typescript-virtual-container 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/dist/SSHMimic/exec.d.ts.map +1 -1
  2. package/dist/SSHMimic/exec.js +8 -2
  3. package/dist/SSHMimic/index.d.ts +1 -0
  4. package/dist/SSHMimic/index.d.ts.map +1 -1
  5. package/dist/SSHMimic/index.js +9 -3
  6. package/dist/SSHMimic/sftp.d.ts +46 -0
  7. package/dist/SSHMimic/sftp.d.ts.map +1 -0
  8. package/dist/SSHMimic/sftp.js +576 -0
  9. package/dist/VirtualFileSystem/index.d.ts +6 -4
  10. package/dist/VirtualFileSystem/index.d.ts.map +1 -1
  11. package/dist/VirtualFileSystem/index.js +144 -153
  12. package/dist/VirtualShell/index.d.ts +6 -0
  13. package/dist/VirtualShell/index.d.ts.map +1 -1
  14. package/dist/VirtualShell/index.js +16 -4
  15. package/dist/VirtualShell/shell.d.ts.map +1 -1
  16. package/dist/VirtualShell/shell.js +7 -0
  17. package/dist/VirtualUserManager/index.d.ts +1 -0
  18. package/dist/VirtualUserManager/index.d.ts.map +1 -1
  19. package/dist/VirtualUserManager/index.js +15 -0
  20. package/dist/commands/exit.d.ts.map +1 -1
  21. package/dist/commands/exit.js +1 -0
  22. package/dist/index.d.ts +2 -2
  23. package/dist/index.d.ts.map +1 -1
  24. package/dist/index.js +2 -2
  25. package/dist/standalone.js +10 -1
  26. package/package.json +1 -1
  27. package/src/SSHMimic/exec.ts +18 -12
  28. package/src/SSHMimic/index.ts +16 -7
  29. package/src/SSHMimic/sftp.ts +833 -0
  30. package/src/VirtualFileSystem/index.ts +158 -188
  31. package/src/VirtualShell/index.ts +19 -8
  32. package/src/VirtualShell/shell.ts +7 -0
  33. package/src/VirtualUserManager/index.ts +20 -0
  34. package/src/commands/exit.ts +1 -0
  35. package/src/index.ts +2 -1
  36. package/src/standalone.ts +11 -1
  37. package/tests/sftp.test.ts +319 -0
  38. package/tests/ssh-exec.test.ts +45 -0
@@ -0,0 +1,576 @@
1
+ /** biome-ignore-all lint/style/useNamingConvention: const as enum */
2
+ import * as path from "node:path";
3
+ import { Server as SshServer } from "ssh2";
4
+ import { VirtualShell } from "../VirtualShell";
5
+ import { loadOrCreateHostKey } from "./hostKey";
6
+ const SFTP_STATUS_CODE = {
7
+ OK: 0,
8
+ EOF: 1,
9
+ NO_SUCH_FILE: 2,
10
+ PERMISSION_DENIED: 3,
11
+ FAILURE: 4,
12
+ BAD_MESSAGE: 5,
13
+ NO_CONNECTION: 6,
14
+ CONNECTION_LOST: 7,
15
+ OP_UNSUPPORTED: 8,
16
+ };
17
+ const OPEN_MODE = {
18
+ READ: 0x00000001,
19
+ WRITE: 0x00000002,
20
+ APPEND: 0x00000004,
21
+ CREAT: 0x00000008,
22
+ TRUNC: 0x00000010,
23
+ EXCL: 0x00000020,
24
+ };
25
+ export class SftpMimic {
26
+ port;
27
+ server;
28
+ hostname;
29
+ shell;
30
+ vfs;
31
+ users;
32
+ nextHandleId = 0;
33
+ handles = new Map();
34
+ constructor({ port, hostname = "typescript-vm", shell, vfs, users, }) {
35
+ this.port = port;
36
+ this.server = null;
37
+ this.hostname = hostname;
38
+ this.shell = null;
39
+ if (shell) {
40
+ this.vfs = shell.vfs;
41
+ this.users = shell.users;
42
+ this.hostname = shell.hostname;
43
+ this.shell = shell;
44
+ }
45
+ else if (vfs && users) {
46
+ this.vfs = vfs;
47
+ this.users = users;
48
+ }
49
+ else {
50
+ const defaultShell = new VirtualShell(hostname);
51
+ this.vfs = defaultShell.vfs;
52
+ this.users = defaultShell.users;
53
+ this.shell = defaultShell;
54
+ }
55
+ }
56
+ getVfs() {
57
+ return this.shell?.vfs ?? this.vfs;
58
+ }
59
+ getUsers() {
60
+ return this.shell?.users ?? this.users;
61
+ }
62
+ async start() {
63
+ const privateKey = loadOrCreateHostKey();
64
