@moewolf/moe-icons-cli 0.0.2 → 0.0.4

package/dist/project/install.js

@@ -630,120 +630,4 @@ export function createFileIfAbsent(target, content, fs_) {
             fs_.rmSync(staging, { force: true });
     }
 }
-/**
- * Download an artifact. HTTPS only, optional host allowlist, bounded redirects,
- * timeout, byte limit. Abort and temporary-file cleanup are handled by the
- * caller via the injected fetch/signal.
- *
- * Redirect policy: unlike the API descriptor handshake (which uses
- * `redirect: "error"`), payload downloads intentionally follow a bounded number
- * of redirects because code/metadata archives are served from CDNs that 3xx to
- * a signed object host; the destination host is re-checked against the
- * allowlist on every hop.
- */
-export async function downloadArtifact(url, limits, deps = {}) {
-    const parsed = new URL(url);
-    const loopbackHttp = limits.allowHttpLoopback === true && parsed.protocol === "http:" && (parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost" || parsed.hostname === "::1");
-    if (parsed.protocol !== "https:" && !loopbackHttp) {
-        return { ok: false, code: "NON_HTTPS", message: "artifact URLs must use https" };
-    }
-    if (limits.allowedHosts && !limits.allowedHosts.includes(parsed.host)) {
-        return { ok: false, code: "HOST_NOT_ALLOWED", message: `host ${parsed.host} not in allowlist` };
-    }
-    const fetchFn = deps.fetchFn ?? globalThis.fetch;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), limits.timeoutMs);
-    const abortHandler = () => controller.abort();
-    deps.signal?.addEventListener("abort", abortHandler, { once: true });
-    try {
-        let currentUrl = url;
-        let redirects = 0;
-        let response;
-        for (;;) {
-            response = await fetchFn(currentUrl, {
-                method: "GET",
-                redirect: "manual",
-                signal: controller.signal,
-                ...(limits.userAgent ? { headers: { "user-agent": limits.userAgent } } : {}),
-            });
-            if (response.status >= 300 && response.status < 400) {
-                redirects += 1;
-                if (redirects > limits.maxRedirects) {
-                    return { ok: false, code: "TOO_MANY_REDIRECTS", message: `exceeded ${limits.maxRedirects} redirects` };
-                }
-                const location = response.headers.get("location");
-                if (!location) {
-                    return { ok: false, code: "REDIRECT_NO_LOCATION", message: "redirect without location header" };
-                }
-                currentUrl = new URL(location, currentUrl).toString();
-                const next = new URL(currentUrl);
-                const nextLoopback = limits.allowHttpLoopback === true && next.protocol === "http:" && (next.hostname === "127.0.0.1" || next.hostname === "localhost" || next.hostname === "::1");
-                if (next.protocol !== "https:" && !nextLoopback) {
-                    return { ok: false, code: "NON_HTTPS", message: "redirect to non-https url" };
-                }
-                if (limits.allowedHosts && !limits.allowedHosts.includes(next.host)) {
-                    return { ok: false, code: "HOST_NOT_ALLOWED", message: `redirect host ${next.host} not in allowlist` };
-                }
-                continue;
-            }
-            break;
-        }
-        if (!response || response.status >= 400) {
-            return { ok: false, code: "HTTP_ERROR", message: `request failed with ${response.status ?? "unknown"}` };
-        }
-        const rawLength = response.headers.get("content-length");
-        const contentLength = rawLength !== null && /^\d+$/.test(rawLength) ? Number(rawLength) : undefined;
-        if (contentLength !== undefined && contentLength > limits.maxBytes) {
-            return { ok: false, code: "TOO_LARGE", message: `content-length ${contentLength} exceeds limit` };
-        }
-        const chunks = [];
-        let downloadedBytes = 0;
-        if (response.body) {
-            const reader = response.body.getReader();
-            for (;;) {
-                const chunk = await reader.read();
-                if (chunk.done)
-                    break;
-                const value = chunk.value;
