@blamejs/core 0.15.10 → 0.15.12

package/lib/mcp.js

@@ -435,7 +435,28 @@ var PROMPT_INJECTION_MARKERS = [
   "</?(?:assistant|system|user|tool)>",
 ];
 var INJECTION_RE = new RegExp(PROMPT_INJECTION_MARKERS.join("|"), "i");                          // allow:dynamic-regex — composed from the const PROMPT_INJECTION_MARKERS list above; not operator-supplied input
-var DANGEROUS_HTML_RE = /<script\b|<iframe\b|<object\b|<embed\b|javascript:/i;
+// vbscript: and data:text/html are dangerous URL schemes the guard claims to
+// neutralize but the original alternation omitted (CodeQL js/incomplete-url-
+// scheme-check). data: is scoped to text/html so a benign data:image/png isn't
+// over-redacted. The alternation stays linear (no nested quantifier).
+var DANGEROUS_HTML_RE = /<script\b|<iframe\b|<object\b|<embed\b|javascript:|vbscript:|data:\s*text\/html/i;
+
+// Global variants for sanitize-mode redaction. A non-global .replace removes
+// only the LEFTMOST match, so on `data:text/html,<script>alert(1)</script>`
+// the leftmost `data:text/html` would be stripped and the executable
+// `<script>` left behind — sanitize mode returning runnable HTML. _redactAll
+// replaces EVERY dangerous token, repeating to a fixpoint in case removing one
+// abuts two halves into a new one. Input byte-length is bounded by the caller,
+// and [REDACTED] introduces no dangerous token, so the loop terminates quickly.
+var INJECTION_RE_G = new RegExp(PROMPT_INJECTION_MARKERS.join("|"), "gi");                        // allow:dynamic-regex — same const-composed source as INJECTION_RE
+var DANGEROUS_HTML_RE_G = /<script\b|<iframe\b|<object\b|<embed\b|javascript:|vbscript:|data:\s*text\/html/gi;
+
+function _redactAll(text, globalRe) {
+  var out = text;
+  var prev;
+  do { prev = out; out = out.replace(globalRe, "[REDACTED]"); } while (out !== prev);
+  return out;
+}
 
 function _toolResultSanitize(result, opts) {
   opts = opts || {};
@@ -475,14 +496,15 @@ function _toolResultSanitize(result, opts) {
       if (INJECTION_RE.test(regexInput)) {                                                       // allow:regex-no-length-cap regexInput byteLength bounded above
         issues.push({ kind: "prompt-injection", index: i });
         if (posture === "sanitize") {
-          // Strip the injection marker line — operators wanting
-          // structural redaction wire their own classifier.
-          t = t.replace(INJECTION_RE, "[REDACTED]");
+          // Strip EVERY injection marker — operators wanting structural
+          // redaction wire their own classifier. Global fixpoint redact so a
+          // second marker after the first isn't left behind.
+          t = _redactAll(t, INJECTION_RE_G);
         }
       }
       if (DANGEROUS_HTML_RE.test(regexInput)) {                                                  // allow:regex-no-length-cap regexInput byteLength bounded above
         issues.push({ kind: "dangerous-html", index: i });
-        if (posture === "sanitize") t = t.replace(DANGEROUS_HTML_RE, "[REDACTED]");
+        if (posture === "sanitize") t = _redactAll(t, DANGEROUS_HTML_RE_G);
       }
       cleaned.push({ type: "text", text: t });
     } else if (block.type === "image" || block.type === "resource_link" || block.type === "audio") {
@@ -922,7 +944,7 @@ function _elicitationGuard(opts) {
       }
       if (posture === "sanitize") {
         return Object.assign({}, elicitRequest, {
-          message: message.replace(INJECTION_RE, "[REDACTED]"),
+          message: _redactAll(message, INJECTION_RE_G),
         });
       }
     }

