gloomberb 0.10.4 → 0.11.0

package/src/updater.test.ts

@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, test } from "bun:test";
+import { createHash } from "crypto";
 import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
@@ -241,6 +242,7 @@ describe("checkForUpdate", () => {
       assets: [{
         name: expectedAssetName(true),
         browser_download_url: "https://example.com/gloomberb.gz",
+        digest: `sha256:${"ab".repeat(32)}`,
       }],
     }), {
       status: 200,
@@ -261,6 +263,7 @@ describe("checkForUpdate", () => {
         publishedAt: "2026-04-03T00:00:00Z",
         updateAction: { kind: "self" },
         compressed: true,
+        checksum: "ab".repeat(32),
       });
     } finally {
       Object.defineProperty(process, "execPath", { value: originalExecPath, configurable: true });
@@ -291,6 +294,36 @@ describe("checkForUpdateDetailed", () => {
       Object.defineProperty(process, "argv", { value: originalArgv, configurable: true });
     }
   });
+
+  test.each([
+    ["missing", undefined],
+    ["malformed", "sha256:not-a-checksum"],
+  ])("rejects release assets with a %s digest", async (_label, digest) => {
+    const originalExecPath = process.execPath;
+    const originalArgv = process.argv;
+    globalThis.fetch = (async () => new Response(JSON.stringify({
+      tag_name: "v0.3.2",
+      published_at: "2026-04-03T00:00:00Z",
+      assets: [{
+        name: expectedAssetName(),
+        browser_download_url: "https://example.com/gloomberb",
+        ...(digest ? { digest } : {}),
+      }],
+    }), { status: 200 })) as typeof fetch;
+
+    try {
+      Object.defineProperty(process, "execPath", { value: "/Applications/gloomberb", configurable: true });
+      Object.defineProperty(process, "argv", { value: ["/Applications/gloomberb"], configurable: true });
+
+      await expect(checkForUpdateDetailed("0.3.1")).resolves.toEqual({
+        kind: "error",
+        error: expect.stringContaining("valid SHA-256 digest"),
+      });
+    } finally {
+      Object.defineProperty(process, "execPath", { value: originalExecPath, configurable: true });
+      Object.defineProperty(process, "argv", { value: originalArgv, configurable: true });
+    }
+  });
 });
 
 describe("performUpdate", () => {
@@ -351,28 +384,24 @@ describe("performUpdate", () => {
     }
   });
 
-  it("decompresses gzipped release assets before replacing the binary", async () => {
+  test.each([
+    ["missing", undefined],
+    ["malformed", "not-a-checksum"],
+  ])("leaves the installed binary untouched when the checksum is %s", async (_label, checksum) => {
     const originalExecPath = process.execPath;
     const originalArgv = process.argv;
     const tempDir = mkdtempSync(join(tmpdir(), "gloomberb-update-"));
     const execPath = join(tempDir, "gloomberb");
-    const nextBinary = Buffer.from("new-binary");
-    const payload = gzipSync(nextBinary);
+    const oldBinary = Buffer.from("old-binary");
     const progress: UpdateProgress[] = [];
 
-    writeFileSync(execPath, Buffer.from("old-binary"));
+    writeFileSync(execPath, oldBinary);
     chmodSync(execPath, 0o755);
-    globalThis.fetch = (async () => new Response(payload, {
-      status: 200,
-      headers: { "content-length": String(payload.length) },
-    })) as typeof fetch;
+    globalThis.fetch = (async () => new Response(gzipSync("new-binary"), { status: 200 })) as typeof fetch;
 
     try {
       Object.defineProperty(process, "execPath", { value: execPath, configurable: true });
-      Object.defineProperty(process, "argv", {
-        value: [execPath],
-        configurable: true,
-      });
+      Object.defineProperty(process, "argv", { value: [execPath], configurable: true });
 
