fix(types): do not overwrite javascript.d.ts with whatever answered

`res.ok` is true for any 200, including the HTML login page a captive portal or
a corporate proxy serves. That page was written straight over a working
javascript.d.ts, and the damage surfaces later as every script in the editor
lighting up with TypeScript errors -- with nothing pointing back at
`iob-sync types`.

Check three things before the write: the announced content-length, the actual
body size, and that the body contains a declaration at all. Each throws into the
existing catch, which already warns and keeps the copy on disk, so a portal
response now leaves a good cached file intact.

The size cap bounds what reaches the disk, not what reaches memory -- res.text()
has already buffered the body by then. Bounding that too means streaming the
response, which is more than a hardcoded raw.githubusercontent.com URL warrants.

The download had no coverage before; it now has the happy path, the portal case,
and the oversize case, against a stubbed fetch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

src/commands/types.ts

@@ -22,6 +22,23 @@ import { Logger } from '../types';
 const JAVASCRIPT_DTS_URL =
   'https://raw.githubusercontent.com/ioBroker/ioBroker.javascript/refs/heads/master/src/lib/javascript.d.ts';
 
+/**
+ * Upper bound for the download. The real declaration file is well under 200 KB;
+ * anything past this is not it, and an unbounded response body has no business
+ * being buffered and then written into someone's project.
+ */
+const MAX_DTS_BYTES = 2 * 1024 * 1024;
+
+/**
+ * A captive portal, a corporate proxy, or a GitHub error page answers 200 with HTML,
+ * and `res.ok` cannot tell that from the real file. Writing a login page over a
+ * working javascript.d.ts breaks every script in the editor and presents as a
+ * TypeScript problem, so check what arrived before it goes near the disk.
+ */
+function looksLikeDeclarationFile(text: string): boolean {
+  return /^\s*declare\s/m.test(text);
+}
+
 const GLOBAL_DTS_CONTENT = `export {};
 declare global {
   function require(library: string): any;
@@ -122,7 +139,17 @@ export async function setupTypes(
       if (!res.ok) {
         throw new Error(`HTTP ${res.status}`);
       }
+      const declared = Number(res.headers.get('content-length'));
+      if (Number.isFinite(declared) && declared > MAX_DTS_BYTES) {
+        throw new Error(`the response announces ${Math.round(declared / 1024)} KB`);
+      }
       const text = await res.text();
+      if (text.length > MAX_DTS_BYTES) {
+        throw new Error(`the response is ${Math.round(text.length / 1024)} KB`);
+      }
+      if (!looksLikeDeclarationFile(text)) {
+        throw new Error('the response is not a TypeScript declaration file');
+      }
       await fs.writeFile(dtsPath, text, 'utf8');
       log.info(`Downloaded javascript.d.ts (${Math.round(text.length / 1024)} KB)`);
     } catch (err) {

test/commands-types.test.ts

@@ -6,7 +6,9 @@
  * module semantics per file (no phantom name collisions) and a module target that
  * permits top-level await.
  *
- * The download is not exercised — it needs the network. `--offline` covers the rest.
+ * The download is exercised against a stubbed `fetch` rather than the network: what
+ * matters is that a response which is not the declaration file never reaches the disk.
+ * `--offline` covers the rest.
  */
 
 import { describe, it } from 'node:test';
@@ -22,6 +24,19 @@ async function readTsconfig(root: string, scriptRoot: string): Promise<Record<st
   return JSON.parse(raw) as Record<string, never>;
 }
 
+/** Run `fn` with `fetch` replaced by one that answers every call with `res`. */
+async function withStubbedFetch(res: Response, fn: () => Promise<void>): Promise<void> {
+  const real = globalThis.fetch;
+  globalThis.fetch = () => Promise.resolve(res.clone());
+  try {
+    await fn();
+  } finally {
+    globalThis.fetch = real;
+  }
+}
+
+const DTS_PATH = ['.iobroker', 'types', 'javascript.d.ts'];
+
 describe('types', () => {
   it('writes a config that gives each script its own scope', async () => {
     const project = await makeTempProject();
@@ -96,6 +111,67 @@ describe('types', () => {
     }
   });
 
+  it('writes the declaration file when the download is the real thing', async () => {
+    const project = await makeTempProject();
+    try {
+      const dts = 'declare global {\n  function log(msg: string): void;\n}\n';
+      const { log } = makeCapturingLogger();
+      await withStubbedFetch(new Response(dts, { status: 200 }), async () => {
+        await setupTypes(project.root, 'scripts', {}, log);
+      });
+
+      assert.equal(await fs.readFile(path.join(project.root, ...DTS_PATH), 'utf8'), dts);
+    } finally {
+      await project.cleanup();
+    }
+  });
+
+  it('leaves a working copy alone when a portal answers 200 with a login page', async () => {
+    const project = await makeTempProject();
+    try {
+      const good = 'declare global {\n  function log(msg: string): void;\n}\n';
+      const dtsPath = path.join(project.root, ...DTS_PATH);
+      await fs.mkdir(path.dirname(dtsPath), { recursive: true });
+      await fs.writeFile(dtsPath, good, 'utf8');
+
+      const portal = '<!doctype html><html><body>Sign in to continue</body></html>';
+      const { log, captured } = makeCapturingLogger();
+      await withStubbedFetch(new Response(portal, { status: 200 }), async () => {
+        await setupTypes(project.root, 'scripts', {}, log);
+      });
+
+      assert.equal(await fs.readFile(dtsPath, 'utf8'), good, 'the HTML must not overwrite it');
+      assert.ok(
+        captured.warn.some((l) => /not a TypeScript declaration file/i.test(l)),
+        `expected a warning about the response, got ${JSON.stringify(captured.warn)}`,
+      );
+    } finally {
+      await project.cleanup();
+    }
+  });
+
+  it('refuses a body far too large to be the declaration file', async () => {
+    const project = await makeTempProject();
+    try {
+      const huge = `declare global {}\n${'x'.repeat(3 * 1024 * 1024)}`;
+      const { log, captured } = makeCapturingLogger();
+      await withStubbedFetch(new Response(huge, { status: 200 }), async () => {
+        await setupTypes(project.root, 'scripts', {}, log);
+      });
+
+      await assert.rejects(
+        () => fs.access(path.join(project.root, ...DTS_PATH)),
+        'nothing should have been written',
+      );
+      assert.ok(
+        captured.warn.some((l) => l.includes('KB')),
+        `expected a warning naming the size, got ${JSON.stringify(captured.warn)}`,
+      );
+    } finally {
+      await project.cleanup();
+    }
+  });
+
   it('says what is missing rather than failing when offline and nothing is cached', async () => {
     const project = await makeTempProject();
     try {