@microsoft/teamsfx-core 3.1.2-alpha.7d8ba7acc9.0 → 3.1.2

package/build/component/driver/teamsApp/createAppPackage.js

@@ -90,15 +90,9 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         }
         for (const file of relativeFiles) {
             const filePath = path.resolve(appDirectory, file);
-            if (!(await fs_extra_1.default.pathExists(filePath))) {
-                const error = new common_1.FileNotFoundError(exports.actionName, filePath, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage");
-                return (0, teamsfx_api_1.err)(error);
-            }
-            const realFilePath = await fs_extra_1.default.realpath(filePath);
-            const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
-            const fileRelativePath = path.relative(realAppDirectory, realFilePath);
-            if (fileRelativePath.startsWith("..")) {
-                return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(filePath));
+            const validationResult = await this.validateReferencedFile(filePath, appDirectory, file);
+            if (validationResult.isErr()) {
+                return (0, teamsfx_api_1.err)(validationResult.error);
             }
         }
         // pre-check existence
@@ -129,19 +123,22 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         if (additionalLanguages && additionalLanguages.length > 0) {
             for (const language of additionalLanguages) {
                 const file = language.file;
-                const fileName = path.join(appDirectory, file);
-                if (!(await fs_extra_1.default.pathExists(fileName))) {
-                    return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, fileName, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+                const fileName = path.resolve(appDirectory, file);
+                const validationResult = await this.validateReferencedFile(fileName, appDirectory, file);
+                if (validationResult.isErr()) {
+                    return (0, teamsfx_api_1.err)(validationResult.error);
                 }
             }
         }
         if (defaultLanguageFile) {
-            const fileName = path.join(appDirectory, defaultLanguageFile);
-            if (!(await fs_extra_1.default.pathExists(fileName))) {
-                return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, fileName, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            const fileName = path.resolve(appDirectory, defaultLanguageFile);
+            const validationResult = await this.validateReferencedFile(fileName, appDirectory, defaultLanguageFile);
+            if (validationResult.isErr()) {
+                return (0, teamsfx_api_1.err)(validationResult.error);
             }
         }
         const zip = new adm_zip_1.default();
+        const resolvedJsonFiles = new Map();
         zip.addFile(constants_1.Constants.MANIFEST_FILE, Buffer.from(JSON.stringify(manifest, null, 4)));
         // icon images, relative path
         for (const icon of relativeFiles) {
@@ -156,9 +153,6 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 const realFileName = await fs_extra_1.default.realpath(fileName);
                 const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
                 const relativePath = path.relative(realAppDirectory, realFileName);
-                if (relativePath.startsWith("..")) {
-                    return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileName));
-                }
                 const resolvedLocFileRes = await ManifestUtils_1.manifestUtils.resolveLocFile(fileName, context);
                 if (resolvedLocFileRes.isErr()) {
                     return (0, teamsfx_api_1.err)(resolvedLocFileRes.error);
@@ -173,9 +167,6 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             const realFileName = await fs_extra_1.default.realpath(fileName);
             const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
             const relativePath = path.relative(realAppDirectory, realFileName);
-            if (relativePath.startsWith("..")) {
-                return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileName));
-            }
             const resolvedLocFileRes = await ManifestUtils_1.manifestUtils.resolveLocFile(fileName, context);
             if (resolvedLocFileRes.isErr()) {
                 return (0, teamsfx_api_1.err)(resolvedLocFileRes.error);
@@ -187,7 +178,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         // API ME, API specification and Adaptive card templates
         if (composeExtensionType == "apiBased" && apiSpecificationFile) {
             const apiSpecificationFilePath = path.resolve(appDirectory, apiSpecificationFile);
-            const checkExistenceRes = await this.validateReferencedFile(apiSpecificationFilePath, appDirectory);
+            const checkExistenceRes = await this.validateReferencedFile(apiSpecificationFilePath, appDirectory, apiSpecificationFile);
             if (checkExistenceRes.isErr()) {
                 return (0, teamsfx_api_1.err)(checkExistenceRes.error);
             }
@@ -199,7 +190,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 for (const command of commands) {
                     if (command.apiResponseRenderingTemplateFile) {
