@pab-iprg/huohuo 1.0.0-preview.7 → 1.0.0-preview.8

package/README.md

@@ -31,3 +31,6 @@ npx.cmd --yes --prefer-online @pab-iprg/huohuo@preview
 ```
 
 默认目录无需手动填写。需要独立试用目录时，CMD 使用 `--home "%USERPROFILE%\.huohuo-windows-trial-01"`，PowerShell 使用 `--home "$env:USERPROFILE\.huohuo-windows-trial-01"`。程序内部使用系统自带 PowerShell 采样，不要求用户用 PowerShell 启动。两种终端的首装、Ctrl+C、再次启动及数据保留均需分别实机验收。
+
+
+平台静态资源缺失、版本不匹配或损坏时，入口会自动补齐该固定版本并核对发行摘要，普通用户无需追加可选依赖、registry或cache参数。恢复只操作火火的受管资源缓存，不执行资源包脚本、不改变npm全局配置，继续原来固定的安装版本。

package/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // distribution/bootstrap/entry.ts
-import { open as open3, readFile as readFile9, realpath as realpath5 } from "node:fs/promises";
+import { open as open4, readFile as readFile9, realpath as realpath5 } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname6, join as join9, resolve as resolve5 } from "node:path";
@@ -377,7 +377,7 @@ async function transfer(artifact2, path, source, fetcher, onBytes) {
     timer.unref();
   };
   const signal = AbortSignal.any([idle.signal, AbortSignal.timeout(30 * 6e4)]);
-  keepAlive();
+  if (!artifact2.bundled) keepAlive();
   try {
     const response = await requestSource(artifact2, source, fetcher, signal, "GET", keepAlive);
     if (!response.ok || !response.body) {
@@ -420,7 +420,7 @@ function safePath(root, path) {
   if (target !== root && !target.startsWith(root + sep)) throw new Error("\u538B\u7F29\u5305\u8DEF\u5F84\u8D8A\u754C");
   return target;
 }
-async function extractArchive(archive, root, expandedLimit) {
+async function extractArchive(archive, root, expandedLimit, allowedFiles) {
   root = resolve(root);
   await mkdir2(root, { mode: 448 });
   root = await realpath(root);
@@ -469,6 +469,11 @@ async function extractArchive(archive, root, expandedLimit) {
       } else {
         const prefix = string(header.subarray(345, 500));
         const name = pax.path ?? (prefix ? prefix + "/" : "") + string(header.subarray(0, 100));
+        if (allowedFiles) {
+          const directory = name.replace(/\/+$/, "");
+          const allowed = kind === "0" ? allowedFiles.has(name) : kind === "5" && [...allowedFiles].some((path) => path.startsWith(directory + "/"));
+          if (!allowed) throw new Error("\u5B89\u88C5\u8D44\u6E90\u538B\u7F29\u5305\u542B\u672A\u5141\u8BB8\u7684\u6587\u4EF6\u6216\u94FE\u63A5");
+        }
         const target = safePath(root, name);
         const linkText = pax.linkpath ?? string(header.subarray(157, 257));
         if (Object.keys(pax).some((key) => /sparse|size/i.test(key))) throw new Error("\u4E0D\u652F\u6301\u7A00\u758F\u6216\u6539\u5199\u5927\u5C0F\u7684\u538B\u7F29\u5305");
@@ -1571,7 +1576,8 @@ async function showStatus(home, watch) {
 
 // distribution/bootstrap/assets.ts
 import { createRequire } from "node:module";
-import { readFile as readFile8 } from "node:fs/promises";
+import { readFile as readFile8, mkdir as mkdir4, mkdtemp, open as open3, rename as rename5, rm as rm5, lstat as lstat3 } from "node:fs/promises";
+import { createHash as createHash3 } from "node:crypto";
 import { dirname as dirname5, join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
 async function assetsDirectory(release, entryURL = import.meta.url) {
@@ -1589,18 +1595,127 @@ async function assetsDirectory(release, entryURL = import.meta.url) {
