@khorsheed/dsh-reader 0.2.1 → 0.3.0

package/lib/index.js

@@ -1169,6 +1169,421 @@ function arxivHtmlUrl(url) {
 	if (link === void 0 || link.kind === "html") return void 0;
 	return `https://arxiv.org/html/${link.id}`;
 }
+/** An honest agent line — bot walls are reported, never impersonated around. */
+const IMAGE_FETCH_USER_AGENT = "dsh-reader image rescue (+https://github.com/Khorsheed/dsh-plugins)";
+/**
+* The raster/vector types a rescued image may declare. The pane re-points the
+* failed `<img>` at these bytes, so an SVG rides an image context (which never
+* scripts); anything else the origin answers — HTML above all — is refused
+* before the body is read.
+*/
+const IMAGE_MIME = /^image\/(?:png|jpe?g|gif|webp|avif|svg\+xml|bmp|x-icon|vnd\.microsoft\.icon)$/i;
+/**
+* The byte budget of the in-memory rescue cache (wire size — base64 is what
+* the map actually holds). A figure-heavy article is a few MB; the budget
+* covers several of them, and the oldest entry leaves first.
+*/
+const IMAGE_CACHE_BUDGET_BYTES = 33554432;
+/**
+* The rescue cache: a pane remount (the sidebar unmounts wholesale when
+* another panel takes over) re-fails every CORP-blocked image, and this map is
+* what keeps that a memory read instead of a dozen outbound requests. LRU by
+* insertion refresh, bounded by bytes.
+*/
+var ImageFetchCache = class {
+	budgetBytes;
+	entries = /* @__PURE__ */ new Map();
+	bytes = 0;
+	constructor(budgetBytes = IMAGE_CACHE_BUDGET_BYTES) {
+		this.budgetBytes = budgetBytes;
+	}
+	/** The cached bytes for one URL, refreshing its recency. */
+	get(url) {
+		const hit = this.entries.get(url);
+		if (hit === void 0) return void 0;
+		this.entries.delete(url);
+		this.entries.set(url, hit);
+		return hit;
+	}
+	/** Cache one fetched image, evicting the oldest entries until it fits. */
+	set(url, mime, base64) {
+		if (base64.length > this.budgetBytes) return;
+		const existing = this.entries.get(url);
+		if (existing !== void 0) {
+			this.bytes -= existing.base64.length;
+			this.entries.delete(url);
+		}
+		while (this.bytes + base64.length > this.budgetBytes) {
+			const oldest = this.entries.keys().next();
+			if (oldest.done) break;
+			const dropped = this.entries.get(oldest.value);
+			this.entries.delete(oldest.value);
+			this.bytes -= dropped?.base64.length ?? 0;
+		}
+		this.entries.set(url, {
+			mime,
+			base64
+		});
+		this.bytes += base64.length;
+	}
+};
+/**
+* Fetch one image, policy-checked end to end.
+*
+* Errors are values: the pane's only answer to a failed rescue is leaving the
+* broken image as it was, so the reason string is for logs, not for display.
+*
+* @param rawUrl - the image URL the pane failed on.
+* @param seams - resolver/lookup overrides (tests only; production pins).
+* @param limits - byte/timeout/redirect overrides (tests only).
+* @returns the image bytes base64-encoded with their declared type, or why not.
