@mikrojs/native 0.18.0 → 0.18.1

package/src/mik_ota_policy.cpp

@@ -0,0 +1,419 @@
+#include "mikrojs/ota_policy.h"
+
+#include <cstdio>
+#include <cstring>
+#include <memory>
+#include <string>
+
+#include "mikrojs/platform.h"
+
+namespace mikrojs {
+
+/* Staging attempts for one url before a checksum is abandoned. */
+constexpr int32_t MIK__OTA_MAX_TRIES = 3;
+
+const char* mik__ota_outcome_to_str(MIKOtaApplyOutcome outcome) {
+    switch (outcome) {
+        case MIKOtaApplyOutcome::kStaged:
+            return "staged";
+        case MIKOtaApplyOutcome::kTrialPending:
+            return "trial-pending";
+        case MIKOtaApplyOutcome::kCurrent:
+            return "current";
+        case MIKOtaApplyOutcome::kAbandoned:
+            return "abandoned";
+        case MIKOtaApplyOutcome::kExhausted:
+            return "exhausted";
+    }
+    return "unknown";
+}
+
+// ── MIKOtaStore ──────────────────────────────────────────────────────────────
+
+namespace {
+
+/* FNV-1a, rendered as hex. Identity for a cache key, not a security property:
+ * the worst a collision does is deny one build a fresh retry budget. */
+std::string url_digest(const std::string& url) {
+    uint64_t hash = 1469598103934665603ull;
+    for (unsigned char c : url) {
+        hash ^= c;
+        hash *= 1099511628211ull;
+    }
+    char out[17];
+    snprintf(out, sizeof(out), "%016llx", static_cast<unsigned long long>(hash));
+    return out;
+}
+
+}  // namespace
+
+bool MIKOtaStore::UrlMatches(const std::string& url) const {
+    if (!env_ || !env_->kv_get_str) return false;
+    char buf[17] = {};
+    if (!env_->kv_get_str(env_->opaque, "ota.url", buf, sizeof(buf))) return false;
+    return url_digest(url) == buf;
+}
+
+void MIKOtaStore::SetUrl(const std::string& url) {
+    if (!env_ || !env_->kv_set_str) return;
+    env_->kv_set_str(env_->opaque, "ota.url", url_digest(url).c_str());
+}
+
+std::string MIKOtaStore::GetAttempt() const {
+    if (!env_ || !env_->kv_get_str) return "";
+    char buf[128] = {};
+    if (env_->kv_get_str(env_->opaque, "ota.att", buf, sizeof(buf))) {
+        return buf;
+    }
+    return "";
+}
+
+void MIKOtaStore::SetAttempt(const std::string& checksum) {
+    if (!env_ || !env_->kv_set_str) return;
+    env_->kv_set_str(env_->opaque, "ota.att", checksum.c_str());
+}
+
+int32_t MIKOtaStore::GetTries() const {
+    if (!env_ || !env_->kv_get_i32) return 0;
+    int32_t val = 0;
+    if (env_->kv_get_i32(env_->opaque, "ota.tries", &val)) {
+        return val;
+    }
+    return 0;
+}
+
+void MIKOtaStore::SetTries(int32_t n) {
+    if (!env_ || !env_->kv_set_i32) return;
+    env_->kv_set_i32(env_->opaque, "ota.tries", n);
+}
+
+std::string MIKOtaStore::GetBad() const {
+    if (!env_ || !env_->kv_get_str) return "";
+    char buf[128] = {};
+    if (env_->kv_get_str(env_->opaque, "ota.bad", buf, sizeof(buf))) {
+        return buf;
+    }
+    return "";
+}
+
+void MIKOtaStore::SetBad(const std::string& checksum) {
+    if (!env_ || !env_->kv_set_str) return;
+    env_->kv_set_str(env_->opaque, "ota.bad", checksum.c_str());
+}
+
+bool MIKOtaStore::GetInFlight() const {
+    if (!env_ || !env_->kv_get_i32) return false;
+    int32_t val = 0;
+    if (env_->kv_get_i32(env_->opaque, "ota.inflight", &val)) {
+        return val == 1;
+    }
+    return false;
+}
+
+void MIKOtaStore::SetInFlight(bool in_flight) {
+    if (!env_ || !env_->kv_set_i32) return;
+    env_->kv_set_i32(env_->opaque, "ota.inflight", in_flight ? 1 : 0);
+}
+
+// ── Offer parsing ────────────────────────────────────────────────────────────
+
+bool mik__ota_parse_offer(const char* url, const char* checksum, int64_t size, bool allow_insecure,
