iterate-skill-installer 3.2.0 → 3.2.2

package/lib/installer.js

@@ -54,6 +54,16 @@ const JSON_MAX_BYTES = 10 * 1024 * 1024; // 10 MiB
 const CHECKSUMS_MAX_BYTES = 1 * 1024 * 1024; // 1 MiB
 const TARBALL_MAX_BYTES = 100 * 1024 * 1024; // 100 MiB
 
+// A strict upper bound for an interactive yes/no prompt. On EOF (piped stdin
+// that ends) or a TTY that stops responding, the prompt must fall back to the
+// default rather than hang the installer forever.
+const ASK_YES_NO_TIMEOUT_MS = 30_000;
+
+// SHA256 digests are exactly 64 lowercase/uppercase hex characters. Any other
+// value in a checksum file is corrupt or tampered and must fail closed rather
+// than feed a garbage hash into the integrity comparison.
+const SHA256_HEX_RE = /^[0-9a-fA-F]{64}$/;
+
 // Curl added --fail-with-body in 7.76. On older curl the installer must fall
 // back to plain --fail so the flag is never rejected by the system curl.
 const CURL_FAIL_WITH_BODY_MIN = { major: 7, minor: 76 };
@@ -242,20 +252,32 @@ function parseChecksums(text) {
   const map = new Map();
   for (const line of text.split(/\r?\n/)) {
     const trimmed = line.trim();
-    if (!trimmed) continue;
+    if (!trimmed || trimmed.startsWith('#')) continue;
     const parts = trimmed.split(/\s+/);
-    if (parts.length >= 2) {
-      // Normalize the filename the same way scripts/install.py does
-      // (_parse_checksum): strip all leading GNU tar binary-mode markers a la
-      // Python's name.lstrip("*") (ONE '*', or several in a malformed entry —
-      // strip them all so the two parsers can never disagree), then strip the
-      // './' prefix, then match on the basename so entries with a subpath or
-      // versioned component (e.g. "dist/iterate-skill.tar.gz" or
-      // "./iterate-skill.tar.gz") still resolve to the expected asset.
-      const normalized = parts[1].replace(/^\*+/, '').replace(/^\.\//, '');
-      const basename = normalized.split('/').pop();
-      map.set(basename, parts[0]);
+    if (parts.length < 2) continue;
+    // Reject any entry whose digest is not a 64-char hex string so a corrupt
+    // or tampered checksum file fails closed: a missing asset ("not found")
+    // aborts the install, whereas a garbage digest would masquerade as a
+    // valid expected hash.
+    if (!SHA256_HEX_RE.test(parts[0])) continue;
+    // Normalize the filename the same way scripts/install.py does
+    // (_parse_checksum): strip all leading GNU tar binary-mode markers a la
+    // Python's name.lstrip("*") (ONE '*', or several in a malformed entry —
+    // strip them all so the two parsers can never disagree), then strip the
+    // './' prefix, then match on the basename so entries with a subpath or
+    // versioned component (e.g. "dist/iterate-skill.tar.gz" or
+    // "./iterate-skill.tar.gz") still resolve to the expected asset.
+    const normalized = parts[1].replace(/^\*+/, '').replace(/^\.\//, '');
+    const basename = normalized.split('/').pop();
+    // A duplicate basename carrying a *different* digest is a red flag (the
+    // file is hand-corrupted or two sources disagree); refuse the whole file
+    // instead of silently letting one value win.
+    if (map.has(basename) && map.get(basename) !== parts[0]) {
+      throw new InstallerError(
+        `Duplicate checksum entry for ${basename} with a different value — refusing to proceed.`,
+      );
     }
+    map.set(basename, parts[0]);
   }
   return map;
 }
@@ -463,18 +485,32 @@ async function installCli(pythonBin, sourceDir) {
  *
  * Used to decide whether the current directory should be treated as the
  * target project when the installer is launched from a non-home directory.
