Serve NuGet sources that are local folders or network shares

AGENTS.md

@@ -43,12 +43,28 @@ The constructor sets `Capabilities`, `Properties`, and wires the helpers. See `s
 These four managers share `BaseNuGet` / `BaseNuGetDetailsHelper`, which talk to a NuGet feed
 over HTTP. Each source picks its protocol independently, in `NuGetV3ServiceIndex.GetServiceIndexUrl`:
 
+- A source URL with the `file` scheme - what `new Uri()` produces for a local folder or a UNC
+  share such as `C:\packages` or `\\server\share` - is a **local folder feed**, served by
+  `NuGetLocalFeed`. There is no HTTP endpoint to call, so search, details, icons, versions and
+  updates read the `.nupkg` files and their embedded `.nuspec` straight from disk. This check
+  runs before the V3 one, everywhere.
 - A source URL whose path ends in `index.json`, or whose last path segment is `v3`, is a
   **NuGet V3** feed. Its service index is fetched once per session and cached.
 - Every other source URL is treated as a **V2/OData** feed and keeps the legacy code path.
 
 Detection is purely by URL shape, so it costs no probe request and no V2 feed changes behaviour.
 
+A local folder feed is scanned at most three directories deep, which covers both the flat layout
+and the `<id>/<version>/<id>.<version>.nupkg` layout, and each parsed manifest is cached against
+its file's size and write time. Installers on such a feed are copied from disk instead of being
+downloaded (`DownloadOperation`), which refuses a destination that is the package file itself.
+
+Every `.nupkg` in the folder is opened during a search, so its contents are treated as untrusted:
+a manifest is rejected above 4 MiB (checked against the declared size *and* while decompressing,
+since the declared one can lie) and parsed with DTD processing prohibited, and an embedded
+`<icon>` is extracted under the same bounds into the package's icon cache directory, named only
+from the package version plus an allow-listed extension so a crafted entry path cannot escape it.
+
 ### V3 resources used
 
 | Resource `@type` | Used for |

src/UniGetUI.Core.Tools/Tools.cs

@@ -376,6 +376,9 @@
 
             try
             {
+                if (url.IsFile)
+                    return new FileInfo(url.LocalPath).Length;
+
                 using HttpClient client = new(CoreTools.GenericHttpClientParameters);
                 using var request = new HttpRequestMessage(HttpMethod.Head, url);
                 using HttpResponseMessage response = client.Send(request);
@@ -394,6 +397,9 @@
         {
             try
             {
+                if (url.IsFile)
+                    return Path.GetFileName(url.LocalPath);
+
                 var handler = CoreTools.GenericHttpClientParameters;
                 handler.AllowAutoRedirect = false;
                 using HttpClient client = new(handler);
@@ -1522,7 +1528,7 @@
                 }
 
                 Task reads = Task.WhenAll(stdout, stderr);
                 reads.ContinueWith(
                     completed => _ = completed.Exception,
                     TaskContinuationOptions.OnlyOnFaulted
                 );

src/UniGetUI.PackageEngine.Managers.Chocolatey/Helpers/ChocolateySourceHelper.cs

@@ -9,6 +9,8 @@ namespace UniGetUI.PackageEngine.Managers.ChocolateyManager
 {
     internal sealed class ChocolateySourceHelper : BaseSourceHelper
     {
+        private const string AuthenticatedMarker = "(Authenticated)";
+
         public ChocolateySourceHelper(Chocolatey manager)
             : base(manager) { }
 
@@ -106,10 +108,11 @@ internal IReadOnlyList<IManagerSource> ParseSources(IEnumerable<string> lines)
 
                     if (line.Contains(" - ") && line.Contains("| "))
                     {
-                        string[] parts = line.Trim().Split('|')[0].Trim().Split(" - ");
+                        string[] parts = line.Trim().Split('|')[0].Trim().Split(" - ", 2);
+                        string url = ExtractSourceUrl(parts[1]);
                         if (
-                            parts[1].Trim() == "https://community.chocolatey.org/api/v2/"
-                            || parts[1].Trim() == "https://chocolatey.org/api/v2/"
+                            url == "https://community.chocolatey.org/api/v2/"
+                            || url == "https://chocolatey.org/api/v2/"
                         )
                         {
                             sources.Add(
@@ -123,11 +126,7 @@ internal IReadOnlyList<IManagerSource> ParseSources(IEnumerable<string> lines)
                         else
                         {
                             sources.Add(
-                                new ManagerSource(
-                                    Manager,
-                                    parts[0].Trim(),
-                                    new Uri(parts[1].Split(" ")[0].Trim())
-                                )
+                                new ManagerSource(Manager, parts[0].Trim(), new Uri(url))
                             );
                         }
                     }
@@ -140,5 +139,14 @@ internal IReadOnlyList<IManagerSource> ParseSources(IEnumerable<string> lines)
 
             return sources;
         }
+
+        private static string ExtractSourceUrl(string value)
+        {
+            string url = value.Trim();
+            if (url.EndsWith(AuthenticatedMarker, StringComparison.Ordinal))
+                url = url[..^AuthenticatedMarker.Length].TrimEnd();
+
+            return url;
+        }
     }
 }

src/UniGetUI.PackageEngine.Managers.Generic.NuGet/BaseNuGet.cs

@@ -116,6 +116,14 @@ protected sealed override IReadOnlyList<Package> FindPackages_UnSafe(string quer
             {
                 try
                 {
+                    if (NuGetLocalFeed.TryGetDirectory(source, out string localDirectory))
+                    {
+                        Packages.AddRange(
+                            FindPackagesLocal(source, localDirectory, query, canPrerelease, logger)
+                        );
+                        continue;
+                    }
+
                     if (NuGetV3ServiceIndex.IsV3Source(source))
                     {
                         Packages.AddRange(FindPackagesV3(source, query, canPrerelease, logger));
@@ -244,6 +252,130 @@ protected sealed override IReadOnlyList<Package> FindPackages_UnSafe(string quer
             return Packages;
         }
 
