@muhkoo/connect 0.12.1-alpha.0 → 0.13.0-alpha.0

package/dist/connect.d.ts

@@ -5725,6 +5725,7 @@ declare class VfsNamespace {
     stat(path: string): Promise<VfsStat>;
     /** Immediate children of a directory. One record fetch. */
     list(path?: string): Promise<VfsStat[]>;
+    private warn;
     /**
      * Every file path under a prefix, depth-first.
      *

package/dist/server/index.js

@@ -3235,7 +3235,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.12.1-alpha.0";
+const VERSION = "0.13.0-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -9025,12 +9025,7 @@ class Space {
         const hashes = manifest.chunks.flatMap((c) => c.shardHashes);
         if (hashes.length === 0)
             return;
-        // `manifestId` is what lets the platform tell two copies of the same
-        // bytes apart. Without it the reference ledger keys on content, so the
-        // second copy takes no reference and releasing either frees shards the
-        // other still needs — silent data loss. Sent on BOTH commit and release,
-        // because a release has to reproduce the key its commit took.
-        const body = JSON.stringify({ hashes, bytes: manifest.size, manifestId: manifest.id });
+        const body = JSON.stringify({ hashes, bytes: manifest.size });
         for (let attempt = 0; attempt < 3; attempt++) {
             try {
                 const res = await this.deps.fetch(`${this.deps.httpBaseUrl}/api/storage/${action}`, {
@@ -11766,13 +11761,40 @@ function isUnder(path, dir) {
  * directory on the next lookup — a file literally named `..` could never be
  * addressed again.
  */
+/** The longest a single entry name may be. Matches the common filesystem limit. */
+const MAX_NAME_BYTES = 255;
+/**
+ * Is this a name we are willing to store, and to hand back as a path segment?
+ *
+ * This is the READ-side check as much as the write-side one, and the read side
+ * is the one that matters: a directory record is sealed with a key that any
+ * holder of the master seed can derive, so its contents are not necessarily
+ * something this SDK wrote. A name arriving from a record is input.
+ *
+ * What each rule is for:
+ *  - `/` and backslash would become path structure. Backslash is a separator on
+ *    Windows, which makes it traversal there and an odd filename elsewhere.
+ *  - `.` and `..` navigate rather than name.
+ *  - NUL terminates a path in every syscall that takes one.
+ *  - Other control characters and bidi overrides let a name print as something
+ *    other than what it is - the classic way a file passes review.
+ *  - A length cap, because nothing else imposes one.
+ */
+function isSafeName(name) {
+    if (!name || name === "." || name === "..")
+        return false;
+    if (name.includes("/") || name.includes(String.fromCharCode(92)))
+        return false;
+    const CONTROL_OR_BIDI = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f\\u202a-\\u202e\\u2066-\\u2069]");
+    if (CONTROL_OR_BIDI.test(name))
+        return false;
+    return new TextEncoder().encode(name).length <= MAX_NAME_BYTES;
+}
 function assertValidName(name) {
     if (!name)
         throw new Error("VFS: name cannot be empty");
-    if (name === "." || name === "..")
-        throw new Error(`VFS: "${name}" is not a usable name`);
-    if (name.includes("/"))
-        throw new Error(`VFS: name cannot contain "/" (got ${JSON.stringify(name)})`);
+    if (!isSafeName(name))
+        throw new Error(`VFS: ${JSON.stringify(name)} is not a usable name`);
 }
 /**
  * MIME type for a filename.
@@ -11884,6 +11906,14 @@ function escapeLiteral(s) {
  * cost storage until a future sweep, which is the trade this shape makes in
  * exchange for single-record writes.
  */
+/**
+ * How deep a tree may be before we stop walking it.
+ *
+ * Well past anything a real project needs, and low enough that a malformed or
+ * hostile record cannot spend the caller's memory before the cycle guard sees a
+ * repeat.
+ */
+const MAX_DEPTH = 64;
 const DEFAULT_HISTORY_LIMIT = 20;
 class VfsNamespace {
     deps;
@@ -12012,9 +12042,29 @@ class VfsNamespace {
         const dir = await this.openDir(path);
         const base = this.resolve(path);
         return Object.entries(dir.node.entries)
+            // Validate the name HERE, where it is read.
+            //
+            // A directory record is sealed under a key derivable from the master
+            // seed, so its contents are not necessarily something this SDK
+            // wrote, and the write-side check never sees them. An unusable name
+            // is dropped rather than thrown on: one bad entry must not make the
+            // whole directory unlistable, and callers walk this output straight
+            // into filesystem paths.
+            .filter(([name]) => {
+            if (isSafeName(name))
+                return true;
+            this.warn(`ignoring entry with an unusable name in ${base}`);
+            return false;
+        })
             .map(([name, entry]) => toStat(join(base, name), name, entry))
             .sort(byDirsThenName);
     }
+    warn(message) {
+        // Kept quiet by default in a browser console that the user cannot act
+        // on, but never silent: a dropped entry is a real difference between