+                         MIKOtaOffer* out_offer, std::string* out_warn_reason) {
+    if (!url) return false;
+
+    std::string s_url = url;
+    bool is_https = s_url.rfind("https://", 0) == 0;
+    bool is_http = s_url.rfind("http://", 0) == 0;
+    bool scheme_ok = is_https || (allow_insecure && is_http);
+
+    size_t query_pos = s_url.find_first_of("?#");
+    std::string path = (query_pos == std::string::npos) ? s_url : s_url.substr(0, query_pos);
+
+    bool ends_with_tgz = path.size() >= 4 && path.compare(path.size() - 4, 4, ".tgz") == 0;
+
+    if (!scheme_ok || !ends_with_tgz) {
+        if (out_warn_reason) {
+            *out_warn_reason =
+                allow_insecure ? "url must be an http(s) .tgz" : "url must be an https .tgz";
+        }
+        return false;
+    }
+
+    if (!checksum || strlen(checksum) == 0) {
+        if (out_warn_reason) {
+            *out_warn_reason = "missing checksum";
+        }
+        return false;
+    }
+
+    if (size <= 0) {
+        if (out_warn_reason) {
+            *out_warn_reason = "invalid size";
+        }
+        return false;
+    }
+
+    if (out_offer) {
+        out_offer->url = s_url;
+        out_offer->checksum = checksum;
+        out_offer->size = static_cast<size_t>(size);
+    }
+    return true;
+}
+
+// ── Policy Operations ────────────────────────────────────────────────────────
+
+MIKOtaReconcileOutcome mik__ota_policy_reconcile(const MIKOtaEnv* env) {
+    MIKOtaStore store(env);
+    if (store.GetInFlight()) {
+        store.SetInFlight(false);
+    } else {
+        store.SetTries(0);
+    }
+    MIKOtaReconcileOutcome outcome = {};
+    if (env && env->reconcile) {
+        env->reconcile(env->opaque, &outcome);
+    }
+    return outcome;
+}
+
+MIKOtaRunningBuild mik__ota_policy_running(const MIKOtaEnv* env) {
+    MIKOtaRunningBuild run = {};
+    if (env && env->running) {
+        env->running(env->opaque, &run);
+    }
+    if (strlen(run.version) == 0 && env && env->read_app_version) {
+        env->read_app_version(env->opaque, run.version, sizeof(run.version));
+    }
+    return run;
+}
+
+bool mik__ota_policy_revert(const MIKOtaEnv* env, MIKOtaError* out_err) {
+    char err_buf[256] = {};
+    if (env && env->revert && env->revert(env->opaque, err_buf, sizeof(err_buf))) {
+        return true;
+    }
+    if (out_err) {
+        out_err->name = "InstallFailed";
+        out_err->kind = "transient";
+        out_err->message = err_buf[0] ? err_buf : "revert failed";
+    }
+    return false;
+}
+
+void mik__ota_policy_confirm(const MIKOtaEnv* env) {
+    if (env && env->mark_valid) {
+        env->mark_valid(env->opaque);
+    }
+}
+
+namespace {
+
+/* The staging session handed to the download pump. Bounds every write against
+ * the offered size, counting bytes already on flash from a resumed transfer. */
+class UpdateImpl : public MIKOtaUpdate {
+public:
+    UpdateImpl(const MIKOtaEnv* env, size_t size, size_t resume_offset)
+        : env_(env), size_(size), resume_offset_(resume_offset), written_(resume_offset) {}
+
+    size_t resume_offset() const override { return resume_offset_; }
+
+    bool write(const uint8_t* bytes, size_t len, MIKOtaError* out_err) override {
+        if (written_ + len > size_) {
+            if (out_err) {
+                out_err->name = "TooLarge";
+                char buf[128];
+                snprintf(buf, sizeof(buf), "build exceeds offered size %zu", size_);
+                out_err->message = buf;
+            }
+            return false;
+        }
+        char eb[256] = {};
+        if (!env_ || !env_->stage_write ||
+            !env_->stage_write(env_->opaque, bytes, len, eb, sizeof(eb))) {
