@newlandnpt/pep-cli 0.6.1 → 0.7.0

package/dist/pep.cjs

@@ -51,6 +51,9 @@ function defaultSkillsDirectory() {
 function claudeSkillsDirectory() {
   return (0, import_node_path.join)((0, import_node_os.homedir)(), ".claude", "skills");
 }
+function samePlace(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
 function userSkillsTarget() {
   return { directory: defaultSkillsDirectory(), linkInto: claudeSkillsDirectory() };
 }
@@ -1102,6 +1105,14 @@ function readTar(bytes) {
 
 // src/skills-service.ts
 var ARCHIVE_PATH = "/api/skills/archive";
+var MAX_ARCHIVE_BYTES = 64 * 1024 * 1024;
+var MAX_UNPACKED_BYTES = 256 * 1024 * 1024;
+var MAX_ENTRIES = 1e4;
+function tooBig(what, limit) {
+  return new Error(
+    `The skills archive is too large (${what} exceeds ${Math.round(limit / 1024 / 1024)} MiB). Refusing to unpack it.`
+  );
+}
 var SKILL_MANIFEST = "SKILL.md";
 function planSkillFiles(entries) {
   const roots = [];
@@ -1116,13 +1127,13 @@ function planSkillFiles(entries) {
   for (const root of roots) {
     const name = root[root.length - 1];
     const where = root.join("/");
-    const first = seen.get(name);
+    const first = seen.get(name.toLowerCase());
     if (first !== void 0) {
       throw new Error(
         `Two skills in this package would both be called "${name}": ${first} and ${where}. Skill names come from the directory name, so they must be unique within a package.`
       );
     }
-    seen.set(name, where);
+    seen.set(name.toLowerCase(), where);
   }
   const files = [];
   for (const entry of entries) {
@@ -1137,9 +1148,38 @@ function planSkillFiles(entries) {
   }
   return files;
 }
+async function readCapped(response, limit) {
+  const reader = response.body?.getReader();
+  if (!reader) return new Uint8Array(await response.arrayBuffer());
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) {
+      await reader.cancel();
+      throw tooBig("the download", limit);
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, at);
+    at += chunk.byteLength;
+  }
+  return out;
+}
+function assertInside(base, target) {
+  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(base), (0, import_node_path4.resolve)(target));
+  if (rel === "" || rel.startsWith("..") || (0, import_node_path4.isAbsolute)(rel)) {
+    throw new Error(`Refusing an archive entry that escapes its directory: ${target}`);
+  }
+}
 function segmentsOf(path) {
-  const segments = path.split("/").filter((one) => one !== "" && one !== ".");
-  if (segments.some((one) => one === "..")) {
+  const segments = path.split(/[\\/]+/).filter((one) => one !== "" && one !== ".");
+  if (segments.some((one) => one === ".." || /^[a-z]:$/i.test(one))) {
     throw new Error(`Refusing an archive entry that escapes its directory: ${path}`);
   }
   return segments;
@@ -1195,6 +1235,12 @@ function hashSkill(files) {
   }
   return hash.digest("hex").slice(0, 32);
 }
+function otherClaimant(packages, self, directory, skill) {
+  const wanted = skill.toLowerCase();
+  return Object.entries(packages).find(
+    ([other, pkg]) => other !== self && samePlace(pkg.directory, directory) && Object.keys(pkg.skills).some((one) => one.toLowerCase() === wanted)
+  )?.[0];
+}
 async function removeSkills(name, store) {
   const state = await store.read();
   const pkg = state?.packages[name];
@@ -1204,9 +1250,7 @@ async function removeSkills(name, store) {
   const deleted = [];
   const keptForOthers = [];
   for (const skill of Object.keys(pkg.skills).sort()) {
-    const owner = Object.entries(state.packages).find(
-      ([other, one]) => other !== name && one.directory === pkg.directory && skill in one.skills
-    )?.[0];
+    const owner = otherClaimant(state.packages, name, pkg.directory, skill);
     if (owner !== void 0) {
       keptForOthers.push({ skill, owner });
       continue;
@@ -1248,10 +1292,8 @@ async function updateSkills(dependencies) {
   const commit = response.headers.get("x-skills-commit") ?? void 0;
   const state = await dependencies.stateStore.read();
   const previous = state?.packages[name];
-  const sameTarget = previous?.directory === dependencies.directory && previous?.linkedInto === dependencies.linkInto;
-  const claimedElsewhere = (skill) => Object.entries(state?.packages ?? {}).find(
-    ([other, pkg]) => other !== name && pkg.directory === dependencies.directory && skill in pkg.skills