-                downloadedBytes += value.byteLength;
-                if (downloadedBytes > limits.maxBytes) {
-                    await reader.cancel();
-                    return { ok: false, code: "TOO_LARGE", message: `body exceeds byte limit ${limits.maxBytes}` };
-                }
-                chunks.push(value);
-                limits.onProgress?.({ downloadedBytes, ...(contentLength !== undefined ? { totalBytes: contentLength } : {}) });
-            }
-        }
-        else {
-            const buffer = await response.arrayBuffer();
-            downloadedBytes = buffer.byteLength;
-            if (downloadedBytes > limits.maxBytes)
-                return { ok: false, code: "TOO_LARGE", message: `body exceeds byte limit ${limits.maxBytes}` };
-            chunks.push(new Uint8Array(buffer));
-            limits.onProgress?.({ downloadedBytes, ...(contentLength !== undefined ? { totalBytes: contentLength } : {}) });
-        }
-        const bytes = new Uint8Array(downloadedBytes);
-        let offset = 0;
-        for (const chunk of chunks) {
-            bytes.set(chunk, offset);
-            offset += chunk.byteLength;
-        }
-        return { ok: true, bytes, finalUrl: currentUrl };
-    }
-    catch (error) {
-        return {
-            ok: false,
-            code: "NETWORK_ERROR",
-            message: error instanceof Error ? error.message : String(error),
-        };
-    }
-    finally {
-        clearTimeout(timer);
-        deps.signal?.removeEventListener("abort", abortHandler);
-    }
-}
-/** Verify a downloaded artifact against an expected SHA-256 (and optional signature). */
-export function verifyArtifact(bytes, expectedSha256) {
-    const actual = createHash("sha256").update(bytes).digest("hex");
-    return { ok: actual.toLowerCase() === expectedSha256.toLowerCase(), actual };
-}
+export { downloadArtifact, verifyArtifact } from "./download.js";

package/dist/project/tar-gz.d.ts

@@ -15,15 +15,13 @@ export type ExtractedTarFiles = {
     readonly files: Record<string, Uint8Array>;
     readonly errors: string[];
 };
-/**
- * Gunzip + unpack tar. Rejects absolute paths, `..`, symlinks and oversized
- * archives. Path safety uses POSIX `/` separators (the tar format mandates `/`);
- * a Windows-style separator would appear literally inside a name and never be
- * treated as a path separator, so `..\evil` is inert (no traversal), which is
- * the documented known assumption.
- */
 export declare function extractTarGz(bytes: Uint8Array, limits: {
     maxEntries: number;
     maxExpandedBytes: number;
 }): ExtractedTarFiles;
+/** Production path: yield between chunks; never materialise the complete tar. */
+export declare function extractTarGzAsync(bytes: Uint8Array, limits: {
+    maxEntries: number;
+    maxExpandedBytes: number;
+}, signal?: AbortSignal): Promise<ExtractedTarFiles>;
 export declare function decodeUtf8(bytes: Uint8Array): string;

package/dist/project/tar-gz.js

@@ -1,4 +1,5 @@
-import { gzipSync, gunzipSync } from "node:zlib";
+import { gzipSync, gunzipSync, createGunzip } from "node:zlib";
+import { Readable } from "node:stream";
 const BLOCK = 512;
 /**
  * Combined release archives contain all four target trees. The current Pro
@@ -60,77 +61,172 @@ export function createTarGz(files) {
     return gzipSync(Buffer.concat(parts), { level: 9 });
 }
 function readOctal(buf, offset, length) {
-    const raw = buf.subarray(offset, offset + length).toString("utf8").replace(/\0.*$/, "").trim();
-    if (!raw)
-        return 0;
-    return Number.parseInt(raw, 8);
+    const raw = buf.subarray(offset, offset + length).toString("ascii").replace(/\0.*$/, "").trim();
+    if (!/^[0-7]+$/.test(raw))
+        throw new Error("invalid tar numeric field");
+    const value = Number.parseInt(raw, 8);
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error("invalid tar size");
+    return value;
 }
-/**
- * Gunzip + unpack tar. Rejects absolute paths, `..`, symlinks and oversized
- * archives. Path safety uses POSIX `/` separators (the tar format mandates `/`);
- * a Windows-style separator would appear literally inside a name and never be
- * treated as a path separator, so `..\evil` is inert (no traversal), which is
- * the documented known assumption.
