@gmickel/gno 1.0.0 → 1.0.1

package/README.md

@@ -653,6 +653,11 @@ Upload the artifact at [gno.sh/studio](https://gno.sh/studio) and pick a visibil
 
 Republishing a public, secret-link, or invite-only artifact updates the same URL. Encrypted shares should be replaced from a fresh local export so the server never needs your plaintext.
 
+Encrypted source-backed publish on `gno.sh` is intentionally disabled. For encrypted shares, use:
+
+- `gno publish export --visibility encrypted --passphrase ...`, or
+- the browser-side encrypted markdown upload path in `gno.sh/studio`
+
 > **Full story**: [gno.sh/publish](https://gno.sh/publish) · **Try it**: [gno.sh/studio](https://gno.sh/studio)
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",

package/src/converters/adapters/markitdownTs/adapter.ts

@@ -15,6 +15,7 @@ import type {
 import {
   adapterError,
   corruptError,
+  permissionError,
   timeoutError,
   tooLargeError,
 } from "../../errors";
@@ -33,6 +34,15 @@ const SUPPORTED_MIMES = [
   "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
 ];
 
+const PDF_SIGNATURE = new Uint8Array([0x25, 0x50, 0x44, 0x46, 0x2d]);
+const CFB_SIGNATURE = new Uint8Array([
+  0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1,
+]);
+const ENCRYPTION_INFO = utf16le("EncryptionInfo");
+const ENCRYPTED_PACKAGE = utf16le("EncryptedPackage");
+const MAX_MESSAGE_LENGTH = 200;
+const PASSWORD_ERROR_REGEX = /password(?:-protected)?|no password given/i;
+
 /**
  * Create zero-copy Buffer view of Uint8Array.
  * Assumes input.bytes is immutable (contract requirement).
@@ -41,6 +51,103 @@ function toBuffer(bytes: Uint8Array): Buffer {
   return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
 }
 
+function utf16le(value: string): Uint8Array {
+  return new Uint8Array(Buffer.from(value, "utf16le"));
+}
+
+function hasPrefix(bytes: Uint8Array, prefix: Uint8Array): boolean {
+  if (bytes.length < prefix.length) {
+    return false;
+  }
+
+  for (let index = 0; index < prefix.length; index += 1) {
+    if (bytes[index] !== prefix[index]) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function includesBytes(bytes: Uint8Array, needle: Uint8Array): boolean {
+  if (needle.length === 0 || bytes.length < needle.length) {
+    return false;
+  }
+
+  outer: for (
+    let index = 0;
+    index <= bytes.length - needle.length;
+    index += 1
+  ) {
+    for (let offset = 0; offset < needle.length; offset += 1) {
+      if (bytes[index + offset] !== needle[offset]) {
+        continue outer;
+      }
+    }
+    return true;
+  }
+
+  return false;
+}
+
+function isPasswordProtectedPdf(bytes: Uint8Array): boolean {
+  if (!hasPrefix(bytes, PDF_SIGNATURE)) {
+    return false;
+  }
+
+  const tailStart = Math.max(0, bytes.length - 64 * 1024);
+  const tail = Buffer.from(bytes.subarray(tailStart)).toString("latin1");
+  return /\/Encrypt\b/.test(tail);
+}
+
+function isPasswordProtectedXlsx(bytes: Uint8Array): boolean {
+  return (
+    hasPrefix(bytes, CFB_SIGNATURE) &&
+    includesBytes(bytes, ENCRYPTION_INFO) &&
+    includesBytes(bytes, ENCRYPTED_PACKAGE)
+  );
+}
+
+function isPasswordProtected(input: ConvertInput): boolean {
+  if (input.ext === ".pdf") {
+    return isPasswordProtectedPdf(input.bytes);
+  }
+
+  if (input.ext === ".xlsx") {
+    return isPasswordProtectedXlsx(input.bytes);
+  }
+
+  return false;
+}
+
+function sanitizeErrorMessage(message: string, input: ConvertInput): string {
+  const normalized = message.trim();
+
+  let hasControlChars = false;
+  for (const char of normalized) {
+    const code = char.charCodeAt(0);
+    if (
+      (code >= 0 && code <= 8) ||
+      code === 11 ||
+      code === 12 ||
+      (code >= 14 && code <= 31)
+    ) {
+      hasControlChars = true;
+      break;
+    }
+  }
+
+  if (
+    normalized.length === 0 ||
+    normalized.length > MAX_MESSAGE_LENGTH ||
+    hasControlChars
+  ) {
+    return `Could not convert ${input.ext} file to markdown`;
+  }
+
+  return normalized;
+}
+
 export const markitdownAdapter: Converter = {
   id: CONVERTER_ID,
   version: CONVERTER_VERSION,
@@ -55,6 +162,21 @@ export const markitdownAdapter: Converter = {
       return { ok: false, error: tooLargeError(input, CONVERTER_ID) };
     }
 
+    // 1b. Detect password-protected documents before calling markitdown-ts.
+    // markitdown-ts logs dependency stack traces to stderr for these files.
+    if (isPasswordProtected(input)) {
+      return {
+        ok: false,
+        error: permissionError(
+          input,
+          CONVERTER_ID,
+          "File is password-protected",
+          undefined,
+          { protection: input.ext.slice(1) }
+        ),
+      };
+    }
+
     // 2. Setup timeout handling
     // Note: markitdown-ts doesn't support AbortSignal, so underlying
     // work may continue after timeout (known limitation; process isolation future work)
@@ -128,14 +250,27 @@ export const markitdownAdapter: Converter = {
       }
 
