@jini-ai/platform 0.6.19 → 0.6.23

package/CHANGELOG.md

@@ -1,5 +1,13 @@
+## 0.6.23
+
+- Security hardening.
+
 # @jini-ai/platform
 
+## 0.6.22
+
+- `readReviewedFile` and `reviewedFileIdentity` for file reads tied to a reviewed identity. SigV4 signs mixed-case headers correctly.
+
 ## 0.6.19
 
 - File locks: a dead holder recorded on this machine under another hostname spelling (macOS `name.lan` / `name.local` / `name`) is reclaimed when it was taken in this same kernel boot (its recorded boot id, or for a record without one, an `acquiredAt` after this boot began), so a never-ageing (`staleMs: Infinity`) lock a killed process left no longer wedges every later acquisition. Other hosts, unrecorded boots and live owners are still never evicted. `@jini-ai/platform/fs/file-lock` re-exports `readBootIdentity` and `BootIdentity` for host process ports.

package/dist/aws-sigv4.d.ts

@@ -15,7 +15,7 @@ export interface SignSigV4Input {
     path: string;
     /** Already-stringified canonical query (sorted `key=value` join). Pass `''` when the request has no query. */
     query: string;
-    /** Mutable lower-case header map. The signer adds the four amz headers and the Authorization header. */
+    /** Mutable header map; names are normalized to lower-case before signing. The signer adds the four amz headers and the Authorization header. */
     headers: Record<string, string>;
     /** Raw body bytes; pass an empty Buffer for no-body requests. */
     body: Buffer;

package/dist/aws-sigv4.js

@@ -36,6 +36,10 @@ export function signSigV4(input) {
     const amzDate = formatAmzDate(now);
     const dateStamp = amzDate.slice(0, 8);
     const contentSha256 = sha256Hex(input.body);
+    // Normalise the outgoing map FIRST so each header has exactly one (lower-case) spelling: a caller's
+    // `X-Amz-Date` left beside the generated `x-amz-date` would let a transport send a value other than
+    // the signed one (FU-B, Codex on F1).
+    normaliseHeaders({ headers: input.headers });
     // Add the required amz headers BEFORE composing the canonical request, since they're part of
     // the signed-headers list.
     input.headers['x-amz-date'] = amzDate;
@@ -43,13 +47,14 @@ export function signSigV4(input) {
     if (input.credentials.sessionToken) {
         input.headers['x-amz-security-token'] = input.credentials.sessionToken;
     }
-    // Canonical headers: lower-case keys + trim values; sort by key.
-    const headerKeys = Object.keys(input.headers)
-        .map((k) => k.toLowerCase())
-        .sort();
-    const canonicalHeaders = headerKeys
-        .map((k) => `${k}:${trimValue(input.headers[k] ?? input.headers[k.toLowerCase()] ?? '')}\n`)
-        .join('');
+    // Canonical headers: keys are already lower-case (normaliseHeaders) + trim values; sort by key. The
+    // values signed are exactly the values left in the map: looking them up by a lower-cased key once
+    // signed a mixed-case header as empty (F1).
+    const canonicalEntries = Object.entries(input.headers)
+        // Keys are unique after lower-casing, so code-unit order never ties (same order as the old .sort()).
+        .sort(([a], [b]) => (a < b ? -1 : 1));
+    const headerKeys = canonicalEntries.map(([k]) => k);
+    const canonicalHeaders = canonicalEntries.map(([k, v]) => `${k}:${trimValue(v)}\n`).join('');
     const signedHeaders = headerKeys.join(';');
     const canonicalRequest = [
         input.method.toUpperCase(),
@@ -76,6 +81,21 @@ export function signSigV4(input) {
     input.headers['authorization'] = authorization;
     return { authorization, amzDate, contentSha256 };
 }
+/**
+ * Rewrites `headers` in place so every key is lower-case. Spellings that collide after lower-casing are
+ * merged into one comma-separated value in input order (AWS's canonical form for multi-value headers).
+ */
+function normaliseHeaders({ headers }, _options = {}) {
+    const merged = new Map();
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        const previous = merged.get(lower);
+        merged.set(lower, previous === undefined ? value : `${previous},${value}`);
+        delete headers[key];
+    }
+    for (const [key, value] of merged)
+        headers[key] = value;
+}
 function sha256Hex(body) {
     return createHash('sha256').update(body).digest('hex');
 }