+ // Ensure VirtualShell is fully initialized before accepting connections
65
+ if (this.shell) {
66
+ await this.shell.ensureInitialized();
67
+ }
68
+ else {
69
+ // If using standalone VFS+Users, initialize users now
70
+ await this.users.initialize();
71
+ }
72
+ this.server = new SshServer({
73
+ hostKeys: [privateKey],
74
+ ident: `SSH-2.0-${this.hostname}`,
75
+ }, (client) => {
76
+ const allowedAuthMethods = [
77
+ "password",
78
+ "keyboard-interactive",
79
+ ];
80
+ let authUser = "root";
81
+ let sessionId = null;
82
+ let remoteAddress = "unknown";
83
+ // Add error handling for the client
84
+ client.on("error", (error) => {
85
+ console.error(`[SFTP] Client error:`, error);
86
+ });
87
+ const acceptSession = (username) => {
88
+ authUser = username;
89
+ sessionId = this.getUsers().registerSession(authUser, remoteAddress).id;
90
+ const homeRoot = "/home";
91
+ if (!this.getVfs().exists(homeRoot)) {
92
+ this.getVfs().mkdir(homeRoot, 0o755);
93
+ }
94
+ const homePath = `/home/${authUser}`;
95
+ if (!this.getVfs().exists(homePath)) {
96
+ this.getVfs().mkdir(homePath, 0o755);
97
+ this.getVfs().writeFile(`${homePath}/README.txt`, `Welcome to ${this.hostname}`);
98
+ void this.getVfs().flushMirror();
99
+ }
100
+ };
101
+ client.on("authentication", (ctx) => {
102
+ const candidateUser = ctx.username || "root";
103
+ remoteAddress = ctx.ip ?? remoteAddress;
104
+ console.log(`[SFTP] Auth attempt: user=${candidateUser}, method=${ctx.method}, ip=${remoteAddress}`);
105
+ if (ctx.method === "password") {
106
+ if (!this.getUsers().verifyPassword(candidateUser, ctx.password ?? "")) {
107
+ ctx.reject(allowedAuthMethods);
108
+ return;
109
+ }
110
+ acceptSession(candidateUser);
111
+ ctx.accept();
112
+ return;
113
+ }
114
+ if (ctx.method === "keyboard-interactive") {
115
+ const keyboardCtx = ctx;
116
+ keyboardCtx.prompt([{ prompt: "Password: ", echo: false }], (answers) => {
117
+ const password = answers[0] ?? "";
118
+ if (!this.getUsers().verifyPassword(candidateUser, password)) {
119
+ keyboardCtx.reject(allowedAuthMethods);
120
+ return;
121
+ }
122
+ acceptSession(candidateUser);
123
+ keyboardCtx.accept();
124
+ });
125
+ return;
126
+ }
127
+ ctx.reject(allowedAuthMethods);
128
+ });
129
+ client.on("close", () => {
130
+ this.getUsers().unregisterSession(sessionId);
131
+ sessionId = null;
132
+ });
133
+ client.on("ready", () => {
134
+ client.on("session", (accept, _reject) => {
135
+ const session = accept();
136
+ // Add error handling for the session
137
+ session.on("error", (error) => {
138
+ console.error(`[SFTP] Session error for user=${authUser}:`, error);
139
+ });
140
+ session.on("sftp", (acceptSftp) => {
141
+ const sftp = acceptSftp();
142
+ this.attachSftpHandlers(sftp, authUser);
143
+ });
144
+ });
145
+ });
146
+ });
147
+ return new Promise((resolve, reject) => {
148
+ this.server?.once("error", (err) => reject(err));
149
+ this.server?.listen(this.port, "0.0.0.0", () => {
150
+ const address = this.server?.address();
151
+ const actualPort = address && typeof address === "object" && "port" in address
152
+ ? address.port
153
+ : this.port;
154
+ console.log(`SFTP Mimic listening on port ${actualPort}`);
155
+ resolve(actualPort);
156
+ });
157
+ });
158
+ }
159
+ stop() {
160
+ if (this.server) {
161
+ this.server.close(() => {
162
+ console.log("SFTP Mimic stopped");
163
+ });
164
+ }
165
+ }
166
+ /**
167
+ * Resolves SFTP request paths with proper handling of relative paths.
