@westbayberry/dg 2.1.0 → 2.3.0

package/dist/state/cooldown-held.js

@@ -0,0 +1,66 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonAtomic } from "../util/json-file.js";
+import { resolveDgPaths } from "./paths.js";
+export const HELD_PACKAGES_CAP = 500;
+export const UNKNOWN_ELIGIBILITY_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export function heldPackagesPath(env = process.env) {
+    return join(resolveDgPaths(env).stateDir, "cooldown-held.json");
+}
+function heldKey(entry) {
+    return `${entry.ecosystem}:${entry.name}@${entry.version}`;
+}
+function readDocument(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || parsed.schemaVersion !== 1 || !Array.isArray(parsed.entries)) {
+            return [];
+        }
+        return parsed.entries.filter((entry) => !!entry
+            && typeof entry.ecosystem === "string"
+            && typeof entry.name === "string"
+            && typeof entry.version === "string"
+            && typeof entry.requiredDays === "number"
+            && typeof entry.firstSeenAt === "string"
+            && typeof entry.lastSeenAt === "string");
+    }
+    catch {
+        return [];
+    }
+}
+function prune(entries, now) {
+    return entries.filter((entry) => {
+        const eligible = entry.eligibleAt ? Date.parse(entry.eligibleAt) : Number.NaN;
+        if (Number.isFinite(eligible)) {
+            return eligible > now.getTime();
+        }
+        const lastSeen = Date.parse(entry.lastSeenAt);
+        return Number.isFinite(lastSeen) && now.getTime() - lastSeen <= UNKNOWN_ELIGIBILITY_TTL_MS;
+    });
+}
+export function readHeldPackages(env = process.env, now = new Date()) {
+    return prune(readDocument(heldPackagesPath(env)), now);
+}
+export function recordHeldPackage(entry, env = process.env, now = new Date()) {
+    const path = heldPackagesPath(env);
+    const nowIso = now.toISOString();
+    const existing = prune(readDocument(path), now);
+    const key = heldKey(entry);
+    const previous = existing.find((candidate) => heldKey(candidate) === key);
+    const updated = {
+        ...entry,
+        firstSeenAt: previous?.firstSeenAt ?? nowIso,
+        lastSeenAt: nowIso
+    };
+    const merged = [...existing.filter((candidate) => heldKey(candidate) !== key), updated]
+        .sort((left, right) => right.lastSeenAt.localeCompare(left.lastSeenAt))
+        .slice(0, HELD_PACKAGES_CAP);
+    writeJsonAtomic(path, { schemaVersion: 1, entries: merged });
+}

package/dist/state/index.js

@@ -1,4 +1,5 @@
 export * from "./cleanup-registry.js";
+export * from "./cooldown-held.js";
 export * from "./locks.js";
 export * from "./paths.js";
 export * from "./sessions.js";

package/dist/state/locks.js

@@ -17,7 +17,8 @@ export class LockBusyError extends Error {
 export async function acquireLock(paths, name, options = {}) {
     assertLockName(name);
     await mkdir(paths.locksDir, {
-        recursive: true
+        recursive: true,
+        mode: 0o700
     });
     const path = join(paths.locksDir, `${name}.lock`);
     await removeStaleLock(path, options);
@@ -54,7 +55,8 @@ export async function acquireLock(paths, name, options = {}) {
 export function acquireLockSync(paths, name, options = {}) {
     assertLockName(name);
     mkdirSync(paths.locksDir, {
-        recursive: true
+        recursive: true,
+        mode: 0o700
     });
     const path = join(paths.locksDir, `${name}.lock`);
     removeStaleLockSync(path, options);

package/dist/state/store.js

@@ -26,7 +26,8 @@ export async function readJsonFile(path, fallback) {
 }
 export async function writeJsonFileAtomic(path, value) {
     await mkdir(dirname(path), {
-        recursive: true
+        recursive: true,
+        mode: 0o700
     });
     const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
     const payload = `${JSON.stringify(value, null, 2)}\n`;

