creepercli 1.1.0 → 1.1.1

package/README.md

@@ -1,12 +1,12 @@
 # CreeperCLI
 
-> Remote administration CLI for Paper/Spigot servers and BungeeCord/Waterfall or Velocity proxies.
+> Remote administration CLI for Paper/Spigot servers and BungeeCord/Waterfall or Velocity proxies.
 
 [![npm version](https://img.shields.io/npm/v/creepercli.svg)](https://www.npmjs.com/package/creepercli)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![Discord](https://img.shields.io/badge/chat-Discord-5865F2.svg)](https://discord.com/invite/zCkE44hsBR)
 
-`creepercli` is the client half of CreeperCLI. It talks to the CreeperCLI server/proxy plugin over a TCP socket and gives you a remote shell: sandboxed filesystem access, console commands through an allowlist, live logs, verified transfers, and monitoring.
+`creepercli` is the client half of CreeperCLI. It talks to the CreeperCLI server/proxy plugin over a TCP socket and gives you a remote shell: sandboxed filesystem access, console commands through an allowlist, live logs, verified transfers, and monitoring.
 
 The plugin is required. Install it on the server, then create a user from the server console:
 
@@ -70,7 +70,7 @@ One-shot mode works for scripts: `creepercli ls /plugins`, `creepercli exec list
 - The server-side sandbox blocks `..`, symlink, and absolute-path escapes.
 - Passwords are bcrypt-hashed (cost 12). Sessions expire after 15 idle minutes and bind to your IP.
 - Only allowlisted console commands run (`list`, `say *`, `whitelist *`, `restart` by default).
-- The plugin binds `127.0.0.1` by default. Connect through an SSH tunnel, VPN, or private network; do not expose the plaintext port directly to the internet.
+- The plugin binds `127.0.0.1` by default. Connect through an SSH tunnel, VPN, or private network; do not expose the plaintext port directly to the internet.
 
 The full threat model lives in the docs: [demonz-development.github.io/creepercli](https://demonz-development.github.io/creepercli/).
 
@@ -82,4 +82,4 @@ The full threat model lives in the docs: [demonz-development.github.io/creepercl
 
 ## License
 
-Apache License 2.0. See [LICENSE](LICENSE).
+Apache License 2.0. See [LICENSE](LICENSE).

package/bin/creepercli.js

@@ -1,15 +1,14 @@
-
- 
-
+#!/usr/bin/env node
+
 'use strict';
 
 const { main } = require('../src/index');
 
 main(process.argv.slice(2)).then((code) => {
   if (typeof code === 'number') process.exitCode = code;
-}).catch((err) => {
-  if (!err || !err.creepercliReported) {
-    console.error(err && err.message ? err.message : String(err));
-  }
-  process.exitCode = 1;
-});
+}).catch((err) => {
+  if (!err || !err.creepercliReported) {
+    console.error(err && err.message ? err.message : String(err));
+  }
+  process.exitCode = 1;
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "creepercli",
-  "version": "1.1.0",
-  "description": "Remote administration CLI for Minecraft servers and proxies running CreeperCLI",
+  "version": "1.1.1",
+  "description": "Remote administration CLI for Minecraft servers and proxies running CreeperCLI",
   "author": "DemonZDevelopment",
   "license": "Apache-2.0",
   "type": "commonjs",

package/src/client.js

@@ -6,9 +6,9 @@ const net = require('net');
 const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const { StringDecoder } = require('string_decoder');
-const { ProtocolError, ERR, PROTOCOL_VERSION } = require('./protocol');
-
-const MAX_INCOMING_BUFFER_BYTES = 16 * 1024 * 1024;
+const { ProtocolError, ERR, PROTOCOL_VERSION } = require('./protocol');
+
+const MAX_INCOMING_BUFFER_BYTES = 16 * 1024 * 1024;
 
 class CreeperClient extends EventEmitter {
   constructor({ host, port, timeoutMs = 300000 }) {
@@ -29,47 +29,47 @@ class CreeperClient extends EventEmitter {
       socket.setNoDelay(true);
       socket.on('connect', () => resolve());
       socket.on('error', (err) => reject(err));
-      socket.on('close', () => {
-        if (this.socket === socket) this.socket = null;
-        this._onClose();
-      });
+      socket.on('close', () => {
+        if (this.socket === socket) this.socket = null;
+        this._onClose();
+      });
       socket.on('data', (chunk) => this._onData(chunk));
     });
   }
 