168
+ * Relative paths (including ".") are resolved relative to the user's home directory.
169
+ * This is standard SFTP behavior where the "working directory" is always the home.
170
+ */
171
+ resolveRequestPath(requestPath, authUser) {
172
+ const homePath = `/home/${authUser}`;
173
+ // Empty path or "." → resolve to home directory
174
+ if (!requestPath || requestPath === ".") {
175
+ return homePath;
176
+ }
177
+ // Relative path (doesn't start with "/") → resolve relative to home
178
+ if (!requestPath.startsWith("/")) {
179
+ const joined = path.posix.join(homePath, requestPath);
180
+ return path.posix.normalize(joined);
181
+ }
182
+ // Absolute path → just normalize it
183
+ return path.posix.normalize(requestPath);
184
+ }
185
+ /**
186
+ * Verifies that a target path is confined within the user's home directory.
187
+ * This implements chroot-like behavior for security.
188
+ * @param targetPath - The normalized target path
189
+ * @param authUser - The authenticated username
190
+ * @returns true if path is within home, false if traversal attempt detected
191
+ */
192
+ isPathWithinHome(targetPath, authUser) {
193
+ const homePath = `/home/${authUser}`;
194
+ const normalized = path.posix.normalize(targetPath);
195
+ // Allow access to home directory itself
196
+ if (normalized === homePath) {
197
+ return true;
198
+ }
199
+ // Check if path is within home directory (starts with /home/username/)
200
+ if (normalized.startsWith(`${homePath}/`)) {
201
+ return true;
202
+ }
203
+ // Reject any attempt to escape home directory
204
+ return false;
205
+ }
206
+ createAttrs(node) {
207
+ const permissions = node.mode & 0o777;
208
+ const fileType = node.type === "directory" ? 0o040000 : 0o100000;
209
+ return {
210
+ mode: fileType | permissions,
211
+ size: node.type === "file" ? node.size : 0,
212
+ uid: 0,
213
+ gid: 0,
214
+ atime: Math.floor(node.createdAt.getTime() / 1000),
215
+ mtime: Math.floor(node.updatedAt.getTime() / 1000),
216
+ };
217
+ }
218
+ openHandle(handleValue) {
219
+ const handleId = ++this.nextHandleId;
220
+ const handle = Buffer.alloc(4);
221
+ handle.writeUInt32BE(handleId, 0);
222
+ this.handles.set(handle.toString("hex"), handleValue);
223
+ return handle;
224
+ }
225
+ getHandle(handle) {
226
+ return this.handles.get(handle.toString("hex"));
227
+ }
228
+ closeHandle(handle) {
229
+ this.handles.delete(handle.toString("hex"));
230
+ }
231
+ attachSftpHandlers(sftp, authUser) {
232
+ const getVfs = () => this.getVfs();
233
+ const getUsers = () => this.getUsers();
234
+ sftp.on("OPEN", (reqid, filename, flags) => {
235
+ const targetPath = this.resolveRequestPath(filename, authUser);
236
+ // Security: Confine to home directory
237
+ if (!this.isPathWithinHome(targetPath, authUser)) {
238
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
239
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
240
+ return;
241
+ }
242
+ const openMode = flags;
243
+ const _canRead = Boolean(openMode & OPEN_MODE.READ);
244
+ const _canWrite = Boolean(openMode & OPEN_MODE.WRITE || openMode & OPEN_MODE.APPEND);
245
+ const canCreate = Boolean(openMode & OPEN_MODE.CREAT);
246
+ const shouldTruncate = Boolean(openMode & OPEN_MODE.TRUNC);
247
+ try {
248
+ if (!getVfs().exists(targetPath)) {
249
+ if (!canCreate) {
250
+ sftp.status(reqid, SFTP_STATUS_CODE.NO_SUCH_FILE);
251
+ return;
252
+ }
253
+ getVfs().writeFile(targetPath, Buffer.alloc(0));
254
+ }
255
+ const stats = getVfs().stat(targetPath);
256
+ if (stats.type === "directory") {
257
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
