@indigoai-us/hq-cloud 6.14.7 → 6.14.9

package/src/object-io.test.ts

@@ -9,12 +9,17 @@
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import * as http from "node:http";
+import { once } from "node:events";
+import { spawn } from "node:child_process";
 import {
   PresignObjectIO,
   S3SdkObjectIO,
   setObjectIOFactory,
+  setPresignedGetTransportForTesting,
   resolveObjectIO,
   presignObjectIOFactory,
+  type PresignedGetTransport,
   type PresignTransportClient,
 } from "./object-io.js";
 import type { EntityContext } from "./types.js";
@@ -23,6 +28,55 @@ import { isAccessDenied } from "./sync-core.js";
 
 const COMPANY = "cmp_test";
 
+function fetchBackedPresignedGetTransport(): PresignedGetTransport {
+  return {
+    async get(url, headers) {
+      const response = await fetch(url, { method: "GET", headers });
+      const body = response.body;
+      return {
+        status: response.status,
+        headers: response.headers,
+        body: body
+          ? (async function* (): AsyncIterable<Uint8Array> {
+              const reader = body.getReader();
+              let exhausted = false;
+              try {
+                while (true) {
+                  const { done, value } = await reader.read();
+                  if (done) {
+                    exhausted = true;
+                    return;
+                  }
+                  if (value.byteLength > 0) yield value;
+                }
+              } finally {
+                if (!exhausted) {
+                  try {
+                    await reader.cancel();
+                  } catch {
+                    // The response may already have been cancelled by destroy.
+                  }
+                }
+                reader.releaseLock();
+              }
+            })()
+          : undefined,
+        destroy: () => {
+          void body?.cancel().catch(() => undefined);
+        },
+      };
+    },
+  };
+}
+
+beforeEach(() => {
+  setPresignedGetTransportForTesting(fetchBackedPresignedGetTransport());
+});
+
+afterEach(() => {
+  setPresignedGetTransportForTesting(null);
+});
+
 function ctx(): EntityContext {
   return {
     uid: COMPANY,
@@ -506,6 +560,27 @@ describe("PresignObjectIO.getObject", () => {
     });
   });
 
