@blamejs/core 0.17.12 → 0.17.13

package/lib/daemon.js

@@ -31,8 +31,17 @@
  *   `b.appShutdown.pidLock`, which layers O_EXCL atomic-create +
  *   signal-0 liveness probe + reap-on-stale.
  *
+ *   On Windows a received signal can never reach a JS handler
+ *   (process.kill maps it to TerminateProcess), so `stop` drives a
+ *   cooperative stop-request sentinel (`<pidFile>.stop`) that `start`
+ *   watches and routes into the same orchestrator, escalating to a hard
+ *   TerminateProcess only after the stop timeout. `status` is a read-only
+ *   liveness probe that never mutates the pidfile.
+ *
  *   Audit events: `daemon.started` (pidFile + logFile + commandKind +
- *   pid), `daemon.stopped` (pidFile + signal + waitMs + escalated),
+ *   pid), `daemon.stopped` (pidFile + signal + waitMs + escalated +
+ *   mechanism: signal|cooperative|terminate), `daemon.spawn_failed`
+ *   (pidFile + command) when a detached child fails to launch, and
  *   `daemon.stale_pid_cleaned` (pidFile + stalePid).
  *
  * @card
@@ -43,6 +52,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var numericBounds = require("./numeric-bounds");
 var appShutdown = require("./app-shutdown");
+var pidProbe = require("./pid-probe");
 var processSpawn = require("./process-spawn");
 var safeAsync = require("./safe-async");
 var atomicFile = require("./atomic-file");
@@ -62,27 +72,23 @@ var DEFAULT_STOP_TIMEOUT_MS = C.TIME.seconds(30);
 var DEFAULT_STOP_SIGNAL     = "SIGTERM";
 var DEFAULT_POLL_MS         = 100;
 var DEFAULT_LOG_FILE_MODE   = 0o600;
+// Poll cadence for the Windows cooperative-stop sentinel (a synchronous
+// existsSync on this interval; see _installStopSentinelWatcher for why it is a
+// poll and not a filesystem watch). Runs for a foreground daemon's whole
+// lifetime, so it is coarser than DEFAULT_POLL_MS (which only polls during the
+// brief stop window); 250ms keeps graceful-stop detection sub-second at
+// negligible idle cost.
+var STOP_SENTINEL_POLL_MS   = 250;
 
 function _safeAuditEmit(action, outcome, metadata) {
   auditEmit.emit(action, metadata, outcome);
 }
 
-function _isLivePid(pid) {
-  if (typeof pid !== "number" || !isFinite(pid) || pid <= 0) return false;
-  try { process.kill(pid, 0); return true; }
-  catch (e) { return e && e.code === "EPERM"; }
-}
-
-function _readPidFile(pidFile) {
-  try {
-    // Same fd-safe + capped + symlink-refusing read as app-shutdown's lockfile
-    // reader (one shape): a PID file is never a legit symlink mount, so
-    // refuseSymlink is safe; any throw → null ("nothing live there").
-    var raw = atomicFile.fdSafeReadSync(pidFile, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
-    var pid = parseInt(String(raw).trim(), 10);
-    return isFinite(pid) && pid > 0 ? pid : null;
-  } catch (_e) { return null; }
-}
+// Signal-0 liveness probe + fd-safe pidfile reader live in lib/pid-probe.js so
+// b.daemon and b.appShutdown.pidLock share ONE implementation (they carried
+// byte-identical copies). Local aliases keep the call sites terse.
+var _isLivePid  = pidProbe.isLivePid;
+var _readPidFile = pidProbe.readPidFile;
 
 function _validateStartOpts(opts) {
   validateOpts.shape(opts, {
@@ -132,6 +138,13 @@ function _validateStopOpts(opts) {
   }, "daemon.stop", DaemonError, "daemon/bad-opts");
 }
 
+function _validateStatusOpts(opts) {
+  validateOpts.shape(opts, {
+    pidFile: { rule: "required-string", code: "daemon/bad-pid-file",
+               label: "daemon.status: opts.pidFile" },
+  }, "daemon.status", DaemonError, "daemon/bad-opts");
+}
+
 function _maybeReapStale(pidFile) {
   var existing = _readPidFile(pidFile);
   if (existing === null) return false;
@@ -187,6 +200,85 @@ function _redirectStdio(fd) {
 // start() in the same process don't double-install signals.
 var _foregroundOrchestrators = Object.create(null);
 