258
+ return;
259
+ }
260
+ let buffer = Buffer.from(getVfs().readFile(targetPath), "utf8");
261
+ if (shouldTruncate) {
262
+ buffer = Buffer.alloc(0);
263
+ }
264
+ if (openMode & OPEN_MODE.APPEND) {
265
+ const handle = this.openHandle({
266
+ type: "file",
267
+ path: targetPath,
268
+ flags: openMode,
269
+ buffer,
270
+ });
271
+ sftp.handle(reqid, handle);
272
+ return;
273
+ }
274
+ const handle = this.openHandle({
275
+ type: "file",
276
+ path: targetPath,
277
+ flags: openMode,
278
+ buffer,
279
+ });
280
+ sftp.handle(reqid, handle);
281
+ }
282
+ catch (error) {
283
+ console.error("SFTP OPEN error:", error);
284
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
285
+ }
286
+ });
287
+ sftp.on("READ", (reqid, handle, offset, length) => {
288
+ const entry = this.getHandle(handle);
289
+ if (!entry || entry.type !== "file") {
290
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
291
+ return;
292
+ }
293
+ if (offset >= entry.buffer.length) {
294
+ sftp.status(reqid, SFTP_STATUS_CODE.EOF);
295
+ return;
296
+ }
297
+ const chunk = entry.buffer.slice(offset, offset + length);
298
+ sftp.data(reqid, chunk);
299
+ });
300
+ sftp.on("WRITE", async (reqid, handle, offset, data) => {
301
+ const entry = this.getHandle(handle);
302
+ if (!entry || entry.type !== "file") {
303
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
304
+ return;
305
+ }
306
+ const end = offset + data.length;
307
+ if (end > entry.buffer.length) {
308
+ const nextBuffer = Buffer.alloc(end);
309
+ entry.buffer.copy(nextBuffer, 0, 0, entry.buffer.length);
310
+ entry.buffer = nextBuffer;
311
+ }
312
+ data.copy(entry.buffer, offset);
313
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
314
+ });
315
+ sftp.on("FSTAT", (reqid, handle) => {
316
+ const entry = this.getHandle(handle);
317
+ if (!entry) {
318
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
319
+ return;
320
+ }
321
+ try {
322
+ const stats = getVfs().stat(entry.path);
323
+ sftp.attrs(reqid, this.createAttrs(stats));
324
+ }
325
+ catch {
326
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
327
+ }
328
+ });
329
+ sftp.on("CLOSE", async (reqid, handle) => {
330
+ const entry = this.getHandle(handle);
331
+ if (!entry) {
332
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
333
+ return;
334
+ }
335
+ if (entry.type === "file") {
336
+ try {
337
+ getUsers().assertWriteWithinQuota(authUser, entry.path, entry.buffer);
338
+ getVfs().writeFile(entry.path, entry.buffer);
339
+ void getVfs().flushMirror();
340
+ }
341
+ catch (error) {
342
+ console.error("SFTP CLOSE write error:", error);
343
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
344
+ this.closeHandle(handle);
345
+ return;
346
+ }
347
+ }
348
+ this.closeHandle(handle);
349
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
350
+ });
351
+ sftp.on("OPENDIR", (reqid, requestPath) => {
352
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
353
+ // Security: Confine to home directory
354
+ if (!this.isPathWithinHome(targetPath, authUser)) {
355
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
356
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
357
+ return;
358
+ }
359
+ try {
360
+ const stats = getVfs().stat(targetPath);
361
+ if (stats.type !== "directory") {
362
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
363
+ return;
364
+ }
365
+ const entries = getVfs().list(targetPath);
366
+ const handle = this.openHandle({
367
+ type: "dir",
368
+ path: targetPath,
369
+ entries,
370
+ index: 0,
371
+ });
372
+ sftp.handle(reqid, handle);
