fix: ci test

Author: duck-bubi-ya

packages/commands/src/commands/update.ts

@@ -14,6 +14,7 @@ import {
   ansi,
   fetchLatestVersion,
   fetchBinaryChannelVersion,
+  isValidUpdateTargetVersion,
   normalizeBinaryVersion,
   performBinaryUpdate,
   type AnsiStyles,
@@ -73,8 +74,10 @@ export default defineCommand({
   },
   exampleArgs: ["", "--to 0.1.14"],
   validate(flags) {
-    if (flags.to !== undefined && !flags.to.trim()) {
-      return "--to requires a non-empty version";
+    if (flags.to === undefined) return undefined;
+    if (!flags.to.trim()) return "--to requires a non-empty version";
+    if (!isValidUpdateTargetVersion(flags.to)) {
+      return `--to must be a semver version (e.g. 1.13.0, v1.13.0, 0.0.0-beta-<sha>-<YYYYMMDDHHMM>), got: ${flags.to.trim()}`;
     }
     return undefined;
   },

packages/commands/tests/e2e/update.e2e.test.ts

@@ -20,4 +20,14 @@ describe("e2e: update", () => {
     const { stderr, exitCode } = await runCommandE2e(UPDATE_ROUTES, ["update", "--to"]);
     expect(exitCode, stderr).toBe(2);
   });
+
+  test("update --to 非法版本时退出为用法错误 (2)", async () => {
+    const { stderr, exitCode } = await runCommandE2e(UPDATE_ROUTES, [
+      "update",
+      "--to",
+      "not-a-version",
+    ]);
+    expect(exitCode, stderr).toBe(2);
+    expect(stderr).toMatch(/semver|--to/i);
+  });
 });

packages/runtime/src/index.ts

@@ -75,6 +75,7 @@ export {
   getBinaryCurrentPath,
   getBinaryShareRoot,
   getBinaryVersionsDir,
+  isValidUpdateTargetVersion,
   normalizeBinaryVersion,
   performBinaryUpdate,
   pruneBinaryVersions,

packages/runtime/src/utils/binary-update.ts

@@ -94,6 +94,21 @@ export function normalizeBinaryVersion(raw: string): string {
   return trimmed;
 }
 
+/**
+ * Semver core + optional pre-release / build metadata.
+ * Accepts this repo's channel betas (`0.0.0-beta-<sha7>-<YYYYMMDDHHMM>`) and
+ * ordinary releases (`1.13.0`, `1.4.2-beta.1`). Optional leading `v` is allowed.
+ */
+const UPDATE_TARGET_VERSION_RE =
+  /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
+
+/** True if `raw` is a usable `--to` target after trim (optional `v` prefix). */
+export function isValidUpdateTargetVersion(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  return UPDATE_TARGET_VERSION_RE.test(trimmed);
+}
+
 async function fetchSha256FromVersionSums(
   version: string,
   fileName: string,

packages/runtime/tests/binary-update-layout.test.ts

@@ -9,6 +9,7 @@ import {
   getBinaryCurrentPath,
   getBinaryShareRoot,
   getBinaryVersionsDir,
+  isValidUpdateTargetVersion,
   normalizeBinaryVersion,
   pruneBinaryVersions,
   readCurrentVersionDir,
@@ -83,6 +84,27 @@ test("normalizeBinaryVersion strips release-style v prefix", () => {
   expect(normalizeBinaryVersion(" 0.1.14-channel.1 ")).toBe("0.1.14-channel.1");
 });
 
+test("isValidUpdateTargetVersion accepts semver and channel betas", () => {
+  expect(isValidUpdateTargetVersion("1.13.0")).toBe(true);
+  expect(isValidUpdateTargetVersion("v1.13.0")).toBe(true);
+  expect(isValidUpdateTargetVersion("1.4.2-beta.1")).toBe(true);
+  expect(isValidUpdateTargetVersion("0.0.0-beta-be3033b-202607311142")).toBe(true);
+  expect(isValidUpdateTargetVersion("v0.0.0-beta-be3033b-202607311142")).toBe(true);
+  expect(isValidUpdateTargetVersion("latest")).toBe(false);
+  expect(isValidUpdateTargetVersion("1.2")).toBe(false);
+  expect(isValidUpdateTargetVersion("foo")).toBe(false);
+  expect(isValidUpdateTargetVersion("")).toBe(false);
+  // Path-traversal / path-separator inputs must never reach versions/<ver>/
+  expect(isValidUpdateTargetVersion("../../../..")).toBe(false);
+  expect(isValidUpdateTargetVersion("..\\..\\..")).toBe(false);
+  expect(isValidUpdateTargetVersion("1.2.3/../x")).toBe(false);
+  expect(isValidUpdateTargetVersion("1.2.3\\..\\x")).toBe(false);
+  expect(isValidUpdateTargetVersion("/etc/passwd")).toBe(false);
+  expect(isValidUpdateTargetVersion("versions/../../tmp")).toBe(false);
+  expect(isValidUpdateTargetVersion("1.2.3/")).toBe(false);
+  expect(isValidUpdateTargetVersion("..")).toBe(false);
+});
+
 test("resolveBinaryDownloadSpec targets version assets, not latest manifest url", async () => {
   const version = "0.1.14-channel.1";
   const { detectBinaryPlatform } = await import("bailian-cli-core");