@goodandready/dsh-remote-workspace 0.3.14 → 0.3.15

package/lib/routes/env.js

@@ -1,6 +1,6 @@
-import { writeJson, readBody, authorizeRequest } from './helpers.js';
+import { writeJson, readBody, authorizeRequest, validateRemotePath } from './helpers.js';
 
-export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store, remoteFs }) {
+export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, store, remoteFs }) {
   // 10. POST /dsh-remote-workspace/env/view
   sctx.effect(() => webServer.register({
     kind: 'exact',
@@ -12,7 +12,8 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const { profileId, remotePath } = await readBody(req);
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const targetPath = remotePath || (profile.remoteWorkspace ? `${profile.remoteWorkspace.replace(/\/+$/, '')}/.env` : '.env');
+        const defaultPath = profile.remoteWorkspace ? `${profile.remoteWorkspace.replace(/\/+$/, '')}/.env` : '.env';
+        const targetPath = validateRemotePath(remotePath || defaultPath);
         const result = await envService.readEnv(profile, targetPath);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
@@ -32,11 +33,19 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const { profileId, remotePath, content, key, value } = await readBody(req);
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const targetPath = remotePath || (profile.remoteWorkspace ? `${profile.remoteWorkspace.replace(/\/+$/, '')}/.env` : '.env');
+        const defaultPath = profile.remoteWorkspace ? `${profile.remoteWorkspace.replace(/\/+$/, '')}/.env` : '.env';
+        const targetPath = validateRemotePath(remotePath || defaultPath);
+        const baseName = targetPath.split('/').pop();
+        if (!baseName.includes('env')) {
+          return writeJson(res, 400, { ok: false, error: 'Target path must be an environment file' });
+        }
         let result;
         if (key) {
           result = await envService.setEnvVar(profile, targetPath, key, value || '');
         } else if (content !== undefined) {
+          if (typeof content !== 'string' && !Buffer.isBuffer(content)) {
+            return writeJson(res, 400, { ok: false, error: 'Content must be a string or buffer' });
+          }
           if (remoteFs && typeof remoteFs.writeFile === 'function') {
             await remoteFs.writeFile(profile, targetPath, content);
           }

package/lib/routes/files.js

@@ -1,19 +1,15 @@
-import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import { writeJson, readBody, authorizeRequest, validateRemotePath } from './helpers.js';
 import { contentDisposition, pipeWithProgress, MAX_BYTES } from '../file-transfer.js';
 
 
 function transferTarget(req, store) {
   const url = new URL(req.url || '/', 'http://localhost');
   const profileId = url.searchParams.get('profileId') || '';
-  const filePath = url.searchParams.get('filePath') || '';
-  if (!filePath || filePath.length > 1024 || filePath.includes('\0')) {
-    const err = new Error('A file path is required');
-    err.status = 400;
-    throw err;
-  }
+  const filePath = validateRemotePath(url.searchParams.get('filePath'));
   const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
   if (!profile) {
     const err = new Error('Profile not found');
+    err.statusCode = 404;
     err.status = 404;
     throw err;
   }
@@ -44,7 +40,8 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         }
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
 
-        const targetPath = body.remotePath || body.path || profile.remoteWorkspace || profile.remotePath || '.';
+        const rawPath = body.remotePath || body.path || profile.remoteWorkspace || profile.remotePath || '.';
+        const targetPath = validateRemotePath(rawPath);
         const entries = await remoteFs.listDir(profile, targetPath);
         writeJson(res, 200, { ok: true, entries, items: entries, currentPath: targetPath });
       } catch (err) {
@@ -62,13 +59,14 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
       if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath } = await readBody(req);
+        const targetPath = validateRemotePath(filePath);
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        const stat = await remoteFs.stat(profile, filePath);
+        const stat = await remoteFs.stat(profile, targetPath);
         if (stat.size > 2 * 1024 * 1024) {
           return writeJson(res, 400, { ok: false, error: 'File exceeds 2MB preview limit' });
         }
-        const buf = await remoteFs.readFile(profile, filePath);
+        const buf = await remoteFs.readFile(profile, targetPath);
         writeJson(res, 200, { ok: true, content: buf.toString('utf8'), size: stat.size });
       } catch (err) {
         writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
@@ -85,9 +83,13 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
       if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath, content } = await readBody(req);
+        const targetPath = validateRemotePath(filePath);
+        if (content === undefined) {
+          return writeJson(res, 400, { ok: false, error: 'Content is required' });
+        }
         const profile = store.getProfile(profileId);
         if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
-        await remoteFs.writeFile(profile, filePath, Buffer.from(content, 'utf8'));
+        await remoteFs.writeFile(profile, targetPath, Buffer.from(content, 'utf8'));
         writeJson(res, 200, { ok: true });
       } catch (err) {
         writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });

package/lib/routes/helpers.js

@@ -80,51 +80,76 @@ export function isLoopbackAddress(address) {
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1' || address.startsWith('127.');
 }
 
