@nissyai/desktop 0.2.40 → 0.2.51

package/bin/nissy.mjs

@@ -68,7 +68,7 @@ function fail(message) {
   process.exit(1);
 }
 
-function validateArchive(archivePath, bundleName) {
+function validateArchive(archivePath) {
   const listing = execFileSync("tar", ["-tzf", archivePath], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "inherit"],
@@ -77,7 +77,7 @@ function validateArchive(archivePath, bundleName) {
     .split(/\r?\n/u)
     .map((entry) => entry.trim())
     .filter((entry) => entry.length > 0);
-  const unsafe = unsafeArchiveEntries(entries, bundleName);
+  const unsafe = unsafeArchiveEntries(entries);
   if (unsafe.length > 0) {
     throw new Error(
       `payload archive contains unsafe entries: ${unsafe.slice(0, 5).join(", ")}`,
@@ -224,7 +224,7 @@ if (existsSync(join(payloadRoot, "app"))) {
     try {
       rmSync(tmp, { recursive: true, force: true });
       mkdirSync(tmp, { recursive: true });
-      validateArchive(archivePath, bundleName);
+      validateArchive(archivePath);
       execFileSync("tar", ["-xzf", archivePath, "-C", tmp], { stdio: "inherit" });
       const tmpApp = join(tmp, bundleName);
       if (!existsSync(tmpApp) || !isExtractedBundleInside(tmp, tmpApp)) {
@@ -256,6 +256,18 @@ if (existsSync(join(payloadRoot, "app"))) {
       if (!existsSync(exePath)) {
         fail(`failed to install ${installedApp}: ${err.message}`);
       }
+      // The previous install is still there, so we CAN carry on — and carrying
+      // on is right: a user with a working app should not be stopped from
+      // opening it because the new version would not unpack.
+      //
+      // But say so. Silence here is what made the validation bug above cost
+      // real users their updates rather than a bug report: the app relaunched
+      // the old version, found the same update waiting, and looped — with
+      // nothing written anywhere to say an install had been attempted at all.
+      console.error(
+        `[nissy] could not install ${version}: ${err.message}\n` +
+          `[nissy] continuing on the installed version at ${installedApp}`,
+      );
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nissyai/desktop",
-  "version": "0.2.40",
+  "version": "0.2.51",
   "type": "module",
   "description": "Launcher for the Nissy desktop app. Resolves the host's app payload and spawns it. Run via `npx @nissyai/desktop`; a global install (`npm i -g @nissyai/desktop`) exposes the `nissy` command.",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,8 +20,8 @@
     "src/"
   ],
   "optionalDependencies": {
-    "@nissyai/app-win32-x64": "0.2.40",
-    "@nissyai/app-darwin-arm64": "0.2.40",
-    "@nissyai/app-darwin-x64": "0.2.40"
+    "@nissyai/app-win32-x64": "0.2.51",
+    "@nissyai/app-darwin-arm64": "0.2.51",
+    "@nissyai/app-darwin-x64": "0.2.51"
   }
 }

package/src/resolve.mjs

@@ -118,28 +118,36 @@ export function payloadCacheKey(pkg, version) {
  * this boundary: npm package replacement or a compromised publish could turn
  * a path traversal entry into a write outside the temporary install directory.
  *
+ * "Unsafe" means exactly one thing: the entry ESCAPES the directory we extract
+ * into — an absolute path, a drive letter, or a `..` segment. It does not mean
+ * "not part of the bundle". `pack-npm.mjs` archives the whole Forge output
+ * (`tar -C <forgeDir> .`), so every real payload carries `./LICENSE`,
+ * `./version` and `./LICENSES.chromium.html` alongside `./Nissy.app/`. Rejecting
+ * those made EVERY macOS update fail validation, and because the caller swallows
+ * the failure whenever the old app is still installed, the app silently relaunched
+ * the old version and found the same update again — for ever.
+ *
+ * Siblings are harmless by construction: they extract into a throwaway temp
+ * directory and only the `.app` is ever moved out of it. That the bundle is
+ * present, and is a real path inside the temp directory, is the caller's check
+ * (`isExtractedBundleInside`) — after extraction, where it can be verified
+ * rather than inferred from a name.
+ *
  * Tar listings commonly prefix names with `./`, and the bundle itself contains
- * legitimate framework symlinks, so this validates names only. The caller
- * separately verifies the extracted top-level bundle is a real path inside the
- * temporary directory before swapping it into ~/Applications.
+ * legitimate framework symlinks, so this validates names only.
  *
  * @param {readonly string[]} entries names from `tar -tzf`
- * @param {string} bundleName expected top-level `.app` directory name
  * @returns {string[]} original unsafe entry names
  */
-export function unsafeArchiveEntries(entries, bundleName) {
-  const root = bundleName.replace(/\\/g, "/").replace(/^\.\/+|\/+$/g, "");
+export function unsafeArchiveEntries(entries) {
   return entries.filter((entry) => {
     const normalized = entry.replace(/\\/g, "/").replace(/^\.\/+/, "");
     if (normalized === "") return false;
-    if (
+    return (
       normalized.startsWith("/") ||
       /^[A-Za-z]:\//u.test(normalized) ||
       normalized.split("/").includes("..")
-    ) {
-      return true;
-    }
-    return normalized !== root && !normalized.startsWith(`${root}/`);
+    );
   });
 }