package/lib/middleware/body-parser.js

@@ -375,6 +375,19 @@ function _detectSmuggling(req) {
   return null;
 }
 
+// Generic, operator-safe status phrase for a client error body — used when the
+// thrown error is NOT a framework-classified BodyParserError (or is a 5xx), so
+// an internal exception's message (fs errno + tmp path, a parse hook's thrown
+// detail) is never echoed to the client (CWE-209 / CodeQL js/stack-trace-exposure).
+var _GENERIC_REASON = {};
+_GENERIC_REASON[HTTP_STATUS.BAD_REQUEST]            = "Bad Request";
+_GENERIC_REASON[HTTP_STATUS.PAYLOAD_TOO_LARGE]      = "Payload Too Large";
+_GENERIC_REASON[HTTP_STATUS.UNSUPPORTED_MEDIA_TYPE] = "Unsupported Media Type";
+_GENERIC_REASON[HTTP_STATUS.INTERNAL_SERVER_ERROR]  = "Internal Server Error";
+function _genericReason(status) {
+  return _GENERIC_REASON[status] || (status >= 500 ? "Internal Server Error" : "Bad Request");
+}
+
 function _writeError(res, status, message, code) {
   if (res.headersSent) return;
   var body = JSON.stringify({ error: message, code: code });
@@ -469,10 +482,13 @@ async function _parseJson(req, opts) {
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
-    catch (e) {
+    catch (_e) {
       throw new BodyParserError(
         "body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)),
+        // Operator parseHook threw — surface a fixed, safe message; the hook's
+        // own thrown detail (which may carry secrets) is the operator's to log,
+        // never echoed to the client (CWE-209).
+        "request body rejected by parse hook",
         true, HTTP_STATUS.BAD_REQUEST
       );
     }
@@ -1476,8 +1492,32 @@ function create(opts) {
       }
       var status = (e && typeof e.statusCode === "number") ? e.statusCode : HTTP_STATUS.BAD_REQUEST;
       var code   = (e && typeof e.code === "string") ? e.code : "body-parser/error";
-      var message = (e && e.message) ? e.message : String(e);
-      _writeError(res, status, message, code);
+      // Only a framework-classified 4xx BodyParserError carries a curated,
+      // operator-safe message (malformed JSON, poisoned key, smuggling). Any
+      // other thrown error — and every 5xx — gets a generic status phrase, so
+      // an internal exception (fs errno + tmp path, a parse hook's thrown
+      // secret) is never echoed to the client (CWE-209). The full diagnostic
+      // stays on the audit chain, redacted by safeEmit.
+      // Object(e) tolerates a non-object throw (throw null, or a string from
+      // an operator parse hook) without a truthiness guard on the caught
+      // binding — the caught value is always defined to CodeQL, so `e && …`
+      // reads as a dead sub-condition; this keeps the null-safety explicit.
+      var eo = Object(e);
+      var clientMessage = (eo.isBodyParserError === true && status < 500 && typeof eo.message === "string")
+        ? eo.message
+        : _genericReason(status);
+      try {
+        audit().safeEmit({
+          action:  "body-parser.error",
+          outcome: status >= 500 ? "failure" : "denied",
+          metadata: {
+            status:  status,
+            code:    code,
+            message: (e && e.message) ? String(e.message).slice(0, 256) : "",
+          },
+        });
+      } catch (_e) { /* audit best-effort — never mask the response */ }
+      _writeError(res, status, clientMessage, code);
     }
   };
 }
@@ -1501,9 +1541,11 @@ async function _parseJsonFromBuf(buf, opts) {
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
-    catch (e) {
+    catch (_e) {
+      // Operator parseHook threw — fixed safe message; the hook's thrown
+      // detail (possible secrets) is never echoed to the client (CWE-209).
       throw new BodyParserError("body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)), true, HTTP_STATUS.BAD_REQUEST);
+        "request body rejected by parse hook", true, HTTP_STATUS.BAD_REQUEST);
     }
   }
   return parsed;