-export function isTrustedSettingsRequest(req) {
-  const ip = req?.socket?.remoteAddress || '';
-  const isLoopback = isLoopbackAddress(ip);
+export function isTrustedSettingsRequest(req, expectedToken = null) {
+  if (!req || !req.headers || typeof req.headers !== 'object') return false;
+  const headers = req.headers;
 
-  const secFetch = req?.headers?.['sec-fetch-site'];
-  // Fail-closed: unconditionally reject cross-site and cross-origin requests
+  const secFetch = headers['sec-fetch-site'];
+  // Fail-closed: unconditionally reject cross-site and non-same-origin Sec-Fetch-Site
   if (secFetch && secFetch !== 'same-origin') {
     return false;
   }
 
-  // If origin is present, ensure it matches the request host
-  const origin = req?.headers?.['origin'];
-  const host = req?.headers?.['host'];
-  if (origin && host) {
+  // Reject invalid or mismatched origin when provided (CSRF protection)
+  const origin = headers['origin'];
+  const host = headers['host'];
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return false;
     try {
-      const url = new URL(origin);
-      if (url.host !== host) {
-        return false;
-      }
+      const originUrl = new URL(origin);
+      if (host && originUrl.host !== host) return false;
     } catch {
       return false;
     }
   }
 
-  const rawAuth = req?.headers?.['authorization'];
-  const cookieHeader = req?.headers?.['cookie'];
-  const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
+  const tokenCandidate = (typeof expectedToken === 'string' && expectedToken)
+    || process.env.DSH_AUTH_TOKEN
+    || process.env.DSH_TOKEN
+    || null;
 
-  if (expectedToken) {
-    if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) {
-      const token = rawAuth.slice(7).trim();
-      if (token && token === expectedToken) return true;
+  const rawAuth = headers['authorization'];
+  if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) {
+    const bearer = rawAuth.slice(7).trim();
+    if (tokenCandidate && bearer && bearer === tokenCandidate) {
+      return true;
     }
-    if (typeof cookieHeader === 'string') {
-      const cookies = parseCookies(cookieHeader);
-      const token = cookies['token'] || cookies['dsh_token'];
-      if (token && token === expectedToken) return true;
+  }
+
+  const cookieHeader = headers['cookie'];
+  if (typeof cookieHeader === 'string' && tokenCandidate) {
+    const cookies = parseCookies(cookieHeader);
+    const token = cookies['token'] || cookies['dsh_token'];
+    if (token && token === tokenCandidate) {
+      return true;
     }
+  }
+
+  // If a token is configured but neither header nor cookie matched, reject
+  if (tokenCandidate) {
     return false;
   }
 
-  // Non-loopback requests without valid token must not pass simply on Sec-Fetch-Site: same-origin
-  if (!isLoopback) return false;
-  if (secFetch === 'same-origin') return true;
-  return true;
+  const ip = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
+  const hasRemote = Boolean(ip && typeof ip === 'string');
+  const isLoopback = hasRemote && isLoopbackAddress(ip);
+
+  // Non-loopback network callers require explicit token authentication
+  if (hasRemote && !isLoopback) {
+    return false;
+  }
+
+  // Browser same-origin navigation / fetch
+  if (secFetch === 'same-origin') {
+    return true;
+  }
+
+  // Local loopback caller (direct CLI / loopback curl)
+  if (isLoopback) {
+    return true;
+  }
+
+  return false;
 }
 
 export function getConnection(ctx) {
@@ -136,6 +161,12 @@ export function getConnection(ctx) {
 }
 
 export function authorizeRequest(sctx, req, res) {
+  // First layer: Cross-origin / CSRF / remote network trust check
+  if (!isTrustedSettingsRequest(req)) {
+    writeJson(res, 403, { ok: false, error: 'Forbidden' });
+    return false;
+  }
+
   let connection;
   try {
     connection = getConnection(sctx);
@@ -168,3 +199,48 @@ export function authorizeRequest(sctx, req, res) {
 
