bfi-cli 0.1.99 → 0.1.101

package/dist/_chunks/receipt.mjs

@@ -0,0 +1,166 @@
+import { checkPath, readConfig } from "./files.mjs";
+import { canonical, hash } from "./digest.mjs";
+import { randomUUID } from "node:crypto";
+import { constants, realpathSync } from "node:fs";
+import { dirname, join, parse, resolve } from "node:path";
+import { access, lstat, mkdir, open, readFile, readdir, rename, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+function pathKey(path) {
+	return resolve(path).normalize("NFC").toLowerCase();
+}
+function ownershipDigest(records) {
+	return hash(canonical([...records].sort((left, right) => left.id.localeCompare(right.id)).map((record) => ({
+		id: record.id,
+		state: record.state,
+		actions: record.actions
+	}))));
+}
+function stateRoot(home = homedir()) {
+	return join(realpathSync(home), ".bfi/installations");
+}
+function operationRoot(id, home) {
+	if (!/^[0-9a-f-]{36}$/.test(id)) throw new Error("无效的操作 ID。");
+	return join(stateRoot(home), id);
+}
+async function safeDirectory(path) {
+	let current = resolve(path);
+	while (current !== parse(current).root) {
+		try {
+			const stat = await lstat(current);
+			if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("目录含符号链接或非目录，拒绝安装。");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		current = dirname(current);
+	}
+}
+async function assertWritable(path, directory = false) {
+	if (directory) await safeDirectory(path);
+	else await checkPath(path);
+	let current = path;
+	while (true) try {
+		if (!((await lstat(current)).mode & 128)) throw new Error("安装目标只读。");
+		await access(current, constants.W_OK);
+		break;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		current = dirname(current);
+	}
+}
+async function atomicPrivate(path, data) {
+	await checkPath(path);
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	try {
+		const handle = await open(temporary, "wx", 384);
+		try {
+			await handle.writeFile(data);
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		await rename(temporary, path);
+		const parent = await open(dirname(path), "r");
+		try {
+			await parent.sync();
+		} finally {
+			await parent.close();
+		}
+	} finally {
+		await rm(temporary, { force: true });
+	}
+}
+async function checkpoint(receipt, home) {
+	await atomicPrivate(join(operationRoot(receipt.id, home), "receipt.json"), JSON.stringify(receipt));
+}
+async function readReceipt(id, home) {
+	const path = join(operationRoot(id, home), "receipt.json");
+	await checkPath(path);
+	const stat = await lstat(path);
+	if (stat.size > 32 * 1024 ** 2 || stat.mode & 63) throw new Error("安装回执大小或权限不安全。");
+	const receipt = JSON.parse(await readFile(path, "utf8"));
+	if (receipt.id !== id || !Array.isArray(receipt.actions)) throw new Error("安装回执无效。");
+	return receipt;
+}
+async function receipts(home) {
+	await safeDirectory(stateRoot(home));
+	let entries;
+	try {
+		entries = await readdir(stateRoot(home));
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	const result = [];
+	for (const entry of entries.filter((name) => /^[0-9a-f-]{36}$/.test(name))) try {
+		result.push(await readReceipt(entry, home));
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const replaced = new Set(result.filter((record) => record.state === "INSTALLED" || record.state === "REMOVED").map((record) => record.replaces));
+	return result.filter((record) => !replaced.has(record.id) && record.state !== "REMOVED");
+}
+async function fingerprint(path, kind) {
+	if (kind === "mcp") {
+		const text = await readConfig(path);
+		return text === void 0 ? void 0 : hash(text);
+	}
+	await safeDirectory(path);
+	try {
+		await lstat(path);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	const files = [];
+	let total = 0;
+	const walk = async (folder, prefix) => {
+		for (const entry of await readdir(folder, { withFileTypes: true })) {
+			const filename = join(folder, entry.name);
+			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+			const stat = await lstat(filename);
+			if (stat.isSymbolicLink() || stat.nlink > 1 && stat.isFile()) throw new Error("技能含链接，拒绝覆盖。");
+			if (stat.isDirectory()) await walk(filename, relative);
+			else if (stat.isFile()) {
+				total += stat.size;
+				if (total > 500 * 1024 ** 2 || stat.size > 50 * 1024 ** 2 || files.length >= 2e4) throw new Error("本地技能超过安全上限。");
+				files.push({
+					path: relative,
+					sha256: hash(await readFile(filename)),
+					executable: Boolean(stat.mode & 73)
+				});
+			} else throw new Error("技能含特殊文件。");
+		}
+	};
+	await walk(path, "");
+	return treeFingerprint(files);
+}
+function treeFingerprint(files) {
+	return hash(canonical([...files].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)));
+}
+async function withInstallationLock(work, home) {
+	const root = stateRoot(home);
+	await safeDirectory(root);
+	await mkdir(root, {
+		recursive: true,
+		mode: 448
+	});
+	const filename = join(root, "active.lock");
+	let handle;
+	try {
+		handle = await open(filename, "wx", 384);
+	} catch {
+		throw new Error("已有安装或残留执行锁：请确认没有 bfi 安装进程后移除 ~/.bfi/installations/active.lock，再用 --operation 恢复。");
+	}
+	try {
+		await handle.writeFile(String(process.pid));
+		return await work();
+	} finally {
+		await handle.close();
+		await rm(filename, { force: true });
+	}
+}
+export { assertWritable, atomicPrivate, checkpoint, fingerprint, operationRoot, ownershipDigest, pathKey, readReceipt, receipts, safeDirectory, treeFingerprint, withInstallationLock };

package/dist/_chunks/rolldown-runtime.mjs

@@ -25,7 +25,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));

package/dist/_chunks/skills.mjs

@@ -127,7 +127,8 @@ async function readSkillLock() {
 async function writeSkillLock(lock) {
 	const lockPath = getSkillLockPath();
 	await mkdir(dirname(lockPath), { recursive: true });
-	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
+	const content = JSON.stringify(lock, null, 2);
+	await writeFile(lockPath, content, "utf-8");
 }
 let _ghWarningShown = false;
 function getGitHubToken() {
@@ -220,7 +221,8 @@ async function writeLocalLock(lock, cwd) {
 		version: lock.version,
 		skills: sortedSkills
 	};
-	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
+	const content = JSON.stringify(sorted, null, 2) + "\n";
+	await writeFile(lockPath, content, "utf-8");
 }
 async function computeSkillFolderHash(skillDir) {
 	const files = [];
@@ -308,7 +310,8 @@ function shouldInstallInternalSkills() {
 }
 async function hasSkillMd(dir) {
 	try {
-		return (await stat(join(dir, "SKILL.md"))).isFile();
+		const skillPath = join(dir, "SKILL.md");
+		return (await stat(skillPath)).isFile();
 	} catch {
 		return false;
 	}

package/dist/cli.d.mts

@@ -1 +1 @@
-export { };
+export {}