@blamejs/core 0.15.43 → 0.15.45

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.45 (2026-06-28) — **`b.selfUpdate.swap` now re-hashes the asset against the hash `verify` returned and refuses to install on a mismatch, closing the window where an asset swapped between verify and swap could be installed after the signature check passed.** selfUpdate.verify (signature-checks the asset and returns its hash) and selfUpdate.swap (renames the new asset into place) were two separate path-keyed operations with nothing binding the bytes swap installs to the bytes verify checked. An attacker able to write the asset path in the window between the two calls — or who pointed verify at a different inode via a symlink — could have the signature-verified bytes replaced before swap renamed the file into place, installing unverified code. swap now requires an expectedHash and re-hashes the from bytes against it immediately before the install, refusing with selfupdate/swap-hash-mismatch on any difference; the re-check runs right before the rename so the residual is a sub-millisecond window rather than the operator-controlled gap between verify and swap. Because swap now requires expectedHash, callers must pass the hash that verify returned (await verify(...) then swap({ ..., expectedHash: result.hash })). **Security:** *self-update install is bound to the signature-verified bytes (verify→swap TOCTOU closed)* — selfUpdate.swap renamed the new asset into place with no integrity re-check, so the bytes it installed were not bound to the bytes selfUpdate.verify had signature-checked: an attacker who could write the asset path between verify and swap (or repoint a symlink) could install unverified code. swap now re-hashes the from bytes against a required expectedHash (the hash verify returns) immediately before the install and refuses a mismatch (selfupdate/swap-hash-mismatch), with the check positioned right before the rename to minimize the residual window. A symlinked or differing-inode asset is caught the same way, because the install source is what gets re-hashed. **Migration:** *selfUpdate.swap requires expectedHash* — swap now requires an expectedHash option (refused at the call with selfupdate/bad-expected-hash if absent). Pass the hash that selfUpdate.verify returns: const v = await selfUpdate.verify({ assetPath, signaturePath, pubkeyPem }); await selfUpdate.swap({ from, to, backupTo, expectedHash: v.hash }). An optional hashAlgo (default sha3-512, matching verify's default) selects the digest when verify used a non-default algorithm.
+
+- v0.15.44 (2026-06-28) — **`b.fileUpload` now rejects the bare path tokens "." and ".." as upload IDs, closing a path traversal where a ".." id resolved to the staging directory's parent and a cancel or cleanup could recursively delete it.** b.fileUpload validated the uploadId with a character-class regex that permits the dot character, so the bare path tokens "." and ".." passed validation even though they are not ordinary identifiers. The uploadId is joined under the configured staging directory to locate an upload's files, so "." resolved to the staging directory itself and ".." to its parent: an operation keyed on a ".." uploadId acted OUTSIDE the staging directory. The most damaging path is cancelUpload (and finalize/expiry cleanup), which removes the upload directory with a recursive rmSync — keyed on ".." that would recursively delete the staging directory's parent; chunk writes for a ".." id also land outside staging. The validator now rejects "." and ".." before any filesystem operation. Every public method validates the uploadId there, so init, acceptChunk, finalize, status, and cancelUpload are all covered, and legitimate dotted IDs (for example "build.v2") are unaffected. **Security:** *Upload IDs of "." and ".." are refused (path-traversal / parent-directory deletion)* — fileUpload's uploadId regex allows the dot character, so the bare tokens "." and ".." passed validation and, joined under the staging directory, resolved to the staging directory or its parent. An operation keyed on a ".." id acted outside staging — most seriously cancelUpload / cleanup, whose recursive rmSync would have deleted the staging directory's parent, and chunk writes that would land outside staging. The validator now rejects "." and ".." up front; because every public method validates the id, init / acceptChunk / finalize / status / cancelUpload are all covered. Legitimate dotted IDs are unaffected. Operators who never pass caller-controlled upload IDs were not exposed.
+
 - v0.15.43 (2026-06-28) — **`b.auth.lockout`'s failed-attempt counter now accumulates with an atomic compare-and-set, so a brute-force attacker spreading failed logins across multiple nodes can no longer lose increments and stay under the lockout threshold.** b.auth.lockout tracked failed attempts with a cache read-modify-write: read the counter, increment it, write it back. On a multi-node deployment two concurrent failures for the same account on different nodes both read the same value, each added one, and one write clobbered the other — a lost update that let an attacker spreading attempts across nodes exceed maxAttempts without ever triggering the lockout, weakening brute-force protection on a cluster. The counter now runs the whole decision (window decay, increment, lockout-ladder) through the cache's atomic update() (compare-and-set, retried on the cluster backend under contention), so every failure is counted regardless of which node records it. The lockout's documented fail-open posture is preserved — a genuinely unreachable cache still allows the attempt and signals the error — but a cache backend that cannot perform an atomic update now surfaces loud at first use instead of silently disabling the lockout. **Security:** *Lockout failure counter is atomic across nodes (no lost increments)* — b.auth.lockout accumulated failed attempts with a non-atomic cache get -> increment -> set, so concurrent failures for one account across a multi-node deployment lost increments and an attacker could exceed maxAttempts without engaging the lockout. The counter now uses the cache's atomic compare-and-set update(), counting every failure across nodes, with the existing exponential lockout ladder and window-decay logic unchanged. The cache backing a lockout must support atomic update() (b.cache does; the create() check now requires it), and a backend that can't commit an atomic update surfaces loud at first use rather than silently disabling brute-force protection. A genuinely unreachable cache still fails open by design.
 
