@cortexkit/subc-client 0.20.0 → 0.21.0

package/src/connection-file.ts

@@ -1,8 +1,8 @@
 // Port of subc-transport's connection_file.rs reader. The connection file is
 // the daemon's published rendezvous record; its `key` is the shared transport
-// secret. We refuse to trust a key from a file other local users can read,
-// exactly as the Rust reader does, so a leaked (group/world-readable) key is a
-// loud failure rather than a silent downgrade.
+// secret. We refuse to trust a key from a file another local user owns or can
+// read, exactly as the Rust reader does, so a substituted or leaked
+// (group/world-readable) key is a loud failure rather than a silent downgrade.
 
 import { promises as fs } from "node:fs";
 
@@ -64,14 +64,22 @@ function validate(info: ConnectionInfo): void {
 }
 
 /**
- * On unix, reject any group/other permission bit: the key is published
- * owner-only (0600), so a wider mode means the secret has leaked. On Windows the
+ * On unix, refuse a file owned by anyone but `expectedUid`, then any
+ * group/other permission bit. A file another user owns is untrusted even at
+ * 0600: its owner could have written their own endpoint and key, and this
+ * client would then authenticate to them. A wider mode on our own file means the
+ * secret has leaked. `expectedUid` is undefined where the platform has no
+ * effective uid (Windows), and the owner check is skipped there. On Windows the
  * file inherits the per-user profile directory ACL at create time and there are
  * no portable mode bits to re-check, matching the Rust no-op.
  */
-async function verifyOwnerOnly(path: string): Promise<void> {
+function verifyOwnerOnly(path: string, stat: { uid: number; mode: number }, expectedUid: number | undefined): void {
   if (process.platform === "win32") return;
-  const stat = await fs.stat(path);
+  if (expectedUid !== undefined && stat.uid !== expectedUid) {
+    throw new ConnectionFileError(
+      `connection file ${path} is owned by uid ${stat.uid}, expected effective uid ${expectedUid}`,
+    );
+  }
   const mode = stat.mode & 0o777;
   if ((mode & 0o077) !== 0) {
     throw new ConnectionFileError(
@@ -80,10 +88,29 @@ async function verifyOwnerOnly(path: string): Promise<void> {
   }
 }
 
-/** Read, permission-check, and validate a connection file. */
+/** Read, ownership- and permission-check, and validate a connection file. */
 export async function readConnectionFile(path: string): Promise<ConnectionInfo> {
-  await verifyOwnerOnly(path);
-  const raw = await fs.readFile(path, "utf8");
+  return readConnectionFileForUid(path, process.geteuid?.());
+}
+
+/**
+ * @internal `readConnectionFile` with the expected owner uid supplied by the
+ * caller, so tests can present a foreign owner without changing the process uid.
+ */
+export async function readConnectionFileForUid(
+  path: string,
+  expectedUid: number | undefined,
+): Promise<ConnectionInfo> {
+  // Check the opened file, not a second lookup of the path: if the path were
+  // replaced between a stat and the read, an unchecked key would get through.
+  const handle = await fs.open(path, "r");
+  let raw: string;
+  try {
+    verifyOwnerOnly(path, await handle.stat(), expectedUid);
+    raw = await handle.readFile({ encoding: "utf8" });
+  } finally {
+    await handle.close();
+  }
   let parsed: Record<string, unknown>;
   try {
     parsed = JSON.parse(raw) as Record<string, unknown>;

package/src/envelope.ts

@@ -172,18 +172,19 @@ function validateHeaderFields(header: EnvelopeHeader): void {
       "sheddable_illegal_frame_type",
     );
   }
-  if (channel === 0 && epoch !== 0) {
-    throw new DecodeError(
-      `control channel carried nonzero epoch ${epoch}`,
-      "nonzero_epoch_on_control_channel",
-    );
-  }
+  // Match the wire decoder's precedence when a header violates both rules.
   if (isPureHeader(ty) && len !== 0) {
     throw new DecodeError(
       `pure-header frame ${FrameType[ty]} declared non-zero body length ${len}`,
       "pure_header_frame_with_body",
     );
   }
+  if (channel === 0 && epoch !== 0) {
+    throw new DecodeError(
+      `control channel carried nonzero epoch ${epoch}`,
+      "nonzero_epoch_on_control_channel",
+    );
+  }
 }
 