       await performUpdate({
         version: "9.9.9",
@@ -381,13 +410,48 @@ describe("performUpdate", () => {
         publishedAt: "2026-04-03T00:00:00Z",
         updateAction: { kind: "self" },
         compressed: true,
-      }, (entry) => {
-        progress.push(entry);
+        ...(checksum ? { checksum } : {}),
+      }, (entry) => { progress.push(entry); });
+
+      expect(readFileSync(execPath)).toEqual(oldBinary);
+      expect(progress.at(-1)).toEqual({
+        phase: "error",
+        error: "Self-update requires a valid SHA-256 checksum.",
       });
+    } finally {
+      Object.defineProperty(process, "execPath", { value: originalExecPath, configurable: true });
+      Object.defineProperty(process, "argv", { value: originalArgv, configurable: true });
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("replaces the binary when the downloaded asset checksum matches", async () => {
+    const originalExecPath = process.execPath;
+    const originalArgv = process.argv;
+    const tempDir = mkdtempSync(join(tmpdir(), "gloomberb-update-"));
+    const execPath = join(tempDir, "gloomberb");
+    const nextBinary = Buffer.from("verified-binary");
+    const checksum = createHash("sha256").update(nextBinary).digest("hex");
+    const progress: UpdateProgress[] = [];
+
+    writeFileSync(execPath, Buffer.from("old-binary"));
+    chmodSync(execPath, 0o755);
+    globalThis.fetch = (async () => new Response(nextBinary, { status: 200 })) as typeof fetch;
+
+    try {
+      Object.defineProperty(process, "execPath", { value: execPath, configurable: true });
+      Object.defineProperty(process, "argv", { value: [execPath], configurable: true });
+
+      await performUpdate({
+        version: "9.9.9",
+        tagName: "v9.9.9",
+        downloadUrl: "https://example.com/gloomberb",
+        publishedAt: "2026-04-03T00:00:00Z",
+        updateAction: { kind: "self" },
+        checksum,
+      }, (entry) => { progress.push(entry); });
 
       expect(readFileSync(execPath)).toEqual(nextBinary);
-      expect(progress[0]).toEqual({ phase: "downloading", percent: 0 });
-      expect(progress).toContainEqual({ phase: "downloading", percent: 100 });
       expect(progress.at(-1)).toEqual({ phase: "done" });
     } finally {
       Object.defineProperty(process, "execPath", { value: originalExecPath, configurable: true });
@@ -395,4 +459,41 @@ describe("performUpdate", () => {
       rmSync(tempDir, { recursive: true, force: true });
     }
   });
+
+  it("leaves the installed binary untouched when the checksum mismatches", async () => {
+    const originalExecPath = process.execPath;
+    const originalArgv = process.argv;
+    const tempDir = mkdtempSync(join(tmpdir(), "gloomberb-update-"));
+    const execPath = join(tempDir, "gloomberb");
+    const oldBinary = Buffer.from("old-binary");
+    const progress: UpdateProgress[] = [];
+
+    writeFileSync(execPath, oldBinary);
+    chmodSync(execPath, 0o755);
+    globalThis.fetch = (async () => new Response("tampered", { status: 200 })) as typeof fetch;
+
+    try {
+      Object.defineProperty(process, "execPath", { value: execPath, configurable: true });
+      Object.defineProperty(process, "argv", { value: [execPath], configurable: true });
+
+      await performUpdate({
+        version: "9.9.9",
+        tagName: "v9.9.9",
+        downloadUrl: "https://example.com/gloomberb",
+        publishedAt: "2026-04-03T00:00:00Z",
+        updateAction: { kind: "self" },
+        checksum: "00".repeat(32),
+      }, (entry) => { progress.push(entry); });
+
+      expect(readFileSync(execPath)).toEqual(oldBinary);
+      expect(progress.at(-1)).toEqual(expect.objectContaining({
+        phase: "error",
+        error: expect.stringContaining("Checksum mismatch"),
+      }));
+    } finally {
+      Object.defineProperty(process, "execPath", { value: originalExecPath, configurable: true });
+      Object.defineProperty(process, "argv", { value: originalArgv, configurable: true });
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
 });

package/src/updater.ts

@@ -11,6 +11,8 @@ export interface ReleaseInfo {
   publishedAt: string;
   updateAction: UpdateAction;
   compressed?: boolean;
+  /** SHA-256 of the downloaded GitHub release asset. */
+  checksum?: string;
 }
 
 export interface UpdateProgress {
@@ -70,18 +72,24 @@ function getAssetBaseName(): string {
   return getAssetBaseNameForRuntime();
 }
 
+function parseAssetDigest(digest: string | undefined): string | undefined {
+  return /^sha256:([a-f\d]{64})$/i.exec(digest ?? "")?.[1]?.toLowerCase();
+}
+
 function resolveReleaseAsset(
-  assets: { name: string; browser_download_url: string }[],
-): { name: string; browser_download_url: string; compressed: boolean } | null {
+  assets: { name: string; browser_download_url: string; digest?: string }[],
+): { name: string; browser_download_url: string; compressed: boolean; checksum?: string } | null {
   const assetBaseName = getAssetBaseName();
   const gzAsset = assets.find((asset) => asset.name === `${assetBaseName}.gz`);
   if (gzAsset) {
-    return { ...gzAsset, compressed: true };
+    const { name, browser_download_url, digest } = gzAsset;
+    return { name, browser_download_url, compressed: true, checksum: parseAssetDigest(digest) };
   }
 
