@rogatio/cli 6.20.2 → 6.20.4

package/dist/editor/index.js

@@ -263,6 +263,14 @@ var HTTP_METHODS = Object.freeze([
   "CONNECT",
   "TRACE"
 ]);
+function compileReplacementRegex(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  try {
+    return new RegExp(value, "u");
+  } catch {
+    return null;
+  }
+}
 function hasLoneSurrogate(value) {
   for (let i = 0; i < value.length; i += 1) {
     const code = value.charCodeAt(i);
@@ -1519,17 +1527,13 @@ function createRequestBodyRuleType() {
             path: `${rulePath}/requestBody/pattern`,
             message: "Regex pattern must not contain lone UTF-16 surrogates."
           });
-        } else {
-          try {
-            new RegExp(action.pattern, "u");
-          } catch {
-            diagnostics.push({
-              code: "editor.request-body-pattern",
-              severity: "error",
-              path: `${rulePath}/requestBody/pattern`,
-              message: "Regex pattern must be a valid regular expression."
-            });
-          }
+        } else if (compileReplacementRegex(action.pattern) === null) {
+          diagnostics.push({
+            code: "editor.request-body-pattern",
+            severity: "error",
+            path: `${rulePath}/requestBody/pattern`,
+            message: "Regex pattern must be a valid regular expression."
+          });
         }
         if (typeof action.replacement !== "string" || action.replacement.length > LIMITS.maxRequestBodyReplacementLength) {
           diagnostics.push({
@@ -1677,11 +1681,7 @@ function validateRegexReplacements(replacements, rulePath) {
   replacements.forEach((entry, index) => {
     const patternPath = `${rulePath}/responseBody/replacements/${index}/pattern`;
     const replacementPath = `${rulePath}/responseBody/replacements/${index}/replacement`;
-    try {
-      if (typeof entry?.pattern !== "string" || entry.pattern.length === 0 || entry.pattern.length > LIMITS.maxResponseBodyPatternLength)
-        throw new Error();
-      new RegExp(entry.pattern, "u");
-    } catch {
+    if (typeof entry?.pattern !== "string" || entry.pattern.length === 0 || entry.pattern.length > LIMITS.maxResponseBodyPatternLength || compileReplacementRegex(entry.pattern) === null) {
       diagnostics.push({
         code: "editor.response-body-pattern",
         severity: "error",

package/dist/node/index.js

@@ -628,6 +628,14 @@ function compileUrlRegex(value) {
     return null;
   }
 }
+function compileReplacementRegex(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  try {
+    return new RegExp(value, "u");
+  } catch {
+    return null;
+  }
+}
 var label = {
   type: "string",
   minLength: 1,
@@ -959,7 +967,7 @@ var projectSchemaDefinition = {
           type: "string",
           minLength: 1,
           maxLength: LIMITS.maxResponseBodyPatternLength,
-          format: "rogatio-url-regex"
+          format: "rogatio-replacement-regex"
         },
         replacement: {
           type: "string",
@@ -1035,7 +1043,7 @@ var projectSchemaDefinition = {
           type: "string",
           minLength: 1,
           maxLength: LIMITS.maxRequestBodyPatternLength,
-          format: "rogatio-url-regex"
+          format: "rogatio-replacement-regex"
         },
         replacement: {
           type: "string",
@@ -1200,6 +1208,10 @@ ajv.addFormat("rogatio-url-regex", {
   type: "string",
   validate: (value) => compileUrlRegex(value) !== null
 });
+ajv.addFormat("rogatio-replacement-regex", {
+  type: "string",
+  validate: (value) => compileReplacementRegex(value) !== null
+});
 function ajvIssues(errors) {
   return (errors ?? []).map((error) => ({
     // Ajv reports a `required` violation against the object that lacks the
@@ -1525,7 +1537,7 @@ function semanticIssues(project) {
           } else {
             for (let index = 0; index < action2.replacements.length; index += 1) {
               const replacement = action2.replacements[index];
-              if (compileUrlRegex(replacement.pattern) === null) {
+              if (compileReplacementRegex(replacement.pattern) === null) {
                 issues.push({
                   instancePath: `${actionPath}/replacements/${index}/pattern`,
                   keyword: "response-body-pattern",
@@ -1611,7 +1623,7 @@ function semanticIssues(project) {