+            if (out_err) {
+                out_err->name = "StagingFull";
+                out_err->message = eb[0] ? eb : "staging full";
+            }
+            return false;
+        }
+        written_ += len;
+        return true;
+    }
+
+    bool finish(const MIKOtaInstallOptions& opts, MIKOtaError* out_err) override {
+        char eb[256] = {};
+        int err_kind = 0;
+        if (!env_ || !env_->stage_finish ||
+            !env_->stage_finish(env_->opaque, opts.trial_boots, opts.require_confirm,
+                                opts.install_now, eb, sizeof(eb), &err_kind)) {
+            if (out_err) {
+                out_err->name = "InstallFailed";
+                out_err->kind = (err_kind == MIK_OTA_ERR_CORRUPT) ? "corrupt"
+                                : (err_kind == MIK_OTA_ERR_OOM)   ? "oom"
+                                                                  : "transient";
+                out_err->message = eb[0] ? eb : "install failed";
+            }
+            return false;
+        }
+        return true;
+    }
+
+    void abort() override {
+        if (env_ && env_->stage_abort) {
+            env_->stage_abort(env_->opaque);
+        }
+    }
+
+private:
+    const MIKOtaEnv* env_;
+    size_t size_;
+    size_t resume_offset_;
+    size_t written_;
+};
+
+}  // namespace
+
+bool mik__ota_policy_apply_begin(const MIKOtaEnv* env, const MIKOtaOffer& offer,
+                                 MIKOtaApplySession* session, MIKOtaApplyOutcome* out_outcome,
+                                 MIKOtaError* out_err) {
+    session->env = env;
+    session->checksum = offer.checksum;
+    session->update.reset();
+
+    MIKOtaRunningBuild run = {};
+    if (env && env->running) {
+        env->running(env->opaque, &run);
+    }
+
+    // (a) a trial is unresolved. Reported distinctly because the caller's
+    // response differs from every other skip: the build on trial still needs
+    // confirming, and treating this like "nothing to do" lets the trial lapse
+    // and roll back a healthy build just because a newer one was published.
+    if (run.trial) {
+        if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kTrialPending;
+        return true;
+    }
+
+    // (b) already running this build
+    if (!offer.checksum.empty() && offer.checksum == run.checksum) {
+        if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kCurrent;
+        return true;
+    }
+
+    // (d) device has given up on this build
+    MIKOtaStore store(env);
+    if (!offer.checksum.empty() && offer.checksum == store.GetBad()) {
+        if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kAbandoned;
+        return true;
+    }
+
+    // (e) retry budget, keyed on url *and* checksum. Exhausting it only stops
+    // attempts against this exact build at this exact url; the checksum is not
+    // abandoned, because everything counted here is transient by construction
+    // (a corrupt build is abandoned in apply_end instead).
+    if (!store.UrlMatches(offer.url) || offer.checksum != store.GetAttempt()) {
+        store.SetUrl(offer.url);
+        store.SetAttempt(offer.checksum);
+        store.SetTries(0);
+    }
+    int32_t tries = store.GetTries();
+    if (tries >= MIK__OTA_MAX_TRIES) {
+        if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kExhausted;
+        return true;
+    }
+
+    // (f) bump before the attempt, so an attempt that crashes the device still
+    // counts — the in-flight flag is what carries that across the reboot (see
+    // mik__ota_policy_reconcile). apply_end clears it on every ordinary exit,
+    // and deliberately never runs when the attempt takes the device down.
