creepercli 1.0.0 → 1.1.0

package/src/client.js

@@ -1,127 +1,137 @@
-/*
- * Copyright 2026 DemonZDevelopment
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-'use strict';
-
-const net = require('net');
-const crypto = require('crypto');
-const { EventEmitter } = require('events');
-const { StringDecoder } = require('string_decoder');
-const { ProtocolError, ERR } = require('./protocol');
-
-class CreeperClient extends EventEmitter {
-  constructor({ host, port, timeoutMs = 300000 }) {
-    super();
-    this.host = host;
-    this.port = port;
-    this.timeoutMs = timeoutMs;
-    this.socket = null;
-    this.buffer = '';
-    this._decoder = new StringDecoder('utf8');
-    this.pending = new Map();
-  }
-
-  connect() {
-    return new Promise((resolve, reject) => {
-      const socket = net.connect({ host: this.host, port: this.port });
-      this.socket = socket;
-      socket.setNoDelay(true);
-      socket.on('connect', () => resolve());
-      socket.on('error', (err) => reject(err));
-      socket.on('close', () => this._onClose());
-      socket.on('data', (chunk) => this._onData(chunk));
-    });
-  }
+ 
+
+'use strict';
+
+const net = require('net');
+const crypto = require('crypto');
+const { EventEmitter } = require('events');
+const { StringDecoder } = require('string_decoder');
+const { ProtocolError, ERR, PROTOCOL_VERSION } = require('./protocol');
 
+const MAX_INCOMING_BUFFER_BYTES = 16 * 1024 * 1024;
+
+class CreeperClient extends EventEmitter {
+  constructor({ host, port, timeoutMs = 300000 }) {
+    super();
+    this.host = host;
+    this.port = port;
+    this.timeoutMs = timeoutMs;
+    this.socket = null;
+    this.buffer = '';
+    this._decoder = new StringDecoder('utf8');
+    this.pending = new Map();
+  }
+
+  connect() {
+    return new Promise((resolve, reject) => {
+      const socket = net.connect({ host: this.host, port: this.port });
+      this.socket = socket;
+      socket.setNoDelay(true);
+      socket.on('connect', () => resolve());
+      socket.on('error', (err) => reject(err));
+      socket.on('close', () => {
+        if (this.socket === socket) this.socket = null;
+        this._onClose();
+      });
+      socket.on('data', (chunk) => this._onData(chunk));
+    });
+  }
+
   _onData(chunk) {
     this.buffer += this._decoder.write(chunk);
-    let idx;
-    while ((idx = this.buffer.indexOf('\n')) !== -1) {
-      const line = this.buffer.slice(0, idx).trim();
-      this.buffer = this.buffer.slice(idx + 1);
-      if (!line) continue;
-      this._handleLine(line);
+    if (Buffer.byteLength(this.buffer, 'utf8') > MAX_INCOMING_BUFFER_BYTES) {
+      this._failAll(new ProtocolError(ERR.PAYLOAD_TOO_LARGE, 'Server frame exceeded client buffer limit'));
+      this.close();
+      return;
+    }
+    let idx;
+    while ((idx = this.buffer.indexOf('\n')) !== -1) {
+      const line = this.buffer.slice(0, idx).trim();
+      this.buffer = this.buffer.slice(idx + 1);
+      if (!line) continue;
+      this._handleLine(line);
     }
   }
-
-  _handleLine(line) {
-    let frame;
-    try {
-      frame = JSON.parse(line);
+
+  _handleLine(line) {
+    let frame;
+    try {
+      frame = JSON.parse(line);
     } catch {
       return;
     }
-    if (frame.type === 'response') {
+    if (frame.v !== PROTOCOL_VERSION) {
       const entry = this.pending.get(frame.id);
-      if (!entry) return;
-      this.pending.delete(frame.id);
-      clearTimeout(entry.timer);
-      if (frame.ok) {
-        entry.resolve(frame.data || {});
-      } else {
-        entry.reject(new ProtocolError(frame.error && frame.error.code, frame.error && frame.error.message));
+      if (entry) {
+        this.pending.delete(frame.id);
+        clearTimeout(entry.timer);
+        entry.reject(new ProtocolError(ERR.BAD_REQUEST,
+          `Unsupported protocol version ${frame.v} (expected ${PROTOCOL_VERSION})`));
       }
-    } else if (frame.type === 'event') {
-      this.emit('event', frame.event, frame.data || {});
-    }
-  }
-
-  async flush() {
-    while (this.pending.size > 0) {
-      await new Promise((r) => setTimeout(r, 25));
-    }
-  }
-
-  request(action, params = {}, { timeoutMs } = {}) {
-    if (!this.socket) {
-      return Promise.reject(new ProtocolError(ERR.INTERNAL, 'Connection closed'));
+      return;
     }
-    const id = crypto.randomUUID();
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        this.pending.delete(id);
-        reject(new ProtocolError(ERR.TIMEOUT, `Request timed out (${action})`));
-      }, timeoutMs || this.timeoutMs);
-      this.pending.set(id, { resolve, reject, timer });
-      const frame = JSON.stringify({ v: 1, type: 'request', id, action, params });
-      try {
-        this.socket.write(frame + '\n');
-      } catch (err) {
-        clearTimeout(timer);
-        this.pending.delete(id);
-        reject(new ProtocolError(ERR.INTERNAL, `Connection closed (${err.code || err.message})`));
-      }
-    });
+    if (frame.type === 'response') {
+      const entry = this.pending.get(frame.id);
+      if (!entry) return;
+      this.pending.delete(frame.id);
+      clearTimeout(entry.timer);
+      if (frame.ok) {
+        entry.resolve(frame.data || {});
+      } else {
+        entry.reject(new ProtocolError(frame.error && frame.error.code, frame.error && frame.error.message));
+      }
+    } else if (frame.type === 'event') {
+      this.emit('event', frame.event, frame.data || {});
+    }
+  }
+
+  async flush() {
+    while (this.pending.size > 0) {
+      await new Promise((r) => setTimeout(r, 25));
+    }
+  }
+
+  request(action, params = {}, { timeoutMs } = {}) {
+    if (!this.socket || this.socket.destroyed === true || this.socket.writable === false) {
+      return Promise.reject(new ProtocolError(ERR.INTERNAL, 'Connection closed'));
+    }
+    const id = crypto.randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new ProtocolError(ERR.TIMEOUT, `Request timed out (${action})`));
+      }, timeoutMs || this.timeoutMs);
+      this.pending.set(id, { resolve, reject, timer });
+      const frame = JSON.stringify({ v: PROTOCOL_VERSION, type: 'request', id, action, params });
+      try {
+        this.socket.write(frame + '\n');
+      } catch (err) {
+        clearTimeout(timer);
+        this.pending.delete(id);
+        reject(new ProtocolError(ERR.INTERNAL, `Connection closed (${err.code || err.message})`));
+      }
+    });
+  }
+
+  _onClose() {
+    this._failAll(new ProtocolError(ERR.INTERNAL, 'Connection closed by server'));
   }
 