package/dist/util/external-tool.js

@@ -0,0 +1,25 @@
+import { resolveRealBinary } from "../launcher/resolve-real-binary.js";
+import { resolveSpawnInvocation } from "../launcher/spawn-invocation.js";
+const toolPathCache = new Map();
+// Windows resolves bare command names against the child cwd before PATH,
+// and dg routinely runs with cwd inside untrusted trees; external tools
+// must always spawn from an absolute PATH-resolved location. Callers may
+// pass a minimal child env; resolution then falls back to the parent PATH.
+export function resolveToolPath(name, env = process.env) {
+    const searchEnv = env.PATH ? env : { ...env, PATH: process.env.PATH };
+    const key = `${name} ${searchEnv.PATH ?? ""}`;
+    const cached = toolPathCache.get(key);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const path = resolveRealBinary({ name, env: searchEnv }).path;
+    toolPathCache.set(key, path);
+    return path;
+}
+export function toolInvocation(name, args, env = process.env) {
+    const path = resolveToolPath(name, env);
+    if (!path) {
+        return null;
+    }
+    return resolveSpawnInvocation(path, args);
+}

package/dist/util/git.js

@@ -1,11 +1,18 @@
 import { spawnSync } from "node:child_process";
+import { toolInvocation } from "./external-tool.js";
 const DEFAULT_MAX_BUFFER = 256 * 1024 * 1024;
 export function gitSync(args, options) {
-    const result = spawnSync("git", [...args], {
+    const env = options.env ?? process.env;
+    const invocation = toolInvocation("git", args, env);
+    if (!invocation) {
+        return { ok: false, code: null, stdout: "", stderr: "git executable not found on PATH" };
+    }
+    const result = spawnSync(invocation.command, [...invocation.args], {
         cwd: options.cwd,
-        env: options.env ?? process.env,
+        env,
         encoding: "utf8",
-        maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER
+        maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER,
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments
     });
     return {
         ok: result.status === 0,

package/dist/util/report-writer.js

@@ -0,0 +1,57 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+export function writeReportAtomic(outputPath, contents) {
+    const directory = dirname(outputPath);
+    mkdirSync(directory, { recursive: true });
+    const temporaryPath = `${outputPath}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporaryPath, contents, { encoding: "utf8", flag: "wx" });
+        renameSync(temporaryPath, outputPath);
+    }
+    catch (error) {
+        rmSync(temporaryPath, { force: true });
+        throw error;
+    }
+}
+export function resolveExportPath(input, cwd) {
+    const trimmed = input.trim();
+    if (trimmed === "~" || trimmed.startsWith("~/")) {
+        return resolve(homedir(), trimmed.slice(2));
+    }
+    return resolve(cwd, trimmed);
+}
+function isDirectory(path) {
+    try {
+        return statSync(path, { throwIfNoEntry: false })?.isDirectory() ?? false;
+    }
+    catch {
+        return false;
+    }
+}
+export function userHomeDir(env = process.env) {
+    return env.HOME && isAbsolute(env.HOME) ? env.HOME : homedir();
+}
+export function exportDestinations(cwd, env = process.env) {
+    const home = userHomeDir(env);
+    const candidates = [{ label: "This folder", dir: cwd }];
+    for (const name of ["Downloads", "Desktop"]) {
+        const dir = join(home, name);
+        if (isDirectory(dir)) {
+            candidates.push({ label: name, dir });
+        }
+    }
+    candidates.push({ label: "Home", dir: home });
+    const seen = new Set();
+    const out = [];
+    for (const candidate of candidates) {
+        const key = resolve(candidate.dir);
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        out.push(candidate);
+    }
+    return out;
+}