-  _onData(chunk) {
-    this.buffer += this._decoder.write(chunk);
-    if (Buffer.byteLength(this.buffer, 'utf8') > MAX_INCOMING_BUFFER_BYTES) {
-      this._failAll(new ProtocolError(ERR.PAYLOAD_TOO_LARGE, 'Server frame exceeded client buffer limit'));
-      this.close();
-      return;
-    }
+  _onData(chunk) {
+    this.buffer += this._decoder.write(chunk);
+    if (Buffer.byteLength(this.buffer, 'utf8') > MAX_INCOMING_BUFFER_BYTES) {
+      this._failAll(new ProtocolError(ERR.PAYLOAD_TOO_LARGE, 'Server frame exceeded client buffer limit'));
+      this.close();
+      return;
+    }
     let idx;
     while ((idx = this.buffer.indexOf('\n')) !== -1) {
       const line = this.buffer.slice(0, idx).trim();
       this.buffer = this.buffer.slice(idx + 1);
       if (!line) continue;
       this._handleLine(line);
-    }
-  }
+    }
+  }
 
   _handleLine(line) {
     let frame;
     try {
       frame = JSON.parse(line);
-    } catch {
-      return;
-    }
-    if (frame.v !== PROTOCOL_VERSION) {
-      const entry = this.pending.get(frame.id);
-      if (entry) {
-        this.pending.delete(frame.id);
-        clearTimeout(entry.timer);
-        entry.reject(new ProtocolError(ERR.BAD_REQUEST,
-          `Unsupported protocol version ${frame.v} (expected ${PROTOCOL_VERSION})`));
-      }
-      return;
-    }
+    } catch {
+      return;
+    }
+    if (frame.v !== PROTOCOL_VERSION) {
+      const entry = this.pending.get(frame.id);
+      if (entry) {
+        this.pending.delete(frame.id);
+        clearTimeout(entry.timer);
+        entry.reject(new ProtocolError(ERR.BAD_REQUEST,
+          `Unsupported protocol version ${frame.v} (expected ${PROTOCOL_VERSION})`));
+      }
+      return;
+    }
     if (frame.type === 'response') {
       const entry = this.pending.get(frame.id);
       if (!entry) return;
@@ -92,7 +92,7 @@ class CreeperClient extends EventEmitter {
   }
 
   request(action, params = {}, { timeoutMs } = {}) {
-    if (!this.socket || this.socket.destroyed === true || this.socket.writable === false) {
+    if (!this.socket || this.socket.destroyed === true || this.socket.writable === false) {
       return Promise.reject(new ProtocolError(ERR.INTERNAL, 'Connection closed'));
     }
     const id = crypto.randomUUID();
@@ -102,7 +102,7 @@ class CreeperClient extends EventEmitter {
         reject(new ProtocolError(ERR.TIMEOUT, `Request timed out (${action})`));
       }, timeoutMs || this.timeoutMs);
       this.pending.set(id, { resolve, reject, timer });
-      const frame = JSON.stringify({ v: PROTOCOL_VERSION, type: 'request', id, action, params });
+      const frame = JSON.stringify({ v: PROTOCOL_VERSION, type: 'request', id, action, params });
       try {
         this.socket.write(frame + '\n');
       } catch (err) {
@@ -113,16 +113,16 @@ class CreeperClient extends EventEmitter {
     });
   }
 
-  _onClose() {
-    this._failAll(new ProtocolError(ERR.INTERNAL, 'Connection closed by server'));
-  }
-
-  _failAll(error) {
-    for (const { reject, timer } of this.pending.values()) {
-      clearTimeout(timer);
-      reject(error);
-    }
-    this.pending.clear();
+  _onClose() {
+    this._failAll(new ProtocolError(ERR.INTERNAL, 'Connection closed by server'));
+  }
+
+  _failAll(error) {
+    for (const { reject, timer } of this.pending.values()) {
+      clearTimeout(timer);
+      reject(error);
+    }
+    this.pending.clear();
   }
 
   close() {

package/src/commands/index.js

@@ -54,21 +54,21 @@ function find(name) {
   return COMMANDS.find((c) => c.name === name);
 }
 