373
+ }
374
+ catch {
375
+ sftp.status(reqid, SFTP_STATUS_CODE.NO_SUCH_FILE);
376
+ }
377
+ });
378
+ sftp.on("READDIR", (reqid, handle) => {
379
+ const entry = this.getHandle(handle);
380
+ if (!entry || entry.type !== "dir") {
381
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
382
+ return;
383
+ }
384
+ if (entry.index >= entry.entries.length) {
385
+ sftp.status(reqid, SFTP_STATUS_CODE.EOF);
386
+ return;
387
+ }
388
+ const filename = entry.entries[entry.index++];
389
+ const filePath = path.posix.join(entry.path, filename);
390
+ const stats = getVfs().stat(filePath);
391
+ const attrs = this.createAttrs(stats);
392
+ const longname = `${stats.type === "directory" ? "d" : "-"}${(stats.mode & 0o777).toString(8)} ${filename}`;
393
+ return sftp.name(reqid, [{ filename, longname, attrs }]);
394
+ });
395
+ sftp.on("STAT", (reqid, requestPath) => {
396
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
397
+ // Security: Confine to home directory
398
+ if (!this.isPathWithinHome(targetPath, authUser)) {
399
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
400
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
401
+ return;
402
+ }
403
+ try {
404
+ const stats = getVfs().stat(targetPath);
405
+ sftp.attrs(reqid, this.createAttrs(stats));
406
+ }
407
+ catch {
408
+ sftp.status(reqid, SFTP_STATUS_CODE.NO_SUCH_FILE);
409
+ }
410
+ });
411
+ sftp.on("LSTAT", (reqid, requestPath) => {
412
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
413
+ // Security: Confine to home directory
414
+ if (!this.isPathWithinHome(targetPath, authUser)) {
415
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
416
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
417
+ return;
418
+ }
419
+ try {
420
+ const stats = getVfs().stat(targetPath);
421
+ sftp.attrs(reqid, this.createAttrs(stats));
422
+ }
423
+ catch {
424
+ sftp.status(reqid, SFTP_STATUS_CODE.NO_SUCH_FILE);
425
+ }
426
+ });
427
+ sftp.on("FSETSTAT", (reqid, handle, attrs) => {
428
+ const entry = this.getHandle(handle);
429
+ if (!entry) {
430
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
431
+ return;
432
+ }
433
+ try {
434
+ if (attrs.mode !== undefined) {
435
+ getVfs().chmod(entry.path, attrs.mode);
436
+ }
437
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
438
+ }
439
+ catch {
440
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
441
+ }
442
+ });
443
+ sftp.on("SETSTAT", (reqid, requestPath, attrs) => {
444
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
445
+ // Security: Confine to home directory
446
+ if (!this.isPathWithinHome(targetPath, authUser)) {
447
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
448
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
449
+ return;
450
+ }
451
+ try {
452
+ if (attrs.mode !== undefined) {
453
+ getVfs().chmod(targetPath, attrs.mode);
454
+ }
455
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
456
+ }
457
+ catch {
458
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
459
+ }
460
+ });
461
+ sftp.on("REALPATH", (reqid, requestPath) => {
462
+ const normalized = this.resolveRequestPath(requestPath, authUser);
463
+ // Security: Confine to home directory
464
+ if (!this.isPathWithinHome(normalized, authUser)) {
465
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${normalized}`);
466
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
467
+ return;
468
+ }
469
+ sftp.name(reqid, [
470
+ {
471
+ filename: normalized,
472
+ longname: normalized,
473
+ attrs: {
474
+ mode: 0o040755,
475
+ uid: 0,
476
+ gid: 0,
477
+ size: 0,
478
+ atime: 0,