                         const adaptiveCardFile = path.resolve(appDirectory, command.apiResponseRenderingTemplateFile);
-                        const checkExistenceRes = await this.validateReferencedFile(adaptiveCardFile, appDirectory);
+                        const checkExistenceRes = await this.validateReferencedFile(adaptiveCardFile, appDirectory, command.apiResponseRenderingTemplateFile);
                         if (checkExistenceRes.isErr()) {
                             return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                         }
@@ -212,13 +203,13 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         // Copilot GPT
         if (declarativeAgents?.length && declarativeAgents[0].file) {
             const declarativeAgentManifestFile = path.resolve(hasTTKGeneratedFolder ? generatedFolder : appDirectory, declarativeAgents[0].file);
-            const checkExistenceRes = await this.validateReferencedFile(declarativeAgentManifestFile, appDirectory);
+            const checkExistenceRes = await this.validateReferencedFile(declarativeAgentManifestFile, appDirectory, declarativeAgents[0].file);
             if (checkExistenceRes.isErr()) {
                 return (0, teamsfx_api_1.err)(checkExistenceRes.error);
             }
             const addFileWithVariableRes = await this.addFileWithVariable(zip, declarativeAgents[0].file, declarativeAgentManifestFile, envFunctionUtils_1.ManifestType.DeclarativeCopilotManifest, context, shouldwriteAllManifest
                 ? path.join(jsonFileDir, path.relative(appDirectory, declarativeAgentManifestFile))
-                : undefined);
+                : undefined, resolvedJsonFiles);
             if (addFileWithVariableRes.isErr()) {
                 return (0, teamsfx_api_1.err)(addFileWithVariableRes.error);
             }
@@ -238,7 +229,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                         const pluginFileAbsolutePath = path.resolve(path.dirname(declarativeAgentManifestFile), pluginFile);
                         const pluginFileRelativePath = path.relative(hasTTKGeneratedFolder ? generatedFolder : appDirectory, pluginFileAbsolutePath);
                         const useForwardSlash = declarativeAgents[0].file.concat(pluginFile).includes("/");
-                        const addPluginRes = await this.addPlugin(zip, (0, utils_2.normalizePath)(pluginFileRelativePath, useForwardSlash), hasTTKGeneratedFolder ? generatedFolder : appDirectory, context, !shouldwriteAllManifest ? undefined : jsonFileDir, hasTTKGeneratedFolder ? appDirectory : undefined);
+                        const addPluginRes = await this.addPlugin(zip, (0, utils_2.normalizePath)(pluginFileRelativePath, useForwardSlash), hasTTKGeneratedFolder ? generatedFolder : appDirectory, context, !shouldwriteAllManifest ? undefined : jsonFileDir, hasTTKGeneratedFolder ? appDirectory : undefined, resolvedJsonFiles, pluginFile);
                         if (addPluginRes.isErr()) {
                             return (0, teamsfx_api_1.err)(addPluginRes.error);
                         }
@@ -264,7 +255,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                             for (const file of fileArr) {
                                 const knowledgeFileAbsolutePath = path.resolve(appDirectory, file);
                                 // check existence
-                                const checkExistenceRes = await this.validateReferencedFile(knowledgeFileAbsolutePath, appDirectory);
+                                const checkExistenceRes = await this.validateReferencedFile(knowledgeFileAbsolutePath, appDirectory, file);
                                 if (checkExistenceRes.isErr()) {
                                     return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                                 }
@@ -284,16 +275,15 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                                 // Resolve skill folder relative to appDirectory (not .generated/)
                                 // since skill folders don't support env var substitution
                                 const skillFolderAbsolutePath = path.resolve(appDirectory, skill.folder);
-                                const checkExistenceRes = await this.validateReferencedFile(skillFolderAbsolutePath, appDirectory);
+                                const checkExistenceRes = await this.validateReferencedFile(skillFolderAbsolutePath, appDirectory, skill.folder);
                                 if (checkExistenceRes.isErr()) {
                                     return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                                 }
                                 const skillMdPath = path.join(skillFolderAbsolutePath, "SKILL.md");
                                 if (!(await fs_extra_1.default.pathExists(skillMdPath))) {
-                                    return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, skillMdPath, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+                                    return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, path.basename(skillMdPath), "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
                                 }
-                                const skillRelativePath = path.relative(appDirectory, skillFolderAbsolutePath);