-function splitArgs(input) {
+function splitArgs(input) {
   const args = [];
   let cur = '';
   let quote = null;
   let escaped = false;
-  for (let i = 0; i < input.length; i++) {
-    const ch = input[i];
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i];
     if (escaped) {
       cur += ch;
       escaped = false;
-    } else if (ch === '\\') {
-      const next = input[i + 1];
-      const escapable = next != null && (next === '\\' || next === '"' || next === "'" || /\s/.test(next));
-      if (escapable) escaped = true;
-      else cur += ch;
+    } else if (ch === '\\') {
+      const next = input[i + 1];
+      const escapable = next != null && (next === '\\' || next === '"' || next === "'" || /\s/.test(next));
+      if (escapable) escaped = true;
+      else cur += ch;
     } else if (quote) {
       if (ch === quote) quote = null;
       else cur += ch;

package/src/commands/monitor.js

@@ -29,18 +29,18 @@ async function log(ctx, args) {
   const res = await ctx.client.request('monitor.log.start', { grep });
   console.log(`Streaming console log (Ctrl+C to stop)${res.grep ? ' filtered by "' + res.grep + '"' : ''}`);
   if (res.buffer && res.buffer.length) console.log(res.buffer.join('\n'));
-  let stop = null;
-  let stopped = false;
+  let stop = null;
+  let stopped = false;
   try {
     await new Promise((resolve) => {
       const onLine = (event, data) => {
         if (event === EVENT_LOG_LINE) console.log(data.message);
       };
-      ctx.client.on('event', onLine);
-      stop = () => {
-        if (stopped) return;
-        stopped = true;
-        ctx.client.removeListener('event', onLine);
+      ctx.client.on('event', onLine);
+      stop = () => {
+        if (stopped) return;
+        stopped = true;
+        ctx.client.removeListener('event', onLine);
         ctx.client.request('monitor.log.stop').catch(() => {});
         resolve();
       };

package/src/index.js

@@ -9,17 +9,17 @@ const { startRepl } = require('./repl');
 const { runCommand } = require('./commands');
 const { doLogin } = require('./commands/auth');
 const { friendly } = require('./protocol');
-const { checkUpdate } = require('./update');
-const pkg = require('../package.json');
+const { checkUpdate } = require('./update');
+const pkg = require('../package.json');
 
-async function main(argv) {
-  const flags = parseFlags(argv);
-  if (flags.help) {
-    printUsage();
-    return 0;
-  }
-  checkUpdate();
-  const cfg = applyFlags(loadConfig(), flags);
+async function main(argv) {
+  const flags = parseFlags(argv);
+  if (flags.help) {
+    printUsage();
+    return 0;
+  }
+  checkUpdate();
+  const cfg = applyFlags(loadConfig(), flags);
   const args = flags.args;
   const cmd = args[0];
 
@@ -33,10 +33,10 @@ async function main(argv) {
         startRepl(ctx);
         return 0;
       }
-    } catch (err) {
-      console.error(`\nError: ${friendly(err)}\n`);
-      client.close();
-      return 1;
+    } catch (err) {
+      console.error(`\nError: ${friendly(err)}\n`);
+      client.close();
+      return 1;
     } finally {
       if (!ctx.exit && !process.stdout.isTTY) {
         client.close();
@@ -66,10 +66,10 @@ async function main(argv) {
   if (creds) {
     ctx.username = creds.username;
     try {
-      const resume = await client.request('auth.resume', { token: creds.token }, { timeoutMs: 15000 });
-      ctx.username = resume.username;
-      ctx.cwd = resume.cwd || '/';
-      session.save({ ...creds, expiresAt: Date.now() + (resume.expiresInSeconds || 0) * 1000 });
+      const resume = await client.request('auth.resume', { token: creds.token }, { timeoutMs: 15000 });
+      ctx.username = resume.username;
+      ctx.cwd = resume.cwd || '/';
+      session.save({ ...creds, expiresAt: Date.now() + (resume.expiresInSeconds || 0) * 1000 });
     } catch (err) {
       if (err.code === 'E_SESSION_EXPIRED' || err.code === 'E_UNAUTHORIZED') {
         session.clear();
@@ -134,7 +134,7 @@ async function connect(cfg) {
     console.error(`CREEPER CLI SETUP & TROUBLESHOOTING GUIDE`);
     console.error(`--------------------------------------------------------------------------------\n`);
     console.error(`1. INSTALL THE PLUGIN ON YOUR MINECRAFT SERVER:`);
-    console.error(`   * Place CreeperCLI-${pkg.version}.jar inside your server's 'plugins/' folder.`);
+    console.error(`   * Place CreeperCLI-${pkg.version}.jar inside your server's 'plugins/' folder.`);
     console.error(`   * Start or restart your server (Paper / Spigot 1.21+).\n`);
     console.error(`2. CREATE YOUR ADMIN USER IN SERVER CONSOLE:`);
     console.error(`   * Open your server console (or run in-game as OP):`);
@@ -147,13 +147,13 @@ async function connect(cfg) {
     console.error(`     ssh -L ${cfg.port}:127.0.0.1:${cfg.port} user@<your-server-ip>\n`);
     console.error(`--------------------------------------------------------------------------------`);
     console.error(`Documentation: https://github.com/DemonZ-Development/creepercli\n`);
-    err.creepercliReported = true;
-    throw err;
-  }
-}
+    err.creepercliReported = true;
+    throw err;
+  }
+}
 