-  _onClose() {
+  _failAll(error) {
     for (const { reject, timer } of this.pending.values()) {
       clearTimeout(timer);
-      reject(new ProtocolError(ERR.INTERNAL, 'Connection closed by server'));
+      reject(error);
     }
     this.pending.clear();
-  }
-
-  close() {
-    if (this.socket) {
-      this.socket.end();
-      this.socket.destroy();
-      this.socket = null;
-    }
-  }
-}
-
-module.exports = { CreeperClient };
+  }
+
+  close() {
+    if (this.socket) {
+      this.socket.end();
+      this.socket.destroy();
+      this.socket = null;
+    }
+  }
+}
+
+module.exports = { CreeperClient };

package/src/commands/auth.js

@@ -1,108 +1,94 @@
-/*
- * Copyright 2026 DemonZDevelopment
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-'use strict';
-
-const { question, readSecret } = require('../prompts');
-const session = require('../session');
-const config = require('../config');
-
-function saveCreds(cfg, res) {
-  session.save({
-    host: cfg.host,
-    port: cfg.port,
-    token: res.token,
-    username: res.username,
-    expiresAt: Date.now() + res.expiresInMinutes * 60000,
-  });
-  config.save({ host: cfg.host, port: cfg.port });
-}
-
-async function doLogin(ctx) {
-  const user = await question('Username: ');
-  const pass = await readSecret('Password: ');
-  let res;
-  try {
-    res = await ctx.client.request('auth.login', { username: user, password: pass }, { timeoutMs: 30000 });
-  } catch (err) {
-    if (err.code === 'E_TOTP_REQUIRED') {
-      const code = await question('TOTP code: ');
-      res = await ctx.client.request('auth.login', { username: user, password: pass, totp: code }, { timeoutMs: 30000 });
-    } else {
-      throw err;
-    }
-  }
-  saveCreds(ctx.cfg, res);
-  ctx.username = res.username;
-  ctx.cwd = '/';
-  console.log(`Authenticated as ${res.username}. Session valid for ${res.expiresInMinutes} minutes.`);
-  return res;
-}
-
-async function login(ctx) {
-  await doLogin(ctx);
-}
-
-async function logout(ctx) {
-  const creds = session.load(ctx.cfg.host, ctx.cfg.port);
-  await ctx.client.request('auth.logout', { token: creds ? creds.token : null }).catch(() => {});
-  session.clear();
-  ctx.username = null;
-  console.log('Logged out. Local credentials cleared.');
-}
-
-async function whoami(ctx) {
-  const res = await ctx.client.request('auth.whoami');
-  console.log(`User ${res.username} (IP ${res.ip}), cwd ${res.cwd}, session expires in ${Math.floor(res.expiresInSeconds / 60)}m${res.totpEnabled ? ', 2FA enabled' : ', 2FA disabled'}`);
-}
-
-async function ping(ctx) {
-  const res = await ctx.client.request('ping', {}, { timeoutMs: 15000 });
-  console.log(`pong (protocol v${res.protocol}, plugin v${res.pluginVersion}, server time ${new Date(res.serverTime).toISOString()})`);
-}
-
-async function passwd(ctx) {
-  const oldP = await readSecret('Current password: ');
-  const newP = await readSecret('New password: ');
-  if (newP.length < 8) throw new Error('New password must be at least 8 characters');
-  await ctx.client.request('auth.passwd', { oldPassword: oldP, newPassword: newP });
-  console.log('Password changed. Other sessions were invalidated.');
-}
-
-async function totp(ctx, args) {
-  const sub = args[0];
-  if (sub === 'setup') {
-    const pass = await readSecret('Password: ');
-    const res = await ctx.client.request('auth.totp.setup', { password: pass });
-    console.log('Scan the QR below with your authenticator app, or enter the secret manually:');
-    console.log(`Secret: ${res.secret}`);
-    console.log(`(setup expires in ${Math.floor((res.expiresInSeconds || 600) / 60)} minutes)`);
-    const qr = require('qrcode-terminal');
-    qr.generate(res.otpauthUrl, { small: true });
-    const code = await question('Enter the 6-digit code from your authenticator app: ');
-    await ctx.client.request('auth.totp.verify', { code });
-    console.log('TOTP enabled.');