-                                zip.addLocalFolder(skillFolderAbsolutePath, skillRelativePath);
+                                await this.addLocalFolderRecursive(zip, skillFolderAbsolutePath, appDirectory);
                             }
                         }
                     }
@@ -318,14 +308,53 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 return (0, teamsfx_api_1.err)(addConnectorsRes.error);
             }
         }
-        zip.writeZip(zipFileName);
-        // Validate zip package size against 10 MB hard limit
+        if (resolvedJsonFiles.has(teamsManifestJsonFileName)) {
+            return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, ["outputFolder"], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+        }
+        resolvedJsonFiles.set(teamsManifestJsonFileName, JSON.stringify(manifest, null, 4));
+        const outputFileNames = [zipFileName, ...resolvedJsonFiles.keys()];
+        const canonicalOutputPaths = [];
+        let hasInvalidOutputPath = false;
+        for (const outputFileName of outputFileNames) {
+            let canonicalOutputPath;
+            try {
+                if (await this.isDirectory(outputFileName)) {
+                    hasInvalidOutputPath = true;
+                    break;
+                }
+                canonicalOutputPath = await this.getCanonicalDestinationPath(outputFileName);
+            }
+            catch (error) {
+                return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageFileSystemError(error, outputFileName));
+            }
+            if (canonicalOutputPaths.some((outputPath) => this.isPathContained(outputPath, canonicalOutputPath) ||
+                this.isPathContained(canonicalOutputPath, outputPath))) {
+                hasInvalidOutputPath = true;
+                break;
+            }
+            canonicalOutputPaths.push(canonicalOutputPath);
+        }
+        if (hasInvalidOutputPath) {
+            return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, ["outputZipPath", args.outputJsonPath ? "outputJsonPath" : "outputFolder"], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+        }
+        const stagedZipFileName = this.getStagedOutputPath(zipFileName);
         const maxPackageSize = 10 * 1024 * 1024;
-        const zipStats = await fs_extra_1.default.stat(zipFileName);
-        if (zipStats.size > maxPackageSize) {
-            return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageSizeExceededError(zipStats.size, maxPackageSize));
+        try {
+            zip.writeZip(stagedZipFileName);
+            const zipStats = await fs_extra_1.default.stat(stagedZipFileName);
+            if (zipStats.size > maxPackageSize) {
+                return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageSizeExceededError(zipStats.size, maxPackageSize));
+            }
+            await this.publishOutputs(stagedZipFileName, zipFileName, resolvedJsonFiles);
+        }
+        catch (error) {
+            return (0, teamsfx_api_1.err)(error instanceof teamsApp_1.AppPackageFileSystemError
+                ? error
+                : new teamsApp_1.AppPackageFileSystemError(error, zipFileName));
+        }
+        finally {
+            await fs_extra_1.default.remove(stagedZipFileName).catch(() => { });
         }
-        await this.writeJsonFile(teamsManifestJsonFileName, JSON.stringify(manifest, null, 4));
         const builtSuccess = [
             { content: "(√)Done: ", color: teamsfx_api_1.Colors.BRIGHT_GREEN },
             { content: "App Package ", color: teamsfx_api_1.Colors.BRIGHT_WHITE },
@@ -357,33 +386,47 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             return (0, teamsfx_api_1.ok)(undefined);
         }
     }
-    async validateReferencedFile(file, directory) {
+    async validateReferencedFile(file, directory, originalReference) {
+        const displayDirectory = path.resolve(directory);
+        const resolvedFile = path.resolve(file);
+        const fileReference = originalReference ?? path.relative(displayDirectory, resolvedFile);
+        if (!this.isPathContained(directory, file)) {
+            return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileReference, resolvedFile, displayDirectory));
+        }
         if (!(await fs_extra_1.default.pathExists(file))) {
-            return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, file, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, path.basename(file), "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+        }
+        let realFile;
+        let realDirectory;
+        try {
+            realFile = await fs_extra_1.default.realpath(file);
+            realDirectory = await fs_extra_1.default.realpath(directory);
+        }
+        catch (error) {
+            return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageFileSystemError(error, file));
         }
-        const realFile = await fs_extra_1.default.realpath(file);
-        const realDirectory = await fs_extra_1.default.realpath(directory);
-        const relativePath = path.relative(realDirectory, realFile);
-        if (relativePath.startsWith("..")) {
-            return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(file));
