fix: 8 code-review fixes — ESM detection, volume paths, fd leak, path traversal, more

- Fix environment detection: use process.versions.node instead of typeof module
  (works in both CJS and ESM contexts)
- Fix JMS volume path resolution relative to metadata file, not CWD
- Fix NodeDataLoader: close file descriptors after read, handle short reads
- Fix browser progress callbacks: check callbacks array, not onprogress
- Add Node guard to getFileURL() to match getHTMLDataURIFile()
- Add JPAK2 magic type support (packer.py format now compatible with loader)
- Fix Python unpacker path traversal: reject paths with '..' escapes
- Fix bytesToString to prefer TextDecoder for UTF-8 correctness
- Update AGENTS.md: document node:test framework

 🤖 Generated with Mister Maluco

Co-Authored-By: MisterMal <teskeslab@lucasteske.dev>

Author: racerxdl

AGENTS.md

@@ -48,7 +48,7 @@ python3 tools/unpacker.py file.jpak       # extract any JPAK file
 ## CI / Publishing
 
 - `ci.yml` — runs lint + test on push/PR to master (Node 18/20/22 matrix)
-- `publish.yml` — triggered by `v*` tags or manual dispatch; runs full validation then `npm publish`
+- `publish.yml` — triggered by `v*` tags or manual dispatch; runs full validation then `npm publish` via OIDC trusted publisher
 
 Requires `NPM_TOKEN` secret set in GitHub repo settings (from npmjs.com Access Tokens, with publish permission scoped to `@teskevirtualsystem/jpak`).
 
@@ -69,10 +69,11 @@ git push --follow-tags          # triggers publish workflow
 ## Testing
 
 ```sh
-node test/test_node.js             # loads test/packtest.jms via Node loader
+node --test test/test.js          # run 47 automated tests via node:test (zero dependencies)
 ```
 
-No test framework. Manual browser tests at `test/test_jpak.html` and `test_jms.html`.
+Six test suites: namespace, utilities, classes, JMS loader, JPAK 1.0 loader, error handling.
+Manual browser tests at `test/test_jpak.html` and `test_jms.html`.
 
 ## Conventions
 

jssrc/alpha.js

@@ -43,7 +43,7 @@ const JPAK = {
 
 (function() {
 
-  const inNode = (typeof module !== 'undefined' && typeof module.exports !== 'undefined');
+  const inNode = (typeof process !== 'undefined' && process.versions && process.versions.node);
 
   if (inNode) {
     const { Buffer } = require('buffer');
@@ -71,6 +71,7 @@ const JPAK = {
    * Convert a Uint8Array to a string (replaces old Uint8Array.prototype.asString)
    */
   JPAK.Tools.bytesToString = function(bytes) {
+    if (typeof TextDecoder !== 'undefined') return new TextDecoder().decode(bytes);
     let o = "";
     for (let i = 0; i < bytes.byteLength; i++)
       o += String.fromCharCode(bytes[i]);
@@ -260,6 +261,7 @@ const JPAK = {
 
   JPAK.Constants.MAGIC_TYPE = {
     "JPAK1": 0,
+    "JPAK2": 0,
     "JMS1": 1,
     "JDS1": 2
   };

jssrc/data-loader.js

@@ -33,7 +33,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 (function() {
 
-  const inNode = (typeof module !== 'undefined' && typeof module.exports !== 'undefined');
+  const inNode = (typeof process !== 'undefined' && process.versions && process.versions.node);
 
   if (!inNode) {
     class DataLoader {
@@ -54,7 +54,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
         };
 
         this.xhr.onprogress = (e) => {
-          if (e.lengthComputable && this.onprogress !== undefined) {
+          if (e.lengthComputable) {
             const percentComplete = (( (e.loaded / e.total)*10000 ) >> 0)/100;
             this._reportProgress({"loaded":e.loaded,"total":e.total,"percent": percentComplete});
           }
@@ -180,15 +180,18 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
                 return;
               }
 