+    store.SetTries(tries + 1);
+    store.SetInFlight(true);
+
+    // (g) open staging
+    size_t resume_offset = 0;
+    char err_buf[256] = {};
+    if (!env || !env->stage_begin ||
+        !env->stage_begin(env->opaque, offer.checksum.c_str(), offer.size, &resume_offset, err_buf,
+                          sizeof(err_buf))) {
+        store.SetInFlight(false);
+        if (out_err) {
+            out_err->name = "StagingFailed";
+            out_err->message = err_buf[0] ? err_buf : "staging failed";
+        }
+        return false;
+    }
+
+    session->update = std::make_unique<UpdateImpl>(env, offer.size, resume_offset);
+    return true;
+}
+
+bool mik__ota_policy_apply_end(MIKOtaApplySession* session, bool download_ok,
+                               const std::string& download_message,
+                               const MIKOtaInstallOptions& options,
+                               MIKOtaApplyOutcome* out_outcome, MIKOtaError* out_err) {
+    MIKOtaStore store(session->env);
+    MIKOtaUpdate* update = session->update.get();
+    struct Closer {
+        MIKOtaApplySession* s;
+        MIKOtaStore& store;
+        ~Closer() {
+            s->update.reset();
+            store.SetInFlight(false);
+        }
+    } closer{session, store};
+
+    if (!update) {
+        if (out_err) {
+            out_err->name = "StagingFailed";
+            out_err->message = "no staging session";
+        }
+        return false;
+    }
+
+    // A failure in the download is transient whatever tripped it: keep the
+    // bumped tries so it retries next time, and do NOT abandon the checksum
+    // (that is only for a corrupt build). The pump's own error name — a
+    // TooLarge or StagingFull from a write — is folded into the message, so
+    // the caller can key on DownloadFailed alone.
+    if (!download_ok) {
+        update->abort();
+        if (out_err) {
+            out_err->name = "DownloadFailed";
+            out_err->kind.clear();
+            out_err->message = download_message;
+        }
+        return false;
+    }
+
+    // A corrupt build is the one thing worth abandoning: the same bytes will
+    // fail identically forever. Abort first, or the verified-bad staging file
+    // (up to the whole build) sits on the app partition until some later offer
+    // happens to reclaim it.
+    if (!update->finish(options, out_err)) {
+        if (out_err && out_err->name == "InstallFailed" && out_err->kind == "corrupt") {
+            update->abort();
+            store.SetBad(session->checksum);
+        }
+        return false;
+    }
+
+    store.SetTries(0);
+    if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kStaged;
+    return true;
+}
+
+bool mik__ota_policy_apply_offer(const MIKOtaEnv* env, const MIKOtaOffer& offer,
+                                 MIKOtaDownloadFn download, const MIKOtaInstallOptions& options,
+                                 MIKOtaApplyOutcome* out_outcome, MIKOtaError* out_err) {
+    MIKOtaApplySession session;
+    if (!mik__ota_policy_apply_begin(env, offer, &session, out_outcome, out_err)) return false;
+    if (!session.update) return true;  // declined before staging
+
+    MIKOtaError dl_err;
+    bool downloaded = download(*session.update, &dl_err);
+    std::string message = dl_err.message.empty() ? "download failed" : dl_err.message;
+    return mik__ota_policy_apply_end(&session, downloaded, message, options, out_outcome, out_err);
+}
+
+}  // namespace mikrojs

package/src/mik_ota_slots.cpp

@@ -0,0 +1,249 @@