+        if (!this.isPathContained(realDirectory, realFile)) {
+            return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileReference, realFile, displayDirectory));
         }
         return (0, teamsfx_api_1.ok)(undefined);
     }
+    isPathContained(directory, file) {
+        const relativePath = path.relative(directory, file);
+        return (relativePath === "" ||
+            (relativePath !== ".." &&
+                !relativePath.startsWith(`..${path.sep}`) &&
+                !path.isAbsolute(relativePath)));
+    }
     async addAgentSkillFolders(zip, agentSkills, appDirectory) {
         for (const skill of agentSkills) {
             const skillFolderAbs = path.resolve(appDirectory, skill.folder);
-            if (!(await fs_extra_1.default.pathExists(skillFolderAbs))) {
-                return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, skillFolderAbs, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            const validationResult = await this.validateReferencedFile(skillFolderAbs, appDirectory, skill.folder);
+            if (validationResult.isErr()) {
+                return (0, teamsfx_api_1.err)(validationResult.error);
             }
             const skillMdPath = path.join(skillFolderAbs, "SKILL.md");
             if (!(await fs_extra_1.default.pathExists(skillMdPath))) {
-                return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, skillMdPath, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
-            }
-            const realSkillFolder = await fs_extra_1.default.realpath(skillFolderAbs);
-            const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
-            const relativeToApp = path.relative(realAppDirectory, realSkillFolder);
-            if (relativeToApp.startsWith("..") || path.isAbsolute(relativeToApp)) {
-                return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(skillFolderAbs));
+                return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, path.basename(skillMdPath), "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
             }
             await this.addLocalFolderRecursive(zip, skillFolderAbs, appDirectory);
         }
@@ -396,7 +439,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 continue;
             }
             const mcpFileAbsolutePath = path.resolve(appDirectory, mcpToolDescriptionFile);
-            const checkExistenceRes = await this.validateReferencedFile(mcpFileAbsolutePath, appDirectory);
+            const checkExistenceRes = await this.validateReferencedFile(mcpFileAbsolutePath, appDirectory, mcpToolDescriptionFile);
             if (checkExistenceRes.isErr()) {
                 return (0, teamsfx_api_1.err)(checkExistenceRes.error);
             }
@@ -418,8 +461,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             }
             else if (entry.isFile()) {
                 const realEntryAbs = await fs_extra_1.default.realpath(entryAbs);
-                const relToApp = path.relative(realAppDirectory, realEntryAbs);
-                if (relToApp.startsWith("..")) {
+                if (!this.isPathContained(realAppDirectory, realEntryAbs)) {
                     continue;
                 }
                 const relDir = path.dirname(path.relative(appDirectory, entryAbs));
@@ -436,9 +478,9 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
      * @param outputDirectory optional. Folder where we should put the resolved manifest in.
      * @returns result of adding plugin file and plugin related files
      */
-    async addPlugin(zip, pluginRelativePath, appDirectory, context, outputDirectory, defaultAppDirectry) {
+    async addPlugin(zip, pluginRelativePath, appDirectory, context, outputDirectory, defaultAppDirectry, resolvedJsonFiles, originalReference) {
         const pluginFile = path.resolve(appDirectory, pluginRelativePath);
-        const checkExistenceRes = await this.validateReferencedFile(pluginFile, appDirectory);
+        const checkExistenceRes = await this.validateReferencedFile(pluginFile, appDirectory, originalReference ?? pluginRelativePath);
         if (checkExistenceRes.isErr()) {
             return (0, teamsfx_api_1.err)(checkExistenceRes.error);
         }
@@ -453,12 +495,16 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         if (pluginFileContent.functions) {
             for (const func of pluginFileContent.functions) {
                 if (func.capabilities?.response_semantics?.static_template?.file) {
-                    const staticTemplateFile = await this.getAdaptiveCardTemplateFile(context, pluginFile, func, appDirectory, defaultAppDirectry);
+                    const staticTemplateFileResult = await this.getAdaptiveCardTemplateFile(context, pluginFile, func, appDirectory, defaultAppDirectry);
+                    if (staticTemplateFileResult.isErr()) {
+                        return (0, teamsfx_api_1.err)(staticTemplateFileResult.error);
+                    }
+                    const staticTemplateFile = staticTemplateFileResult.value;
                     if (!staticTemplateFile) {
                         continue;
                     }
                     if (Object.keys(func.capabilities.response_semantics.static_template).length > 1) {
-                        context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.overrideWarning", pluginFile, func.name));