- */
-export function extractTarGz(bytes, limits) {
-    const files = {};
-    const errors = [];
-    let data;
-    try {
-        // Bound the decompressed stream itself so a zip bomb fails during gunzip,
-        // before the tar bytes are materialised.
-        data = gunzipSync(bytes, { maxOutputLength: limits.maxExpandedBytes });
+/** One incremental parser used by both fixture and production extraction. */
+class TarReader {
+    limits;
+    files = {};
+    errors = [];
+    header = Buffer.alloc(BLOCK);
+    headerBytes = 0;
+    body;
+    bodyBytes = 0;
+    padding = 0;
+    name = "";
+    longName;
+    type = 0;
+    total = 0;
+    entries = 0;
+    zeroBlocks = 0;
+    failed = false;
+    constructor(limits) {
+        this.limits = limits;
     }
-    catch (error) {
-        if (isOutputLimitError(error))
-            return { files, errors: ["expanded size exceeds limit"] };
-        return { files, errors: ["invalid gzip"] };
+    fail(message) { this.errors.push(message); this.failed = true; }
+    feed(bytes) {
+        if (this.failed)
+            return;
+        this.total += bytes.length;
+        if (this.total > this.limits.maxExpandedBytes)
+            return this.fail("expanded size exceeds limit");
+        let offset = 0;
+        while (offset < bytes.length && !this.failed) {
+            if (this.body) {
+                const count = Math.min(this.body.length - this.bodyBytes, bytes.length - offset);
+                this.body.set(bytes.subarray(offset, offset + count), this.bodyBytes);
+                offset += count;
+                this.bodyBytes += count;
+                if (this.bodyBytes !== this.body.length)
+                    continue;
+                this.finishBody();
+            }
+            else if (this.padding) {
+                const count = Math.min(this.padding, bytes.length - offset);
+                offset += count;
+                this.padding -= count;
+            }
+            else {
+                const count = Math.min(BLOCK - this.headerBytes, bytes.length - offset);
+                this.header.set(bytes.subarray(offset, offset + count), this.headerBytes);
+                this.headerBytes += count;
+                offset += count;
+                if (this.headerBytes === BLOCK) {
+                    this.headerBytes = 0;
+                    this.beginBody();
+                }
+            }
+        }
     }
-    let offset = 0;
-    let entries = 0;
-    let expanded = 0;
-    while (offset + BLOCK <= data.byteLength) {
-        const header = data.subarray(offset, offset + BLOCK);
-        offset += BLOCK;
-        if (header.every((byte) => byte === 0))
-            break;
-        const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "").replace(/^\.\//, "");
-        const size = readOctal(header, 124, 12);
-        const type = header[156];
-        const padded = Math.ceil(size / BLOCK) * BLOCK;
-        const content = data.subarray(offset, offset + size);
-        offset += padded;
-        if (type === 0x31 || type === 0x32) {
-            // Hard-link (typeflag '1') and symlink (typeflag '2') entries are
-            // rejected with an explicit error, never silently skipped.
-            errors.push(`link entries are not allowed: ${name || "<unnamed>"}`);
-            continue;
+    beginBody() {
+        const header = this.header;
+        if (header.every(byte => byte === 0)) {
+            this.zeroBlocks++;
+            return;
         }
-        if (type !== 0 && type !== 0x30)
-            continue;
-        if (!name || name.endsWith("/"))
-            continue;
-        entries += 1;
-        if (entries > limits.maxEntries) {
-            errors.push(`too many entries (> ${limits.maxEntries})`);
-            break;
+        if (this.zeroBlocks)
+            return this.fail("tar data after end marker");
+        try {
+            const expected = readOctal(header, 148, 8);
+            const copy = Buffer.from(header);
+            copy.fill(0x20, 148, 156);
+            if (checksumHeader(copy) !== expected)
+                return this.fail("invalid tar header checksum");
+            const size = readOctal(header, 124, 12);
+            if (size > this.limits.maxExpandedBytes)
+                return this.fail("expanded size exceeds limit");
+            this.entries++;
+            if (this.entries > this.limits.maxEntries)
+                return this.fail(`too many entries (> ${this.limits.maxEntries})`);
+            const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+            const prefix = header.subarray(257, 263).toString("ascii") === "ustar\0"
+                ? header.subarray(345, 500).toString("utf8").replace(/\0.*$/, "") : "";
+            this.name = this.longName ?? (prefix ? `${prefix}/${name}` : name);
+            this.longName = undefined;
+            this.name = this.name.replace(/^\.\//, "");
+            this.type = header[156] ?? 0;
+            this.padding = (BLOCK - size % BLOCK) % BLOCK;
+            this.bodyBytes = 0;
+            this.body = Buffer.alloc(size);
+            if (size === 0)
+                this.finishBody();
         }
-        if (name.startsWith("/") || name.split("/").includes("..")) {
-            errors.push(`unsafe path "${name}"`);
-            continue;
+        catch (error) {
+            this.fail(error instanceof Error ? error.message : "invalid tar header");
         }
-        if (name in files) {
-            errors.push(`duplicate entry "${name}"`);
-            continue;
+    }
+    finishBody() {
+        const body = this.body;
+        this.body = undefined;
+        if (this.type === 0x4c) { // GNU long names, emitted by the production packer.
