cabloy 5.1.228 → 5.1.229

package/.cabloy-version

@@ -1 +1 @@
-5.1.228
+5.1.229

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 5.1.229
+
+### Features
+
+- Update functionality.
+
+### Improvements
+
+- Update `source-map-js` to version 1.2.2 in the documentation dependencies.
+- Refresh the pnpm lockfile.
+
 ## 5.1.228
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.228",
+  "version": "5.1.229",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-agent-governance/tests/evidence-paths.test.mjs

@@ -366,81 +366,45 @@ test('stream fatal UTF-8 and line limit never emit raw fragments of the failing
   await assert.rejects(streamed(['/Users/Secret/raw']), /^Error: INVALID_INPUT$/u);
 });
 
-test('stream rejects binary control bytes on complete and final lines without raw fragments', async () => {
-  for (const byte of [0, 1, 27, 127]) {
-    for (const ending of ['', '\n']) {
-      for (const prefix of ['', '/Users/Secret/file ']) {
-        const bytes = Buffer.concat([
-          Buffer.from(prefix),
-          Buffer.from([byte]),
-          Buffer.from(ending),
-        ]);
-        const bytePosition = Buffer.byteLength(prefix) + 1;
-        const output = sink();
-        await assert.rejects(
-          sanitizeStream(Readable.from([bytes]), output.stream, { matcher }),
-          error => {
-            assert.equal(String(error), 'Error: BINARY');
-            assert.equal(error.code, 'BINARY');
-            assert.deepEqual(error.details, { byte, line: 1, bytePosition });
-            return true;
-          },
-        );
-        assert.equal(output.text(), '');
-        const result = cli(['sanitize'], bytes);
-        assert.equal(result.status, 2);
-        assert.equal(result.stdout, '');
-        assert.equal(
-          result.stderr,
-          `evidence-paths: BINARY byte=${byte} line=1 byte-position=${bytePosition}\n`,
-        );
-      }
-    }
+test('stream preserves controls on complete and final lines while sanitizing paths', async () => {
+  const controls = '\u0000\u0001\u001B\u007F';
+  const input = `${controls}/Users/Secret/file${controls} /Users/Secret${controls} /synthetic/checkout/a${controls} file:///Users/Secret/file${controls}`;
+  const expected = `${controls}<PRIVATE_PATH>${controls} <PRIVATE_PATH>${controls} a${controls} <PRIVATE_PATH>${controls}`;
+  for (const ending of ['', '\n']) {
+    const bytes = Buffer.from(input + ending);
+    assert.equal(await streamed([bytes]), expected + ending);
+    const result = cli(['sanitize', '--repo-root', '/synthetic/checkout'], bytes);
+    assert.equal(result.status, 0);
+    assert.equal(result.stdout, expected + ending);
+    assert.equal(result.stderr, '');
   }
   assert.equal(await streamed([Buffer.from('plain\ttext\f\r\n')]), 'plain\ttext\f\r\n');
 });
 