package/lib/middleware/bot-disclose.js

@@ -29,6 +29,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var safeBuffer = require("../safe-buffer");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -140,11 +141,12 @@ function create(opts) {
       if (typeof ct !== "string" || ct.indexOf("text/html") === -1) return chunk;
       var body = Buffer.isBuffer(chunk) ? chunk.toString("utf8") :
         (typeof chunk === "string" ? chunk : "");
-      // Inject after <body> opening tag if present, else after <html>
-      // opening tag, else prepend.
-      var bodyMatch = body.match(/<body[^>]*>/i);
-      if (bodyMatch) {
-        var idx = bodyMatch.index + bodyMatch[0].length;
+      // Inject after the <body> opening tag if present, else prepend.
+      // Linear tag-find — NOT body.match(/<body[^>]*>/i), which is O(n^2)
+      // in V8 on a body carrying many `<body` starts with no closing `>`
+      // (rendered user content can produce exactly that).
+      var idx = safeBuffer.indexAfterOpenTag(body, "body");
+      if (idx !== -1) {
         body = body.slice(0, idx) + "\n" + bannerHtml + "\n" + body.slice(idx);
       } else {
         body = bannerHtml + "\n" + body;

package/lib/middleware/speculation-rules.js

@@ -65,6 +65,7 @@
  */
 
 var validateOpts = require("../validate-opts");
+var safeBuffer = require("../safe-buffer");
 
 // Per W3C draft + Chromium implementation. `immediate` triggers the
 // speculation as soon as the rules are seen; `conservative` waits
@@ -287,10 +288,11 @@ function create(opts) {
       if (headClose !== -1) {
         body = body.slice(0, headClose) + tag + body.slice(headClose);
       } else {
-        var bodyOpen = body.match(/<body[^>]*>/i);
-        if (bodyOpen) {
-          var idx = bodyOpen.index + bodyOpen[0].length;
-          body = body.slice(0, idx) + tag + body.slice(idx);
+        // Linear tag-find — NOT body.match(/<body[^>]*>/i) (O(n^2) in V8
+        // on a body with many `<body` starts and no closing `>`).
+        var bodyIdx = safeBuffer.indexAfterOpenTag(body, "body");
+        if (bodyIdx !== -1) {
+          body = body.slice(0, bodyIdx) + tag + body.slice(bodyIdx);
         } else {
           // No <head> or <body> — prepend so the rules at least
           // reach the parser. This matches the bot-disclose fallback.

package/lib/network-dns.js

@@ -149,7 +149,7 @@ function setServers(serverList) {
     throw new DnsError("dns/setservers-failed", "dns.setServers failed: " + e.message);
   }
   _clearCache();
-  _emitObs("network.dns.servers.set", { count: serverList.length });
+  observability().safeEvent("network.dns.servers.set", 1, { count: serverList.length });
 }
 
 function getServers() {
@@ -169,7 +169,7 @@ function setResultOrder(order) {
     try { dns.setDefaultResultOrder(order); } catch (_e) { /* node may not support setter on this version — best-effort */ }
   }
   _clearCache();
-  _emitObs("network.dns.result_order.set", { order: order });
+  observability().safeEvent("network.dns.result_order.set", 1, { order: order });
 }
 
 function setFamily(fam) {
@@ -215,7 +215,7 @@ function useSystemResolver() {
   STATE.systemResolver = true;
   _resetDotPool();
   _clearCache();
-  _emitObs("network.dns.system_resolver.set", {});
+  observability().safeEvent("network.dns.system_resolver.set", 1, {});
 }
 
 function useDnsOverHttps(opts) {
@@ -246,7 +246,7 @@ function useDnsOverHttps(opts) {
   }
   STATE.doh = { url: url, method: method, ca: opts.ca || null };
   _clearCache();
-  _emitObs("network.dns.doh.set", { url: url, method: method || "auto" });
+  observability().safeEvent("network.dns.doh.set", 1, { url: url, method: method || "auto" });
 }
 
 function useDnsOverTls(opts) {
@@ -267,7 +267,7 @@ function useDnsOverTls(opts) {
   };
   _resetDotPool();
   _clearCache();
-  _emitObs("network.dns.dot.set", { host: STATE.dot.host, port: STATE.dot.port });
+  observability().safeEvent("network.dns.dot.set", 1, { host: STATE.dot.host, port: STATE.dot.port });
 }
 
