frogoe 0.3.0 → 0.3.1

package/dist/cli.js

@@ -183,19 +183,18 @@ var init_init = __esm({
 // src/add.ts
 import { cpSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import path2 from "path";
-var STYLE_PATTERN, MARKUP_PATTERN, parseBlock, blockMarker, injectIntoHtml, addBlock;
+var parseBlock, blockMarker, injectIntoHtml, addBlock;
 var init_add = __esm({
   "src/add.ts"() {
     "use strict";
     init_init();
-    STYLE_PATTERN = /<style>([\s\S]*?)<\/style>/u;
-    MARKUP_PATTERN = /<\/style>\s*([\s\S]*)$/u;
     parseBlock = (source) => {
-      const styleMatch = STYLE_PATTERN.exec(source);
-      const markupMatch = MARKUP_PATTERN.exec(source);
+      const styleOpen = source.indexOf("<style>");
+      const styleClose = source.indexOf("</style>");
+      const css = styleOpen === -1 || styleClose === -1 || styleClose < styleOpen ? null : source.slice(styleOpen + "<style>".length, styleClose);
       return {
-        css: styleMatch?.[1]?.trim() ?? null,
-        markup: (markupMatch?.[1] ?? "").trim()
+        css: css?.trim() ?? null,
+        markup: (styleClose === -1 ? "" : source.slice(styleClose + "</style>".length)).trim()
       };
     };
     blockMarker = (name) => `<!-- frogoe:block:${name} -->`;
@@ -723,11 +722,32 @@ var init_bundle2 = __esm({
 });
 
 // ../lint/src/brief.ts
-var stripComment, parseBrief;
+var KEY_PATTERN, WS, stripComment, parseLine, parseBrief;
 var init_brief = __esm({
   "../lint/src/brief.ts"() {
     "use strict";
-    stripComment = (value) => value.replace(/\s+#.*$/u, "").trim().replace(/^["']|["']$/gu, "");
+    KEY_PATTERN = /^[a-z-]+$/u;
+    WS = /\s/u;
+    stripComment = (value) => {
+      let cut = -1;
+      for (let i = 1; i < value.length; i += 1) {
+        if (value[i] === "#" && WS.test(value[i - 1] ?? "")) {
+          cut = i;
+          break;
+        }
+      }
+      return (cut === -1 ? value : value.slice(0, cut)).trim().replace(/^["']|["']$/gu, "");
+    };
+    parseLine = (line) => {
+      let indent = 0;
+      while (indent < line.length && line[indent] === " ") indent += 1;
+      const body = line.slice(indent);
+      const colon = body.indexOf(":");
+      if (colon === -1) return null;
+      const key = body.slice(0, colon);
+      if (!KEY_PATTERN.test(key)) return null;
+      return { indent, key, rest: body.slice(colon + 1) };
+    };
     parseBrief = (source) => {
       const match = /^---\r?\n([\s\S]*?)\r?\n---/u.exec(source);
       if (!match) {
@@ -739,20 +759,20 @@ var init_brief = __esm({
         if (rawLine.trim() === "") {
           continue;
         }
-        const nested = /^\s{2,}([a-z-]+):\s*(.*)$/u.exec(rawLine);
-        const top = /^([a-z-]+):\s*(.*)$/u.exec(rawLine);
-        if (nested && section === "palette") {
-          const key = nested[1];
-          brief[key] = stripComment(nested[2] ?? "");
+        const parsed = parseLine(rawLine);
+        if (!parsed) {
+          continue;
+        }
+        if (parsed.indent >= 2 && section === "palette") {
+          brief[parsed.key] = stripComment(parsed.rest);
           continue;
         }
-        if (top) {
-          section = top[1] ?? "";
+        if (parsed.indent === 0) {
+          section = parsed.key;
           if (section === "palette") {
             continue;
           }
-          const key = section;
-          brief[key] = stripComment(top[2] ?? "");
+          brief[parsed.key] = stripComment(parsed.rest);
         }
       }
       return brief;
@@ -2799,12 +2819,21 @@ import { existsSync as existsSync6, mkdirSync as mkdirSync6, chmodSync, writeFil
 import os3 from "os";
 import path9 from "path";
 import { gunzipSync } from "zlib";
-var URL_PATTERN, parseTunnelUrl, octalAt, extractSingleFile, ENV_PIN, assetName, binaryFileName, cacheBase, resolveLatestTag, mb, downloadWithProgress, binaryEchoes, resolveBinary, startTunnel;
+var URL_PATTERN, parseTunnelUrl, TAG_PATTERN, assertSafeTag, octalAt, extractSingleFile, ENV_PIN, assetName, binaryFileName, cacheBase, resolveLatestTag, mb, downloadWithProgress, binaryEchoes, resolveBinary, startTunnel;
 var init_tunnel = __esm({
   "src/net/tunnel.ts"() {
     "use strict";
     URL_PATTERN = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/iu;
     parseTunnelUrl = (chunk) => URL_PATTERN.exec(chunk)?.[0];
+    TAG_PATTERN = /^\d{4}\.\d+\.\d+(-[A-Za-z0-9.]+)?$/u;
+    assertSafeTag = (tag) => {
+      if (!TAG_PATTERN.test(tag)) {
+        throw new Error(
+          `cloudflared version "${tag}" is not a valid release tag (expected e.g. 2025.10.1)`
+        );
+      }
+      return tag;
+    };
     octalAt = (block, offset, length) => {
       const raw = block.subarray(offset, offset + length).toString("utf-8");
       const digits = raw.replace(/[\0 ]/gu, "");
@@ -2897,10 +2926,15 @@ var init_tunnel = __esm({
           `cloudflared publishes no build for ${platform}/${process.arch} \u2014 install it and put \`cloudflared\` on PATH`
         );
       }
-      const tag = process.env[ENV_PIN] ?? await resolveLatestTag();
+      const tag = process.env[ENV_PIN] ? assertSafeTag(process.env[ENV_PIN]) : assertSafeTag(await resolveLatestTag());
       const root = path9.join(cacheBase(platform, process.env, os3.homedir()), "frogoe", "cloudflared");
       const dir = path9.join(root, tag);
       const bin = path9.join(dir, binaryFileName(platform));
+      const rootResolved = path9.resolve(root);
+      const binResolved = path9.resolve(bin);
+      if (!binResolved.startsWith(rootResolved + path9.sep)) {
+        throw new Error("cloudflared binary path escaped the frogoe cache \u2014 refusing to execute");
+      }
       if (existsSync6(bin) && binaryEchoes(bin, tag)) return { downloaded: false, path: bin };
       onProgress?.(`downloading cloudflared ${tag} (~25 MB, once)\u2026`);
       const res = await fetch(
@@ -3601,7 +3635,7 @@ import { defineCommand as defineCommand9, runMain } from "citty";
 // package.json
 var package_default = {
   name: "frogoe",
-  version: "0.3.0",
+  version: "0.3.1",
   description: "froge CLI \u2014 the agent's hands: init, add, run, check, bundle",
   homepage: "https://github.com/frogoe/engine#readme",
   bugs: "https://github.com/frogoe/engine/issues",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frogoe",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "froge CLI — the agent's hands: init, add, run, check, bundle",
   "homepage": "https://github.com/frogoe/engine#readme",
   "bugs": "https://github.com/frogoe/engine/issues",