+                        context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.overrideWarning", path.basename(pluginFile), func.name));
                     }
                     const staticTemplateFileContent = await fs_extra_1.default.readJSON(staticTemplateFile);
                     func.capabilities.response_semantics.static_template = staticTemplateFileContent;
@@ -477,22 +523,30 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         if (containExternalAdaptiveCard) {
             await (0, utils_1.updateVersionForTeamsAppYamlFile)(context.projectPath);
         }
-        if (namespaceContainsUnderscore || containExternalAdaptiveCard) {
-            tempFolder = path.join(appDirectory, ".tmp");
-            await fs_extra_1.default.ensureDir(tempFolder);
-            tmpPluginFile = path.join(tempFolder, `tmp-ai-plugin-${uuid.v4().slice(0, 6)}.json`);
-            const processedFunctionRes = await (0, envFunctionUtils_1.expandVariableWithFunction)(JSON.stringify(pluginFileContent), context, undefined, true, envFunctionUtils_1.ManifestType.PluginManifest, pluginFile);
-            if (processedFunctionRes.isErr()) {
-                return (0, teamsfx_api_1.err)(processedFunctionRes.error);
+        let addFileWithVariableRes;
+        try {
+            if (namespaceContainsUnderscore || containExternalAdaptiveCard) {
+                const processedFunctionRes = await (0, envFunctionUtils_1.expandVariableWithFunction)(JSON.stringify(pluginFileContent), context, undefined, true, envFunctionUtils_1.ManifestType.PluginManifest, pluginFile);
+                if (processedFunctionRes.isErr()) {
+                    return (0, teamsfx_api_1.err)(processedFunctionRes.error);
+                }
+                pluginFileContent = JSON.parse(processedFunctionRes.value);
+                tempFolder = await fs_extra_1.default.mkdtemp(path.join(appDirectory, ".tmp-"));
+                const tempFolderValidation = await this.validateReferencedFile(tempFolder, appDirectory);
+                if (tempFolderValidation.isErr()) {
+                    return (0, teamsfx_api_1.err)(tempFolderValidation.error);
+                }
+                tmpPluginFile = path.join(tempFolder, `tmp-ai-plugin-${uuid.v4().slice(0, 6)}.json`);
+                await fs_extra_1.default.writeJSON(tmpPluginFile, pluginFileContent, { spaces: 4 });
             }
-            pluginFileContent = JSON.parse(processedFunctionRes.value);
-            await fs_extra_1.default.writeJSON(tmpPluginFile, pluginFileContent, { spaces: 4 });
+            addFileWithVariableRes = await this.addFileWithVariable(zip, pluginRelativePath, tmpPluginFile, envFunctionUtils_1.ManifestType.PluginManifest, context, !outputDirectory
+                ? undefined
+                : path.join(outputDirectory, path.relative(appDirectory, pluginFile)), resolvedJsonFiles);
         }
-        const addFileWithVariableRes = await this.addFileWithVariable(zip, pluginRelativePath, tmpPluginFile, envFunctionUtils_1.ManifestType.PluginManifest, context, !outputDirectory
-            ? undefined
-            : path.join(outputDirectory, path.relative(appDirectory, pluginFile)));
-        if (containExternalAdaptiveCard && tmpPluginFile !== pluginFile && tempFolder) {
-            await fs_extra_1.default.remove(tempFolder);
+        finally {
+            if (tempFolder) {
+                await fs_extra_1.default.remove(tempFolder);
+            }
         }
         if (addFileWithVariableRes.isErr()) {
             return (0, teamsfx_api_1.err)(addFileWithVariableRes.error);
@@ -522,7 +576,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 if (runtime.type === "OpenApi" && runtime.spec?.url) {
                     const specFile = path.resolve(path.dirname(pluginFilePath), runtime.spec.url);
                     // add openapi spec
-                    const checkExistenceRes = await this.validateReferencedFile(specFile, appDirectory);
+                    const checkExistenceRes = await this.validateReferencedFile(specFile, appDirectory, runtime.spec.url);
                     if (checkExistenceRes.isErr()) {
                         return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                     }
@@ -537,7 +591,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                     runtime.spec?.mcp_tool_description?.file) {
                     const mcpFile = path.resolve(path.dirname(pluginFilePath), runtime.spec.mcp_tool_description.file);
                     // add mcp tool description file
-                    const checkExistenceRes = await this.validateReferencedFile(mcpFile, appDirectory);
+                    const checkExistenceRes = await this.validateReferencedFile(mcpFile, appDirectory, runtime.spec.mcp_tool_description.file);
                     if (checkExistenceRes.isErr()) {
                         return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                     }
@@ -548,8 +602,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         }
         return (0, teamsfx_api_1.ok)(undefined);
     }
-    async addFileWithVariable(zip, entryName, filePath, manifestType, context, outputPath // If outputPath exists, we will write down the file after replacing placeholders.