 function printUsage() {
-  console.log(`CreeperCLI v${pkg.version} — remote Minecraft administration
+  console.log(`CreeperCLI v${pkg.version} — remote Minecraft administration
 
 Usage:
   creepercli login                       Authenticate with the server

package/src/repl.js

@@ -10,9 +10,9 @@ function prompt(ctx) {
   return `${ctx.username || '?'}@${ctx.cfg.host}:${ctx.cwd || '/'}> `;
 }
 
-function startRepl(ctx, io = {}) {
-  const input = io.input || process.stdin;
-  const output = io.output || process.stdout;
+function startRepl(ctx, io = {}) {
+  const input = io.input || process.stdin;
+  const output = io.output || process.stdout;
   const completions = COMMANDS.map((c) => c.name);
 
   function completer(line) {
@@ -22,9 +22,9 @@ function startRepl(ctx, io = {}) {
   }
 
   const rl = readline.createInterface({
-    input,
-    output,
-    terminal: Boolean(output.isTTY),
+    input,
+    output,
+    terminal: Boolean(output.isTTY),
     historySize: 1000,
     completer,
   });
@@ -47,11 +47,11 @@ function startRepl(ctx, io = {}) {
     running = true;
     while (queue.length) {
       const line = queue.shift();
-      await runCommand(ctx, line);
-      if (ctx.exit) {
-        queue.length = 0;
-        rl.close();
-        return;
+      await runCommand(ctx, line);
+      if (ctx.exit) {
+        queue.length = 0;
+        rl.close();
+        return;
       }
       rl.setPrompt(prompt(ctx));
       rl.prompt();
@@ -83,12 +83,12 @@ function startRepl(ctx, io = {}) {
     });
   });
 
-  rl.on('close', async () => {
-    await ctx.client.flush();
-    ctx.client.close();
-  });
-
-  return rl;
-}
+  rl.on('close', async () => {
+    await ctx.client.flush();
+    ctx.client.close();
+  });
+
+  return rl;
+}
 
 module.exports = { startRepl, prompt };

package/src/session.js

@@ -24,7 +24,7 @@ function load(host, port) {
     const raw = fs.readFileSync(CREDS_FILE, 'utf8');
     const creds = JSON.parse(raw);
     if (creds.host !== host || creds.port !== port) return null;
-    return creds;
+    return creds;
   } catch {
     return null;
   }