+  it("drains the injected transport body instead of returning empty content", async () => {
+    const { vault, setPresign } = makeVault();
+    setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
+    const transportGet = vi.fn(async () => ({
+      status: 200,
+      headers: new Headers({ "x-amz-meta-source": "transport" }),
+      body: (async function* (): AsyncIterable<Uint8Array> {
+        yield Buffer.from("transport-bytes");
+      })(),
+      destroy: () => undefined,
+    }));
+    setPresignedGetTransportForTesting({ get: transportGet });
+
+    const io = new PresignObjectIO(vault, COMPANY);
+    const res = await io.getObject("shared/a.md");
+
+    expect(res.body.toString("utf-8")).toBe("transport-bytes");
+    expect(res.metadata).toEqual({ source: "transport" });
+    expect(transportGet).toHaveBeenCalledWith("https://s3/get", undefined);
+  });
+
   it("throws a NotFound-named error on 404 (so s3.ts catch sites match)", async () => {
     const { vault, setPresign } = makeVault();
     setPresign([{ key: "gone", op: "get", url: "https://s3/get" }]);
@@ -1044,3 +1119,103 @@ describe("presignObjectIOFactory — personal vaults route to S3 SDK", () => {
     expect(personal).toBeInstanceOf(S3SdkObjectIO);
   });
 });
+
+describe("PresignObjectIO — core HTTP presigned GET", () => {
+  function streamingVault(baseUrl: string): PresignTransportClient {
+    return {
+      presign: async (input) => ({
+        results: input.keys.map((key) => ({
+          key: key.key,
+          op: "get" as const,
+          url: `${baseUrl}/${key.key}`,
+        })),
+        expiresAt: "2099-01-01T00:00:00.000Z",
+      }),
+      listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
+    };
+  }
+
+  it("destroys an early-exit response and rejects a FIN-short body", async () => {
+    setPresignedGetTransportForTesting(null);
+    let responseClosed: Promise<unknown> | undefined;
+    const server = http.createServer((req, res) => {
+      if (req.url === "/short") {
+        res.writeHead(200, { "content-length": "10" });
+        res.end("short");
+        return;
+      }
+
+      res.writeHead(200, { "content-length": "131072" });
+      res.write(Buffer.alloc(65_536, 1));
+      responseClosed = once(res, "close");
+      const finish = setTimeout(() => res.end(Buffer.alloc(65_536, 2)), 1_000);
+      res.once("close", () => clearTimeout(finish));
+    });
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      throw new Error("test server did not bind a TCP port");
+    }
+
+    try {
+      const io = new PresignObjectIO(
+        streamingVault(`http://127.0.0.1:${address.port}`),
+        COMPANY,
+      );
+      const streamed = await io.getObjectStream("large");
+      const iterator = streamed.body[Symbol.asyncIterator]();
+      expect((await iterator.next()).value).toBeInstanceOf(Uint8Array);
+      await iterator.return?.();
+      if (!responseClosed) throw new Error("response did not start streaming");
+      await expect(responseClosed).resolves.toBeDefined();
+
+      await expect(io.getObject("short")).rejects.toThrow(
+        /content-length mismatch/,
+      );
+    } finally {
+      server.close();
+      await once(server, "close");
+    }
+  });
+
+  it.runIf(
+    process.platform === "win32" && /^(22|24)\./.test(process.versions.node),
+  )("keeps a child FIN safe after the consumer has applied backpressure", async () => {
+    setPresignedGetTransportForTesting(null);
+    const child = spawn(process.execPath, [
+      "-e",
+      [
+        "const http = require('node:http');",
+        "const body = Buffer.alloc(524288, 7);",
+        "const server = http.createServer((_req, res) => {",
+        "  res.writeHead(200, { 'content-length': String(body.length) });",
+        "  for (let offset = 0; offset < body.length; offset += 16384) res.write(body.subarray(offset, offset + 16384));",
+        "  res.end();",
+        "});",
+        "server.listen(0, '127.0.0.1', () => process.stdout.write(String(server.address().port) + '\\n'));",
+        "process.on('SIGTERM', () => server.close(() => process.exit(0)));",
+      ].join("\n"),
+    ], { stdio: ["ignore", "pipe", "inherit"] });
+
+    const port = await new Promise<number>((resolve, reject) => {
+      child.once("error", reject);
+      child.stdout?.once("data", (data: Buffer) => resolve(Number(data.toString())));
+      child.once("exit", (code) => reject(new Error(`child server exited (${code})`)));
+    });
+
+    try {
+      const io = new PresignObjectIO(
+        streamingVault(`http://127.0.0.1:${port}`),
+        COMPANY,
+      );
+      const streamed = await io.getObjectStream("bulk");
+      await new Promise((resolve) => setTimeout(resolve, 40));
+      let bytes = 0;
+      for await (const chunk of streamed.body) bytes += chunk.byteLength;
+      expect(bytes).toBe(524_288);
+    } finally {
+      child.kill("SIGTERM");
+    }
+  });
+});

package/src/object-io.ts

@@ -13,8 +13,8 @@
  *   - `PresignObjectIO` — the presigned-URL path. The vault-service decides
  *     access as a runtime DDB check (no IAM policy ceiling) and hands back
  *     short-lived presigned GET/PUT/DELETE URLs + (for PUT) the exact headers
- *     to replay. The client never holds AWS credentials — it just `fetch`es
- *     the signed URLs.
+ *     to replay. The client never holds AWS credentials — it requests the
+ *     signed URLs directly.
  *
  * The seam is a per-EntityContext factory resolved INSIDE s3.ts, so every
  * existing call site (`uploadFile(ctx, …)`, `downloadFile(ctx, …)`, …) keeps
@@ -31,6 +31,9 @@ import {
   DeleteObjectCommand,
   HeadObjectCommand,
 } from "@aws-sdk/client-s3";
+import * as http from "node:http";
+import * as https from "node:https";
+import type { IncomingMessage } from "node:http";
 import type { EntityContext } from "./types.js";
 import type {
   PresignOp,
@@ -344,6 +347,141 @@ function metaFromHeaders(headers: Headers): Record<string, string> {
   return meta;
 }
 