 function _withTimeout(promise, ms, host) {
@@ -1178,13 +1178,13 @@ async function _querySvcbLike(host, qtype, opts) {
     throw new DnsError("dns/bad-transport",
       "dns.querySvcb: transport must be 'doh' | 'dot' | 'system' | undefined");
   }
-  _emitObs("network.dns.svcb.requested", { qtype: qtype, transport: opts.transport || "auto" });
+  observability().safeEvent("network.dns.svcb.requested", 1, { qtype: qtype, transport: opts.transport || "auto" });
   var startMs = _now();
   var reply;
   try {
     reply = await _rawQuery(host, qtype, opts.transport);
   } catch (e) {
-    _emitObs("network.dns.svcb.failure", {
+    observability().safeEvent("network.dns.svcb.failure", 1, {
       latencyMs: _now() - startMs,
       code:      e.code || "unknown",
     });
@@ -1198,7 +1198,7 @@ async function _querySvcbLike(host, qtype, opts) {
     records.push(_parseSvcbRdata(decoded.msg, ans.rdataOff, ans.rdlen));
   }
   records.sort(function (a, b) { return a.priority - b.priority; });
-  _emitObs("network.dns.svcb.success", {
+  observability().safeEvent("network.dns.svcb.success", 1, {
     latencyMs: _now() - startMs,
     count:     records.length,
     qtype:     qtype,
@@ -1322,7 +1322,7 @@ async function discoverEncrypted(opts) {
   try {
     records = await _querySvcbLike(name, DNS_QTYPE_SVCB, { transport: transport });
   } catch (e) {
-    _emitObs("network.dns.ddr.failure", {
+    observability().safeEvent("network.dns.ddr.failure", 1, {
       latencyMs: _now() - startMs,
       code:      e.code || "unknown",
     });
@@ -1333,7 +1333,7 @@ async function discoverEncrypted(opts) {
     throw e;
   }
   if (records.length === 0) {
-    _emitObs("network.dns.ddr.empty", { latencyMs: _now() - startMs });
+    observability().safeEvent("network.dns.ddr.empty", 1, { latencyMs: _now() - startMs });
     throw new DnsError("dns/ddr-not-discovered",
       "dns.discoverEncrypted: resolver returned empty DDR record set at " + name);
   }
@@ -1364,7 +1364,7 @@ async function discoverEncrypted(opts) {
     throw new DnsError("dns/ddr-not-discovered",
       "dns.discoverEncrypted: DDR records present but none advertised a recognized transport (alpn=dot/h2/h3)");
   }
-  _emitObs("network.dns.ddr.success", {
+  observability().safeEvent("network.dns.ddr.success", 1, {
     latencyMs: _now() - startMs,
     count:     resolvers.length,
   });
@@ -1454,7 +1454,7 @@ function useDesignatedResolvers(list) {
         });
       }
       _designatedResolvers = validated.slice();
-      _emitObs("network.dns.dnr.set", {
+      observability().safeEvent("network.dns.dnr.set", 1, {
         count:     validated.length,
         active:    j,
         transport: v.transport,
@@ -1462,7 +1462,7 @@ function useDesignatedResolvers(list) {
       return { active: j, count: validated.length };
     } catch (e) {
       lastErr = e;
-      _emitObs("network.dns.dnr.entry_failed", {
+      observability().safeEvent("network.dns.dnr.entry_failed", 1, {
         index:     j,
         transport: v.transport,
         code:      e.code || "unknown",
@@ -1511,7 +1511,7 @@ async function lookup(host, opts) {
     if (cached.error) throw cached.error;
     return opts.all ? cached.value : cached.value[0];
   }
-  _emitObs("network.dns.lookup.requested", { family: cacheKey });
+  observability().safeEvent("network.dns.lookup.requested", 1, { family: cacheKey });
   var startMs = _now();