+// Sibling-sentinel path a cooperative stop request is written to. Kept beside
+// the pidFile so it inherits the same operator-owned directory + permissions.
+function _stopSentinelPath(pidFile) {
+  return pidFile + ".stop";
+}
+
+// Remove a cooperative stop sentinel (best-effort — it may already be gone, or
+// never have existed on the POSIX path). unlink removes the LINK, not a target.
+function _cleanupSentinel(sentinelPath) {
+  try { nodeFs.unlinkSync(sentinelPath); } catch (_e) { /* best-effort — may not exist */ }
+}
+
+// Install the Windows cooperative-stop watcher for a foreground daemon. Fires
+// the orchestrator's graceful shutdown the first time the sibling <pidFile>.stop
+// sentinel appears — the same orchestrator.shutdown() the POSIX signal path
+// drives, so the exit code is set from the phase result and the event loop
+// drains once the phases release the daemon's resources.
+//
+// Detection is a synchronous existsSync on a plain unref'd interval, NOT a
+// filesystem watch, for two Windows-specific reasons:
+//   - fs.watch (libuv ReadDirectoryChangesW) aborts the whole process — an
+//     uncatchable src/win/fs-event.c assertion, "!_wcsnicmp(filename, dir,
+//     dirlen)" — when the watched directory is reached through an 8.3
+//     short-name path, exactly the shape of a CI runner's temp dir
+//     (C:\Users\RUNNER~1\AppData\Local\Temp\...): GetFinalPathNameByHandle
+//     returns the long form and the prefix check fails. A try/catch cannot
+//     recover from an abort().
+//   - fs.watchFile's StatWatcher stats through the libuv threadpool, which
+//     starves under heavy concurrent filesystem load and delays detection by
+//     seconds; a synchronous existsSync runs inline on the main thread and is
+//     immune.
+// The interval is unref'd so it never itself keeps the process alive; a clean
+// daemon exits on its own once shutdown completes. If the sentinel is never
+// written the poll is a no-op the release phase clears at shutdown. Returns a
+// handle exposing close().
+function _installStopSentinelWatcher(pidFile, orchestrator) {
+  var dir = nodePath.dirname(pidFile);
+  var sentinelName = nodePath.basename(pidFile) + ".stop";
+  var sentinelPath = nodePath.join(dir, sentinelName);
+  var fired = false;
+  var timer = null;
+  function _stopPolling() {
+    if (!timer) return;
+    try { clearInterval(timer); } catch (_e) { /* best-effort */ }
+    timer = null;
+  }
+  function _maybeFire() {
+    if (fired) return;
+    // Synchronous existsSync on the main thread — deliberately not an async
+    // stat, so detection never queues behind a saturated libuv threadpool.
+    if (!nodeFs.existsSync(sentinelPath)) return;
+    fired = true;
+    _stopPolling();
+    log("cooperative stop-request observed (" + sentinelPath + ") — initiating graceful shutdown");
+    // Mirror the POSIX signal path: run the orchestrator's phases, derive the
+    // exit code from the result, then let the loop drain (a foreground daemon's
+    // phases release its server/db so the process exits on its own).
+    Promise.resolve(orchestrator.shutdown()).then(function (result) {
+      if (process.exitCode === undefined || process.exitCode === 0) {
+        process.exitCode = (result && result.ok) ? 0 : 1;
+      }
+    }).catch(function () { process.exitCode = 1; });
+  }
+  try {
+    timer = setInterval(_maybeFire, STOP_SENTINEL_POLL_MS);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  } catch (_e) {
+    // Timer scheduling unavailable — no cooperative channel; daemon.stop()
+    // still hard-stops via TerminateProcess after its timeout.
+    timer = null;
+  }
+  // The sentinel may already exist (stop() raced ahead of this install).
+  _maybeFire();
+  return {
+    close: function () { _stopPolling(); },
+    sentinelPath: sentinelPath,
+  };
+}
+
 /**
  * @primitive b.daemon.start
  * @signature b.daemon.start(opts)
@@ -286,6 +378,33 @@ function start(opts) {
       throw new DaemonError("daemon/spawn-failed",
         "daemon.start: spawn failed: " + ((e && e.message) || String(e)));
     }
+    // A bad command does NOT throw synchronously from spawn — child_process
+    // reports it ASYNC via a 'error' event, with child.pid left undefined. The
+    // sync try/catch above only covers spawn() itself, so without this the old
+    // path wrote "undefined\n" to the pidFile and returned success. Subscribe a
+    // one-shot 'error' handler that reaps the sidecar + audits the failure, then
+    // refuse to proceed for a child that never got a pid.
+    child.on("error", function (err) {
+      try { nodeFs.unlinkSync(pidFile); } catch (_e) { /* best-effort — may not exist */ }
+      _safeAuditEmit("daemon.spawn_failed", "failure", {
+        pidFile: pidFile,
+        command: opts.command,
+        error:   (err && err.message) || String(err),
+      });
+    });
+    // child.pid must be a real, positive PID. A command that failed to launch
+    // leaves it undefined; the same positive-integer front-guard the shared
+    // liveness probe (pidProbe.isLivePid) applies before it will signal a pid —
+    // a non-number / non-finite / non-positive value is never a launched child.
+    // Fail closed BEFORE any pidfile write so no "undefined" sidecar survives
+    // for daemon.stop to misread.
+    if (typeof child.pid !== "number" || !isFinite(child.pid) || child.pid <= 0) {
+      try { if (typeof logFd === "number") nodeFs.closeSync(logFd); }
+      catch (_c) { /* best-effort */ }
+      throw new DaemonError("daemon/spawn-failed",
+        "daemon.start: spawn of '" + opts.command + "' produced no pid (the command " +
+        "failed to launch)");
+    }
     // Write the child's PID via atomic temp+rename so a concurrent
     // observer never sees a half-written pidFile.
     atomicFile.ensureDir(nodePath.dirname(pidFile));
@@ -334,6 +453,15 @@ function start(opts) {
     }
   }
 
