@manturhub/cli 0.9.2 → 0.9.4

package/lib/archive.js

@@ -10,8 +10,9 @@ import {
 import { basename, join, posix } from "node:path";
 import { tmpdir } from "node:os";
 
-const MAX_FILES = 2000;
+const MAX_FILES = 20000;
 const MAX_UNPACKED_BYTES = 500 * 1024 * 1024;
+const ARCHIVE_LIST_MAX_BUFFER = 32 * 1024 * 1024;
 
 export function validateSlug(slug, label = "ID") {
   if (!slug || !/^[a-z0-9][a-z0-9._-]*$/i.test(slug)) {
@@ -20,8 +21,8 @@ export function validateSlug(slug, label = "ID") {
   return slug;
 }
 
-function listArchive(zipPath) {
-  const commands = [
+function archiveTools(zipPath) {
+  return [
     {
       command: "unzip",
       list: ["-Z1", zipPath],
@@ -36,19 +37,16 @@ function listArchive(zipPath) {
       extract: (dest) => ["-xf", zipPath, "-C", dest],
     },
   ];
-  for (const tool of commands) {
-    try {
-      const output = execFileSync(tool.command, tool.list, { encoding: "utf8" });
-      const verbose = execFileSync(tool.command, tool.verbose, { encoding: "utf8" });
-      const summary = tool.summary
-        ? execFileSync(tool.command, tool.summary, { encoding: "utf8" })
-        : "";
-      return { tool, entries: output.split(/\r?\n/).filter(Boolean), verbose, summary };
-    } catch {
-      // Try the next installed extractor.
-    }
-  }
-  throw new Error("解压失败（需系统 tar 或 unzip 命令）");
+}
+
+function inspectArchive(tool) {
+  const execOptions = { encoding: "utf8", maxBuffer: ARCHIVE_LIST_MAX_BUFFER };
+  const output = execFileSync(tool.command, tool.list, execOptions);
+  const verbose = execFileSync(tool.command, tool.verbose, execOptions);
+  const summary = tool.summary
+    ? execFileSync(tool.command, tool.summary, execOptions)
+    : "";
+  return { entries: output.split(/\r?\n/).filter(Boolean), verbose, summary };
 }
 
 function declaredUnpackedBytes(tool, verbose, summary) {
@@ -129,18 +127,44 @@ function rejectDestinationLinks(dir) {
 }
 
 export function extractZipSafely(zipPath, dest) {
-  const { tool, entries, verbose, summary } = listArchive(zipPath);
-  validateArchiveEntries(entries, verbose, declaredUnpackedBytes(tool, verbose, summary));
-  const staging = mkdtempSync(join(tmpdir(), "manturhub-extract-"));
-  try {
-    execFileSync(tool.command, tool.extract(staging), { stdio: ["ignore", "ignore", "ignore"] });
-    inspectExtracted(staging);
-    mkdirSync(dest, { recursive: true });
-    rejectDestinationLinks(dest);
-    for (const entry of readdirSync(staging)) {
-      cpSync(join(staging, entry), join(dest, basename(entry)), { recursive: true, force: true });
+  let foundExtractor = false;
+  for (const tool of archiveTools(zipPath)) {
+    let archive;
+    try {
+      archive = inspectArchive(tool);
+      foundExtractor = true;
+    } catch (error) {
+      if (error?.code !== "ENOENT") foundExtractor = true;
+      continue;
     }
-  } finally {
-    rmSync(staging, { recursive: true, force: true });
+    validateArchiveEntries(
+      archive.entries,
+      archive.verbose,
+      declaredUnpackedBytes(tool, archive.verbose, archive.summary)
+    );
+
+    const staging = mkdtempSync(join(tmpdir(), "manturhub-extract-"));
+    try {
+      try {
+        execFileSync(tool.command, tool.extract(staging), { stdio: ["ignore", "ignore", "ignore"] });
+      } catch {
+        // Some macOS unzip builds can list legacy-encoded Chinese filenames but fail
+        // while creating them. Let the next validated extractor (bsdtar via `tar`) try.
+        continue;
+      }
+      inspectExtracted(staging);
+      mkdirSync(dest, { recursive: true });
+      rejectDestinationLinks(dest);
+      for (const entry of readdirSync(staging)) {
+        cpSync(join(staging, entry), join(dest, basename(entry)), { recursive: true, force: true });
+      }
+      return;
+    } finally {
+      rmSync(staging, { recursive: true, force: true });
+    }
+  }
+  if (foundExtractor) {
+    throw new Error("解压失败：安装包格式无效、已损坏或文件清单过大");
   }
+  throw new Error("解压失败（需系统 tar 或 unzip 命令）");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manturhub/cli",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "ManturHub 算子广场 CLI：通过 REST 发现和调用 AI 算子、浏览配方，并安装 Skill 与 Agent 套件",
   "type": "module",
   "bin": {