   }
   return join8(dirname5(file), "assets");
 }
+var recovering = /* @__PURE__ */ new Map();
+async function bundledAssetPath(release, artifact2, home, options = {}) {
+  const localFile = async () => join8(await assetsDirectory(release, options.entryURL), artifact2.sha256 + ".tgz");
+  if (!release.assetPackage) return localFile();
+  const expected = release.assetPackage;
+  if (expected.name !== `@pab-iprg/huohuo-assets-${release.platform.os}-${release.platform.arch}` || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(expected.version) || ![release.runtime, release.pythonDependencies].some((a) => a.bundled && a.sha256 === artifact2.sha256)) throw new Error("\u5E73\u53F0\u5B89\u88C5\u8D44\u6E90\u8EAB\u4EFD\u65E0\u6548");
+  try {
+    const file = await localFile();
+    await verifyArtifact(file, artifact2);
+    return file;
+  } catch {
+  }
+  const key = createHash3("sha256").update(JSON.stringify([expected.name, expected.version, release.runtime.sha256, release.pythonDependencies.sha256])).digest("hex");
+  const directory = join8(home, "cache", "platform-assets", key);
+  let pending = recovering.get(directory);
+  if (!pending) {
+    pending = recoverCompanion(directory, release, options);
+    recovering.set(directory, pending);
+    void pending.finally(() => {
+      if (recovering.get(directory) === pending) recovering.delete(directory);
+    }).catch(() => {
+    });
+  }
+  return join8(await pending, "assets", artifact2.sha256 + ".tgz");
+}
+async function validateCompanion(directory, release) {
+  const meta = await lstat3(directory);
+  if (!meta.isDirectory() || meta.isSymbolicLink()) throw new Error("\u5B89\u88C5\u8D44\u6E90\u7F13\u5B58\u8EAB\u4EFD\u65E0\u6548");
+  const file = join8(directory, "package.json");
+  if ((await lstat3(file)).size > 64 * 1024) throw new Error("\u5B89\u88C5\u8D44\u6E90\u6E05\u5355\u8FC7\u5927");
+  const manifest = JSON.parse(await readFile8(file, "utf8"));
+  if (manifest.name !== release.assetPackage.name || manifest.version !== release.assetPackage.version) throw new Error("\u5B89\u88C5\u8D44\u6E90\u8EAB\u4EFD\u6821\u9A8C\u672A\u901A\u8FC7");
+  for (const artifact2 of [release.runtime, release.pythonDependencies]) await verifyArtifact(join8(directory, "assets", artifact2.sha256 + ".tgz"), artifact2);
+}
+async function recoverCompanion(directory, release, options) {
+  try {
+    await validateCompanion(directory, release);
+    return directory;
+  } catch {
+  }
+  const { name, version: version2 } = release.assetPackage;
+  const basename = name.split("/")[1];
+  const url = `https://registry.npmjs.org/${name}/-/${basename}-${encodeURIComponent(version2)}.tgz`;
+  const limit = release.runtime.downloadBytes + release.pythonDependencies.downloadBytes + 128 * 1024;
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error("\u5B89\u88C5\u8D44\u6E90\u5927\u5C0F\u65E0\u6548");
+  const parent = dirname5(directory);
+  await mkdir4(parent, { recursive: true, mode: 448 });
+  const stage = await mkdtemp(join8(parent, ".recover-"));
+  try {
+    options.progress?.("\u6B63\u5728\u81EA\u52A8\u8865\u9F50\u5F53\u524D\u8BBE\u5907\u7684\u5B89\u88C5\u8D44\u6E90\u2026");
+    const archive = join8(stage, "companion.tgz");