   const rawAsset = assets.find((asset) => asset.name === assetBaseName);
   if (rawAsset) {
-    return { ...rawAsset, compressed: false };
+    const { name, browser_download_url, digest } = rawAsset;
+    return { name, browser_download_url, compressed: false, checksum: parseAssetDigest(digest) };
   }
 
   return null;
@@ -249,7 +257,7 @@ export async function checkForUpdateDetailed(
     const data = (await res.json()) as {
       tag_name: string;
       published_at: string;
-      assets: { name: string; browser_download_url: string }[];
+      assets: { name: string; browser_download_url: string; digest?: string }[];
     };
 
     const version = data.tag_name.replace(/^v/, "");
@@ -264,6 +272,12 @@ export async function checkForUpdateDetailed(
         error: `No compatible release asset found for ${getAssetBaseName()}`,
       };
     }
+    if (!asset.checksum) {
+      return {
+        kind: "error",
+        error: `Release asset ${asset.name} is missing a valid SHA-256 digest`,
+      };
+    }
 
     return {
       kind: "available",
@@ -274,6 +288,7 @@ export async function checkForUpdateDetailed(
         publishedAt: data.published_at,
         updateAction,
         compressed: asset.compressed,
+        ...(asset.checksum ? { checksum: asset.checksum } : {}),
       },
     };
   } catch (error: unknown) {
@@ -332,6 +347,12 @@ export async function performUpdate(
     return;
   }
 
+  const checksum = /^[a-f\d]{64}$/i.exec(release.checksum ?? "")?.[0].toLowerCase();
+  if (!checksum) {
+    onProgress({ phase: "error", error: "Self-update requires a valid SHA-256 checksum." });
+    return;
+  }
+
   const updatePath = execPath + ".update";
   const oldPath = execPath + ".old";
   let unlinkUpdatePath: ((path: string) => void) | null = null;
@@ -339,6 +360,7 @@ export async function performUpdate(
   try {
     const fsModulePath = "fs";
     const zlibModulePath = "zlib";
+    const cryptoModulePath = "crypto";
     const {
       renameSync,
       unlinkSync,
@@ -346,6 +368,7 @@ export async function performUpdate(
     } = await import(fsModulePath) as typeof import("fs");
     unlinkUpdatePath = unlinkSync;
     const { gunzipSync } = await import(zlibModulePath) as typeof import("zlib");
+    const { createHash } = await import(cryptoModulePath) as typeof import("crypto");
 
     onProgress({ phase: "downloading", percent: 0 });
 
@@ -378,6 +401,10 @@ export async function performUpdate(
       downloaded.set(chunk, offset);
       offset += chunk.byteLength;
     }
+    const actual = createHash("sha256").update(downloaded).digest("hex");
+    if (actual !== checksum) {
+      throw new Error(`Checksum mismatch: expected ${checksum}, got ${actual}`);
+    }
     const nextBinary = release.compressed
       ? new Uint8Array(gunzipSync(downloaded))
       : downloaded;

package/src/utils/exchanges.ts

@@ -82,6 +82,7 @@ export const CANONICAL_EXCHANGE_ALIASES: Record<string, string> = {
   ICEX: "ICEX",
   XICE: "ICEX",
   WSE: "WSE",
+  GPW: "WSE",
   XWAR: "WSE",
   PRA: "PSE",
   XPRA: "PSE",

package/src/utils/external-url.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import { safeExternalUrl } from "./external-url";
+
+describe("safeExternalUrl", () => {
+  test("accepts the web schemes and returns the normalised URL", () => {
+    expect(safeExternalUrl("https://example.com/a?b=1")).toBe("https://example.com/a?b=1");
+    expect(safeExternalUrl("http://example.com")).toBe("http://example.com/");
+    expect(safeExternalUrl("  https://example.com/x  ")).toBe("https://example.com/x");
+  });
+
+  test("rejects schemes that would let a feed reach the local machine", () => {
+    // These reach openUrl straight from RSS, news, and market payloads, and
+    // end up as arguments to `open` / `xdg-open` / `cmd /c start`.
+    for (const hostile of [
+      "file:///etc/passwd",
+      "javascript:alert(1)",
+      "data:text/html,<script>alert(1)</script>",
+      "vbscript:msgbox(1)",
+      "smb://attacker/share",
+      "gloomberb://open",
+    ]) {
+      expect(safeExternalUrl(hostile)).toBeNull();
+    }
+  });
+
+  test("rejects input that is not a URL at all", () => {
+    expect(safeExternalUrl("")).toBeNull();
+    expect(safeExternalUrl("   ")).toBeNull();
+    expect(safeExternalUrl("not-a-url")).toBeNull();
+    expect(safeExternalUrl("//example.com")).toBeNull();
+  });
+});

