hostpad 0.2.2 → 0.3.0

package/lib/bridge.js

@@ -108,7 +108,7 @@ function createBridge({
     const pairId = crypto.randomUUID();
     const code = codeStore.issue(pairId, pairCode);
     conn.pair = { pairId };
-    sendTo(conn, { type: 'pair-challenge', pairId, code });
+    sendTo(conn, { type: 'pair-challenge', pairId, code, codeTtlMs });
     conn.pairTimer = setTimeout(() => {
       conn.pairTimer = null;
       if (conn.pair?.pairId === pairId) startPairing(conn);

package/lib/tools.js

@@ -47,14 +47,18 @@ function createToolStore(toolsDir) {
   const toolDir = (id) => path.join(toolsDir, id);
 
   function readRaw(id) {
+    // id 来自 MCP 输入（AI 可控），读取/删除入口必须先过白名单，防 ../ 穿越
+    if (typeof id !== 'string' || !ID_RE.test(id)) return null;
     const dir = toolDir(id);
     if (!fs.existsSync(path.join(dir, 'manifest.json'))) return null;
     const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
     const files = [];
+    const root = path.resolve(dir);
     const walk = (rel) => {
       for (const name of fs.readdirSync(path.join(dir, rel))) {
         const relPath = rel ? `${rel}/${name}` : name;
-        const abs = path.join(dir, relPath);
+        const abs = path.resolve(dir, relPath);
+        if (abs !== root && !abs.startsWith(root + path.sep)) continue; // 深度防御：symlink 等逃逸
         if (fs.statSync(abs).isDirectory()) { walk(relPath); continue; }
         if (relPath === 'manifest.json') continue;
         files.push({ path: relPath, content: fs.readFileSync(abs, 'utf8') });
@@ -120,6 +124,7 @@ function createToolStore(toolsDir) {
     },
 
     remove(id) {
+      if (typeof id !== 'string' || !ID_RE.test(id)) throw new Error(`非法工具 id: ${id}`);
       fs.rmSync(toolDir(id), { recursive: true, force: true });
     },
   };

package/package.json

@@ -1,8 +1,15 @@
 {
   "name": "hostpad",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "HostPad 的 MCP 服务器 + iPhone 同步桥：AI agent 经 MCP 管理与调试 iOS 工具（写→推→读日志闭环）",
   "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Huang-Yangkai/hostpad.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Huang-Yangkai/hostpad/issues"
+  },
   "bin": {
     "hostpad": "./bin/hostpad.js",
     "hostpad-dev": "./server.js"

package/server.js

@@ -9,7 +9,6 @@
 //
 // 正式的 agent 入口是 bin/hostpad.js（MCP 服务器，`npx hostpad`）。
 'use strict';
-const fs = require('node:fs');
 const path = require('node:path');
 const readline = require('node:readline');
 const { createBridge } = require('./lib/bridge.js');
@@ -75,17 +74,12 @@ bridge.start().then(() => {
 function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
 
 async function runSoak() {
-  const dir = bridge.store.list().map((id) => path.join(TOOLS_DIR, id))
-    .find((d) => {
-      try {
-        const m = JSON.parse(fs.readFileSync(path.join(d, 'manifest.json'), 'utf8'));
-        return fs.readFileSync(path.join(d, m.entry), 'utf8').includes('SOAK_MARKER');
-      } catch { return false; }
-    });
-  if (!dir) { console.log('[soak] 没有含 SOAK_MARKER 的工具，无法压测'); process.exit(2); }
-  const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
-  const entryPath = path.join(dir, manifest.entry);
-  const template = fs.readFileSync(entryPath, 'utf8');
+  // 目标工具：entry 含 SOAK_MARKER；每轮 reload 强推触发 App 热重载（走 bridge 原生推送，不直接碰文件系统）
+  const tool = bridge.store.list()
+    .map((id) => bridge.store.read(id))
+    .find((t) => t?.files.some((f) => f.path === t.manifest.entry && f.content.includes('SOAK_MARKER')));
+  if (!tool) { console.log('[soak] 没有含 SOAK_MARKER 的工具，无法压测'); process.exit(2); }
+  const { manifest } = tool;
   console.log(`[soak] tool=${manifest.id} cycles=${SOAK_N} interval=${SOAK_INTERVAL}ms timeout=${SOAK_TIMEOUT}ms`);
   console.log('[soak] 等待 App 连接…');
   while (bridge.listDevices().filter((d) => d.authed).length === 0) await sleep(200);
@@ -93,7 +87,7 @@ async function runSoak() {
 
   const results = [];
   for (let i = 1; i <= SOAK_N; i++) {
-    fs.writeFileSync(entryPath, template.replace(/SOAK_MARKER/g, `#${i}`)); // 触发 watch → push
+    bridge.reload(manifest.id); // force 重推（无变化也推）→ App 热重载
     const r = await bridge.waitForLoaded(manifest.id, SOAK_TIMEOUT);
     results.push(r);
     console.log(`[soak] ${i}/${SOAK_N} ${r.ok ? `${r.ms}ms` : `FAIL（>${SOAK_TIMEOUT}ms）`}`);