 /** Decode and validate a header from the front of `bytes`. */
@@ -233,18 +234,19 @@ export function decodeHeader(bytes: Uint8Array): EnvelopeHeader {
   }
   const channel = view.getUint16(7, true);
   const epoch = view.getUint32(9, true);
-  if (channel === 0 && epoch !== 0) {
-    throw new DecodeError(
-      `control channel carried nonzero epoch ${epoch}`,
-      "nonzero_epoch_on_control_channel",
-    );
-  }
+  // Body length is checked before the control epoch in Rust and Swift too.
   if (isPureHeader(ty) && len !== 0) {
     throw new DecodeError(
       `pure-header frame ${FrameType[ty]} declared non-zero body length ${len}`,
       "pure_header_frame_with_body",
     );
   }
+  if (channel === 0 && epoch !== 0) {
+    throw new DecodeError(
+      `control channel carried nonzero epoch ${epoch}`,
+      "nonzero_epoch_on_control_channel",
+    );
+  }
   return { len, ver, ty, flags, channel, epoch, corr: view.getBigUint64(13, true) };
 }
 
@@ -278,7 +280,17 @@ export function buildFrameWithVersion(
   return { header, body };
 }
 
-/** Encode a frame to wire bytes: header followed by exactly `len` body bytes. */
+/**
+ * Encode a frame to wire bytes: header followed by exactly `len` body bytes.
+ *
+ * Refuses, before producing any bytes, a frame the peer's decoder would reject:
+ * a header that fails any wire decode rule, or a body over MAX_FRAME_BODY_LEN.
+ * A `Frame` can be assembled by hand without going through `buildFrame`, and
+ * once a rejected header is on the socket the peer tears the whole connection
+ * down, so the refusal has to happen here rather than on the far side. The
+ * header check runs the encoded bytes through `decodeHeader` itself, so the
+ * writer cannot drift from the reader's rules.
+ */
 export function encodeFrame(frame: Frame): Uint8Array {
   if (frame.header.len !== frame.body.length) {
     throw new DecodeError(
@@ -286,7 +298,14 @@ export function encodeFrame(frame: Frame): Uint8Array {
       "frame_length_mismatch",
     );
   }
+  if (frame.body.length > MAX_FRAME_BODY_LEN) {
+    throw new DecodeError(
+      `frame body ${frame.body.length} exceeds max ${MAX_FRAME_BODY_LEN}`,
+      "frame_body_too_large",
+    );
+  }
   const header = encodeHeader(frame.header);
+  decodeHeader(header);
   const output = new Uint8Array(header.length + frame.body.length);
   output.set(header, 0);
   output.set(frame.body, header.length);

package/src/index.ts

@@ -19,6 +19,7 @@ export {
   type RouteTarget,
   type ManagedRouteKind,
   type ConsumerIdentity,
+  type RouteScope,
   type RouteOpenOptions,
   type CatalogCapabilities,
   type CatalogCapabilityRequirement,

package/src/provider.ts

@@ -680,8 +680,7 @@ export class SubcProvider {
 
   async close(): Promise<void> {
     if (!this.closeStarted) {
-      this.closeStarted = true;
-      this.cancelRestoredDebounce();
+      this.endServing(new SubcProviderError("provider closed", "provider_closed"));
       const sock = this.sock;
       try {
         await sendFrame(sock, buildFrame(FrameType.Goodbye, controlFlags(), 0, 0, 0n, new Uint8Array(0)));
@@ -722,7 +721,9 @@ export class SubcProvider {
         const frame = await sock.readFrame(Number.POSITIVE_INFINITY, { afterHeaderMs: BODY_READ_TIMEOUT_MS });
         const keepGoing = await this.dispatch(frame, sock, generation, control);
         if (!keepGoing) {
-          if (this.sock === sock && this.generation === generation) this.closeStarted = true;
+          if (this.sock === sock && this.generation === generation) {
+            this.endServing(new SubcProviderError("daemon closed provider connection", "connection_closed"));
+          }
           break;
         }
       }
@@ -903,12 +904,16 @@ export class SubcProvider {
 
   private abortGeneration(_generation: number): void {
     this.abortAllInflight();
+    this.rejectPendingRequests(new SubcProviderError("provider connection dropped", "connection_dropped"));
+    this.liveRoutes.clear();
+  }
+
+  private rejectPendingRequests(error: Error): void {
     for (const [key, pending] of this.pending) {
       this.pending.delete(key);
       clearTimeout(pending.timer);
-      pending.reject(new SubcProviderError("provider connection dropped", "connection_dropped"));
+      pending.reject(error);
     }
-    this.liveRoutes.clear();
   }
 
   private abortAllInflight(): void {
@@ -1410,12 +1415,19 @@ export class SubcProvider {
   }
 
   private failFatal(err: Error): void {
+    this.endServing(err);
+    this.sock.close();
+    this.finishClosed();
+  }
+
+  /** End work before closing the socket, which cannot settle requests on its own. */
+  private endServing(err: Error): void {
     if (!this.closedErr) this.closedErr = err;
     this.closeStarted = true;
     this.cancelRestoredDebounce();
+    this.rejectPendingRequests(this.closedErr);
     this.abortAllInflight();
-    this.sock.close();
-    this.finishClosed();
+    this.liveRoutes.clear();
   }
 
   private finishClosed(): void {