schornai 0.2.0 → 0.3.0

package/dist/service/bootstrap.mjs

@@ -7,7 +7,7 @@ import { dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { r as runServiceCLI, e as extractArchive } from './shared/cli-BxEHldVH.mjs';
+import { r as runServiceCLI, e as extractArchive } from './shared/cli-DwJIziOh.mjs';
 import { i as initConfig, w as writeJson, l as loadConfig, r as resolveFrom, o as object, a as literal, d as defaultConfigPath, s as string, c as createLogger, b as run, e as binary, n as number, f as boolean } from './shared/docker-Dj7cdbkw.mjs';
 import { g as generateSecuritySecrets, h as hasLegacyLayout } from './shared/installer-CWopk_6Z.mjs';
 import { execFile } from 'node:child_process';
@@ -409,6 +409,7 @@ async function runDefaultCLI() {
         console.log(`Downloading schorn.ai setup from ${latestSetupUrl}`);
         const archive = join(temporary, "setup.tar");
         const id = await downloadSetup(archive, signal);
+        console.log("Download complete. Verifying and extracting schorn.ai setup...");
         const payload = join(temporary, "payload");
         await mkdir(payload, { mode: 0o700 });
         const inspected = await extractArchive(archive, payload, id, signal);

package/dist/service/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as runServiceCLI } from './shared/cli-BxEHldVH.mjs';
+import { r as runServiceCLI } from './shared/cli-DwJIziOh.mjs';
 import 'node:util';
 import 'node:fs';
 import 'node:fs/promises';

package/dist/service/commands.mjs

@@ -6,7 +6,7 @@ import 'node:path';
 import 'node:child_process';
 import 'node:timers/promises';
 import './shared/docker-Dj7cdbkw.mjs';
-export { r as runServiceCLI } from './shared/cli-BxEHldVH.mjs';
+export { r as runServiceCLI } from './shared/cli-DwJIziOh.mjs';
 import 'node:os';
 import 'node:crypto';
 import 'node:http';

