@opengsd/gsd-core 1.20.0 → 1.21.0

package/gsd-core/bin/lib/capability-activation.cjs

@@ -8,11 +8,13 @@
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspaceMod = require("./planning-workspace.cjs");
 const { planningDir, planningRoot } = planningWorkspaceMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- config-file-read.cjs is an export= CommonJS module
+const configFileReadMod = require("./config-file-read.cjs");
+const { readConfigFileBounded } = configFileReadMod;
 function _getNestedConfigValue(config, dotKey) {
     const segments = dotKey.split('.');
     let current = config;
@@ -34,7 +36,11 @@ function _getNestedConfigValue(config, dotKey) {
 const _warnedRawConfigPaths = new Set();
 function _readRawConfigKey(filePath, dotKey, quiet = false) {
     try {
-        const raw = node_fs_1.default.readFileSync(filePath, 'utf8');
+        // Bounded read (#5759): null is an absent file; a FIFO/device/oversized one throws to the
+        // catch below, which reports the key as not found.
+        const raw = readConfigFileBounded(filePath);
+        if (raw === null)
+            return { found: false, value: undefined };
         let parsed;
         try {
             parsed = JSON.parse(raw);

package/gsd-core/bin/lib/capability-command-router.cjs

@@ -88,10 +88,14 @@ async function routeCapabilityCommand({ args, cwd, raw }) {
     } catch {
       return undefined; // cannot even resolve the project config dir — permissive default
     }
-    if (!fs.existsSync(cfgPath)) return undefined; // no project config — permissive default
     let cfg;
     try {
-      cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
+      // #5759: bounded regular-file read — a FIFO/device/oversized config throws (fails closed
+      // below) instead of blocking; null is an absent file.
+      const { readConfigFileBounded } = require('./config-file-read.cjs');
+      const rawCfg = readConfigFileBounded(cfgPath);
+      if (rawCfg === null) return undefined; // no project config — permissive default
+      cfg = JSON.parse(rawCfg);
     } catch {
       // Config is PRESENT but unreadable/unparseable: a security policy must not silently
       // downgrade to permissive. Fail CLOSED — lockdown ([]) blocks external installs (local

package/gsd-core/bin/lib/capability-ledger.cjs

@@ -158,7 +158,7 @@ function readSmallRegularFile(filePath, maxBytes) {
  */
 function readSmallRegularFileBuffer(filePath, maxBytes) {
     // O_RDONLY | O_NONBLOCK: never block on opening a FIFO/device — return the fd so fstat can reject it.
-    const openFlags = node_fs_1.default.constants.O_RDONLY | node_fs_1.default.constants.O_NONBLOCK;
+    const openFlags = node_fs_1.default.constants.O_RDONLY | node_fs_1.default.constants.O_NONBLOCK | (node_fs_1.default.constants.O_NOCTTY || 0);
     let fd;
     try {
         fd = node_fs_1.default.openSync(filePath, openFlags);

package/gsd-core/bin/lib/capability-lock.cjs

@@ -80,6 +80,16 @@ const LOCK_MAX_BODY_BYTES = 64 * 1024;
  */
 const LOCK_MAX_ATTEMPTS = 8;
 const LOCK_RETRY_BACKOFF_MS = 25;
+/** The exact (dev, ino) of `p`, or nulls when it cannot be statted. */
+function statIdentity(p) {
+    try {
+        const st = node_fs_1.default.statSync(p, { bigint: true });
+        return { dev: typeof st.dev === 'bigint' ? st.dev : null, ino: typeof st.ino === 'bigint' ? st.ino : null };
+    }
+    catch {
+        return { dev: null, ino: null };
+    }
+}
 // ---------------------------------------------------------------------------
 // Tokens + backoff
 // ---------------------------------------------------------------------------
@@ -308,16 +318,9 @@ function readParsedLockBounded(lockPath) {
  * "changed" and retries rather than stealing. Never throws.
  */
 function lockIdentity(lockPath) {
-    let dev = null;
-    let ino = null;
-    try {
-        const st = node_fs_1.default.statSync(lockPath);
-        dev = typeof st.dev === 'number' ? st.dev : null;
-        ino = typeof st.ino === 'number' ? st.ino : null;
-    }
-    catch {
+    const { dev, ino } = statIdentity(lockPath);
+    if (dev === null || ino === null)
         return { dev: null, ino: null, ts: null }; // vanished/unstatable — treat as changed.
-    }
     const ts = readParsedLockBounded(lockPath).ts;
     return { dev, ino, ts };
 }
@@ -437,14 +440,7 @@ function acquireLock(lockPath, opts) {
             }
             // Capture the lock inode's (dev, ino) so releaseLock can confirm, immediately before rmSync, that
             // the path still holds OUR inode. Best-effort: a null dev/ino just falls back to the token check.
-            let dev = null;
-            let ino = null;
-            try {
-                const lst = node_fs_1.default.statSync(lockPath);
-                dev = typeof lst.dev === 'number' ? lst.dev : null;
-                ino = typeof lst.ino === 'number' ? lst.ino : null;
-            }
-            catch { /* best-effort — release falls back to the token check alone */ }
+            const { dev, ino } = statIdentity(lockPath); // best-effort — null falls back to the token check alone
             return { path: lockPath, token, dev, ino };
         }
         catch (err) {
@@ -456,7 +452,7 @@ function acquireLock(lockPath, opts) {
         // Held — decide whether to steal.
         let st;
         try {
-            st = node_fs_1.default.statSync(lockPath);
+            st = node_fs_1.default.statSync(lockPath, { bigint: true });
         }
         catch {
             continue; // lock vanished between open and stat — retry the create immediately.
@@ -466,7 +462,7 @@ function acquireLock(lockPath, opts) {
         // even if the file `mtime` is stale-old. A legacy/garbage/no-`ts` body — and a FUTURE/implausible
         // `ts` — falls back to the file `mtime` age so a planted/clock-skewed future ts can never deadlock.
         const parsed = readParsedLockBounded(lockPath);
-        const age = lockAgeMs(parsed.ts, st.mtimeMs);
+        const age = lockAgeMs(parsed.ts, Number(st.mtimeMs));
         if (age <= LOCK_STALE_MS) { // genuinely held (fresh) — blocked.
             const b = blocked(attempt);
             if (b === 'retry')
@@ -474,8 +470,8 @@ function acquireLock(lockPath, opts) {
             return b;
         }
         const decisionIdentity = {
-            dev: typeof st.dev === 'number' ? st.dev : null,
-            ino: typeof st.ino === 'number' ? st.ino : null,
+            dev: typeof st.dev === 'bigint' ? st.dev : null,
+            ino: typeof st.ino === 'bigint' ? st.ino : null,
             ts: parsed.ts,
         };
         if (isSameHost(parsed) && parsed.pid !== null) {
@@ -553,13 +549,9 @@ function releaseLock(handle) {
         if (lockBodyToken(body) !== handle.token && body !== handle.token)
             return; // not our token (PRIMARY).
         if (handle.dev !== null && handle.ino !== null) {
-            let cur;
-            try {
-                cur = node_fs_1.default.statSync(handle.path);
-            }
-            catch {
+            const cur = statIdentity(handle.path);
+            if (cur.dev === null || cur.ino === null)
                 return; // vanished/unstatable between read and rmSync → nothing of ours to release.
-            }
             if (cur.dev !== handle.dev || cur.ino !== handle.ino)
                 return; // successor inode — not ours.
         }