+    await downloadCompanion(url, archive, limit, options.fetcher ?? fetch, options.signal);
+    const unpacked = join8(stage, "unpacked");
+    const allowed = /* @__PURE__ */ new Set([
+      "package/package.json",
+      "package/README.md",
+      ...[release.runtime, release.pythonDependencies].map((a) => "package/assets/" + a.sha256 + ".tgz")
+    ]);
+    await extractArchive(archive, unpacked, limit, allowed);
+    const root = join8(unpacked, "package");
+    await validateCompanion(root, release);
+    try {
+      await rename5(directory, directory + ".invalid-" + stage.slice(-6));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await rename5(root, directory);
+    options.progress?.("\u5B89\u88C5\u8D44\u6E90\u5DF2\u8865\u9F50\u5E76\u6821\u9A8C\uFF0C\u7EE7\u7EED\u5B89\u88C5\u3002");
+    return directory;
+  } catch (error) {
+    throw new Error("\u5B89\u88C5\u8D44\u6E90\u6682\u65F6\u672A\u80FD\u51C6\u5907\u597D\u3002\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u65B0\u8FD0\u884C\u540C\u4E00\u6761\u542F\u52A8\u547D\u4EE4\uFF0C\u5DF2\u5B8C\u6210\u7684\u6B65\u9AA4\u4F1A\u4FDD\u7559\u3002", { cause: error });
+  } finally {
+    await rm5(stage, { recursive: true, force: true });
+  }
+}
+async function downloadCompanion(url, path, limit, fetcher, signal) {
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const file = await open3(path, "w", 384);
+    const idle = new AbortController();
+    let timer;
+    const touch = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => idle.abort(), 45e3);
+      timer.unref();
+    };
+    touch();
+    try {
+      const response = await fetcher(url, { redirect: "error", signal: AbortSignal.any([idle.signal, AbortSignal.timeout(30 * 6e4), ...signal ? [signal] : []]) });
+      if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        throw new Error(`\u5B89\u88C5\u8D44\u6E90\u4E0B\u8F7D\u6682\u4E0D\u53EF\u7528\uFF08HTTP ${response.status}\uFF09`);
+      }
+      touch();
+      let size = 0;
+      for await (const chunk of response.body) {
+        touch();
+        size += chunk.byteLength;
+        if (size > limit) throw new Error("\u5B89\u88C5\u8D44\u6E90\u8D85\u8FC7\u5927\u5C0F\u9650\u5236");
+        await file.writeFile(chunk);
+      }
+      await file.sync();
+      return;
+    } catch (error) {
+      if (attempt === 1 || signal?.aborted) throw error;
+    } finally {
+      clearTimeout(timer);
+      await file.close();
+    }
+  }
+}
 
 // distribution/bootstrap/entry.ts
-function artifactSource(source, directory) {
+function artifactSource(source, directory, home) {
   return async (url, options) => {
     const bundled = /^https:\/\/bundled\.invalid\/([a-f0-9]{64})\.tgz$/.exec(String(url));
     if (!directory && !bundled) return fetch(url, options);
     const artifact2 = source && [source.runtime, source.python, source.pythonDependencies].find((item) => item.url === String(url));
     const sha256 = bundled?.[1] ?? artifact2?.sha256;
     if (!sha256) throw new Error("\u672C\u673A\u4EA7\u7269\u76EE\u5F55\u7F3A\u5C11\u8BE5\u56FA\u5B9A\u53D1\u884C\u8D44\u6E90");
-    const root = directory ?? await assetsDirectory(source, import.meta.url);
-    const path = join9(root, sha256 + ".tgz");
-    const file = await open3(path).catch((error) => {