-    ) {
+    async addFileWithVariable(zip, entryName, filePath, manifestType, context, outputPath, resolvedJsonFiles) {
         const expandedEnvVarResult = await CreateAppPackageDriver_1.expandEnvVars(filePath, context, manifestType);
         if (expandedEnvVarResult.isErr()) {
             return (0, teamsfx_api_1.err)(expandedEnvVarResult.error);
@@ -558,7 +611,11 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         const attr = await fs_extra_1.default.stat(filePath);
         zip.addFile(entryName, Buffer.from(content), "", attr.mode);
         if (outputPath && path.extname(outputPath).toLowerCase() === ".json") {
-            await this.writeJsonFile(`${outputPath.substring(0, outputPath.length - 5)}.${process.env.TEAMSFX_ENV}.json`, content);
+            const resolvedOutputPath = `${outputPath.substring(0, outputPath.length - 5)}.${process.env.TEAMSFX_ENV}.json`;
+            if (resolvedJsonFiles?.has(resolvedOutputPath)) {
+                return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, ["outputFolder"], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            }
+            resolvedJsonFiles?.set(resolvedOutputPath, content);
         }
         return (0, teamsfx_api_1.ok)(undefined);
     }
@@ -570,26 +627,163 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             await fs_extra_1.default.chmod(jsonFileName, 0o777);
         }
         await fs_extra_1.default.ensureDir(path.dirname(jsonFileName));
-        await fs_extra_1.default.writeFile(jsonFileName, content);
+        await fs_extra_1.default.outputFile(jsonFileName, content);
         await fs_extra_1.default.chmod(jsonFileName, 0o444);
     }
+    getStagedOutputPath(outputPath) {
+        return path.join(path.dirname(outputPath), `.${path.basename(outputPath)}.${uuid.v4()}.tmp`);
+    }
+    async isDirectory(filePath) {
+        try {
+            return (await fs_extra_1.default.stat(filePath)).isDirectory();
+        }
+        catch (error) {
+            if (this.isFileNotFoundError(error)) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async getCanonicalDestinationPath(outputPath) {
+        try {
+            return await fs_extra_1.default.realpath(outputPath);
+        }
+        catch (error) {
+            if (!this.isFileNotFoundError(error)) {
+                throw error;
+            }
+        }
+        const missingDirectories = [];
+        let ancestor = path.dirname(outputPath);
+        while (true) {
+            try {
+                const realAncestor = await fs_extra_1.default.realpath(ancestor);
+                return path.join(realAncestor, ...missingDirectories, path.basename(outputPath));
+            }
+            catch (error) {
+                if (!this.isFileNotFoundError(error)) {
+                    throw error;
+                }
+                const parent = path.dirname(ancestor);
+                if (parent === ancestor) {
+                    throw error;
+                }
+                missingDirectories.unshift(path.basename(ancestor));
+                ancestor = parent;
+            }
+        }
+    }
+    async publishOutputs(stagedZipFile, outputZipFile, jsonFiles) {
+        const stagedJsonFiles = new Map();
+        const backupFiles = new Map();
+        const publishedFiles = [];
+        let publicationError;
+        try {
+            for (const [jsonFile, content] of jsonFiles) {
+                const stagedJsonFile = this.getStagedOutputPath(jsonFile);
+                stagedJsonFiles.set(jsonFile, stagedJsonFile);
+                await this.writeJsonFile(stagedJsonFile, content);
+            }
+            for (const [jsonFile, stagedJsonFile] of stagedJsonFiles) {
+                await this.backUpOutputFile(jsonFile, backupFiles);
+                await fs_extra_1.default.rename(stagedJsonFile, jsonFile);
+                publishedFiles.push(jsonFile);
+            }
+            await this.backUpOutputFile(outputZipFile, backupFiles);
+            await fs_extra_1.default.rename(stagedZipFile, outputZipFile);
+            publishedFiles.push(outputZipFile);
+        }
+        catch (error) {
+            let rollbackError;
+            for (const publishedFile of publishedFiles.reverse()) {
+                try {
+                    await fs_extra_1.default.chmod(publishedFile, 0o777);
+                }
+                catch (cleanupError) {