+  // Cooperative stop channel (Windows). Node maps process.kill(pid, "SIGTERM")
+  // to TerminateProcess on win32, so a "signal" never reaches a JS handler and
+  // the graceful orchestrator would be unreachable. daemon.stop() writes a
+  // sibling <pidFile>.stop sentinel; a watcher installed below routes it into
+  // the SAME orchestrator.shutdown() the POSIX signal path uses. Assigned after
+  // the orchestrator exists; the release phase (which runs at shutdown) closes
+  // it + removes the sentinel.
+  var stopWatcher = null;
+
   var orchestrator = appShutdown.create({
     signals:               signals,
     installSignalHandlers: true,
@@ -341,16 +469,21 @@ function start(opts) {
       {
         name: "pidLock-release",
         run:  function () {
+          if (stopWatcher) { try { stopWatcher.close(); } catch (_w) { /* best-effort */ } }
           try { lock.release(); } catch (_e) { /* best-effort */ }
           if (logFdForeground !== null) {
             try { nodeFs.closeSync(logFdForeground); } catch (_c) { /* best-effort */ }
           }
+          _cleanupSentinel(_stopSentinelPath(pidFile));
         },
         timeoutMs: C.TIME.seconds(2),
       },
     ],
   });
   _foregroundOrchestrators[pidFile] = orchestrator;
+  if (process.platform === "win32") {
+    stopWatcher = _installStopSentinelWatcher(pidFile, orchestrator);
+  }
 