+#include "mikrojs/ota_slots.h"
+
+#include <nanocbor/nanocbor.h>
+
+#include <cstring>
+#include <string>
+
+#include "mikrojs/cbor_helpers.h"
+
+namespace mikrojs {
+
+namespace {
+
+const char* slot_key(MIKOtaConfigSlot slot) {
+    switch (slot) {
+        case MIK_OTA_CFG_CURRENT:
+            return "ota.cfg";
+        case MIK_OTA_CFG_NEXT:
+            return "ota.cfgNext";
+        case MIK_OTA_CFG_PREV:
+            return "ota.cfgPrev";
+    }
+    return "ota.cfg";
+}
+
+const char* kTrialKey = "ota.cfgTrial";
+const char* kErrorKey = "ota.cfgErr";
+
+/* Read a whole blob, distinguishing absent from failed. */
+MIKOtaKvStatus kv_read(const MIKOtaEnv* env, const char* key, std::vector<uint8_t>* out) {
+    if (!env || !env->kv_get_blob) return MIK_OTA_KV_ABSENT;
+    size_t len = 0;
+    MIKOtaKvStatus status = env->kv_get_blob(env->opaque, key, nullptr, &len);
+    if (status != MIK_OTA_KV_OK) return status;
+    if (len == 0) return MIK_OTA_KV_ABSENT;
+    out->resize(len);
+    status = env->kv_get_blob(env->opaque, key, out->data(), &len);
+    if (status != MIK_OTA_KV_OK) return status;
+    out->resize(len);
+    return MIK_OTA_KV_OK;
+}
+
+bool take_str(nanocbor_value_t* it, char* out, size_t out_len) {
+    const uint8_t* ptr = nullptr;
+    size_t len = 0;
+    if (nanocbor_get_tstr(it, &ptr, &len) < 0) return false;
+    snprintf(out, out_len, "%.*s", static_cast<int>(len), reinterpret_cast<const char*>(ptr));
+    return true;
+}
+
+bool take_key(nanocbor_value_t* map, std::string* out) {
+    const uint8_t* ptr = nullptr;
+    size_t len = 0;
+    if (nanocbor_get_tstr(map, &ptr, &len) < 0) return false;
+    out->assign(reinterpret_cast<const char*>(ptr), len);
+    return true;
+}
+
+template <typename Fn>
+std::vector<uint8_t> encode_to_vector(Fn&& encode) {
+    /* The measuring pass needs a non-null base: zero-length appends (an empty
+     * string, an empty document) still reach memcpy. */
+    static uint8_t measure_base;
+    nanocbor_encoder_t enc;
+    nanocbor_encoder_init(&enc, &measure_base, 0);
+    encode(&enc);
+    std::vector<uint8_t> out(nanocbor_encoded_len(&enc));
+    nanocbor_encoder_init(&enc, out.data(), out.size());
+    encode(&enc);
+    return out;
+}
+
+/* Append pre-encoded CBOR verbatim. A stored document keeps the exact bytes the
+ * registry sent, so the JS reader decodes the same value the app would have
+ * seen; re-encoding would mean carrying a value model for no reason. */
+void put_raw(nanocbor_encoder_t* enc, const uint8_t* data, size_t len) {
+    enc->len += len;
+    if (enc->fits(enc, enc->context, len)) {
+        enc->append(enc, enc->context, data, len);
+    }
+}
+
+}  // namespace
+
+/* The slot holds the CBOR map the registry path wrote; anything else reads as
+ * absent. */
+MIKOtaLoadedConfig mik__ota_load_slot(const MIKOtaEnv* env, MIKOtaConfigSlot slot) {
+    MIKOtaLoadedConfig out;
+    MIKOtaKvStatus status = kv_read(env, slot_key(slot), &out.bytes);
+    if (status == MIK_OTA_KV_ERROR) {
+        out.failed = true;
+        return out;
+    }
+    if (status != MIK_OTA_KV_OK) return out;
+
+    nanocbor_value_t val;
+    nanocbor_decoder_init(&val, out.bytes.data(), out.bytes.size());
+    nanocbor_value_t map;
+    if (nanocbor_get_type(&val) != NANOCBOR_TYPE_MAP || nanocbor_enter_map(&val, &map) < 0) {
+        return out;
+    }
+
+    while (!nanocbor_at_end(&map)) {
+        std::string key;
+        if (!take_key(&map, &key)) break;
+        if (key == "version") {
