@vosjs/cli 0.76.0 → 0.77.0

package/dist/{chunk-OJ3ZCPYS.js → chunk-SB622PZM.js}

@@ -9,7 +9,7 @@ import {
   reencodeStill,
   renderStill,
   videoFormat
-} from "./chunk-YZAM4W7B.js";
+} from "./chunk-KDIRW72G.js";
 import {
   PREV_DOC_NAME,
   RECORDING_NAME,
@@ -28,6 +28,7 @@ import {
   readJson,
   readMediaHead,
   recordHostedMedia,
+  safePathName,
   sourceSidecarRefs,
   takeMediaFile,
   takePaths,
@@ -36,7 +37,7 @@ import {
   uploadDocRefs,
   uploadManifest,
   writeJson
-} from "./chunk-M3QIN457.js";
+} from "./chunk-UY2N42P2.js";
 import {
   CREDENTIALS_PATH,
   MEDIA_HEAD_BYTES,
@@ -68,8 +69,9 @@ import {
   sniffMediaType,
   strFlag,
   writeCredential,
+  writeFileSafe,
   writeSyncState
-} from "./chunk-FL3E27WE.js";
+} from "./chunk-B4U4URE3.js";
 import {
   deadLine,
   deadWarns
@@ -366,10 +368,13 @@ var EPS = 1e-3;
 var isNum = (v) => typeof v === "number" && Number.isFinite(v);
 var isObj = (v) => typeof v === "object" && v !== null;
 function htmlFontUrlProblem(url) {
-  if (/^https?:\/\//.test(url)) return null;
+  if (/^https:\/\/assets\.vos\.so\//.test(url)) return null;
   if (/^\/api\/assets\/[^/]+\/file$/.test(url)) return null;
+  if (/^https?:\/\//i.test(url)) {
+    return `names ${url}: a face is fetched from https://assets.vos.so (the host a layer's images are held to), a hosted file (/api/assets/<id>/file) or a .woff2 beside the document, never another host`;
+  }
   if (/^(data:|blob:)/.test(url) || url.startsWith("/")) {
-    return `must be an https URL, a hosted file (/api/assets/<id>/file) or a .woff2 beside the document (got ${url})`;
+    return `must be an https://assets.vos.so URL, a hosted file (/api/assets/<id>/file) or a .woff2 beside the document (got ${url})`;
   }
   if (url.split(/[\\/]/).includes("..")) {
     return `names ${url}, outside the document's directory: copy the font beside doc.json`;
@@ -6205,7 +6210,7 @@ async function writeScriptBeside(dir, doc) {
 }
 
 // src/plugin/folder.ts
-import { mkdir as mkdir5, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir5 } from "fs/promises";
 import { join as join12 } from "path";
 import { recipeHints } from "@vosjs/shared/frontmatter";
 import { migrateHostedDoc } from "@vosjs/studio-core";
@@ -6394,7 +6399,6 @@ function recipeLine(filename, body) {
   ].filter(Boolean);
   return `${filename}${facts.length ? `  (${facts.join(" \xB7 ")})` : ""}`;
 }
-var safeName = (v) => v.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
 async function cmdPull(argv) {
   const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS);
   const ref = positionals[0];
@@ -6413,26 +6417,27 @@ async function cmdPull(argv) {
   if (res.status !== 200)
     throw new Error(apiError(`pull folder ${folder.slug}`, res));
   const payload = res.body;
-  const out = strFlag(flags, "out") ?? folder.slug;
+  const safeName = (v, id) => safePathName((v ?? "").toLowerCase(), id);
+  const out = strFlag(flags, "out") ?? safeName(folder.slug, folder.id);
   await mkdir5(join12(out, "recipes"), { recursive: true });
   const lines = [];
   const recipes = [];
   for (const rec of payload.recipes) {
-    const path = join12(out, "recipes", safeName(rec.filename));
-    await writeFile8(path, rec.body ?? "");
+    const path = join12(out, "recipes", safeName(rec.filename, rec.id));
+    await writeFileSafe(path, rec.body ?? "");
     recipes.push({ path, line: recipeLine(rec.filename, rec.body ?? "") });
   }
   for (const rec of payload.inheritedRecipes) {
-    const from = safeName(rec.folderSlug ?? "inherited");
+    const from = safeName(rec.folderSlug ?? "inherited", "inherited");
     await mkdir5(join12(out, "recipes", "_inherited", from), { recursive: true });
     const path = join12(
       out,
       "recipes",
       "_inherited",
       from,
-      safeName(rec.filename)
+      safeName(rec.filename, rec.id)
     );
-    await writeFile8(path, rec.body ?? "");
+    await writeFileSafe(path, rec.body ?? "");
     recipes.push({