       // Map adapter errors
+      const message =
+        err instanceof Error
+          ? sanitizeErrorMessage(err.message, input)
+          : `Could not convert ${input.ext} file to markdown`;
+
+      if (PASSWORD_ERROR_REGEX.test(message)) {
+        return {
+          ok: false,
+          error: permissionError(
+            input,
+            CONVERTER_ID,
+            "File is password-protected",
+            err,
+            { protection: input.ext.slice(1) }
+          ),
+        };
+      }
+
       return {
         ok: false,
-        error: adapterError(
-          input,
-          CONVERTER_ID,
-          err instanceof Error ? err.message : "Unknown error",
-          err
-        ),
+        error: adapterError(input, CONVERTER_ID, message, err),
       };
     }
   },

package/src/converters/errors.ts

@@ -179,6 +179,29 @@ export function corruptError(
   });
 }
 
+/**
+ * Create an error for permission-gated files (for example password-protected documents).
+ */
+export function permissionError(
+  input: Pick<ConvertInput, "sourcePath" | "mime" | "ext">,
+  converterId: string,
+  message: string,
+  cause?: unknown,
+  details?: Record<string, unknown>
+): ConvertError {
+  return convertError("PERMISSION", {
+    message,
+    retryable: false,
+    fatal: false,
+    converterId,
+    sourcePath: input.sourcePath,
+    mime: input.mime,
+    ext: input.ext,
+    cause,
+    details,
+  });
+}
+
 /**
  * Create an error for adapter-level failures.
  */

package/src/publish/encrypted-export.ts

@@ -2,8 +2,6 @@ import { randomBytes, webcrypto } from "node:crypto";
 
 import type { EncryptedArtifactPayload, PublishArtifactNote } from "./artifact";
 
-import { slugify } from "./artifact";
-
 const { subtle } = webcrypto;
 
 const PBKDF2_ITERATIONS = 210_000;
@@ -19,6 +17,7 @@ type MetadataEntry = {
 
 type NoteBlock =
   | { type: "paragraph"; text: string }
+  | { type: "markdown"; markdown: string }
   | { type: "heading"; depth: 2 | 3; id: string; text: string }
   | { type: "list"; items: string[]; style: "ordered" | "unordered" }
   | { code: string; language: string; type: "code" }
@@ -108,120 +107,12 @@ const filterMetadata = (
   }));
 };
 
-const parseMarkdownBlocks = (markdown: string): NoteBlock[] => {
-  const blocks: NoteBlock[] = [];
-  const lines = stripFrontmatter(markdown).split("\n");
-  let paragraph: string[] = [];
-  let listItems: string[] = [];
-  let codeFence: { code: string[]; language: string } | null = null;
-
-  const flushParagraph = () => {
-    if (paragraph.length === 0) {
-      return;
-    }
-
-    blocks.push({
-      type: "paragraph",
-      text: paragraph.join(" ").trim(),
-    });
-    paragraph = [];
-  };
-
-  const flushList = () => {
-    if (listItems.length === 0) {
-      return;
-    }
-
-    blocks.push({
-      type: "list",
-      style: "unordered",
-      items: listItems,
-    });
-    listItems = [];
-  };
-
-  for (const line of lines) {
-    if (codeFence) {
-      if (line.startsWith("```")) {
-        blocks.push({
-          type: "code",
-          language: codeFence.language || "text",
-          code: codeFence.code.join("\n"),
-        });
-        codeFence = null;
-        continue;
-      }
-
-      codeFence.code.push(line);
-      continue;
-    }
-
-    const trimmed = line.trim();
-    if (!trimmed) {
-      flushParagraph();
-      flushList();
-      continue;
-    }
-
-    const codeMatch = trimmed.match(/^```([\w-]*)$/);
-    if (codeMatch) {
-      flushParagraph();
-      flushList();
-      codeFence = { code: [], language: codeMatch[1] || "text" };
-      continue;
-    }
-
-    const headingMatch = trimmed.match(/^(#{1,3})\s+(.*)$/);
-    if (headingMatch) {
-      flushParagraph();
-      flushList();
-      const headingText = headingMatch[2] ?? "";
-      blocks.push({
-        type: "heading",
-        depth: headingMatch[1] === "###" ? 3 : 2,
-        id: slugify(headingText),
-        text: headingText,
-      });
-      continue;
-    }
-
-    const imageMatch = trimmed.match(/^!\[(.*?)\]\((.*?)\)$/);
-    if (imageMatch) {
-      flushParagraph();
-      flushList();
-      const alt = imageMatch[1] ?? "";
-      const src = imageMatch[2] ?? "";
-      blocks.push({
-        type: "image",
-        alt,
-        src,
-        caption: alt,
-      });
-      continue;
-    }
-
-    const listMatch = trimmed.match(/^[-*]\s+(.*)$/);
-    if (listMatch) {
-      flushParagraph();
-      listItems.push(listMatch[1] ?? "");
-      continue;
-    }
-
-    paragraph.push(trimmed);
-  }
-
-  flushParagraph();
-  flushList();
-
-  if (blocks.length === 0) {
-    blocks.push({
-      type: "paragraph",
-      text: markdown.trim(),
-    });
-  }
-
-  return blocks;
-};
+const parseMarkdownBlocks = (markdown: string): NoteBlock[] => [
+  {
+    type: "markdown",
+    markdown: stripFrontmatter(markdown).trim(),
+  },
+];
 
 const getOutline = (blocks: NoteBlock[]) =>
   blocks.flatMap((block) =>