 - v0.15.42 (2026-06-28) — **The agent orchestrator and tenant registries serialize registration per name, so two concurrent register() calls for the same name can no longer both create a row (duplicate-create / lost registration), and a new b.safeAsync.keyedSerializer exposes that per-key serialization.** b.agent.orchestrator and b.agent.tenant registered a name with a check-then-create: read the backend row for the name, throw a duplicate error if it exists, otherwise write the new row. Because the read and the write are separated by an await, two concurrent register() calls for the same name both observed absence and both wrote — a duplicate-create where the second silently clobbered the first and both callers saw success, violating the one-row-per-name invariant. register() (and unregister()) now run through a per-name in-process serializer, so concurrent calls for the same name apply one at a time and the second is correctly refused as a duplicate; distinct names still run concurrently. The serializer is exposed as b.safeAsync.keyedSerializer() for any read-modify-write or check-then-create that must not interleave per key. It is in-process only: a registry backend shared across processes still needs its own atomic create or unique constraint to refuse a cross-process duplicate. **Added:** *b.safeAsync.keyedSerializer — serialize async work per key* — b.safeAsync.keyedSerializer() returns a { run(key, fn) } that queues fn behind any in-flight or queued work for the same key and runs it once they settle, so a read-modify-write or a check-then-create on a shared store cannot interleave with another call for the same key in the same process. Distinct keys run concurrently, and the per-key chain is dropped once it drains. It is the serialization the agent registries now use, and the same primitive backs the lockout and bot-challenge per-key failure counters. **Fixed:** *Agent orchestrator + tenant registries serialize registration per name (no duplicate-create race)* — b.agent.orchestrator.register and b.agent.tenant.register did a check-then-create (await backend.get -> throw-if-exists -> await backend.set) with an await between the read and the write, so two concurrent registrations of the same name both passed the duplicate check and both wrote — the second silently clobbering the first while both callers saw success. Registration now serializes per name in-process, so concurrent calls for one name apply sequentially and the second is refused with the duplicate error; distinct names are unaffected. A backend shared across processes still needs its own uniqueness constraint to refuse a cross-process duplicate. **Detectors:** *Build guard: a registry check-then-create must serialize per key* — A codebase guard now fails the build if a primitive does an async check-then-create on a pluggable backend (await backend.get -> throw a /duplicate error -> await backend.set) without serializing per key, so the duplicate-create race fixed here cannot reappear at a new registry.