+*/
+async function fetchImageBytes(rawUrl, seams = {}, limits = {}) {
+	const maxBytes = limits.maxBytes ?? 8388608;
+	const timeoutMs = limits.timeoutMs ?? 15e3;
+	const maxRedirects = limits.maxRedirects ?? 3;
+	let current = rawUrl;
+	for (let hop = 0; hop <= maxRedirects; hop++) {
+		const gate = await checkImageTarget(current, seams.resolve);
+		if (!gate.ok) return {
+			ok: false,
+			url: rawUrl,
+			error: gate.error
+		};
+		const response = await requestOnce(gate.url, gate.addresses, timeoutMs, seams.lookup);
+		if (!response.ok) return {
+			ok: false,
+			url: rawUrl,
+			error: response.error
+		};
+		const { message } = response;
+		const status = message.statusCode ?? 0;
+		if (status >= 300 && status < 400) {
+			message.resume();
+			const location = message.headers["location"];
+			if (typeof location !== "string" || location.length === 0) return {
+				ok: false,
+				url: rawUrl,
+				error: `HTTP ${status} without a location`
+			};
+			try {
+				current = new URL(location, current).toString();
+			} catch {
+				return {
+					ok: false,
+					url: rawUrl,
+					error: `HTTP ${status} to an unparseable location`
+				};
+			}
+			continue;
+		}
+		if (status < 200 || status >= 300) {
+			message.resume();
+			return {
+				ok: false,
+				url: rawUrl,
+				error: `HTTP ${status}`
+			};
+		}
+		const mime = (message.headers["content-type"] ?? "").replace(/;.*$/s, "").trim().toLowerCase();
+		if (!IMAGE_MIME.test(mime)) {
+			message.resume();
+			return {
+				ok: false,
+				url: rawUrl,
+				error: `the response is not an image (content-type "${mime || "unknown"}")`
+			};
+		}
+		const declared = Number(message.headers["content-length"] ?? NaN);
+		if (Number.isFinite(declared) && declared > maxBytes) {
+			message.resume();
+			return {
+				ok: false,
+				url: rawUrl,
+				error: `the image exceeds the ${Math.floor(maxBytes / 1024 / 1024)} MiB cap`
+			};
+		}
+		const body = await readBody(message, maxBytes);
+		if (!body.ok) return {
+			ok: false,
+			url: rawUrl,
+			error: body.error
+		};
+		return {
+			ok: true,
+			url: rawUrl,
+			mime,
+			base64: body.base64
+		};
+	}
+	return {
+		ok: false,
+		url: rawUrl,
+		error: `more than ${maxRedirects} redirects`
+	};
+}
+/**
+* The syntax gate plus the address gate, in the order capture's navigation
+* policy runs them. The address set travels with the verdict: the transport
+* dials exactly these, so the hostname is never resolved twice.
+*/
+async function checkImageTarget(raw, resolve) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return {
+			ok: false,
+			error: "invalid-url"
+		};
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return {
+		ok: false,
+		error: `only http(s) images can be rescued, not ${url.protocol}`
+	};
+	if (url.username !== "" || url.password !== "") return {
+		ok: false,
+		error: "URLs with embedded credentials are never fetched"
+	};
+	const hostname = url.hostname.replace(/\.$/, "");
+	if (hostname === "") return {
+		ok: false,
+		error: "invalid-url"
+	};
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) return {
+		ok: false,
+		error: "localhost is never fetched"
+	};
+	if (isIpLiteral(hostname)) {
+		const bare = hostname.startsWith("[") ? hostname.slice(1, -1) : hostname;
+		const cls = classifyAddress(bare);
+		if (cls !== "public") return {
+			ok: false,
+			error: `${bare} is a ${cls} address`
+		};
+		return {
+			ok: true,
+			url,
+			addresses: [{
+				address: bare,
+				family: bare.includes(":") ? 6 : 4
+			}]
+		};
+	}
+	const resolver = resolve ?? defaultResolve;
+	let addresses;
+	try {
+		addresses = await resolver(hostname.replace(/^\[(.*)\]$/, "$1"));
+	} catch (error) {
+		return {
+			ok: false,
+			error: `cannot resolve ${hostname}: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	if (addresses.length === 0) return {
+		ok: false,
+		error: `cannot resolve ${hostname}: no addresses`
+	};
+	for (const { address } of addresses) {
+		const cls = classifyAddress(address);
+		if (cls !== "public") return {
+			ok: false,
+			error: `${hostname} resolves to a ${cls} address`
+		};
+	}
+	return {
+		ok: true,
+		url,
+		addresses
+	};
+}
+/**
+* Issue one GET against the validated address set.
