@runinfra/cli 0.1.0 → 0.1.1

package/dist/endpoints.js

@@ -29,7 +29,7 @@ export function resolveApiBase(env) {
     const base = `${url.origin}${url.pathname}`.replace(/\/+$/u, "");
     return { ok: true, base };
 }
-function isLoopbackHostname(hostname) {
+export function isLoopbackHostname(hostname) {
     return (hostname === "localhost" ||
         hostname === "127.0.0.1" ||
         hostname === "[::1]" ||

package/dist/http.js

@@ -1,5 +1,6 @@
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
+import { isLoopbackHostname } from "./endpoints.js";
 import { CliError } from "./errors.js";
 import { userAgent } from "./version.js";
 export const DEFAULT_IDLE_TIMEOUT_MS = 30_000;
@@ -24,11 +25,28 @@ function networkError(url, cause) {
     }
     return new CliError("network", `Could not reach ${host}: ${detail}`, "Check your connection or proxy settings, then run the command again.");
 }
+const CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+]);
+function headersForHop(requested, origin, originalOrigin) {
+    if (!requested || origin === originalOrigin)
+        return { ...(requested ?? {}) };
+    const carried = {};
+    for (const [name, value] of Object.entries(requested)) {
+        if (CREDENTIAL_HEADERS.has(name.toLowerCase()))
+            continue;
+        carried[name] = value;
+    }
+    return carried;
+}
 async function dispatch(options) {
     const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
     let currentUrl = options.url;
     let method = options.method;
     let body = options.json === undefined ? null : Buffer.from(JSON.stringify(options.json), "utf8");
+    const originalOrigin = new URL(options.url).origin;
     for (let hop = 0; hop <= maxRedirects; hop += 1) {
         const parsed = new URL(currentUrl);
         const secure = parsed.protocol === "https:";
@@ -36,7 +54,7 @@ async function dispatch(options) {
         const headers = {
             accept: "application/json",
             "user-agent": userAgent(),
-            ...(options.headers ?? {}),
+            ...headersForHop(options.headers, parsed.origin, originalOrigin),
         };
         if (body) {
             headers["content-type"] = "application/json";
@@ -74,6 +92,9 @@ async function dispatch(options) {
         if (parsed.protocol === "https:" && next.protocol !== "https:") {
             throw new CliError("network", `${parsed.host} redirected to an insecure URL (${next.protocol}//${next.host}).`, "This is not something the CLI can safely follow. Report it to support.");
         }
+        if (next.protocol === "http:" && !isLoopbackHostname(next.hostname)) {
+            throw new CliError("network", `${parsed.host} redirected to a plaintext URL off this machine (${next.protocol}//${next.host}).`, "This is not something the CLI can safely follow. Report it to support.");
+        }
         if (status === 303 || ((status === 301 || status === 302) && method !== "HEAD")) {
             method = "GET";
             body = null;

package/dist/pull.js

@@ -37,7 +37,25 @@ export async function pull(context, options, signal) {
     const existing = await statOrNull(finalPath);
     if (existing !== null) {
         if (existing.size === artifact.sizeBytes) {
-            output.info(`${fileName} is already downloaded.`);
+            if (lease.checksumSha256) {
+                let lastTickMs = 0;
+                const actual = await sha256File(finalPath, (hashed) => {
+                    const nowMs = Date.now();
+                    if (nowMs - lastTickMs < 500)
+                        return;
+                    lastTickMs = nowMs;
+                    const percent = artifact.sizeBytes > 0 ? (hashed / artifact.sizeBytes) * 100 : 0;
+                    output.status(`  Checking the file already here  ${percent.toFixed(1)}%`);
+                }, signal);
+                output.endStatus();
+                if (judgeChecksum(lease.checksumSha256, actual) === "mismatch") {
+                    throw new CliError("checksum_mismatch", `${finalPath} is the published size but does not match the published checksum.`, "Move or delete that file, then run the same command again to download it fresh.");
+                }
+                output.info(`${fileName} is already downloaded, and its checksum matches.`);
+            }
+            else {
+                output.info(`${fileName} is already downloaded. UNVERIFIED: this package publishes no checksum.`);
+            }
             output.result(finalPath);
             return 0;
         }

package/dist/version.js

@@ -1,6 +1,6 @@
 export const CLI_NAME = "runinfra";
 export const CLI_PACKAGE = "@runinfra/cli";
-export const CLI_VERSION = "0.1.0";
+export const CLI_VERSION = "0.1.1";
 export const CLI_CLIENT_ID = "runinfra-cli";
 export const MINIMUM_NODE_MAJOR = 20;
 export function isSupportedNodeVersion(version) {

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@runinfra/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "RunInfra CLI: browser-approved sign-in and resumable downloads for optimized model packages",
   "license": "SEE LICENSE IN LICENSE",
-  "homepage": "https://runinfra.ai/optimized-models",
+  "homepage": "https://runinfra.ai/catalog",
   "bugs": {
     "url": "https://runinfra.ai/contact"
   },