+            if (!take_str(&map, out.cfg.version, sizeof(out.cfg.version))) {
+                mik__cbor_skip_value(&map);
+            }
+        } else if (key == "rev") {
+            if (!take_str(&map, out.cfg.rev, sizeof(out.cfg.rev))) mik__cbor_skip_value(&map);
+        } else if (key == "doc") {
+            const uint8_t* start = map.cur;
+            if (nanocbor_get_null(&map) >= 0) continue;  // null normalises to absent
+            if (mik__cbor_skip_value(&map) < 0) break;
+            out.cfg.doc_cbor = const_cast<uint8_t*>(start);
+            out.cfg.doc_cbor_len = static_cast<size_t>(map.cur - start);
+        } else {
+            mik__cbor_skip_value(&map);
+        }
+    }
+    out.present = out.cfg.version[0] != '\0';
+    return out;
+}
+
+void mik__ota_store_slot(const MIKOtaEnv* env, MIKOtaConfigSlot slot,
+                         const MIKOtaStoredConfig& cfg) {
+    if (!env || !env->kv_set_blob) return;
+    size_t map_size = 1;  // version
+    if (cfg.rev[0]) map_size++;
+    if (cfg.doc_cbor && cfg.doc_cbor_len > 0) map_size++;
+
+    std::vector<uint8_t> buf = encode_to_vector([&](nanocbor_encoder_t* enc) {
+        nanocbor_fmt_map(enc, map_size);
+        nanocbor_put_tstr(enc, "version");
+        nanocbor_put_tstr(enc, cfg.version);
+        if (cfg.rev[0]) {
+            nanocbor_put_tstr(enc, "rev");
+            nanocbor_put_tstr(enc, cfg.rev);
+        }
+        if (cfg.doc_cbor && cfg.doc_cbor_len > 0) {
+            nanocbor_put_tstr(enc, "doc");
+            put_raw(enc, cfg.doc_cbor, cfg.doc_cbor_len);
+        }
+    });
+    env->kv_set_blob(env->opaque, slot_key(slot), buf.data(), buf.size());
+}
+
+void mik__ota_clear_slot(const MIKOtaEnv* env, MIKOtaConfigSlot slot) {
+    if (env && env->kv_remove) env->kv_remove(env->opaque, slot_key(slot));
+}
+
+MIKOtaKvStatus mik__ota_load_trial(const MIKOtaEnv* env, MIKOtaConfigTrial* out) {
+    std::vector<uint8_t> bytes;
+    MIKOtaKvStatus status = kv_read(env, kTrialKey, &bytes);
+    if (status != MIK_OTA_KV_OK) return status;
+    nanocbor_value_t val;
+    nanocbor_decoder_init(&val, bytes.data(), bytes.size());
+    nanocbor_value_t map;
+    if (nanocbor_get_type(&val) != NANOCBOR_TYPE_MAP || nanocbor_enter_map(&val, &map) < 0) {
+        return MIK_OTA_KV_ABSENT;
+    }
+    bool has_left = false;
+    bool has_read = false;
+    while (!nanocbor_at_end(&map)) {
+        std::string key;
+        if (!take_key(&map, &key)) break;
+        if (key == "left") {
+            int32_t left = 0;
+            if (nanocbor_get_int32(&map, &left) >= 0) {
+                out->left = left;
+                has_left = true;
+            } else {
+                mik__cbor_skip_value(&map);
+            }
+        } else if (key == "read") {
+            bool read = false;
+            if (nanocbor_get_bool(&map, &read) >= 0) {
+                out->read = read;
+                has_read = true;
+            } else {
+                mik__cbor_skip_value(&map);
+            }
+        } else {
+            mik__cbor_skip_value(&map);
+        }
+    }
+    return (has_left && has_read) ? MIK_OTA_KV_OK : MIK_OTA_KV_ABSENT;
+}
+
+void mik__ota_store_trial(const MIKOtaEnv* env, const MIKOtaConfigTrial& trial) {
+    if (!env || !env->kv_set_blob) return;
+    std::vector<uint8_t> buf = encode_to_vector([&](nanocbor_encoder_t* enc) {
+        nanocbor_fmt_map(enc, 2);
+        nanocbor_put_tstr(enc, "left");
+        nanocbor_fmt_int(enc, trial.left);
+        nanocbor_put_tstr(enc, "read");