   return true;
 }
+
+
+export function validateRemotePath(filePath, options = {}) {
+  const { allowEmpty = false, maxLength = 1024 } = options;
+  if (!filePath && filePath !== '') {
+    if (allowEmpty) return '';
+    const err = new Error('A file path is required');
+    err.statusCode = 400;
+    err.status = 400;
+    throw err;
+  }
+  if (typeof filePath !== 'string') {
+    const err = new Error('File path must be a string');
+    err.statusCode = 400;
+    err.status = 400;
+    throw err;
+  }
+  const trimmed = filePath.trim();
+  if (!trimmed) {
+    if (allowEmpty) return '';
+    const err = new Error('A file path is required');
+    err.statusCode = 400;
+    err.status = 400;
+    throw err;
+  }
+  if (trimmed.length > maxLength) {
+    const err = new Error(`File path exceeds maximum length of ${maxLength} characters`);
+    err.statusCode = 400;
+    err.status = 400;
+    throw err;
+  }
+  if (trimmed.includes('\0')) {
+    const err = new Error('File path cannot contain null bytes');
+    err.statusCode = 400;
+    err.status = 400;
+    throw err;
+  }
+  if (/[\x00-\x1f]/.test(trimmed)) {
+    const err = new Error('File path cannot contain control characters');
+    err.statusCode = 400;
+    err.status = 400;
+    throw err;
+  }
+  return trimmed;
+}

package/lib/routes/profiles.js

@@ -1,4 +1,8 @@
-import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import os from 'node:os';
+import path from 'node:path';
+import { isWithinDir } from '../ssh-config-parser.js';
+import { validateProxyCommandTemplate } from '../proxy-command.js';
+import { writeJson, readBody, authorizeRequest } from './helpers.js';
 import { SshConfigParser } from '../ssh-config-parser.js';
 import { testProfileGroup } from '../profile-groups.js';
 import { filterClusterProfiles, runCluster } from '../cluster-service.js';
@@ -48,6 +52,9 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         if (!profile.id || !profile.host) {
           return writeJson(res, 400, { ok: false, error: 'ID and Host are required' });
         }
+        if (profile.proxyCommand) {
+          validateProxyCommandTemplate(profile.proxyCommand);
+        }
         sshService.invalidate(profile.id);
         await store.saveProfile(profile);
         const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : maskProfile(profile);
@@ -108,7 +115,12 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
           ? body.content
           : SshConfigParser.readDefaultConfig();
         if (!content) return writeJson(res, 400, { ok: false, error: 'SSH config content is required' });
-        const report = SshConfigParser.parseReport(content, { baseDir: body.baseDir });
+        const sshDir = path.join(os.homedir(), '.ssh');
+        const allowedRoot = sshDir;
+        const baseDir = (body.baseDir && isWithinDir(body.baseDir, allowedRoot))
+          ? path.resolve(body.baseDir)
+          : sshDir;
+        const report = SshConfigParser.parseReport(content, { baseDir, allowedRoot });
         for (const p of report.profiles) {
           await store.saveProfile(p);
         }
@@ -218,7 +230,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const remoteOs = result.os !== undefined ? result.os : (result.remoteOs ?? 'Linux/Unix');
         writeJson(res, 200, { ok: true, latency: latencyMs, latencyMs, os: remoteOs, remoteOs });
       } catch (err) {
-        writeJson(res, 200, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 502), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /test');

package/lib/routes/sync.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import { writeJson, readBody, authorizeRequest } from './helpers.js';
 
 export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService, watcherService, store }) {
   // 17. POST /dsh-remote-workspace/sync

package/lib/routes/terminal.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import { writeJson, readBody, authorizeRequest } from './helpers.js';
 import { normalizeTerminalFont } from '../terminal-font.js';
 
 export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {

package/lib/routes/tunnels.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import { writeJson, readBody, authorizeRequest } from './helpers.js';
 
 export function registerTunnelRoutes(sctx, webServer, { tunnelService, store }) {
   // 18. POST /dsh-remote-workspace/tunnels/start

package/lib/ssh-config-parser.js

@@ -1,3 +1,4 @@
+import { validateProxyCommandTemplate } from './proxy-command.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
@@ -7,19 +8,48 @@ function expandHome(value) {
   return value;
 }
 