package/lib/file-upload.js

@@ -245,9 +245,16 @@ var UPLOAD_ID_RE = /^[A-Za-z0-9._-]+$/;
 var UPLOAD_ID_MAX_LENGTH = C.BYTES.bytes(128);
 
 function _validateUploadId(id) {
+  // The char-class allows '.', so the bare path tokens "." and ".." pass the
+  // regex; joined under stagingDir they resolve to the staging dir / its PARENT
+  // (path.join(stagingDir, "..") escapes), and a later rmSync would recurse into
+  // the parent. Reject them before any filesystem op — every public method
+  // validates the id here, so this guards init / acceptChunk / finalize /
+  // status / cancelUpload alike.
   if (typeof id !== "string" ||
       id.length === 0 ||
       id.length > UPLOAD_ID_MAX_LENGTH ||
+      id === "." || id === ".." ||
       !UPLOAD_ID_RE.test(id)) {
     var ID_PREVIEW_CHARS = C.BYTES.bytes(64);
     throw _err("BAD_UPLOAD_ID",

package/lib/self-update.js

@@ -28,9 +28,11 @@
  *        P-384 from the supplied PEM) and reports the bytes' hash for
  *        SBOM correlation. A mismatched signature throws and the swap
  *        never runs.
- *     4. `b.selfUpdate.swap({ from, to, backupTo })` performs the
- *        atomic install: copy the current `to` to `backupTo`, rename
- *        `from` → `to`, fsync both directories. Cross-device renames
+ *     4. `b.selfUpdate.swap({ from, to, backupTo, expectedHash })` performs
+ *        the atomic install: re-hash `from` and refuse unless it matches
+ *        `expectedHash` (the hash step 3 returned — binding the installed
+ *        bytes to the verified bytes), copy the current `to` to `backupTo`,
+ *        rename `from` → `to`, fsync both directories. Cross-device renames
  *        fall back to copy + unlink. Any failure rolls back from the
  *        backup. `b.selfUpdate.rollback({ to, backupTo })` restores
  *        the backup post-swap when a healthcheck reports the new
@@ -614,6 +616,18 @@ function _validateSwapOpts(opts, label) {
   if (label === "swap") {
     schema.from = { rule: "required-string", code: "selfupdate/bad-from",
                     label: "selfUpdate.swap: opts.from" };
+    // The bytes about to be installed are re-hashed and checked against the
+    // hash selfUpdate.verify returned, closing the verify -> swap window. The
+    // binding is mandatory — an optional integrity check is opt-in security.
+    schema.expectedHash = { rule: "required-string", code: "selfupdate/bad-expected-hash",
+                            label: "selfUpdate.swap: opts.expectedHash (the hash selfUpdate.verify returned)" };
+    schema.hashAlgo = function (value) {
+      if (value !== undefined &&
+          (typeof value !== "string" || ALLOWED_HASH_ALGS.indexOf(value) === -1)) {
+        throw new SelfUpdateError("selfupdate/bad-hash-algo",
+          "selfUpdate.swap: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
+      }
+    };
   }
   schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
                       label: "selfUpdate." + label + ": opts.to" };
@@ -664,24 +678,31 @@ async function _safeRollback(backupTo, to, hadOriginal) {
  * @since     0.6.0
  * @related   b.selfUpdate.verify, b.selfUpdate.rollback, b.atomicFile.copy
  *
- * Atomic install: copy the existing `to` to `backupTo`, rename `from`
- * → `to`, then fsync both directories. Cross-device renames fall back
- * to copy + unlink on the destination filesystem. On any failure the
- * original `to` is restored from `backupTo`. Throws SelfUpdateError on
- * a missing `from`, backup-copy failure, cross-device install failure,
+ * Atomic install: re-hash `from` and refuse unless it matches `expectedHash`
+ * (the hash selfUpdate.verify returned — this binds the installed bytes to the
+ * signature-verified bytes and closes the verify→swap window), copy the
+ * existing `to` to `backupTo`, rename `from` → `to`, then fsync both
+ * directories. Cross-device renames fall back to copy + unlink on the
+ * destination filesystem. On any failure the original `to` is restored from
+ * `backupTo`. Throws SelfUpdateError on a missing `from`, an
+ * expectedHash mismatch, backup-copy failure, cross-device install failure,
  * or rename failure.
  *
  * @opts
- *   from:     string,   // required — newly-installed asset path
- *   to:       string,   // required — target install path
- *   backupTo: string,   // required — backup path for the existing `to`
+ *   from:         string,   // required — newly-installed asset path
+ *   to:           string,   // required — target install path
+ *   backupTo:     string,   // required — backup path for the existing `to`
+ *   expectedHash: string,   // required — the hash selfUpdate.verify returned
+ *   hashAlgo:     string,   // sha3-512 (default) | sha-256 | sha-512 | shake256
  *
  * @example
+ *   var v = await b.selfUpdate.verify({ assetPath, signaturePath, pubkeyPem });
  *   try {
  *     await b.selfUpdate.swap({
- *       from:     "/tmp/blamejs-doc-missing.bin",
- *       to:       "/tmp/blamejs-doc-target.bin",
- *       backupTo: "/tmp/blamejs-doc-backup.bin",
+ *       from:         "/tmp/blamejs-doc-missing.bin",
+ *       to:           "/tmp/blamejs-doc-target.bin",
+ *       backupTo:     "/tmp/blamejs-doc-backup.bin",
+ *       expectedHash: v.hash,
  *     });
  *   } catch (e) {
  *     e.code;                 // → "selfupdate/missing-from"
@@ -698,6 +719,37 @@ async function swap(opts) {
       "selfUpdate.swap: from path does not exist: " + from);
   }
 