- * Falls back to ``defaultNo`` if the input is unrecognized.
+ * Falls back to ``defaultNo`` if the input is unrecognized, on EOF (piped
+ * stdin that ends without an answer) or after a timeout, so a non-interactive
+ * or hung invocation resolves instead of blocking forever.
  */
 function askYesNo(question, defaultNo = false) {
   return new Promise((resolve) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const hint = defaultNo ? '[y/N]' : '[Y/n]';
-    rl.question(`\x1b[36m◆\x1b[0m  ${question} ${hint} `, (answer) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
       rl.close();
+      resolve(value);
+    };
+    // EOF (stdin is a closed pipe, or the terminal disappears) never invokes
+    // rl.question's callback; the interface 'close' event is the signal that
+    // no answer is coming, so fall back to the default instead of hanging.
+    rl.on('close', () => finish(defaultNo));
+    const timer = setTimeout(() => finish(defaultNo), ASK_YES_NO_TIMEOUT_MS);
+    rl.question(`\x1b[36m◆\x1b[0m  ${question} ${hint} `, (answer) => {
       const a = answer.trim().toLowerCase();
-      if (a === 'y' || a === 'yes') resolve(true);
-      else if (a === 'n' || a === 'no') resolve(false);
-      else resolve(defaultNo);
+      if (a === 'y' || a === 'yes') finish(true);
+      else if (a === 'n' || a === 'no') finish(false);
+      else finish(defaultNo);
     });
   });
 }
@@ -569,6 +605,18 @@ function parseArgs(argv) {
     const arg = argv[i];
     const next = argv[i + 1];
 
+    // -h/--help and -v/--version short-circuit parsing: later arguments (even
+    // malformed or value-consuming flags) must not turn `--help`/`--version`
+    // into an error exit. bin/cli.js exits 0 on these modes before installing.
+    if (arg === '--help' || arg === '-h') {
+      options.mode = 'help';
+      break;
+    }
+    if (arg === '--version' || arg === '-v') {
+      options.mode = 'version';
+      break;
+    }
+
     switch (arg) {
       case '--ai':
         if (!next || next.startsWith('-')) {
@@ -607,16 +655,6 @@ function parseArgs(argv) {
         // user who only wants the skill is not surprised by a global install.
         options.noCli = true;
         break;
-      case '--help':
-      case '-h':
-        // Show usage and exit 0 (handled by bin/cli.js).
-        options.mode = 'help';
-        break;
-      case '--version':
-      case '-v':
-        // Print the package version and exit 0 (handled by bin/cli.js).
-        options.mode = 'version';
-        break;
       case '--token':
         if (!next || next.startsWith('-')) {
           console.error('Error: --token requires a value (a flag was found instead)');

package/package.json

@@ -1,11 +1,17 @@
 {
   "name": "iterate-skill-installer",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "description": "One-command installer for iterate-skill across AI coding assistants",
   "main": "lib/installer.js",
+  "files": [
+    "bin/",
+    "lib/",
+    "LICENSE",
+    "README.md",
+    "README.zh-CN.md"
+  ],
   "bin": {
-    "iterate-skill-installer": "bin/cli.js",
-    "iterate-skill": "bin/cli.js"
+    "iterate-skill-installer": "bin/cli.js"
   },
   "scripts": {
     "test": "node --check bin/cli.js && node --check lib/installer.js && node test/mode.test.js"

package/test/mode.test.js

@@ -1,231 +0,0 @@
-/**
- * Unit tests for resolveInstallMode() — the global vs project install-mode
- * decision — and parseChecksums() — the SHA256SUMS.txt parser — in the npx
- * installer. Uses node:assert so no extra test runner is required; run via
- * `npm test`.
