@preventive/triage 1.0.0-alpha.1 → 1.0.0-alpha.3

package/server/sync-handlers.ts

@@ -13,9 +13,8 @@ import { MAX_CIPHERTEXT_LEN, MAX_FIELD_LEN, validCiphertextShape, validNonce, va
 import { debugTag } from './util.ts'
 import type { UnauthorizedContext } from './auth.ts'
 
-// `chainForWire` accepts the row shape from `chainFrom` (where
-// `keyframe` is the SQLite INTEGER 0 / 1) and returns the same fields
-// with `keyframe` normalised to a strict boolean for the wire.
+// Wire shape `chainForWire` produces from a `chainFrom` row, with
+// `keyframe` normalised from the SQLite INTEGER 0/1 to a strict boolean.
 type WireRevision = {
   base: string | null
   id: string
@@ -88,14 +87,12 @@ export function createSyncHandlers(deps: SyncHandlersDeps): SyncHandlers {
     send(socket, { type: 'workspace-save-error', workspaceTag, base, reason })
   }
 
-  // Normalise `keyframe` on outbound chain entries to a strict boolean.
+  // Normalise `keyframe` to a strict boolean on outbound chain entries.
   // SQLite stores the column as INTEGER (0/1) and `chainFrom` returns
-  // raw rows; the wire contract (and the canonical signing payload)
-  // uses strict `=== true` to mark keyframes. Forwarding the integer
-  // shape works only because every shipping client coerces via
-  // `Boolean(rev.keyframe)` before reconstructing the canonical bytes —
-  // fragile if a future client (or test harness) ever strict-compares.
-  // Convert once on the send side.
+  // raw rows; the wire contract (and canonical signing payload) uses
+  // strict `=== true`. Convert once on the send side — forwarding the
+  // integer relies on clients coercing via `Boolean()` before rebuilding
+  // canonical bytes, fragile against any client that strict-compares.
   function chainForWire(revisions: RevisionRow[]): WireRevision[] {
     return revisions.map((r) => ({ ...r, keyframe: r.keyframe === 1 }))
   }
@@ -174,19 +171,14 @@ export function createSyncHandlers(deps: SyncHandlersDeps): SyncHandlers {
       sendUnauthorized(socket, { kind: 'gated', workspaceTag: tag, base: msg.base ?? null })
       return
     }
-    // NOTE: Earlier revisions auto-subscribed the sending socket here.
-    // That created a replay vector — a passive observer who captured
-    // any single valid `workspace-save` frame could replay it from any
-    // TCP connection forever to attach as a subscriber and silently
-    // mirror every future encrypted broadcast for the workspace,
-    // without ever holding the seed (the duplicate-id path returns
-    // ack-only and doesn't reject the socket). Audit round-9 H1.
-    //
-    // The legitimate client always sends an explicit
-    // `workspace-subscribe` (see `trySendSubscribe` in
-    // `client/triage-sync.js` — fires on key derivation, on socket
-    // open, on continuity-break recovery, on dismissError). The
-    // subscribe path remains the only way to attach as a subscriber.
+    // Save does NOT subscribe the sending socket — that would be a
+    // replay vector: a passive observer who captured one valid
+    // `workspace-save` frame could replay it from any TCP connection to
+    // attach as a subscriber and mirror every future encrypted
+    // broadcast, without holding the seed (the duplicate-id path returns
+    // ack-only, doesn't reject the socket). Explicit `workspace-subscribe`
+    // (signs the per-connection challenge nonce) is the ONLY attach path.
+    // Audit round-9 H1.
     const baseNorm = msg.base ?? null
     // `keyframe === true` is what canonicalSave bound the signature to
     // (strict equality); the signer's intent is unambiguous here.
@@ -230,13 +222,10 @@ export function createSyncHandlers(deps: SyncHandlersDeps): SyncHandlers {
       base: baseNorm,
       id,
     })
-    // Carry `keyframe` as a strict boolean on the broadcast wire —
-    // peers strict-compare `=== true` (matching the canonical-payload
-    // contract). The previous shape emitted `keyframe ? 1 : 0` which a
-    // strict check would treat as non-keyframe, making a replayed
-    // keyframe look like a regular delta on broadcast paths even though
-    // the chain-fetch path (chainFrom → SQLite integer) DID round-trip
-    // correctly.
+    // Carry `keyframe` as a strict boolean on the broadcast wire — peers
+    // strict-compare `=== true` (matching the canonical-payload
+    // contract). An integer 0/1 here would make a keyframe look like a
+    // regular delta on broadcast paths.
     broadcast(tag, {
       type: 'workspace-state',
       workspaceTag: tag,
@@ -261,15 +250,19 @@ export function createSyncHandlers(deps: SyncHandlersDeps): SyncHandlers {
   }
 