+/**
+ * Response shape shared by every presigned GET consumer. Unlike the runtime
+ * `fetch` response, its body is backed by Node's core HTTP client, so it never
+ * enters the runtime-bundled undici parser path.
+ */
+export interface PresignedGetResponse {
+  status: number;
+  headers: Headers;
+  body?: AsyncIterable<Uint8Array>;
+  destroy(): void;
+}
+
+/** Transport seam retained for deterministic wire-level regression tests. */
+export interface PresignedGetTransport {
+  get(
+    url: string,
+    headers: Record<string, string> | undefined,
+  ): Promise<PresignedGetResponse>;
+}
+
+function headersFromNode(
+  headers: IncomingMessage["headers"],
+): Headers {
+  const out = new Headers();
+  for (const [name, value] of Object.entries(headers)) {
+    if (value === undefined) continue;
+    out.set(name, Array.isArray(value) ? value.join(", ") : value);
+  }
+  return out;
+}
+
+function expectedContentLength(headers: Headers): number | undefined {
+  const value = headers.get("content-length");
+  if (value === null) return undefined;
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`invalid presigned GET content-length: ${value}`);
+  }
+  const length = Number(value);
+  if (!Number.isSafeInteger(length)) {
+    throw new Error(`invalid presigned GET content-length: ${value}`);
+  }
+  return length;
+}
+
+function contentLengthError(expected: number, actual: number): Error {
+  return new Error(
+    `presigned GET content-length mismatch: expected ${expected} bytes, received ${actual}`,
+  );
+}
+
+async function* checkedNodeBody(
+  message: IncomingMessage,
+  expected: number | undefined,
+): AsyncIterable<Uint8Array> {
+  let received = 0;
+  let exhausted = false;
+  try {
+    try {
+      for await (const chunk of message) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        received += bytes.byteLength;
+        if (expected !== undefined && received > expected) {
+          throw contentLengthError(expected, received);
+        }
+        yield bytes;
+      }
+    } catch (err) {
+      // A FIN before Node has received the declared bytes normally surfaces as
+      // an "aborted" stream error. Preserve the useful data-integrity cause.
+      if (expected !== undefined && received !== expected) {
+        throw contentLengthError(expected, received);
+      }
+      throw err;
+    }
+    exhausted = true;
+    if (expected !== undefined && received !== expected) {
+      throw contentLengthError(expected, received);
+    }
+  } finally {
+    // Consumers such as HEAD only inspect headers, and a caller can stop after
+    // a prefix. Destroying in both cases releases the socket immediately.
+    if (!exhausted) message.destroy();
+  }
+}
+
+function nodePresignedGet(
+  url: string,
+  headers: Record<string, string> | undefined,
+): Promise<PresignedGetResponse> {
+  const target = new URL(url);
+  return new Promise((resolve, reject) => {
+    const handleResponse = (message: IncomingMessage): void => {
+      const responseHeaders = headersFromNode(message.headers);
+      let expected: number | undefined;
+      try {
+        expected = expectedContentLength(responseHeaders);
+      } catch (err) {
+        message.destroy();
+        reject(err);
+        return;
+      }
+      resolve({
+        status: message.statusCode ?? 0,
+        headers: responseHeaders,
+        body: checkedNodeBody(message, expected),
+        destroy: () => message.destroy(),
+      });
+    };
+    const request = target.protocol === "https:"
+      ? https.request(target, { method: "GET", headers }, handleResponse)
+      : target.protocol === "http:"
+        ? http.request(target, { method: "GET", headers }, handleResponse)
+        : undefined;
+    if (!request) {
+      reject(new Error(`unsupported presigned GET protocol: ${target.protocol}`));
+      return;
+    }
+    request.once("error", reject);
+    request.end();
+  });
+}
+
+const NODE_PRESIGNED_GET_TRANSPORT: PresignedGetTransport = {
+  get: nodePresignedGet,
+};
+
+let presignedGetTransport: PresignedGetTransport = NODE_PRESIGNED_GET_TRANSPORT;
+
+/** Test-only override; production always uses Node's core HTTP(S) transport. */
+export function setPresignedGetTransportForTesting(
+  transport: PresignedGetTransport | null,
+): void {
+  presignedGetTransport = transport ?? NODE_PRESIGNED_GET_TRANSPORT;
+}
+
 /**
  * Per-key presign denial codes that are EXPECTED and must be reclassified as
  * skip-with-log — throwing the `name: "Forbidden"` shape (see
@@ -825,20 +963,21 @@ export class PresignObjectIO implements ObjectIO {
 
