@poe-platform/safe-bash 0.1.799 → 0.1.800

package/dist/safe-bash/command-chunks/chunk-NFGI5IGF.js

@@ -0,0 +1,266 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-unzip/src/unzip/safety.ts
+init_buffer();
+import { retainFileSystemCleanup } from "@poe-platform/safe-fs/core";
+import { dirname, isPathWithin, readBytes, resolvePath } from "../../safe-bash-contracts/index.js";
+import { concatBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { checkPath, display, fail, hasIdentity, sameIdentity } from "../../safe-bash-io-engine/commands/archive/internal.js";
+var Extraction = class {
+  constructor(context, limits) {
+    this.context = context;
+    this.limits = limits;
+  }
+  context;
+  limits;
+  inputVolumes = [];
+  pending = /* @__PURE__ */ new Set();
+  publications = /* @__PURE__ */ new Set();
+  readers = /* @__PURE__ */ new Set();
+  closed = false;
+  work = 0;
+  serial = 0;
+  async operation(action) {
+    this.context.signal.throwIfAborted();
+    if (this.closed) fail("extraction is closed");
+    if (++this.work > this.limits.maxPatternSteps) fail("filesystem work limit exceeded");
+    const pending = Promise.resolve().then(() => {
+      this.context.signal.throwIfAborted();
+      return action();
+    });
+    this.pending.add(pending);
+    try {
+      const value = await pending;
+      this.context.signal.throwIfAborted();
+      return value;
+    } finally {
+      this.pending.delete(pending);
+    }
+  }
+  async close() {
+    this.closed = true;
+    while (this.pending.size) await Promise.allSettled([...this.pending]);
+    while (this.publications.size) await Promise.allSettled([...this.publications]);
+    await Promise.allSettled([...this.readers].map((close) => close()));
+  }
+  source(source) {
+    return { [Symbol.asyncIterator]: () => {
+      const state = {};
+      let closing;
+      const close = () => closing ??= (async () => {
+        try {
+          await state.iterator?.return?.();
+        } finally {
+          this.readers.delete(close);
+        }
+      })();
+      this.readers.add(close);
+      this.context.signal.throwIfAborted();
+      state.iterator = source[Symbol.asyncIterator]();
+      return {
+        next: () => this.operation(async () => {
+          const result = await state.iterator.next();
+          if (result.done) this.readers.delete(close);
+          return result;
+        }),
+        async return() {
+          await close();
+          return { done: true, value: void 0 };
+        }
+      };
+    } };
+  }
+  async *input(path) {
+    const { fs, signal } = this.context;
+    const capabilities = await this.operation(async () => await fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities);
+    if (fs.readStream && capabilities.streamingRead !== false) {
+      const source = await this.operation(async () => fs.readStream(path, { signal, chunkSize: this.limits.chunkSize }));
+      yield* readBytes(this.source(source), signal);
+    } else {
+      const stat = await this.operation(() => fs.stat(path, { signal }));
+      if (stat.size > this.limits.maxBufferedFileBytes) fail("filesystem lacks streaming reads: buffered file limit exceeded");
+      const bytes = await this.operation(() => fs.readFile(path, { signal, ...Number.isFinite(this.limits.maxBufferedFileBytes) ? { maxBytes: this.limits.maxBufferedFileBytes } : {} }));
+      if (bytes.length > this.limits.maxBufferedFileBytes) fail("buffered file limit exceeded");
+      yield bytes;
+    }
+  }
+  async stat(path) {
+    try {
+      return await this.operation(() => this.context.fs.lstat(path, { signal: this.context.signal }));
+    } catch (error) {
+      this.context.signal.throwIfAborted();
+      if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  async directory(raw, create, ancestors) {
+    checkPath(raw, this.limits);
+    let current = "/";
+    const { fs, signal } = this.context;
+    if (ancestors) ancestors.push({ path: current, stat: await this.operation(() => fs.lstat(current, { signal })) });
+    for (const component of raw.split("/")) {
+      if (!component || component === ".") continue;
+      const parent = await this.operation(() => fs.lstat(current, { signal }));
+      current = resolvePath(current, component);
+      const stat = await this.stat(current);
+      if (!stat && create) await this.createDirectory(current, parent);
+      else if (!stat || stat.type !== "directory") fail(`unsafe non-directory or symlink ancestor: ${display(current)}`);
+      if (ancestors) ancestors.push({ path: current, stat: stat ?? await this.operation(() => fs.lstat(current, { signal })) });
+    }
+    return current;
+  }
+  async createDirectory(path, parent) {
+    const { fs, signal } = this.context;
+    const capabilities = await this.operation(async () => await fs.capabilitiesFor?.(path, { signal, create: true }) ?? fs.capabilities);
+    if (capabilities.atomicDirectoryMetadata !== true && capabilities.trustedOwnedStaging !== true || !fs.prepareDirectory) fail("extraction requires atomic directory creation");
+    return this.operation(() => fs.prepareDirectory(path, {
+      signal,
+      parent,
+      expected: null,
+      ...capabilities.permissions === false ? {} : { mode: 493 }
+    }));
+  }
+  async parents(root, path, create) {
+    if (!isPathWithin(root, path)) fail("extraction path escapes root");
+    await this.directory(dirname(path), create);
+  }
+  member(root, name) {
+    checkPath(name, this.limits);
+    if (name.startsWith("/") || name.split("/").includes("..")) fail(`unsafe archive member: ${display(name)}`);
+    const path = resolvePath(root, name);
+    checkPath(path, this.limits);
+    if (!isPathWithin(root, path)) fail("extraction path escapes root");
+    return path;
+  }
+  async target(root, path, target) {
+    checkPath(target, this.limits);
+    if (target.startsWith("/")) fail("symlink target escapes extraction root");
+    let current = dirname(path);
+    const components = (value) => {
+      checkPath(value, this.limits);
+      let descended = false;
+      const result = value.split("/");
+      for (const component of result) {
+        if (component === ".." && descended) fail("unsafe non-leading parent in symlink target");