-function defaultExpandInclude(pattern, baseDir) {
-  const expanded = expandHome(pattern);
-  const full = path.isAbsolute(expanded) ? expanded : path.join(baseDir, expanded);
+
+export function isWithinDir(targetPath, parentDir) {
+  if (!targetPath || !parentDir) return false;
+  const normTarget = path.resolve(targetPath);
+  const normParent = path.resolve(parentDir);
+  const prefix = normParent.endsWith(path.sep) ? normParent : normParent + path.sep;
+  return normTarget === normParent || normTarget.startsWith(prefix);
+}
+
+function defaultExpandInclude(pattern, baseDir, allowedRoot = null) {
+  if (typeof pattern !== 'string' || !pattern.trim() || pattern.includes('\0')) {
+    return [];
+  }
+  const expanded = expandHome(pattern.trim());
+  const full = path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(baseDir, expanded);
+  if (allowedRoot && !isWithinDir(full, allowedRoot)) {
+    return [];
+  }
   if (full.includes('*') || full.includes('?')) {
     return fs.globSync(full, { windowsPathsNoEscape: true })
       .filter((file) => {
-        try { return fs.statSync(file).isFile(); } catch { return false; }
+        try {
+          const absFile = path.resolve(file);
+          if (allowedRoot && !isWithinDir(absFile, allowedRoot)) return false;
+          return fs.statSync(absFile).isFile();
+        } catch {
+          return false;
+        }
       })
       .sort();
   }
-  return fs.existsSync(full) ? [full] : [];
+  try {
+    if (fs.existsSync(full) && fs.statSync(full).isFile()) {
+      return [full];
+    }
+  } catch {
+    return [];
+  }
+  return [];
 }
 
+
 export class SshConfigParser {
   /**
    * @param {string} text
@@ -31,7 +61,8 @@ export class SshConfigParser {
 
   static parseReport(text, options = {}) {
     const baseDir = options.baseDir || path.join(os.homedir(), '.ssh');
-    const expandInclude = options.expandInclude || ((pattern) => defaultExpandInclude(pattern, baseDir));
+    const allowedRoot = options.allowedRoot !== undefined ? options.allowedRoot : (options.expandInclude ? null : baseDir);
+    const expandInclude = options.expandInclude || ((pattern) => defaultExpandInclude(pattern, baseDir, allowedRoot));
     const readFile = options.readFile || ((file) => fs.readFileSync(file, 'utf8'));
     const seen = options.seen || new Set();
     const known = options.knownIds || new Set();
@@ -71,6 +102,10 @@ export class SshConfigParser {
         }
         for (const file of files) {
           const abs = path.resolve(file);
+          if (allowedRoot && !isWithinDir(abs, allowedRoot)) {
+            skipped.push({ name: abs, reason: 'unauthorized-include' });
+            continue;
+          }
           if (seen.has(abs)) {
             skipped.push({ name: abs, reason: 'duplicate' });
             continue;
@@ -83,6 +118,7 @@ export class SshConfigParser {
           }
           const child = this.parseReport(nested, {
             baseDir: path.dirname(abs),
+            allowedRoot,
             expandInclude: options.expandInclude,
             readFile,
             seen,
@@ -137,7 +173,14 @@ export class SshConfigParser {
         current.authType = 'key';
         current.privateKey = val;
       } else if (key === 'proxyjump') current.jumpHostId = val;
-      else if (key === 'proxycommand') current.proxyCommand = val;
+      else if (key === 'proxycommand') {
+        try {
+          validateProxyCommandTemplate(val);
+          current.proxyCommand = val;
+        } catch {
+          skipped.push({ block: current.name || 'unnamed', reason: 'ProxyCommand contains forbidden shell metacharacters' });
+        }
+      }
     }
     pushCurrent();
     return { profiles, skipped };

package/lib/ssh-service.js

@@ -364,6 +364,7 @@ export class SshService {
     let pty = false;
     let timeoutMs = 0;
     let cleanAnsi = false;
+    let maxBufferSize = 10 * 1024 * 1024;
 
     if (typeof optionsOrCwd === 'string') {
       cwd = optionsOrCwd;
@@ -373,6 +374,11 @@ export class SshService {
       pty = Boolean(optionsOrCwd.pty);
       timeoutMs = optionsOrCwd.timeout ? optionsOrCwd.timeout * 1000 : 0;
       cleanAnsi = Boolean(optionsOrCwd.cleanAnsi);
+      if (typeof optionsOrCwd.maxBufferSize === 'number') {
+        maxBufferSize = optionsOrCwd.maxBufferSize;
+      } else if (typeof optionsOrCwd.maxBuffer === 'number') {
+        maxBufferSize = optionsOrCwd.maxBuffer;
+      }
     }
 