+        nanocbor_fmt_bool(enc, trial.read);
+    });
+    env->kv_set_blob(env->opaque, kTrialKey, buf.data(), buf.size());
+}
+
+void mik__ota_clear_trial(const MIKOtaEnv* env) {
+    if (env && env->kv_remove) env->kv_remove(env->opaque, kTrialKey);
+}
+
+bool mik__ota_load_config_error(const MIKOtaEnv* env, MIKOtaConfigErrorReport* out) {
+    std::vector<uint8_t> bytes;
+    if (kv_read(env, kErrorKey, &bytes) != MIK_OTA_KV_OK) return false;
+    nanocbor_value_t val;
+    nanocbor_decoder_init(&val, bytes.data(), bytes.size());
+    nanocbor_value_t map;
+    if (nanocbor_get_type(&val) != NANOCBOR_TYPE_MAP || nanocbor_enter_map(&val, &map) < 0) {
+        return false;
+    }
+    memset(out, 0, sizeof(*out));
+    bool has_message = false;
+    while (!nanocbor_at_end(&map)) {
+        std::string key;
+        if (!take_key(&map, &key)) break;
+        if (key == "rev") {
+            if (!take_str(&map, out->rev, sizeof(out->rev))) mik__cbor_skip_value(&map);
+        } else if (key == "message") {
+            has_message = take_str(&map, out->message, sizeof(out->message));
+            if (!has_message) mik__cbor_skip_value(&map);
+        } else {
+            mik__cbor_skip_value(&map);
+        }
+    }
+    return out->rev[0] != '\0' && has_message;
+}
+
+void mik__ota_store_config_error(const MIKOtaEnv* env, const MIKOtaConfigErrorReport& report) {
+    if (!env || !env->kv_set_blob) return;
+    std::vector<uint8_t> buf = encode_to_vector([&](nanocbor_encoder_t* enc) {
+        nanocbor_fmt_map(enc, 2);
+        nanocbor_put_tstr(enc, "rev");
+        nanocbor_put_tstr(enc, report.rev);
+        nanocbor_put_tstr(enc, "message");
+        nanocbor_put_tstr(enc, report.message);
+    });
+    env->kv_set_blob(env->opaque, kErrorKey, buf.data(), buf.size());
+}
+
+void mik__ota_clear_config_error(const MIKOtaEnv* env) {
+    if (env && env->kv_remove) env->kv_remove(env->opaque, kErrorKey);
+}
+
+}  // namespace mikrojs

package/src/mik_repl.cpp

@@ -852,9 +852,12 @@ static std::vector<uint8_t> proto_complete(JSContext* ctx, const char* partial,
     const char* argv[1] = {partial};
     completion_callback(cb, 1, argv);
 
-    /* Two-pass CBOR encode: {"prefix": tstr, "items": [tstr, ...]} */
+    /* Two-pass CBOR encode: {"prefix": tstr, "items": [tstr, ...]}. The
+     * measuring pass needs a non-null base: zero-length appends still hit
+     * memcpy, and memcpy(NULL, ..., 0) is undefined behavior. */
+    static uint8_t measure_base;
     nanocbor_encoder_t enc;
-    nanocbor_encoder_init(&enc, nullptr, 0);
+    nanocbor_encoder_init(&enc, &measure_base, 0);
     nanocbor_fmt_map(&enc, 2);
     nanocbor_put_tstr(&enc, "prefix");
     nanocbor_put_tstrn(&enc, partial, len);
@@ -904,8 +907,11 @@ static void refresh_ready(MIKReplTransport* transport);
  * the length the encoding needs, which exceeds cap when it did not fit. */
 static size_t encode_ready(uint8_t* buf, size_t cap, const char* chip, const char* id,
                            const char* version, const char* fw, const char* name) {
+    /* Measuring calls pass buf=NULL; substitute a non-null base so
+     * zero-length appends never hand memcpy a null pointer (UB). */
+    static uint8_t measure_base;
     nanocbor_encoder_t enc;
-    nanocbor_encoder_init(&enc, buf, cap);
+    nanocbor_encoder_init(&enc, buf ? buf : &measure_base, buf ? cap : 0);
     nanocbor_fmt_map(&enc, 3 + (fw ? 1 : 0) + (name ? 1 : 0));
     nanocbor_put_tstr(&enc, "chip");
     nanocbor_put_tstr(&enc, chip);