+        if (component && component !== "." && component !== "..") descended = true;
+      }
+      return result;
+    };
+    let pending = components(target);
+    let links = 0;
+    let steps = 0;
+    while (pending.length) {
+      if (++steps > this.limits.maxDepth * 41) fail("symlink target resolution limit exceeded");
+      const component = pending.shift();
+      if (!component || component === ".") continue;
+      if (component === "..") {
+        if (current === root) fail("symlink target escapes extraction root");
+        current = dirname(current);
+        continue;
+      }
+      const candidate = resolvePath(current, component);
+      checkPath(candidate, this.limits);
+      if (!isPathWithin(root, candidate)) fail("symlink target escapes extraction root");
+      const stat = await this.stat(candidate);
+      if (stat?.type === "symlink") {
+        if (++links > 40 || !this.context.fs.readlink) fail("symlink target chain cannot be safely resolved");
+        const link = await this.operation(() => this.context.fs.readlink(candidate, { signal: this.context.signal }));
+        if (link.startsWith("/")) fail("absolute symlink target chain is unsafe");
+        pending = [...components(link), ...pending];
+        if (pending.length > this.limits.maxDepth * 41) fail("symlink target resolution limit exceeded");
+      } else current = candidate;
+    }
+  }
+  async destination(path, archivePath, archiveStat) {
+    const stat = await this.stat(path);
+    if (path === archivePath || stat && sameIdentity(stat, archiveStat)) fail("entry would overwrite input archive");
+    if (this.inputVolumes.some((volume) => path === volume.path || stat && sameIdentity(stat, volume.stat))) fail("entry would overwrite input archive volume");
+    if (stat && stat.type !== "file") fail(`unsafe non-regular destination: ${display(path)}`);
+    if (stat && (!hasIdentity(stat) || !hasIdentity(archiveStat))) fail("cannot overwrite file with unknown input-archive backing identity");
+    return stat;
+  }
+  async checked(root, path, expected) {
+    await this.parents(root, path, false);
+    const current = await this.stat(path);
+    if (!current || current.type !== expected.type || !sameIdentity(current, expected)) fail("extraction entry changed before mutation");
+  }
+  async metadata(root, path, identity, parent, mode, modified) {
+    const { fs, signal } = this.context;
+    await this.parents(root, path, false);
+    const capabilities = await this.operation(async () => await fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities);
+    if (capabilities.permissions === false && capabilities.timestamps === false) return;
+    if (capabilities.atomicDirectoryMetadata !== true && capabilities.trustedOwnedStaging !== true || !fs.prepareDirectory) fail("extraction metadata requires atomic entry conditions");
+    await this.operation(() => fs.prepareDirectory(path, {
+      signal,
+      expected: identity,
+      parent,
+      ...capabilities.permissions === false ? {} : { mode: mode & 511 },
+      ...capabilities.timestamps === false ? {} : { atimeMs: modified.getTime(), mtimeMs: modified.getTime() }
+    }));
+  }
+  publish(root, path, chunks, expected, parent, mode, modified, target) {
+    const publication = this.stage(root, path, chunks, expected, parent, mode, modified, target);
+    this.publications.add(publication);
+    return publication.finally(() => {
+      this.publications.delete(publication);
+    });
+  }
+  async stage(root, path, chunks, expected, parent, mode, modified, target) {
+    const { fs, signal } = this.context;
+    const capabilities = await this.operation(async () => await fs.capabilitiesFor?.(path, { signal, create: true }) ?? fs.capabilities);
+    if (capabilities.atomicFileStaging !== true && capabilities.trustedOwnedStaging !== true || !fs.createStagedFile || !fs.publishStagedFile || !fs.removeStagedFile) fail("extraction requires atomic owned file staging");
+    if (capabilities.atomicStagingAncestry !== true) fail("extraction requires atomic staging ancestry verification");
+    const ancestors = [];
+    let staging;
+    let failure;
+    const cleanup = retainFileSystemCleanup(fs, async (view) => {
+      if (staging) {
+        if (!view.removeStagedFile) fail("extraction atomic cleanup unavailable");
+        await view.removeStagedFile(staging);
+      }
+    }, { maxOperations: Math.min(4096, this.limits.maxDepth + 3) });
+    try {
+      if (!isPathWithin(root, path)) fail("extraction path escapes root");
+      await this.directory(dirname(path), false, ancestors);
+      const content = target === void 0 ? { type: "file", data: concatBytes(chunks) } : { type: "symlink", target };
+      for (let attempt = 0; attempt < this.limits.maxMembers; attempt++) {
+        const temporary = resolvePath(dirname(path), `.unzip-${++this.serial}`);
+        checkPath(temporary, this.limits);
+        checkPath(`${temporary}/entry`, this.limits);
+        if (temporary === path) continue;
+        try {
+          await this.operation(async () => {
+            staging = await fs.createStagedFile(temporary, "entry", content, {
+              signal,
+              parent,
+              ...target !== void 0 || capabilities.permissions === false ? {} : { mode: mode & 511 },
+              ...target !== void 0 || capabilities.timestamps === false ? {} : { atimeMs: modified.getTime(), mtimeMs: modified.getTime() }
+            });
+          });
+          break;
+        } catch (error) {
+          signal.throwIfAborted();
+          if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "EEXIST") throw error;
+        }
+      }
+      if (!staging) fail("temporary file attempt limit exceeded");
+      await this.parents(root, path, false);
+      await this.operation(() => fs.publishStagedFile(staging, path, { signal, parent, destination: expected ?? null, ancestors }));
+    } catch (error) {
+      failure = { reason: error };
+    }
+    try {
+      await cleanup();
+    } catch (error) {
+      if (failure) throw new AggregateError([failure.reason, error], "unzip publication and cleanup failed");
+      throw error;
+    }
+    if (failure) throw failure.reason;
+  }
+};
+
+export {
+  Extraction
+};