   async getObjectStream(key: string): Promise<GetObjectStreamResult> {
     const row = await this.resolveGetUrlForBody(key);
-    const res = await fetchWithRetry(row.url, { method: "GET" }, `presigned GET ${key}`);
+    const res = await presignedGetWithRetry(
+      row.url,
+      row.headers,
+      `presigned GET ${key}`,
+    );
     if (res.status === 404) {
-      await cancelBody(res);
+      res.destroy();
       throw notFoundError(key);
     }
-    if (!res.ok) {
-      const detail = await safeText(res);
+    if (res.status < 200 || res.status >= 300) {
+      const detail = await safePresignedGetText(res);
       throw new Error(`presigned GET failed for ${key}: ${res.status} ${detail}`);
     }
-    if (!res.body) {
-      return { body: (async function* () {})(), metadata: metaFromHeaders(res.headers) };
-    }
     return {
-      body: webReadableToAsyncIterable(res.body),
+      body: res.body ?? (async function* () {})(),
       metadata: metaFromHeaders(res.headers),
     };
   }
@@ -933,9 +1072,13 @@ export class PresignObjectIO implements ObjectIO {
       }
       url = row.url;
     }
-    const res = await fetchWithRetry(url, { method: "GET" }, `presigned HEAD ${key}`);
+    const res = await presignedGetWithRetry(
+      url,
+      undefined,
+      `presigned HEAD ${key}`,
+    );
     if (res.status === 404) {
-      await cancelBody(res);
+      res.destroy();
       return null;
     }
     if (res.status === 403) {
@@ -944,12 +1087,11 @@ export class PresignObjectIO implements ObjectIO {
       // denial branch above. The SDK transport throws name:"Forbidden" here;
       // mirror it so both transports agree and no caller mistakes a denial
       // for a missing object.
-      await cancelBody(res);
+      res.destroy();
       throw accessDeniedError(key, "presigned HEAD returned 403");
     }
-    if (!res.ok) {
-      await cancelBody(res);
-      const detail = await safeText(res);
+    if (res.status < 200 || res.status >= 300) {
+      const detail = await safePresignedGetText(res);
       throw new Error(`presigned HEAD failed for ${key}: ${res.status} ${detail}`);
     }
     const result: HeadObjectResult = {
@@ -958,7 +1100,7 @@ export class PresignObjectIO implements ObjectIO {
       size: Number(res.headers.get("content-length") ?? "0"),
       metadata: metaFromHeaders(res.headers),
     };
-    await cancelBody(res);
+    res.destroy();
     return result;
   }
 }
@@ -979,21 +1121,6 @@ async function cancelBody(res: Response): Promise<void> {
   }
 }
 