- */
-
-const assert = require('node:assert');
-const fs = require('node:fs');
-const path = require('node:path');
-const os = require('node:os');
-const { resolveInstallMode, parseChecksums, parseArgs, buildPythonInstallArgs, isGithubApiUrl } = require('../lib/installer');
-
-const originalCwd = process.cwd();
-const originalHome = os.homedir;
-
-/**
- * Temporarily set the home directory and chdir into a fresh temp directory
- * (the "current working directory"), then run fn(cwd). Always restores state.
- */
-function withHomeAndCwd(home, fn) {
-  return (async () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'iterate-mode-'));
-    os.homedir = () => home;
-    process.chdir(cwd);
-    try {
-      return await fn(cwd);
-    } finally {
-      os.homedir = originalHome;
-      process.chdir(originalCwd);
-      fs.rmSync(cwd, { recursive: true, force: true });
-    }
-  })();
-}
-
-async function run() {
-  // 1) Explicit --target is honored without asking.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: '/x', targetExplicit: true, globalExplicit: false };
-    const ask = () => { throw new Error('should not ask'); };
-    const out = await resolveInstallMode(opts, ask);
-    assert.strictEqual(out.target, '/x', 'target should be preserved');
-    assert.strictEqual(out.global, true, 'global should be left untouched for explicit target');
-  });
-
-  // 2) Explicit --global is honored without asking.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: true };
-    const ask = () => { throw new Error('should not ask'); };
-    const out = await resolveInstallMode(opts, ask);
-    assert.strictEqual(out.global, true, 'global should be preserved');
-    assert.strictEqual(out.target, null, 'target should stay null');
-  });
-
-  // 3) cwd === home: no ask, stays global.
-  await withHomeAndCwd('/home/u', async () => {
-    // Use process.cwd() (the resolved path) so home matches cwd exactly,
-    // avoiding macOS /var -> /private/var symlink mismatches.
-    os.homedir = () => process.cwd();
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: false };
-    const ask = () => { throw new Error('should not ask when cwd is home'); };
-    const out = await resolveInstallMode(opts, ask);
-    assert.strictEqual(out.global, true, 'should stay global when cwd is home');
-  });
-
-  // 4) cwd !== home and user says yes -> project-level install into cwd.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: false };
-    const out = await resolveInstallMode(opts, async () => true);
-    assert.strictEqual(out.global, false, 'should switch to project mode');
-    assert.strictEqual(out.target, process.cwd(), 'target should be cwd');
-  });
-
-  // 5) cwd !== home and user says no -> stays global.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: false };
-    const out = await resolveInstallMode(opts, async () => false);
-    assert.strictEqual(out.global, true, 'should stay global when user declines');
-    assert.strictEqual(out.target, null, 'target should stay null');
-  });
-
-  console.log('mode.test.js: all resolveInstallMode tests passed');
-
-  // parseChecksums: must strip the GNU tar binary-mode marker ('*') so both
-  // "HASH  name" and "HASH *name" formats resolve, matching the Python side.
-  const plain = parseChecksums('abc123  iterate-skill.tar.gz\n');
-  assert.strictEqual(plain.get('iterate-skill.tar.gz'), 'abc123', 'plain format should parse');
-
-  const starred = parseChecksums('def456 *iterate-skill.tar.gz\n');
-  assert.strictEqual(starred.get('iterate-skill.tar.gz'), 'def456', 'starred format should strip the * marker');
-
-  const crlf = parseChecksums('abc123  iterate-skill.tar.gz\r\n');
-  assert.strictEqual(crlf.get('iterate-skill.tar.gz'), 'abc123', 'CRLF line endings should parse');
-
-  const multi = parseChecksums('aa  a.txt\nbb  b.txt\n');
-  assert.strictEqual(multi.get('a.txt'), 'aa');
-  assert.strictEqual(multi.get('b.txt'), 'bb');
-
-  // './' prefix and subpath/basename matching must resolve like the Python
-  // side (scripts/install.py _parse_checksum), which matches on basename.