   // Resolve secure-DNS default on first use. Idempotent.
   _ensureSecureDefault();
@@ -1546,11 +1546,11 @@ async function lookup(host, opts) {
       throw new DnsError("dns/no-result", "dns lookup of '" + host + "' returned no addresses");
     }
     _cachePutPositive(host, cacheKey, normalized);
-    _emitObs("network.dns.lookup.success", { latencyMs: _now() - startMs, count: normalized.length });
+    observability().safeEvent("network.dns.lookup.success", 1, { latencyMs: _now() - startMs, count: normalized.length });
     return opts.all ? normalized : normalized[0];
   } catch (e) {
     _cachePutNegative(host, cacheKey, e);
-    _emitObs("network.dns.lookup.failure", { latencyMs: _now() - startMs, code: e.code || "unknown" });
+    observability().safeEvent("network.dns.lookup.failure", 1, { latencyMs: _now() - startMs, code: e.code || "unknown" });
     throw e;
   }
 }
@@ -1571,7 +1571,7 @@ async function _resolveProtocol(host, family, opts) {
     throw new DnsError("dns/bad-transport",
       "dns.resolve" + family + ": transport must be 'doh' | 'dot' | 'system' | undefined");
   }
-  _emitObs("network.dns.resolve.requested", { family: family, transport: opts.transport || "auto" });
+  observability().safeEvent("network.dns.resolve.requested", 1, { family: family, transport: opts.transport || "auto" });
   var startMs = _now();
   try {
     var addrs;
@@ -1597,10 +1597,10 @@ async function _resolveProtocol(host, family, opts) {
     if (normalized.length === 0) {
       throw new DnsError("dns/no-result", "dns.resolve" + family + " of '" + host + "' returned no addresses");
     }
-    _emitObs("network.dns.resolve.success", { family: family, latencyMs: _now() - startMs, count: normalized.length });
+    observability().safeEvent("network.dns.resolve.success", 1, { family: family, latencyMs: _now() - startMs, count: normalized.length });
     return normalized;
   } catch (e) {
-    _emitObs("network.dns.resolve.failure", { family: family, latencyMs: _now() - startMs, code: e.code || "unknown" });
+    observability().safeEvent("network.dns.resolve.failure", 1, { family: family, latencyMs: _now() - startMs, code: e.code || "unknown" });
     if (e instanceof DnsError) throw e;
     throw new DnsError("dns/resolve-failed",
       "dns.resolve" + family + " of '" + host + "' failed: " + (e.message || String(e)));
@@ -1643,16 +1643,16 @@ async function reverse(ip) {
     throw new DnsError("dns/bad-ip",
       "dns.reverse: '" + ip + "' is not a valid IPv4 or IPv6 address");
   }
-  _emitObs("network.dns.reverse.requested", { family: net.isIPv6(ip) ? 6 : 4 });
+  observability().safeEvent("network.dns.reverse.requested", 1, { family: net.isIPv6(ip) ? 6 : 4 });
   var startMs = _now();
   try {
     var ptrs = await _withTimeout(dnsPromises.reverse(ip), STATE.lookupTimeoutMs, ip);
-    _emitObs("network.dns.reverse.success", {
+    observability().safeEvent("network.dns.reverse.success", 1, {
       latencyMs: _now() - startMs, count: Array.isArray(ptrs) ? ptrs.length : 0,
     });
     return Array.isArray(ptrs) ? ptrs : [];
   } catch (e) {
-    _emitObs("network.dns.reverse.failure", {
+    observability().safeEvent("network.dns.reverse.failure", 1, {
       latencyMs: _now() - startMs, code: e.code || "unknown",
     });
     if (e instanceof DnsError) throw e;
@@ -1674,10 +1674,6 @@ function nodeLookup(host, options, callback) {
   );
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;

