arcane-os 0.1.0-dev.5

package/runtime/arcane/modules/RiskSignalAnalyzer.js

@@ -0,0 +1,37 @@
+const DEFAULT_LEVELS=Object.freeze([
+    {minimum:70,id:'critical'},
+    {minimum:40,id:'high'},
+    {minimum:15,id:'caution'},
+    {minimum:0,id:'low'},
+]);
+
+function normalizeText(value,maxLength){
+    return String(value??'').normalize('NFKC').slice(0,maxLength);
+}
+
+export function analyzeRiskSignals(input,{signals=[],levels=DEFAULT_LEVELS,maxLength=20_000}={}){
+    const text=normalizeText(input,maxLength);
+    const matches=[];
+    let score=0;
+
+    for(const signal of signals){
+        if(!signal||typeof signal.id!=='string'||!(signal.pattern instanceof RegExp))continue;
+        signal.pattern.lastIndex=0;
+        if(!signal.pattern.test(text))continue;
+        const weight=Math.max(0,Math.min(100,Number(signal.weight)||0));
+        score+=weight;
+        matches.push({
+            id:signal.id,
+            label:String(signal.label||signal.id),
+            weight,
+            guidance:String(signal.guidance||''),
+        });
+    }
+
+    score=Math.min(100,score);
+    const ordered=[...levels].sort((a,b)=>b.minimum-a.minimum);
+    const level=ordered.find(candidate=>score>=candidate.minimum)?.id||'unknown';
+    return Object.freeze({level,matches:Object.freeze(matches),score,textLength:text.length,truncated:String(input??'').length>text.length});
+}
+
+export {DEFAULT_LEVELS};

package/runtime/arcane/modules/ScamRiskPolicy.js

@@ -0,0 +1,62 @@
+import {analyzeRiskSignals} from './RiskSignalAnalyzer.js';
+import {canonicalNetworkHostname,emptyArcaneNetworkPolicy,findDeniedDomainRule,loadArcaneNetworkPolicy} from './ArcaneNetworkPolicy.js?v=3';
+
+export const scamRiskSignals=Object.freeze([
+    {id:'urgency',label:'Urgency or secrecy pressure',weight:18,pattern:/\b(urgent|immediately|act now|do not tell|keep (?:this|it) secret|stay on the line)\b/i,guidance:'Pause. A legitimate organization will let you verify independently.'},
+    {id:'payment',label:'Unusual payment request',weight:32,pattern:/\b(gift cards?|bitcoin|crypto(?:currency)?|wire transfer|cash courier|payment app|prepaid cards?)\b/i,guidance:'Do not pay. Contact the organization using a trusted number.'},
+    {id:'credential',label:'Credential or access request',weight:35,pattern:/\b(password|passcode|verification code|one[- ]time code|otp|remote access|screen share)\b/i,guidance:'Never share security codes or grant remote access to an unexpected contact.'},
+    {id:'impersonation',label:'Authority or family impersonation',weight:24,pattern:/\b(irs|social security|medicare|police|sheriff|grandson|granddaughter|family emergency|tech support)\b/i,guidance:'End the contact and verify through an independently found official channel.'},
+    {id:'threat',label:'Threat or fear tactic',weight:28,pattern:/\b(arrest|warrant|deport|account (?:will be )?closed|service (?:will be )?cut off|in danger|kidnapped)\b/i,guidance:'Threats are designed to prevent careful checking. Stop and contact someone you trust.'},