package/dist/safe-bash/command-chunks/{chunk-KVFCSLKK.js → chunk-NXEQ3ESQ.js}

@@ -59,6 +59,12 @@ var XmlBudget = class {
   pollSignal;
   outputBytes = 0;
   inputBytes = 0;
+  /** Charge synchronous work only when it cannot start an asynchronous checkpoint. */
+  tryTickSync(work = 1) {
+    if (this.checkpoint + work >= 16384) return false;
+    this.tick(work);
+    return true;
+  }
   tick(work = 1) {
     if (this.aborted || this.pollSignal && this.signal.aborted) this.signal.throwIfAborted();
     this.steps += work;

package/dist/safe-bash/command-chunks/{chunk-3VGGYEDH.js → chunk-ORYGZYKW.js}

@@ -1,6 +1,6 @@
 import {
   SearchError
-} from "./chunk-J4PEQWSF.js";
+} from "./chunk-VGG2DL5Q.js";
 import {
   init_buffer
 } from "./chunk-HX3SHTCE.js";
@@ -116,8 +116,9 @@ var Limits = class {
       this.outBuf = null;
     }
   }
-  tick() {
+  tick(syncOnly = false) {
     if (this.context.signal.aborted) throw this.context.signal.reason;
+    if (syncOnly && (this.ticks + 1 & (this.hasExtYield ? 127 : 2047)) === 0) return true;
     if (this.hasExtYield) {
       runYieldCheckpoint(this.context.signal);
       if ((++this.ticks & 127) === 0) return yieldTurn(this.context.signal);
@@ -553,7 +554,7 @@ function findDualDelimiter(chunk, start, delimiter, extraDelimiter) {
   return -1;
 }
 function trySyncLineBatches(source, limits, state, binary, nullData, maxRecords, needAll = false, crlf = false, reusePool = false) {
-  if (limits.tick() !== void 0) return void 0;
+  if (limits.tick(true) !== void 0) return void 0;
   const chunk = source;
   if (state.bytesRead + chunk.length > limits.maxFileBytes) throw new SearchError("input file byte limit exceeded");
   const delimiter = nullData ? 0 : 10;