package/dist/fs/directory-user-config.js

@@ -173,7 +173,7 @@ export function createDirectoryUserConfig({ homeDir, defaultFolder, envName, pol
     function databasePath({ dir, id, filename, placement }, _options = {}) {
         assertDatabaseFilename(filename);
         const inSite = path.join(dir, "data.nosync", filename), legacy = path.join(dir, filename);
-        if (!SAFE_SITE_ID.test(id))
+        if (typeof id !== "string" || !SAFE_SITE_ID.test(id))
             return unsafeIdentityPath(legacy, placement);
         const appData = path.join(directories.appData, "databases", id, filename);
         if (placement)

package/dist/fs/index.d.ts

@@ -12,4 +12,5 @@ export * from "./directory-workspace.js";
 export { DirectoryUserConfigRefusal, validateDirectoryUserConfig } from "./directory-user-config.js";
 export * from "./workspace-directory.js";
 export * from "./verified-directory-move.js";
+export * from "./reviewed-file.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/fs/index.js

@@ -13,4 +13,5 @@ export * from "./directory-workspace.js";
 export { DirectoryUserConfigRefusal, validateDirectoryUserConfig } from "./directory-user-config.js";
 export * from "./workspace-directory.js";
 export * from "./verified-directory-move.js";
+export * from "./reviewed-file.js";
 //# sourceMappingURL=index.js.map

package/dist/fs/reviewed-file.d.ts

@@ -0,0 +1,42 @@
+import { type BigIntStats, type Stats } from "node:fs";
+/** Metadata captured when a caller reviews a file, before its later read. */
+export interface ReviewedFile {
+    readonly root: string;
+    readonly absPath: string;
+    readonly bytes: number;
+    readonly mtimeMs: number;
+    readonly identity: string | null;
+    readonly nlink: number;
+}
+/** Metadata and bytes must come from the same open descriptor. */
+export interface ReviewedFileHandle {
+    stat(): Promise<Pick<Stats, "isFile" | "size" | "mtimeMs">>;
+    stat(options: {
+        bigint: true;
+    }): Promise<Pick<BigIntStats, "dev" | "ino">>;
+    readFile(): Promise<Buffer>;
+    close(): Promise<void>;
+}
+type PathEntry = Pick<BigIntStats, "dev" | "ino" | "nlink" | "isSymbolicLink" | "isDirectory">;
+/** Injectable filesystem boundary for deterministic path-swap probes. */
+export interface ReviewedFileSystem {
+    open(file: string, flags: number): Promise<ReviewedFileHandle>;
+    lstat(file: string): Promise<PathEntry>;
+    realpath(file: string): Promise<string>;
+}
+/** Bigint preserves 64-bit file IDs; inode zero means the filesystem supplies no identity. */
+export declare function reviewedFileIdentity({ info }: {
+    info: Pick<BigIntStats, "dev" | "ino">;
+}, _options?: {}): string | null;
+/**
+ * Reads only the reviewed inode, size and mtime through a plain path with no newly added hardlinks.
+ * Returns null for stale paths/open failures; descriptor I/O errors propagate after closing it.
+ * @complexity O(bytes + path depth), one payload read, two fstats, depth lstats and two realpaths.
+ */
+export declare function readReviewedFile({ file }: {
+    file: ReviewedFile;
+}, { fileSystem }?: {
+    fileSystem?: ReviewedFileSystem;
+}): Promise<Buffer | null>;
+export {};
+//# sourceMappingURL=reviewed-file.d.ts.map

