@cosyte/mllp 0.0.5 → 0.0.7

package/CHANGELOG.md

@@ -76,6 +76,76 @@ begins its public history at `0.0.x`, per the cosyte version ladder (`0.0.x` unt
 
 ### Security
 
+- **The PHI scanner refuses a non-regular entry under a scan root, on both routes
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`).** A symbolic link under `test/` or `src/` read CLEAN on
+  **both** enumerating routes, so a link pointing at a PHI-bearing file passed the gate twice over.
+  Reproduced on `d854e81` with a synthetic name-bearing payload kept outside both walk roots: a link
+  to it under `test/` gave `all` mode exit 0 "OK, no hits"; a link to its **directory** did the same
+  and took the whole subtree with it; `--staged`, which is this repo's pre-commit gate, exited 0
+  after `git add`; and naming the target explicitly exited 1 with every hit. The payload was always
+  detectable, the two routes never looked at it.
+
+  Two mechanisms, two fixes. `walk()` enumerates `Dirent.isFile()`, an **lstat** answer, so a link is
+  neither a file nor a directory and fell out of the loop; `isDirectory()` is an lstat answer too,
+  which is how a linked directory vanished wholesale. `--staged` read content with
+  `git show :<path>`, and git stores a symbolic link as its **target path** under mode `120000`, so
+  it scanned the path text.
+
+  **Neither route follows a link it finds INSIDE a scan root.** Following would read bytes the
+  enumeration does not control (outside the repo, a loop, a device, a FIFO that blocks the gate
+  forever), and git does not carry those bytes anyway, so a hit on them would be a claim about
+  something no commit contains. The enumeration is narrowed instead: a non-regular in-scope entry
+  **refuses the scan** (exit 2, the existing "could not complete" code), naming **every** offender.
+  `--staged` now reads `git diff --cached --raw -z` so the destination mode is visible. The scan
+  roots' own names are matched as well as the prefix, because an entry named exactly `test` or `src`
+  does not sit inside a root, it **replaces** one, and a prefix test alone let a staged mode-`120000`
+  blob named `test` through at exit 0.
+
+  **The root itself is the one thing still followed, and a flat "neither route follows a link" would
+  be false.** `walk()` opens `test/` and `src/` with `existsSync` + `readdirSync`, and both follow,
+  so replacing a walk root with a link to a directory outside the repo makes the walk read straight
+  through it. Pre-existing, and the precise reading is **not** "its PHI is reported": the tree beyond
+  the link is scanned exactly as the root it replaced would have been, **with that root's own
+  limits**. A fixture-like payload behind a linked `test/` is reported (measured, exit 1); the same
+  payload behind a linked `src/` gets only the conservative pass and can read clean, exactly as it
+  would through a real `src/`. It is link-**neutral**, which is why it is disclosed rather than
+  closed: refusing a linked root is a decision about repo layout, not this defect.
+
+  **`--diff-filter` admits `T` (typechange), and leaving it out would have made the mode check
+  unreachable whenever the file being replaced was already tracked.** Replacing a **tracked** regular
+  file with a link is neither an add nor a modify; git raises it as `T`, so `--diff-filter=AM` deleted
+  the record before any mode could be read and the hook passed a mode-`120000` blob green. Measured on
+  git 2.39.5 against a tracked `test/differential/fixtures/*.frame.bin`: with `AM` the raw output for
+  that stage is **empty**. Admitting `T` also scans the reverse typechange, a link replaced by a real
+  file bearing PHI. Both premises are asserted in the tests rather than trusted.
+
+  A refusal names the entry's own repo-relative path and an engine-owned kind token, **never the link
+  target**, which is working-tree text that can itself carry PHI. Pinned with a synthetic name-bearing
+  payload whose target **filename** also carries a name, so the never-echo assertion is not a claim
+  about an empty string. 10 of the 14 new cases are red on `d854e81`; the other four are boundary
+  controls that must stay green (a gitignored entry stays exempt, an entry outside both roots is not
+  refused, the committed corpus still passes, a staged regular file still scans).
+
+  **Scope, stated rather than left to be read charitably.** "In scope" is each route's own existing
+  **root**; the `.ts` / `.md` **name** exemptions deliberately do not carry over to a non-regular
+  entry, because they are judgements about a file whose bytes the route could have read. `R`/`C`
+  rename and copy are still not enumerated by `--staged` at all: **pre-existing** (`AM` excluded them
+  too), disclosed rather than fixed. Explicit-path mode still reads **through** a link and is
+  unchanged. The gitlink (mode `160000`) arm is **not** a hole this closes: `--staged`'s scope already
+  reached a staged submodule under both roots and `git show` on one fails with `bad object`, so the
+  base commit already refused it, and what changed is that the diagnostic now says what the entry is.
+  The refuse-a-sweep-that-observed-nothing rule and the vanished-transient tolerance are untouched:
+  a non-regular entry that goes away mid-sweep therefore still **refuses**, because that tolerance is
+  scoped to the read and these entries are refused at enumeration. That asymmetry is deliberate in
+  direction, fail-closed being the correct way for a PHI gate to be wrong, and it is not reachable
+  here: nothing in this repo creates a non-regular entry under a scan root, and every one the tests
+  create lives in a throwaway repo under `tmpdir()`.
+
+  **This corrects a claim made under this same heading by the previous scanner change**, which called
+  the symlink gap "bounded, because git cannot commit content through a symlink and `--staged` reads
+  the index". The first half is true and the conclusion does not follow: the gate's promise is that it
+  observed what is under its roots, and both routes reported clean over an entry neither had read.
+
 - **BREAKING: ACK-correlation diagnostics no longer carry the control ID (`PHI-WARNING-MESSAGE-LEAK`).**
   The opt-in `correlateByControlId` path built its diagnostics by interpolation, and both ends were
   consumer-controlled and unbounded. The unmatched-ACK path read the **peer's** MSA-2 straight off an
@@ -185,6 +255,147 @@ begins its public history at `0.0.x`, per the cosyte version ladder (`0.0.x` unt
 
