@cosyte/mllp 0.0.6 → 0.0.7

package/CHANGELOG.md

@@ -76,6 +76,76 @@ begins its public history at `0.0.x`, per the cosyte version ladder (`0.0.x` unt
 
 ### Security
 
+- **The PHI scanner refuses a non-regular entry under a scan root, on both routes
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`).** A symbolic link under `test/` or `src/` read CLEAN on
+  **both** enumerating routes, so a link pointing at a PHI-bearing file passed the gate twice over.
+  Reproduced on `d854e81` with a synthetic name-bearing payload kept outside both walk roots: a link
+  to it under `test/` gave `all` mode exit 0 "OK, no hits"; a link to its **directory** did the same
+  and took the whole subtree with it; `--staged`, which is this repo's pre-commit gate, exited 0
+  after `git add`; and naming the target explicitly exited 1 with every hit. The payload was always
+  detectable, the two routes never looked at it.
+
+  Two mechanisms, two fixes. `walk()` enumerates `Dirent.isFile()`, an **lstat** answer, so a link is
+  neither a file nor a directory and fell out of the loop; `isDirectory()` is an lstat answer too,
+  which is how a linked directory vanished wholesale. `--staged` read content with
+  `git show :<path>`, and git stores a symbolic link as its **target path** under mode `120000`, so
+  it scanned the path text.
+
+  **Neither route follows a link it finds INSIDE a scan root.** Following would read bytes the
+  enumeration does not control (outside the repo, a loop, a device, a FIFO that blocks the gate
+  forever), and git does not carry those bytes anyway, so a hit on them would be a claim about
+  something no commit contains. The enumeration is narrowed instead: a non-regular in-scope entry
+  **refuses the scan** (exit 2, the existing "could not complete" code), naming **every** offender.
+  `--staged` now reads `git diff --cached --raw -z` so the destination mode is visible. The scan
+  roots' own names are matched as well as the prefix, because an entry named exactly `test` or `src`
+  does not sit inside a root, it **replaces** one, and a prefix test alone let a staged mode-`120000`
+  blob named `test` through at exit 0.
+
+  **The root itself is the one thing still followed, and a flat "neither route follows a link" would
+  be false.** `walk()` opens `test/` and `src/` with `existsSync` + `readdirSync`, and both follow,
+  so replacing a walk root with a link to a directory outside the repo makes the walk read straight
+  through it. Pre-existing, and the precise reading is **not** "its PHI is reported": the tree beyond
+  the link is scanned exactly as the root it replaced would have been, **with that root's own
+  limits**. A fixture-like payload behind a linked `test/` is reported (measured, exit 1); the same
+  payload behind a linked `src/` gets only the conservative pass and can read clean, exactly as it
+  would through a real `src/`. It is link-**neutral**, which is why it is disclosed rather than
+  closed: refusing a linked root is a decision about repo layout, not this defect.
+
+  **`--diff-filter` admits `T` (typechange), and leaving it out would have made the mode check
+  unreachable whenever the file being replaced was already tracked.** Replacing a **tracked** regular