                 message: `Regex pattern exceeds the maximum length of ${LIMITS.maxRequestBodyPatternLength} characters.`,
                 params: { limit: LIMITS.maxRequestBodyPatternLength }
               });
-            } else if (compileUrlRegex(action2.pattern) === null) {
+            } else if (compileReplacementRegex(action2.pattern) === null) {
               issues.push({
                 instancePath: `${actionPath}/pattern`,
                 keyword: "request-body-pattern",
@@ -2283,21 +2295,23 @@ import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2
 import { X509Certificate } from "node:crypto";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, unlinkSync, writeFileSync } from "node:fs";
-import { mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join3 } from "node:path";
+import { accessSync, constants as constants3 } from "node:fs";
+import { mkdtemp as mkdtemp2, rm as rm3 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat2, mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join3 } from "node:path";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, mkdirSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { accessSync as accessSync2, constants as constants4, mkdirSync, unlinkSync } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 import { join as posixJoin2 } from "node:path/posix";
 import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
-import { accessSync as accessSync3, constants as constants4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { accessSync as accessSync3, constants as constants5 } from "node:fs";
 import { join as posixJoin3 } from "node:path/posix";
-import { constants as constants5 } from "node:fs";
+import { constants as constants6 } from "node:fs";
 import { open as open4, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
@@ -23153,6 +23167,84 @@ function createRequestBodyTrustController(options = {}) {
   }
   return { install, uninstall, status, verify: verify2 };
 }
+var INSTALL_CERT_NAME = "ca.crt";
+function optionalFlag(flag) {
+  return typeof flag === "number" ? flag : 0;
+}
+function exclusiveWriteFlags() {
+  return constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_TRUNC | optionalFlag(constants2.O_NOFOLLOW);
+}
+function readFlags() {
+  return constants2.O_RDONLY | optionalFlag(constants2.O_NOFOLLOW) | optionalFlag(constants2.O_NONBLOCK);
+}
+function refuseCertificateFile(message) {
+  throw new TrustError("trust.internal", message, [
+    "certificate-file-rejected"
+  ]);
+}
+async function writeExclusiveCertificate(certPath, pem) {
+  const handle = await open3(certPath, exclusiveWriteFlags(), 384);
+  try {
+    await handle.writeFile(Buffer.from(pem, "utf8"));
+    await handle.chmod(384);
+  } finally {
+    await handle.close();
+  }
+}
+async function assertCertificateReady(certPath, pem) {
+  let info;
+  try {
+    info = await lstat2(certPath);
+  } catch {
+    refuseCertificateFile("certificate file is not a regular file");
+  }
+  if (!info.isFile() || info.isSymbolicLink() || info.isFIFO()) {
+    refuseCertificateFile("certificate file is not a regular file");
+  }
+  let handle;
+  try {
+    handle = await open3(certPath, readFlags());
+    const opened = await handle.stat();
+    if (!opened.isFile() || opened.isFIFO() || opened.isSymbolicLink()) {
+      refuseCertificateFile("certificate file is not a regular file");
+    }
+    const bytes = await handle.readFile();
+    if (!bytes.equals(Buffer.from(pem, "utf8"))) {
+      refuseCertificateFile(
+        "certificate file does not match the certificate to install"
+      );
+    }
+    if (!isInstallableCaCertificate(bytes.toString("utf8"))) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+  } catch (error) {
+    if (error instanceof TrustError) throw error;
+    refuseCertificateFile("certificate file is not a regular file");
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function withInstallCertificateFile(pem, use) {
+  if (!isInstallableCaCertificate(pem)) {
+    throw new TrustError("trust.internal", "invalid-ca-certificate", [
+      "invalid-ca-certificate"
+    ]);
+  }
+  const directory = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
+  try {
+    const certPath = join3(directory, INSTALL_CERT_NAME);
+    await writeExclusiveCertificate(certPath, pem);
+    await assertCertificateReady(certPath, pem);
+    await use(certPath);
+  } finally {