+*
+* The `lookup` handed to the transport answers with the validated addresses
+* and nothing else — DNS is consulted once, by the gate, and the connection
+* cannot re-resolve the hostname into a private network (the rebinding window
+* a plain fetch leaves open). Node still verifies TLS against the HOSTNAME;
+* the lookup only maps it to an address.
+*/
+function requestOnce(url, addresses, timeoutMs, lookup) {
+	return new Promise((resolvePromise) => {
+		(async () => {
+			const request = (url.protocol === "https:" ? await import("node:https") : await import("node:http")).request({
+				protocol: url.protocol,
+				hostname: url.hostname.replace(/^\[(.*)\]$/, "$1"),
+				port: url.port,
+				path: `${url.pathname}${url.search}`,
+				method: "GET",
+				headers: {
+					accept: "image/avif,image/webp,image/png,image/svg+xml,image/*,*/*;q=0.8",
+					"accept-encoding": "identity",
+					"user-agent": IMAGE_FETCH_USER_AGENT
+				},
+				lookup: lookup ?? pinnedLookup(addresses)
+			}, (message) => resolvePromise({
+				ok: true,
+				message
+			}));
+			request.setTimeout(timeoutMs, () => {
+				request.destroy(/* @__PURE__ */ new Error(`the image fetch timed out after ${timeoutMs} ms`));
+			});
+			request.on("error", (error) => resolvePromise({
+				ok: false,
+				error: error.message
+			}));
+			request.end();
+		})().catch((error) => resolvePromise({
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		}));
+	});
+}
+/** The lookup that pins a request to the gate's validated answers. */
+function pinnedLookup(addresses) {
+	return (_hostname, options, callback) => {
+		if (options.all === true) {
+			callback(null, addresses.map(({ address, family }) => ({
+				address,
+				family
+			})));
+			return;
+		}
+		const first = addresses[0];
+		callback(null, first.address, first.family);
+	};
+}
+/** The body, capped; over the cap is a refusal, not a truncation. */
+function readBody(message, maxBytes) {
+	return new Promise((resolvePromise) => {
+		const chunks = [];
+		let received = 0;
+		message.on("data", (chunk) => {
+			received += chunk.byteLength;
+			if (received > maxBytes) {
+				message.destroy();
+				resolvePromise({
+					ok: false,
+					error: `the image exceeds the ${Math.floor(maxBytes / 1024 / 1024)} MiB cap`
+				});
+				return;
+			}
+			chunks.push(chunk);
+		});
+		message.on("end", () => resolvePromise({
+			ok: true,
+			base64: Buffer.concat(chunks).toString("base64")
+		}));
+		message.on("error", (error) => resolvePromise({
+			ok: false,
+			error: error.message
+		}));
+	});
+}
+/** The system resolver, bound lazily so importing this module never touches `node:dns`. */
+async function defaultResolve(hostname) {
+	return (await import("node:dns")).promises.lookup(hostname, {
+		all: true,
+		verbatim: true
+	});
+}
+/** Parse a canonical IPv4 string into its 32-bit value, or undefined. */
+function parseIpv4(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return void 0;
+	let value = 0;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part)) return void 0;
+		if (part.length > 1 && part.startsWith("0")) return void 0;
+		const octet = Number(part);
+		if (octet > 255) return void 0;
+		value = value * 256 + octet;
+	}
+	return value >>> 0;
+}
+/** Expand an IPv6 string into its eight 16-bit groups, or undefined when malformed. */
+function parseIpv6Groups(address) {
+	const zoneless = address.split("%")[0];
+	if (!/^[0-9a-fA-F:.]+$/.test(zoneless)) return void 0;
+	const halves = zoneless.split("::");
+	if (halves.length > 2) return void 0;
+	const parseHalf = (half) => {
+		if (half === "") return [];
+		const groups = [];