package/lib/network-heartbeat.js

@@ -259,7 +259,7 @@ function statuses() {
 
 function _emitObsProbe(entry, result) {
   try {
-    observability().emit("network.heartbeat.probe", {
+    observability().safeEvent("network.heartbeat.probe", 1, {
       name:      entry.target.name,
       type:      entry.target.type,
       ok:        result.ok,
@@ -381,7 +381,7 @@ function passive(opts) {
 
 function _emitObsPong(state) {
   try {
-    observability().emit("network.heartbeat.passive.pong", {
+    observability().safeEvent("network.heartbeat.passive.pong", 1, {
       pongCount:  state.pongCount,
       timeoutMs:  state.timeoutMs,
     });
@@ -390,7 +390,7 @@ function _emitObsPong(state) {
 
 function _emitObsTimeout(state) {
   try {
-    observability().emit("network.heartbeat.passive.timeout", {
+    observability().safeEvent("network.heartbeat.passive.timeout", 1, {
       pongCount:  state.pongCount,
       lastPongMs: state.lastPongMs,
       timeoutMs:  state.timeoutMs,

package/lib/network-proxy.js

@@ -70,7 +70,7 @@ function set(opts) {
   if (opts.no !== undefined)    STATE.noProxy = _parseNoProxy(opts.no);
   if (opts.auth !== undefined)  STATE.auth = opts.auth ? _parseAuth(opts.auth) : null;
   STATE.agentCache.clear();
-  _emitObs("network.proxy.set", {
+  observability().safeEvent("network.proxy.set", 1, {
     httpSet:  !!STATE.http,
     httpsSet: !!STATE.https,
     noProxyCount: STATE.noProxy.length,
@@ -93,7 +93,7 @@ function fromEnv(envObj) {
   if (authEnv)    { STATE.auth = _parseAuth(authEnv);         changed = true; }
   if (changed) {
     STATE.agentCache.clear();
-    _emitObs("network.proxy.from_env", {
+    observability().safeEvent("network.proxy.from_env", 1, {
       httpSet:  !!STATE.http,
       httpsSet: !!STATE.https,
       noProxyCount: STATE.noProxy.length,
@@ -255,7 +255,7 @@ function agentFor(targetUrl) {
     };
   }
   STATE.agentCache.set(key, agent);
-  _emitObs("network.proxy.agent.created", { protocol: u.protocol });
+  observability().safeEvent("network.proxy.agent.created", 1, { protocol: u.protocol });
   return agent;
 }
 
@@ -268,10 +268,6 @@ function snapshot() {
   };
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
   STATE.agentCache.clear();

package/lib/network-tls.js

@@ -23,6 +23,29 @@ var networkDns = lazyRequire(function () { return require("./network-dns"); });
 var httpClient = lazyRequire(function () { return require("./http-client"); });
 var asn1 = require("./asn1-der");
 
+// Audit + observability emit for an outbound TLS connection that runs with
+// peer-certificate validation DISABLED (an explicit operator opt-in —
+// rejectUnauthorized:false / allowInsecure — never a framework default).
+// Emitted at the point the disable is HONORED so the degraded posture is
+// observable (compliance evidence + incident response), parallel to the
+// tls.classical_downgrade audit. Drop-silent best-effort (§8 hot-path sink) —
+// an audit-sink failure must never break the TLS connect itself.
+function auditInsecureTls(meta) {
+  meta = meta || {};
+  try {
+    observability().safeEvent("tls.insecure_skip_verify", 1, {
+      host: meta.host || null, port: meta.port || null, source: meta.source || null,
+    });
+  } catch (_e) { /* drop-silent */ }
+  try {
+    audit().safeEmit({
+      action:  "tls.insecure_skip_verify",
+      outcome: "success",
+      metadata: { host: meta.host || null, port: meta.port || null, source: meta.source || null },
+    });
+  } catch (_e) { /* drop-silent — audit best-effort, never break TLS */ }
+}
+
 // STATE.tlsKeyShares is initialized to the default PQC group list at
 // module load — operator setKeyShares() overrides; resetKeyShares()
 // restores the default. Empty array means "fall back to Node's TLS
@@ -144,7 +167,7 @@ function addCa(pemOrPath, opts) {
     added.push(meta);
   }
   _emitAuditAdd(added, opts);
-  _emitObs("network.tls.ca.added", { count: added.length });
+  observability().safeEvent("network.tls.ca.added", 1, { count: added.length });
   return added;
 }
 
@@ -154,7 +177,7 @@ function addCaBundle(p, opts) {
 
 function useSystemTrust(enable) {
   STATE.systemTrust = enable !== false;
-  _emitObs("network.tls.system_trust.set", { enabled: STATE.systemTrust });
+  observability().safeEvent("network.tls.system_trust.set", 1, { enabled: STATE.systemTrust });
 }
 
 function isSystemTrustEnabled() { return !!STATE.systemTrust; }
@@ -216,7 +239,7 @@ function removeCa(fingerprint256, opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove");
-  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "operator" });
+  observability().safeEvent("network.tls.ca.removed", 1, { count: removed.length, reason: "operator" });
   return removed.length;
 }
 
