phone' ?
+            await proxyPhoneTwoFactorCode(
+              limbuildApiUrl,
+              appleSessionId,
+              twoFactorMethod.phoneNumberId,
+              code,
+              twoFactorMethod.mode,
+              token,
+            )
+          : await proxyTwoFactorCode(limbuildApiUrl, appleSessionId, code, token);
         if (response.status < 200 || response.status >= 300) {
-          throw new Error(`Apple two-factor code failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim());
+          throw new Error(
+            `Apple two-factor code failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim(),
+          );
         }
         return response;
       },

package/src/core/device-install/apple/crypto.ts

@@ -41,7 +41,11 @@ export async function generateAppleSigningKeyAndCSR(input: AppleCSRInput): Promi
     derContext(0, new Uint8Array()),
   );
   const signature = new Uint8Array(
-    await crypto.subtle.sign('RSASSA-PKCS1-v1_5', keyPair.privateKey, toArrayBuffer(certificationRequestInfo)),
+    await crypto.subtle.sign(
+      'RSASSA-PKCS1-v1_5',
+      keyPair.privateKey,
+      toArrayBuffer(certificationRequestInfo),
+    ),
   );
   const csrDER = derSequence(
     certificationRequestInfo,
@@ -62,11 +66,10 @@ export function exportAppleCertificateP12(input: ExportP12Input) {
   if (!input.certificateBase64 && !input.certificatePEM) {
     throw new Error('certificateBase64 or certificatePEM is required.');
   }
-  const privateKey = forge.pki.privateKeyFromPem(
-    pemFromBase64('PRIVATE KEY', input.privateKeyPKCS8Base64),
-  );
-  const certificate = input.certificatePEM
-    ? forge.pki.certificateFromPem(input.certificatePEM)
+  const privateKey = forge.pki.privateKeyFromPem(pemFromBase64('PRIVATE KEY', input.privateKeyPKCS8Base64));
+  const certificate =
+    input.certificatePEM ?
+      forge.pki.certificateFromPem(input.certificatePEM)
     : forge.pki.certificateFromAsn1(
         forge.asn1.fromDer(forge.util.createBuffer(base64ToBinary(input.certificateBase64!))),
       );

package/src/core/device-install/apple/gsa-srp.ts

@@ -79,13 +79,9 @@ async function deriveApplePassword(
   if (protocol === 's2k_fo') {
     passHash = stringToBytes(util.toHex(passHash));
   }
-  const imported = await crypto.subtle.importKey(
-    'raw',
-    toArrayBuffer(passHash),
-    { name: 'PBKDF2' },
-    false,
-    ['deriveBits'],
-  );
+  const imported = await crypto.subtle.importKey('raw', toArrayBuffer(passHash), { name: 'PBKDF2' }, false, [
+    'deriveBits',
+  ]);
   const derived = await crypto.subtle.deriveBits(
     {
       name: 'PBKDF2',

package/src/core/device-install/apple/provisioning.ts

@@ -87,12 +87,18 @@ export function listTeamsRequest(): AppleProvisioningRequest {
   };
 }
 
-export function findBundleIDRequest({ bundleID, teamID = '' }: Pick<AppleProvisioningContext, 'bundleID' | 'teamID'>) {
+export function findBundleIDRequest({
+  bundleID,
+  teamID = '',
+}: Pick<AppleProvisioningContext, 'bundleID' | 'teamID'>) {
   void bundleID;
   return pagedRequest('/account/ios/identifiers/listAppIds.action', teamID, { sort: 'name=asc' });
 }
 
-export function findDeviceRequest({ deviceUDID, teamID = '' }: Pick<AppleProvisioningContext, 'deviceUDID' | 'teamID'>) {
+export function findDeviceRequest({
+  deviceUDID,
+  teamID = '',
+}: Pick<AppleProvisioningContext, 'deviceUDID' | 'teamID'>) {
   void deviceUDID;
   return pagedRequest('/account/ios/device/listDevices.action', teamID, {
     sort: 'name=asc',
@@ -170,13 +176,7 @@ export function createBundleIDRequest({
   } satisfies AppleProvisioningRequest;
 }
 
-export function submitDevelopmentCSRRequest({
-  csrPEM,
-  teamID = '',
-}: {
-  csrPEM: string;
-  teamID?: string;
-}) {
+export function submitDevelopmentCSRRequest({ csrPEM, teamID = '' }: { csrPEM: string; teamID?: string }) {
   return {
     method: 'POST',
     path: '/account/ios/certificate/submitCertificateRequest.action',
@@ -188,13 +188,7 @@ export function submitDevelopmentCSRRequest({
   } satisfies AppleProvisioningRequest;
 }
 