-test('binary diagnostics use original byte positions across chunks and input lines', async () => {
+test('stream preserves ANSI sequences and controls across UTF-8 chunks and lines', async () => {
+  const input = 'ok\r\n\r\né🙂\u001B[31m /Users/Secret/file\u001B[0m\u0000';
+  const expected = 'ok\r\n\r\né🙂\u001B[31m <PRIVATE_PATH>\u001B[0m\u0000';
   for (const ending of ['', '\n']) {
-    const bytes = Buffer.concat([
-      Buffer.from('ok\r\n\r\né🙂'),
-      Buffer.from([27, 0]),
-      Buffer.from('/Users/Secret/file'),
-      Buffer.from(ending),
-    ]);
+    const bytes = Buffer.from(input + ending);
     for (const chunks of [[bytes], Array.from(bytes, byte => Buffer.from([byte]))]) {
+      assert.equal(await streamed(chunks), expected + ending);
       const output = sink();
-      await assert.rejects(
-        sanitizeStream(Readable.from(chunks), output.stream, { matcher }),
-        error => {
-          assert.equal(String(error), 'Error: BINARY');
-          assert.equal(error.code, 'BINARY');
-          assert.deepEqual(error.details, { byte: 27, line: 3, bytePosition: 7 });
-          return true;
-        },
-      );
-      assert.equal(output.text(), 'ok\r\n\r\n');
-      const cliOutput = sink();
       const errors = sink();
       assert.equal(
         await runCli(['sanitize'], {
           input: Readable.from(chunks),
-          output: cliOutput.stream,
+          output: output.stream,
           error: errors.stream,
         }),
-        2,
+        0,
       );
-      assert.equal(cliOutput.text(), 'ok\r\n\r\n');
-      assert.equal(errors.text(), 'evidence-paths: BINARY byte=27 line=3 byte-position=7\n');
+      assert.equal(output.text(), expected + ending);
+      assert.equal(errors.text(), '');
     }
-    const result = cli(['sanitize'], bytes);
-    assert.equal(result.status, 2);
-    assert.equal(result.stdout, 'ok\r\n\r\n');
-    assert.equal(result.stderr, 'evidence-paths: BINARY byte=27 line=3 byte-position=7\n');
   }
 });
 
-test('line limits retain precedence over binary diagnostics', async () => {
+test('line byte limits still apply to control-containing input', async () => {
   for (const ending of ['', '\n']) {
     const bytes = Buffer.concat([
       Buffer.from([27]),

package/repo-agent-governance/tools/evidence-paths/sanitize.mjs

@@ -9,15 +9,14 @@ export const LINE_LIMIT = 1024 * 1024;
 export const FILE_LIMIT = 8 * 1024 * 1024;
 
 class SafeError extends Error {
-  constructor(code, details) {
+  constructor(code) {
     super(code);
     this.code = code;
-    this.details = details;
   }
 }
 
-function fail(code, details) {
-  throw new SafeError(code, details);
+function fail(code) {
+  throw new SafeError(code);
 }
 
 function rootInfo(value) {
@@ -70,7 +69,7 @@ function pathEnd(text, start, quoted) {
   let end = start;
   while (end < text.length) {
     const char = text[end];
-    if (/[\r\n\t"'`<>(){}[\]|,;!?]/u.test(char) || (!quoted && /\s/u.test(char))) break;
+    if (/[\p{Cc}"'`<>(){}[\]|,;!?]/u.test(char) || (!quoted && /\s/u.test(char))) break;
     // Preserve stack line/column suffixes (and keep other colon-delimited prose out).
     if (char === ':') break;
     end++;
@@ -120,14 +119,15 @@ export function createMatcher({ repoRoot = DEFAULT_REPO_ROOT, maps = [] } = {})
   );
 
   const sep = '(?:\\\\{1,2}|/)';
-  const account = '[^/\\\\\\s"\'`<>(){}[\\]|,;:!?]+(?: [^/\\\\\\s"\'`<>(){}[\\]|,;:!?]+)*';
+  const account =
+    '[^/\\\\\\s\\p{Cc}"\'`<>(){}[\\]|,;:!?]+(?: [^/\\\\\\s\\p{Cc}"\'`<>(){}[\\]|,;:!?]+)*';
   const known = [
-    new RegExp(`/(?:Users|home)/${account}`, 'y'),
+    new RegExp(`/(?:Users|home)/${account}`, 'uy'),
     /\/(?:private\/)?tmp/y,
     /\/(?:private\/)?var\/folders/y,
-    new RegExp(`[A-Z]:${sep}(?:Users${sep}${account}|(?:Windows${sep})?Temp)`, 'iy'),
+    new RegExp(`[A-Z]:${sep}(?:Users${sep}${account}|(?:Windows${sep})?Temp)`, 'iuy'),
     // UNC is a filesystem convention; forward-slash protocol-relative URLs are not.
-    /\\{2,4}[^\\/\s"'`<>(){}[\]|,;:!?]+\\{1,2}[^\\/\s"'`<>(){}[\]|,;:!?]+/y,
+    /\\{2,4}[^\\/\s\p{Cc}"'`<>(){}[\]|,;:!?]+\\{1,2}[^\\/\s\p{Cc}"'`<>(){}[\]|,;:!?]+/uy,
   ];
 
