creepercli 1.0.0 → 1.1.0

package/src/session.js

@@ -1,58 +1,40 @@
-/*
- * Copyright 2026 DemonZDevelopment
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const DIR = path.join(os.homedir(), '.creepercli');
-const CREDS_FILE = path.join(DIR, 'creds');
-const HISTORY_FILE = path.join(DIR, 'history');
-
-function ensureDir() {
-  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
-}
-
-function save(creds) {
-  ensureDir();
-  fs.writeFileSync(CREDS_FILE, JSON.stringify(creds, null, 2), { mode: 0o600 });
-}
-
-function load(host, port) {
-  try {
-    const raw = fs.readFileSync(CREDS_FILE, 'utf8');
-    const creds = JSON.parse(raw);
-    if (creds.host !== host || creds.port !== port) return null;
-    if (creds.expiresAt && Date.now() > creds.expiresAt) {
-      clear();
-      return null;
-    }
+ 
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const DIR = path.join(os.homedir(), '.creepercli');
+const CREDS_FILE = path.join(DIR, 'creds');
+const HISTORY_FILE = path.join(DIR, 'history');
+
+function ensureDir() {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+}
+
+function save(creds) {
+  ensureDir();
+  fs.writeFileSync(CREDS_FILE, JSON.stringify(creds, null, 2), { mode: 0o600 });
+}
+
+function load(host, port) {
+  try {
+    const raw = fs.readFileSync(CREDS_FILE, 'utf8');
+    const creds = JSON.parse(raw);
+    if (creds.host !== host || creds.port !== port) return null;
     return creds;
-  } catch {
-    return null;
-  }
-}
-
-function clear() {
-  try {
-    fs.unlinkSync(CREDS_FILE);
-  } catch {
-  }
-}
-
-module.exports = { DIR, CREDS_FILE, HISTORY_FILE, save, load, clear };
+  } catch {
+    return null;
+  }
+}
+
+function clear() {
+  try {
+    fs.unlinkSync(CREDS_FILE);
+  } catch {
+  }
+}
+
+module.exports = { DIR, CREDS_FILE, HISTORY_FILE, save, load, clear };

package/src/top.js

@@ -1,53 +1,39 @@
-/*
- * Copyright 2026 DemonZDevelopment
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-'use strict';
-
-const readline = require('readline');
-const { formatStats, formatTps } = require('./formatters');
-
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-
-async function runTop(client, refreshMs) {
-  if (process.stdin.isTTY) {
-    readline.emitKeypressEvents(process.stdin);
-    process.stdin.setRawMode(true);
-  }
-  let stopped = false;
-  const onKey = (str, key) => {
-    if (key.name === 'q' || key.name === 'escape' || (key.ctrl && key.name === 'c')) stopped = true;
-  };
-  process.stdin.on('keypress', onKey);
-  try {
-    while (!stopped) {
-      const res = await client.request('monitor.top', {});
-      readline.cursorTo(process.stdout, 0, 0);
-      readline.clearScreenDown(process.stdout);
-      console.log('CreeperCLI top (q to quit)\n');
-      console.log(formatStats(res.stats));
-      console.log();
-      console.log(formatTps(res.tps));
-      await sleep(refreshMs);
-    }
-  } finally {
-    process.stdin.removeListener('keypress', onKey);
-    if (process.stdin.isTTY) process.stdin.setRawMode(false);
-  }
-}
-
-module.exports = { runTop };
+ 
+
+'use strict';
+
+const readline = require('readline');
+const { formatStats, formatTps } = require('./formatters');
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+async function runTop(client, refreshMs) {
+  if (process.stdin.isTTY) {
+    readline.emitKeypressEvents(process.stdin);
+    process.stdin.setRawMode(true);
+  }
+  let stopped = false;
+  const onKey = (str, key) => {
+    if (key.name === 'q' || key.name === 'escape' || (key.ctrl && key.name === 'c')) stopped = true;
+  };
+  process.stdin.on('keypress', onKey);
+  try {
+    while (!stopped) {
+      const res = await client.request('monitor.top', {});
+      readline.cursorTo(process.stdout, 0, 0);
+      readline.clearScreenDown(process.stdout);
+      console.log('CreeperCLI top (q to quit)\n');
+      console.log(formatStats(res.stats));
+      console.log();
+      console.log(formatTps(res.tps));
+      await sleep(refreshMs);
+    }
+  } finally {
+    process.stdin.removeListener('keypress', onKey);
+    if (process.stdin.isTTY) process.stdin.setRawMode(false);
+  }
+}
+
+module.exports = { runTop };

package/src/transfer.js

@@ -1,217 +1,292 @@
-/*
- * Copyright 2026 DemonZDevelopment
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
+ 
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
 const crypto = require('crypto');
 const { confirm } = require('./prompts');
 