-  )?.[0];
+  const sameTarget = previous !== void 0 && samePlace(previous.directory, dependencies.directory) && (previous.linkedInto === void 0 ? dependencies.linkInto === void 0 : dependencies.linkInto !== void 0 && samePlace(previous.linkedInto, dependencies.linkInto));
+  const claimedElsewhere = (skill) => otherClaimant(state?.packages ?? {}, name, dependencies.directory, skill);
   const gone = previous !== void 0 && sameTarget ? await missingSkills(previous.directory, Object.keys(previous.skills)) : /* @__PURE__ */ new Set();
   const nothingToRestore = !dependencies.restoreMissing || gone.size === 0;
   const standing = Object.keys(previous?.skills ?? {}).flatMap((skill) => {
@@ -1262,8 +1304,23 @@ async function updateSkills(dependencies) {
     await response.body?.cancel();
     return { status: "unchanged", name, commit, conflicts: standing };
   }
-  const gzipped = new Uint8Array(await response.arrayBuffer());
-  const files = planSkillFiles(readTar((0, import_node_zlib.gunzipSync)(gzipped)));
+  const gzipped = await readCapped(response, dependencies.maxArchiveBytes ?? MAX_ARCHIVE_BYTES);
+  let unpacked;
+  try {
+    unpacked = (0, import_node_zlib.gunzipSync)(gzipped, { maxOutputLength: MAX_UNPACKED_BYTES });
+  } catch (error) {
+    if (error.code === "ERR_BUFFER_TOO_LARGE") {
+      throw tooBig("the unpacked archive", MAX_UNPACKED_BYTES);
+    }
+    throw error;
+  }
+  const entries = readTar(unpacked);
+  if (entries.length > MAX_ENTRIES) {
+    throw new Error(
+      `The skills archive holds ${entries.length} files (limit ${MAX_ENTRIES}). Refusing to unpack it.`
+    );
+  }
+  const files = planSkillFiles(entries);
   const bySkill = /* @__PURE__ */ new Map();
   for (const file of files) {
     const group = bySkill.get(file.skill);
@@ -1300,6 +1357,7 @@ async function updateSkills(dependencies) {
   if (previous !== void 0) {
     const stale = sameTarget ? removed : Object.keys(previous.skills);
     for (const skill of stale) {
+      if (otherClaimant(state?.packages ?? {}, name, previous.directory, skill)) continue;
       await (0, import_promises4.rm)((0, import_node_path4.join)(previous.directory, skill), { recursive: true, force: true });
       if (previous.linkedInto !== void 0) {
         await (0, import_promises4.rm)((0, import_node_path4.join)(previous.linkedInto, skill), { recursive: true, force: true });
@@ -1313,6 +1371,7 @@ async function updateSkills(dependencies) {
   for (const file of files) {
     if (untouched.has(file.skill)) continue;
     const target = (0, import_node_path4.join)(dependencies.directory, file.skill, ...file.path.split("/"));
+    assertInside(dependencies.directory, target);
     await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(target), { recursive: true });
     await (0, import_promises4.writeFile)(target, file.data);
   }
@@ -1353,7 +1412,9 @@ async function updateSkills(dependencies) {
     updated,
     unchanged,
     skills,
-    fileCount: files.filter((one) => !skipped.includes(one.skill)).length,
+    // ⚠ 扣掉的是 `untouched` 全部（用户删的 + 让给别的包的），不只是 skipped ——
+    // 让开没写的那些文件算进去，「N file(s)」就是句假话。
+    fileCount: files.filter((one) => !untouched.has(one.skill)).length,
     removed,
     skipped,
     conflicts,
@@ -1365,7 +1426,7 @@ async function updateSkills(dependencies) {
 }
 
 // src/cli.ts
-var VERSION = false ? "0.0.0-dev" : "0.6.1";
+var VERSION = false ? "0.0.0-dev" : "0.7.0";
 function usage() {
   return `PEP CLI ${VERSION}
 
@@ -1723,7 +1784,10 @@ ${usage()}`);
       );
     }
     const wanted = named.length > 0 ? named : installed;
-    const targets = chosenTarget ? wanted.filter((one) => state?.packages[one]?.directory === chosenTarget.directory) : wanted;
+    const targets = chosenTarget ? wanted.filter((one) => {
+      const at = state?.packages[one]?.directory;
+      return at !== void 0 && samePlace(at, chosenTarget.directory);
+    }) : wanted;
     if (targets.length === 0) {
       console.error(`No skills are installed in ${chosenTarget?.directory}.`);
       console.error("`pep skills update` (no flag) refreshes every repository where it lives;");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newlandnpt/pep-cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "PEP CLI —— 凭 PEP 身份读取 Newland 开发者文档与 agent skills",
   "license": "UNLICENSED",
   "type": "module",