mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
Gabe Debes
10a78d0527
## What A new `tar-upload` file-input kind so a tool that reads a local file or directory (e.g. `reinstall-app`'s app bundle) works when the tool-server runs on a different machine than the caller. ## Why `reinstall-app` assumes the bundle is on the tool-server's filesystem. That breaks with a cloud-hosted simulator — the bundle is on your machine, not the server's. The existing `file` kind inlines base64 and is capped at 32 MB, too small for a real `.app`/`.apk`; `tar-upload` streams instead. ## How When you're not linked to a remote server, an existing local path is used in place. When you are (e.g. `argent link`), the client tars the path, streams it to `POST /upload`, and the tool call carries `uploadId` plus a SHA-256 `contentHash`. The server always extracts from that upload — even if the same path already exists on disk — verifies the hash, and vets tar members before extracting. The client only uploads when the path is on its own machine (a line on stderr so you know it's working). Same command local or remote: ``` argent run reinstall-app --udid <udid> --bundleId <id> --appPath ./MyApp.app ``` ## Shared extraction Per review feedback, the tar pack/unpack logic is unified in a small `@argent/archive` package used by **both** directions — this upload path and the pre-existing artifact download (`streamDirectoryAsTarGz` / `downloadAndExtractArchive`). The shared extractor rejects path-traversal entries, symlinks whose target escapes the extract dir, and non-file/dir members (hardlinks, devices) — while still allowing a bundle's internal symlinks. This also hardens the artifact-download path, which previously extracted without those checks. ## Tests Client + server unit and HTTP round-trip tests: dir and file upload, skip-when-not-local, co-located no-op, hash required, path-traversal / escaping-symlink / hardlink rejection, sidecar handling, single-member resolution, `/upload` auth + size caps, and artifact download extraction. All suites pass. --------- Co-authored-by: Filip131311 <contact@filipkaminski.com>
20 lines
627 B
JSON
20 lines
627 B
JSON
{
|
|
"files": [],
|
|
"references": [
|
|
{ "path": "packages/archive" },
|
|
{ "path": "packages/registry" },
|
|
{ "path": "packages/telemetry" },
|
|
{ "path": "packages/update-core" },
|
|
{ "path": "packages/native-devtools-ios" },
|
|
{ "path": "packages/native-devtools-android" },
|
|
{ "path": "packages/preview-window" },
|
|
{ "path": "packages/argent-tools-client" },
|
|
{ "path": "packages/configuration-core" },
|
|
{ "path": "packages/argent-cli" },
|
|
{ "path": "packages/tool-server" },
|
|
{ "path": "packages/argent-installer" },
|
|
{ "path": "packages/argent-mcp" },
|
|
{ "path": "packages/argent" }
|
|
]
|
|
}
|