+    try {
+      await rm2(directory, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
 var PREVIOUS_CA_PEM_MAX_BYTES = 16 * 1024;
 function spawnSecurity(args) {
   return new Promise((resolve12) => {
@@ -23191,12 +23283,12 @@ var darwinAdapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync(manifestDir, constants2.W_OK);
+      accessSync(manifestDir, constants3.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
     try {
-      accessSync(caDir, constants2.W_OK);
+      accessSync(caDir, constants3.W_OK);
     } catch {
       reasons.push("keychain-unwritable");
     }
@@ -23210,44 +23302,31 @@ var darwinAdapter = {
   },
   async caTrustInstaller(certPem) {
     const keychain = this.defaultCaInstallPath();
-    const tmpPath = join3(tmpdir(), `rogatio-ca-${Date.now()}.crt`);
     try {
-      writeFileSync(tmpPath, certPem, "utf8");
-    } catch {
-      throw new TrustError("trust.internal", "keychain-unwritable", [
-        "keychain-unwritable"
-      ]);
-    }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn("security", [
+      await withInstallCertificateFile(certPem, async (certPath) => {
+        const result = await spawnSecurity([
           "add-trusted-cert",
           "-d",
           "-r",
           "trustRoot",
           "-k",
           keychain,
-          tmpPath
+          certPath
         ]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
-    try {
-      unlinkSync(tmpPath);
-    } catch {
-    }
-    if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "keychain-unwritable";
-      if (stderr.includes("permission") || stderr.includes("auth")) {
-        reason = "keychain-unwritable";
-      }
-      throw new TrustError("trust.internal", reason, [reason]);
+        if (result.code !== 0) {
+          const stderr = result.stderr.toLowerCase();
+          let reason = "keychain-unwritable";
+          if (stderr.includes("permission") || stderr.includes("auth")) {
+            reason = "keychain-unwritable";
+          }
+          throw new TrustError("trust.internal", reason, [reason]);
+        }
+      });
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
+      throw new TrustError("trust.internal", "keychain-unwritable", [
+        "keychain-unwritable"
+      ]);
     }
   },
   async caTrustRemover() {
@@ -23289,17 +23368,11 @@ var darwinAdapter = {
       ]);
     }
     const keychain = this.defaultCaInstallPath();
-    const dir = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
-    const tmpPath = join3(dir, "previous.crt");
+    const dir = await mkdtemp2(join4(tmpdir2(), "rogatio-ca-"));
+    const tmpPath = join4(dir, "previous.crt");
     let failed = false;
     try {
-      const handle = await open3(tmpPath, "wx", 384);
-      try {
-        await handle.writeFile(certPem, "utf8");
-        await handle.chmod(384);
-      } finally {
-        await handle.close();
-      }
+      await writeExclusiveCertificate(tmpPath, certPem);
       const trust = await spawnSecurity(["remove-trusted-cert", "-d", tmpPath]);
       if (trust.code !== 0 && !securityMiss(trust.stderr)) failed = true;
       const item = await spawnSecurity([
@@ -23314,7 +23387,7 @@ var darwinAdapter = {
       failed = true;
     } finally {
       try {
-        await rm2(dir, { recursive: true, force: true });
+        await rm3(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -23352,7 +23425,7 @@ function exists(path2) {
 }
 function writable(path2) {
   try {
-    accessSync2(path2, constants3.W_OK);
+    accessSync2(path2, constants4.W_OK);
     return true;
   } catch {
     return false;
@@ -23389,7 +23462,7 @@ function p11kitAnchorsDir() {
 function needsElevation(dir) {
   if (writable(dir)) return false;
   try {
-    accessSync2(dir, constants3.W_OK);
+    accessSync2(dir, constants4.W_OK);
   } catch (err) {
     if (nodeCode(err) === "ENOENT" && writable(dirname4(dir))) return false;
   }
@@ -23406,13 +23479,13 @@ function manifestDirFor(browser) {
 }
 function canHostManifest(dir) {
   try {
-    accessSync2(dir, constants3.W_OK);
+    accessSync2(dir, constants4.W_OK);
     return true;
   } catch (err) {
     if (nodeCode(err) !== "ENOENT") return false;
   }
   try {
-    accessSync2(dirname4(dir), constants3.W_OK);
+    accessSync2(dirname4(dir), constants4.W_OK);
     return true;
   } catch {
     return false;