+  // Bind the installed object to the signature-verified bytes. Read `from` with
+  // O_NOFOLLOW (refuseSymlink) so a symlinked source is refused AT OPEN rather
+  // than followed — otherwise the bytes hashed (the link target) would differ
+  // from the object a by-path rename installs (the link itself). The verified
+  // bytes are then installed FROM MEMORY below, so the installed object is
+  // exactly what was hashed: no symlink-install surface and no time-of-check /
+  // time-of-use window between the hash and the install (which a by-path rename
+  // or re-read would reopen).
+  var swapAlg = opts.hashAlgo || DEFAULT_HASH_ALG;
+  var fromMode;
+  try { fromMode = (nodeFs.statSync(from).mode & 0o777); } catch (_m) { fromMode = 0o600; }
+  var fromBytes;
+  try {
+    fromBytes = atomicFile.fdSafeReadSync(from, {
+      maxBytes: typeof opts.maxBytes === "number" ? opts.maxBytes : C.BYTES.gib(1),
+      refuseSymlink: true,
+    });
+  } catch (e) {
+    throw new SelfUpdateError("selfupdate/swap-read-failed",
+      "selfUpdate.swap: failed to read from for the integrity re-check (a symlinked source is refused): " +
+      ((e && e.message) || String(e)));
+  }
+  var actualHash = nodeCrypto.createHash(swapAlg).update(fromBytes).digest("hex");
+  if (actualHash !== opts.expectedHash) {
+    _safeAuditEmit("selfupdate.swap.hash_mismatch", "denied", {
+      from: from, to: to, alg: swapAlg, expected: opts.expectedHash, actual: actualHash,
+    });
+    throw new SelfUpdateError("selfupdate/swap-hash-mismatch",
+      "selfUpdate.swap: from bytes do not match expectedHash (asset changed after verify?) — refusing to install");
+  }
+
   var toDir       = nodePath.dirname(to);
   var backupDir   = nodePath.dirname(backupTo);
   atomicFile.ensureDir(toDir);
@@ -716,53 +768,33 @@ async function swap(opts) {
     }
   }
 
