@linxin666/dsh-pet 0.2.9 → 0.3.0

package/src/registry.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { closeSync, existsSync, ftruncateSync, mkdirSync, mkdtempSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
@@ -8,6 +8,7 @@ import {
   DEFAULT_TRACK_PATTERNS,
   PET_ROW_ORDER,
   PET_SCAN_JSON_CAP,
+  PET_SCAN_LIVE2D_MODEL_CAP,
   codexPetsDir,
   loadPetRegistry,
   petAtlasFile,
@@ -261,6 +262,41 @@ describe('loadPetRegistry', () => {
       rmSync(root, { recursive: true, force: true })
     }
   })
+
+  it('skips an oversized pet.json with a warning instead of reading it', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'loud'), { recursive: true })
+      writeFileSync(join(petsDir, 'loud', 'pet.json'), '{ ' + 'x'.repeat(PET_SCAN_JSON_CAP) + ' }', 'utf8')
+      // A healthy neighbor keeps listing while the pathological one is skipped.
+      mkdirSync(join(petsDir, 'plain'), { recursive: true })
+      writeFileSync(join(petsDir, 'plain', 'pet.json'), JSON.stringify({
+        id: 'plain', displayName: 'Plain', spritesheetPath: 'spritesheet.webp',
+      }), 'utf8')
+      writeFileSync(join(petsDir, 'plain', 'spritesheet.webp'), 'webp', 'utf8')
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.byId('loud')).toBeUndefined()
+      expect(registry.byId('plain')).toBeDefined()
+      expect(registry.warnings.some(w => w.includes('scan ceiling'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it('skips a non-regular pet.json with a warning', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'odd', 'pet.json'), { recursive: true })
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.entries.map(entry => entry.id)).toEqual([])
+      expect(registry.warnings.some(w => w.includes('not a regular file'))).toBe(true)
+      expect(registry.diagnostics.some(d => d.level === 'warning' && d.message.includes('pet manifest is not a regular file'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
 })
 
 describe('codexPetsDir', () => {
@@ -479,6 +515,52 @@ describe('loadPetRegistry pet-center v2 (issue #623)', () => {
       rmSync(root, { recursive: true, force: true })
     }
   })
+
+  it('skips a live2d pet whose model3.json exceeds the model scan ceiling with a warning', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'haru'), { recursive: true })
+      writeFileSync(join(petsDir, 'haru', 'pet.json'), JSON.stringify({
+        petManifestVersion: 2, id: 'haru', displayName: 'Haru', license: 'Live2D-Sample',
+        renderer: 'live2d', live2d: { model: 'haru.model3.json', motions: { idle: 'Idle' } },
+      }), 'utf8')
+      // A sparse file one byte past the ceiling: stat reports the size
+      // without materializing 32 MB of bytes on disk.
+      const fd = openSync(join(petsDir, 'haru', 'haru.model3.json'), 'w')
+      try {
+        ftruncateSync(fd, PET_SCAN_LIVE2D_MODEL_CAP + 1)
+      } finally {
+        closeSync(fd)
+      }
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.byId('haru')).toBeUndefined()
+      expect(registry.warnings.some(w => w.includes('scan ceiling'))).toBe(true)
+      expect(registry.diagnostics.some(d => d.level === 'warning'
+        && d.message.includes('exceeds the ' + PET_SCAN_LIVE2D_MODEL_CAP + '-byte scan ceiling'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it('skips a live2d pet whose model3.json is not a regular file with a warning', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'haru', 'haru.model3.json'), { recursive: true })
+      writeFileSync(join(petsDir, 'haru', 'pet.json'), JSON.stringify({
+        petManifestVersion: 2, id: 'haru', displayName: 'Haru', license: 'Live2D-Sample',
+        renderer: 'live2d', live2d: { model: 'haru.model3.json', motions: { idle: 'Idle' } },
+      }), 'utf8')
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.byId('haru')).toBeUndefined()
+      expect(registry.warnings.some(w => w.includes('not a regular file'))).toBe(true)
+      expect(registry.diagnostics.some(d => d.level === 'warning'
+        && d.message.includes('live2d model haru.model3.json is not a regular file'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
 })
 