-function sha256File(file) {
-  return new Promise((resolve, reject) => {
-    const hash = crypto.createHash('sha256');
-    const stream = fs.createReadStream(file);
-    stream.on('data', (d) => hash.update(d));
-    stream.on('end', () => resolve(hash.digest('hex')));
-    stream.on('error', reject);
-  });
-}
+const MAX_TRANSFER_CHUNK_BYTES = 1024 * 1024;
 
-function showProgress(transferred, total) {
-  if (!total) return;
-  const pct = Math.floor((transferred / total) * 100);
-  const kb = Math.floor(transferred / 1024);
-  const totalKb = Math.floor(total / 1024);
-  process.stdout.write(`\r${pct}% (${kb}KB / ${totalKb}KB)   `);
-}
-
-function clearProgress() {
-  process.stdout.write('\r'.padEnd(70) + '\r');
+function validateTransferStart(start, expectFileMetadata = false) {
+  if (!start || typeof start.transferId !== 'string' || !start.transferId) {
+    throw new Error('Server returned an invalid transfer id');
+  }
+  if (!Number.isInteger(start.chunkSize) || start.chunkSize < 1024
+      || start.chunkSize > MAX_TRANSFER_CHUNK_BYTES) {
+    throw new Error('Server returned an invalid transfer chunk size');
+  }
+  if (expectFileMetadata) {
+    if (!Number.isSafeInteger(start.size) || start.size < 0) {
+      throw new Error('Server returned an invalid file size');
+    }
+    if (typeof start.sha256 !== 'string' || !/^[0-9a-f]{64}$/i.test(start.sha256)) {
+      throw new Error('Server returned an invalid file checksum');
+    }
+  }
 }
-
+
+function sha256File(file) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(file);
+    stream.on('data', (d) => hash.update(d));
+    stream.on('end', () => resolve(hash.digest('hex')));
+    stream.on('error', reject);
+  });
+}
+
+function showProgress(transferred, total) {
+  if (!total) return;
+  const pct = Math.floor((transferred / total) * 100);
+  const kb = Math.floor(transferred / 1024);
+  const totalKb = Math.floor(total / 1024);
+  process.stdout.write(`\r${pct}% (${kb}KB / ${totalKb}KB)   `);
+}
+
+function clearProgress() {
+  process.stdout.write('\r'.padEnd(70) + '\r');
+}
+
 async function cpush(ctx, args) {
-  const rest = args.filter((a) => !a.startsWith('--'));
-  let [local, remote] = rest;
-  if (!local || !remote) throw new Error('Usage: cpush <local-file> <remote-path>');
-  remote = remote.replace(/\\/g, '/');
-  const stat = fs.statSync(local);
-  if (!stat.isFile()) throw new Error('Local path must be a file');
-  const sha = await sha256File(local);
+  const rest = args.filter((a) => !a.startsWith('--'));
+  let [local, remote] = rest;
+  if (!local || !remote) throw new Error('Usage: cpush <local-file> <remote-path>');
+  remote = remote.replace(/\\/g, '/');
+  const stat = fs.statSync(local);
+  if (!stat.isFile()) throw new Error('Local path must be a file');
+  const sha = await sha256File(local);
   const start = await ctx.client.request('xfer.push.start', {
-    path: remote,
-    size: stat.size,
-    sha256: sha,
+    path: remote,
+    size: stat.size,
+    sha256: sha,
     force: args.includes('--force'),
   }, { timeoutMs: 60000 });
   const { transferId, chunkSize } = start;
-  const fd = fs.openSync(local, 'r');
+  let fd = null;
   let transferred = 0;
   let index = 0;
   try {
+    validateTransferStart(start);
+    fd = fs.openSync(local, 'r');
     const buf = Buffer.alloc(chunkSize);
-    while (true) {
-      const n = fs.readSync(fd, buf, 0, chunkSize, transferred);
-      if (n === 0) break;
-      await ctx.client.request('xfer.push.chunk', {
-        transferId,
-        index,
-        data: buf.subarray(0, n).toString('base64'),
-      }, { timeoutMs: 120000 });
-      transferred += n;
-      index++;
+    while (true) {
+      const n = fs.readSync(fd, buf, 0, chunkSize, transferred);
+      if (n === 0) break;
+      await ctx.client.request('xfer.push.chunk', {
+        transferId,
+        index,
+        data: buf.subarray(0, n).toString('base64'),
+      }, { timeoutMs: 120000 });
+      transferred += n;
+      index++;
       showProgress(transferred, stat.size);
     }
+    const finish = await ctx.client.request('xfer.push.finish', { transferId, sha256: sha });
+    if (!finish || typeof finish.sha256 !== 'string' || finish.sha256.toLowerCase() !== sha) {
+      throw new Error('Server reported an unexpected upload checksum');
+    }
+    clearProgress();