+    const path = !directory && bundled && source && artifact2 && home ? await bundledAssetPath(source, artifact2, home, { entryURL: import.meta.url, signal: options?.signal ?? void 0, progress: (message) => console.log(message) }) : join9(directory ?? await assetsDirectory(source, import.meta.url), sha256 + ".tgz");
+    const file = await open4(path).catch((error) => {
       if (error.code === "ENOENT" && bundled) throw new Error("\u7F3A\u5C11\u4E0A\u6B21\u5B89\u88C5\u4F7F\u7528\u7684\u6587\u4EF6\u3002\u8BF7\u7528\u4E0A\u6B21\u5B89\u88C5\u65F6\u7684\u7248\u672C\u7EE7\u7EED\u3002");
       throw error;
     });
@@ -1656,7 +1771,7 @@ async function main(args = process.argv.slice(2)) {
   const ui = installUI(assumeYes);
   if (command === "upgrade") {
     const candidate = selectRelease(JSON.parse(await readFile9(releaseFile ?? join9(dirname6(fileURLToPath2(import.meta.url)), "release.json"), "utf8")));
-    await upgrade(home, candidate, { fetcher: artifactSource(candidate, artifactDirectory), progress, ...ui });
+    await upgrade(home, candidate, { fetcher: artifactSource(candidate, artifactDirectory, home), progress, ...ui });
     const current = await readInstallation(home);
     if (await control(home, current.releaseDigest, noOpen ? "status" : "open")) return;
     await run(process.execPath, [join9(installationPaths(home, current.release).runtime, "lib/distribution/managed.js"), "start", home, ...noOpen ? ["--no-open"] : []], home, process.env, () => control(home, current.releaseDigest, "stop"));
@@ -1716,7 +1831,7 @@ async function main(args = process.argv.slice(2)) {
       }
       source = selectRelease(catalog);
     }
-    const fetcher = artifactSource(source, artifactDirectory);
+    const fetcher = artifactSource(source, artifactDirectory, home);
     record = await install(home, source, { fetcher, progress, ...ui });
   }
   const installedHome = record.home;
@@ -1729,5 +1844,6 @@ if (process.argv[1] && await realpath5(resolve5(process.argv[1])).catch(() => ""
   });
 }
 export {
+  artifactSource,
   main
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pab-iprg/huohuo",
-  "version": "1.0.0-preview.7",
+  "version": "1.0.0-preview.8",
   "type": "module",
   "description": "火火多平台安装入口（实验预览）",
   "bin": {
@@ -15,9 +15,9 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@pab-iprg/huohuo-assets-darwin-arm64": "1.0.0-preview.7",
-    "@pab-iprg/huohuo-assets-linux-x64": "1.0.0-preview.7",
-    "@pab-iprg/huohuo-assets-win32-x64": "1.0.0-preview.7"
+    "@pab-iprg/huohuo-assets-darwin-arm64": "1.0.0-preview.8",
+    "@pab-iprg/huohuo-assets-linux-x64": "1.0.0-preview.8",
+    "@pab-iprg/huohuo-assets-win32-x64": "1.0.0-preview.8"
   },
   "publishConfig": {
     "access": "public",

package/release.json

@@ -18,12 +18,12 @@
       "runtime": {
         "name": "@huohuo/research-agent",
         "version": "1.0.0",
-        "url": "https://bundled.invalid/32e96855b2579f293877c67dc6c5645b2b1fb4e9300f70f3e7a783a6d67a4120.tgz",
+        "url": "https://bundled.invalid/0a7dabb24c07e97d1bff0a4b10350998e72c5f32f095e13bd3b81322a9ca689e.tgz",
         "bundled": true,
-        "sha256": "32e96855b2579f293877c67dc6c5645b2b1fb4e9300f70f3e7a783a6d67a4120",
-        "integrity": "sha512-6IAa0KnmqVFw7Z6ogyyLlaeOCHCFPJ7VxMIz7nzemffiZwBYGt8+SvNjkk4CWKzjtJppYQQl2NAPooqZ6keteg==",
