af360 0.1.15 → 0.1.16

package/dist/node_modules/source-map-js/lib/source-map-consumer.js

@@ -11,6 +11,14 @@ var ArraySet = require('./array-set').ArraySet;
 var base64VLQ = require('./base64-vlq');
 var quickSort = require('./quick-sort').quickSort;
 
+// Upper bound for a section's `offset.line` in an indexed source map. A flat
+// map spends one ';' per generated line, so a tiny indexed map with a huge
+// offset.line turns into a huge amount of work and memory once its mappings
+// are copied into a SourceMapGenerator (CVE-2026-93749). Ten million lines is
+// far beyond any real generated file. Columns are VLQ-encoded as deltas and
+// don't amplify, so they only need to be valid integers.
+var MAX_SECTION_OFFSET_LINE = 1e7;
+
 function SourceMapConsumer(aSourceMap, aSourceMapURL) {
   var sourceMap = aSourceMap;
   if (typeof aSourceMap === 'string') {
@@ -935,6 +943,7 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     line: -1,
     column: 0
   };
+  var maxOffsetLine = 0;
   this._sections = sections.map(function (s) {
     if (s.url) {
       // The url field will require support for asynchronicity.
@@ -945,12 +954,32 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     var offsetLine = util.getArg(offset, 'line');
     var offsetColumn = util.getArg(offset, 'column');
 
+    if (!isValidOffset(offsetLine) || !isValidOffset(offsetColumn)) {
+      throw new Error('Section offset line and column must be non-negative integers.');
+    }
+    if (offsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE + '.');
+    }
+
     if (offsetLine < lastOffset.line ||
         (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
       throw new Error('Section offsets must be ordered and non-overlapping.');
     }
     lastOffset = offset;
 
+    var consumer = new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL);
+
+    // Offsets of a nested indexed map add up with this one, so apply the
+    // bound to the total.
+    var totalOffsetLine = offsetLine + (consumer._maxOffsetLine || 0);
+    if (totalOffsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE +
+                      ', including offsets of nested sections.');
+    }
+    if (totalOffsetLine > maxOffsetLine) {
+      maxOffsetLine = totalOffsetLine;
+    }
+
     return {
       generatedOffset: {
         // The offset fields are 0-based, but we use 1-based indices when
@@ -958,9 +987,24 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
         generatedLine: offsetLine + 1,
         generatedColumn: offsetColumn + 1
       },
-      consumer: new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL)
+      consumer: consumer
     }
   });
+
+  // The largest offset.line of any section, including nested sections.
+  this._maxOffsetLine = maxOffsetLine;
+}
+
+/**
+ * Section offsets come from untrusted input and are used as line/column
+ * numbers, so only accept non-negative safe integers (rejects NaN, Infinity,
+ * strings, fractions, etc).
+ */
+function isValidOffset(aValue) {
+  return typeof aValue === 'number' &&
+    aValue >= 0 &&
+    aValue <= 9007199254740991 && // Number.MAX_SAFE_INTEGER
+    Math.floor(aValue) === aValue;
 }
 
 IndexedSourceMapConsumer.prototype = Object.create(SourceMapConsumer.prototype);
@@ -978,8 +1022,12 @@ Object.defineProperty(IndexedSourceMapConsumer.prototype, 'sources', {
   get: function () {
     var sources = [];
     for (var i = 0; i < this._sections.length; i++) {
-      for (var j = 0; j < this._sections[i].consumer.sources.length; j++) {
-        sources.push(this._sections[i].consumer.sources[j]);
+      // Read the getter once per section: for a nested indexed map it is
+      // itself this getter, and re-reading it per item is exponential in the
+      // nesting depth (CVE-2026-93749).
+      var sectionSources = this._sections[i].consumer.sources;
+      for (var j = 0; j < sectionSources.length; j++) {
+        sources.push(sectionSources[j]);
       }
     }
     return sources;