+		const parts = half.split(":");
+		for (const [index, part] of parts.entries()) {
+			if (part.includes(".")) {
+				if (index !== parts.length - 1) return void 0;
+				const v4 = parseIpv4(part);
+				if (v4 === void 0) return void 0;
+				groups.push(v4 >>> 16 & 65535, v4 & 65535);
+				continue;
+			}
+			if (!/^[0-9a-fA-F]{1,4}$/.test(part)) return void 0;
+			groups.push(parseInt(part, 16));
+		}
+		return groups;
+	};
+	const head = parseHalf(halves[0]);
+	if (head === void 0) return void 0;
+	if (halves.length === 1) return head.length === 8 ? head : void 0;
+	const tail = parseHalf(halves[1]);
+	if (tail === void 0) return void 0;
+	const missing = 8 - head.length - tail.length;
+	if (missing < 0 || missing === 0 && halves[1] !== "") return void 0;
+	return [
+		...head,
+		...Array(missing).fill(0),
+		...tail
+	];
+}
+/** The embedded IPv4 value of an IPv4-mapped, NAT64, or 6to4 IPv6 address. */
+function embeddedIpv4(groups) {
+	if (groups.slice(0, 5).every((g) => g === 0) && groups[5] === 65535) return (groups[6] << 16 | groups[7]) >>> 0;
+	if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return (groups[6] << 16 | groups[7]) >>> 0;
+	if (groups[0] === 8194) return (groups[1] << 16 | groups[2]) >>> 0;
+}
+/** Classify a canonical dotted-quad IPv4 value. */
+function classifyIpv4(value) {
+	const a = value >>> 24 & 255;
+	const b = value >>> 16 & 255;
+	if (a === 0) return "unspecified";
+	if (a === 127) return "loopback";
+	if (a === 10) return "private";
+	if (a === 172 && b >= 16 && b <= 31) return "private";
+	if (a === 192 && b === 168) return "private";
+	if (a === 169 && b === 254) return "link-local";
+	if (a === 100 && b >= 64 && b <= 127) return "private";
+	if (a === 192 && b === 0) return "reserved";
+	if (a === 198 && (b === 18 || b === 19)) return "reserved";
+	if (a === 198 && b === 51) return "reserved";
+	if (a === 203 && b === 0) return "reserved";
+	if (a >= 224 && a <= 239) return "multicast";
+	if (a >= 240) return "reserved";
+	return "public";
+}
+/** Classify one resolved address (IPv4 or IPv6, canonical or transition form). */
+function classifyAddress(address) {
+	const v4 = parseIpv4(address);
+	if (v4 !== void 0) return classifyIpv4(v4);
+	const groups = parseIpv6Groups(address);
+	if (groups === void 0) return "reserved";
+	const embedded = embeddedIpv4(groups);
+	if (embedded !== void 0) return classifyIpv4(embedded);
+	const first = groups[0];
+	if (groups.every((g) => g === 0)) return "unspecified";
+	if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return "loopback";
+	if ((first & 65024) === 64512) return "private";
+	if ((first & 65472) === 65152) return "link-local";
+	if ((first & 65280) === 65280) return "multicast";
+	if (first === 8193 && groups[1] === 3512) return "reserved";
+	return "public";
+}
+/** Whether one hostname string is already an IP literal (bracketed v6 or dotted v4). */
+function isIpLiteral(hostname) {
+	const bare = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+	return parseIpv4(bare) !== void 0 || parseIpv6Groups(bare) !== void 0;
+}
 //#endregion
 //#region lib/types/link-resolvers.js
 /**
@@ -1469,6 +1884,8 @@ var ReaderService = class {
 	disposed = false;
 	/** The document of record when no filesystem is mounted. */
 	memoryDoc;
+	/** Rescued images, by URL — a pane remount re-fails every blocked image, and this is what keeps that a memory read. */
+	imageCache = new ImageFetchCache();
 	/**
 	* @param ctx - owning context.
 	* @param config - optional state-root override.
@@ -1930,6 +2347,54 @@ var ReaderService = class {
 		}
 	}
 	/**
+	* One image the browser could not load cross-origin, fetched host-side.