package/dist/service/shared/{cli-BxEHldVH.mjs → cli-DwJIziOh.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { promisify, isDeepStrictEqual, parseArgs } from 'node:util';
 import u, { createReadStream, existsSync, createWriteStream, openSync, closeSync } from 'node:fs';
-import ro, { mkdir, readFile, mkdtemp, rm, cp, writeFile, rename, statfs, readdir, chmod, stat, open } from 'node:fs/promises';
+import ro, { lstat, readdir, realpath, mkdir, symlink, readlink, unlink, readFile, mkdtemp, rm, cp, writeFile, rename, statfs, chmod, stat, open } from 'node:fs/promises';
 import R, { win32, posix, basename, join, resolve, dirname as dirname$1 } from 'node:path';
 import { execFile, spawn } from 'node:child_process';
 import { setTimeout as setTimeout$1 } from 'node:timers/promises';
@@ -151,6 +151,46 @@ function archivePath(value) {
     }
     return posix.normalize(value).replace(/^\.\//, "");
 }
+function assertRelativeLink(target) {
+    if (!target ||
+        target.startsWith("/") ||
+        target.includes("\\") ||
+        /^[A-Za-z]:/.test(target))
+        throw new Error("XRAG_UNSAFE_LINK");
+}
+async function assertSafeLink(name, link, lookup) {
+    assertRelativeLink(link.target);
+    const resolved = link.hard
+        ? []
+        : posix
+            .dirname(name)
+            .split("/")
+            .filter((part) => part !== ".");
+    const pending = link.target.split("/");
+    let hops = 0;
+    while (pending.length) {
+        const part = pending.shift();
+        if (!part || part === ".")
+            continue;
+        if (part === "..") {
+            if (!resolved.length)
+                throw new Error("XRAG_UNSAFE_LINK");
+            resolved.pop();
+            continue;
+        }
+        const nested = await lookup([...resolved, part].join("/"));
+        if (nested) {
+            assertRelativeLink(nested.target);
+            if (++hops > 40)
+                throw new Error("XRAG_UNSAFE_LINK");
+            if (nested.hard)
+                resolved.length = 0;
+            pending.unshift(...nested.target.split("/"));
+        }
+        else
+            resolved.push(part);
+    }
+}
 /** Stream even very large archives; only small metadata files are held in memory. */
 async function inspectArchive(source, signal) {
     const hash = createHash("sha256");
@@ -178,11 +218,7 @@ async function inspectArchive(source, signal) {
                 names.add(name);
                 if (entry.type === "SymbolicLink" || entry.type === "Link") {
                     const target = entry.linkpath ?? "";
-                    if (!target ||
-                        target.startsWith("/") ||
-                        target.includes("\\") ||
-                        /^[A-Za-z]:/.test(target))
-                        throw new Error("XRAG_UNSAFE_LINK");
+                    assertRelativeLink(target);
                     archivePath(posix.normalize(posix.join(entry.type === "Link" ? "." : posix.dirname(name), target)));
                     links.set(name, { target, hard: entry.type === "Link" });
                 }
@@ -227,37 +263,8 @@ async function inspectArchive(source, signal) {
     }
     // Resolve links component by component: normalizing "link/../x" first can hide
     // an escape when that intermediate link points at an ancestor directory.
-    for (const [name, link] of links) {
-        const resolved = link.hard
-            ? []
-            : posix
-                .dirname(name)
-                .split("/")
-                .filter((part) => part !== ".");
-        const pending = link.target.split("/");
-        let hops = 0;
-        while (pending.length) {
-            const part = pending.shift();
-            if (!part || part === ".")
-                continue;
-            if (part === "..") {
-                if (!resolved.length)
-                    throw new Error("XRAG_UNSAFE_LINK");
-                resolved.pop();
-                continue;
-            }
-            const nested = links.get([...resolved, part].join("/"));
-            if (nested) {
-                if (++hops > 40)
-                    throw new Error("XRAG_UNSAFE_LINK");
-                if (nested.hard)
-                    resolved.length = 0;
-                pending.unshift(...nested.target.split("/"));
-            }
-            else
-                resolved.push(part);
-        }
-    }
+    for (const [name, link] of links)
+        await assertSafeLink(name, link, (path) => links.get(path));
     const xrag = xragSchema.parse(JSON.parse(metadata.get("xrag.json")?.toString("utf8") ?? "null"));
     const required = xrag.xrag_type === "setup"
         ? ["setup.sh", "update.mts", "apps/service/cli.mjs"]
@@ -270,21 +277,85 @@ async function inspectArchive(source, signal) {
                     : [];
     if (required.some((name) => !files.has(name)))
         throw new Error("XRAG_MISSING_PAYLOAD");
-    return { id: hash.digest("hex"), size, xrag, metadata };
+    return { id: hash.digest("hex"), size, xrag, metadata, links };
 }
+/** Extract only into a fresh, private directory owned by the caller. */
 async function extractArchive(file, destination, expectedId, signal) {
+    if (!(await lstat(destination)).isDirectory())
+        throw new Error("XRAG_UNSAFE_DESTINATION");
+    if ((await readdir(destination)).length)
+        throw new Error("XRAG_DESTINATION_NOT_EMPTY");
+    const root = await realpath(destination);
     const result = await inspectArchive(createReadStream(file), signal);
     if (result.id !== expectedId)
         throw new Error("XRAG_CHECKSUM_MISMATCH");
     signal?.throwIfAborted();
+    let extractionError;
     await So({
         file,
-        cwd: destination,
-        strict: true,
+        cwd: root,
+        // tar's strict mode rejects while other entries are still being written.
+        // Keep warnings fatal, but wait for those writes before callers clean up.
+        strict: false,
+        onwarn(code, message, data) {
+            extractionError ??= Object.assign(new Error(`${code}: ${message}`), data);
+        },
         preservePaths: false,
         noChmod: false,
         noMtime: true,
+        // tar rejects even validated in-tree symlink chains. Install these last,
+        // unchanged, so extraction never writes through an archive symlink.
+        filter: (_path, entry) => !("type" in entry && entry.type === "SymbolicLink"),
     });
+    if (extractionError)
+        throw extractionError;
+    signal?.throwIfAborted();
+    const created = [];
+    try {
+        for (const [name, link] of result.links) {
+            if (link.hard)
+                continue;
+            signal?.throwIfAborted();
+            let parent = root;
+            for (const part of posix.dirname(name).split("/")) {
+                if (part === ".")
+                    continue;
+                parent = join(parent, part);
+                await mkdir(parent).catch((error) => {
+                    if (error.code !== "EEXIST")
+                        throw error;
+                });
+                if (!(await lstat(parent)).isDirectory())
+                    throw new Error("XRAG_LINK_PARENT");
+            }
+            const path = join(root, name);
+            await symlink(link.target, path);
+            created.push(path);
+        }
+        // Check actual filesystem resolution too: case/Unicode aliases can make
+        // distinct archive names refer to the same path on macOS.
+        for (const [name, link] of result.links) {
+            if (link.hard)
+                continue;
+            signal?.throwIfAborted();
+            await assertSafeLink(name, link, async (path) => {
+                try {
+                    if (!(await lstat(join(root, path))).isSymbolicLink())
+                        return;
+                    return { target: await readlink(join(root, path)), hard: false };
+                }
+                catch (error) {
+                    if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                        return;
+                    throw error;
+                }
+            });
+        }
+    }
+    catch (error) {
+        await Promise.allSettled(created.map((path) => unlink(path)));
+        throw error;
+    }
     return result;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "schornai",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "The schorn.ai CLI, including machine service commands.",
   "type": "module",
   "bin": {