package/dist/node_modules/source-map-js/lib/source-map-generator.js

@@ -348,10 +348,12 @@ SourceMapGenerator.prototype._serializeMappings =
 
       if (mapping.generatedLine !== previousGeneratedLine) {
         previousGeneratedColumn = 0;
-        while (mapping.generatedLine !== previousGeneratedLine) {
-          next += ';';
-          previousGeneratedLine++;
-        }
+        // One ';' per skipped line. Build large gaps with a single flat
+        // string: appending ';' one by one creates a rope node per line, which
+        // can exhaust the heap for a big gap (CVE-2026-93749).
+        var lineDelta = mapping.generatedLine - previousGeneratedLine;
+        next += lineDelta === 1 ? ';' : ';'.repeat(lineDelta);
+        previousGeneratedLine = mapping.generatedLine;
       }
       else {
         if (i > 0) {

package/dist/node_modules/source-map-js/lib/source-node.js

@@ -113,6 +113,13 @@ SourceNode.fromStringWithSourceMap =
       // to the SourceNode without any mapping.
       // Each line is added as separate string.
       while (lastGeneratedLine < mapping.generatedLine) {
+        if (remainingLinesIndex >= remainingLines.length) {
+          // The generated code is exhausted. Skip the rest instead of adding
+          // empty lines one by one: a mapping may point far past the end of
+          // the code (e.g. an indexed map section with a huge offset.line).
+          lastGeneratedLine = mapping.generatedLine;
+          break;
+        }
         node.add(shiftNextLine());
         lastGeneratedLine++;
       }

package/dist/node_modules/source-map-js/package.json

@@ -1,7 +1,7 @@
 {
   "name": "source-map-js",
   "description": "Generates and consumes source maps",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "homepage": "https://github.com/7rulnik/source-map-js",
   "author": "Valentin 7rulnik Semirulnik <v7rulnik@gmail.com>",
   "contributors": [

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "af360",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Watches the things you have built - folders, repos and sites - and tells you what needs you. Runs entirely on your own machine.",
   "license": "UNLICENSED",
   "author": "Afeleos LLC",
@@ -60,13 +60,13 @@
   },
   "overrides": {
     "postcss": "^8.5.23",
-    "sharp": "^0.35.0"
+    "sharp": "^0.35.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.2.4",
-    "next": "^15.5.24",
+    "next": "^15.5.27",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "typescript": "^5.6.0"

package/docs/legal/PRIVACY.md

@@ -8,7 +8,7 @@
 af360 reads the folders you choose to watch and the websites you choose to watch. It reads them to tell you what is going on; it never changes anything inside them.
 
 ## What af360 keeps, and where
-Everything af360 remembers lives in one folder on your machine: `C:\Users\<your name>\.af360`. That is your settings, your list of watched folders and sites, and af360's own log of what it looked at and when. The log covers the last seven days. Older entries stop being shown at once, and are deleted from the file within a day. af360 itself copies nothing off the machine.
+Everything af360 remembers lives in one folder on your machine: `C:\Users\<your name>\.af360`. That is your settings, your list of watched folders and sites, and af360's own log of what it looked at and when. The log covers the last seven days. Older entries stop being shown at once, and are deleted from the file within a day. The same folder holds `launch.log`, which records only the steps of each start of af360 - when it started and how far it got - holds nothing from your folders or sites, and stays on your machine. af360 itself copies nothing off the machine.
 
 ## What af360 sends, and to whom
 af360 makes no connection on its own. Each of these happens only because you turned it on, and each has its own switch in Settings:

package/lib/mask.mjs

@@ -92,6 +92,14 @@ export function looksLikeSettingName(name) {
  *   - then the shape-based rules (JWT, long hex, long base64), which are the
  *     catch-all for a key nobody has a pattern for yet.
  */
+/** A slash-separated run of lowercase segments - an estate path, not a key.
+ *  See the base64 rule in `mask` for why each condition is there. */
+export function looksLikePath(run) {
+  if (!run.includes("/") || run.includes("+") || /[A-Z=]/.test(run)) return false;
+  const segs = run.split("/").filter(Boolean);
+  return segs.length >= 2 && segs.every((s) => /^[a-z0-9]+$/.test(s) && /[a-z]/.test(s));
+}
+
 export function mask(text) {
   let t = text;
 