       path,
       line: `${recipeLine(rec.filename, rec.body ?? "")}  [inherited from ${rec.folderName ?? from}]`
@@ -6440,14 +6445,14 @@ async function cmdPull(argv) {
   }
   const members = [];
   for (const v of payload.voses) {
-    const dir = join12(out, "members", safeName(v.slug || v.title || v.id));
+    const dir = join12(out, "members", safeName(v.slug || v.title, v.id));
     await mkdir5(dir, { recursive: true });
     const cfg = await apiJson(origin, `/api/vos/${v.id}/config`, { key });
     if (cfg.status !== 200) {
       lines.push(`skipped ${v.title}: ${apiError("fetch config", cfg)}`);
       continue;
     }
-    await writeFile8(
+    await writeFileSafe(
       join12(dir, "config.json"),
       JSON.stringify(cfg.body.config, null, 2)
     );
@@ -6459,7 +6464,7 @@ async function cmdPull(argv) {
         { key }
       );
       if (doc.status === 200) {
-        await writeFile8(
+        await writeFileSafe(
           join12(dir, "doc.json"),
           JSON.stringify(doc.body, null, 2)
         );
@@ -6991,7 +6996,7 @@ async function pushTakeClaimable(dir, flags, r) {
 
 // src/plugin/program.ts
 import { existsSync as existsSync13 } from "fs";
-import { mkdir as mkdir6, readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile11 } from "fs/promises";
 import { createInterface as createInterface2 } from "readline/promises";
 import { basename as basename3, dirname as dirname2, join as join14 } from "path";
 import {
@@ -7209,9 +7214,9 @@ async function cmdFetch(argv) {
   if (cfg.status !== 200)
     throw new Error(apiError(`fetch config for ${vosId}`, cfg));
   const slug = typeof vosMeta.slug === "string" && vosMeta.slug ? vosMeta.slug : vosId;
-  const out = strFlag(flags, "out") ?? slug;
+  const out = strFlag(flags, "out") ?? safePathName(slug, vosId);
   await mkdir6(out, { recursive: true });
-  await writeFile9(
+  await writeFileSafe(
     join14(out, "config.json"),
     JSON.stringify(cfg.body.config, null, 2)
   );
@@ -7237,12 +7242,18 @@ async function cmdFetch(argv) {
       const hosted = migrateHostedDoc3(doc.body);
       const { config: own } = await writeProgramDoc(out, hosted);
       if (own) {
-        await writeFile9(join14(out, "config.json"), JSON.stringify(own, null, 2));
+        await writeFileSafe(
+          join14(out, "config.json"),
+          JSON.stringify(own, null, 2)
+        );
       }
     } else if (doc.status === 200) {
       take = true;
       const hosted = migrateHostedDoc3(doc.body);
-      await writeFile9(join14(out, "doc.json"), JSON.stringify(hosted, null, 2));
+      await writeFileSafe(
+        join14(out, "doc.json"),
+        JSON.stringify(hosted, null, 2)
+      );
       if (flags.media === true) {
         const media = await pullMedia({ origin, key }, out, hosted, r.log);
         await recordHostedMedia(out, vosId, media);
@@ -7263,7 +7274,7 @@ async function cmdFetch(argv) {
     if (hostedCount && flags.media === true) {
       const pulled = await pullManifest({ origin, key }, out, written, r.log);
       if (pulled) {
-        await writeFile9(
+        await writeFileSafe(
           configPath,
           JSON.stringify({ ...written, assets: pulled.assets }, null, 2)
         );
@@ -7737,7 +7748,10 @@ async function cmdPullProgram(argv) {
   const configPath = join14(dir, "config.json");
   let backedUp = false;
   if (existsSync13(configPath)) {
-    await writeFile9(join14(dir, "config.backup.json"), await readFile11(configPath));
+    await writeFileSafe(
+      join14(dir, "config.backup.json"),
+      await readFile11(configPath)
+    );
     backedUp = true;
   }
   let headConfig = cfg.body.config;
@@ -7756,7 +7770,7 @@ async function cmdPullProgram(argv) {
       if (own) headConfig = own;
     }
   }
-  await writeFile9(configPath, JSON.stringify(headConfig, null, 2));
+  await writeFileSafe(configPath, JSON.stringify(headConfig, null, 2));
   writeSyncState(dir, {
     vosId,
     versionId: typeof head.id === "string" ? head.id : since