package/src/utils/external-url.ts

@@ -0,0 +1,23 @@
+/**
+ * Scheme validation for links handed to the operating system.
+ *
+ * Opening a link natively means spawning `open` / `xdg-open` / `cmd /c start`
+ * with a string that usually came from an external feed: RSS items, prediction
+ * markets, news, filings, Substack. Two things make an unvalidated string
+ * dangerous there — `file://` launches local content, and Windows routes the
+ * argument through cmd's parser.
+ *
+ * Restricting to http(s) removes both. Returns the normalised URL so callers
+ * spawn the parsed form rather than the raw input.
+ */
+export function safeExternalUrl(value: string): string | null {
+  if (!value.trim()) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.toString();
+}

package/src/utils/sort-values.ts

@@ -15,3 +15,34 @@ export function compareSortValues(
     : Number(left) - Number(right);
   return direction === "asc" ? comparison : -comparison;
 }
+
+export interface SortPreference<Id extends string> {
+  columnId: Id | null;
+  direction: SortDirection;
+}
+
+/**
+ * Keyboard equivalent of clicking column headers: walks every sort state the
+ * mouse can reach (each column ascending then descending, plus the unsorted
+ * state when the table has one) so sorting is not mouse-only.
+ */
+export function cycleSortPreference<Id extends string>(
+  columnIds: readonly Id[],
+  current: SortPreference<Id>,
+  step: 1 | -1,
+  options?: { allowUnsorted?: boolean },
+): SortPreference<Id> {
+  const states: SortPreference<Id>[] = options?.allowUnsorted
+    ? [{ columnId: null, direction: "asc" }]
+    : [];
+  for (const columnId of columnIds) {
+    states.push({ columnId, direction: "asc" }, { columnId, direction: "desc" });
+  }
+  if (states.length === 0) return current;
+
+  const index = states.findIndex(
+    (state) => state.columnId === current.columnId && state.direction === current.direction,
+  );
+  const next = (index < 0 ? 0 : index + step + states.length) % states.length;
+  return states[next]!;
+}

package/src/utils/zoned-date-time.ts

@@ -0,0 +1,67 @@
+export interface ZonedDateTimeParts {
+  year: number;
+  month: number;
+  day: number;
+  hour: number;
+  minute: number;
+  second: number;
+}
+
+const formatters = new Map<string, Intl.DateTimeFormat>();
+
+function formatter(timeZone: string): Intl.DateTimeFormat {
+  let value = formatters.get(timeZone);
+  if (!value) {
+    value = new Intl.DateTimeFormat("en-US", {
+      timeZone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit",
+    });
+    formatters.set(timeZone, value);
+  }
+  return value;
+}
+
+export function zonedDateTimeParts(utcMs: number, timeZone: string): ZonedDateTimeParts {
+  const parts = new Map<string, string>();
+  for (const part of formatter(timeZone).formatToParts(new Date(utcMs))) {
+    if (part.type !== "literal") parts.set(part.type, part.value);
+  }
+  return {
+    year: Number(parts.get("year")),
+    month: Number(parts.get("month")),
+    day: Number(parts.get("day")),
+    hour: Number(parts.get("hour")),
+    minute: Number(parts.get("minute")),
+    second: Number(parts.get("second")),
+  };
+}
+
+function zonedOffsetMs(utcMs: number, timeZone: string): number {
+  const parts = zonedDateTimeParts(utcMs, timeZone);
+  const wallMs = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+  return wallMs - Math.floor(utcMs / 1000) * 1000;
+}
+
+/** Convert a wall-clock reading in an IANA timezone to a real UTC instant. */
+export function zonedWallClockToUtcMs(
+  timeZone: string,
+  year: number,
+  month: number,
+  day: number,
+  hour: number,
+  minute: number,
+  second: number,
+  millisecond = 0,
+): number {
+  const wallMs = Date.UTC(year, month - 1, day, hour, minute, second, millisecond);
+  const firstOffset = zonedOffsetMs(wallMs, timeZone);
+  const candidate = wallMs - firstOffset;
+  const verifiedOffset = zonedOffsetMs(candidate, timeZone);
+  return wallMs - verifiedOffset;
+}