 describe('voice packs (pet-center M4, issue #677)', () => {

package/src/registry.ts

@@ -516,9 +516,20 @@ function resolveLive2dEntry(
     record('error', 'pet ' + manifest.id + ': renderer live2d requires a live2d block')
     return undefined
   }
+  const modelFile = join(dir, block.model)
   let model3: unknown
   try {
-    model3 = JSON.parse(readFileSync(join(dir, block.model), 'utf8'))
+    // Stat guard before the read: a pathological model file — huge, or a
+    // FIFO/device — is skipped with a warning instead of stalling the host
+    // at scan time, mirroring the voice/decoration descriptor discipline.
+    // The guard stays silent on stat errors, so a missing or unreadable
+    // path is re-stat'ed here to fall through to the original fail-closed
+    // 'not readable' diagnostic below.
+    if (guardedScannedJsonStat(modelFile, options, 'live2d model ' + block.model, PET_SCAN_LIVE2D_MODEL_CAP) === undefined) {
+      statSync(modelFile)
+      return undefined
+    }
+    model3 = JSON.parse(readFileSync(modelFile, 'utf8'))
   } catch (error) {
     record('error', 'pet ' + manifest.id + ': live2d model ' + block.model + ' is not readable: '
       + (error instanceof Error ? error.message : String(error)))
@@ -583,7 +594,7 @@ function scanPetDir(dir: string, options: { assetPrefix?: string; warnings?: str
   for (const name of names) {
     const manifestFile = join(dir, name, 'pet.json')
     if (!existsSync(manifestFile)) continue
-    const parsed = readPetJson(manifestFile, options.warnings)
+    const parsed = readPetJson(manifestFile, options)
     if (parsed === undefined) continue
     const entryDir = join(dir, name)
     const verdict = parsePetManifest(parsed, entryDir)
@@ -613,12 +624,21 @@ function scanPetDir(dir: string, options: { assetPrefix?: string; warnings?: str
   return entries
 }
 
-/** Read and parse one manifest file; undefined (warning recorded) on failure. */
-function readPetJson(file: string, warnings: string[] | undefined): unknown {
+/**
+ * Read and parse one pet.json manifest; undefined (warning recorded) on
+ * failure. The descriptor stat guard applies first: a pathological file —
+ * huge, or a FIFO/device — is skipped with a warning instead of stalling
+ * or OOM-ing the host at scan time (same discipline as voice/decoration).
+ */
+function readPetJson(
+  file: string,
+  options: { warnings?: string[]; diagnostics?: PetRegistryDiagnostic[] },
+): unknown {
+  if (guardedScannedJsonStat(file, options, 'pet manifest') === undefined) return undefined
   try {
     return JSON.parse(readFileSync(file, 'utf8'))
   } catch (error) {
-    warnings?.push('skipping ' + file + ': ' + (error instanceof Error ? error.message : String(error)))
+    options.warnings?.push('skipping ' + file + ': ' + (error instanceof Error ? error.message : String(error)))
     return undefined
   }
 }
@@ -632,16 +652,28 @@ function readPetJson(file: string, warnings: string[] | undefined): unknown {
  */
 export const PET_SCAN_JSON_CAP = 64 * 1024
 
+/**
+ * Scan-time read ceiling for a live2d model3.json, matching the asset
+ * route's model cap (PET_ASSET_CAPS.model). Model descriptors are far
+ * larger than the other scanned JSON, but a pathological file — huge, or a
+ * FIFO/device — must still be skipped with a warning instead of stalling
+ * or OOM-ing the host at plugin startup (same review-spd follow-up).
+ */
+export const PET_SCAN_LIVE2D_MODEL_CAP = 32 * 1024 * 1024
+
 /**
  * Stat one scanned JSON descriptor with a regular-file + size guard, so a
  * pathological user file is skipped with a warning instead of stalling or
  * OOM-ing the host at startup. Returns the Stats, or undefined when the
- * caller must skip the file (a warning was recorded).
+ * caller must skip the file (a warning was recorded). 'cap' defaults to
+ * the descriptor ceiling (PET_SCAN_JSON_CAP); model descriptors pass the
+ * larger live2d ceiling.
  */
 function guardedScannedJsonStat(
   file: string,
   options: { warnings?: string[]; diagnostics?: PetRegistryDiagnostic[] },
   what: string,
+  cap: number = PET_SCAN_JSON_CAP,
 ): ReturnType<typeof statSync> | undefined {
   let st: ReturnType<typeof statSync>
   try {
@@ -657,8 +689,8 @@ function guardedScannedJsonStat(
     warn(what + ' is not a regular file; ignored')
     return undefined
   }
-  if (st.size > PET_SCAN_JSON_CAP) {
-    warn(what + ' exceeds the ' + PET_SCAN_JSON_CAP + '-byte scan ceiling; ignored')
+  if (st.size > cap) {
+    warn(what + ' exceeds the ' + cap + '-byte scan ceiling; ignored')
     return undefined
   }
   return st

package/src/routes.ts

@@ -23,6 +23,7 @@ import type { PetInteraction } from './affinity.ts'
 import { DECORATION_ASSET_PREFIX, petEntryView, petPackageRoot, type PetEntry, type PetRegistry } from './registry.ts'
 import { isPetAllowed } from './access.ts'
 import { dshHome } from './dsh-home.ts'
+import { readJsonBody, writeJson } from './http.ts'
 
