fix(anime): harden the extension bridge against untrusted repos and hangs

Addresses CodeRabbit review feedback on the Anime Browser:

- reject repository package/apk names that are not plain identifiers, and
  verify the install target resolves inside the extensions directory
- count mpv's %n% option escape in UTF-8 bytes, and escape backslashes in
  header values so a trailing one cannot eat the list separator
- key the bridge extension-id cache by APK content, so an in-place upgrade
  re-uploads instead of running the previous build
- bound every bridge, release-listing, and download request with a timeout
- enforce the APK size limit while streaming rather than after buffering
- read APK bytes on demand instead of holding a base64 copy per extension
  for the lifetime of the browser
- serialize preference mutations and write the file atomically
- handle the sidecar spawn error event, and wait for the child to exit in
  stop() before returning
- report a failed Anime Browser bootstrap instead of showing the starting
  banner forever
- keep the preferences panel's save confirmation and in-flight multi-select
  edits by re-rendering only on a structural schema change

src/anime-bridge/extension-installer.ts

@@ -15,11 +15,18 @@ export interface InstallExtensionOptions {
   fetchImpl?: typeof fetch;
   /** Guards against a mistyped repo serving something enormous. */
   maxBytes?: number;
+  /** Cancels a stalled download; without it a hung repo blocks the install. */
+  signal?: AbortSignal;
+  /** Applied when no `signal` is given, so a download can never hang forever. */
+  timeoutMs?: number;
 }
 
 /** APKs are a few MB; anything far past that is not an extension. */
 const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
 
+/** Generous enough for a large APK on a slow link, short of hanging forever. */
+const DEFAULT_TIMEOUT_MS = 120_000;
+
 const APK_MAGIC = [0x50, 0x4b, 0x03, 0x04]; // "PK\x03\x04" — APKs are zip archives.
 
 export function looksLikeApk(bytes: Uint8Array): boolean {
@@ -35,8 +42,9 @@ export function looksLikeApk(bytes: Uint8Array): boolean {
 export async function installExtension(options: InstallExtensionOptions): Promise<string> {
   const fetchImpl = options.fetchImpl ?? fetch;
   const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const signal = options.signal ?? AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
 
-  const response = await fetchImpl(options.extension.apkUrl);
+  const response = await fetchImpl(options.extension.apkUrl, { signal });
   if (!response.ok) {
     throw new Error(`Downloading ${options.extension.name} failed (${response.status}).`);
   }
@@ -46,21 +54,74 @@ export async function installExtension(options: InstallExtensionOptions): Promis
     throw new Error(`${options.extension.name} is larger than the ${maxBytes} byte limit.`);
   }
 
-  const bytes = new Uint8Array(await response.arrayBuffer());
-  if (bytes.byteLength > maxBytes) {
-    throw new Error(`${options.extension.name} is larger than the ${maxBytes} byte limit.`);
-  }
+  const bytes = await readBounded(response, maxBytes, options.extension.name);
   if (!looksLikeApk(bytes)) {
     throw new Error(`${options.extension.name} did not download as an APK.`);
   }
 
   await mkdir(options.extensionsDir, { recursive: true });
-  const target = path.join(options.extensionsDir, extensionFileName(options.extension.pkg));
+  const target = resolveTarget(options.extensionsDir, options.extension.pkg);
   await writeFile(target, bytes);
   return target;
 }
 
+/**
+ * Read the body incrementally and stop the moment the limit is passed.
+ *
+ * Buffering first and measuring afterwards would let a repo that lies about
+ * (or omits) `content-length` push an unbounded amount into memory before the
+ * check ever runs.
+ */
+async function readBounded(
+  response: Response,
+  maxBytes: number,
+  name: string,
+): Promise<Uint8Array> {
+  const reader = response.body?.getReader();
+  if (!reader) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes) {
+      throw new Error(`${name} is larger than the ${maxBytes} byte limit.`);
+    }
+    return bytes;
+  }
+
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new Error(`${name} is larger than the ${maxBytes} byte limit.`);
+    }
+    chunks.push(value);
+  }
+
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+
+/**
+ * Defence in depth against a repository index that smuggles path separators
+ * into a package name: the write target must stay inside `extensionsDir`.
+ */
+function resolveTarget(extensionsDir: string, pkg: string): string {
+  const root = path.resolve(extensionsDir);
+  const target = path.resolve(root, extensionFileName(pkg));
+  if (path.dirname(target) !== root) {
+    throw new Error(`Refusing to install ${pkg}: the package name is not a valid file name.`);
+  }
+  return target;
+}
+
 /** Delete an installed extension. Missing files are treated as already gone. */
 export async function removeExtension(extensionsDir: string, pkg: string): Promise<void> {
-  await rm(path.join(extensionsDir, extensionFileName(pkg)), { force: true });
+  await rm(resolveTarget(extensionsDir, pkg), { force: true });
 }