package/dist/verify/local.js

@@ -8,6 +8,10 @@ const MAX_UNPACKED_BYTES = 250 * 1024 * 1024;
 const MAX_ARCHIVE_ENTRIES = 20000;
 const MAX_ARCHIVE_PATH_LENGTH = 240;
 const TAR_BLOCK_SIZE = 512;
+const GNU_LONGNAME_TYPE = 0x4c;
+const GNU_LONGLINK_TYPE = 0x4b;
+const PAX_EXTENDED_TYPE = 0x78;
+const PAX_GLOBAL_TYPE = 0x67;
 export function verifyLocalTarget(targetPath, cwd = process.cwd()) {
     const absoluteTarget = resolve(cwd, targetPath);
     if (!existsSync(absoluteTarget)) {
@@ -101,7 +105,7 @@ function scanTarball(bytes, path) {
     let tarBytes = bytes;
     if (path.endsWith(".tgz") || path.endsWith(".tar.gz")) {
         try {
-            tarBytes = gunzipSync(bytes);
+            tarBytes = gunzipSync(bytes, { maxOutputLength: MAX_UNPACKED_BYTES });
         }
         catch (error) {
             return archiveError(`could not decompress tarball: ${error instanceof Error ? error.message : "unknown gzip error"}`);
@@ -115,23 +119,73 @@ function scanTarball(bytes, path) {
     const entries = [];
     let offset = 0;
     let unpackedSizeBytes = 0;
+    let pendingLongName = null;
+    let pendingPax = null;
+    let globalPax = null;
     while (offset + TAR_BLOCK_SIZE <= tarBytes.length) {
         const header = tarBytes.subarray(offset, offset + TAR_BLOCK_SIZE);
         if (header.every((byte) => byte === 0)) {
             break;
         }
-        const name = tarEntryName(header);
+        const rawName = tarEntryName(header);
         const size = tarEntrySize(header);
+        if (size === null) {
+            errors.push("tar archive has an unparseable entry size");
+            break;
+        }
         const bodyOffset = offset + TAR_BLOCK_SIZE;
         const nextOffset = bodyOffset + Math.ceil(size / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
-        if (name.length === 0 || nextOffset > tarBytes.length) {
+        if (rawName.length === 0 || nextOffset > tarBytes.length) {
             errors.push("tar archive has a malformed entry header");
             break;
         }
+        const body = tarBytes.subarray(bodyOffset, bodyOffset + size);
+        const typeflag = header.readUInt8(156);
+        if (typeflag === GNU_LONGNAME_TYPE) {
+            pendingLongName = readNullTerminated(body, 0, body.length);
+            if (pendingLongName.length === 0) {
+                errors.push("tar archive has an empty long-name header");
+                break;
+            }
+            offset = nextOffset;
+            continue;
+        }
+        if (typeflag === GNU_LONGLINK_TYPE) {
+            offset = nextOffset;
+            continue;
+        }
+        if (typeflag === PAX_EXTENDED_TYPE || typeflag === PAX_GLOBAL_TYPE) {
+            const records = parsePaxRecords(body);
+            if (records === null) {
+                errors.push("tar archive has an unparseable PAX extended header");
+                break;
+            }
+            if (typeflag === PAX_EXTENDED_TYPE) {
+                pendingPax = mergePaxRecords(pendingPax, records);
+            }
+            else {
+                globalPax = mergePaxRecords(globalPax, records);
+            }
+            offset = nextOffset;
+            continue;
+        }
+        const paxPath = pendingPax?.get("path") ?? globalPax?.get("path") ?? null;
+        if (paxPath !== null && pendingLongName !== null && paxPath !== pendingLongName) {
+            errors.push("tar entry name metadata is contradictory");
+            break;
+        }
+        const paxSize = pendingPax?.get("size") ?? null;
+        if (paxSize !== null && Number.parseInt(paxSize, 10) !== size) {
+            errors.push("tar entry size metadata is contradictory");
+            break;
+        }
+        const name = paxPath ?? pendingLongName ?? rawName;
+        pendingLongName = null;
+        pendingPax = null;
         unpackedSizeBytes += size;
         entries.push({
             name,
-            body: tarBytes.subarray(bodyOffset, bodyOffset + size)