-  const dotSlash = parseChecksums('abc123  ./iterate-skill.tar.gz\n');
-  assert.strictEqual(dotSlash.get('iterate-skill.tar.gz'), 'abc123', './ prefix should parse');
-
-  const subpath = parseChecksums('abc123  dist/iterate-skill.tar.gz\n');
-  assert.strictEqual(subpath.get('iterate-skill.tar.gz'), 'abc123', 'subpath entries should match by basename');
-
-  const starredSubpath = parseChecksums('abc123  *./release/iterate-skill-1.2.3.tar.gz\n');
-  assert.strictEqual(starredSubpath.get('iterate-skill-1.2.3.tar.gz'), 'abc123', '*./ and versioned subpath should match by basename');
-
-  // Multiple leading '*' markers must be stripped like Python's lstrip("*")
-  // (a malformed entry must never leave a leading '*' in the basename).
-  const multiStar = parseChecksums('abc123  **iterate-skill.tar.gz\n');
-  assert.strictEqual(multiStar.get('iterate-skill.tar.gz'), 'abc123', 'all leading * markers should strip (lstrip matching)');
-
-  console.log('mode.test.js: all parseChecksums tests passed');
-
-  // parseArgs: --no-cli must toggle skill-only mode, and default to off.
-  assert.strictEqual(parseArgs([]).noCli, false, 'noCli should default to false');
-  assert.strictEqual(parseArgs(['--no-cli']).noCli, true, '--no-cli should set noCli');
-  assert.strictEqual(parseArgs(['--no-cli', '--force', '--global']).noCli, true, 'noCli persists with other flags');
-  assert.strictEqual(parseArgs(['--global']).noCli, false, 'unrelated flags do not set noCli');
-
-  // parseArgs: unrelated flag surface is preserved (target/global/ai/force).
-  const combo = parseArgs(['--ai', 'trae', '--target', '/proj', '--force']);
-  assert.strictEqual(combo.ai, 'trae', 'ai should parse');
-  assert.strictEqual(combo.target, '/proj', 'target should parse');
-  assert.strictEqual(combo.force, true, 'force should parse');
-  assert.strictEqual(combo.global, false, 'target forces project mode');
-
-  // parseArgs: --version/-v/--help/-h must set the corresponding mode instead
-  // of falling through to the unknown-option error.
-  assert.strictEqual(parseArgs([]).mode, null, 'mode should default to null');
-  assert.strictEqual(parseArgs(['--version']).mode, 'version', '--version should set version mode');
-  assert.strictEqual(parseArgs(['-v']).mode, 'version', '-v should set version mode');
-  assert.strictEqual(parseArgs(['--help']).mode, 'help', '--help should set help mode');
-  assert.strictEqual(parseArgs(['-h']).mode, 'help', '-h should set help mode');
-
-  // parseArgs: value-consuming flags must reject a following flag as their
-  // value instead of silently swallowing it (regression: `--ai --force`
-  // previously set ai='--force' and misled the Python side with an invalid
-  // choice). process.exit is stubbed so the error path is assertable.
-  const origExit = process.exit;
-  process.exit = (code) => {
-    throw new Error(`exit(${code})`);
-  };
-  try {
-    assert.throws(() => parseArgs(['--ai', '--force']), /exit\(1\)/, '--ai must reject a flag as its value');
-    assert.throws(() => parseArgs(['--target', '--global']), /exit\(1\)/, '--target must reject a flag as its value');
-    assert.throws(() => parseArgs(['--token', '--yes']), /exit\(1\)/, '--token must reject a flag as its value');
-    assert.throws(() => parseArgs(['--ai']), /exit\(1\)/, '--ai without a value must error');
-    assert.throws(() => parseArgs(['--token']), /exit\(1\)/, '--token without a value must error');
-  } finally {
-    process.exit = origExit;
-  }
-
-  // parseArgs: a bare positional argument must produce a warning instead of
-  // being silently ignored (fix: typos like "npx iterate-skill-installer trae").