@@ -163,7 +171,19 @@ export function mask(text) {
   t = t.replace(/(?<![A-Za-z0-9])[0-9a-f]{32,}(?![A-Za-z0-9])/gi, SECRET_MASK);
 
   // a long unbroken base64-ish run is not a word anybody typed on purpose
-  t = t.replace(/(?<![A-Za-z0-9])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g, SECRET_MASK);
+  /* ~~...EXCEPT WHEN IT IS A PATH.~~ **A PATH IS NOT A KEY** (sitting 52, step
+     3b, the owner's export: "[secret masked].csv/+server.ts"). Measured on his
+     own inventory: `src/routes/fabrication/consumables/export.csv/+server.ts`
+     - the run before `.csv` is 41 characters of letters and `/`, so this rule
+     ate a file-gone finding whose path IS the finding; its six siblings
+     survived only because a `[bracket]` broke their runs.
+     THE EXCEPTION IS NARROW ON PURPOSE: the run must contain `/`, no `+`, no
+     uppercase letter, and every `/` segment must be lowercase letters and
+     digits. Base64 key material is mixed-case by construction, so a run with
+     ONE uppercase letter or a `+` is still masked here, and every other rule
+     above and below is untouched - a secret in CONTENT stays masked. */
+  t = t.replace(/(?<![A-Za-z0-9])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g, (run) =>
+    looksLikePath(run) ? run : SECRET_MASK);
 
   return t;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "af360",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Watches the things you have built - folders, repos and sites - and tells you what needs you. Runs entirely on your own machine.",
   "license": "UNLICENSED",
   "author": "Afeleos LLC",
@@ -60,13 +60,13 @@
   },
   "overrides": {
     "postcss": "^8.5.23",
-    "sharp": "^0.35.0"
+    "sharp": "^0.35.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.2.4",
-    "next": "^15.5.24",
+    "next": "^15.5.27",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "typescript": "^5.6.0"

package/scripts/mcp-server.mjs

@@ -524,7 +524,9 @@ const TOOLS = [
       ...envelope(look, now),
       empty: look.empty,
       state: look.estate.state,
-      needsYou: look.estate.open,
+      /* sitting 50 A2: the needs-you number (rows + safety). An older record
+         carries no `needs` and answers with the row count it always did. */
+      needsYou: look.estate.needs ?? look.estate.open,
       headline: look.estate.line,
       under: look.estate.under,
       watching: look.estate.counts,
@@ -715,14 +717,22 @@ const TOOLS = [
       "The sites af360 watches and the last confirmed reading for each: answering or down, the status code, and " +
       "when that reading was taken. An unconfirmed miss is never reported as an outage. Read-only, from the last look.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    run: (look, now) => ({
-      ...envelope(look, now),
-      count: look.sites.length,
-      sites: look.sites,
-      honesty:
-        "ok null means af360 has no confirmed reading for this site yet. One missed check is a hiccup, not an " +
-        "outage, so a single failure never appears here as down.",
-    }),
+    /* F1's amendment (owner ruling 2026-10-22): the room's own role travels in
+       each row, so an agent is never told a dependency is a site that is down. */
+    run: (look, now) => {
+      const role = (s) => (s && s.role === "dependency" ? "dependency" : "site");
+      return {
+        ...envelope(look, now),
+        count: look.sites.filter((s) => role(s) === "site").length,
+        dependencies: look.sites.filter((s) => role(s) === "dependency").length,
+        sites: look.sites.map((s) => ({ ...s, role: role(s) })),
+        honesty:
+          "ok null means af360 has no confirmed reading for this site yet. One missed check is a hiccup, not an " +
+          "outage, so a single failure never appears here as down. A row with role \"dependency\" is an address " +
+          "the user's project uses rather than runs: for it ok means only asked and answered, and af360 makes no " +
+          "up or down judgment about it.",
+      };
+    },
   },
   {
     name: "blast_radius",