+            body
         });
         findings.push(...pathSafetyFindings(name));
         if (entries.length > MAX_ARCHIVE_ENTRIES) {
@@ -144,6 +198,9 @@ function scanTarball(bytes, path) {
         }
         offset = nextOffset;
     }
+    if (errors.length === 0 && (pendingLongName !== null || pendingPax !== null)) {
+        errors.push("tar archive ends with an unapplied extended header");
+    }
     findings.push(...packageManifestFindings(entries));
     return {
         findings,
@@ -155,56 +212,41 @@ function scanTarball(bytes, path) {
         }
     };
 }
+const ZIP_LOCAL_HEADER_SIG = 0x04034b50;
+const ZIP_CENTRAL_HEADER_SIG = 0x02014b50;
+const ZIP_EOCD_SIG = 0x06054b50;
+const ZIP_DATA_DESCRIPTOR_SIG = 0x08074b50;
+const ZIP_EOCD_MIN_BYTES = 22;
+const ZIP_EOCD_SEARCH_BYTES = ZIP_EOCD_MIN_BYTES + 0xffff;
 function scanZipLike(bytes, path) {
+    const central = readZipCentralDirectory(bytes);
+    if ("error" in central) {
+        return archiveError(`${basename(path)}: ${central.error}`);
+    }
+    const mismatch = zipLocalHeaderMismatch(bytes, central);
+    if (mismatch) {
+        return archiveError(`${basename(path)}: ${mismatch}`);
+    }
     const findings = [];
     const errors = [];
     const entries = [];
-    let offset = 0;
     let unpackedSizeBytes = 0;
-    while (offset + 30 <= bytes.length) {
-        const signature = bytes.readUInt32LE(offset);
-        if (signature !== 0x04034b50) {
-            break;
-        }
-        const flags = bytes.readUInt16LE(offset + 6);
-        const method = bytes.readUInt16LE(offset + 8);
-        const compressedSize = bytes.readUInt32LE(offset + 18);
-        const uncompressedSize = bytes.readUInt32LE(offset + 22);
-        const fileNameLength = bytes.readUInt16LE(offset + 26);
-        const extraLength = bytes.readUInt16LE(offset + 28);
-        const nameStart = offset + 30;
-        const dataStart = nameStart + fileNameLength + extraLength;
-        const dataEnd = dataStart + compressedSize;
-        if (dataEnd > bytes.length) {
-            errors.push(`${basename(path)} has a malformed zip entry`);
-            break;
-        }
-        const name = bytes.subarray(nameStart, nameStart + fileNameLength).toString("utf8");
-        findings.push(...pathSafetyFindings(name));
-        if ((flags & 0x1) !== 0) {
+    for (const entry of central.entries) {
+        findings.push(...pathSafetyFindings(entry.name));
+        if ((entry.flags & 0x1) !== 0) {
             findings.push({
                 id: "encrypted-archive-entry",
                 severity: "block",
                 title: "Encrypted archive entry",
                 message: "encrypted archive entries cannot be inspected locally",
-                location: name
+                location: entry.name
             });
         }
-        const body = readZipBody(bytes.subarray(dataStart, dataEnd), method, name, errors);
-        unpackedSizeBytes += uncompressedSize;
+        unpackedSizeBytes += entry.uncompressedSize;
         entries.push({
-            name,
-            body
+            name: entry.name,
+            body: readZipEntryBody(bytes, entry, errors)
         });
-        if ((flags & 0x8) !== 0) {
-            findings.push({
-                id: "zip-data-descriptor",
-                severity: "warn",
-                title: "Zip data descriptor",
-                message: "zip entry uses a data descriptor, so byte-size validation is conservative",
-                location: name
-            });
-        }
         if (entries.length > MAX_ARCHIVE_ENTRIES) {
             findings.push(limitFinding("archive has too many entries"));
             break;
@@ -213,7 +255,6 @@ function scanZipLike(bytes, path) {
             findings.push(limitFinding("archive expands beyond the local verification limit"));
             break;
         }
-        offset = dataEnd;
     }
     findings.push(...packageManifestFindings(entries));
     return {
@@ -226,13 +267,128 @@ function scanZipLike(bytes, path) {