479
+ mtime: 0,
480
+ },
481
+ },
482
+ ]);
483
+ });
484
+ sftp.on("MKDIR", (reqid, requestPath) => {
485
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
486
+ // Security: Confine to home directory
487
+ if (!this.isPathWithinHome(targetPath, authUser)) {
488
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
489
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
490
+ return;
491
+ }
492
+ try {
493
+ getVfs().mkdir(targetPath, 0o755);
494
+ void getVfs().flushMirror();
495
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
496
+ }
497
+ catch {
498
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
499
+ }
500
+ });
501
+ sftp.on("RMDIR", (reqid, requestPath) => {
502
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
503
+ // Security: Confine to home directory
504
+ if (!this.isPathWithinHome(targetPath, authUser)) {
505
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
506
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
507
+ return;
508
+ }
509
+ try {
510
+ getVfs().remove(targetPath, { recursive: false });
511
+ void getVfs().flushMirror();
512
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
513
+ }
514
+ catch {
515
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
516
+ }
517
+ });
518
+ sftp.on("REMOVE", (reqid, requestPath) => {
519
+ const targetPath = this.resolveRequestPath(requestPath, authUser);
520
+ // Security: Confine to home directory
521
+ if (!this.isPathWithinHome(targetPath, authUser)) {
522
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
523
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
524
+ return;
525
+ }
526
+ try {
527
+ getVfs().remove(targetPath, { recursive: false });
528
+ void getVfs().flushMirror();
529
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
530
+ }
531
+ catch {
532
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
533
+ }
534
+ });
535
+ sftp.on("RENAME", (reqid, oldPath, newPath) => {
536
+ const fromPath = this.resolveRequestPath(oldPath, authUser);
537
+ const toPath = this.resolveRequestPath(newPath, authUser);
538
+ // Security: Confine both source and destination to home directory
539
+ if (!this.isPathWithinHome(fromPath, authUser) ||
540
+ !this.isPathWithinHome(toPath, authUser)) {
541
+ console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, from=${fromPath}, to=${toPath}`);
542
+ sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
543
+ return;
544
+ }
545
+ try {
546
+ getVfs().move(fromPath, toPath);
547
+ void getVfs().flushMirror();
548
+ sftp.status(reqid, SFTP_STATUS_CODE.OK);
549
+ }
550
+ catch {
551
+ sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
552
+ }
553
+ });
554
+ sftp.on("READLINK", (reqid) => {
555
+ sftp.status(reqid, SFTP_STATUS_CODE.OP_UNSUPPORTED);
556
+ });
557
+ sftp.on("SYMLINK", (reqid) => {
558
+ sftp.status(reqid, SFTP_STATUS_CODE.OP_UNSUPPORTED);
559
+ });
560
+ sftp.on("error", (error) => {
561
+ console.error(`[SFTP] Stream error for user=${authUser}:`, error);
562
+ });
563
+ sftp.on("close", () => {
564
+ console.log(`[SFTP] Stream closed for user=${authUser}`);
565
+ this.handles.clear();
566
+ });
567
+ sftp.on("end", () => {
568
+ console.log(`[SFTP] end event for user=${authUser}`);
569
+ this.handles.clear();
570
+ });
571
+ sftp.on("END", () => {
572
+ console.log(`[SFTP] END event for user=${authUser}`);
573
+ this.handles.clear();
574
+ });
575
+ }
576
+ }
@@ -7,10 +7,12 @@ import type { RemoveOptions, VfsNodeStats, WriteFileOptions } from "../types/vfs
7
7
  * {@link VirtualFileSystem.flushMirror} to persist pending changes.
