@gmickel/gno 1.29.6 → 1.30.1

package/src/serve/server.ts

@@ -17,6 +17,11 @@ import {
 import { startBackgroundRuntime } from "./background-runtime";
 import { handleContextBuild, handleContextVerify } from "./context-capsule";
 import { DocumentEventBus } from "./doc-events";
+import {
+  createDocAssetRouteHandlers,
+  handlePdfjsVendorRequest,
+  isPdfjsVendorPath,
+} from "./fn112-routes";
 // HTML import - Bun handles bundling TSX/CSS automatically via routes
 import homepage from "./public/index.html";
 import { handleResidentRead } from "./resident-request";
@@ -38,7 +43,6 @@ import {
   handleDeactivateDoc,
   handleDeleteCollection,
   handleDoc,
-  handleDocAsset,
   handleDocSections,
   handleDocsAutocomplete,
   handleDocs,
@@ -98,6 +102,10 @@ import {
   handleTraceShow,
 } from "./routes/traces";
 import { forbiddenResponse, isRequestAllowed } from "./security";
+import {
+  createSpaBundleSource,
+  type SpaBundleSource,
+} from "./spa-bundle-source";
 
 export interface ServeOptions extends HttpGatewayOverrides {
   /** Port to listen on (default: 3000) */
@@ -135,7 +143,8 @@ interface StartServerDependencies {
  * Get CSP based on environment.
  * Dev mode allows WebSocket connections for HMR.
  */
-function getCspHeader(isDev: boolean): string {
+/** Exported for security tests (CSP contract). */
+export function getCspHeader(isDev: boolean): string {
   // Local fonts only - no Google Fonts for true offline-first
   const base = [
     "default-src 'self'",
@@ -143,6 +152,7 @@ function getCspHeader(isDev: boolean): string {
     "style-src 'self' 'unsafe-inline'",
     "font-src 'self'",
     "img-src 'self' data: blob:",
+    "worker-src 'self'", // explicit for PDF.js module worker (fn-112)
     "frame-ancestors 'none'",
     "base-uri 'none'", // Prevent base tag injection
     "object-src 'none'", // Prevent plugin execution
@@ -160,20 +170,49 @@ function getCspHeader(isDev: boolean): string {
 
 /**
  * Apply security headers to a Response.
+ * Exported for unit tests that assert the envelope on specific responses.
+ *
+ * Mutates headers on the original Response when possible. Re-wrapping via
+ * `new Response(response.body, …)` breaks Bun.file().slice() range bodies
+ * (the stream re-reads the full file), which would corrupt HTTP 206 slices.
  */
-function withSecurityHeaders(response: Response, isDev: boolean): Response {
-  const headers = new Headers(response.headers);
-  headers.set("Content-Security-Policy", getCspHeader(isDev));
-  headers.set("X-Content-Type-Options", "nosniff");
-  headers.set("X-Frame-Options", "DENY");
-  headers.set("Referrer-Policy", "no-referrer");
-  headers.set("Cross-Origin-Resource-Policy", "same-origin");
+export function withSecurityHeaders(
+  response: Response,
+  isDev: boolean
+): Response {
+  const apply = (headers: Headers): void => {
+    headers.set("Content-Security-Policy", getCspHeader(isDev));
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    headers.set("Referrer-Policy", "no-referrer");
+    headers.set("Cross-Origin-Resource-Policy", "same-origin");
+  };
 
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+  try {
+    apply(response.headers);
+    return response;
+  } catch {
+    // Headers locked — fall back to a new envelope. Prefer cloning via
+    // arrayBuffer only when body is already consumed is not possible here
+    // (sync API); empty-body responses (HEAD/416) are the common case.
+    const headers = new Headers(response.headers);
+    apply(headers);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  }
+}
+
+/** Build a loopback origin with correct IPv6 authority formatting. */
+export function loopbackHttpOrigin(host: string, port: number): string {
+  const normalizedHost =
+    host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  const authority = normalizedHost.includes(":")
+    ? `[${normalizedHost}]`
+    : normalizedHost;
+  return `http://${authority}:${port}`;
 }
 
