@opengeni/runtime 0.14.0 → 0.14.1

package/dist/{chunk-3NUSY22C.js → chunk-HHWIZHQM.js}

@@ -19458,6 +19458,7 @@ function withRunCredentialsClient(client, sessionId, onSessionReady) {
 import { createHash as createHash5 } from "crypto";
 import { posix as posixPath } from "path";
 var MAX_TOOLSPACE_SESSION_ID_BYTES = 512;
+var HOME_RELATIVE_TOOLSPACE_PREFIX = "$HOME/";
 var ToolspaceTokenPathError = class extends Error {
   constructor(message) {
     super(message);
@@ -19473,11 +19474,29 @@ function assertToolspaceSessionId(sessionId) {
   }
   return sessionId;
 }
-function toolspaceTokenFileForSession(manifestTokenFile, sessionId) {
-  if (!manifestTokenFile || manifestTokenFile.includes("\0") || !posixPath.isAbsolute(manifestTokenFile)) {
-    throw new ToolspaceTokenPathError("Toolspace manifest token file must be absolute");
+function isHomeRelativeToolspacePath(value) {
+  if (!value.startsWith(HOME_RELATIVE_TOOLSPACE_PREFIX)) return false;
+  const relative4 = value.slice(HOME_RELATIVE_TOOLSPACE_PREFIX.length);
+  const segments = relative4.split("/");
+  return relative4.length > 0 && !relative4.includes("\0") && segments.every(
+    (segment) => segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)
+  ) && posixPath.normalize(relative4) === relative4;
+}
+function assertToolspaceFilePath(value, label) {
+  if (!value || value.includes("\0") || !posixPath.isAbsolute(value) && !isHomeRelativeToolspacePath(value)) {
+    throw new ToolspaceTokenPathError(`${label} must be absolute or use the trusted $HOME/ prefix`);
   }
-  const normalizedManifestFile = posixPath.normalize(manifestTokenFile);
+  return posixPath.isAbsolute(value) ? posixPath.normalize(value) : value;
+}
+function shellToolspacePath(value) {
+  const validated = assertToolspaceFilePath(value, "Toolspace token file");
+  return isHomeRelativeToolspacePath(validated) ? `"${validated}"` : shellQuote5(validated);
+}
+function toolspaceTokenFileForSession(manifestTokenFile, sessionId) {
+  const normalizedManifestFile = assertToolspaceFilePath(
+    manifestTokenFile,
+    "Toolspace manifest token file"
+  );
   const digest = createHash5("sha256").update(assertToolspaceSessionId(sessionId)).digest("hex");
   return posixPath.join(posixPath.dirname(normalizedManifestFile), "toolspace-tokens", digest);
 }
@@ -19486,10 +19505,7 @@ function toolspaceTokenFileFromEnvironment(environment, sessionId) {
   return toolspaceTokenFileForSession(manifestTokenFile, sessionId);
 }
 function withToolspaceTokenEnvironment(cmd, tokenFile) {
-  if (!tokenFile || tokenFile.includes("\0") || !posixPath.isAbsolute(tokenFile)) {
-    throw new ToolspaceTokenPathError("Toolspace token file must be absolute");
-  }
-  return [`export OPENGENI_TOOLSPACE_TOKEN_FILE=${shellQuote5(tokenFile)}`, cmd].join("\n");
+  return [`export OPENGENI_TOOLSPACE_TOKEN_FILE=${shellToolspacePath(tokenFile)}`, cmd].join("\n");
 }
 function withToolspaceTokenSession(session, tokenFile) {
   return new Proxy(session, {
@@ -23984,6 +24000,7 @@ export {
   withRunCredentialsSession,
   withRunCredentialsClient,
   ToolspaceTokenPathError,
+  shellToolspacePath,
   toolspaceTokenFileForSession,
   toolspaceTokenFileFromEnvironment,
   withToolspaceTokenEnvironment,
@@ -24048,4 +24065,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-3NUSY22C.js.map
+//# sourceMappingURL=chunk-HHWIZHQM.js.map