wyvrnpm 2.10.2 → 2.12.2

package/src/zip-safe.js

@@ -1,52 +1,52 @@
-'use strict';
-
-/**
- * Defense-in-depth against Zip Slip (CVE-2018-1002200 family). Both
- * node-stream-zip and adm-zip claim to handle this upstream, but we
- * don't want to take the library's word for it on a supply-chain-
- * critical code path. Pre-scan zip entry names before extraction and
- * reject anything that could write outside the target directory.
- *
- * The ZIP spec uses forward slashes only, but Windows-produced archives
- * sometimes leak backslashes — normalise both.
- *
- * @param {string} entryName   zip-internal path as reported by the zip library
- * @param {string} [context]   optional archive identifier for the error message
- * @throws {Error} if the entry name is absolute, contains a path-traversal
- *                 segment, or starts with a Windows drive-letter prefix.
- */
-function assertSafeZipEntryName(entryName, context) {
-  const where = context ? ` in ${context}` : '';
-
-  if (/^[A-Za-z]:[\\/]/.test(entryName)) {
-    throw new Error(`unsafe zip entry${where}: drive-letter absolute path ${JSON.stringify(entryName)}`);
-  }
-  if (entryName.startsWith('/') || entryName.startsWith('\\')) {
-    throw new Error(`unsafe zip entry${where}: absolute path ${JSON.stringify(entryName)}`);
-  }
-
-  const segments = entryName.split(/[\\/]+/);
-  for (const seg of segments) {
-    if (seg === '..') {
-      throw new Error(`unsafe zip entry${where}: path-traversal segment in ${JSON.stringify(entryName)}`);
-    }
-  }
-}
-
-/**
- * Convenience: validate every name in an iterable. Throws on the first
- * offender (fail-fast) rather than collecting all violations.
- *
- * @param {Iterable<string>} names
- * @param {string} [context]
- */
-function assertAllSafeZipEntryNames(names, context) {
-  for (const name of names) {
-    assertSafeZipEntryName(name, context);
-  }
-}
-
-module.exports = {
-  assertSafeZipEntryName,
-  assertAllSafeZipEntryNames,
-};
+'use strict';
+
+/**
+ * Defense-in-depth against Zip Slip (CVE-2018-1002200 family). Both
+ * node-stream-zip and adm-zip claim to handle this upstream, but we
+ * don't want to take the library's word for it on a supply-chain-
+ * critical code path. Pre-scan zip entry names before extraction and
+ * reject anything that could write outside the target directory.
+ *
+ * The ZIP spec uses forward slashes only, but Windows-produced archives
+ * sometimes leak backslashes — normalise both.
+ *
+ * @param {string} entryName   zip-internal path as reported by the zip library
+ * @param {string} [context]   optional archive identifier for the error message
+ * @throws {Error} if the entry name is absolute, contains a path-traversal
+ *                 segment, or starts with a Windows drive-letter prefix.
+ */
+function assertSafeZipEntryName(entryName, context) {
+  const where = context ? ` in ${context}` : '';
+
+  if (/^[A-Za-z]:[\\/]/.test(entryName)) {
+    throw new Error(`unsafe zip entry${where}: drive-letter absolute path ${JSON.stringify(entryName)}`);
+  }
+  if (entryName.startsWith('/') || entryName.startsWith('\\')) {
+    throw new Error(`unsafe zip entry${where}: absolute path ${JSON.stringify(entryName)}`);
+  }
+
+  const segments = entryName.split(/[\\/]+/);
+  for (const seg of segments) {
+    if (seg === '..') {
+      throw new Error(`unsafe zip entry${where}: path-traversal segment in ${JSON.stringify(entryName)}`);
+    }
+  }
+}
+
+/**
+ * Convenience: validate every name in an iterable. Throws on the first
+ * offender (fail-fast) rather than collecting all violations.
+ *
+ * @param {Iterable<string>} names
+ * @param {string} [context]
+ */
+function assertAllSafeZipEntryNames(names, context) {
+  for (const name of names) {
+    assertSafeZipEntryName(name, context);
+  }
+}
+
+module.exports = {
+  assertSafeZipEntryName,
+  assertAllSafeZipEntryNames,
+};