package/src/transfer.js

@@ -4,28 +4,28 @@
 
 const fs = require('fs');
 const path = require('path');
-const crypto = require('crypto');
-const { confirm } = require('./prompts');
-
-const MAX_TRANSFER_CHUNK_BYTES = 1024 * 1024;
-
-function validateTransferStart(start, expectFileMetadata = false) {
-  if (!start || typeof start.transferId !== 'string' || !start.transferId) {
-    throw new Error('Server returned an invalid transfer id');
-  }
-  if (!Number.isInteger(start.chunkSize) || start.chunkSize < 1024
-      || start.chunkSize > MAX_TRANSFER_CHUNK_BYTES) {
-    throw new Error('Server returned an invalid transfer chunk size');
-  }
-  if (expectFileMetadata) {
-    if (!Number.isSafeInteger(start.size) || start.size < 0) {
-      throw new Error('Server returned an invalid file size');
-    }
-    if (typeof start.sha256 !== 'string' || !/^[0-9a-f]{64}$/i.test(start.sha256)) {
-      throw new Error('Server returned an invalid file checksum');
-    }
-  }
-}
+const crypto = require('crypto');
+const { confirm } = require('./prompts');
+
+const MAX_TRANSFER_CHUNK_BYTES = 1024 * 1024;
+
+function validateTransferStart(start, expectFileMetadata = false) {
+  if (!start || typeof start.transferId !== 'string' || !start.transferId) {
+    throw new Error('Server returned an invalid transfer id');
+  }
+  if (!Number.isInteger(start.chunkSize) || start.chunkSize < 1024
+      || start.chunkSize > MAX_TRANSFER_CHUNK_BYTES) {
+    throw new Error('Server returned an invalid transfer chunk size');
+  }
+  if (expectFileMetadata) {
+    if (!Number.isSafeInteger(start.size) || start.size < 0) {
+      throw new Error('Server returned an invalid file size');
+    }
+    if (typeof start.sha256 !== 'string' || !/^[0-9a-f]{64}$/i.test(start.sha256)) {
+      throw new Error('Server returned an invalid file checksum');
+    }
+  }
+}
 
 function sha256File(file) {
   return new Promise((resolve, reject) => {
@@ -49,7 +49,7 @@ function clearProgress() {
   process.stdout.write('\r'.padEnd(70) + '\r');
 }
 
-async function cpush(ctx, args) {
+async function cpush(ctx, args) {
   const rest = args.filter((a) => !a.startsWith('--'));
   let [local, remote] = rest;
   if (!local || !remote) throw new Error('Usage: cpush <local-file> <remote-path>');
@@ -57,20 +57,20 @@ async function cpush(ctx, args) {
   const stat = fs.statSync(local);
   if (!stat.isFile()) throw new Error('Local path must be a file');
   const sha = await sha256File(local);
-  const start = await ctx.client.request('xfer.push.start', {
+  const start = await ctx.client.request('xfer.push.start', {
     path: remote,
     size: stat.size,
     sha256: sha,
-    force: args.includes('--force'),
-  }, { timeoutMs: 60000 });
-  const { transferId, chunkSize } = start;
-  let fd = null;
-  let transferred = 0;
-  let index = 0;
-  try {
-    validateTransferStart(start);
-    fd = fs.openSync(local, 'r');
-    const buf = Buffer.alloc(chunkSize);
+    force: args.includes('--force'),
+  }, { timeoutMs: 60000 });
+  const { transferId, chunkSize } = start;
+  let fd = null;
+  let transferred = 0;
+  let index = 0;
+  try {
+    validateTransferStart(start);
+    fd = fs.openSync(local, 'r');
+    const buf = Buffer.alloc(chunkSize);
     while (true) {
       const n = fs.readSync(fd, buf, 0, chunkSize, transferred);
       if (n === 0) break;
@@ -81,99 +81,99 @@ async function cpush(ctx, args) {
       }, { timeoutMs: 120000 });
       transferred += n;
       index++;
-      showProgress(transferred, stat.size);
-    }
-    const finish = await ctx.client.request('xfer.push.finish', { transferId, sha256: sha });
-    if (!finish || typeof finish.sha256 !== 'string' || finish.sha256.toLowerCase() !== sha) {
-      throw new Error('Server reported an unexpected upload checksum');
-    }
-    clearProgress();
-    console.log(`Pushed ${local} -> ${finish.target} (${finish.size} bytes, sha256 ${finish.sha256})`);
-  } catch (err) {
-    await ctx.client.request('xfer.abort', { transferId }).catch(() => {});
-    clearProgress();
-    throw err;
-  } finally {
-    if (fd !== null) fs.closeSync(fd);
-  }
-}
+      showProgress(transferred, stat.size);
+    }
+    const finish = await ctx.client.request('xfer.push.finish', { transferId, sha256: sha });
+    if (!finish || typeof finish.sha256 !== 'string' || finish.sha256.toLowerCase() !== sha) {
+      throw new Error('Server reported an unexpected upload checksum');
+    }
+    clearProgress();
+    console.log(`Pushed ${local} -> ${finish.target} (${finish.size} bytes, sha256 ${finish.sha256})`);
+  } catch (err) {
+    await ctx.client.request('xfer.abort', { transferId }).catch(() => {});
+    clearProgress();
+    throw err;
+  } finally {
+    if (fd !== null) fs.closeSync(fd);
+  }
+}
 