+        internal IReadOnlyList<Package> FindPackagesLocal(
+            IManagerSource source,
+            string directory,
+            string query,
+            bool canPrerelease,
+            INativeTaskLogger logger
+        )
+        {
+            logger.Log(
+                $"Begin local folder package search for query={query} on source {source.Name} "
+                    + $"at Directory={directory} of manager {Name}"
+            );
+
+            Dictionary<string, LocalNuGetPackage> latest = new(StringComparer.OrdinalIgnoreCase);
+            foreach (LocalNuGetPackage candidate in NuGetLocalFeed.Enumerate(directory))
+            {
+                if (candidate.IsPreRelease && !canPrerelease)
+                    continue;
+
+                if (!NuGetLocalFeed.MatchesQuery(candidate, query, UseSubstringSearch))
+                    continue;
+
+                if (
+                    latest.TryGetValue(candidate.Id, out LocalNuGetPackage? current)
+                    && !IsNewerVersion(candidate.Version, current.Version)
+                )
+                    continue;
+
+                latest[candidate.Id] = candidate;
+            }
+
+            List<Package> packages = [];
+            foreach (LocalNuGetPackage found in latest.Values)
+            {
+                logger.Log(
+                    $"Found package {found.Id} version {found.Version} on source {source.Name}"
+                );
+
+                packages.Add(
+                    new Package(
+                        CoreTools.FormatAsName(found.Id),
+                        found.Id,
+                        found.Version,
+                        source,
+                        this
+                    )
+                );
+            }
+
+            return packages;
+        }
+
+        internal IReadOnlyList<Package> GetAvailableUpdatesLocal(
+            IManagerSource source,
+            string directory,
+            IReadOnlyList<IPackage> installedPackages,
+            bool canPrerelease,
+            INativeTaskLogger logger
+        )
+        {
+            Dictionary<string, List<LocalNuGetPackage>> availableById = new(
+                StringComparer.OrdinalIgnoreCase
+            );
+
+            foreach (LocalNuGetPackage candidate in NuGetLocalFeed.Enumerate(directory))
+            {
+                if (candidate.IsPreRelease && !canPrerelease)
+                    continue;
+
+                if (!availableById.TryGetValue(candidate.Id, out List<LocalNuGetPackage>? entries))
+                    availableById[candidate.Id] = entries = [];
+
+                entries.Add(candidate);
+            }
+
+            var installed = new Dictionary<string, (string Id, string Version)>();
+            foreach (IPackage package in installedPackages)
+                installed[package.Id.ToLower()] = (package.Id, package.VersionString);
+
+            var scopeMap = BuildInstalledScopeMap(installedPackages);
+            List<Package> packages = [];
+
+            foreach ((string id, string installedVersion) in installed.Values)
+            {
+                if (!availableById.TryGetValue(id, out List<LocalNuGetPackage>? entries))
+                    continue;
+
+                string? newest = null;
+                foreach (LocalNuGetPackage candidate in entries)
+                {
+                    if (!IsNewerVersion(candidate.Version, installedVersion))
+                        continue;
+
+                    if (newest is null || IsNewerVersion(candidate.Version, newest))
+                        newest = candidate.Version;
+                }
+
+                if (newest is null)
+                    continue;
+
+                logger.Log($"Found package {id} version {newest} on source {source.Name}");
+
+                packages.Add(
+                    new Package(
+                        CoreTools.FormatAsName(id),
+                        id,
+                        installedVersion,
+                        newest,
+                        source,
+                        this,
+                        new OverridenInstallationOptions(scopeMap.GetValueOrDefault(id.ToLower()))
+                    )
+                );
+            }
+
+            return packages;
+        }
+
+        private bool IsNewerVersion(string candidate, string current) =>
+            CompareVersions(candidate, current) is { } comparison
+                ? comparison > 0
+                : CoreTools.VersionStringToStruct(candidate)
+                    > CoreTools.VersionStringToStruct(current);
+
         internal IReadOnlyList<Package> FindPackagesV3(
             IManagerSource source,
             string query,
@@ -324,6 +456,20 @@ protected override IReadOnlyList<Package> GetAvailableUpdates_UnSafe()
             {
                 try
                 {
+                    if (NuGetLocalFeed.TryGetDirectory(pair.Key, out string localDirectory))
+                    {
+                        Packages.AddRange(
+                            GetAvailableUpdatesLocal(
+                                pair.Key,
+                                localDirectory,
+                                pair.Value,
+                                canPrerelease,
+                                logger
+                            )
+                        );
+                        continue;
+                    }
+
                     if (NuGetV3ServiceIndex.IsV3Source(pair.Key))
                     {
                         var v3Updates = GetAvailableUpdatesV3(