+    {id:'prize',label:'Unexpected prize or refund',weight:20,pattern:/\b(lottery|sweepstakes|prize|inheritance|refund|you(?: have|'ve) won)\b/i,guidance:'Do not pay a fee or disclose information to receive an unexpected benefit.'},
+    {id:'link',label:'Pressure to open a link',weight:16,pattern:/\b(click|tap|open|visit|follow)\b.{0,36}\b(link|url|website)\b/i,guidance:'Do not use an unexpected link. Open the official app or type a trusted address yourself.'},
+]);
+
+const blockedDomainSignal=Object.freeze({
+    id:'blocked-domain',
+    label:'Domain blocked by Arcane network policy',
+    weight:55,
+    guidance:'Do not open or contact this domain. Arcane has a system-wide safety rule blocking it.',
+});
+let activeNetworkPolicy=emptyArcaneNetworkPolicy();
+let activeNetworkPolicyLoadSequence=0;
+let nextNetworkPolicyLoadSequence=0;
+
+function candidateHostnames(value){
+    const text=String(value??'').normalize('NFKC').slice(0,20_000),hostnames=new Set();
+    const add=value=>{
+        const candidate=String(value).replace(/^[([{<'"]+|[\])}>'",.;!?]+$/g,'');
+        try{
+            const hostname=/^https?:\/\//i.test(candidate)?new URL(candidate).hostname:candidate,canonical=canonicalNetworkHostname(hostname);
+            if(canonical)hostnames.add(canonical);
+        }catch{}
+    };
+    for(const match of text.matchAll(/\bhttps?:\/\/[^\s<>"']+/gi))add(match[0]);
+    for(const match of text.matchAll(/(?<![\p{L}\p{N}-])(?:www\.)?(?:[\p{L}\p{N}](?:[\p{L}\p{N}-]{0,61}[\p{L}\p{N}])?\.)+[\p{L}\p{N}](?:[\p{L}\p{N}-]{0,61}[\p{L}\p{N}])?(?![\p{L}\p{N}-])/giu))add(match[0]);
+    return hostnames;
+}
+
+function levelForScore(score){if(score>=70)return 'critical';if(score>=40)return 'high';if(score>=15)return 'caution';return 'low';}
+
+export async function loadScamNetworkPolicy(options){
+    const loadSequence=++nextNetworkPolicyLoadSequence,networkPolicy=await loadArcaneNetworkPolicy(options);
+    if(networkPolicy.generation>activeNetworkPolicy.generation||(networkPolicy.generation===activeNetworkPolicy.generation&&loadSequence>activeNetworkPolicyLoadSequence)){
+        activeNetworkPolicy=networkPolicy;
+        activeNetworkPolicyLoadSequence=loadSequence;
+    }
+    return networkPolicy;
+}
+
+export function assessScamRisk(text,{networkPolicy=activeNetworkPolicy}={}){
+    const result=analyzeRiskSignals(text,{signals:scamRiskSignals});
+    let blocked=false;
+    for(const hostname of candidateHostnames(text)){if(findDeniedDomainRule(networkPolicy,hostname)){blocked=true;break;}}
+    if(!blocked)return result;
+    const score=Math.min(100,result.score+blockedDomainSignal.weight);
+    return Object.freeze({...result,score,level:levelForScore(score),matches:Object.freeze([...result.matches,blockedDomainSignal])});
+}
+
+export function scamSafetyGuidance(result){
+    if(result.level==='critical'||result.level==='high')return 'Stop contact. Do not send money, codes, or personal information. Verify independently and ask a trusted person for help.';
+    if(result.level==='caution')return 'Pause and verify the sender using contact information you already trust.';
+    return 'No strong warning signs were detected, but automated checks can miss scams. Stay cautious.';
+}