 async function cpull(ctx, args) {
   let [remote, local] = args.filter((a) => !a.startsWith('--'));
   if (!remote || !local) throw new Error('Usage: cpull <remote-path> <local-file>');
-  remote = remote.replace(/\\/g, '/');
-  const start = await ctx.client.request('xfer.pull.start', { path: remote });
-  const { transferId, size, sha256: expectedSha, chunkSize } = start;
-  const part = `${local}.creepercli-part-${process.pid}-${Date.now()}`;
-  const hash = crypto.createHash('sha256');
-  let fd = null;
-  let transferred = 0;
-  let index = 0;
-  try {
-    validateTransferStart(start, true);
-    const parent = path.dirname(path.resolve(local));
-    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
-    fd = fs.openSync(part, 'w');
-    while (true) {
+  remote = remote.replace(/\\/g, '/');
+  const start = await ctx.client.request('xfer.pull.start', { path: remote });
+  const { transferId, size, sha256: expectedSha, chunkSize } = start;
+  const part = `${local}.creepercli-part-${process.pid}-${Date.now()}`;
+  const hash = crypto.createHash('sha256');
+  let fd = null;
+  let transferred = 0;
+  let index = 0;
+  try {
+    validateTransferStart(start, true);
+    const parent = path.dirname(path.resolve(local));
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    fd = fs.openSync(part, 'w');
+    while (true) {
       const res = await ctx.client.request('xfer.pull.chunk', { transferId, index }, { timeoutMs: 120000 });
-      const data = Buffer.from(res.data || '', 'base64');
-      if (data.length === 0) break;
-      if (data.length > chunkSize || transferred + data.length > size) {
-        throw new Error('Server sent an invalid transfer chunk');
-      }
+      const data = Buffer.from(res.data || '', 'base64');
+      if (data.length === 0) break;
+      if (data.length > chunkSize || transferred + data.length > size) {
+        throw new Error('Server sent an invalid transfer chunk');
+      }
       fs.writeSync(fd, data, 0, data.length);
       hash.update(data);
       transferred += data.length;
-      index++;
-      showProgress(transferred, size);
-    }
-    fs.closeSync(fd);
-    fd = null;
-    if (transferred !== size) {
-      throw new Error(`Transfer ended early: expected ${size} bytes, received ${transferred}`);
-    }
-    const actual = await ctx.client.request('xfer.pull.finish', { transferId, sha256: hash.digest('hex') });
-    clearProgress();
-    if (!actual || typeof actual.sha256 !== 'string'
-        || actual.sha256.toLowerCase() !== expectedSha.toLowerCase()) {
-      throw new Error('Checksum mismatch: transfer aborted');
-    }
-    replaceFile(part, local);
-    console.log(`Pulled ${remote} -> ${local} (${transferred} bytes, sha256 ${actual.sha256})`);
-  } catch (err) {
-    if (fd !== null) {
-      fs.closeSync(fd);
-      fd = null;
-    }
-    await ctx.client.request('xfer.abort', { transferId }).catch(() => {});
-    try { fs.unlinkSync(part); } catch {}
-    clearProgress();
-    throw err;
-  } finally {
-    if (fd !== null) fs.closeSync(fd);
-  }
-}
+      index++;
+      showProgress(transferred, size);
+    }
+    fs.closeSync(fd);
+    fd = null;
+    if (transferred !== size) {
+      throw new Error(`Transfer ended early: expected ${size} bytes, received ${transferred}`);
+    }
+    const actual = await ctx.client.request('xfer.pull.finish', { transferId, sha256: hash.digest('hex') });
+    clearProgress();
+    if (!actual || typeof actual.sha256 !== 'string'
+        || actual.sha256.toLowerCase() !== expectedSha.toLowerCase()) {
+      throw new Error('Checksum mismatch: transfer aborted');
+    }
+    replaceFile(part, local);
+    console.log(`Pulled ${remote} -> ${local} (${transferred} bytes, sha256 ${actual.sha256})`);
+  } catch (err) {
+    if (fd !== null) {
+      fs.closeSync(fd);
+      fd = null;
+    }
+    await ctx.client.request('xfer.abort', { transferId }).catch(() => {});
+    try { fs.unlinkSync(part); } catch {}
+    clearProgress();
+    throw err;
+  } finally {
+    if (fd !== null) fs.closeSync(fd);
+  }
+}
 