@@ -23542,7 +23615,7 @@ var linuxAdapter = {
   },
   async caTrustRemover() {
     try {
-      unlinkSync2(DEBIAN_CERT);
+      unlinkSync(DEBIAN_CERT);
     } catch {
     }
     if (!toolOnPath("update-ca-trust")) return;
@@ -23603,7 +23676,7 @@ var win32Adapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync3(manifestDir, constants4.W_OK);
+      accessSync3(manifestDir, constants5.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
@@ -23616,37 +23689,42 @@ var win32Adapter = {
     };
   },
   async caTrustInstaller(certPem) {
-    const tmpPath = join4(tmpdir2(), `rogatio-ca-${Date.now()}.crt`);
     try {
-      writeFileSync2(tmpPath, certPem, "utf8");
-    } catch {
+      await withInstallCertificateFile(certPem, async (certPath) => {
+        const result = await new Promise(
+          (resolve12) => {
+            const child = spawn3("certutil", [
+              "-addstore",
+              "-f",
+              "Root",
+              certPath
+            ]);
+            let stderr = "";
+            child.stderr?.on("data", (data) => {
+              stderr += data.toString();
+            });
+            child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+            child.on(
+              "error",
+              (err) => resolve12({ code: 1, stderr: err.message })
+            );
+          }
+        );
+        if (result.code !== 0) {
+          const stderr = result.stderr.toLowerCase();
+          let reason = "elevation-required";
+          if (stderr.includes("access denied") || stderr.includes("permission")) {
+            reason = "elevation-required";
+          }
+          throw new TrustError("trust.internal", reason, [reason]);
+        }
+      });
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
       throw new TrustError("trust.internal", "elevation-required", [
         "elevation-required"
       ]);
     }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn3("certutil", ["-addstore", "-f", "Root", tmpPath]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
-    try {
-      unlinkSync3(tmpPath);
-    } catch {
-    }
-    if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "elevation-required";
-      if (stderr.includes("access denied") || stderr.includes("permission")) {
-        reason = "elevation-required";
-      }
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
   },
   async caTrustRemover() {
     const result = await new Promise(
@@ -24586,7 +24664,7 @@ async function resolveConfinedRoot(value) {
   }
   let directory;
   try {
-    directory = await open4(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
+    directory = await open4(value, constants6.O_RDONLY | constants6.O_DIRECTORY);
     const info = await directory.stat();
     if (!info.isDirectory()) return failure("runtime.root-invalid");
     return { ok: true, value: await realpath2(value) };
@@ -33439,7 +33517,7 @@ function errorMessage(error) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir5, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod, mkdir as mkdir5, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname10, join as join9, resolve as resolve8 } from "node:path";
 function generateHostWrapper(rogatioCommand, logPath) {
   const parts = rogatioCommand.split(" ");
@@ -33550,11 +33628,11 @@ Note: reload the extension at chrome://extensions for the native host to be dete
     case "uninstall": {
       const uninstallResult = await controller.uninstall();
       try {
-        await rm3(hostPath, { force: true });
+        await rm4(hostPath, { force: true });
       } catch {
       }
       try {
-        await rm3(join9(installRoot, "runtime-host.log"), { force: true });
+        await rm4(join9(installRoot, "runtime-host.log"), { force: true });
       } catch {
       }
       return reportTrust(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.20.2",
+  "version": "6.20.4",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "ajv": "8.20.0",
-    "koffi": "3.3.2"
+    "koffi": "3.3.3"
   },
   "devDependencies": {
     "@rogatio/compiler": "workspace:*",
@@ -50,8 +50,8 @@
     "@rogatio/requestly-import": "workspace:*",
     "@rogatio/runtime": "workspace:*",
     "@rogatio/schema": "workspace:*",
-    "@types/node": "26.6.4",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.3"
+    "vitest": "5.0.4"
   }
 }