-        "downloadBytes": 2613970,
-        "expandedBytes": 8341044
+        "sha256": "0a7dabb24c07e97d1bff0a4b10350998e72c5f32f095e13bd3b81322a9ca689e",
+        "integrity": "sha512-pZhVfMCto3Pm3ASdDuFnxfmNV8P8LfT8WHZ3gIkd1R9ygJD0SN55nad0SBMZh/WZdgZUcNv/z76m0tUeykdXIg==",
+        "downloadBytes": 2615359,
+        "expandedBytes": 8348241
       },
       "python": {
         "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.13.18%2B20261026-aarch64-apple-darwin-install_only_stripped.tar.gz",
@@ -99,7 +99,7 @@
       },
       "assetPackage": {
         "name": "@pab-iprg/huohuo-assets-darwin-arm64",
-        "version": "1.0.0-preview.7"
+        "version": "1.0.0-preview.8"
       }
     },
     {
@@ -118,12 +118,12 @@
       "runtime": {
         "name": "@huohuo/research-agent",
         "version": "1.0.0",
-        "url": "https://bundled.invalid/79cbf018a4363d256fee64f07dc3cd8e434ef1e89ba1dcfdcbdf4c2b0a424f65.tgz",
+        "url": "https://bundled.invalid/11495b66f6a1c6816978cf9f360c2a473b44332638506f5cb95c9cd0af047775.tgz",
         "bundled": true,
-        "sha256": "79cbf018a4363d256fee64f07dc3cd8e434ef1e89ba1dcfdcbdf4c2b0a424f65",
-        "integrity": "sha512-8KMx3WCkkFxvcD6XQcV7N9FNTgU/Q5SNezCkyJizOnlT4lt4bqWdbxlBfhRcTiVmaP2/3PjsyzFDB1KEaaev3g==",
-        "downloadBytes": 2613972,
-        "expandedBytes": 8341062
+        "sha256": "11495b66f6a1c6816978cf9f360c2a473b44332638506f5cb95c9cd0af047775",
+        "integrity": "sha512-Y7d6X7XBeRmy54ZzWb3iR4dQuh6fkflNIwPf0K60QueXUiCxcARRvzB0HtN1WKbqZGFSjQ4m+v6M0uwuBtQT6w==",
+        "downloadBytes": 2615361,
+        "expandedBytes": 8348259
       },
       "python": {
         "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.13.18%2B20261026-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
@@ -198,7 +198,7 @@
       },
       "assetPackage": {
         "name": "@pab-iprg/huohuo-assets-linux-x64",
-        "version": "1.0.0-preview.7"
+        "version": "1.0.0-preview.8"
       }
     },
     {
@@ -216,12 +216,12 @@
       "runtime": {
         "name": "@huohuo/research-agent",
         "version": "1.0.0",
-        "url": "https://bundled.invalid/32f67fca6cae53021035f6b972953335a657357907620c1fa5a618290cc552eb.tgz",
+        "url": "https://bundled.invalid/823a7ee2018ab91fbab69b09ef34a2d97f9ce0b88ecf23361a9485b92b31585a.tgz",
         "bundled": true,
-        "sha256": "32f67fca6cae53021035f6b972953335a657357907620c1fa5a618290cc552eb",
-        "integrity": "sha512-NVB0sYN/W8BWmBu6ShAl75t8jncWzSprwQ5NfS1k6M6KzJtqY+oEY/zQYZz500W6/na2yzCJC6TKmkxCugXfwA==",
-        "downloadBytes": 2613974,
-        "expandedBytes": 8341060
+        "sha256": "823a7ee2018ab91fbab69b09ef34a2d97f9ce0b88ecf23361a9485b92b31585a",
+        "integrity": "sha512-ywdwTv+V0TRIs6xOL2esvfuYFY9Y2Z2SRS2+Xhwqw4Lw5Y/+JLBiJCguB3pGOwfqHCLkq0ygm1Jg2E7lby1dqw==",
+        "downloadBytes": 2615361,
+        "expandedBytes": 8348257
       },
       "python": {
         "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.13.18%2B20261026-x86_64-pc-windows-msvc-install_only_stripped.tar.gz",
@@ -296,7 +296,7 @@
       },
       "assetPackage": {
         "name": "@pab-iprg/huohuo-assets-win32-x64",
-        "version": "1.0.0-preview.7"
+        "version": "1.0.0-preview.8"
       }
     }
   ]