package/src/zip-stream.js

@@ -0,0 +1,126 @@
+'use strict';
+
+// Streaming zip writer. Replaces adm-zip's load-into-memory model on
+// the publish + source-build write paths so multi-GB files (gRPC
+// static libs, embedded test corpora, …) don't trip Node's
+// `Buffer.byteLength` cap of ~2 GiB inside `fs.readFileSync`.
+//
+// Wraps `archiver` behind an adm-zip-compatible facade
+// (`addLocalFile(fullPath, zipDir)`) so existing call sites stay
+// largely unchanged — the only structural difference is that
+// `finalize()` is async (the file is written progressively as entries
+// are added; closing the underlying stream is what flushes the
+// central directory). Adm-zip's `writeZip()` was sync and required
+// holding the full archive in memory.
+//
+// archiver auto-promotes to ZIP64 when the archive crosses the 4 GB
+// or >65535-entries thresholds, so consumers using `node-stream-zip`
+// (the default extraction path in [src/download.js](download.js))
+// continue to extract correctly without any special handling.
+//
+// adm-zip stays in deps for the consumer-side reading we still do in
+// `install-skill` and the small write of `scripts/repack-skill.js`,
+// where bundle sizes are measured in KB and adm-zip's API is simpler.
+
+const fs       = require('fs');
+const path     = require('path');
+const archiver = require('archiver');
+
+class StreamingZipWriter {
+  /**
+   * @param {string} outPath  Output path for the zip file.
+   * @param {object} [opts]
+   * @param {number} [opts.compressionLevel=6]  zlib level 0..9.
+   *   archiver default is 9 (max compression). 6 is the widely-accepted
+   *   "balanced" pick — for our artefact mix (mostly already-compressed
+   *   binaries: .lib/.dll, JPEGs, PNGs in test fixtures), level 9 burns
+   *   minutes for sub-percent gains over level 6. Override per-call if
+   *   the artefact is text-heavy.
+   */
+  constructor(outPath, opts = {}) {
+    const { compressionLevel = 6 } = opts;
+
+    this._outPath  = outPath;
+    this._out      = fs.createWriteStream(outPath);
+    this._archive  = archiver('zip', { zlib: { level: compressionLevel } });
+    this._closed   = false;
+    this._error    = null;
+
+    // Wire error propagation up front. archiver emits 'warning' for
+    // recoverable issues (e.g. ENOENT on a file that vanished between
+    // queue and read) — we propagate ALL of them rather than silently
+    // dropping content (CLAUDE.md §2 principle 8: silent fallback is a
+    // bug). adm-zip's `readFileSync` would have failed loudly in the
+    // same scenario; matching that behaviour here means a
+    // disappearing file during publish surfaces as an error rather
+    // than a silently-incomplete artefact.
+    this._archive.on('error',   (err) => { this._error = err; });
+    this._archive.on('warning', (err) => { this._error = err; });
+    this._out.on('error',       (err) => { this._error = err; });
+
+    this._archive.pipe(this._out);
+  }
+
+  /**
+   * Stream a file into the archive at `<zipDir>/<basename(fullPath)>`.
+   * adm-zip-compatible signature so existing publish/source-build
+   * helpers (which were written against `AdmZip#addLocalFile`) work
+   * without per-call refactor.
+   *
+   * No `fs.readFileSync` happens here — archiver opens a read stream
+   * lazily during `.finalize()`. Memory usage stays flat regardless of
+   * file size.
+   *
+   * @param {string} fullPath  Absolute path on disk.
+   * @param {string} zipDir    Directory inside the zip (forward
+   *   slashes); empty string places the file at the zip root.
+   */
+  addLocalFile(fullPath, zipDir) {
+    if (this._error) throw this._error;
+    const base = path.basename(fullPath);
+    const name = (typeof zipDir === 'string' && zipDir.length > 0)
+      ? `${zipDir.replace(/\\/g, '/')}/${base}`
+      : base;
+    this._archive.file(fullPath, { name });
+  }
+
+  /**
+   * Stream a Buffer / string into the archive at the given path. Used
+   * for synthesised entries that aren't on disk (the publish flow
+   * doesn't hit this today, but it keeps parity with adm-zip's
+   * `addFile(path, content)` for future use).
+   *
+   * @param {string} zipPath
+   * @param {Buffer|string} content
+   */
+  addFile(zipPath, content) {
+    if (this._error) throw this._error;
+    this._archive.append(content, { name: zipPath.replace(/\\/g, '/') });
+  }
+
+  /**
+   * Close the archive and flush bytes to disk. Must be awaited — the
+   * file is not fully written until the underlying WriteStream emits
+   * `close`.
+   *
+   * @returns {Promise<void>}
+   */
+  finalize() {
+    if (this._closed) return Promise.resolve();
+    this._closed = true;
+    return new Promise((resolve, reject) => {
+      // Reject if any error already accumulated before finalize was called.
+      if (this._error) return reject(this._error);
+
+      this._out.on('close', () => {
+        if (this._error) reject(this._error);
+        else             resolve();
+      });
+      this._out.on('error', reject);
+      this._archive.on('error', reject);
+      this._archive.finalize();
+    });
+  }
+}
+
+module.exports = { StreamingZipWriter };