 ### Fixed
 
+- **The `attw` publish gate no longer passes on a tarball that carries no types.** `pnpm attw` was
+  `attw --pack . --profile node16`, and `@arethetypeswrong/cli@0.18.4`'s `getExitCode.js` opens with
+  `if (!analysis.types) return 0`, so the problem list is never read and no `--profile`,
+  `--ignore-rules` or config setting reaches that early return. For a package that ships types, "does
+  not contain types" means the declarations were not in the tarball, which is a broken publish
+  reported as a pass. A false red costs an hour; a false green merges.
+  `ATTW-FALSE-GREEN-PORT`, porting the remedy that shipped in `terminology#28` (`bf153cb`).
+
+  **Measured on this package at `0.0.6` with zero concurrency**, under the old invocation:
+  `rm -rf dist && pnpm attw` printed "This package does not contain types." and exited **0**.
+  Concurrency supplies only the condition, so the remedy is not a lock, a lease or a build queue: the
+  gate has to be able to say its own inputs were missing, whatever removed them.
+
+  **The exit-0 path needs the tarball to carry no declaration at all**, which is a boundary specific
+  to how this package is built and is stated here because it is easy to get wrong. `tsup` emits a
+  shared type chunk (`dist/index-<hash>.d.ts`) beside the three entry declarations, so deleting only
+  the six entry `.d.ts`/`.d.cts` files leaves that chunk in the tarball and `attw` reds honestly
+  (`❌ No types`, UntypedResolution, exit 1); the same removal **plus** `dist/index-*.d.*ts` is what
+  exits 0. The build window lands in the exit-0 state regardless, because `tsup` writes JS in one
+  pass and every declaration in a later one, so no moment exists where only some are present: polling
+  two real clean builds here for `dist/index.mjs` and then the first declaration of any kind gave
+  windows of **4.25s and 3.31s**, holding JS and zero declarations throughout. The absolute timings
+  move run to run, so no single figure is quoted as "the" window; the stable claim is that the gap is
+  seconds rather than milliseconds, which is wide enough for a concurrent build or `pnpm clean` to
+  land `attw` in it.
+
+  `pnpm attw` is now `node scripts/attw.mjs --profile node16`. The wrapper hardcodes `--pack .` and
+  forwards the rest, so **`--profile node16` is preserved**, not dropped. Two nets, which catch
+  different things: a **preflight** that every relative path `package.json` promises (`main`,
+  `module`, `types`, `typings`, and every string leaf of `exports`) exists and is non-empty, which
+  catches the build window and names the missing file; and a **post-check** that promotes `attw`'s
+  untyped sentence to a failure, which catches declarations present on disk but excluded from the
+  tarball by `files`/`.npmignore` (no instance of that is on record here). This package declares
+  three subpaths, so the preflight has **twelve** artifact paths to check. Because the post-check
+  reads a string, the options that would hide it are refused by name and wholesale rather than by
+  value: `--quiet`/`-q`, `--format`/`-f`, `--config-path`, and a `.attw.json` setting `quiet` or
+  `format`. The first three of those were re-measured here, on this package's own untyped pack and
+  under its own `--profile node16`, each handing back exit 0 with the sentence unreadable;
+  `--config-path` is refused by inference, not measurement.
+
+  **Disclosed gap:** the preflight cannot see that shared type chunk go missing, because
+  `package.json` names it nowhere. It is left to the post-check and to `attw` itself rather than
+  papered over with a glob. For the same reason the preflight's failure message does not promise
+  which way `attw` would have gone, since it cannot tell the two states apart.
+
+  `test/scripts/attw-gate.test.ts` pins both nets against the real binary, including **the upstream
+  exit 0 itself** (so an `attw` upgrade that rewords the sentence or fixes the exit code reds the
+  suite rather than letting the net go slack), that the preflight reaches a **subpath's `require`
+  branch** and not just the root entry, **the boundary above** (a tarball keeping a shared chunk reds
