Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Windows] 插件安装管线文本模式写入 vendor 资源：CRLF 注入致 sha256 全失配与渲染损坏（visualize 0.1.0 实证）

Open
  • Is something wrong?
#109 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, python
Domain
desktop-dev, tooling

Research direction

Trace the Windows plugin vendor extraction and file-writing path around ~/.zcode/cli/plugins/cache/zcode-plugins-official/visualize/0.1.0/skills/visualize/assets/vendor/, then ensure resources are written as binary data without newline conversion. Use the issue’s Python SHA-256 script to compare installed files with manifest.json, and reproduce against the preserved .backup-crlf-20261016/ sample. Done means restored LF resources match their manifest hashes and installation-time hash verification reports mismatches.

Written by the indexing model from the issue text.

Description

环境
  • Windows 11 ARM64（10.0.26200）
  • ZCode Desktop（GLM 桌面版）
  • 插件：visualize 0.1.0（zcode-plugins-official 官方市场安装）
  • 路径：~/.zcode/cli/plugins/cache/zcode-plugins-official/visualize/0.1.0/skills/visualize/assets/vendor/
现象

插件 vendor 资源安装后，实际文件 sha256 与该目录 manifest.json 内声明的 sha256 全部不匹配（8/8 MISMATCH），官方导出（render 管线）产物损坏无法渲染。

根因取证（损坏安装产物 vs npm tarball 恢复版）

损坏产物中 所有 LF 行尾被写为 CRLF（文本模式写入的典型特征）；从 npm 原版 tarball（sha512 验真）恢复后 8/8 哈希全部 OK：

文件 损坏态字节 恢复态字节 损坏态 CRLF 数 恢复态 CRLF 数
lucide-1.17.0.js 621,166 601,680 19,521 0
d3-7.9.0.min.js 279,708 279,706 2 0
floating-ui-core-1.7.3.min.js 12,530 12,529 1 0
floating-ui-dom-1.7.4.min.js 10,252 10,251 1 0
（4 个 *.LICENSE 同样 100% CRLF，如 MIT LICENSE 20 处）

首个差异字节示例（d3-7.9.0.min.js @ byte 59）：

损坏: ...Mike Bostock\r\n!function(t,n){"ob
恢复: ...Mike Bostock\n!function(t,n){"obj

npm 发布的原版资源均为纯 LF；损坏态把每一个 \n 都变成了 \r\n（lucide.js 19,521 行全部命中，膨胀 19.5KB），manifest.json 的 sha256 因此全部失配。

推断与建议
  • 推断：Windows 安装管线在解包/落盘 vendor 资源时走了文本模式（换行转换）而非二进制流写入。
  • 建议：①vendor 资源写入统一走二进制（Buffer/stream，不做 newline 转换）；②安装完成后对 manifest 声明的 sha256 做一次自检，失配即重装/告警，避免损坏静默累积到运行期。
  • 现场保留：损坏样本已备份于该 vendor 目录下 .backup-crlf-20261016/，如需原始样本可提供。
最小复现/校验脚本
import hashlib, json
from pathlib import Path
V = Path.home() / ".zcode/cli/plugins/cache/zcode-plugins-official/visualize/0.1.0/skills/visualize/assets/vendor"
m = json.loads((V / "manifest.json").read_text(encoding="utf-8"))
for e in m["resources"]:
    f = V / e["file"]
    actual = hashlib.sha256(f.read_bytes()).hexdigest()
    print(e["file"], "OK" if actual == e["sha256"] else "MISMATCH")

（恢复方法：从 npm registry 拉 tarball，sha512 验真后覆盖 vendor 文件，哈希即全部对上。）

Dominant language
Python
Stars
103
Forks
78
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from zai-org/zcode-plugins

All issues in zai-org/zcode-plugins

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.