   async function handleSubscribe(socket: WebSocket, msg: SubscribeMsg): Promise<void> {
-    if (typeof msg.workspaceTag !== 'string') return
-    // Same `string | null` contract as `base` in handleSave. The signed
-    // canonical uses `String(from)`, but the chain-lookup path
-    // (`typeof msg.from === 'string' ? msg.from : null`) treats every
-    // non-string as null — so a legit signer sending `from: { … }`
-    // would silently take the keyframe-fallback path even though the
-    // signature was over a different canonical shape. Reject at the
-    // wire gate.
-    if (msg.from != null && typeof msg.from !== 'string') return
+    // Mirror handleSave's wire gate: length-cap + base64url-alphabet on
+    // workspaceTag / signature / from BEFORE canonicalSubscribe UTF-8-
+    // encodes them and verifyEd25519 base64-decodes the signature.
+    // Without it a peer can submit up-to-maxPayload strings and force
+    // O(n) encode + decode per subscribe before the 32/64-byte length
+    // gates reject — a CPU-DoS surface handleSave is already hardened
+    // against. `from` keeps the `string | null` contract (null = full-
+    // chain catch-up); a legit signer's `from` is a base64url revision
+    // id, so any non-string / over-long / wrong-alphabet value can't be
+    // one the signature was computed over, and the chain-lookup path
+    // (`typeof msg.from === 'string' ? msg.from : null`) still treats a
+    // null / absent `from` as the keyframe-fallback.
+    if (!validTagSigBase(msg.workspaceTag, MAX_FIELD_LEN) || !validTagSigBase(msg.signature, MAX_FIELD_LEN) || (msg.from != null && !validTagSigBase(msg.from, MAX_FIELD_LEN))) return
     // The challenge nonce we issued on this socket is bound into the
     // signed canonical, blocking cross-connection replay of a captured
     // subscribe frame. A subscribe arriving before we sent the

package/server/ws-server.ts

@@ -55,23 +55,19 @@ export type WsServerDeps = PeerConnectionDeps & {
 }
 
 // Per-connection setup: create Peer, send challenge, wire message /
-// close / error / pong listeners. Shared between the WS connection
-// handler below and the SSE+POST adapter in ./sse-server.ts. The
-// `socket` parameter is the WebSocket-shaped surface (a real `ws`
-// `WebSocket`, or an `SseSession` cast through `as unknown as
-// WebSocket`); the function only uses the subset both expose.
+// close / error / pong listeners. `socket` is the WebSocket-shaped
+// surface — a real `ws` `WebSocket`, or an `SseSession` cast through
+// `as unknown as WebSocket`; only the subset both expose is used.
 export function setupPeerConnection(socket: WebSocket, req: HttpRequest, deps: PeerConnectionDeps): void {
   const {
     peers, send, unsubscribeAll, handleSave, handleSubscribe, handleAuthenticate,
     sendSaveError, objstore, track, isShuttingDown, maxInflightPerSocket, debug,
   } = deps
   if (debug) console.log(`connect from ${req.socket.remoteAddress}`)
-  // One Peer holds this connection's state (challenge / authorized /
-  // alive / inflight / tags). Created before any client frame can
-  // arrive (`socket.on('message')` is wired below). The heartbeat
-  // sweep flips `alive` false after each `ping()`; the `pong` listener
-  // flips it back, and a socket still false on the next sweep is
-  // terminated — the only thing closing FDs for an idle peer.
+  // One Peer holds this connection's state, created before any client
+  // frame can arrive (`socket.on('message')` is wired below). The
+  // heartbeat sweep's two-tick liveness check (see below) is the only
+  // thing closing FDs for an otherwise-idle peer.
   const peer = new Peer(randomId())
   peers.set(socket, peer)
   socket.on('pong', () => { peer.alive = true })
@@ -228,9 +224,8 @@ export function setupPeerConnection(socket: WebSocket, req: HttpRequest, deps: P
   // Surface socket-level errors instead of swallowing — these are
   // the signals operators want under abuse / network flakiness
   // (TLS handshake failures, frame-decode errors, ws-protocol
-  // violations). The previous `() => {}` left every per-connection
-  // failure invisible. `close` fires after `error` and runs the
-  // unsubscribe cleanup, so logging here doesn't risk leaking.
+  // violations). `close` fires after `error` and runs the unsubscribe
+  // cleanup, so logging here doesn't risk leaking.
   socket.on('error', (err: Error) => { console.warn('Socket error:', errMsg(err)) })
 }
 