package/runtime/arcane/modules/ScopedOPFSCache.js

@@ -0,0 +1,183 @@
+import {
+    canonicalApplicationId,
+    openApplicationDataDirectory
+} from './AppDataScope.js';
+
+const DEFAULT_MAX_ENTRY_BYTES=4*1024*1024;
+const MAX_NAMESPACE_LENGTH=96;
+const MAX_KEY_LENGTH=240;
+
+function safeSegment(value,label,maximum){
+    if(typeof value!=='string'){
+        throw new TypeError(`${label} must be a string.`);
+    }
+    const normalized=value.trim();
+    if(!normalized||normalized.length>maximum){
+        throw new RangeError(`${label} must contain between 1 and ${maximum} characters.`);
+    }
+    if(normalized==='.'||normalized==='..'||/[\\/\0]/u.test(normalized)){
+        throw new TypeError(`${label} must be one filename-safe segment.`);
+    }
+    return normalized;
+}
+
+function positiveInteger(value,label,maximum){
+    if(!Number.isSafeInteger(value)||value<1||value>maximum){
+        throw new RangeError(`${label} must be an integer between 1 and ${maximum}.`);
+    }
+    return value;
+}
+
+function unavailable(){
+    const error=new Error('Origin Private File System storage is unavailable in this browser.');
+    error.code='OPFS_UNAVAILABLE';
+    return error;
+}
+
+function entryTooLarge(maximum){
+    const error=new RangeError(`The cache entry exceeds the ${maximum}-byte limit.`);
+    error.code='OPFS_CACHE_ENTRY_TOO_LARGE';
+    return error;
+}
+
+/**
+ * A deliberately narrow JSON cache over one application-owned OPFS directory.
+ *
+ * It exposes only exact-key get, set, and delete operations. It never enumerates,
+ * exports, restores, clears, or selects another namespace, so one consumer cannot
+ * accidentally mutate unrelated origin storage.
+ */
+export default class ScopedOPFSCache{
+    #applicationId;
+    #arcane;
+    #directoryPromise=null;
+    #documentObject;
+    #maxEntryBytes;
+    #namespace;
+    #storage;
+
+    constructor({
+        applicationId=null,
+        namespace,
+        maxEntryBytes=DEFAULT_MAX_ENTRY_BYTES,
+        storage=globalThis.navigator?.storage,
+        documentObject=globalThis.document,
+        arcane=globalThis.Arcane
+    }={}){
+        this.#applicationId=applicationId==null||applicationId===''
+            ?null
+            :canonicalApplicationId(applicationId);
+        this.#namespace=safeSegment(namespace,'namespace',MAX_NAMESPACE_LENGTH);
+        this.#maxEntryBytes=positiveInteger(maxEntryBytes,'maxEntryBytes',64*1024*1024);
+        if(!storage||typeof storage.getDirectory!=='function'){
+            throw unavailable();
+        }
+        this.#storage=storage;
+        this.#documentObject=documentObject;
+        this.#arcane=arcane;
+    }
+
+    static supported(storage=globalThis.navigator?.storage){
+        return Boolean(storage&&typeof storage.getDirectory==='function');
+    }
+
+    get namespace(){
+        return this.#namespace;
+    }
+
+    get applicationId(){
+        return this.#applicationId;
+    }
+
+    get maxEntryBytes(){
+        return this.#maxEntryBytes;
+    }
+
+    async #directory(){
+        if(!this.#directoryPromise){
+            this.#directoryPromise=(async()=>{
+                const scope=await openApplicationDataDirectory({
+                    storage:this.#storage,
+                    applicationId:this.#applicationId,
+                    documentObject:this.#documentObject,
+                    arcane:this.#arcane,
+                    create:true
+                });
+                this.#applicationId=scope.applicationId;
+                return scope.directory.getDirectoryHandle(
+                    this.#namespace,
+                    {create:true}
+                );
+            })().catch(error=>{
+                this.#directoryPromise=null;
+                throw error;
+            });
+        }
+        return this.#directoryPromise;
+    }
+
+    async get(key){
+        const normalized=safeSegment(key,'key',MAX_KEY_LENGTH);
+        try{
+            const directory=await this.#directory();
+            const handle=await directory.getFileHandle(normalized);
+            const file=await handle.getFile();
+            if(file.size>this.#maxEntryBytes){
+                await this.delete(normalized).catch(()=>{});
+                return undefined;
+            }
+            const source=await file.text();
+            if(new TextEncoder().encode(source).byteLength>this.#maxEntryBytes){
+                await this.delete(normalized).catch(()=>{});
+                return undefined;
+            }
+            try{
+                return JSON.parse(source);
+            }catch{
+                await this.delete(normalized).catch(()=>{});
+                return undefined;
+            }
+        }catch(error){
+            if(error?.name==='NotFoundError'||error?.code==='ENOENT'){
+                return undefined;
+            }
+            throw error;
+        }
+    }
+
+    async set(key,value){
+        const normalized=safeSegment(key,'key',MAX_KEY_LENGTH);
+        const source=JSON.stringify(value);
+        if(source===undefined){
+            throw new TypeError('Cache values must be JSON serializable.');
+        }
+        if(new TextEncoder().encode(source).byteLength>this.#maxEntryBytes){
+            throw entryTooLarge(this.#maxEntryBytes);
+        }
+        const directory=await this.#directory();
+        const handle=await directory.getFileHandle(normalized,{create:true});
+        const writable=await handle.createWritable();
+        try{
+            await writable.write(source);
+            await writable.close();
+        }catch(error){
+            await writable.abort?.().catch(()=>{});
+            throw error;
+        }
+        return value;
+    }
+
+    async delete(key){
+        const normalized=safeSegment(key,'key',MAX_KEY_LENGTH);
+        const directory=await this.#directory();
+        try{
+            await directory.removeEntry(normalized);
+            return true;
+        }catch(error){
+            if(error?.name==='NotFoundError'||error?.code==='ENOENT'){
+                return false;
+            }
+            throw error;
+        }
+    }
+}