-export function submitDistributionCSRRequest({
-  csrPEM,
-  teamID = '',
-}: {
-  csrPEM: string;
-  teamID?: string;
-}) {
+export function submitDistributionCSRRequest({ csrPEM, teamID = '' }: { csrPEM: string; teamID?: string }) {
   return {
     method: 'POST',
     path: '/account/ios/certificate/submitCertificateRequest.action',
@@ -313,10 +307,14 @@ export async function getReusableAppleSigningAssets({
 export async function putAppleGeneratedSigningAssets(input: PutAppleGeneratedSigningAssetsInput) {
   return putSigningAssets({
     ...input,
-    certificateFileName: input.certificateID ? `${input.certificateID}.p12` : `apple-${input.signingMode ?? 'development'}.p12`,
+    certificateFileName:
+      input.certificateID ? `${input.certificateID}.p12` : `apple-${input.signingMode ?? 'development'}.p12`,
     certificatePassword: input.certificatePassword || undefined,
     signingMode: input.signingMode,
-    profileFileName: input.profile.uuid ? `${input.profile.uuid}.mobileprovision` : `${input.signingMode ?? 'development'}.mobileprovision`,
+    profileFileName:
+      input.profile.uuid ?
+        `${input.profile.uuid}.mobileprovision`
+      : `${input.signingMode ?? 'development'}.mobileprovision`,
   });
 }
 

package/src/core/device-install/apple/relay.ts

@@ -26,7 +26,11 @@ export async function createAppleRelaySession(limbuildApiUrl: string, token?: st
   return (await response.json()) as { appleSessionId: string };
 }
 
-export async function deleteAppleRelaySession(limbuildApiUrl: string, appleSessionId: string, token?: string) {
+export async function deleteAppleRelaySession(
+  limbuildApiUrl: string,
+  appleSessionId: string,
+  token?: string,
+) {
   const response = await fetch(limbuildURL(limbuildApiUrl, '/apple/auth/session/delete', token), {
     method: 'POST',
     headers: jsonHeaders(token),

package/src/core/device-install/operations/limbuild-client.ts

@@ -123,11 +123,18 @@ export function watchBuildLogEvents({
   events.addEventListener('stderr', (event) => onLine({ type: 'stderr', data: event.data }));
   events.addEventListener('exitCode', (event) => {
     const code = parseInt(event.data, 10);
-    onStatus(code === 0 ? 'succeeded' : code < 0 ? 'cancelled' : 'failed');
+    onStatus(
+      code === 0 ? 'succeeded'
+      : code < 0 ? 'cancelled'
+      : 'failed',
+    );
     events.close();
   });
   events.onerror = () => {
     events.close();
+    // The stream closed without a terminal exitCode event. Mark the build as
+    // failed so consumers don't stay stuck on "running" and can retry.
+    onStatus('failed');
     onError?.(new Error('Build log stream closed before completion.'));
   };
   return () => events.close();

package/src/core/device-install/operations/operations.ts

@@ -155,7 +155,9 @@ async function claimBestUsbmuxCandidate(target: DeviceRelayTarget, log: DeviceIn
         lastError = error;
         log(
           'USB interface claim failed',
-          `configuration ${candidate.configurationValue}, interface ${candidate.interfaceNumber}: ${errorMessage(error)}`,
+          `configuration ${candidate.configurationValue}, interface ${
+            candidate.interfaceNumber
+          }: ${errorMessage(error)}`,
         );
         await resetUSBDevice(target);
         await sleep(250);

package/src/core/device-install/operations/relay-client.ts

@@ -40,10 +40,17 @@ export class RelayClient {
     socket.onclose = () => {
       this.closed = true;
       this.log('Relay socket closed');
-      if (this.pairRecordWaiter) {
-        this.pairRecordWaiter.reject(new Error('Relay socket closed'));
-        this.pairRecordWaiter = undefined;
-      }
+      // The server often sends PairRecordReady and then closes immediately. In
+      // Chromium, onclose can be delivered before the queued onmessage handler
+      // has finished processing that final frame. Drain the frame queue before
+      // rejecting the waiter so a successful pair is not reported as
+      // "Relay socket closed".
+      void this.frameQueue.finally(() => {
+        if (this.pairRecordWaiter) {
+          this.pairRecordWaiter.reject(new Error('Relay socket closed'));
+          this.pairRecordWaiter = undefined;
+        }
+      });
     };
     await new Promise<void>((resolve, reject) => {
       socket.onopen = () => resolve();
@@ -92,9 +99,11 @@ export class RelayClient {
   }
 