+    console.log(`Pushed ${local} -> ${finish.target} (${finish.size} bytes, sha256 ${finish.sha256})`);
+  } catch (err) {
+    await ctx.client.request('xfer.abort', { transferId }).catch(() => {});
+    clearProgress();
+    throw err;
   } finally {
-    fs.closeSync(fd);
+    if (fd !== null) fs.closeSync(fd);
   }
-  clearProgress();
-  const finish = await ctx.client.request('xfer.push.finish', { transferId, sha256: sha });
-  console.log(`Pushed ${local} -> ${finish.target} (${finish.size} bytes, sha256 ${finish.sha256})`);
 }
-
-async function cpull(ctx, args) {
-  let [remote, local] = args.filter((a) => !a.startsWith('--'));
-  if (!remote || !local) throw new Error('Usage: cpull <remote-path> <local-file>');
+
+async function cpull(ctx, args) {
+  let [remote, local] = args.filter((a) => !a.startsWith('--'));
+  if (!remote || !local) throw new Error('Usage: cpull <remote-path> <local-file>');
   remote = remote.replace(/\\/g, '/');
   const start = await ctx.client.request('xfer.pull.start', { path: remote });
   const { transferId, size, sha256: expectedSha, chunkSize } = start;
-  const part = local + '.creepercli-part';
+  const part = `${local}.creepercli-part-${process.pid}-${Date.now()}`;
   const hash = crypto.createHash('sha256');
-  const fd = fs.openSync(part, 'w');
+  let fd = null;
   let transferred = 0;
   let index = 0;
   try {
+    validateTransferStart(start, true);
+    const parent = path.dirname(path.resolve(local));
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    fd = fs.openSync(part, 'w');
     while (true) {
-      const res = await ctx.client.request('xfer.pull.chunk', { transferId, index }, { timeoutMs: 120000 });
+      const res = await ctx.client.request('xfer.pull.chunk', { transferId, index }, { timeoutMs: 120000 });
       const data = Buffer.from(res.data || '', 'base64');
       if (data.length === 0) break;
-      fs.writeSync(fd, data, 0, data.length);
-      hash.update(data);
-      transferred += data.length;
+      if (data.length > chunkSize || transferred + data.length > size) {
+        throw new Error('Server sent an invalid transfer chunk');
+      }
+      fs.writeSync(fd, data, 0, data.length);
+      hash.update(data);
+      transferred += data.length;
       index++;
       showProgress(transferred, size);
     }
-  } finally {
     fs.closeSync(fd);
+    fd = null;
+    if (transferred !== size) {
+      throw new Error(`Transfer ended early: expected ${size} bytes, received ${transferred}`);
+    }
+    const actual = await ctx.client.request('xfer.pull.finish', { transferId, sha256: hash.digest('hex') });
+    clearProgress();
+    if (!actual || typeof actual.sha256 !== 'string'
+        || actual.sha256.toLowerCase() !== expectedSha.toLowerCase()) {
+      throw new Error('Checksum mismatch: transfer aborted');
+    }
+    replaceFile(part, local);
+    console.log(`Pulled ${remote} -> ${local} (${transferred} bytes, sha256 ${actual.sha256})`);
+  } catch (err) {
+    if (fd !== null) {
+      fs.closeSync(fd);
+      fd = null;
+    }
+    await ctx.client.request('xfer.abort', { transferId }).catch(() => {});
+    try { fs.unlinkSync(part); } catch {}
+    clearProgress();
+    throw err;
+  } finally {
+    if (fd !== null) fs.closeSync(fd);
   }
-  const actual = await ctx.client.request('xfer.pull.finish', { transferId, sha256: hash.digest('hex') });
-  clearProgress();
-  if (actual.sha256 !== expectedSha) {
-    fs.unlinkSync(part);
-    throw new Error('Checksum mismatch: partial file removed, transfer aborted');
-  }
-  fs.renameSync(part, local);
-  console.log(`Pulled ${remote} -> ${local} (${transferred} bytes, sha256 ${actual.sha256})`);
 }
-
-async function csync(ctx, args) {
-  let [remoteDir, localDir] = args.filter((a) => a !== '-y' && !a.startsWith('--'));
-  if (!remoteDir || !localDir) throw new Error('Usage: csync <remote-dir> <local-dir> [--yes]');
-  remoteDir = remoteDir.replace(/\\/g, '/');
+
+async function csync(ctx, args) {
+  let [remoteDir, localDir] = args.filter((a) => a !== '-y' && !a.startsWith('--'));
+  if (!remoteDir || !localDir) throw new Error('Usage: csync <remote-dir> <local-dir> [--yes]');
+  remoteDir = remoteDir.replace(/\\/g, '/');
   const yes = args.includes('--yes') || args.includes('-y') || !!(ctx.flags && ctx.flags.yes);
   await ctx.client.request('fs.mkdir', { path: remoteDir, parents: true }).catch(() => {});
 