+  on `attw`'s own account, so the failure message must not claim the exit-0 counterfactual), that
+  **`--profile node16` survives the wrapper** (the fixture is red under the default profile and green
+  under `node16`), a **negative control** on a well-formed package, and that a **real `attw` failure
+  still fails** with `attw`'s own exit status. Build and
+  packaging only: no runtime, framing, transport, or public-API change.
+
+- **The PHI scanner no longer refuses an entire sweep because a transient file went away while it
+  was reading.** `all` mode lists `test/` + `src/`, then reads each file; anything created and
+  removed inside that window made a read throw `ENOENT` and took the whole scan down with it
+  (exit 2, the invocation-error code). The refusal was never wrong, the **enumeration** was, so the
+  enumeration is what changed. `PHI-SCAN-ENUMERATE-THEN-READ-CLASS`, porting the remedy that
+  shipped in `ccda#80`.
+
+  **This repo is genuinely reachable, and that was measured rather than read off the code.** With a
+  `git` shim first on `PATH` (the scanner runs `git` between the walk and the first read, so the
+  shim is a deterministic hook into exactly that gap), a `test/phi-scan-cap-*/capture.txt` removed
+  in the window made `pnpm phi-scan` on this checkout exit 2. Those directories are not
+  hypothetical: `test/scripts/phi-scan.test.ts` `mkdtemp`s two of them inside `test/`, which IS a
+  walk root, and polling the tree during a suite run measured each existing for about **510 ms**
+  (about 1.03 s of exposure per `pnpm test`). The siblings are spared only because their walk roots
+  are not the repo root, which is where a build transient lands. **The exposure is real but not
+  self-triggering:** nothing in this repo runs an `all`-mode sweep beside the suite (CI runs
+  `pnpm phi-scan` as a step strictly before `pnpm test` in one sequential job, the pre-commit hook
+  runs `--staged` and reads blobs from the index, and inside the test file the sweep is ordered
+  before both capture tests), so what is live is a hand-run or agent-run sweep during a test run.
+  Racing 88 sweeps against 6 suite runs produced 0 refusals, which is consistent with the measured
+  duty cycle: walk 2-4 ms, `git check-ignore` 6-9 ms, reads 11-19 ms, inside a ~4 s process.
+
+  **Exactly one case is now tolerated:** a file the walk enumerated **itself**, that **git does not
+  track**, failing with **`ENOENT`**. It is reported on stderr as skipped, naming the path, and is
+  never silent. **Still refusing:** a tracked file that cannot be read, any non-`ENOENT` failure, a
+  tolerated file back on disk at sweep end, a `git` that cannot report the tracked set, and an
+  **empty** tracked set (a removed `.git/index` exits 0 with no output, which would make every file
+  untracked and quietly delete the tracked-file bound; a corrupt one exits 128 and was already
+  caught). `all` mode additionally refuses when it observed **no** files, so the tolerance can never
+  decay into a clean report of nothing.
+
+  **Which bounds are pinned, and which are only disclosed.** Pinned by eight tests in
+  `test/scripts/phi-scan.test.ts`, each against a throwaway tree under `tmpdir()` (seven of them a
+  git repo, one deliberately not) and **five** of them driven by the `git`-shim technique, with no
+  sleep and no real build: the tolerance itself; the tracked-file bound; the `ENOENT`-only bound
+  (`EISDIR` via a decoy replaced by a directory); git unable to answer; the empty tracked set;
+  `observed no files`; a violator in an untracked file that does not vanish; and a violator inside a
+  transient that is still there when the read arrives. Each bound was **mutation-tested**: widening
+  `tolerateVanish` to `true` fails three of them, dropping the `ENOENT` check fails one, dropping
+  the `size > 0` guard fails one, and dropping the `observed === 0` refusal fails one. **Not pinned,
+  and measured as not pinned:** the back-on-disk re-check. Stubbing it out leaves all 40 tests
+  green. Reaching it needs a timed re-create against a deliberately slowed sweep, and a