-  } else if (sub === 'disable') {
-    const pass = await readSecret('Password: ');
-    const code = await question('TOTP code: ');
-    await ctx.client.request('auth.totp.disable', { password: pass, code });
-    console.log('TOTP disabled.');
-  } else {
-    throw new Error('Usage: totp <setup|disable>');
-  }
-}
-
-module.exports = { login, logout, whoami, ping, passwd, totp, doLogin };
+ 
+
+'use strict';
+
+const { question, readSecret } = require('../prompts');
+const session = require('../session');
+const config = require('../config');
+
+function saveCreds(cfg, res) {
+  session.save({
+    host: cfg.host,
+    port: cfg.port,
+    token: res.token,
+    username: res.username,
+    expiresAt: Date.now() + res.expiresInMinutes * 60000,
+  });
+  config.save({ host: cfg.host, port: cfg.port });
+}
+
+async function doLogin(ctx) {
+  const user = await question('Username: ');
+  const pass = await readSecret('Password: ');
+  let res;
+  try {
+    res = await ctx.client.request('auth.login', { username: user, password: pass }, { timeoutMs: 30000 });
+  } catch (err) {
+    if (err.code === 'E_TOTP_REQUIRED') {
+      const code = await question('TOTP code: ');
+      res = await ctx.client.request('auth.login', { username: user, password: pass, totp: code }, { timeoutMs: 30000 });
+    } else {
+      throw err;
+    }
+  }
+  saveCreds(ctx.cfg, res);
+  ctx.username = res.username;
+  ctx.cwd = '/';
+  console.log(`Authenticated as ${res.username}. Session valid for ${res.expiresInMinutes} minutes.`);
+  return res;
+}
+
+async function login(ctx) {
+  await doLogin(ctx);
+}
+
+async function logout(ctx) {
+  const creds = session.load(ctx.cfg.host, ctx.cfg.port);
+  await ctx.client.request('auth.logout', { token: creds ? creds.token : null }).catch(() => {});
+  session.clear();
+  ctx.username = null;
+  console.log('Logged out. Local credentials cleared.');
+}
+
+async function whoami(ctx) {
+  const res = await ctx.client.request('auth.whoami');
+  console.log(`User ${res.username} (IP ${res.ip}), cwd ${res.cwd}, session expires in ${Math.floor(res.expiresInSeconds / 60)}m${res.totpEnabled ? ', 2FA enabled' : ', 2FA disabled'}`);
+}
+
+async function ping(ctx) {
+  const res = await ctx.client.request('ping', {}, { timeoutMs: 15000 });
+  console.log(`pong (protocol v${res.protocol}, plugin v${res.pluginVersion}, server time ${new Date(res.serverTime).toISOString()})`);
+}
+
+async function passwd(ctx) {
+  const oldP = await readSecret('Current password: ');
+  const newP = await readSecret('New password: ');
+  if (newP.length < 8) throw new Error('New password must be at least 8 characters');
+  await ctx.client.request('auth.passwd', { oldPassword: oldP, newPassword: newP });
+  console.log('Password changed. Other sessions were invalidated.');
+}
+
+async function totp(ctx, args) {
+  const sub = args[0];
+  if (sub === 'setup') {
+    const pass = await readSecret('Password: ');
+    const res = await ctx.client.request('auth.totp.setup', { password: pass });
+    console.log('Scan the QR below with your authenticator app, or enter the secret manually:');
+    console.log(`Secret: ${res.secret}`);
+    console.log(`(setup expires in ${Math.floor((res.expiresInSeconds || 600) / 60)} minutes)`);
+    const qr = require('qrcode-terminal');
+    qr.generate(res.otpauthUrl, { small: true });
+    const code = await question('Enter the 6-digit code from your authenticator app: ');
+    await ctx.client.request('auth.totp.verify', { code });
+    console.log('TOTP enabled.');
+  } else if (sub === 'disable') {
+    const pass = await readSecret('Password: ');
+    const code = await question('TOTP code: ');
+    await ctx.client.request('auth.totp.disable', { password: pass, code });
+    console.log('TOTP disabled.');
+  } else {
+    throw new Error('Usage: totp <setup|disable>');
+  }
+}
+
+module.exports = { login, logout, whoami, ping, passwd, totp, doLogin };