   function recognizeAt(text, start, quoted = false) {
@@ -136,7 +136,7 @@ export function createMatcher({ repoRoot = DEFAULT_REPO_ROOT, maps = [] } = {})
       const match = entry.regex.exec(text);
       if (!match) continue;
       const after = start + match[0].length;
-      if (after < text.length && !/[/\\\s"'`<>(){}[\]|,;:!?]/u.test(text[after])) continue;
+      if (after < text.length && !/[/\\\s\p{Cc}"'`<>(){}[\]|,;:!?]/u.test(text[after])) continue;
       const end = pathEnd(text, after, quoted);
       const tail = normalizeTail(text.slice(after, end), entry.windows).replace(/^\/+|\/+$/gu, '');
       const replacement =
@@ -154,7 +154,7 @@ export function createMatcher({ repoRoot = DEFAULT_REPO_ROOT, maps = [] } = {})
       const match = regex.exec(text);
       if (!match) continue;
       const after = start + match[0].length;
-      if (after < text.length && !/[/\\\s"'`<>(){}[\]|,;:!?]/u.test(text[after])) continue;
+      if (after < text.length && !/[/\\\s\p{Cc}"'`<>(){}[\]|,;:!?]/u.test(text[after])) continue;
       return { end: pathEnd(text, after, quoted), replacement: '<PRIVATE_PATH>' };
     }
     return null;
@@ -164,7 +164,7 @@ export function createMatcher({ repoRoot = DEFAULT_REPO_ROOT, maps = [] } = {})
     if (typeof text !== 'string') fail('INVALID_TEXT');
     const matches = [];
     // Skip non-file URLs as units, including their paths, query strings and fragments.
-    const urls = /[A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/[^\s"'`<>(){}[\]|]+/gu;
+    const urls = /[A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/[^\s\p{Cc}"'`<>(){}[\]|]+/gu;
     const protectedUrls = [...text.matchAll(urls)];
     let urlIndex = 0;
     for (let index = 0; index < text.length; index++) {
@@ -248,7 +248,6 @@ export async function sanitizeStream(input, output, { matcher = createMatcher()
   output.on('error', onError);
   let parts = [];
   let length = 0;
-  let lineNumber = 1;
   try {
     for await (const chunk of input) {
       if (outputFailed) fail('OUTPUT_ERROR');
@@ -264,10 +263,8 @@ export async function sanitizeStream(input, output, { matcher = createMatcher()
         parts.push(bytes.subarray(start, end));
         if (newline < 0) break;
         const line = Buffer.concat(parts, length);
-        rejectBinary(line, lineNumber);
         const text = decode(line);
         await write(output, `${matcher.sanitize(text)}\n`);
-        lineNumber++;
         parts = [];
         length = 0;
         start = newline + 1;
@@ -275,7 +272,6 @@ export async function sanitizeStream(input, output, { matcher = createMatcher()
     }
     if (length) {
       const line = Buffer.concat(parts, length);
-      rejectBinary(line, lineNumber);
       await write(output, matcher.sanitize(decode(line)));
     }
     if (outputFailed) fail('OUTPUT_ERROR');
@@ -296,21 +292,12 @@ function safeFilename(value, matcher) {
     );
 }
 
-function binaryIndex(bytes) {
-  return bytes.findIndex(
+function binary(bytes) {
+  return bytes.some(
     byte => byte === 0 || byte === 127 || (byte < 32 && ![9, 10, 12, 13].includes(byte)),
   );
 }
 