+  load-sensitive sleep guarding a load-dependent race is the failure mode this defect itself
+  teaches; losing that branch loses the re-check, never the tolerance's bounds. **The gate drove
+  that branch by hand** (shim anchored on the second git call, `git ls-files`, against a 20,000-file
+  read loop with a tuned re-create delay) and confirmed the code right at all three delays, so the
+  branch is measured-correct and unpinned rather than unknown.
+
+  **Two residuals carried, not closed.** The post-sweep re-check is keyed on the enumerated PATH,
+  not on content, so an untracked file RENAMED inside the window goes unscanned under a clean
+  report; it is bounded (committing the file means `git add`, after which it is tracked and
+  untolerable) and closing it needs a content-addressed sweep, a different design rather than a
+  wider bound. And `walk()`'s own `existsSync` -> `readdirSync` race, one phase earlier, is
+  untouched: a directory removed in that window throws a plain `SystemError` `main()` does not
+  convert, so Node exits **1**, the code the contract reserves for "hits found". It matters more
+  here than in the siblings because this repo's transient is a **directory**, removed wholesale, and
+  it is unpinnable by the same technique because nothing runs before the walk.
+
+  **The suite keeps writing inside the walk root, deliberately.** The two capture tests exist to
+  prove that a file whose repo-relative path starts with `test/` earns the structured scan, so the
+  path is the fixture and moving them would delete what they test.
+
+  **Three things the gate checked hardest and could not break, recorded so they are not re-derived.**
+  The tracked-set spelling comparison holds: instrumented against this checkout, **zero** files come
+  out `tolerateVanish: true`, so the tolerance is inert on a clean tree, and a purpose-built repo of
+  15 adversarial tracked filenames (space, tab, newline, quote, backslash, `$`, `*`, `;`, non-ASCII,
+  CJK, emoji, plus an invalid-UTF-8 name) never marked a tracked file untracked, because `-z`
+  suppresses `core.quotePath` on both sides. The tolerance cannot reach `paths` or `staged` mode,
+  and `--allow-fixture` forces `mode = "paths"`, so an allow-list subtraction can never be used to
+  drive `all` mode to zero observed files. And in `all` mode `report()` is unreachable while
+  `observed === 0`, while in every mode a sweep that observed nothing has no hits to publish.
+  (`staged` legitimately reaches `report()` at `observed === 0` and prints `OK, no hits` when a
+  commit stages nothing in scope, which is why the refusal is scoped to `all`.)
+
+  **Two scope notes surfaced by the same review, one pre-existing and one introduced here.**
+  PRE-EXISTING: `walk()` tests `e.isFile()`, which is false for a symlink Dirent, so a symlinked
+  file under `test/` or `src/` is never swept in `all` mode. **The "bounded" reading recorded here
+  was wrong and is corrected under Security above (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`): git
+  not committing content through a link does not make a route that reports clean over an unread
+  entry safe, and `--staged` reading the index is exactly how the link's target path text got
+  scanned in place of any content.** INTRODUCED by this change: a
+  tolerated skip exits **0** with only a stderr line, including in CI, where the tree is at rest and
+  a skip is therefore anomalous by definition. On the base commit that same input exited 2. Both are
+  stated rather than changed: the first is not this defect, and the second **is** the shipped design
+  under review.
+
 - **Three doc comments that had outlived the code they described**, all of which shipped into the
   published type declarations. The `'reconnecting'` payload was documented as carrying
   `connectionId` only, while `MllpClient` populates `attempt` and `delayMs` when it schedules a

package/dist/index.cjs

@@ -3438,7 +3438,7 @@ async function createStarterClient(opts) {
 }
 
 // src/index.ts
-var VERSION = "0.0.5";
+var VERSION = "0.0.7";
 
 exports.Connection = Connection;
 exports.FrameReader = FrameReader;