@@ -234,7 +257,7 @@ function removeCaByLabel(label, opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove-by-label");
-  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "label" });
+  observability().safeEvent("network.tls.ca.removed", 1, { count: removed.length, reason: "label" });
   return removed.length;
 }
 
@@ -243,7 +266,7 @@ function clearAll(opts) {
   var removed = STATE.cas.map(function (e) { return Object.assign({ label: e.label }, e.meta); });
   STATE.cas = [];
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-clear-all");
-  _emitObs("network.tls.ca.cleared", { count: removed.length });
+  observability().safeEvent("network.tls.ca.cleared", 1, { count: removed.length });
   return removed.length;
 }
 
@@ -260,7 +283,7 @@ function purgeExpired(opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "expired");
-  _emitObs("network.tls.ca.purged_expired", { count: removed.length });
+  observability().safeEvent("network.tls.ca.purged_expired", 1, { count: removed.length });
   return removed.length;
 }
 
@@ -705,10 +728,6 @@ function _emitAuditAdd(metaList, opts) {
   }
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   STATE.cas = [];
   STATE.systemTrust = false;
@@ -2725,6 +2744,7 @@ function connectWithEch(opts) {
       }
       if (opts.rejectUnauthorized === false) {
         connectOpts.rejectUnauthorized = false;
+        auditInsecureTls({ host: opts.host, port: port, source: "network.tls.connectWithEch" });
       }
       var echAttached = false;
       if (echConfigBuf && nodeSupportsEch) {
@@ -2735,7 +2755,7 @@ function connectWithEch(opts) {
         // gracefully with a one-shot warn so operators know they're
         // sending an outer-only ClientHello.
         try {
-          observability().emit("network.tls.ech.unsupported", {
+          observability().safeEvent("network.tls.ech.unsupported", 1, {
             host: opts.host, source: sourceLabel,
           });
         } catch (_e) { /* drop-silent */ }
@@ -2772,7 +2792,7 @@ function connectWithEch(opts) {
         settled = true;
         if (to) clearTimeout(to);
         try {
-          observability().emit("network.tls.ech.connected", {
+          observability().safeEvent("network.tls.ech.connected", 1, {
             host: opts.host, echAttached: echAttached, source: sourceLabel,
           });
         } catch (_e) { /* drop-silent */ }
@@ -2832,7 +2852,7 @@ function connectWithEch(opts) {
       // operator still gets a working TLS session. Emit obs so the
       // operator sees the degradation.
       try {
-        observability().emit("network.tls.ech.dns_failed", {
+        observability().safeEvent("network.tls.ech.dns_failed", 1, {
           host: opts.host, error: (e && e.message) || String(e),
         });
       } catch (_e) { /* drop-silent */ }
@@ -3174,6 +3194,7 @@ function wrapSNICallback(operatorCb) {
 }
 
 module.exports = {
+  auditInsecureTls:    auditInsecureTls,
   addCa:               addCa,
   addCaBundle:         addCaBundle,
   removeCa:            removeCa,

package/lib/network.js

@@ -151,7 +151,7 @@ var ntpFacade = {
       throw new NetworkError("ntp/bad-servers", "ntp.setServers: expected non-empty array");
     }
     ntpFacade._defaultServers = list.slice();
-    _emitObs("network.ntp.servers.set", { count: list.length });
+    observability().safeEvent("network.ntp.servers.set", 1, { count: list.length });
   },
   getServers:     function () {
     return (ntpFacade._defaultServers || ntpCheck.DEFAULT_SERVERS).slice();
@@ -262,7 +262,7 @@ function bootFromEnv(opts) {
       } catch (_e) { /* audit best-effort — never break boot */ }
     }
   }
-  _emitObs("network.boot.from_env", { source: "env" });
+  observability().safeEvent("network.boot.from_env", 1, { source: "env" });
   return applied;
 }
 
@@ -301,10 +301,6 @@ function snapshot() {
   };
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   ntpFacade._defaultServers = null;
   ntpFacade._defaultTimeoutMs = null;