@@ -7898,13 +7912,16 @@ async function setProgramStill(dir, t) {
       );
     doc = parsed;
   }
-  await writeFile9(docPath, JSON.stringify({ ...doc, still: t }, null, 2) + "\n");
+  await writeFileSafe(
+    docPath,
+    JSON.stringify({ ...doc, still: t }, null, 2) + "\n"
+  );
 }
 async function writeProgramDoc(dir, hosted) {
   const program = hosted.program && typeof hosted.program === "object" ? hosted.program : {};
   const { config, ...rest } = program;
   const onDisk = { ...hosted, program: rest };
-  await writeFile9(join14(dir, "doc.json"), JSON.stringify(onDisk, null, 2));
+  await writeFileSafe(join14(dir, "doc.json"), JSON.stringify(onDisk, null, 2));
   return {
     config: config && typeof config === "object" ? config : null
   };
@@ -8013,6 +8030,130 @@ function nameFromUrl(url) {
   }
 }
 
+// src/plugin/netAddress.ts
+function privateHostReason(hostname2) {
+  const host = hostname2.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost"))
+    return "is this machine";
+  const v4 = parseIPv4(host);
+  if (v4) return privateIPv4Reason(v4);
+  const v6 = expandIPv6(host);
+  if (!v6) return null;
+  const carried = carriedIPv4(v6);
+  if (carried) return privateIPv4Reason(carried);
+  if (v6.every((w) => w === 0)) return "is an unspecified address";
+  if (v6.slice(0, 7).every((w) => w === 0) && v6[7] === 1)
+    return "is this machine";
+  if ((v6[0] & 65024) === 64512) return "is a private network address";
+  if ((v6[0] & 65472) === 65152) return "is a link-local address";
+  return null;
+}
+function privateIPv4Reason([a, b]) {
+  if (a === 0) return "is an unspecified address";
+  if (a === 127) return "is this machine";
+  if (a === 10) return "is a private network address";
+  if (a === 172 && b >= 16 && b <= 31) return "is a private network address";
+  if (a === 192 && b === 168) return "is a private network address";
+  if (a === 100 && b >= 64 && b <= 127) return "is a private network address";
+  if (a === 169 && b === 254) return "is a link-local address";
+  return null;
+}
+function parseIPv4(host) {
+  if (!/^[0-9a-fx.]+$/i.test(host)) return null;
+  const parts = host.split(".");
+  if (parts.length > 4 || parts.some((p) => p === "")) return null;
+  const nums = [];
+  for (const p of parts) {
+    let n;
+    if (/^0x[0-9a-f]+$/i.test(p)) n = parseInt(p.slice(2), 16);
+    else if (/^0[0-7]+$/.test(p)) n = parseInt(p, 8);
+    else if (/^[0-9]+$/.test(p)) n = parseInt(p, 10);
+    else return null;
+    nums.push(n);
+  }
+  const last = nums[nums.length - 1];
+  const lead = nums.slice(0, -1);
+  if (lead.some((n) => n > 255)) return null;
+  const fill = 4 - lead.length;
+  if (last >= 256 ** fill) return null;
+  const tail = [];
+  let rest = last;
+  for (let i = 0; i < fill; i++) {
+    tail.unshift(rest % 256);
+    rest = Math.floor(rest / 256);
+  }
+  return [...lead, ...tail];
+}
+function expandIPv6(host) {
+  if (!host.includes(":")) return null;
+  const zone = host.indexOf("%");
+  const addr = zone >= 0 ? host.slice(0, zone) : host;
+  if (!/^[0-9a-f:.]+$/i.test(addr)) return null;
+  const halves = addr.split("::");
+  if (halves.length > 2) return null;
+  const words2 = (part) => {
+    if (part === "") return [];
+    const out = [];
+    const groups = part.split(":");
+    for (let i = 0; i < groups.length; i++) {
+      const g = groups[i];
+      if (g.includes(".")) {
+        if (i !== groups.length - 1) return null;
+        const v4 = parseIPv4(g);
+        if (!v4) return null;
+        out.push(v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/i.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const head = words2(halves[0]);
+  const tail = halves.length === 2 ? words2(halves[1]) : [];
+  if (!head || !tail) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const gap = 8 - head.length - tail.length;
+  if (gap < 1) return null;
+  return [...head, ...new Array(gap).fill(0), ...tail];
+}
+function carriedIPv4(v6) {