   private enqueueFrame(data: Uint8Array) {
-    this.frameQueue = this.frameQueue.then(() => this.handleFrame(decodeFrame(data))).catch((error) => {
-      this.log('Relay frame handling failed', error instanceof Error ? error.message : String(error));
-    });
+    this.frameQueue = this.frameQueue
+      .then(() => this.handleFrame(decodeFrame(data)))
+      .catch((error) => {
+        this.log('Relay frame handling failed', error instanceof Error ? error.message : String(error));
+      });
   }
 
   private async handleFrame(frame: ReturnType<typeof decodeFrame>) {
@@ -163,7 +172,10 @@ export class RelayClient {
       this.log(`Opened device stream ${streamId} to port ${port}`);
       void this.pumpDeviceToServer(streamId, stream);
     } catch (error) {
-      this.log(`Open device stream ${streamId} failed`, error instanceof Error ? error.message : String(error));
+      this.log(
+        `Open device stream ${streamId} failed`,
+        error instanceof Error ? error.message : String(error),
+      );
       await this.send({
         type: RelayMessageType.OpenResult,
         requestId,
@@ -230,26 +242,44 @@ function formatInstallProgress(message: string) {
   if (!message.startsWith(prefix)) {
     return message;
   }
-  const xml = message.slice(prefix.length);
-  const doc = new DOMParser().parseFromString(xml, 'application/xml');
-  const dict = doc.querySelector('plist > dict');
-  if (!dict) {
-    return message;
+  const plist = message.slice(prefix.length);
+  // The relay message is untrusted device input. Parsing it with DOMParser is
+  // both an XSS DOM sink and an XML entity-expansion (billion-laughs) vector,
+  // so extract only the fields we render via plain string scanning instead of
+  // building a DOM.
+  // Surface the real failure reason (e.g. ApplicationVerificationFailed) rather
+  // than collapsing it to an opaque numeric code downstream.
+  const error = readPlistValue(plist, 'Error');
+  if (error) {
+    const description = readPlistValue(plist, 'ErrorDescription');
+    return `Install error: ${error}${description ? ` — ${description}` : ''}`;
   }
-  const values = readPlistDict(dict);
-  const status = values.Status ?? 'Unknown';
-  const percent = values.PercentComplete ? `${values.PercentComplete}% ` : '';
-  return `Install progress: ${percent}${status}`;
+  const status = readPlistValue(plist, 'Status') ?? 'Unknown';
+  const percent = readPlistValue(plist, 'PercentComplete');
+  return `Install progress: ${percent ? `${percent}% ` : ''}${status}`;
 }
 
-function readPlistDict(dict: Element) {
-  const result: Record<string, string> = {};
-  const children = Array.from(dict.children);
-  for (let index = 0; index < children.length; index += 2) {
-    const key = children[index];
-    const value = children[index + 1];
-    if (!key || key.tagName !== 'key' || !value) continue;
-    result[key.textContent ?? ''] = value.textContent ?? '';
-  }
-  return result;
+// Returns the <string>/<integer>/<real> value immediately following
+// <key>NAME</key> in an Apple plist fragment, without an XML/DOM parser.
+function readPlistValue(plist: string, key: string): string | undefined {
+  const pattern = new RegExp(
+    `<key>\\s*${escapeRegExp(
+      key,
+    )}\\s*</key>\\s*<(?:string|integer|real)>([\\s\\S]*?)</(?:string|integer|real)>`,
+  );
+  const match = pattern.exec(plist);
+  return match ? decodeBasicXmlEntities(match[1].trim()) : undefined;
+}
+
+function escapeRegExp(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function decodeBasicXmlEntities(value: string) {
+  return value
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, '&');
 }

package/src/core/device-install/operations/usbmux.ts

@@ -150,9 +150,9 @@ async function sendMux(session: UsbmuxSession, protocol: number, payload: Uint8A
   session.writeChain = session.writeChain.then(async () => {
     if (session.closed) return;
     const packet =
-      session.muxVersion >= 2
-        ? buildV2Packet(protocol, payload, session.txSeq++, session.rxSeq)
-        : buildV1Packet(protocol, payload);
+      session.muxVersion >= 2 ?
+        buildV2Packet(protocol, payload, session.txSeq++, session.rxSeq)
+      : buildV1Packet(protocol, payload);
     await transferOutWithZlp(session.device, session.outEndpoint, packet);
   });
   return session.writeChain;

package/src/core/device-install/operations/webusb.ts

@@ -39,7 +39,9 @@ export function findUsbmuxCandidates(device: USBDevice): UsbmuxCandidate[] {
   return candidates;
 }
 