 /** Browser-facing base path of the pet API. */
 export const PET_API_PREFIX = '/api/pet'
@@ -97,52 +98,17 @@ function mimeFor(file: string): string {
   return MIME_BY_EXT[file.slice(dot).toLowerCase()] ?? 'application/octet-stream'
 }
 
-/** Write one JSON response. */
-function json(res: ServerResponse, status: number, body: unknown): void {
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' })
-  res.end(JSON.stringify(body))
-}
-
 /** Require the method or answer 405. */
 function requireMethod(req: IncomingMessage, res: ServerResponse, method: string): boolean {
   if (req.method === method) return true
-  json(res, 405, { ok: false, error: 'method-not-allowed' })
+  writeJson(res, 405, { ok: false, error: 'method-not-allowed' })
   return false
 }
 
-/** Read a JSON request body (bounded). */
-function readJsonBody(req: IncomingMessage): Promise<unknown> {
-  return new Promise((resolve, reject) => {
-    let size = 0
-    const chunks: Buffer[] = []
-    req.on('data', (chunk: Buffer) => {
-      size += chunk.length
-      if (size > 64 * 1024) {
-        reject(new Error('body-too-large'))
-        queueMicrotask(() => req.destroy())
-        return
-      }
-      chunks.push(chunk)
-    })
-    req.on('end', () => {
-      if (chunks.length === 0) {
-        resolve({})
-        return
-      }
-      try {
-        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')))
-      } catch {
-        reject(new Error('invalid-json'))
-      }
-    })
-    req.on('error', reject)
-  })
-}
-
 /** Shared route fence: loopback always passes; a live paired-device cookie is an extra allow path. */
 function guard(ctx: Context, req: IncomingMessage, res: ServerResponse): boolean {
   if (isPetAllowed(ctx, req)) return true
-  json(res, 403, { ok: false, error: 'forbidden: loopback-only' })
+  writeJson(res, 403, { ok: false, error: 'forbidden: loopback-only' })
   return false
 }
 
@@ -154,8 +120,8 @@ function getRoute(ctx: Context, path: string, run: () => Promise<unknown>): WebR
     handler: (req: IncomingMessage, res: ServerResponse): void => {
       if (!guard(ctx, req, res)) return
       if (!requireMethod(req, res, 'GET')) return
-      run().then((value) => json(res, 200, value), (error) => {
-        json(res, 500, { ok: false, error: error instanceof Error ? error.message : String(error) })
+      run().then((value) => writeJson(res, 200, value), (error) => {
+        writeJson(res, 500, { ok: false, error: error instanceof Error ? error.message : String(error) })
       })
     },
   }
@@ -169,16 +135,21 @@ function postRoute(ctx: Context, path: string, run: (body: Record<string, unknow
     handler: (req: IncomingMessage, res: ServerResponse): Promise<void> => {
       if (!guard(ctx, req, res)) return Promise.resolve()
       if (!requireMethod(req, res, 'POST')) return Promise.resolve()
-      return readJsonBody(req).then((body) => {
-        const record = (typeof body === 'object' && body !== null) ? body as Record<string, unknown> : {}
+      // Shared lenient reader (64 KiB cap): an empty body yields null and is
+      // restored to {} at the call site (legacy empty-body semantics); invalid
+      // JSON and over-limit bodies also yield null, so the endpoint validators
+      // below keep answering 400 with the same { ok: false, error } envelope.
+      return readJsonBody(req, { maxBytes: 64 * 1024 }).then((parsed) => {
+        const payload = parsed ?? {}
+        const record = (typeof payload === 'object' && payload !== null) ? payload as Record<string, unknown> : {}
         return run(record).then(
-          (value) => json(res, 200, value),
+          (value) => writeJson(res, 200, value),
           (error) => {
-            json(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
+            writeJson(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
           },
         )
       }, (error) => {
-        json(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
+        writeJson(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
       })
     },
   }
@@ -393,7 +364,7 @@ function runtimeHandler(ctx: Context, roots: { runtimeDir: string; vendorDir: st
     const base = spec.root === 'runtimeDir' ? roots.runtimeDir : roots.vendorDir
     const file = join(base, name)
     if (!existsSync(file)) {
-      json(res, 404, { ok: false, error: 'runtime-file-missing', file: name })
+      writeJson(res, 404, { ok: false, error: 'runtime-file-missing', file: name })
       return
     }
     const resolved = containedRealpath(base, file)