-async function* webReadableToAsyncIterable(
-  stream: ReadableStream<Uint8Array>,
-): AsyncIterable<Uint8Array> {
-  const reader = stream.getReader();
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) return;
-      if (value && value.byteLength > 0) yield value;
-    }
-  } finally {
-    reader.releaseLock();
-  }
-}
-
 function parseLastModified(value: string | null): Date {
   if (!value) return new Date();
   const d = new Date(value);
@@ -1023,6 +1150,60 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * Shared presigned-GET path for streaming reads and header-only probes.
+ *
+ * GET deliberately uses Node core HTTP(S), not global fetch: on affected
+ * Node/Windows builds the bundled undici parser can assert after a FIN arrives
+ * while the consumer is backpressured. Keep the retry budget identical to the
+ * PUT/DELETE fetch path below.
+ */
+async function presignedGetWithRetry(
+  url: string,
+  headers: Record<string, string> | undefined,
+  what: string,
+): Promise<PresignedGetResponse> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt <= FETCH_MAX_RETRIES; attempt++) {
+    if (attempt > 0) {
+      const backoff = FETCH_BASE_DELAY_MS * 2 ** (attempt - 1);
+      const jitter = Math.floor(Math.random() * FETCH_BASE_DELAY_MS);
+      await sleep(backoff + jitter);
+    }
+    let res: PresignedGetResponse;
+    try {
+      res = await presignedGetTransport.get(url, headers);
+    } catch (err) {
+      lastError = err;
+      continue;
+    }
+    if (isTransientStatus(res.status) && attempt < FETCH_MAX_RETRIES) {
+      res.destroy();
+      lastError = new Error(`${what}: transient ${res.status}`);
+      continue;
+    }
+    return res;
+  }
+  throw lastError instanceof Error
+    ? lastError
+    : new Error(`${what}: failed after ${FETCH_MAX_RETRIES} retries`);
+}
+
+async function safePresignedGetText(res: PresignedGetResponse): Promise<string> {
+  try {
+    let text = "";
+    for await (const chunk of res.body ?? []) {
+      text += Buffer.from(chunk).toString("utf-8");
+      if (text.length >= 200) break;
+    }
+    return text.slice(0, 200);
+  } catch {
+    return "";
+  } finally {
+    res.destroy();
+  }
+}
+
 /**
  * `fetch` with bounded retry on network errors + transient 5xx. The presigned
  * URL is reusable until expiry and the bodies are in-memory Buffers, so a

package/src/s3.test.ts

@@ -93,6 +93,7 @@ import {
   decodeSymlinkMetadataValue,
   FILE_MTIME_META_KEY,
   FILE_BTIME_META_KEY,
+  classifyVaultKey,
   validateVaultUploadKey,
 } from "./s3.js";
 import {
@@ -1450,6 +1451,23 @@ describe("validateVaultUploadKey — direct-S3 key poisoning guard (incident 202
     },
   );
 
+  it.each([
+    [
+      "companies/indigo/knowledge/x.md",
+      "company",
+      "INVALID_KEY_COMPANIES_SCOPED",
+    ],
+    ["bad\x00key.md", "personal", "INVALID_KEY_CONTROL_CHARS"],
+    ["docs/good.md", "personal", null],
+  ] as const)(
+    "classifyVaultKey reports the validator outcome without throwing: %j",
+    (key, scope, code) => {
+      expect(classifyVaultKey(key, scope)).toEqual(
+        code === null ? null : expect.objectContaining({ code }),
+      );
+    },
+  );
+
   it("uploadFile refuses to PUT a companies/-prefixed key into a company (cmp_) vault — no S3 command is sent", async () => {
     await expect(
       uploadFile(makeCtx(), tmpFile, "companies/indigo/knowledge/x.md"),

package/src/s3.ts

@@ -561,67 +561,101 @@ export function toPosixKey(key: string): string {
  * (`cmp_*` → "company", otherwise "personal").
  *
  * Errors carry the same `code` values the server throws so telemetry and
- * operator messaging line up across client and server.
+ * operator messaging line up across client and server. Pull planning also
+ * uses the non-throwing classifier below to keep poison keys away from the
+ * presign transport.
  */
 // Matching control chars is the whole point — block NUL/0x00–0x1F/0x7F in keys
 // (they can smuggle past path checks or corrupt HTTP headers on the signed URL).
 // eslint-disable-next-line no-control-regex
 const KEY_CONTROL_CHARS = /[\x00-\x1F\x7F]/;
 