-function findConfigurationUsbmuxCandidates(configuration: USBDevice['configurations'][number]): UsbmuxCandidate[] {
+function findConfigurationUsbmuxCandidates(
+  configuration: USBDevice['configurations'][number],
+): UsbmuxCandidate[] {
   const candidates: UsbmuxCandidate[] = [];
   for (const usbInterface of configuration.interfaces) {
     for (const alternate of usbInterface.alternates) {
@@ -68,9 +70,12 @@ export async function claimUsbmux(device: USBDevice, candidate: UsbmuxCandidate)
     await device.selectConfiguration(candidate.configurationValue);
   }
   await device.claimInterface(candidate.interfaceNumber);
-  if (candidate.alternateSetting !== 0) {
-    await device.selectAlternateInterface(candidate.interfaceNumber, candidate.alternateSetting);
-  }
+  // Always select the alternate (even alt 0). On macOS Chrome the
+  // interface's endpoints are not treated as active until the alternate
+  // is explicitly selected, which otherwise surfaces as
+  // "endpoint is not part of a claimed and selected alternate interface"
+  // on the first transferIn/transferOut.
+  await device.selectAlternateInterface(candidate.interfaceNumber, candidate.alternateSetting);
 }
 
 export function getBulkEndpoints(candidate: UsbmuxCandidate) {

package/src/core/device-install/storage/browser-storage.ts

@@ -73,12 +73,13 @@ export async function getLatestSigningAssets(signingMode: DeviceInstallSigningMo
   const all = await getAllSigningAssets();
   return all
     .filter((asset) => (asset.signingMode ?? 'development') === signingMode)
-    .sort(
-      (left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime(),
-    )[0];
+    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())[0];
 }
 
-export async function getLatestSigningAssetsWithCertificate(teamID?: string, signingMode: DeviceInstallSigningMode = 'development') {
+export async function getLatestSigningAssetsWithCertificate(
+  teamID?: string,
+  signingMode: DeviceInstallSigningMode = 'development',
+) {
   const all = await getAllSigningAssets();
   return all
     .filter((asset) => {
@@ -116,11 +117,16 @@ export async function putSigningAssets(input: PutSigningAssetsInput) {
   return stored;
 }
 
-export async function findSigningAssetsForBundle(bundleID?: string, signingMode: DeviceInstallSigningMode = 'development') {
+export async function findSigningAssetsForBundle(
+  bundleID?: string,
+  signingMode: DeviceInstallSigningMode = 'development',
+) {
   const normalized = normalizeBundleID(bundleID);
   if (!normalized) return [];
   const all = await getAllSigningAssets();
-  return all.filter((asset) => asset.bundleID === normalized && (asset.signingMode ?? 'development') === signingMode);
+  return all.filter(
+    (asset) => asset.bundleID === normalized && (asset.signingMode ?? 'development') === signingMode,
+  );
 }
 
 export function profileContainsDevice(profile: ProvisioningProfileInfo, deviceUDID?: string) {
@@ -160,6 +166,14 @@ export function parseProvisioningProfileBytes(bytes: Uint8Array) {
     throw new Error('Provisioning profile plist not found.');
   }
   const xml = text.slice(start, end + '</plist>'.length);
+  // Defensively reject entity declarations before parsing: they are the vector
+  // for XML entity-expansion (billion-laughs) attacks and never appear in a
+  // real provisioning profile. The standard Apple `<!DOCTYPE plist PUBLIC ...>`
+  // (an external DTD reference with no internal entity subset) is benign —
+  // browsers' DOMParser does not fetch it — so it is intentionally allowed.
+  if (/<!ENTITY/i.test(xml)) {
+    throw new Error('Provisioning profile plist contains a disallowed ENTITY declaration.');
+  }
   const doc = new DOMParser().parseFromString(xml, 'application/xml');
   if (doc.querySelector('parsererror')) {
     throw new Error('Provisioning profile plist could not be parsed.');

package/src/core/device-install/types.ts

@@ -8,13 +8,7 @@ export type DeviceInstallStepStatus = 'idle' | 'active' | 'complete' | 'error';
 
 export type DeviceInstallBusyAction = 'signing' | 'usb' | 'pair' | 'build' | 'install';
 
-export type DeviceInstallBuildStatus =
-  | 'idle'
-  | 'queued'
-  | 'running'
-  | 'succeeded'
-  | 'failed'
-  | 'cancelled';
+export type DeviceInstallBuildStatus = 'idle' | 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled';
 
 export type BuildLogLine = {
   type: 'command' | 'stdout' | 'stderr' | 'meta';

package/src/device-build/react.ts

@@ -100,7 +100,10 @@ export function useDeviceBuild({
                 .catch((caught) => setError(errorMessage(caught)));
             }
           },
-          onError: (caught) => setError(caught.message),
+          onError: (caught) => {
+            setStatus('failed');
+            setError(caught.message);
+          },
         });
         return result.execId;
       } catch (caught) {