+  const remoteInfo = await ctx.client.request('fs.info', { path: remoteDir });
+  if (!remoteInfo.isDir || typeof remoteInfo.path !== 'string' || !remoteInfo.path.startsWith('/')) {
+    throw new Error('Server returned an invalid sync directory');
+  }
+  remoteDir = remoteInfo.path;
+
   const remote = await ctx.client.request('xfer.list', { path: remoteDir }, { timeoutMs: 600000 });
   const remoteMap = new Map();
   for (const e of remote.entries) {
-    if (!e.isDir) remoteMap.set(e.path.replace(/^\//, ''), e);
-  }
-  if (remote.truncated) console.error('(remote listing truncated)');
-
-  const localMap = walkLocal(localDir);
-
-  const toDownload = [];
-  const toUpload = [];
-  for (const [rel, e] of remoteMap) {
-    const local = localMap.get(rel);
-    if (!local) {
-      toDownload.push(rel);
-      continue;
+    if (!e.isDir) {
+      const rel = relativeRemotePath(remoteDir, e.path);
+      if (rel) remoteMap.set(rel, e);
     }
-    if (local.size === e.size && local.mtime === e.mtime) continue;
-    if (local.size === e.size) {
-      let localSha;
-      try {
-        localSha = await sha256File(path.join(localDir, rel));
-      } catch {
-        toUpload.push(rel);
-        continue;
-      }
-      if (localSha === e.sha256) continue;
-    }
-    if (e.mtime > local.mtime) toDownload.push(rel);
-    else toUpload.push(rel);
-  }
-  for (const rel of localMap.keys()) {
-    if (!remoteMap.has(rel)) toUpload.push(rel);
+  }
+  if (remote.truncated) console.error('(remote listing truncated)');
+
+  const localMap = walkLocal(localDir);
+
+  const toDownload = [];
+  const toUpload = [];
+  for (const [rel, e] of remoteMap) {
+    const local = localMap.get(rel);
+    if (!local) {
+      toDownload.push(rel);
+      continue;
+    }
+    if (local.size === e.size && local.mtime === e.mtime) continue;
+    if (local.size === e.size) {
+      let localSha;
+      try {
+        localSha = await sha256File(path.join(localDir, rel));
+      } catch {
+        toUpload.push(rel);
+        continue;
+      }
+      if (localSha === e.sha256) continue;
+    }
+    if (e.mtime > local.mtime) toDownload.push(rel);
+    else toUpload.push(rel);
+  }
+  for (const rel of localMap.keys()) {
+    if (!remoteMap.has(rel)) toUpload.push(rel);
+  }
+
+  if (!toDownload.length && !toUpload.length) {
+    console.log('Directories are in sync.');
+    return;
+  }
+  console.log(`Download: ${toDownload.length} file(s), Upload: ${toUpload.length} file(s)`);
+  if (!yes && toUpload.length) {
+    const ok = await confirm(`Upload ${toUpload.length} local file(s)?`, false);
+    if (!ok) toUpload.length = 0;
+  }
+  if (!yes && toDownload.length) {
+    const ok = await confirm(`Download ${toDownload.length} remote file(s)?`, false);
+    if (!ok) toDownload.length = 0;
+  }
+  for (const rel of toDownload) {
+    await cpull(ctx, [joinRemote(remoteDir, rel), path.join(localDir, rel)]);
+  }
+  for (const rel of toUpload) {
+    await cpush(ctx, [path.join(localDir, rel), joinRemote(remoteDir, rel)]);
+  }
+  console.log('Sync complete.');
+}
+
+function joinRemote(base, rel) {
+  const cleanBase = base.replace(/\\/g, '/');
+  const cleanRel = rel.replace(/\\/g, '/');
+  return (cleanBase.endsWith('/') ? cleanBase : cleanBase + '/') + cleanRel;
+}
+
+function relativeRemotePath(base, absolutePath) {
+  const cleanBase = ('/' + base.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '')).replace(/^\/$/, '');
+  const cleanPath = '/' + absolutePath.replace(/\\/g, '/').replace(/^\/+/, '');
+  if (!cleanBase) return cleanPath.replace(/^\//, '');
+  if (cleanPath === cleanBase) return '';
+  if (!cleanPath.startsWith(cleanBase + '/')) {
+    throw new Error(`Server returned path outside sync root: ${absolutePath}`);
   }
+  return cleanPath.slice(cleanBase.length + 1);
+}
 