package/runtime/arcane/modules/ScreenCapture.js

@@ -0,0 +1,20 @@
+import GifEncoder from './GifEncoder.js';
+
+function captureEvent(type,detail){return new CustomEvent(`capture-${type}`,{detail});}
+function canvasBlob(canvas,type,quality){return new Promise((resolve,reject)=>canvas.toBlob(blob=>blob?resolve(blob):reject(new Error('Unable to encode the captured image.')),type,quality));}
+function supportedRecorderType(Recorder){for(const type of ['video/webm;codecs=vp9,opus','video/webm;codecs=vp8,opus','video/webm','video/mp4'])if(Recorder.isTypeSupported?.(type))return type;return '';}
+
+export default class ScreenCapture extends EventTarget{
+    constructor({mediaDevices=globalThis.navigator?.mediaDevices,Recorder=globalThis.MediaRecorder,documentRef=globalThis.document}={}){super();this.mediaDevices=mediaDevices;this.Recorder=Recorder;this.document=documentRef;this.mode='idle';this.stream=null;this.recorder=null;this.startedAt=0;this.frames=[];this.timer=0;this.video=null;this.canvas=null;this.stopPromise=null;}
+    available(){return Boolean(this.mediaDevices?.getDisplayMedia&&this.document);}
+    async acquire({audio=false}={}){if(!this.available())throw new Error('Display capture is unavailable in this browser.');return this.mediaDevices.getDisplayMedia({video:{frameRate:{ideal:15,max:30}},audio:Boolean(audio)});}
+    async captureImage({maxWidth=1920,type='image/png'}={}){this.assertIdle();this.emit('requesting',{mode:'image'});let stream;try{stream=await this.acquire();const {video,canvas}=await this.prepare(stream,maxWidth);canvas.getContext('2d').drawImage(video,0,0,canvas.width,canvas.height);const blob=await canvasBlob(canvas,type);const result={blob,mimeType:type,extension:type==='image/jpeg'?'jpg':'png',duration:0,width:canvas.width,height:canvas.height};this.emit('result',result);return result}catch(error){this.emit('error',{error,mode:'image'});throw error}finally{this.stopTracks(stream)}}
+    async startVideo({audio=true}={}){this.assertIdle();if(!this.Recorder)throw new Error('Video recording is unavailable in this browser.');this.emit('requesting',{mode:'video'});this.stream=await this.acquire({audio});const mimeType=supportedRecorderType(this.Recorder);const chunks=[];this.recorder=new this.Recorder(this.stream,mimeType?{mimeType}:undefined);this.stopPromise=new Promise((resolve,reject)=>{this.recorder.addEventListener('dataavailable',event=>{if(event.data?.size)chunks.push(event.data)});this.recorder.addEventListener('stop',()=>{const type=this.recorder.mimeType||mimeType||'video/webm';resolve({blob:new Blob(chunks,{type}),mimeType:type,extension:type.includes('mp4')?'mp4':'webm',duration:Date.now()-this.startedAt})},{once:true});this.recorder.addEventListener('error',event=>reject(event.error||new Error('Video recording failed.')),{once:true})});this.mode='video';this.startedAt=Date.now();this.recorder.start(500);this.emit('start',{mode:'video'});return true;}
+    async startGif({maxWidth=640,frameDelay=250}={}){this.assertIdle();this.emit('requesting',{mode:'gif'});this.stream=await this.acquire();const prepared=await this.prepare(this.stream,maxWidth);this.video=prepared.video;this.canvas=prepared.canvas;this.frames=[];this.mode='gif';this.startedAt=Date.now();const context=this.canvas.getContext('2d',{willReadFrequently:true});const sample=()=>{context.drawImage(this.video,0,0,this.canvas.width,this.canvas.height);this.frames.push(context.getImageData(0,0,this.canvas.width,this.canvas.height))};sample();this.timer=setInterval(sample,Math.max(100,frameDelay));this.gifDelay=Math.max(100,frameDelay);this.emit('start',{mode:'gif'});return true;}
+    async stop(){if(this.mode==='idle')return null;const mode=this.mode;try{let result;if(mode==='video'){this.recorder.stop();result=await this.stopPromise}else{clearInterval(this.timer);const encoder=new GifEncoder(this.canvas.width,this.canvas.height);for(const frame of this.frames)encoder.addFrame(frame,{delay:this.gifDelay});result={blob:encoder.encode(),mimeType:'image/gif',extension:'gif',duration:Date.now()-this.startedAt,width:this.canvas.width,height:this.canvas.height}}this.emit('result',result);return result}catch(error){this.emit('error',{error,mode});throw error}finally{this.stopTracks(this.stream);this.reset()}}
+    assertIdle(){if(this.mode!=='idle')throw new Error('Stop the active capture before starting another one.');}
+    async prepare(stream,maxWidth){const video=this.document.createElement('video');video.muted=true;video.playsInline=true;video.srcObject=stream;await new Promise((resolve,reject)=>{video.addEventListener('loadedmetadata',resolve,{once:true});video.addEventListener('error',()=>reject(new Error('Unable to read the selected display.')),{once:true})});await video.play();const scale=Math.min(1,Math.max(1,Number(maxWidth)||1920)/video.videoWidth);const canvas=this.document.createElement('canvas');canvas.width=Math.max(1,Math.round(video.videoWidth*scale));canvas.height=Math.max(1,Math.round(video.videoHeight*scale));return {video,canvas};}
+    stopTracks(stream){for(const track of stream?.getTracks?.()||[])track.stop()}
+    reset(){clearInterval(this.timer);this.mode='idle';this.stream=null;this.recorder=null;this.frames=[];this.timer=0;this.video=null;this.canvas=null;this.stopPromise=null;this.startedAt=0;this.emit('stop',{});}
+    emit(type,detail){this.dispatchEvent(captureEvent(type,detail));}
+}