@maxceem/agw 0.14.0 → 0.15.0

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.14.0", wrangler: "4.96.0", upgradeFrom: ["0.14.0", "0.13.1", "0.13.0", "0.12.1", "0.12.0", "0.11.2", "0.11.1", "0.11.0", "0.10.11", "0.10.10", "0.10.9", "0.10.8", "0.10.7", "0.10.6", "0.10.5", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.14.0/gateway-0.14.0.tar.gz", sha256: "5aa7d75f4a2570fcb92a34fba3735561d9bacbfad6ea109aedfb020521482793", manifest: "93881984b069a1bb21654753c2c7c221897e406afe32781feb146f3501ad7c79" } };
+var define_AGW_MANIFEST_default = { version: "0.15.0", wrangler: "4.96.0", upgradeFrom: ["0.15.0", "0.14.0", "0.13.1", "0.13.0", "0.12.1", "0.12.0", "0.11.2", "0.11.1", "0.11.0", "0.10.11", "0.10.10", "0.10.9", "0.10.8", "0.10.7", "0.10.6", "0.10.5", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.15.0/gateway-0.15.0.tar.gz", sha256: "a16f9357ee510e03ba06f1d9ddc531057d00fef1750a0318969da72b8c3ef282", manifest: "48e6067ef1475bf894a3f00021c5caf3ee2140fae57f64d487f32e2f93e2553f" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -22622,7 +22622,7 @@ function snippetRemedy(code, appId, language) {
 
 // src/conversations.ts
 import { mkdir as mkdir2, readFile as readFile3, stat, writeFile } from "node:fs/promises";
-import { dirname, join as join2, resolve as resolve2 } from "node:path";
+import { dirname, isAbsolute, relative, resolve as resolve2 } from "node:path";
 import { gunzipSync } from "node:zlib";
 
 // src/usage.ts
@@ -22686,6 +22686,14 @@ async function sizeOf(path) {
     return null;
   }
 }
+function inside(output2, name) {
+  const path = resolve2(output2, name);
+  const rel = relative(output2, path);
+  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) {
+    fail("invalid_response", "The deployment named a conversation file outside the export folder.", void 0, 3);
+  }
+  return path;
+}
 async function save(path, bytes) {
   await mkdir2(dirname(path), { recursive: true });
   await writeFile(path, bytes);
@@ -22715,7 +22723,7 @@ async function conversationsCommand(ctx, appId, flags) {
     })).data;
     for (const file2 of page2.files) {
       result.files += 1;
-      const path = join2(output2, file2.name);
+      const path = inside(output2, file2.name);
       batches.push(path);
       if (await sizeOf(path) === file2.size) continue;
       const bytes = await ctx.client.download("getAppConversationFile", {
@@ -22735,7 +22743,7 @@ async function conversationsCommand(ctx, appId, flags) {
       for (const match of text2.matchAll(MEDIA_REFERENCE)) names.add(match[1]);
     }
     for (const name of names) {
-      const path = join2(output2, name);
+      const path = inside(output2, name);
       if (await sizeOf(path) !== null) continue;
       const bytes = await ctx.client.download("getAppConversationFile", {
         params: { app: appId },
@@ -26322,11 +26330,11 @@ async function openBrowser(url2) {
 // src/deployment.ts
 import { createHash as createHash4, randomUUID } from "node:crypto";
 import { writeFile as writeFile4, unlink as unlink2 } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { join as join4 } from "node:path";
 
 // src/release.ts
 import { readFile as readFile4, lstat as lstat2, mkdir as mkdir3, rename as rename2, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join3, dirname as dirname2 } from "node:path";
+import { join as join2, dirname as dirname2 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createHash as createHash3, randomBytes as randomBytes3 } from "node:crypto";
 