-export function validateVaultUploadKey(
+export type VaultKeyScope = "company" | "personal";
+
+export interface VaultKeyValidationIssue {
+  code: string;
+  message: string;
+}
+
+/**
+ * Classify a vault key with the same rules as {@link validateVaultUploadKey}
+ * without throwing. Callers that enumerate remote objects can use this before
+ * presigning so permanently-invalid legacy keys remain benign skips.
+ */
+export function classifyVaultKey(
   key: string,
-  scope: "company" | "personal",
-): void {
-  const fail = (message: string, code: string): never => {
-    throw Object.assign(new Error(message), { code });
-  };
+  scope: VaultKeyScope,
+): VaultKeyValidationIssue | null {
   if (key.length === 0) {
-    fail("Invalid key: must not be empty", "INVALID_KEY_EMPTY");
+    return {
+      code: "INVALID_KEY_EMPTY",
+      message: "Invalid key: must not be empty",
+    };
   }
   if (key.startsWith("/")) {
-    fail("Invalid key: leading '/' not allowed", "INVALID_KEY_LEADING_SLASH");
+    return {
+      code: "INVALID_KEY_LEADING_SLASH",
+      message: "Invalid key: leading '/' not allowed",
+    };
   }
   if (key.endsWith("/")) {
-    fail(
-      "Invalid key: trailing '/' (folder marker, not an object)",
-      "INVALID_KEY_TRAILING_SLASH",
-    );
+    return {
+      code: "INVALID_KEY_TRAILING_SLASH",
+      message: "Invalid key: trailing '/' (folder marker, not an object)",
+    };
   }
   if (scope === "company" && key.startsWith("companies/")) {
-    fail(
-      "Invalid key: vault keys are bucket-relative and the vault is already " +
+    return {
+      code: "INVALID_KEY_COMPANIES_SCOPED",
+      message:
+        "Invalid key: vault keys are bucket-relative and the vault is already " +
         "company-scoped — do not prefix with 'companies/<slug>/'. This " +
         "usually means a stale doubled local tree " +
         "(companies/<slug>/companies/<slug>/…); remove the inner copy.",
-      "INVALID_KEY_COMPANIES_SCOPED",
-    );
+    };
   }
   if (KEY_CONTROL_CHARS.test(key)) {
-    fail("Invalid key: contains control characters", "INVALID_KEY_CONTROL_CHARS");
+    return {
+      code: "INVALID_KEY_CONTROL_CHARS",
+      message: "Invalid key: contains control characters",
+    };
   }
   if (key.includes("\\")) {
-    // Unreachable after toPosixKey normalization at the upload boundary, but
-    // kept so the validator mirrors the server rule set 1:1 for other callers.
-    fail(
-      "Invalid key: backslash separators are not allowed — vault keys are POSIX ('/')",
-      "INVALID_KEY_BACKSLASH",
-    );
+    return {
+      code: "INVALID_KEY_BACKSLASH",
+      message:
+        "Invalid key: backslash separators are not allowed — vault keys are POSIX ('/')",
+    };
   }
   if (key.includes("//")) {
-    fail("Invalid key: consecutive slashes not allowed", "INVALID_KEY_DOUBLE_SLASH");
+    return {
+      code: "INVALID_KEY_DOUBLE_SLASH",
+      message: "Invalid key: consecutive slashes not allowed",
+    };
   }
   for (const segment of key.split("/")) {
     if (segment === "." || segment === "..") {
-      fail(
-        "Invalid key: '.' and '..' path components are not allowed",
-        "INVALID_KEY_DOT_COMPONENT",
-      );
+      return {
+        code: "INVALID_KEY_DOT_COMPONENT",
+        message: "Invalid key: '.' and '..' path components are not allowed",
+      };
     }
   }
+  return null;
+}
+
+export function validateVaultUploadKey(
+  key: string,
+  scope: VaultKeyScope,
+): void {
+  const issue = classifyVaultKey(key, scope);
+  if (issue !== null) {
+    throw Object.assign(new Error(issue.message), { code: issue.code });
+  }
 }
 
 /** Scope for {@link validateVaultUploadKey}, derived from the entity uid. */
-function uploadScopeFor(ctx: EntityContext): "company" | "personal" {
+function uploadScopeFor(ctx: EntityContext): VaultKeyScope {
   return ctx.uid.startsWith("cmp_") ? "company" : "personal";
 }