 async function csync(ctx, args) {
   let [remoteDir, localDir] = args.filter((a) => a !== '-y' && !a.startsWith('--'));
   if (!remoteDir || !localDir) throw new Error('Usage: csync <remote-dir> <local-dir> [--yes]');
   remoteDir = remoteDir.replace(/\\/g, '/');
-  const yes = args.includes('--yes') || args.includes('-y') || !!(ctx.flags && ctx.flags.yes);
-  await ctx.client.request('fs.mkdir', { path: remoteDir, parents: true }).catch(() => {});
-
-  const remoteInfo = await ctx.client.request('fs.info', { path: remoteDir });
-  if (!remoteInfo.isDir || typeof remoteInfo.path !== 'string' || !remoteInfo.path.startsWith('/')) {
-    throw new Error('Server returned an invalid sync directory');
-  }
-  remoteDir = remoteInfo.path;
-
-  const remote = await ctx.client.request('xfer.list', { path: remoteDir }, { timeoutMs: 600000 });
-  const remoteMap = new Map();
-  for (const e of remote.entries) {
-    if (!e.isDir) {
-      const rel = relativeRemotePath(remoteDir, e.path);
-      if (rel) remoteMap.set(rel, e);
-    }
+  const yes = args.includes('--yes') || args.includes('-y') || !!(ctx.flags && ctx.flags.yes);
+  await ctx.client.request('fs.mkdir', { path: remoteDir, parents: true }).catch(() => {});
+
+  const remoteInfo = await ctx.client.request('fs.info', { path: remoteDir });
+  if (!remoteInfo.isDir || typeof remoteInfo.path !== 'string' || !remoteInfo.path.startsWith('/')) {
+    throw new Error('Server returned an invalid sync directory');
+  }
+  remoteDir = remoteInfo.path;
+
+  const remote = await ctx.client.request('xfer.list', { path: remoteDir }, { timeoutMs: 600000 });
+  const remoteMap = new Map();
+  for (const e of remote.entries) {
+    if (!e.isDir) {
+      const rel = relativeRemotePath(remoteDir, e.path);
+      if (rel) remoteMap.set(rel, e);
+    }
   }
   if (remote.truncated) console.error('(remote listing truncated)');
 
@@ -227,38 +227,38 @@ async function csync(ctx, args) {
   console.log('Sync complete.');
 }
 
-function joinRemote(base, rel) {
+function joinRemote(base, rel) {
   const cleanBase = base.replace(/\\/g, '/');
   const cleanRel = rel.replace(/\\/g, '/');
   return (cleanBase.endsWith('/') ? cleanBase : cleanBase + '/') + cleanRel;
-}
-
-function relativeRemotePath(base, absolutePath) {
-  const cleanBase = ('/' + base.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '')).replace(/^\/$/, '');
-  const cleanPath = '/' + absolutePath.replace(/\\/g, '/').replace(/^\/+/, '');
-  if (!cleanBase) return cleanPath.replace(/^\//, '');
-  if (cleanPath === cleanBase) return '';
-  if (!cleanPath.startsWith(cleanBase + '/')) {
-    throw new Error(`Server returned path outside sync root: ${absolutePath}`);
-  }
-  return cleanPath.slice(cleanBase.length + 1);
-}
-
-function replaceFile(part, destination) {
-  if (!fs.existsSync(destination)) {
-    fs.renameSync(part, destination);
-    return;
-  }
-  const backup = `${destination}.creepercli-backup-${process.pid}-${Date.now()}`;
-  fs.renameSync(destination, backup);
-  try {
-    fs.renameSync(part, destination);
-  } catch (err) {
-    try { fs.renameSync(backup, destination); } catch {}
-    throw err;
-  }
-  try { fs.rmSync(backup, { force: true }); } catch {}
-}
+}
+
+function relativeRemotePath(base, absolutePath) {
+  const cleanBase = ('/' + base.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '')).replace(/^\/$/, '');
+  const cleanPath = '/' + absolutePath.replace(/\\/g, '/').replace(/^\/+/, '');
+  if (!cleanBase) return cleanPath.replace(/^\//, '');
+  if (cleanPath === cleanBase) return '';
+  if (!cleanPath.startsWith(cleanBase + '/')) {
+    throw new Error(`Server returned path outside sync root: ${absolutePath}`);
+  }
+  return cleanPath.slice(cleanBase.length + 1);
+}
+
+function replaceFile(part, destination) {
+  if (!fs.existsSync(destination)) {
+    fs.renameSync(part, destination);
+    return;
+  }
+  const backup = `${destination}.creepercli-backup-${process.pid}-${Date.now()}`;
+  fs.renameSync(destination, backup);
+  try {
+    fs.renameSync(part, destination);
+  } catch (err) {
+    try { fs.renameSync(backup, destination); } catch {}
+    throw err;
+  }
+  try { fs.rmSync(backup, { force: true }); } catch {}
+}
 