   _safeAuditEmit("daemon.started", "success", {
     pidFile:     pidFile,
@@ -423,16 +556,26 @@ async function stop(opts) {
   }
 
   var t0 = Date.now();
-  // First signal — typically SIGTERM. Wait up to timeoutMs for exit.
+
+  // Windows has no cooperative signal: process.kill(pid, "SIGTERM") maps to
+  // TerminateProcess (a hard kill), so the graceful appShutdown orchestration is
+  // only reachable via the cooperative stop-request sentinel start() watches.
+  // Drive that channel first and escalate to the hard kill only on timeout.
+  if (process.platform === "win32") {
+    return await _stopWin32Cooperative(pidFile, pid, signal, timeoutMs, pollMs, t0, opts);
+  }
+
+  // POSIX signal path — first signal (typically SIGTERM), wait up to timeoutMs
+  // for exit, then escalate to SIGKILL. mechanism is always "signal" here.
   try { process.kill(pid, signal); }
   catch (e) {
     if (e && e.code === "ESRCH") {
       // Died between read and kill — cleanup + report.
       try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
       _safeAuditEmit("daemon.stopped", "success", {
-        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false,
+        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false, mechanism: "signal",
       });
-      return { stopped: true, pid: pid, signal: signal };
+      return { stopped: true, pid: pid, signal: signal, mechanism: "signal" };
     }
     throw new DaemonError("daemon/kill-failed",
       "daemon.stop: kill(" + pid + ", " + signal + ") failed: " + e.message);
@@ -443,9 +586,9 @@ async function stop(opts) {
     if (!_isLivePid(pid)) {
       try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
       _safeAuditEmit("daemon.stopped", "success", {
-        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false,
+        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false, mechanism: "signal",
       });
-      return { stopped: true, pid: pid, signal: signal };
+      return { stopped: true, pid: pid, signal: signal, mechanism: "signal" };
     }
     await safeAsync.sleep(pollMs, { signal: opts.abortSignal });
   }
@@ -466,9 +609,109 @@ async function stop(opts) {
   }
   try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
   _safeAuditEmit("daemon.stopped", "success", {
-    pidFile: pidFile, signal: "SIGKILL", waitMs: Date.now() - t0, escalated: true,
+    pidFile: pidFile, signal: "SIGKILL", waitMs: Date.now() - t0, escalated: true, mechanism: "signal",
+  });
+  return { stopped: true, pid: pid, signal: "SIGKILL", escalated: true, mechanism: "signal" };
+}
+
+// Windows cooperative stop. Writes the sibling <pidFile>.stop sentinel the
+// foreground start() watcher routes into the graceful orchestrator, polls for a
+// clean exit up to timeoutMs, and escalates to a hard TerminateProcess (Windows
+// maps any real signal to it) ONLY on timeout — preserving the POSIX
+// graceful-first / forced-on-timeout shape and the same brief post-kill reap
+// wait. mechanism distinguishes the cooperative exit from the forced one; the
+// sentinel is removed on both paths.
+async function _stopWin32Cooperative(pidFile, pid, signal, timeoutMs, pollMs, t0, opts) {
+  var sentinel = _stopSentinelPath(pidFile);
+  // O_NOFOLLOW-staged write (atomicFile.writeSync → _openExclTemp with
+  // O_EXCL | O_NOFOLLOW) so a symlink planted at <pidFile>.stop can't redirect
+  // the request to an attacker-chosen file (CWE-59).
+  try {
+    atomicFile.writeSync(sentinel, String(pid) + "\n", { fileMode: 0o600 });
+  } catch (e) {
+    throw new DaemonError("daemon/stop-request-failed",
+      "daemon.stop: failed to write cooperative stop-request '" + sentinel + "': " +
+      ((e && e.message) || String(e)));
+  }
+
+  // Poll for cooperative exit up to timeoutMs.
+  var deadline = t0 + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!_isLivePid(pid)) {
+      _cleanupSentinel(sentinel);
+      try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
+      _safeAuditEmit("daemon.stopped", "success", {
+        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false, mechanism: "cooperative",
+      });
+      return { stopped: true, pid: pid, signal: signal, mechanism: "cooperative" };
+    }
+    await safeAsync.sleep(pollMs, { signal: opts.abortSignal });
+  }
+
+  // Timed out — the daemon ignored the cooperative request. Hard-stop it.
+  try { process.kill(pid, "SIGKILL"); }
+  catch (e) {
+    if (!(e && e.code === "ESRCH")) {
+      _cleanupSentinel(sentinel);
+      throw new DaemonError("daemon/kill-failed",
+        "daemon.stop: TerminateProcess escalation failed for pid " + pid + ": " + e.message);
+    }
+  }
+  var killDeadline = Date.now() + C.TIME.seconds(2);
+  while (Date.now() < killDeadline) {
+    if (!_isLivePid(pid)) break;
+    await safeAsync.sleep(pollMs, { signal: opts.abortSignal });
+  }
+  _cleanupSentinel(sentinel);
+  try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
+  _safeAuditEmit("daemon.stopped", "success", {
+    pidFile: pidFile, signal: "SIGKILL", waitMs: Date.now() - t0, escalated: true, mechanism: "terminate",
   });
-  return { stopped: true, pid: pid, signal: "SIGKILL", escalated: true };
+  return { stopped: true, pid: pid, signal: "SIGKILL", escalated: true, mechanism: "terminate" };
+}
+
+/**
+ * @primitive b.daemon.status
+ * @signature b.daemon.status(opts)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.daemon.start, b.daemon.stop
+ *
+ * Read-only PID-liveness probe. Reads `pidFile` and reports whether the
+ * recorded process is alive, WITHOUT mutating anything — unlike `stop()`,
+ * a stale pidfile is reported but never unlinked, so a health check can't
+ * disturb the daemon's lifecycle state. A missing / malformed / symlinked /
+ * oversized pidfile reports `running: false` with `reason: "no-pidfile"`
+ * rather than throwing (the same fd-safe, symlink-refusing, 1 KiB-capped
+ * read that `start` and `stop` use). Bad opts throw `daemon/bad-pid-file`.
+ *
+ * Returns `{ running, pid, reason? }`. `reason` is `"no-pidfile"` when no
+ * live sidecar was found and `"stale"` when the pidfile pointed at a dead
+ * PID — the file is left in place for the operator to inspect or for `stop`
+ * to reap.
+ *
+ * @opts
+ *   pidFile: string,   // absolute path of the PID sidecar (required)
+ *
+ * @example
+ *   var s = b.daemon.status({ pidFile: "/tmp/blamejs-daemon-demo.pid" });
+ *   s.running; // → false
+ *   s.reason;  // → "no-pidfile"
+ */
+function status(opts) {
+  _validateStatusOpts(opts);
+  var pidFile = opts.pidFile;
+  var pid = _readPidFile(pidFile);
+  if (pid === null) {
+    // Missing / malformed / symlinked / oversized — nothing live to report.
+    // READ-ONLY: never unlink (stop() reaps; status() must not).
+    return { running: false, pid: null, reason: "no-pidfile" };
+  }
+  if (!_isLivePid(pid)) {
+    // Recorded PID is dead. Report it but leave the sidecar in place.
+    return { running: false, pid: pid, reason: "stale" };
+  }
+  return { running: true, pid: pid };
 }
 