         }
     };
 }
+function readZipCentralDirectory(bytes) {
+    const eocdOffset = findZipEndOfCentralDirectory(bytes);
+    if (eocdOffset === null) {
+        return { error: "zip end of central directory record not found" };
+    }
+    const entryCount = bytes.readUInt16LE(eocdOffset + 10);
+    const centralDirectorySize = bytes.readUInt32LE(eocdOffset + 12);
+    const centralDirectoryOffset = bytes.readUInt32LE(eocdOffset + 16);
+    if (entryCount === 0xffff || centralDirectorySize === 0xffffffff || centralDirectoryOffset === 0xffffffff) {
+        return { error: "zip64 archives are not supported by local verification" };
+    }
+    if (centralDirectoryOffset + centralDirectorySize > eocdOffset) {
+        return { error: "zip central directory extends past its end record" };
+    }
+    const entries = [];
+    let offset = centralDirectoryOffset;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (offset + 46 > eocdOffset || bytes.readUInt32LE(offset) !== ZIP_CENTRAL_HEADER_SIG) {
+            return { error: "zip central directory is truncated or malformed" };
+        }
+        const nameLength = bytes.readUInt16LE(offset + 28);
+        const extraLength = bytes.readUInt16LE(offset + 30);
+        const commentLength = bytes.readUInt16LE(offset + 32);
+        if (offset + 46 + nameLength + extraLength + commentLength > eocdOffset) {
+            return { error: "zip central directory is truncated or malformed" };
+        }
+        entries.push({
+            name: bytes.subarray(offset + 46, offset + 46 + nameLength).toString("utf8"),
+            flags: bytes.readUInt16LE(offset + 8),
+            method: bytes.readUInt16LE(offset + 10),
+            compressedSize: bytes.readUInt32LE(offset + 20),
+            uncompressedSize: bytes.readUInt32LE(offset + 24),
+            localHeaderOffset: bytes.readUInt32LE(offset + 42)
+        });
+        offset += 46 + nameLength + extraLength + commentLength;
+    }
+    if (offset !== centralDirectoryOffset + centralDirectorySize) {
+        return { error: "zip central directory size disagrees with its entries" };
+    }
+    return { entries, centralDirectoryOffset };
+}
+function findZipEndOfCentralDirectory(bytes) {
+    const searchStart = Math.max(0, bytes.length - ZIP_EOCD_SEARCH_BYTES);
+    for (let offset = bytes.length - ZIP_EOCD_MIN_BYTES; offset >= searchStart; offset -= 1) {
+        if (bytes.readUInt32LE(offset) === ZIP_EOCD_SIG) {
+            const commentLength = bytes.readUInt16LE(offset + 20);
+            if (offset + ZIP_EOCD_MIN_BYTES + commentLength === bytes.length) {
+                return offset;
+            }
+        }
+    }
+    return null;
+}
+function zipLocalHeaderMismatch(bytes, central) {
+    const { entries, centralDirectoryOffset } = central;
+    const claimed = new Map();
+    for (const entry of entries) {
+        if (claimed.has(entry.localHeaderOffset)) {
+            return "zip central directory lists overlapping local entries";
+        }
+        claimed.set(entry.localHeaderOffset, entry);
+    }
+    for (const entry of entries) {
+        const offset = entry.localHeaderOffset;
+        if (offset + 30 > centralDirectoryOffset || bytes.readUInt32LE(offset) !== ZIP_LOCAL_HEADER_SIG) {
+            return "zip central directory points at a missing local file header";
+        }
+        const flags = bytes.readUInt16LE(offset + 6);
+        const compressedSize = bytes.readUInt32LE(offset + 18);
+        const nameLength = bytes.readUInt16LE(offset + 26);
+        const name = bytes.subarray(offset + 30, offset + 30 + nameLength).toString("utf8");
+        if (name !== entry.name) {
+            return "zip local file header name disagrees with the central directory";
+        }
+        if ((flags & 0x8) === 0 && compressedSize !== entry.compressedSize) {
+            return "zip local file header size disagrees with the central directory";
+        }
+    }