+            this.longName = body.toString("utf8").replace(/\0.*$/, "");
+            return;
+        }
+        if (this.type === 0x31 || this.type === 0x32) {
+            this.errors.push(`link entries are not allowed: ${this.name}`);
+            return;
+        }
+        if (this.type === 0x35)
+            return;
+        if (this.type !== 0 && this.type !== 0x30)
+            return this.fail("unsupported tar entry type");
+        if (!this.name || this.name.startsWith("/") || this.name.split("/").includes("..")) {
+            this.errors.push(`unsafe path "${this.name}"`);
+            return;
         }
-        expanded += content.byteLength;
-        if (expanded > limits.maxExpandedBytes) {
-            errors.push("expanded size exceeds limit");
-            break;
+        if (this.name in this.files) {
+            this.errors.push(`duplicate entry "${this.name}"`);
+            return;
         }
-        files[name] = new Uint8Array(content);
+        this.files[this.name] = body;
+    }
+    result() {
+        if (!this.failed && (this.body || this.padding || this.headerBytes || this.zeroBlocks < 2 || this.longName))
+            this.errors.push("truncated tar archive");
+        return { files: this.files, errors: this.errors };
+    }
+}
+export function extractTarGz(bytes, limits) {
+    const reader = new TarReader(limits);
+    try {
+        reader.feed(gunzipSync(bytes, { maxOutputLength: limits.maxExpandedBytes }));
+    }
+    catch (error) {
+        return { files: {}, errors: [isOutputLimitError(error) ? "expanded size exceeds limit" : "invalid gzip"] };
+    }
+    return reader.result();
+}
+/** Production path: yield between chunks; never materialise the complete tar. */
+export async function extractTarGzAsync(bytes, limits, signal) {
+    const reader = new TarReader(limits);
+    const stream = Readable.from([bytes]).pipe(createGunzip());
+    const abort = () => stream.destroy(new Error("archive extraction cancelled"));
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    try {
+        for await (const chunk of stream) {
+            reader.feed(chunk);
+            if (reader.errors.length) {
+                stream.destroy();
+                break;
+            }
+        }
+        return reader.result();
+    }
+    catch (error) {
+        return { files: {}, errors: [signal?.aborted ? "archive extraction cancelled" : "invalid gzip"] };
+    }
+    finally {
+        signal?.removeEventListener("abort", abort);
+        stream.destroy();
     }
-    return { files, errors };
 }
 export function decodeUtf8(bytes) {
     return Buffer.from(bytes).toString("utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moewolf/moe-icons-cli",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Moeicons CLI: install React, Vue, Vanilla, or Assets icon targets, manage releases and login, and expose an MCP server.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -74,5 +74,5 @@
     "fflate": "^0.8.2",
     "jsonc-parser": "^3.3.1"
   },
-  "payloadHash": "70e69a67e0cb555afbf081eb98b18f09c1fd0db70c95ab69a9ebb90fdd38c991"
+  "payloadHash": "abc4b8255136c07072b0c1b34bc2c960407997d8ce783515cbd51c439faaa820"
 }