 // Test-only — drop process-wide foreground orchestrator state so smoke
@@ -485,6 +728,7 @@ function _resetForTest() {
 module.exports = {
   start:                start,
   stop:                 stop,
+  status:               status,
   DaemonError:          DaemonError,
   DEFAULT_STOP_SIGNAL:  DEFAULT_STOP_SIGNAL,
   DEFAULT_STOP_TIMEOUT_MS: DEFAULT_STOP_TIMEOUT_MS,

package/lib/db-declare-view.js

@@ -359,7 +359,7 @@ function declareView(opts) {
     // Build CREATE VIEW. Each column is independently quoted so a
     // reserved-word column name (e.g. "user", "order") resolves correctly.
     var quotedCols = selectedColumns.map(function (c) {
-      return safeSql.quoteIdentifier(c, "postgres");
+      return safeSql.quoteIdentifier(c, "postgres", { allowReserved: true }); // reserved-word column names (e.g. "user"/"order") — parity with b.db.from()
     }).join(", ");
     var createSql = "CREATE VIEW " + qView + " AS SELECT " + quotedCols +
                     " FROM " + qSource;
@@ -370,7 +370,7 @@ function declareView(opts) {
     // GRANT SELECT — one statement covers all roles.
     if (spec.grantTo.length > 0) {
       var quotedRoles = spec.grantTo.map(function (r) {
-        return safeSql.quoteIdentifier(r, "postgres");
+        return safeSql.quoteIdentifier(r, "postgres", { allowReserved: true }); // parity with b.db.from()
       }).join(", ");
       await xdb.query(
         "GRANT SELECT ON " + qView + " TO " + quotedRoles,

package/lib/db.js

@@ -2211,7 +2211,10 @@ function exportCsv(opts) {
   validateOpts.requireNonEmptyString(opts.table, "exportCsv: opts.table", DbError, "db/bad-export-table");
   // Quote-validate the table identifier — refuses anything with embedded
   // quotes, schema-qualified names valid via dot-separated parts.
-  safeSql.quoteIdentifier(opts.table);
+  // allowReserved: parity with b.db.from() — a schema-valid operator table
+  // whose name is a SQL keyword must validate here too (still fails closed on
+  // shape/length/null-byte/sqlite_ prefix; the keyword is safe once quoted).
+  safeSql.quoteIdentifier(opts.table, undefined, { allowReserved: true });
   var meta = tableMetadata[opts.table];
   if (!meta) {
     throw new DbError("db/unknown-table",

package/lib/dsr.js

@@ -1053,7 +1053,7 @@ function dbTicketStore(opts) {
   var SQL_OPTS = { dialect: "sqlite", quoteName: true };
   var qTable, qEmailIdx, qStatusIdx;
   try {
-    qTable     = safeSql.quoteIdentifier(tableRaw, "sqlite");
+    qTable     = safeSql.quoteIdentifier(tableRaw, "sqlite", { allowReserved: true }); // parity with b.db.from() (the _idx names below are suffix-derived — can't be a bare keyword)
     qEmailIdx  = safeSql.quoteIdentifier(tableRaw + "_email_idx", "sqlite");
     qStatusIdx = safeSql.quoteIdentifier(tableRaw + "_status_idx", "sqlite");
   } catch (sqlErr) {

package/lib/i18n-messageformat.js

@@ -48,6 +48,7 @@
  */
 var lazyRequire = require("./lazy-require");
 var boundedMap = require("./bounded-map");
+var safeObject = require("./safe-object");
 var { defineClass } = require("./framework-error");
 
 var I18nMessageFormatError = defineClass("I18nMessageFormatError",
@@ -370,7 +371,7 @@ function _renderSequence(nodes, vars, locale, hashContext, depth) {
 // a non-array (a request DoS). Every case-map lookup goes through this so no key
 // can reach the prototype chain.
 function _ownCase(cases, key) {
-  return Object.prototype.hasOwnProperty.call(cases, key) ? cases[key] : undefined;
+  return safeObject.ownProp(cases, key);
 }
 
 // Own-property variable lookup. A template argument NAME is parse-derived from
@@ -383,7 +384,7 @@ function _ownCase(cases, key) {
 // which is already own-property-only. Every argument / plural / select value
 // lookup goes through this so no template name can reach the prototype chain.
 function _ownVar(vars, name) {
-  return Object.prototype.hasOwnProperty.call(vars, name) ? vars[name] : undefined;
+  return safeObject.ownProp(vars, name);
 }
 
 function _renderNode(node, vars, locale, hashContext, depth) {

package/lib/log-stream-otlp-grpc.js

@@ -40,6 +40,10 @@ var lazyRequire = require("./lazy-require");
 // scrub attribute values through the telemetry redactor before they cross the
 // OTLP egress boundary (CWE-532).
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy to match the observability cycle-break above. Scrubs secrets embedded in
+// the free-text log body for a directly-wired sink (defense in depth — emit()
+// already redacts, but a sink can be driven without it, same as meta/redactAttrs).
+var redact = lazyRequire(function () { return require("./redact"); });
 // Lazy — network-tls is widely required; audit an insecure (cert-validation-
 // disabled) outbound TLS session at honor time, same surface as connectWithEch.
 var networkTls = lazyRequire(function () { return require("./network-tls"); });
@@ -148,7 +152,7 @@ function _encodeLogRecord(record) {
   var attrPieces = _encodeAttributes(observability().redactAttrs(record.meta)).map(function (kvBody) {
     return pb.embeddedMessage(6, kvBody);
   });
-  var msg = (record.message != null ? String(record.message) : "");
+  var msg = (record.message != null ? redact().redactText(String(record.message)) : "");
   return Buffer.concat([
     pb.fixed64(1, tsNs),
     pb.uint32(2, sev.number),

package/lib/log-stream-otlp.js

@@ -65,6 +65,10 @@ var lazyRequire = require("./lazy-require");
 // log path can reach a log-stream sink). Used only to scrub attribute values
 // through the telemetry redactor before they cross the OTLP egress boundary.
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy to match the observability cycle-break above. Scrubs secrets embedded in
+// the free-text log body for a directly-wired sink (defense in depth — emit()
+// already redacts, but a sink can be driven without it, same as meta/redactAttrs).
+var redact = lazyRequire(function () { return require("./redact"); });
 
 var MAX_RESPONSE_BYTES = C.BYTES.mib(1);
 var FRAMEWORK_VERSION = (pkg && pkg.version) || "unknown";
@@ -157,7 +161,7 @@ function _toLogRecord(record) {
     observedTimeUnixNano: nanos,
     severityNumber:   sev.number,
     severityText:     sev.text,
-    body:             { stringValue: record.message == null ? "" : String(record.message) },
+    body:             { stringValue: record.message == null ? "" : redact().redactText(String(record.message)) },
     attributes:       attrs,
   };
 }

package/lib/log-stream.js

@@ -210,11 +210,14 @@ function emit(level, message, meta) {
   if (LEVELS.indexOf(level) === -1) {
     throw _err("INVALID_LEVEL", "log level must be one of " + LEVELS.join(", "), true);
   }
-  // Build the record. Redact metadata BEFORE distribution to any sink.
+  // Build the record. Redact BOTH the structured metadata AND the free-text
+  // message BEFORE distribution to any sink — a secret interpolated into the
+  // message string (a JWT, an AWS key, a URL password) must not reach a file /
+  // remote sink verbatim. redactText scrubs embedded fragments in place.
   var record = {
     ts:      Date.now(),
     level:   level,
-    message: message == null ? null : String(message),
+    message: message == null ? null : redact.redactText(String(message)),
   };
   if (meta) {
     record.meta = redact.redact(meta);

package/lib/middleware/bot-guard.js

@@ -52,6 +52,7 @@ var DEFAULT_BLOCKED_AGENTS = [
 
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
+var ssrfGuard = require("../ssrf-guard");
 var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
@@ -185,15 +186,10 @@ function create(opts) {
     if (_proto.resolve(req) === "https") return true;
     var host = (req.headers && req.headers.host) || "";
     host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
-    if (host.charAt(0) === "[") {                              // [::1] IPv6 literal
-      var end = host.indexOf("]");
-      host = end === -1 ? host.slice(1) : host.slice(1, end);
-    }
-    host = host.replace(/\.$/, "");                            // strip trailing root-zone dot (RFC 1034 §3.1) so "localhost." matches
-    if (host === "localhost" || /\.localhost$/.test(host)) return true;
-    if (host === "::1") return true;
-    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) return true;   // allow:regex-no-length-cap — bounded dotted-quad loopback
-    return false;
+    // Loopback HTTP is a secure context (can't be reached off-box). Compose the
+    // canonical hostname-aware classifier — 127/8, ::1 / [::1], localhost, and
+    // *.localhost (RFC 6761 §6.3) — instead of re-rolling the triad here.
+    return ssrfGuard.isLoopbackHost(host);
   }
 
   function _checkHeuristics(req) {

package/lib/outbox.js

@@ -99,7 +99,7 @@ var KEY_MAX_LEN             = C.BYTES.bytes(255);
 function _validateTableName(name) {
   // SQL identifier — quoteIdentifier rejects anything with embedded
   // quotes, schema-qualified names valid via dot-separated parts.
-  return safeSql.quoteIdentifier(name);
+  return safeSql.quoteIdentifier(name, undefined, { allowReserved: true }); // parity with b.db.from()
 }
 
 // Map the operator backend's dialect tag to the b.sql dialect vocabulary.

package/lib/pid-probe.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// pid-probe — the signal-0 liveness probe + fd-safe pidfile reader shared by
+// b.daemon (lib/daemon.js) and b.appShutdown.pidLock (lib/app-shutdown.js).
+// Both files carried a byte-for-byte copy of the liveness check and the capped,
+// symlink-refusing pidfile reader; a single owner keeps the liveness semantics
+// (process.kill(pid, 0) → alive; EPERM → alive-but-unowned; ESRCH → dead) and
+// the read hardening (1 KiB cap + O_NOFOLLOW refusal so a planted symlink or an
+// oversized file can neither redirect nor OOM the read) identical across every
+// caller — daemon.start / stop / status and pidLock.acquire / release.
+//
+// This is not request-reachable: the two callers are process-lifecycle
+// primitives, so a throw here would only ever surface at daemon start/stop.
+// Both entry points are defensive readers (return-default, never throw): a
+// missing / malformed / hostile pidfile yields null ("nothing live there")
+// rather than propagating an error into the shutdown path.
+
+var atomicFile = require("./atomic-file");
+var C = require("./constants");
+
+// isLivePid(pid) — signal-0 existence probe. process.kill(pid, 0) sends no
+// signal but performs the permission + existence check the kernel would do for
+// a real signal: it succeeds when the process is alive and signalable, throws
+// EPERM when the process is alive but owned by another user (still "live"), and
+// throws ESRCH when no such process exists (dead). A non-numeric / non-finite /
+// non-positive pid is never live.
+function isLivePid(pid) {
+  if (typeof pid !== "number" || !isFinite(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (e) { return !!(e && e.code === "EPERM"); }
+}
+
+// readPidFile(pidFile) — fd-safe + capped + symlink-refusing read of a PID
+// sidecar. A PID file is never a legitimate symlink mount (unlike a k8s/certbot
+// secret mount), so refuseSymlink is safe here and stops a planted symlink from
+// redirecting the read; the 1 KiB cap stops an oversized planted file from
+// OOM-ing it. Returns the parsed positive PID, or null for any failure
+// (missing / symlink / too-large / non-numeric) — the uniform "nothing live
+// there" sentinel both callers already relied on.
+function readPidFile(pidFile) {
+  try {
+    var raw = atomicFile.fdSafeReadSync(pidFile, {
+      maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8",
+    });
+    var pid = parseInt(String(raw).trim(), 10);
+    return isFinite(pid) && pid > 0 ? pid : null;
+  } catch (_e) { return null; }
+}
+
+module.exports = {
+  isLivePid:   isLivePid,
+  readPidFile: readPidFile,
+};

package/lib/pqc-agent.js

@@ -176,6 +176,13 @@ function _buildAgentOpts(opts) {
   } else {
     merged.ecdhCurve = C.TLS_GROUP_CURVE_STR;
   }
+  // Mirror the resolved ecdhCurve into `groups` from one string (same
+  // shape as network-tls.buildOptions). `applyToContext` only fills
+  // `groups` when it is undefined, so setting it here preserves the
+  // caller's narrowed/reordered selection instead of letting the
+  // context filler re-derive `groups` from STATE.tlsKeyShares — a
+  // different ordering that would ignore the caller's ecdhCurve.
+  merged.groups = merged.ecdhCurve;
   merged.minVersion = "TLSv1.3";
   if (networkTls && typeof networkTls.applyToContext === "function") {
     merged = networkTls.applyToContext({ base: merged });
@@ -203,7 +210,7 @@ function _buildAgentOpts(opts) {
  *   maxSockets?:          number,
  *   maxFreeSockets?:      number,
  *   scheduling?:          string,
- *   ecdhCurve?:           string,   // colon-separated group names; must subset C.TLS_GROUP_PREFERENCE
+ *   ecdhCurve?:           string,   // colon-separated group names; must subset C.TLS_GROUP_PREFERENCE. The TLS `groups` list tracks this value exactly (mirrored from one resolved string), so a narrowed/reordered ecdhCurve is the negotiated key-share order.
  *   allowOperatorGroups?: boolean,  // default false; opt in to operator-supplied groups outside the framework PQC preference
  *
  * @example