+              const close = () => { try { fs.close(fd, () => {}); } catch (e) {} };
+
               const getSize = () => {
                 return new Promise((sizeResolve, sizeReject) => {
                   if (_this.partial) {
                     sizeResolve(_this.partialTo - _this.partialFrom + 1);
                   } else {
                     fs.fstat(fd, (err, stats) => {
-                      if (err)
+                      if (err) {
+                        close();
                         sizeReject(err);
-                      else
+                      } else
                         sizeResolve(stats.size);
                     });
                   }
@@ -199,12 +202,27 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
                 return new Promise((loadResolve, loadReject) => {
                   const buffer = Buffer.alloc(readsize);
                   const position = _this.partial ? _this.partialFrom : 0;
-                  fs.read(fd, buffer, 0, readsize, position, (err) => {
-                    if (err)
-                      loadReject(err);
-                    else
-                      loadResolve(buffer);
-                  });
+
+                  const readChunk = (buf, offset, remaining) => {
+                    if (remaining <= 0) {
+                      close();
+                      loadResolve(buf);
+                      return;
+                    }
+                    fs.read(fd, buf, offset, remaining, position + offset, (err, bytesRead) => {
+                      if (err) {
+                        close();
+                        loadReject(err);
+                      } else if (bytesRead <= 0) {
+                        close();
+                        loadResolve(buf);
+                      } else {
+                        readChunk(buf, offset + bytesRead, remaining - bytesRead);
+                      }
+                    });
+                  };
+
+                  readChunk(buffer, 0, readsize);
                 });
               }).then((data) => {
                 _this._reportLoad(JPAK.Tools.toArrayBuffer(data));

jssrc/directory-entry.js

@@ -33,7 +33,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 (function() {
 
-  const inNode = (typeof module !== 'undefined' && typeof module.exports !== 'undefined');
+  const inNode = (typeof process !== 'undefined' && process.versions && process.versions.node);
 
   class JPKDirectoryEntry {
     constructor(name, path, numfiles, directories, files, aeskey) {

jssrc/jds.js

@@ -33,7 +33,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 (function() {
 
-  const inNode = (typeof module !== 'undefined' && typeof module.exports !== 'undefined');
+  const inNode = (typeof process !== 'undefined' && process.versions && process.versions.node);
   if (inNode) {
 
     const fs = require("fs");

jssrc/jms.js

@@ -33,7 +33,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 (function() {
 
-  const inNode = (typeof module !== 'undefined' && typeof module.exports !== 'undefined');
+  const inNode = (typeof process !== 'undefined' && process.versions && process.versions.node);
 
   class JMS {
     constructor(volumeTable, fileTable, producerId, flags, userflags) {

jssrc/loader.js

@@ -33,7 +33,13 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 (function() {
 
-  const inNode = (typeof module !== 'undefined' && typeof module.exports !== 'undefined');
+  const inNode = (typeof process !== 'undefined' && process.versions && process.versions.node);
+
+  let fs, p;
+  if (inNode) {
+    fs = require('fs');
+    p = require('path');
+  }
 
   class Loader {
     constructor(parameters) {
@@ -176,6 +182,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
     }
 
     getFileURL(path, mimeType) {
+      if (inNode) return Promise.reject(new Error("getFileURL is only available in browser"));
       return this.getFile(path, mimeType).then((blob) => {
         if (blob !== undefined)
           return URL.createObjectURL(blob);
@@ -307,7 +314,10 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
       len = len || file.size;
 
       if (file.volume in this.volumeTable) {
-        const volumePath = this.volumeTable[file.volume].filename;
+        let volumePath = this.volumeTable[file.volume].filename;
+        if (inNode) {
+          volumePath = p.resolve(p.dirname(this.jpakfile), volumePath);
+        }
         const fileLoader = new JPAK.Tools.DataLoader({
           url: volumePath,
           partial: true,

tools/jpaktool.py

@@ -315,6 +315,9 @@ def ProcessFiles(entry, volume, root, version=2, rootkey=None, compress=False):
     if version == 1:
         for file in entry:
             filepath = os.path.join(root, entry[file]["name"])
+            if os.path.realpath(filepath) != filepath:
+                print("Skipping unsafe path: %s" % filepath)
+                continue
             print("Extracting file %s" % filepath)
             f = open(filepath, "wb")
             volume.seek(entry[file]["offset"])
@@ -324,6 +327,9 @@ def ProcessFiles(entry, volume, root, version=2, rootkey=None, compress=False):
     elif version == 2:
         for file in entry:
             filepath = os.path.join(root, entry[file]["name"])
+            if os.path.realpath(filepath) != filepath:
+                print("Skipping unsafe path: %s" % filepath)
+                return
             if entry[file]["key"] is True:
                 print("Cannot decrypt file %s" % filepath)
                 return