package/src/commands/exec.js

@@ -1,37 +1,23 @@
-/*
- * Copyright 2026 DemonZDevelopment
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-'use strict';
-
-async function exec(ctx, args) {
-  if (!args.length) throw new Error('Usage: exec <minecraft command>');
-  const command = args.join(' ');
-  const res = await ctx.client.request('exec.run', { command }, { timeoutMs: 150000 });
-  if (res.lines && res.lines.length) console.log(res.lines.join('\n'));
-  if (!res.success) console.error('Command reported failure');
-  if (res.elapsedMs != null) console.error(`(completed in ${res.elapsedMs}ms)`);
-  return res.success ? 0 : 1;
-}
-
-function say(ctx, args) {
-  return exec(ctx, ['say', ...args]);
-}
-
-function restart(ctx, args) {
-  return exec(ctx, ['restart', ...args]);
-}
-
-module.exports = { exec, say, restart };
+ 
+
+'use strict';
+
+async function exec(ctx, args) {
+  if (!args.length) throw new Error('Usage: exec <minecraft command>');
+  const command = args.join(' ');
+  const res = await ctx.client.request('exec.run', { command }, { timeoutMs: 150000 });
+  if (res.lines && res.lines.length) console.log(res.lines.join('\n'));
+  if (!res.success) console.error('Command reported failure');
+  if (res.elapsedMs != null) console.error(`(completed in ${res.elapsedMs}ms)`);
+  return res.success ? 0 : 1;
+}
+
+function say(ctx, args) {
+  return exec(ctx, ['say', ...args]);
+}
+
+function restart(ctx, args) {
+  return exec(ctx, ['restart', ...args]);
+}
+
+module.exports = { exec, say, restart };