+                    if (!this.isFileNotFoundError(cleanupError)) {
+                        rollbackError ??= cleanupError;
+                    }
+                }
+                try {
+                    await fs_extra_1.default.remove(publishedFile);
+                }
+                catch (cleanupError) {
+                    rollbackError ??= cleanupError;
+                }
+            }
+            for (const [outputFile, backupFile] of Array.from(backupFiles.entries()).reverse()) {
+                try {
+                    await fs_extra_1.default.rename(backupFile, outputFile);
+                }
+                catch (restoreError) {
+                    rollbackError ??= restoreError;
+                }
+            }
+            if (rollbackError) {
+                publicationError = rollbackError;
+            }
+            else {
+                publicationError = error;
+            }
+        }
+        let stagedCleanupError;
+        for (const stagedJsonFile of stagedJsonFiles.values()) {
+            try {
+                await fs_extra_1.default.remove(stagedJsonFile);
+            }
+            catch (error) {
+                stagedCleanupError ??= error;
+            }
+        }
+        if (publicationError) {
+            throw new teamsApp_1.AppPackageFileSystemError(publicationError, outputZipFile);
+        }
+        if (stagedCleanupError) {
+            throw new teamsApp_1.AppPackageFileSystemError(stagedCleanupError, outputZipFile);
+        }
+        for (const backupFile of backupFiles.values()) {
+            await fs_extra_1.default.chmod(backupFile, 0o600).catch(() => { });
+            await fs_extra_1.default.remove(backupFile).catch(() => { });
+        }
+    }
+    async backUpOutputFile(outputFile, backupFiles) {
+        const backupFile = this.getStagedOutputPath(outputFile);
+        try {
+            await fs_extra_1.default.rename(outputFile, backupFile);
+            backupFiles.set(outputFile, backupFile);
+        }
+        catch (error) {
+            if (!this.isFileNotFoundError(error)) {
+                throw error;
+            }
+        }
+    }
+    isFileNotFoundError(error) {
+        return error instanceof Error && "code" in error && error.code === "ENOENT";
+    }
     async getAdaptiveCardTemplateFile(context, pluginFile, func, appDirectory, defaultAppDirectry) {
         let staticTemplateFile = path.resolve(defaultAppDirectry ?? path.dirname(pluginFile), func.capabilities.response_semantics.static_template.file);
-        let checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, defaultAppDirectry ?? appDirectory);
+        let checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, defaultAppDirectry ?? appDirectory, func.capabilities.response_semantics.static_template.file);
         if (checkExistenceRes.isOk()) {
-            return staticTemplateFile;
+            return (0, teamsfx_api_1.ok)(staticTemplateFile);
+        }
+        if (checkExistenceRes.error instanceof teamsApp_1.InvalidFileOutsideOfTheDirectotryError) {
+            return (0, teamsfx_api_1.err)(checkExistenceRes.error);
         }
         if (defaultAppDirectry) {
             // Try generated folder
             staticTemplateFile = path.resolve(appDirectory, func.capabilities.response_semantics.static_template.file);
-            checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, appDirectory);
+            checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, appDirectory, func.capabilities.response_semantics.static_template.file);
         }
         if (checkExistenceRes.isErr()) {
+            if (checkExistenceRes.error instanceof teamsApp_1.InvalidFileOutsideOfTheDirectotryError) {
+                return (0, teamsfx_api_1.err)(checkExistenceRes.error);
+            }
             delete func.capabilities.response_semantics.static_template;
-            context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.invalidFilePropertyWarning", pluginFile, func.name));
-            return undefined;
+            context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.invalidFilePropertyWarning", path.basename(pluginFile), func.name));
+            return (0, teamsfx_api_1.ok)(undefined);
         }
-        return staticTemplateFile;
+        return (0, teamsfx_api_1.ok)(staticTemplateFile);
     }
 };
 exports.CreateAppPackageDriver = CreateAppPackageDriver;