-  // Step 3 — install. Rename is atomic on same FS; on cross-device we
-  // fall back to copy + unlink. Rollback failure on either branch
-  // surfaces as a DISTINCT error class and audit event so operators
-  // don't silently lose both binaries (the prior best-effort comment
-  // swallowed the rollback exception — SSDF RV.1 violation).
+  // Step 3 — install the verified in-memory bytes via an atomic temp+fsync+
+  // rename on the DESTINATION filesystem (atomicFile.write), so the installed
+  // object is exactly the bytes just hashed: cross-device is handled (the temp
+  // is created on the dest FS), there is no by-path re-read to race, and a
+  // symlinked source can't be moved into place. Roll back from the backup on
+  // failure; a rollback failure surfaces as a DISTINCT error class + audit
+  // event so operators don't silently lose both binaries (SSDF RV.1).
   try {
-    atomicFile.renameWithRetry(from, to);
+    await atomicFile.write(to, fromBytes, { fileMode: fromMode, overwrite: true });
   } catch (e) {
-    if (e && e.code === "EXDEV") {
-      // Cross-device — copy + unlink. Use atomicFile.copy for the safety
-      // net (temp+fsync+rename on dest FS); then remove the source.
-      try {
-        await atomicFile.copy(from, to, { fileMode: 0o600 });
-        try { nodeFs.unlinkSync(from); } catch (_u) { /* tmp source leak — operator-cleanable */ }
-      } catch (ce) {
-        // Roll back from backup if we have one. Rollback failure here
-        // is catastrophic — both the new asset (corrupt cross-device
-        // copy) AND the original (overwritten partial) are now
-        // unreachable. Surface to operator with a dedicated error.
-        var rbErrXdev = await _safeRollback(backupTo, to, hadOriginal);
-        if (rbErrXdev) {
-          throw new SelfUpdateError("selfupdate/swap-rollback-failed",
-            "selfUpdate.swap: cross-device install failed AND rollback ALSO " +
-            "failed — operator must manually restore from backupTo=" + backupTo +
-            ". install-error=" + ((ce && ce.message) || String(ce)) +
-            "; rollback-error=" + rbErrXdev.message);
-        }
-        throw new SelfUpdateError("selfupdate/cross-device",
-          "selfUpdate.swap: cross-device install failed: " + ((ce && ce.message) || String(ce)));
-      }
-    } else {
-      // Other rename failure — try to roll back. Same rollback-failure
-      // semantics as the cross-device branch.
-      var rbErr = await _safeRollback(backupTo, to, hadOriginal);
-      if (rbErr) {
-        throw new SelfUpdateError("selfupdate/swap-rollback-failed",
-          "selfUpdate.swap: rename " + from + " -> " + to + " failed AND " +
-          "rollback ALSO failed — operator must manually restore from " +
-          "backupTo=" + backupTo + ". rename-error=" + e.message +
-          "; rollback-error=" + rbErr.message);
-      }
-      throw new SelfUpdateError("selfupdate/swap-failed",
-        "selfUpdate.swap: rename " + from + " -> " + to + " failed: " + e.message);
+    var rbErr = await _safeRollback(backupTo, to, hadOriginal);
+    if (rbErr) {
+      throw new SelfUpdateError("selfupdate/swap-rollback-failed",
+        "selfUpdate.swap: install of " + to + " failed AND rollback ALSO failed — " +
+        "operator must manually restore from backupTo=" + backupTo +
+        ". install-error=" + ((e && e.message) || String(e)) +
+        "; rollback-error=" + rbErr.message);
     }
+    throw new SelfUpdateError("selfupdate/swap-failed",
+      "selfUpdate.swap: install of " + to + " failed: " + ((e && e.message) || String(e)));
   }
+  // Consume the source asset now that the verified bytes are installed
+  // (best-effort — the install already succeeded; a leftover temp is
+  // operator-cleanable).
+  try { nodeFs.unlinkSync(from); } catch (_u) { /* tmp source leak — operator-cleanable */ }
 
-  // Step 4 — fsync directories so the rename is durable.
+  // Step 4 — fsync directories so the install is durable.
   atomicFile.fsyncDir(toDir);
   if (backupDir !== toDir) atomicFile.fsyncDir(backupDir);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.43",
+  "version": "0.15.45",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bcd0c33c-a657-4ed3-b17c-eb1691a77bc5",
+  "serialNumber": "urn:uuid:d5a2ec6c-d7a4-4d6c-a799-5b72ffcf1191",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T11:16:40.494Z",
+    "timestamp": "2026-06-28T13:37:01.021Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.43",
+      "bom-ref": "@blamejs/core@0.15.45",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.43",
+      "version": "0.15.45",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.43",
+      "purl": "pkg:npm/%40blamejs/core@0.15.45",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.43",
+      "ref": "@blamejs/core@0.15.45",
       "dependsOn": []
     }
   ]