+    let offset = bytes.length >= 4 && bytes.readUInt32LE(0) === ZIP_LOCAL_HEADER_SIG
+        ? 0
+        : entries.length > 0
+            ? Math.min(...entries.map((entry) => entry.localHeaderOffset))
+            : centralDirectoryOffset;
+    while (offset + 4 <= centralDirectoryOffset && bytes.readUInt32LE(offset) === ZIP_LOCAL_HEADER_SIG) {
+        const entry = claimed.get(offset);
+        if (!entry) {
+            return "zip has a local file entry the central directory does not list";
+        }
+        const nameLength = bytes.readUInt16LE(offset + 26);
+        const extraLength = bytes.readUInt16LE(offset + 28);
+        let next = offset + 30 + nameLength + extraLength + entry.compressedSize;
+        if ((entry.flags & 0x8) !== 0) {
+            next += next + 4 <= centralDirectoryOffset && bytes.readUInt32LE(next) === ZIP_DATA_DESCRIPTOR_SIG ? 16 : 12;
+        }
+        if (next > centralDirectoryOffset) {
+            return "zip local entry data extends into the central directory";
+        }
+        offset = next;
+    }
+    return null;
+}
+function readZipEntryBody(bytes, entry, errors) {
+    if ((entry.flags & 0x1) !== 0) {
+        return Buffer.alloc(0);
+    }
+    const headerOffset = entry.localHeaderOffset;
+    const nameLength = bytes.readUInt16LE(headerOffset + 26);
+    const extraLength = bytes.readUInt16LE(headerOffset + 28);
+    const dataStart = headerOffset + 30 + nameLength + extraLength;
+    if (dataStart + entry.compressedSize > bytes.length) {
+        errors.push(`${entry.name}: zip entry data is truncated`);
+        return Buffer.alloc(0);
+    }
+    return readZipBody(bytes.subarray(dataStart, dataStart + entry.compressedSize), entry.method, entry.name, errors);
+}
 function readZipBody(data, method, name, errors) {
     if (method === 0) {
         return data;
     }
     if (method === 8) {
         try {
-            return inflateRawSync(data);
+            return inflateRawSync(data, { maxOutputLength: MAX_UNPACKED_BYTES });
         }
         catch (error) {
             errors.push(`${name}: could not inflate zip entry: ${error instanceof Error ? error.message : "unknown inflate error"}`);
@@ -375,9 +531,51 @@ function tarEntryName(header) {
     return prefix.length > 0 ? `${prefix}/${name}` : name;
 }
 function tarEntrySize(header) {
+    if ((header.readUInt8(124) & 0x80) !== 0) {
+        return null;
+    }
     const value = readNullTerminated(header, 124, 12).trim();
-    const parsed = Number.parseInt(value || "0", 8);
-    return Number.isFinite(parsed) ? parsed : 0;
+    if (value.length === 0) {
+        return 0;
+    }
+    if (!/^[0-7]+$/u.test(value)) {
+        return null;
+    }
+    return Number.parseInt(value, 8);
+}
+function parsePaxRecords(body) {
+    const records = new Map();
+    let offset = 0;
+    while (offset < body.length) {
+        const space = body.indexOf(0x20, offset);
+        if (space === -1 || space === offset) {
+            return null;
+        }
+        const lengthText = body.subarray(offset, space).toString("ascii");
+        if (!/^\d+$/u.test(lengthText)) {
+            return null;
+        }
+        const length = Number.parseInt(lengthText, 10);
+        const recordEnd = offset + length;
+        if (length <= space - offset + 1 || recordEnd > body.length || body.readUInt8(recordEnd - 1) !== 0x0a) {
+            return null;
+        }
+        const text = body.subarray(space + 1, recordEnd - 1).toString("utf8");
+        const equals = text.indexOf("=");
+        if (equals <= 0) {
+            return null;
+        }
+        records.set(text.slice(0, equals), text.slice(equals + 1));
+        offset = recordEnd;
+    }
+    return records;
+}
+function mergePaxRecords(existing, incoming) {
+    const merged = new Map(existing ?? []);
+    for (const [key, value] of incoming) {
+        merged.set(key, value);
+    }
+    return merged;
 }
 function readNullTerminated(buffer, start, length) {
     const slice = buffer.subarray(start, start + length);