@@ -26451,7 +26459,7 @@ async function fetchArchive(url2) {
 async function extract(archive, directory) {
   await mkdir3(directory, { recursive: true, mode: 448 });
   for (const entry of readArchive(archive)) {
-    const path = join3(directory, entry.path);
+    const path = join2(directory, entry.path);
     if (entry.directory) {
       await mkdir3(path, { recursive: true, mode: 448 });
       continue;
@@ -26461,9 +26469,9 @@ async function extract(archive, directory) {
   }
 }
 async function cachedRelease(version2, integrity, source) {
-  const root = source.cache ?? join3(cacheDirectory(), "releases");
-  const directory = join3(root, version2);
-  const cached2 = await readFile4(join3(directory, "manifest.json")).catch(() => null);
+  const root = source.cache ?? join2(cacheDirectory(), "releases");
+  const directory = join2(root, version2);
+  const cached2 = await readFile4(join2(directory, "manifest.json")).catch(() => null);
   if (cached2 && digest(cached2) === integrity.manifest) return directory;
   const supplied = source.archive ?? process.env["AGW_RELEASE_ARCHIVE"] ?? void 0;
   let archive;
@@ -26487,10 +26495,10 @@ async function cachedRelease(version2, integrity, source) {
       4
     );
   await protectedDirectory(root);
-  const staging = join3(root, `.${version2}-${randomBytes3(8).toString("hex")}`);
+  const staging = join2(root, `.${version2}-${randomBytes3(8).toString("hex")}`);
   try {
     await extract(archive, staging);
-    const manifest2 = await readFile4(join3(staging, "manifest.json")).catch(() => null);
+    const manifest2 = await readFile4(join2(staging, "manifest.json")).catch(() => null);
     if (!manifest2 || digest(manifest2) !== integrity.manifest)
       fail(
         "release_integrity",
@@ -26516,7 +26524,7 @@ async function release2(requested = VERSION, base = dirname2(fileURLToPath(impor
   if (major === void 0 || minor === void 0 || major < 22 || major === 22 && minor < 19)
     fail("unsupported_runtime", "Node.js 22.19.0 or newer is required.");
   const integrity = source.integrity === void 0 ? RELEASE : source.integrity;
-  const packaged = join3(base, "release", requested);
+  const packaged = join2(base, "release", requested);
   const local = await lstat2(packaged).catch(() => null);
   let directory;
   if (local?.isDirectory()) directory = packaged;
@@ -26530,7 +26538,7 @@ async function release2(requested = VERSION, base = dirname2(fileURLToPath(impor
     );
   let serialized;
   try {
-    serialized = await readFile4(join3(directory, "manifest.json"), "utf8");
+    serialized = await readFile4(join2(directory, "manifest.json"), "utf8");
   } catch {
     fail(
       "release_missing",
@@ -26550,7 +26558,7 @@ async function release2(requested = VERSION, base = dirname2(fileURLToPath(impor
   for (const [path, hash2] of Object.entries(manifest2.files)) {
     if (path.startsWith("/") || path.split(/[\\/]/).some((p) => p === ".." || p === ""))
       fail("release_integrity", "Release includes an unsafe path.");
-    const file2 = join3(directory, path);
+    const file2 = join2(directory, path);
     const info = await lstat2(file2);
     if (!info.isFile() || info.isSymbolicLink() || digest(await readFile4(file2)) !== hash2)
       fail("release_integrity", "Release asset integrity check failed.");
@@ -26559,7 +26567,7 @@ async function release2(requested = VERSION, base = dirname2(fileURLToPath(impor
     directory,
     manifest: manifest2,
     config: JSON.parse(
-      await readFile4(join3(directory, "wrangler.json"), "utf8")
+      await readFile4(join2(directory, "wrangler.json"), "utf8")
     )
   };
 }
@@ -26816,7 +26824,7 @@ async function whileWarming(run, sleep = delay3, report = (line) => process.stde
 
 // src/installation.ts
 import { cp, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
 import { setTimeout as delay4 } from "node:timers/promises";
 async function advance(ctx, journal, phase, patch = {}) {
   const fields = journal;
@@ -26843,9 +26851,9 @@ function selectedInstallation(ctx) {
   };
 }
 async function configFile(ctx, journal, artifact) {
-  const directory = join4(ctx.store.directory, "deployments", journal.id);
+  const directory = join3(ctx.store.directory, "deployments", journal.id);
   await protectedDirectory(directory);
-  await cp(artifact.directory, join4(directory, "release"), { recursive: true });
+  await cp(artifact.directory, join3(directory, "release"), { recursive: true });
   const config2 = {
     ...artifact.config,
     name: journal.name,
@@ -26873,7 +26881,7 @@ async function configFile(ctx, journal, artifact) {
       }))
     } : {}
   };
-  const path = join4(directory, "wrangler.json");
+  const path = join3(directory, "wrangler.json");
   await writeFile3(path, JSON.stringify(config2, null, 2), { mode: 384 });
   return { path, directory, config: config2 };
 }
@@ -27220,7 +27228,7 @@ async function install(ctx, cf, journal, artifact, url2, domain2) {
     // the account is this CLI's however soon anyone else finds the address.
     CLI_BOOTSTRAP_TOKEN_DIGEST: createHash4("sha256").update(journal.bootstrap.token).digest("hex")
   };
-  const secretPath = join5(file2.directory, "secrets.json");
+  const secretPath = join4(file2.directory, "secrets.json");
   await writeFile4(secretPath, JSON.stringify(secrets), {
     mode: 384
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -26,6 +26,7 @@
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
   "upgradeFrom": [
+    "0.14.0",
     "0.13.1",
     "0.13.0",
     "0.12.1",