package/dist/fs/reviewed-file.js

@@ -0,0 +1,76 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+const FILE_SYSTEM = { open, lstat: file => lstat(file, { bigint: true }), realpath };
+/** Bigint preserves 64-bit file IDs; inode zero means the filesystem supplies no identity. */
+export function reviewedFileIdentity({ info }, _options = {}) {
+    return info.ino === 0n ? null : `${info.dev}:${info.ino}`;
+}
+// NOFOLLOW guards the leaf only. NONBLOCK prevents a swapped FIFO hanging the read; NOCTTY prevents
+// a swapped terminal becoming the server's controlling terminal. Windows lacks these flags.
+const READ_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0) | (constants.O_NOCTTY ?? 0);
+/**
+ * Reads only the reviewed inode, size and mtime through a plain path with no newly added hardlinks.
+ * Returns null for stale paths/open failures; descriptor I/O errors propagate after closing it.
+ * @complexity O(bytes + path depth), one payload read, two fstats, depth lstats and two realpaths.
+ */
+export async function readReviewedFile({ file }, { fileSystem = FILE_SYSTEM } = {}) {
+    let handle;
+    try {
+        handle = await fileSystem.open(file.absPath, READ_FLAGS);
+    }
+    catch {
+        return null;
+    }
+    try {
+        if (!(await openedIsReviewed({ file, handle, fileSystem })))
+            return null;
+        const bytes = await handle.readFile();
+        return bytes.length === file.bytes ? bytes : null;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Identity closes ancestor/root swap-and-swap-back races that path walks alone cannot prove. */
+async function openedIsReviewed({ file, handle, fileSystem }) {
+    const info = await handle.stat();
+    if (!info.isFile() || info.size !== file.bytes || info.mtimeMs !== file.mtimeMs)
+        return false;
+    const opened = reviewedFileIdentity({ info: await handle.stat({ bigint: true }) });
+    if (file.identity !== null && opened !== file.identity)
+        return false;
+    const reached = await walkReviewedPath({ file, fileSystem });
+    // Both null only on inode-zero volumes: the path proof is the remaining protection there.
+    // A plan raced onto an outside inode can reach it through real folders only via an extra hardlink.
+    return reached !== null && reviewedFileIdentity({ info: reached }) === opened && Number(reached.nlink) <= file.nlink;
+}
+/** Proves each descendant is unlinked and the resolved leaf stays under the trusted scope root. */
+async function walkReviewedPath({ file, fileSystem }) {
+    const relative = path.relative(file.root, file.absPath);
+    const names = relative.split(path.sep);
+    if (relative === "" || path.isAbsolute(relative) || names[0] === "..")
+        return null;
+    try {
+        const leaf = await lstatNames({ root: file.root, names, fileSystem });
+        if (leaf === null)
+            return null;
+        return await fileSystem.realpath(file.absPath) === path.join(await fileSystem.realpath(file.root), relative) ? leaf : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** O(path depth) metadata reads, without entering links or non-directory ancestors. */
+async function lstatNames({ root, names, fileSystem }) {
+    let current = root;
+    let leaf = null;
+    for (const [index, name] of names.entries()) {
+        current = path.join(current, name);
+        leaf = await fileSystem.lstat(current);
+        if (leaf.isSymbolicLink() || (index < names.length - 1 && !leaf.isDirectory()))
+            return null;
+    }
+    return leaf;
+}
+//# sourceMappingURL=reviewed-file.js.map

package/dist/web/index.d.ts

@@ -3,4 +3,5 @@
 export * from "./web-page.js";
 export * from "./html-document.js";
 export { htmlToMarkdown } from "./html-to-markdown.js";
+export { stripHtmlPresentation } from "./strip-html-presentation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/web/index.js