-  if (!toDownload.length && !toUpload.length) {
-    console.log('Directories are in sync.');
+function replaceFile(part, destination) {
+  if (!fs.existsSync(destination)) {
+    fs.renameSync(part, destination);
     return;
   }
-  console.log(`Download: ${toDownload.length} file(s), Upload: ${toUpload.length} file(s)`);
-  if (!yes && toUpload.length) {
-    const ok = await confirm(`Upload ${toUpload.length} local file(s)?`, false);
-    if (!ok) toUpload.length = 0;
-  }
-  if (!yes && toDownload.length) {
-    const ok = await confirm(`Download ${toDownload.length} remote file(s)?`, false);
-    if (!ok) toDownload.length = 0;
-  }
-  for (const rel of toDownload) {
-    await cpull(ctx, [joinRemote(remoteDir, rel), path.join(localDir, rel)]);
-  }
-  for (const rel of toUpload) {
-    await cpush(ctx, [path.join(localDir, rel), joinRemote(remoteDir, rel)]);
+  const backup = `${destination}.creepercli-backup-${process.pid}-${Date.now()}`;
+  fs.renameSync(destination, backup);
+  try {
+    fs.renameSync(part, destination);
+  } catch (err) {
+    try { fs.renameSync(backup, destination); } catch {}
+    throw err;
   }
-  console.log('Sync complete.');
-}
-
-function joinRemote(base, rel) {
-  const cleanBase = base.replace(/\\/g, '/');
-  const cleanRel = rel.replace(/\\/g, '/');
-  return (cleanBase.endsWith('/') ? cleanBase : cleanBase + '/') + cleanRel;
+  try { fs.rmSync(backup, { force: true }); } catch {}
 }
-
-function walkLocal(dir) {
-  const map = new Map();
-  function walk(d, prefix) {
-    let names;
-    try {
-      names = fs.readdirSync(d);
-    } catch {
-      return;
-    }
-    for (const name of names) {
-      const p = path.join(d, name);
-      let st;
-      try {
-        st = fs.statSync(p);
-      } catch {
-        continue;
-      }
-      const rel = ((prefix ? prefix + '/' : '') + name).replace(/\\/g, '/');
+
+function walkLocal(dir) {
+  const map = new Map();
+  function walk(d, prefix) {
+    let names;
+    try {
+      names = fs.readdirSync(d);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const p = path.join(d, name);
+      let st;
+      try {
+        st = fs.lstatSync(p);
+      } catch {
+        continue;
+      }
+      const rel = ((prefix ? prefix + '/' : '') + name).replace(/\\/g, '/');
+      if (st.isSymbolicLink()) continue;
       if (st.isDirectory()) walk(p, rel);
-      else if (st.isFile()) map.set(rel, { size: st.size, mtime: Math.floor(st.mtimeMs) });
-    }
-  }
-  walk(dir, '');
-  return map;
-}
-
-module.exports = { cpush, cpull, csync, joinRemote, walkLocal };
+      else if (st.isFile()) map.set(rel, { size: st.size, mtime: Math.floor(st.mtimeMs) });
+    }
+  }
+  walk(dir, '');
+  return map;
+}
+
+module.exports = {
+  cpush, cpull, csync, joinRemote, relativeRemotePath, replaceFile, walkLocal, validateTransferStart,
+};