+  file with a link is neither an add nor a modify; git raises it as `T`, so `--diff-filter=AM` deleted
+  the record before any mode could be read and the hook passed a mode-`120000` blob green. Measured on
+  git 2.39.5 against a tracked `test/differential/fixtures/*.frame.bin`: with `AM` the raw output for
+  that stage is **empty**. Admitting `T` also scans the reverse typechange, a link replaced by a real
+  file bearing PHI. Both premises are asserted in the tests rather than trusted.
+
+  A refusal names the entry's own repo-relative path and an engine-owned kind token, **never the link
+  target**, which is working-tree text that can itself carry PHI. Pinned with a synthetic name-bearing
+  payload whose target **filename** also carries a name, so the never-echo assertion is not a claim
+  about an empty string. 10 of the 14 new cases are red on `d854e81`; the other four are boundary
+  controls that must stay green (a gitignored entry stays exempt, an entry outside both roots is not
+  refused, the committed corpus still passes, a staged regular file still scans).
+
+  **Scope, stated rather than left to be read charitably.** "In scope" is each route's own existing
+  **root**; the `.ts` / `.md` **name** exemptions deliberately do not carry over to a non-regular
+  entry, because they are judgements about a file whose bytes the route could have read. `R`/`C`
+  rename and copy are still not enumerated by `--staged` at all: **pre-existing** (`AM` excluded them
+  too), disclosed rather than fixed. Explicit-path mode still reads **through** a link and is
+  unchanged. The gitlink (mode `160000`) arm is **not** a hole this closes: `--staged`'s scope already
+  reached a staged submodule under both roots and `git show` on one fails with `bad object`, so the
+  base commit already refused it, and what changed is that the diagnostic now says what the entry is.
+  The refuse-a-sweep-that-observed-nothing rule and the vanished-transient tolerance are untouched:
+  a non-regular entry that goes away mid-sweep therefore still **refuses**, because that tolerance is
+  scoped to the read and these entries are refused at enumeration. That asymmetry is deliberate in
+  direction, fail-closed being the correct way for a PHI gate to be wrong, and it is not reachable
+  here: nothing in this repo creates a non-regular entry under a scan root, and every one the tests
+  create lives in a throwaway repo under `tmpdir()`.
+
+  **This corrects a claim made under this same heading by the previous scanner change**, which called
+  the symlink gap "bounded, because git cannot commit content through a symlink and `--staged` reads
+  the index". The first half is true and the conclusion does not follow: the gate's promise is that it
+  observed what is under its roots, and both routes reported clean over an entry neither had read.
+
 - **BREAKING: ACK-correlation diagnostics no longer carry the control ID (`PHI-WARNING-MESSAGE-LEAK`).**
   The opt-in `correlateByControlId` path built its diagnostics by interpolation, and both ends were
   consumer-controlled and unbounded. The unmatched-ACK path read the **peer's** MSA-2 straight off an
@@ -185,6 +255,61 @@ begins its public history at `0.0.x`, per the cosyte version ladder (`0.0.x` unt
 
 ### Fixed
 
+- **The `attw` publish gate no longer passes on a tarball that carries no types.** `pnpm attw` was
+  `attw --pack . --profile node16`, and `@arethetypeswrong/cli@0.18.4`'s `getExitCode.js` opens with
+  `if (!analysis.types) return 0`, so the problem list is never read and no `--profile`,
+  `--ignore-rules` or config setting reaches that early return. For a package that ships types, "does
+  not contain types" means the declarations were not in the tarball, which is a broken publish
+  reported as a pass. A false red costs an hour; a false green merges.
+  `ATTW-FALSE-GREEN-PORT`, porting the remedy that shipped in `terminology#28` (`bf153cb`).
+
+  **Measured on this package at `0.0.6` with zero concurrency**, under the old invocation:
+  `rm -rf dist && pnpm attw` printed "This package does not contain types." and exited **0**.
+  Concurrency supplies only the condition, so the remedy is not a lock, a lease or a build queue: the
+  gate has to be able to say its own inputs were missing, whatever removed them.
+
+  **The exit-0 path needs the tarball to carry no declaration at all**, which is a boundary specific
+  to how this package is built and is stated here because it is easy to get wrong. `tsup` emits a
+  shared type chunk (`dist/index-<hash>.d.ts`) beside the three entry declarations, so deleting only
+  the six entry `.d.ts`/`.d.cts` files leaves that chunk in the tarball and `attw` reds honestly
+  (`❌ No types`, UntypedResolution, exit 1); the same removal **plus** `dist/index-*.d.*ts` is what
+  exits 0. The build window lands in the exit-0 state regardless, because `tsup` writes JS in one
+  pass and every declaration in a later one, so no moment exists where only some are present: polling
+  two real clean builds here for `dist/index.mjs` and then the first declaration of any kind gave
+  windows of **4.25s and 3.31s**, holding JS and zero declarations throughout. The absolute timings
+  move run to run, so no single figure is quoted as "the" window; the stable claim is that the gap is
+  seconds rather than milliseconds, which is wide enough for a concurrent build or `pnpm clean` to
+  land `attw` in it.
+
+  `pnpm attw` is now `node scripts/attw.mjs --profile node16`. The wrapper hardcodes `--pack .` and
+  forwards the rest, so **`--profile node16` is preserved**, not dropped. Two nets, which catch
+  different things: a **preflight** that every relative path `package.json` promises (`main`,
+  `module`, `types`, `typings`, and every string leaf of `exports`) exists and is non-empty, which
+  catches the build window and names the missing file; and a **post-check** that promotes `attw`'s
+  untyped sentence to a failure, which catches declarations present on disk but excluded from the
+  tarball by `files`/`.npmignore` (no instance of that is on record here). This package declares
+  three subpaths, so the preflight has **twelve** artifact paths to check. Because the post-check
+  reads a string, the options that would hide it are refused by name and wholesale rather than by
+  value: `--quiet`/`-q`, `--format`/`-f`, `--config-path`, and a `.attw.json` setting `quiet` or
+  `format`. The first three of those were re-measured here, on this package's own untyped pack and
+  under its own `--profile node16`, each handing back exit 0 with the sentence unreadable;
+  `--config-path` is refused by inference, not measurement.
+
+  **Disclosed gap:** the preflight cannot see that shared type chunk go missing, because
+  `package.json` names it nowhere. It is left to the post-check and to `attw` itself rather than
+  papered over with a glob. For the same reason the preflight's failure message does not promise
+  which way `attw` would have gone, since it cannot tell the two states apart.
+
+  `test/scripts/attw-gate.test.ts` pins both nets against the real binary, including **the upstream
+  exit 0 itself** (so an `attw` upgrade that rewords the sentence or fixes the exit code reds the
+  suite rather than letting the net go slack), that the preflight reaches a **subpath's `require`
+  branch** and not just the root entry, **the boundary above** (a tarball keeping a shared chunk reds
+  on `attw`'s own account, so the failure message must not claim the exit-0 counterfactual), that
+  **`--profile node16` survives the wrapper** (the fixture is red under the default profile and green
+  under `node16`), a **negative control** on a well-formed package, and that a **real `attw` failure
+  still fails** with `attw`'s own exit status. Build and
+  packaging only: no runtime, framing, transport, or public-API change.
+
 - **The PHI scanner no longer refuses an entire sweep because a transient file went away while it
   was reading.** `all` mode lists `test/` + `src/`, then reads each file; anything created and
   removed inside that window made a read throw `ENOENT` and took the whole scan down with it
@@ -261,8 +386,11 @@ begins its public history at `0.0.x`, per the cosyte version ladder (`0.0.x` unt
 
   **Two scope notes surfaced by the same review, one pre-existing and one introduced here.**
   PRE-EXISTING: `walk()` tests `e.isFile()`, which is false for a symlink Dirent, so a symlinked
-  file under `test/` or `src/` is never swept in `all` mode; it is bounded, because git cannot
-  commit content through a symlink and `--staged` reads the index. INTRODUCED by this change: a
+  file under `test/` or `src/` is never swept in `all` mode. **The "bounded" reading recorded here
+  was wrong and is corrected under Security above (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`): git
+  not committing content through a link does not make a route that reports clean over an unread
+  entry safe, and `--staged` reading the index is exactly how the link's target path text got
+  scanned in place of any content.** INTRODUCED by this change: a
   tolerated skip exits **0** with only a stderr line, including in CI, where the tree is at rest and
   a skip is therefore anomalous by definition. On the base commit that same input exited 2. Both are
   stated rather than changed: the first is not this defect, and the second **is** the shipped design

package/dist/index.cjs

@@ -3438,7 +3438,7 @@ async function createStarterClient(opts) {
 }
 
 // src/index.ts
-var VERSION = "0.0.6";
+var VERSION = "0.0.7";
 
 exports.Connection = Connection;
 exports.FrameReader = FrameReader;