     this.bumpInFlight(profile.id, 1);
@@ -405,6 +411,7 @@ export class SshService {
         }
         let stdout = '';
         let stderr = '';
+        let truncated = false;
 
         if (timeoutMs > 0) {
           timer = setTimeout(() => {
@@ -423,13 +430,29 @@ export class SshService {
 
         stream.on('data', (data) => {
           const str = data.toString();
-          stdout += str;
+          if (stdout.length < maxBufferSize) {
+            const remaining = maxBufferSize - stdout.length;
+            stdout += str.length > remaining ? str.slice(0, remaining) : str;
+            if (str.length > remaining) {
+              truncated = true;
+              stdout += '\n[Output truncated: exceeded max buffer size]';
+              try { stream.signal('SIGTERM'); stream.close(); } catch (_err) { /* ignore best-effort process termination */ }
+            }
+          }
           if (onData) onData({ type: 'stdout', data: str });
         });
 
         stream.stderr?.on('data', (data) => {
           const str = data.toString();
-          stderr += str;
+          if (stderr.length < maxBufferSize) {
+            const remaining = maxBufferSize - stderr.length;
+            stderr += str.length > remaining ? str.slice(0, remaining) : str;
+            if (str.length > remaining) {
+              truncated = true;
+              stderr += '\n[Stderr truncated: exceeded max buffer size]';
+              try { stream.signal('SIGTERM'); stream.close(); } catch (_err) { /* ignore best-effort process termination */ }
+            }
+          }
           if (onData) onData({ type: 'stderr', data: str });
         });
 
@@ -440,7 +463,8 @@ export class SshService {
             code: code ?? 0,
             signal,
             stdout: cleanAnsi ? stripAnsi(stdout) : stdout,
-            stderr: cleanAnsi ? stripAnsi(stderr) : stderr
+            stderr: cleanAnsi ? stripAnsi(stderr) : stderr,
+            truncated
           });
         });
       });

package/lib/tar-sync-service.js

@@ -40,7 +40,7 @@ export class TarSyncService {
 
         localTar.on('close', (code) => {
           if (code !== 0) {
-            try { stream.destroy(); } catch (_) {}
+            try { stream.destroy(); } catch (_err) { /* ignore best-effort stream cleanup */ }
             reject(new Error(`Local tar extraction failed (code ${code}): ${stderr}`));
           } else {
             resolve({ ok: true, direction: 'pull', remoteDir, localDir });
@@ -48,17 +48,17 @@ export class TarSyncService {
         });
 
         localTar.on('error', (err) => {
-          try { stream.destroy(); } catch (_) {}
+          try { stream.destroy(); } catch (_err) { /* ignore best-effort stream cleanup */ }
           reject(err);
         });
 
         stream.on('error', (err) => {
-          try { localTar.kill('SIGTERM'); } catch (_) {}
+          try { localTar.kill('SIGTERM'); } catch (_err) { /* ignore best-effort process termination */ }
           reject(err);
         });
 
         localTar.stdin.on('error', (err) => {
-          try { stream.destroy(); } catch (_) {}
+          try { stream.destroy(); } catch (_err) { /* ignore best-effort stream cleanup */ }
           reject(err);
         });
       });
@@ -93,7 +93,7 @@ export class TarSyncService {
 
         stream.on('close', (code) => {
           if (code !== 0) {
-            try { localTar.kill('SIGTERM'); } catch (_) {}
+            try { localTar.kill('SIGTERM'); } catch (_err) { /* ignore best-effort process termination */ }
             reject(new Error(`Remote tar extraction failed (code ${code}): ${remoteStderr}`));
           } else {
             resolve({ ok: true, direction: 'push', localDir, remoteDir });
@@ -101,12 +101,12 @@ export class TarSyncService {
         });
 
         stream.on('error', (err) => {
-          try { localTar.kill('SIGTERM'); } catch (_) {}
+          try { localTar.kill('SIGTERM'); } catch (_err) { /* ignore best-effort process termination */ }
           reject(err);
         });
 
         localTar.on('error', (err) => {
-          try { stream.destroy(); } catch (_) {}
+          try { stream.destroy(); } catch (_err) { /* ignore best-effort stream cleanup */ }
           reject(err);
         });
       });