package/strip-types-loader.js

@@ -0,0 +1,94 @@
+// Module customization hook that erases TypeScript types using Node's
+// built-in `module.stripTypeScriptTypes()` — the same eraser that powers
+// Node's unflagged `.ts` execution, exposed here as an explicit loader so
+// this package can run its own `.ts` source after it's installed as a
+// dependency. Built on Node's bundled eraser, it needs no third-party dep
+// (cf. `amaro`, which is just the library Node already bundles for this).
+//
+// Why this is needed at all — Node DISABLES built-in `.ts` stripping for
+// any file under `node_modules` (it throws ERR_UNSUPPORTED_NODE_MODULES_
+// TYPE_STRIPPING), which is exactly where this package's `.ts` files live
+// once it's a dependency. A registered `load` hook is not bound by that
+// rule, so it restores `.ts` execution from inside `node_modules`.
+//
+// Registered as an entry point — `@preventive/triage/strip-types-loader` —
+// so consumers can run the server (or import `@preventive/triage/server`)
+// with the hook active:
+//   node --import @preventive/triage/strip-types-loader <entry>
+//
+// `registerHooks` (synchronous, in-thread) is used over the async,
+// worker-thread `module.register`: stripping is a pure synchronous string
+// transform, so there's no reason to round-trip every load through a
+// worker — and the read below is synchronous too.
+//
+// We must read + strip the source OURSELVES rather than delegate to
+// `nextLoad`: under `node_modules`, `nextLoad`'s default format detection
+// is what throws ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING, before our
+// hook ever sees the source. Reading the bytes and short-circuiting with
+// an explicit format sidesteps that gate.
+//
+// `mode: 'strip'` (types elided, no enum/namespace transform) suffices —
+// the repo is `erasableSyntaxOnly` (tsconfig.json). Strip mode replaces
+// each elided type with equal-width whitespace, so line AND column
+// positions survive 1:1 and stack traces stay exact without a source map.
+
+import { isUtf8 } from 'node:buffer'
+import { readFileSync } from 'node:fs'
+import { registerHooks, stripTypeScriptTypes } from 'node:module'
+import { fileURLToPath } from 'node:url'
+
+// `.ts` / `.mts` -> ESM, `.cts` -> CommonJS. The `kind` group is the
+// optional `m`/`c` infix; absent (plain `.ts`) defaults to ESM, which is
+// correct for this `"type": "module"` package.
+const TS_RE = /\.(?<kind>[cm])?ts$/u
+
+// Defence-in-depth: assert strip mode only ERASED — every output character
+// is either unchanged, replaced by whitespace, or replaced by a semicolon
+// (swc's ASI guard — swc-project/swc#9331). This enforces at runtime what
+// tsconfig's `erasableSyntaxOnly` asserts at type-check time: nothing but
+// type syntax was removed, so the bytes Node runs can't silently diverge
+// from the bytes we wrote.
+//
+// The comparison is per-CODE-POINT, not per-byte. swc preserves byte
+// offsets by swapping each elided multi-byte character for a *same-width*
+// Unicode whitespace char — e.g. an em-dash (U+2014) in a type-level
+// comment becomes U+2002 EN SPACE, not ASCII 0x20 — so a raw-byte check
+// would false-positive on the many such comments in this codebase. `\s`
+// matches those Unicode spaces, and strip preserves code-unit length too,
+// so string indices stay aligned.
+const WHITESPACE = /\s/u
+
+function assertOnlyErased(url, source, stripped) {
+  if (source.length !== stripped.length) {
+    throw new Error(`strip-types-loader: ${url} changed length ${source.length} -> ${stripped.length}; not a pure type erasure`)
+  }
+  for (let i = 0; i < stripped.length; i++) {
+    const ch = stripped[i]
+    if (ch === source[i] || ch === ';' || WHITESPACE.test(ch)) continue
+    throw new Error(`strip-types-loader: ${url} char ${i} changed ${JSON.stringify(source[i])} -> ${JSON.stringify(ch)}; not a pure type erasure`)
+  }
+}
+
+registerHooks({
+  load(url, context, nextLoad) {
+    const match = TS_RE.exec(new URL(url).pathname)
+    if (match) {
+      const bytes = readFileSync(fileURLToPath(url))
+      // Assert the source is valid UTF-8 before decoding: a mis-encoded
+      // file (latin-1, UTF-16, a stray binary) would otherwise decode with
+      // U+FFFD replacement chars and we'd strip / execute silent garbage.
+      if (!isUtf8(bytes)) {
+        throw new Error(`strip-types-loader: ${url} is not valid UTF-8`)
+      }
+      const raw = bytes.toString('utf8')
+      const stripped = stripTypeScriptTypes(raw, { mode: 'strip' })
+      assertOnlyErased(url, raw, stripped)
+      return {
+        format: match.groups.kind === 'c' ? 'commonjs' : 'module',
+        source: stripped,
+        shortCircuit: true,
+      }
+    }
+    return nextLoad(url, context)
+  },
+})