 /**
@@ -261,6 +300,86 @@ export async function startServer(
 
   // Start server with try/catch for port-in-use etc.
   let server: ReturnType<typeof Bun.serve>;
+  // Bun HTMLBundle route values cannot carry custom headers. In production,
+  // host it on a private Unix socket (ephemeral loopback on Windows), then
+  // proxy bytes through this public listener's security envelope. Injected
+  // server tests keep an in-listener bundle route because their fake Bun
+  // server cannot host the private source.
+  let spaBundleSource: SpaBundleSource | null = null;
+  const usesInjectedServer = dependencies.serve !== undefined;
+  try {
+    if (!usesInjectedServer) {
+      spaBundleSource = createSpaBundleSource(homepage, isDev);
+    }
+  } catch (error) {
+    removeShutdownHandlers();
+    await Promise.allSettled([gateway.close()]);
+    await Promise.allSettled([runtime.dispose()]);
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+  const spaInternalPath =
+    spaBundleSource?.entryPath ??
+    `/__gno_spa_${crypto.randomUUID().replaceAll("-", "")}`;
+  let spaHtmlCache: {
+    body: ArrayBuffer;
+    contentType: string;
+    etag: string | null;
+  } | null = null;
+
+  const serveSpaHtml = async (): Promise<Response> => {
+    if (!isDev && spaHtmlCache) {
+      const headers = new Headers({
+        "Content-Type": spaHtmlCache.contentType,
+      });
+      if (spaHtmlCache.etag) {
+        headers.set("ETag", spaHtmlCache.etag);
+      }
+      return withSecurityHeaders(
+        new Response(spaHtmlCache.body.slice(0), { headers }),
+        isDev
+      );
+    }
+    const boundPort = server.port ?? port;
+    const internalRequest = new Request(
+      `${loopbackHttpOrigin(gatewayConfig.host, boundPort)}${spaInternalPath}`
+    );
+    const raw = spaBundleSource
+      ? await spaBundleSource.fetch(internalRequest)
+      : await fetch(internalRequest);
+    if (!raw.ok) {
+      return withSecurityHeaders(
+        new Response("SPA unavailable", { status: 503 }),
+        isDev
+      );
+    }
+    if (!isDev) {
+      spaHtmlCache = {
+        body: await raw.arrayBuffer(),
+        contentType:
+          raw.headers.get("content-type") ?? "text/html;charset=utf-8",
+        etag: raw.headers.get("etag"),
+      };
+      const headers = new Headers({
+        "Content-Type": spaHtmlCache.contentType,
+      });
+      if (spaHtmlCache.etag) {
+        headers.set("ETag", spaHtmlCache.etag);
+      }
+      return withSecurityHeaders(
+        new Response(spaHtmlCache.body.slice(0), { headers }),
+        isDev
+      );
+    }
+    return withSecurityHeaders(raw, isDev);
+  };
+
+  const spaPageRoute = {
+    GET: serveSpaHtml,
+  };
+
   try {
     server = (dependencies.serve ?? Bun.serve)({
       port,
@@ -276,18 +395,21 @@ export async function startServer(
           isHttpGatewayLoopbackBind(gatewayConfig.host),
           clipperGateway
         ),
-        // SPA routes - all serve the same React app
-        "/": homepage,
-        "/search": homepage,
-        "/browse": homepage,
-        "/doc": homepage,
-        "/edit": homepage,
-        "/collections": homepage,
-        "/connectors": homepage,
-        "/traces": homepage,
-        "/ask": homepage,
-        "/graph": homepage,
-        "/clipper/pair": homepage,
+        // Injected-server tests only. Real runs keep the raw HTMLBundle off the
+        // public listener in createSpaBundleSource above.
+        ...(spaBundleSource ? {} : { [spaInternalPath]: homepage }),
+        // SPA routes - same React app, security envelope on every document
+        "/": spaPageRoute,
+        "/search": spaPageRoute,
+        "/browse": spaPageRoute,
+        "/doc": spaPageRoute,
+        "/edit": spaPageRoute,
+        "/collections": spaPageRoute,
+        "/connectors": spaPageRoute,
+        "/traces": spaPageRoute,
+        "/ask": spaPageRoute,
+        "/graph": spaPageRoute,
+        "/clipper/pair": spaPageRoute,
 
         // API routes with CSRF protection wrapper
         "/api/health": {
@@ -750,17 +872,17 @@ export async function startServer(
             );
           },
         },
-        "/api/doc-asset": {
-          GET: async (req: Request) => {
-            const url = new URL(req.url);
-            return withSecurityHeaders(
-              await handleResidentRead(runtime as ResidentRuntime, req, () =>
-                handleDocAsset(store, ctxHolder.config, url)
-              ),
-              isDev
-            );
-          },
-        },
+        // fn-112: production factories shared with route-level tests (I1-04)
+        "/api/doc-asset": createDocAssetRouteHandlers({
+          store,
+          getConfig: () => ctxHolder.config,
+          runtime: runtime as ResidentRuntime,
+          isDev,
+          withSecurityHeaders,
+        }),
+        // Vendor assets are NOT mounted as valid-only patterns here.
+        // ALL /vendor/pdfjs/* traffic is handled by handlePdfjsVendorRequest
+        // in the fetch fallback below (same production dispatcher tests use).
         "/api/events": {
           GET: (req: Request) => {
             const residentRuntime = runtime as ResidentRuntime;
@@ -1136,9 +1258,37 @@ export async function startServer(
           },
         },
       },
+      // Production vendor dispatcher for the entire /vendor/pdfjs prefix.
+      // Covers valid worker/cMap/font AND malformed/unknown/POST — same function
+      // that tests invoke (no test-only fallback path).
+      fetch: async (req: Request): Promise<Response> => {
+        const pathname = new URL(req.url).pathname;
+        if (isPdfjsVendorPath(pathname)) {
+          return handlePdfjsVendorRequest(req, {
+            isDev,
+            withSecurityHeaders,
+          });
+        }
+        if (
+          spaBundleSource &&
+          (req.method === "GET" || req.method === "HEAD")
+        ) {
+          const asset = await spaBundleSource.fetch(req);
+          if (asset.status !== 404) {
+            return withSecurityHeaders(asset, isDev);
+          }
+        }
+        return withSecurityHeaders(
+          new Response("Not Found", { status: 404 }),
+          isDev
+        );
+      },
     });
   } catch (e) {
     removeShutdownHandlers();
+    if (spaBundleSource) {
+      await Promise.allSettled([spaBundleSource.close()]);
+    }
     await Promise.allSettled([gateway.close()]);
     await Promise.allSettled([runtime.dispose()]);
     return {
@@ -1168,6 +1318,9 @@ export async function startServer(
   try {
     await server.stop(true);
   } finally {
+    if (spaBundleSource) {
+      await Promise.allSettled([spaBundleSource.close()]);
+    }
     await Promise.allSettled([gateway.close()]);
     await Promise.allSettled([runtime.dispose()]);
   }

package/src/serve/spa-bundle-source.ts

@@ -0,0 +1,99 @@
+import type { HTMLBundle, Server } from "bun";
+
+// node:fs/promises — no Bun equivalent for removing a Unix socket pathname.
+import { unlink } from "node:fs/promises";
+// node:os — no Bun equivalent for the platform temporary directory.
+import { tmpdir } from "node:os";
+// node:path — no Bun equivalent for joining the socket path.
+import { join } from "node:path";
+
+type BunServer = Server<unknown>;
+
+export type SpaBundleSource = {
+  entryPath: string;
+  fetch(request: Request): Promise<Response>;
+  close(): Promise<void>;
+};
+
+const notFound = (): Response => new Response("Not Found", { status: 404 });
+
+/**
+ * Host Bun's headerless HTMLBundle surface outside the public listener.
+ *
+ * Unix hosts use a private Unix-domain socket, so the raw bundle and generated
+ * assets have no TCP origin at all. Windows falls back to an ephemeral
+ * loopback listener plus an unguessable entry path. The public server proxies
+ * the bytes and applies its normal security envelope before browser delivery.
+ */
+export function createSpaBundleSource(
+  bundle: HTMLBundle,
+  isDev: boolean
+): SpaBundleSource {
+  const nonce = crypto.randomUUID().replaceAll("-", "");
+  const entryPath = `/__gno_spa_${nonce}`;
+  let server: BunServer;
+  let fetchPrivate: (request: Request) => Promise<Response>;
+  let socketPath: string | null = null;
+
+  const routes = { [entryPath]: bundle };
+  const fallback = { fetch: notFound };
+
+  if (process.platform === "win32") {
+    server = Bun.serve({
+      hostname: "127.0.0.1",
+      port: 0,
+      development: isDev,
+      routes,
+      ...fallback,
+    });
+    const origin = `http://127.0.0.1:${server.port}`;
+    fetchPrivate = async (request): Promise<Response> => {
+      const url = new URL(request.url);
+      return fetch(`${origin}${url.pathname}${url.search}`, {
+        method: request.method,
+      });
+    };
+  } else {
+    socketPath = join(tmpdir(), `gno-spa-${nonce.slice(0, 20)}.sock`);
+    server = Bun.serve({
+      unix: socketPath,
+      development: isDev,
+      routes,
+      ...fallback,
+    });
+    fetchPrivate = async (request): Promise<Response> => {
+      const url = new URL(request.url);
+      return fetch(`http://localhost${url.pathname}${url.search}`, {
+        method: request.method,
+        unix: socketPath ?? undefined,
+      });
+    };
+  }
+
+  let closed = false;
+  return {
+    entryPath,
+    fetch: fetchPrivate,
+    async close(): Promise<void> {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      await server.stop(true);
+      if (socketPath) {
+        try {
+          await unlink(socketPath);
+        } catch (error) {
+          if (
+            !error ||
+            typeof error !== "object" ||
+            !("code" in error) ||
+            error.code !== "ENOENT"
+          ) {
+            throw error;
+          }
+        }
+      }
+    },
+  };
+}

package/browser-extension/artifacts/gno-browser-clipper-v1.29.6.zip.sha256

@@ -1 +0,0 @@
-c1fc560d5f77022b3123d36c0f488b0e662883b0b67e6e40fe7476674d70e085  gno-browser-clipper-v1.29.6.zip