-function binary(bytes) {
-  return binaryIndex(bytes) >= 0;
-}
-
-function rejectBinary(bytes, line) {
-  const index = binaryIndex(bytes);
-  if (index >= 0) fail('BINARY', { byte: bytes[index], line, bytePosition: index + 1 });
-}
-
 async function ancestorExclusion(path) {
   const root = parse(path).root;
   let current = root;
@@ -476,13 +463,11 @@ Stack :line:column suffixes are preserved. Non-file URLs, unrelated API/containe
 paths and unknown absolute roots are left unchanged: this is NOT a universal secret
 scanner. Use explicit maps for other local roots; inspect output before publication.
 UTF-8 decoding is fatal, with a 1 MiB byte limit per line (including CR, excluding LF).
-NUL, DEL and non-text C0 controls are rejected; tab, LF, form feed and CR are allowed.
-sanitize BINARY diagnostics report only the first rejected decimal byte, 1-based input
-line and byte-position within that original UTF-8 line. LF advances the line; CR counts
-as a byte, not a line boundary. No text from the rejected line is reported.
+sanitize preserves control characters without interpreting or stripping them; they do
+not cause BINARY rejection. LF separates lines; CR counts toward the line byte limit.
 Only complete validated lines are emitted; earlier sanitized lines may survive failure.
-check limits each file to 8 MiB, treats NUL/non-text controls as binary, and reports only
-scope-N/relative-filename:line CODE, never source lines or absolute scan roots.
+check limits each file to 8 MiB and treats NUL, DEL and non-text C0 controls as binary.
+It reports only scope-N/relative-filename:line CODE, never source lines or absolute scan roots.
 Symlinks (including scope ancestors), special files, .env* files/directories, unreadable,
 binary, invalid UTF-8 and over-limit files make checking incomplete. Scope trees must
 remain stable while scanning; this is not an adversarial filesystem snapshot.
@@ -545,23 +530,8 @@ export async function runCli(
     return result.status;
   } catch (caught) {
     const code = caught instanceof SafeError ? caught.code : 'INTERNAL_ERROR';
-    let diagnostic = code;
-    if (caught instanceof SafeError && code === 'BINARY') {
-      const { byte, line, bytePosition } = caught.details ?? {};
-      if (
-        Number.isInteger(byte) &&
-        byte >= 0 &&
-        byte <= 255 &&
-        Number.isSafeInteger(line) &&
-        line > 0 &&
-        Number.isSafeInteger(bytePosition) &&
-        bytePosition > 0
-      ) {
-        diagnostic += ` byte=${byte} line=${line} byte-position=${bytePosition}`;
-      }
-    }
     try {
-      await write(error, `evidence-paths: ${diagnostic}\n`);
+      await write(error, `evidence-paths: ${code}\n`);
     } catch {
       /* no unsafe fallback */
     }

package/repo-docs/pnpm-lock.yaml

@@ -697,8 +697,8 @@ packages:
   shiki@2.5.0:
     resolution: {integrity: sha512-mI//trrsaiCIPsja5CNfsyNOqgAZUb6VpJA+340toL42UpzQlXpwRV9nch69X6gaUxrr9kaOOa6e3y3uAkGFxQ==}
 
-  source-map-js@1.2.1:
-    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
     engines: {node: '>=0.10.0'}
 
   space-separated-tokens@2.0.2:
@@ -1175,7 +1175,7 @@ snapshots:
       '@vue/shared': 3.5.35
       entities: 7.0.1
       estree-walker: 2.0.2
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   '@vue/compiler-dom@3.5.35':
     dependencies:
@@ -1192,7 +1192,7 @@ snapshots:
       estree-walker: 2.0.2
       magic-string: 0.30.21
       postcss: 8.5.15
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   '@vue/compiler-ssr@3.5.35':
     dependencies:
@@ -1425,7 +1425,7 @@ snapshots:
     dependencies:
       nanoid: 3.3.12
       picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   preact@10.29.2: {}
 
@@ -1487,7 +1487,7 @@ snapshots:
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
 
-  source-map-js@1.2.1: {}
+  source-map-js@1.2.2: {}
 
   space-separated-tokens@2.0.2: {}
 

package/zova/pnpm-lock.yaml

@@ -610,7 +610,7 @@ importers:
         specifier: ^7.6.2
         version: 7.8.5
       zova-cli-set-front:
-        specifier: ^1.2.118
+        specifier: ^1.2.119
         version: link:../cli-set-front
     devDependencies:
       clean-package: