@blamejs/core 0.18.54 → 0.18.55

package/lib/mcp.js

@@ -479,7 +479,12 @@ function _toolResultSanitize(result, opts) {
       "toolResult.sanitize: posture must be 'refuse' | 'sanitize' | 'audit-only'");
   }
   var maxBytes = opts.maxTextBytes || DEFAULT_TOOL_OUTPUT_MAX_BYTES;
-  var allowedHosts = Array.isArray(opts.allowedHosts) ? opts.allowedHosts : [];
+  // `null` when no allowlist was supplied, the array when one was — including
+  // an EMPTY one, which asks that no URL be permitted. Normalising the absent
+  // case to `[]` made the two indistinguishable, and the length test below then
+  // read both as "no restriction". A tool result is attacker-influenced
+  // content, so this is the allowlist that stops one pointing wherever it likes.
+  var allowedHosts = Array.isArray(opts.allowedHosts) ? opts.allowedHosts : null;
   if (!result || typeof result !== "object") {
     throw new McpError("mcp/bad-tool-result",
       "toolResult.sanitize: result must be an object");
@@ -522,7 +527,7 @@ function _toolResultSanitize(result, opts) {
       cleaned.push({ type: "text", text: t });
     } else if (block.type === "image" || block.type === "resource_link" || block.type === "audio") {
       var url = block.url || (block.resource && block.resource.uri);
-      if (typeof url === "string" && url.length > 0 && allowedHosts.length > 0) {
+      if (typeof url === "string" && url.length > 0 && allowedHosts) {
         var u; try { u = new URL(url); } catch (_e) { u = null; }                                // allow:raw-new-url-parse-only — operator-supplied tool URL; allowlist enforced below
         if (!u || allowedHosts.indexOf(u.host) === -1) {
           issues.push({ kind: "off-allowlist-url", index: i, url: url });
@@ -950,7 +955,10 @@ function _samplingGuard(opts) {
 function _elicitationGuard(opts) {
   opts = opts || {};
   var maxBytes    = opts.maxMessageBytes || (8 * 1024);                                          // allow:raw-byte-literal — 8 KiB elicitation message cap
-  var allowedSchemaTypes = Array.isArray(opts.allowedSchemaTypes) && opts.allowedSchemaTypes.length > 0
+  // The default applies when the option is OMITTED. An explicitly empty list
+  // says no schema type is acceptable, and falling back to the default there
+  // would answer a caller's "none" with "object".
+  var allowedSchemaTypes = Array.isArray(opts.allowedSchemaTypes)
     ? opts.allowedSchemaTypes : ["object"];
   var posture     = opts.posture || "refuse";
 

package/lib/middleware/require-mtls.js

@@ -272,7 +272,14 @@ function create(opts) {
         });
       }
     }
-    if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
+    // Gated on "was an allowlist supplied", NOT on "is it non-empty". The
+    // derivation above already spells the two apart — `null` when the option is
+    // omitted, an array when it is given — and re-testing the length here
+    // collapsed them, so a pin built from configuration that returned zero
+    // entries admitted every client certificate instead of none. An allowlist
+    // that disappears when empty is a firewall rule set that opens when the
+    // last rule is deleted, and here that rule set is the front door.
+    if (allowList && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
       return _refuse(req, res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,

package/lib/network-tls.js

@@ -549,6 +549,23 @@ function _stripUnreachableCertCompression(merged, caller) {
   return merged;
 }
 
+// The key-agreement preference alone, as the string node:tls reads under
+// `ecdhCurve`. `applyToContext` is the whole-context form and also merges the
+// framework trust store, minimum version and certificate compression; a caller
+// that only wants the group policy — a listener building its own server context
+// — takes this instead, so it does not inherit a `ca` list it never asked for.
+//
+// An override is honoured, and a malformed one is REFUSED rather than replaced:
+// quietly substituting the default would start a listener on groups the
+// operator did not choose, with nothing said. Absent takes the framework
+// default (the ML-KEM hybrids with a classical X25519 fallback).
+function keyAgreementGroups(override, where) {
+  if (override !== undefined && override !== null) {
+    return _groupPreferenceString(override, where || "tls.keyAgreementGroups");
+  }
+  return STATE.tlsKeyShares.length > 0 ? STATE.tlsKeyShares.join(":") : null;
+}
+
 function applyToContext(opts) {
   opts = opts || {};
   validateOpts(opts, ["base"], "tls.applyToContext");
@@ -4138,6 +4155,7 @@ module.exports = {
   captureBaselineFingerprints: captureBaselineFingerprints,
   detectBaselineDrift: detectBaselineDrift,
   applyToContext:      applyToContext,
+  keyAgreementGroups:  keyAgreementGroups,
   buildOptions:        buildOptions,
   getCaPems:           getCaPems,
   ocsp:                ocsp,

package/lib/safe-mount-info.js

@@ -81,6 +81,22 @@ var SafeMountInfoError = defineClass("SafeMountInfoError", { alwaysPermanent: tr
 
 var DEFAULT_PATH = "/proc/self/mountinfo";
 
+// The default path is a Linux path, and reaching for it anywhere else is not
+// merely useless. A leading slash is DRIVE-relative on Windows, so the read
+// lands on C:\proc\self\mountinfo — a location an unprivileged local user can
+// create, because the default ACL on C:\ grants Authenticated Users the right
+// to add subdirectories. Whoever plants that file authors the entries
+// bestMatch() and isBindMount() answer from, which is to say they choose what
+// the framework believes about which filesystem a path is on.
+//
+// So off Linux there is no default: a caller who genuinely has a mountinfo
+// file elsewhere still passes opts.path, and everyone else is refused rather
+// than answered from a file anyone could have written. Platform is a parameter
+// so the Windows branch is reachable from a Linux CI host.
+function _defaultPathFor(platform) {
+  return platform === "linux" ? DEFAULT_PATH : null;
+}
+
 /**
  * @primitive b.safeMountInfo.parse
  * @signature b.safeMountInfo.parse(text, opts?)
@@ -187,12 +203,20 @@ function parse(text, opts) {
  * @related   b.safeMountInfo.parse, b.safeMountInfo.bestMatch
  *
  * Read + parse `/proc/self/mountinfo` in one call. Returns the same
- * array shape as `parse(text)`. On non-Linux platforms (where /proc
- * doesn't exist) returns `opts.fallback` (default `null`); audit
- * emission per `safe-mount-info.refused` with code `read-failed`.
+ * array shape as `parse(text)`.
+ *
+ * The default path is used on Linux only. Elsewhere there is no default and
+ * `opts.fallback` (default `null`) is returned without reading anything, with
+ * an audit emission of `safe-mount-info.refused` carrying code
+ * `no-default-path`. `/proc` is not simply absent off Linux — a leading slash
+ * is drive-relative on Windows, so the default names `C:\proc\self\mountinfo`,
+ * which an unprivileged local user can create; reading it would let whoever
+ * wrote it decide which filesystem a path appears to be on. A caller holding a
+ * mountinfo file elsewhere passes `opts.path`, which is honored on every
+ * platform and reports a read failure as `read-failed`.
  *
  * @opts
- *   path:     string,        // override path (default /proc/self/mountinfo)
+ *   path:     string,        // override path; on Linux defaults to /proc/self/mountinfo, elsewhere there is no default
  *   fallback: any,           // returned on read failure (default null)
  *   audit:    object,        // optional b.audit handle for refusal events
  *   strict:   boolean,       // forwarded to parse()
@@ -211,12 +235,20 @@ function read(opts) {
     "safeMountInfo.read");
   var path = typeof opts.path === "string" && opts.path.length > 0
     ? opts.path
-    : DEFAULT_PATH;
+    : _defaultPathFor(process.platform);
+  if (!path) {
+    _refuseEmit(opts, "safe-mount-info/no-default-path",
+      "/proc/self/mountinfo is a Linux path and this host is " + process.platform +
+      " — pass opts.path to name a mountinfo file explicitly.");
+    return ("fallback" in opts) ? opts.fallback : null;
+  }
   var text;
   try { text = nodeFs.readFileSync(path, "utf8"); }
   catch (e) {
+    // Name the file that was actually read. A caller who passed opts.path and
+    // is told "/proc/self/mountinfo unreadable" is looking at the wrong file.
     _refuseEmit(opts, "safe-mount-info/read-failed",
-      "/proc/self/mountinfo unreadable: " + ((e && e.message) || String(e)));
+      path + " unreadable: " + ((e && e.message) || String(e)));
     return ("fallback" in opts) ? opts.fallback : null;
   }
   return parse(text, opts);
@@ -305,4 +337,5 @@ module.exports = {
   isBindMount:            isBindMount,
   SafeMountInfoError:     SafeMountInfoError,
   DEFAULT_PATH:           DEFAULT_PATH,
+  _defaultPathForForTest: _defaultPathFor,
 };

package/lib/safe-smtp.js

@@ -39,6 +39,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var guardSmtpCommand = require("./guard-smtp-command");
 
 var SafeSmtpError = defineClass("SafeSmtpError", { alwaysPermanent: true });
 
@@ -110,7 +111,14 @@ function dotUnstuff(buf) {
   }
   var out = Buffer.alloc(buf.length);
   var oi = 0;
-  for (var i = 0; i < buf.length; i += 1) {
+  // Offset 0 IS a line start. RFC 5321 §4.5.2 has the sender stuff a leading
+  // dot on any line of the body and grants the first line no exemption, but
+  // this only ever looked for a dot AFTER a CRLF — so a body beginning
+  // `..signature` was delivered with the extra dot still on it, and dotStuff,
+  // which does stuff offset 0, had a pair that would not undo it.
+  var start = 0;
+  if (buf.length >= 2 && buf[0] === 0x2e && buf[1] === 0x2e) start = 1;
+  for (var i = start; i < buf.length; i += 1) {
     out[oi++] = buf[i];
     // After \r\n, if the next byte is `.` followed by another non-CR
     // byte (i.e., not the terminator itself), strip the stuffing dot.
@@ -179,9 +187,96 @@ function dotStuff(buf) {
   return out.subarray(0, oi);
 }
 
+/**
+ * @primitive b.safeSmtp.createBodyScanner
+ * @signature b.safeSmtp.createBodyScanner()
+ * @since     0.18.55
+ * @status    stable
+ * @related   b.safeSmtp.findDotTerminator, b.guardSmtpCommand.detectBodySmuggling
+ *
+ * Watch a DATA body for its terminator and for the smuggling shape as it
+ * ARRIVES, in work proportional to each chunk rather than to everything
+ * received so far.
+ *
+ * A listener that answers "has the body ended yet?" by re-deriving the whole
+ * accumulated buffer on every chunk does O(n) work per chunk and O(n²) over the
+ * message. The byte cap still holds — the collector refuses a chunk that would
+ * cross it — but processor cost is not what a byte cap bounds, so a message
+ * inside the limit could still cost minutes. Measured before this existed:
+ * 1 MiB accepted in 143 ms and 8 MiB in 4949 ms, a growth of 4.67x for each
+ * doubling where linear would hold at 2.
+ *
+ * Each `push` scans only the new bytes plus a four-byte overlap from the
+ * previous chunk. Four is exact, not generous: the longest shape either screen
+ * matches spans five bytes (`\r\n.\r\n`, and the smuggling scan's widest
+ * lookahead), and a pattern of length L needs L-1 bytes of overlap to be caught
+ * across a boundary.
+ *
+ * @example
+ *   var scan = b.safeSmtp.createBodyScanner();
+ *   var seen = scan.push(chunk);
+ *   if (seen.smuggling)          refuse();
+ *   if (seen.terminatorAt !== -1) finish(collector.result(), seen.terminatorAt);
+ */
+function createBodyScanner() {
+  var OVERLAP = 4;                                    // longest matched shape (5) minus one
+  var consumed = 0;                                   // bytes pushed before the current chunk
+  var tail = Buffer.alloc(0);                         // last OVERLAP bytes of what came before
+  var sawSmuggling = false;
+  var terminatorAt = -1;
+  // The byte immediately before `tail`, which the next window will not contain.
+  // Classifying a leading LF needs it: overlap gives every other offset its
+  // predecessor, but never offset zero, and widening the overlap only changes
+  // which byte is stranded there.
+  var beforeTail = -1;
+
+  return {
+    push: function (chunk) {
+      if (!Buffer.isBuffer(chunk)) {
+        throw new SafeSmtpError("safe-smtp/bad-input",
+          "createBodyScanner.push: chunk must be a Buffer");
+      }
+      // Once a verdict is reached it stands: the terminator does not move and a
+      // smuggling shape does not un-happen. Later chunks are still counted so
+      // the reported offset stays absolute.
+      var window = tail.length === 0 ? chunk : Buffer.concat([tail, chunk]);
+      var windowStart = consumed - tail.length;
+
+      // `windowStart === 0`, NOT `consumed === 0`: with the overlap carried in,
+      // a window can still begin at body offset 0 after bytes have been
+      // consumed. One-byte chunks are the case — the first push is a lone `.`
+      // (too short to match), and the second window is `.\n` starting at 0 with
+      // one byte already consumed. Testing `consumed` there skipped the
+      // dot-at-body-start shape entirely.
+      if (!sawSmuggling &&
+          guardSmtpCommand.detectBodySmuggling(window, windowStart === 0,
+                                               beforeTail === 0x0d)) {
+        sawSmuggling = true;
+      }
+      if (terminatorAt === -1) {
+        var at = findDotTerminator(window);
+        if (at !== -1) terminatorAt = windowStart + at;
+      }
+
+      consumed += chunk.length;
+      // Capture the byte the next window will drop off its front, before the
+      // window itself goes out of scope. When the window is no longer than the
+      // overlap nothing is dropped, and the next window still starts at body
+      // offset 0, where there is no preceding byte to carry.
+      beforeTail = window.length > OVERLAP ? window[window.length - OVERLAP - 1] : -1;
+      tail = window.length <= OVERLAP ? window : window.subarray(window.length - OVERLAP);
+      return { smuggling: sawSmuggling, terminatorAt: terminatorAt };
+    },
+    // What the scanner has been shown, so a caller can check its own accounting
+    // against this one rather than keeping a second counter.
+    bytesSeen: function () { return consumed; },
+  };
+}
+
 module.exports = {
   findDotTerminator: findDotTerminator,
   dotUnstuff:        dotUnstuff,
   dotStuff:          dotStuff,
+  createBodyScanner: createBodyScanner,
   SafeSmtpError:     SafeSmtpError,
 };

package/lib/safe-url.js

@@ -312,7 +312,11 @@ function _normalizePctPath(path) {
  */
 function parse(url, opts) {
   opts = opts || {};
-  var allowed = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
+  // The documented default applies when the option is OMITTED. An explicitly
+  // empty list is a caller saying no protocol is acceptable, and widening that
+  // back to https: answers "none" with "one" — an allowlist that disappears
+  // when empty is a firewall rule set that opens when the last rule is deleted.
+  var allowed = Array.isArray(opts.allowedProtocols)
     ? opts.allowedProtocols
     : ALLOW_HTTP_TLS;
   var errClass = opts.errorClass;
@@ -531,7 +535,9 @@ function format(url) {
  */
 function canonicalize(input, opts) {
   opts = opts || {};
-  var allowedSchemes = Array.isArray(opts.allowedSchemes) && opts.allowedSchemes.length > 0
+  // Same reading as parse above: the default is for the OMITTED case. An empty
+  // list asked for nothing and used to receive all four schemes.
+  var allowedSchemes = Array.isArray(opts.allowedSchemes)
     ? opts.allowedSchemes
     : ALLOW_ANY;
 

package/lib/self-update.js

@@ -231,7 +231,10 @@ function _validatePollOpts(opts) {
         throw new SelfUpdateError("selfupdate/bad-releases-url",
           "selfUpdate.poll: opts.releasesUrl is not parseable as a URL");
       }
-      var allowedProtocols = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
+      // The documented default is for the OMITTED case. An explicitly empty
+      // list says no protocol may be dialled, and widening it back to https:
+      // answers "none" with "one".
+      var allowedProtocols = Array.isArray(opts.allowedProtocols)
         ? opts.allowedProtocols.slice() : ["https:"];
       if (allowedProtocols.indexOf(parsedProto) === -1) {
         throw new SelfUpdateError("selfupdate/bad-releases-url",

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-24T23:54:10.282Z"
+      "refreshedAt": "2026-08-25T10:45:22.083Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-24T23:54:10.282Z"
+      "refreshedAt": "2026-08-25T10:45:22.083Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-24T23:54:10.282Z",
+      "refreshedAt": "2026-08-25T10:45:22.083Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-24T23:54:10.282Z",
+      "refreshedAt": "2026-08-25T10:45:22.083Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-24T23:54:10.282Z"
+      "refreshedAt": "2026-08-25T10:45:22.083Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-24T23:54:10.282Z"
+      "refreshedAt": "2026-08-25T10:45:22.083Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-24T23:54:10.282Z"
+      "refreshedAt": "2026-08-25T10:45:22.083Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.30",
+      "version": "0.5.31",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -216,12 +216,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-24T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.30:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-25T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.31:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:fc8b1783ae40c377c1bc7afb7bd902b5282c165ed11354b803867f7d9f75f021"
+        "server": "sha256:8cc54fdfb7ac5277fb30f054f57500a9e77ce6b2d2b8f6846a14766d217770db"
       },
-      "refreshedAt": "2026-08-24T23:54:10.282Z"
+      "refreshedAt": "2026-08-25T10:45:22.083Z"
     }
   }
 }