+  const zeroLead = v6.slice(0, 5).every((w) => w === 0);
+  const mapped = zeroLead && v6[5] === 65535;
+  const compatible = zeroLead && v6[5] === 0 && (v6[6] !== 0 || v6[7] > 1);
+  const nat64 = v6[0] === 100 && v6[1] === 65435;
+  if (!mapped && !compatible && !nat64) return null;
+  return [v6[6] >> 8, v6[6] & 255, v6[7] >> 8, v6[7] & 255];
+}
+function fetchRefusal(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return `${url} is not a URL`;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:")
+    return `${url} is not an http(s) address, and the CLI fetches nothing else`;
+  const reason = privateHostReason(u.hostname);
+  if (reason)
+    return `${u.hostname} ${reason}, and the CLI fetches only from the public internet`;
+  return null;
+}
+var MAX_HOPS = 5;
+async function fetchPublic(url, init = {}, fetchImpl = fetch) {
+  let at2 = url;
+  for (let hop = 0; ; hop++) {
+    const refused = fetchRefusal(at2);
+    if (refused) throw new Error(refused);
+    const res = await fetchImpl(at2, { ...init, redirect: "manual" });
+    const location = res.headers.get("location");
+    if (res.status < 300 || res.status > 399 || !location) return res;
+    if (hop >= MAX_HOPS)
+      throw new Error(`${url} redirected more than ${MAX_HOPS} times`);
+    at2 = new URL(location, at2).href;
+  }
+}
+
 // src/plugin/asset.ts
 var BOOLEAN_FLAGS3 = /* @__PURE__ */ new Set(["json", "help"]);
 async function cmdRename(argv) {
@@ -8133,8 +8274,10 @@ async function cmdImport(argv) {
   const key = requireCredential(strFlag(flags, "key"));
   const folderRef = strFlag(flags, "folder");
   const folder = folderRef ? resolveFolder(await listFolders(origin, key), folderRef) : null;
+  const refused = fetchRefusal(url);
+  if (refused) throw new UsageError(`import: ${refused}`);
   r.log(`fetching ${url}`);
-  const res = await fetch(url, { redirect: "follow" });
+  const res = await fetchPublic(url);
   if (!res.ok)
     throw new Error(`import ${url}: the address answered ${res.status}`);
   const declared = Number(res.headers.get("content-length") ?? 0);
@@ -10608,7 +10751,7 @@ async function cmdRecipe(argv) {
 }
 
 // src/plugin/brand.ts
-import { writeFile as writeFile10 } from "fs/promises";
+import { writeFile as writeFile8 } from "fs/promises";
 import { resolve as resolve11 } from "path";
 import { parseFrontmatter as parseFrontmatter2 } from "@vosjs/shared/frontmatter";
 import { lookKindForGround } from "@vosjs/studio-core";
@@ -10907,7 +11050,7 @@ function renderBrandMd(c, claim) {
 }
 async function fetchText(url) {
   try {
-    const res = await fetch(url, { redirect: "follow" });
+    const res = await fetchPublic(url);
     if (!res.ok) return null;
     const type = res.headers.get("content-type") ?? "";
     if (/text\/html/i.test(type)) return null;
@@ -10927,6 +11070,8 @@ async function cmdBrand(argv) {
   } catch {
     throw new UsageError(`not a URL: ${raw}`);
   }
+  const refused = fetchRefusal(url);
+  if (refused) throw new UsageError(refused);
   const r = createReporter(flags.json === true);
   const out = resolve11(strFlag(flags, "out") ?? "BRAND.md");
   r.log(`reading ${origin}/design.md and /llms.txt\u2026`);
@@ -10962,7 +11107,7 @@ async function cmdBrand(argv) {
     composition,
     llms?.claim ?? design?.description ?? null
   );
-  await writeFile10(out, md);
+  await writeFile8(out, md);
   const k = composition.kit;
   r.done(
     {
@@ -10993,6 +11138,20 @@ function hostedEnv(actions, shell) {
   }
   return { env, missing };
 }
+function envNamesNotice(actions) {
+  const names = setupEnvNames2(actions.setup);
+  if (names.length === 0) return null;
+  return {
+    names,
+    line: `the setup reads ${names.length === 1 ? "this environment variable" : "these environment variables"} from this shell: ${names.join(", ")} (names only; a value is never printed or stored)`
+  };
+}
+function announceEnvNames(actions, r) {
+  const notice = envNamesNotice(actions);
+  if (!notice) return;