+	*
+	* The pane calls this only for an `<img>` that already FAILED: the page's
+	* bytes arrived fine (a direct fetch gets a 200) but the origin answers them
+	* with `Cross-Origin-Resource-Policy: same-origin`, so the browser withholds
+	* them from this page no matter what the tag asks — measured on claude.dev's
+	* `/media/*` figures (2026-09-29), which broke with the alt text showing.
+	* CORP is an embedder-side check, so a host-process fetch is the way through.
+	*
+	* This deliberately does NOT ride `ctx.web.fetch`: the seam's decoded body is
+	* a closed html|text union and its provider refuses binary content types
+	* outright. The image fetch re-implements the seam's hardening at image
+	* scope instead (public-address validation with the connection pinned to the
+	* validated answers, a byte cap, a timeout, per-hop re-validation, and an
+	* image/* content-type gate) — see `image-fetch.ts`.
+	*
+	* Rescued bytes are kept in an in-memory LRU under a byte budget: the
+	* sidebar unmounts wholesale when another panel takes over, and a remount
+	* re-fails every blocked image before this cache can answer it.
+	*
+	* @param request - the image URL the pane failed on.
+	* @returns the bytes and their declared type, or why there are none.
+	*/
+	async fetchImage(request) {
+		const url = normalizeUrl(request.url);
+		if (url === void 0) return {
+			url: request.url,
+			error: "invalid-url"
+		};
+		const cached = this.imageCache.get(url);
+		if (cached !== void 0) return {
+			url,
+			mime: cached.mime,
+			base64: cached.base64
+		};
+		const fetched = await fetchImageBytes(url);
+		if (!fetched.ok) return {
+			url,
+			error: fetched.error
+		};
+		this.imageCache.set(url, fetched.mime, fetched.base64);
+		return {
+			url,
+			mime: fetched.mime,
+			base64: fetched.base64
+		};
+	}
+	/**
 	* Which entries have a body, a stored raw payload, or a recorded failure.
 	*
 	* The wall needs this per ENTRY (entries come from the browser's parse of a
@@ -3098,6 +3563,7 @@ let ReaderRemoteService = (() => {
 	let _getBodies_decorators;
 	let _getEntryBody_decorators;
 	let _fetchEntryBody_decorators;
+	let _fetchImage_decorators;
 	let _storeEntryBody_decorators;
 	let _entryFetchStates_decorators;
 	let _getRawBody_decorators;
@@ -3132,6 +3598,7 @@ let ReaderRemoteService = (() => {
 			_getBodies_decorators = [Remote("getBodies")];
 			_getEntryBody_decorators = [Remote("getEntryBody")];
 			_fetchEntryBody_decorators = [Remote("fetchEntryBody")];
+			_fetchImage_decorators = [Remote("fetchImage")];
 			_storeEntryBody_decorators = [Remote("storeEntryBody")];
 			_entryFetchStates_decorators = [Remote("entryFetchStates")];
 			_getRawBody_decorators = [Remote("getRawBody")];
@@ -3253,6 +3720,17 @@ let ReaderRemoteService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _fetchImage_decorators, {
+				kind: "method",
+				name: "fetchImage",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "fetchImage" in obj,
+					get: (obj) => obj.fetchImage
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _storeEntryBody_decorators, {
 				kind: "method",
 				name: "storeEntryBody",
@@ -3547,6 +4025,14 @@ let ReaderRemoteService = (() => {
 		fetchEntryBody(request) {
 			return this.core.fetchEntryBody(request);
 		}
+		/**
+		* Fetch one image the browser could not load cross-origin (CORP /
+		* hotlink-protected), so the pane can re-point the failed `<img>` at the
+		* bytes. Called per failed image, never for a healthy one.
+		*/
+		fetchImage(request) {
+			return this.core.fetchImage(request);
+		}
 		/** Cache the markup the browser extracted for one entry. */
 		storeEntryBody(request) {
 			return this.core.storeEntryBody(request);