8
8
  */
9
9
  declare class VirtualFileSystem {
10
- private readonly root;
11
- private readonly archivePath;
12
- private dirty;
13
- private computeNodeUsageBytes;
10
+ private readonly mirrorRoot;
11
+ private ensureMirrorRoot;
12
+ private resolveFsPath;
13
+ private detectGzipFile;
14
+ private computeDiskUsageBytes;
15
+ private renderTreeLines;
14
16
  /**
15
17
  * Creates a virtual filesystem instance.
16
18
  *
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/VirtualFileSystem/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,MAAM,cAAc,CAAC;AAOtB;;;;;;GAMG;AACH,cAAM,iBAAiB;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,KAAK,CAAS;IAEtB,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;gBACS,OAAO,GAAE,MAAsB;IAa3C;;;;OAIG;IACU,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3C;;;;OAIG;IACU,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAazC;;;;;OAKG;IACI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,MAAc,GAAG,IAAI;IAiC5D;;;;;;;;OAQG;IACI,SAAS,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,OAAO,GAAE,gBAAqB,GAC5B,IAAI;IAyCP;;;;;;;OAOG;IACI,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAU3C;;;;;OAKG;IACI,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAS1C;;;;;OAKG;IACI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAOpD;;;;;OAKG;IACI,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY;IA4B7C;;;;;OAKG;IACI,IAAI,CAAC,OAAO,GAAE,MAAY,GAAG,MAAM,EAAE;IAS5C;;;;;OAKG;IACI,IAAI,CAAC,OAAO,GAAE,MAAY,GAAG,MAAM;IAW1C;;;;;;;;OAQG;IACI,aAAa,CAAC,UAAU,GAAE,MAAY,GAAG,MAAM;IAKtD;;;;OAIG;IACI,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAc7C;;;;OAIG;IACI,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAc/C;;;;;OAKG;IACI,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,IAAI;IAiCpE;;;;;OAKG;IACI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAsCnD;AAED,eAAe,iBAAiB,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/VirtualFileSystem/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,MAAM,cAAc,CAAC;AAGtB;;;;;;GAMG;AACH,cAAM,iBAAiB;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,eAAe;IA4BvB;;;;OAIG;gBACS,OAAO,GAAE,MAAsB;IAI3C;;;;OAIG;IACU,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3C;;;;OAIG;IACU,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzC;;;;;OAKG;IACI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,MAAc,GAAG,IAAI;IAW5D;;;;;;;;OAQG;IACI,SAAS,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,OAAO,GAAE,gBAAqB,GAC5B,IAAI;IAuBP;;;;;;;OAOG;IACI,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAY3C;;;;;OAKG;IACI,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAS1C;;;;;OAKG;IACI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQpD;;;;;OAKG;IACI,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY;IAqC7C;;;;;OAKG;IACI,IAAI,CAAC,OAAO,GAAE,MAAY,GAAG,MAAM,EAAE;IAS5C;;;;;OAKG;IACI,IAAI,CAAC,OAAO,GAAE,MAAY,GAAG,MAAM;IAW1C;;;;;;;;OAQG;IACI,aAAa,CAAC,UAAU,GAAE,MAAY,GAAG,MAAM;IAQtD;;;;OAIG;IACI,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAY7C;;;;OAIG;IACI,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAY/C;;;;;OAKG;IACI,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,IAAI;IA4BpE;;;;;OAKG;IACI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAsBnD;AAED,eAAe,iBAAiB,CAAC"}