molt-cli 1.0.1 → 1.0.3

package/cli.js

@@ -120,10 +120,16 @@ function signMessage(message, privateKeyBase64) {
 
 function computeProofOfWork(publicKey) {
   let nonce = 0;
+  const startTime = Date.now();
   while (true) {
     const hash = crypto.createHash('sha256').update(publicKey + nonce).digest('hex');
-    if (hash.startsWith('0000')) return nonce;
+    if (hash.startsWith('000000')) return nonce; // 6 zeros ≈ 5-15 seconds
     nonce++;
+    // Safety: log progress every 5M hashes
+    if (nonce % 5000000 === 0) {
+      const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+      process.stdout.write(`\r  Mining proof-of-work... ${(nonce / 1000000).toFixed(0)}M hashes (${elapsed}s)`);
+    }
   }
 }
 
@@ -332,13 +338,45 @@ function extractTarGz(tarGzPath, destDir) {
     const extract = tar.extract();
     const gunzip = zlib.createGunzip();
 
+    const MAX_EXTRACTED_SIZE = 50 * 1024 * 1024; // 50MB max decompressed
+    const MAX_FILES = 500; // max files in package
+    let totalSize = 0;
+    let fileCount = 0;
+    const resolvedDest = path.resolve(destDir);
+
     extract.on('entry', (header, stream, next) => {
-      const filePath = path.join(destDir, header.name);
+      fileCount++;
+      if (fileCount > MAX_FILES) {
+        stream.destroy();
+        return reject(new Error(`Too many files in package (max ${MAX_FILES}). Aborting.`));
+      }
+
+      // Path traversal protection: resolve and verify within destDir
+      const filePath = path.resolve(destDir, header.name);
+      if (!filePath.startsWith(resolvedDest + path.sep) && filePath !== resolvedDest) {
+        stream.resume(); // skip malicious entry
+        console.log(`  ${C.red}⚠ Skipping suspicious path: ${header.name}${C.reset}`);
+        return next();
+      }
+
+      // Skip symlinks (potential attack vector)
+      if (header.type === 'symlink' || header.type === 'link') {
+        stream.resume();
+        return next();
+      }
+
       if (header.type === 'directory') {
         fs.mkdirSync(filePath, { recursive: true });
         stream.resume();
         next();
       } else {
+        // Tar bomb protection: track decompressed size
+        totalSize += header.size || 0;
+        if (totalSize > MAX_EXTRACTED_SIZE) {
+          stream.destroy();
+          return reject(new Error(`Package too large when extracted (>${MAX_EXTRACTED_SIZE / 1024 / 1024}MB). Possible tar bomb.`));
+        }
+
         fs.mkdirSync(path.dirname(filePath), { recursive: true });
         const out = fs.createWriteStream(filePath);
         stream.pipe(out);
@@ -858,7 +896,9 @@ async function cmdInstall(skillName) {
     console.log(`  ${C.dim}Installed to: ${C.cyan}${path.relative(process.cwd(), destDir) || destDir}${C.reset}`);
     console.log();
   } catch (err) {
-    errorMsg(err.error || 'Install failed', err.hint);
+    // Clear any active spinners before showing error
+    process.stdout.write('\r\x1b[K');
+    errorMsg(err.error || err.message || 'Install failed', err.hint);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "molt-cli",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "CLI for MolTunes — the AI agent skill marketplace",
   "main": "cli.js",
   "bin": {