+        // what is stored and what is shown.
+        console.warn(`[muhkoo/vfs] ${message}`);
+    }
     /**
      * Every file path under a prefix, depth-first.
      *
@@ -12023,15 +12073,32 @@ class VfsNamespace {
      */
     async walk(path = ".") {
         const out = [];
-        const visit = async (dirPath) => {
+        // Guard against a tree that is not one.
+        //
+        // `visit` recurses on a PATH, re-resolved from the root each time, so a
+        // record whose entry points back at an ancestor - or, before names were
+        // validated, an entry simply named ".." - recurses forever and grows
+        // `out` without bound. Nothing in the format prevents that, and `mount`
+        // calls this on every sync pass.
+        const seen = new Set();
+        const visit = async (dirPath, depth) => {
+            if (depth > MAX_DEPTH) {
+                this.warn(`stopping at ${dirPath}: deeper than ${MAX_DEPTH} levels`);
+                return;
+            }
+            if (seen.has(dirPath)) {
+                this.warn(`stopping at ${dirPath}: already visited (the tree contains a cycle)`);
+                return;
+            }
+            seen.add(dirPath);
             for (const entry of await this.list(dirPath)) {
                 if (entry.kind === "dir")
-                    await visit(entry.path);
+                    await visit(entry.path, depth + 1);
                 else
                     out.push(entry.path);
             }
         };
-        await visit(this.resolve(path));
+        await visit(this.resolve(path), 0);
         return out;
     }
     async readFile(path) {
@@ -12304,6 +12371,12 @@ class VfsNamespace {
         const root = await this.root();
         const reachable = new Set();
         const visit = async (dir) => {
+            // `reachable` was already the visited set - it just was not being
+            // TESTED before recursing, so a cycle looped forever. Here the
+            // consequence would have been worse than a hang: sweep decides what
+            // to delete, and it never got as far as deciding.
+            if (reachable.has(dirKey(dir.id)))
+                return;
             reachable.add(dirKey(dir.id));
             for (const entry of Object.values(dir.node.entries)) {
                 if (entry.kind === "dir") {
@@ -12461,10 +12534,16 @@ class VfsNamespace {
         });
     }
     /** Recursively remove a subtree's records. Best-effort: unreachable ≠ fatal. */
-    async purge(dir) {
+    async purge(dir, seen = new Set()) {
+        // A record that references an ancestor would otherwise recurse forever:
+        // the id is only removed from the cache AFTER the loop, so re-entering
+        // it hits the same cached record every time.
+        if (seen.has(dir.id))
+            return;
+        seen.add(dir.id);
         for (const entry of Object.values(dir.node.entries)) {
             if (entry.kind === "dir") {
-                await this.purge(await this.openDirById(entry.id, fromBase64(entry.key)));
+                await this.purge(await this.openDirById(entry.id, fromBase64(entry.key)), seen);
             }
             else {
                 await this.releaseFile(dir, entry);
@@ -12478,18 +12557,32 @@ class VfsNamespace {
      * directory gets a fresh id and key, so the copy is independent of the
      * original — writing into one must never appear in the other.
      */
-    async cloneEntry(entry) {
+    async cloneEntry(entry, seen = new Set()) {
         if (entry.kind === "file") {
             // Same bytes, second owner: take a reference so deleting either one
             // leaves the other readable.
             await this.deps.content.retain(entry.manifest);
             return { kind: "file", id: newId(), manifest: entry.manifest, size: entry.size, mtime: Date.now(), versions: 0 };
         }
+        // The most expensive walker to leave unguarded: it mints a NEW id, key
+        // and stored record at every level, so a cyclic tree does not merely
+        // hang - it writes records to the store, and to the user's bill, in an
+        // unbounded loop.
+        if (seen.has(entry.id) || seen.size > MAX_DEPTH) {
+            throw new VfsConflictError("VFS: refusing to copy a directory that contains a cycle");
+        }
+        seen.add(entry.id);
         const source = await this.openDirById(entry.id, fromBase64(entry.key));
         const clone = { kind: "dir", id: newId(), key: toBase64(newDirKey()), mtime: Date.now() };
         const node = { v: 1, entries: {}, mtime: Date.now() };
         for (const [name, child] of Object.entries(source.node.entries)) {
-            node.entries[name] = await this.cloneEntry(child);
+            // Names are validated on read everywhere else; a copy must not be
+            // the way a bad one is carried into a fresh record.
+            if (!isSafeName(name)) {
+                this.warn(`skipping entry with an unusable name while copying`);
+                continue;
+            }
+            node.entries[name] = await this.cloneEntry(child, seen);
         }
         const open = { id: clone.id, key: fromBase64(clone.key), node };
         await this.deps.store.put(dirKey(open.id), await seal(open.key, node));