 function walkLocal(dir) {
   const map = new Map();
@@ -273,13 +273,13 @@ function walkLocal(dir) {
       const p = path.join(d, name);
       let st;
       try {
-        st = fs.lstatSync(p);
+        st = fs.lstatSync(p);
       } catch {
         continue;
       }
       const rel = ((prefix ? prefix + '/' : '') + name).replace(/\\/g, '/');
-      if (st.isSymbolicLink()) continue;
-      if (st.isDirectory()) walk(p, rel);
+      if (st.isSymbolicLink()) continue;
+      if (st.isDirectory()) walk(p, rel);
       else if (st.isFile()) map.set(rel, { size: st.size, mtime: Math.floor(st.mtimeMs) });
     }
   }
@@ -287,6 +287,6 @@ function walkLocal(dir) {
   return map;
 }
 
-module.exports = {
-  cpush, cpull, csync, joinRemote, relativeRemotePath, replaceFile, walkLocal, validateTransferStart,
-};
+module.exports = {
+  cpush, cpull, csync, joinRemote, relativeRemotePath, replaceFile, walkLocal, validateTransferStart,
+};

package/src/update.js

@@ -22,14 +22,14 @@ function checkUpdate() {
 
     if (cache.lastCheck && now - cache.lastCheck < CHECK_INTERVAL_MS) {
       if (cache.latest && isNewerVersion(pkg.version, cache.latest)) {
-        console.log(`[Notice] A new version of creepercli (v${cache.latest}) is available! Run "npm install -g creepercli" to update.\n`);
+        console.log(`[Notice] A new version of creepercli (v${cache.latest}) is available! Run "npm install -g creepercli" to update.\n`);
       }
       return;
     }
 
-    const req = https.get('https://registry.npmjs.org/creepercli/latest', {
+    const req = https.get('https://registry.npmjs.org/creepercli/latest', {
       timeout: 2500,
-      headers: { 'User-Agent': `creepercli/${pkg.version}` }
+      headers: { 'User-Agent': `creepercli/${pkg.version}` }
     }, (res) => {
       if (res.statusCode !== 200) return;
       let body = '';
@@ -42,7 +42,7 @@ function checkUpdate() {
             fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
             fs.writeFileSync(UPDATE_FILE, JSON.stringify({ lastCheck: now, latest }), { mode: 0o600 });
             if (isNewerVersion(pkg.version, latest)) {
-              console.log(`[Notice] A new version of creepercli (v${latest}) is available! Run "npm install -g creepercli" to update.\n`);
+              console.log(`[Notice] A new version of creepercli (v${latest}) is available! Run "npm install -g creepercli" to update.\n`);
             }
           }
         } catch {
@@ -50,9 +50,9 @@ function checkUpdate() {
       });
     });
 
-    req.on('error', () => {});
-    req.on('socket', (socket) => socket.unref());
-  } catch {
+    req.on('error', () => {});
+    req.on('socket', (socket) => socket.unref());
+  } catch {
   }
 }