@@ -3,4 +3,5 @@
 export * from "./web-page.js";
 export * from "./html-document.js";
 export { htmlToMarkdown } from "./html-to-markdown.js";
+export { stripHtmlPresentation } from "./strip-html-presentation.js";
 //# sourceMappingURL=index.js.map

package/dist/web/strip-html-presentation.d.ts

@@ -0,0 +1,15 @@
+/** Remove presentation using source ranges; untouched bytes (including comments) stay exact.
+ * Scripts, classes and functional attributes are preserved. This is not an HTML sanitizer.
+ * @param required.html - Document or fragment to transform; never mutated.
+ * @param optional.preservedStylesheetHrefs - Exact hrefs retained for host sentinels/vendor CSS.
+ * @returns HTML without style elements/attributes or unretained stylesheet links; no I/O.
+ * @complexity O(n + p + r log r) time and O(n + p + r) space for HTML bytes n,
+ * preserved href bytes p and removal ranges r.
+ * @example stripHtmlPresentation({ html: '<p style="color:red">Hi</p>' })
+ */
+export declare function stripHtmlPresentation({ html }: {
+    html: string;
+}, { preservedStylesheetHrefs }?: {
+    preservedStylesheetHrefs?: readonly string[];
+}): string;
+//# sourceMappingURL=strip-html-presentation.d.ts.map

package/dist/web/strip-html-presentation.js

@@ -0,0 +1,60 @@
+import { parse } from "parse5";
+import { attr } from "./html-document.js";
+/** Select whole elements before attributes; the ordered edit pass skips overlapping ranges. */
+function presentationRange(node, preserved) {
+    const location = node.sourceCodeLocation;
+    if (!location)
+        return undefined;
+    const rel = (attr({ element: node, name: "rel" }) ?? "").toLowerCase().split(/\s+/);
+    const href = attr({ element: node, name: "href" }) ?? "";
+    if (node.tagName === "style")
+        return location;
+    if (node.tagName === "link" && rel.includes("stylesheet") && !preserved.has(href))
+        return location;
+    return location.attrs?.style;
+}
+/** Iterative traversal includes inert template content without recursion or argument spreading. */
+function* walk(root) {
+    const pending = [root];
+    while (pending.length) {
+        const node = pending.pop();
+        yield node;
+        if ("childNodes" in node)
+            for (const child of node.childNodes)
+                pending.push(child);
+        if ("content" in node)
+            pending.push(node.content);
+    }
+}
+/** Remove presentation using source ranges; untouched bytes (including comments) stay exact.
+ * Scripts, classes and functional attributes are preserved. This is not an HTML sanitizer.
+ * @param required.html - Document or fragment to transform; never mutated.
+ * @param optional.preservedStylesheetHrefs - Exact hrefs retained for host sentinels/vendor CSS.
+ * @returns HTML without style elements/attributes or unretained stylesheet links; no I/O.
+ * @complexity O(n + p + r log r) time and O(n + p + r) space for HTML bytes n,
+ * preserved href bytes p and removal ranges r.
+ * @example stripHtmlPresentation({ html: '<p style="color:red">Hi</p>' })
+ */
+export function stripHtmlPresentation({ html }, { preservedStylesheetHrefs = [] } = {}) {
+    const preserved = new Set(preservedStylesheetHrefs);
+    const ranges = [];
+    for (const node of walk(parse(html, { sourceCodeLocationInfo: true, scriptingEnabled: false }))) {
+        if (!("tagName" in node))
+            continue;
+        const range = presentationRange(node, preserved);
+        if (range)
+            ranges.push(range);
+    }
+    ranges.sort((a, b) => a.startOffset - b.startOffset);
+    const parts = [];
+    let end = 0;
+    for (const range of ranges) {
+        if (range.startOffset < end)
+            continue;
+        parts.push(html.slice(end, range.startOffset));
+        end = range.endOffset;
+    }
+    parts.push(html.slice(end));
+    return parts.join("");
+}
+//# sourceMappingURL=strip-html-presentation.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/platform",
-  "version": "0.6.19",
+  "version": "0.6.23",
   "description": "Generic OS/platform primitives: process exec and lifecycle, filesystem containment, HTTP readiness polling, toolchain discovery, blob storage, AWS signing, and an SSRF-safe asset cache.",
   "license": "Apache-2.0",
   "repository": {