+  r.log(notice.line);
+  r.event({ event: "env", names: notice.names });
+}
 function isWallError(error) {
   return !!error && /^(\[\w+\] )?The page is behind a sign-in/.test(error);
 }
@@ -11076,8 +11235,11 @@ async function recordHosted(input) {
   };
 }
 
+// src/plugin/run.ts
+import { urlSchemeProblem } from "@vosjs/render-core/record";
+
 // src/plugin/agentBrowser.ts
-import { writeFile as writeFile11 } from "fs/promises";
+import { writeFile as writeFile9 } from "fs/promises";
 import { resolve as resolve12 } from "path";
 function parseAgentBrowserLog(text) {
   const records = [];
@@ -11575,7 +11737,7 @@ async function cmdActions(argv) {
     );
     return EXIT_ERROR;
   }
-  await writeFile11(out, `${JSON.stringify(result.actions, null, 2)}
+  await writeFile9(out, `${JSON.stringify(result.actions, null, 2)}
 `);
   r.done(
     { ok: true, out, url: result.actions.url ?? null, ...summary2(result) },
@@ -11610,7 +11772,43 @@ async function cmdActionsScript(input, flags) {
 import { existsSync as existsSync20 } from "fs";
 import { copyFile, mkdir as mkdir7, readFile as readFile12, stat as stat2 } from "fs/promises";
 import { basename as basename9, join as join22, resolve as resolve13 } from "path";
+
+// src/plugin/traceInflate.ts
 import { inflateRawSync } from "zlib";
+var TRACE_ENTRY_MAX_BYTES = 64 * 1024 * 1024;
+var TRACE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
+function traceBudget(caps = {}) {
+  return {
+    entry: caps.entry ?? TRACE_ENTRY_MAX_BYTES,
+    total: caps.total ?? TRACE_TOTAL_MAX_BYTES,
+    used: 0
+  };
+}
+var mib = (n) => `${(n / (1024 * 1024)).toFixed(n < 10 * 1024 * 1024 ? 1 : 0)} MiB`;
+function inflateEntry(raw, entry, budget) {
+  const room = Math.min(budget.entry, budget.total - budget.used);
+  const over = (bytes) => new Error(
+    `${entry.name} inflates to ${bytes}, past the ${mib(budget.entry)} an entry may take (${mib(budget.total)} for the whole trace); this is not a trace the recorder reads`
+  );
+  if (entry.size > room) throw over(mib(entry.size));
+  let out;
+  if (entry.method === 8) {
+    try {
+      out = new Uint8Array(inflateRawSync(raw, { maxOutputLength: room + 1 }));
+    } catch (e) {
+      if (e.code === "ERR_BUFFER_TOO_LARGE")
+        throw over(`more than ${mib(room)}`);
+      throw e;
+    }
+  } else {
+    out = raw;
+  }
+  if (out.length > room) throw over(mib(out.length));
+  budget.used += out.length;
+  return out;
+}
+
+// src/plugin/ingest.ts
 import {
   cursorFromPlaywrightTrace,
   cursorFromTrace,
@@ -11706,7 +11904,7 @@ async function readTraceFile(path, offsetMs) {
     }
     const raw = zipEntryBytes(bytes, entry);
     const text2 = new TextDecoder().decode(
-      entry.method === 8 ? new Uint8Array(inflateRawSync(raw)) : raw
+      inflateEntry(raw, entry, traceBudget())
     );
     return cursorFromPlaywrightTrace(text2, { offsetMs });
   }
@@ -12867,6 +13065,9 @@ async function cmdRecord(argv) {
   const url = strFlag(flags, "url") ?? actions.url;
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
+  const scheme = urlSchemeProblem(url);
+  if (scheme) throw new UsageError(scheme);
+  announceEnvNames(actions, r);
   const outDir = resolve14(strFlag(flags, "out") ?? "take");
   const storageState = takeStorageState(flags);
   const sessionName = takeSessionName(flags, storageState);
@@ -13112,6 +13313,9 @@ async function cmdCreate2(argv) {
   const url = strFlag(flags, "url") ?? actions.url;
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
+  const scheme = urlSchemeProblem(url);
+  if (scheme) throw new UsageError(scheme);
+  announceEnvNames(actions, r);
   const outDir = resolve14(strFlag(flags, "out") ?? "take");
   const format = videoFormat(strFlag(flags, "format"), positionals[0]);
   const out = positionals[0] ?? join25(outDir, `out.${format}`);
@@ -14475,4 +14679,4 @@ export {
   verbHelp,
   run
 };
-//# sourceMappingURL=chunk-OJ3ZCPYS.js.map
+//# sourceMappingURL=chunk-SB622PZM.js.map