-  const origLog = console.log;
-  const warnings = [];
-  console.log = (msg) => { warnings.push(msg); };
-  try {
-    const opts = parseArgs(['trae', '--force']);
-    assert.strictEqual(opts.force, true, 'known flags still parse alongside positionals');
-    assert.ok(
-      warnings.some((w) => w.includes('Ignoring unexpected positional argument: trae')),
-      `positional arg should warn, got: ${JSON.stringify(warnings)}`,
-    );
-  } finally {
-    console.log = origLog;
-  }
-
-  // parseArgs: --global + --target together must warn that the later flag wins.
-  const conflictLogs = [];
-  console.log = (msg) => { conflictLogs.push(msg); };
-  try {
-    const targetThenGlobal = parseArgs(['--target', '/proj', '--global']);
-    assert.strictEqual(targetThenGlobal.global, true, 'later --global wins');
-    assert.strictEqual(targetThenGlobal.target, null, 'later --global clears the target');
-    assert.ok(
-      conflictLogs.some((w) => w.includes('--global overrides --target')),
-      `conflict should warn, got: ${JSON.stringify(conflictLogs)}`,
-    );
-    const globalThenTarget = parseArgs(['--global', '--target', '/proj']);
-    assert.strictEqual(globalThenTarget.global, false, 'later --target wins');
-    assert.strictEqual(globalThenTarget.target, '/proj', 'later --target is kept');
-    assert.ok(
-      conflictLogs.some((w) => w.includes('--target overrides --global')),
-      `conflict should warn, got: ${JSON.stringify(conflictLogs)}`,
-    );
-  } finally {
-    console.log = origLog;
-  }
-
-  console.log('mode.test.js: all parseArgs tests passed');
-
-  // buildPythonInstallArgs: a relative --target must be resolved against the
-  // current working directory (the Python installer runs with a different
-  // cwd, so the raw relative path would point at the wrong place).
-  const resolved = buildPythonInstallArgs({ ai: 'trae', target: 'rel/sub', force: true, globalInstall: false });
-  assert.deepStrictEqual(
-    resolved,
-    ['--ai', 'trae', '--target', path.resolve('rel/sub'), '--force'],
-    'relative --target should be resolved against cwd',
-  );
-  const globalArgs = buildPythonInstallArgs({ ai: null, target: null, force: false, globalInstall: true });
-  assert.deepStrictEqual(globalArgs, ['--global'], 'global flag should be forwarded');
-  assert.deepStrictEqual(
-    buildPythonInstallArgs({ ai: null, target: '/abs/target', force: false, globalInstall: false }),
-    ['--target', '/abs/target'],
-    'absolute --target is passed through unchanged',
-  );
-  assert.deepStrictEqual(buildPythonInstallArgs({ ai: null, target: null, force: false, globalInstall: false }), [], 'no flags -> empty argv');
-
-  console.log('mode.test.js: all buildPythonInstallArgs tests passed');
-
-  // isGithubApiUrl: the caller's PAT must only ever be attached to the
-  // api.github.com host — never to public release-asset / other URLs
-  // (credential surface minimalism, mirroring scripts/install.py).
-  assert.strictEqual(isGithubApiUrl('https://api.github.com/repos/jingzhao-l/iterate-skill/releases/latest'), true, 'api host should match');
-  assert.strictEqual(isGithubApiUrl('https://api.github.com.evil.com/x'), false, 'lookalike host must not match');
-  assert.strictEqual(isGithubApiUrl('https://release-assets.githubusercontent.com/foo.tar.gz'), false, 'asset host must not receive the token');
-  assert.strictEqual(isGithubApiUrl('https://github.com/x'), false, 'github.com is not the API host');
-  assert.strictEqual(isGithubApiUrl('not a url'), false, 'malformed url must not match');
-
-  console.log('mode.test.js: all isGithubApiUrl tests passed');
-}
-
-run().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});