deepadb 1.1.1 → 1.1.3

package/build/middleware/fs-utils.js

@@ -0,0 +1,229 @@
+// Copyright 2026 Jason <fullread@github>
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Filesystem Utilities - Shared helpers for safe on-disk state.
+ *
+ * Four primitives used across DeepADB tempDir-backed storage:
+ *
+ *   1. ensurePrivateDir(path) - Create a directory with restrictive
+ *      permissions (0o700 on Unix; mode bits ignored on Windows). Use
+ *      everywhere we create a subdirectory under tempDir. Defends against
+ *      other-user reads on shared Unix hosts.
+ *
+ *   2. writeAtomicSync(path, data) - Write via a unique-per-call .tmp
+ *      path then atomic rename. Defends against (a) mid-write crashes
+ *      leaving corrupt data on disk, (b) concurrent readers seeing a
+ *      partially-written file, (c) concurrent writers to the same path
+ *      racing on .tmp filenames.
+ *
+ *   3. sanitizeFilenameComponent(name, maxLen?) - Replace any character
+ *      outside [a-zA-Z0-9_-] with underscore. Optional maxLen truncates
+ *      the result. Empty results are coerced to "_" so the caller never
+ *      receives a zero-length component. Centralizes the pattern used
+ *      across several tool modules for user-supplied identifier strings.
+ *
+ *   4. sanitizeFilenameComponentDotted(name, maxLen?) - Like (3) but
+ *      ALSO allows "." in the output (for package names like
+ *      "com.example.app"). Defangs pure-dot strings (".", "..", "...")
+ *      by coercing them to "_", so a caller using the result directly
+ *      as a path component cannot be steered into parent-directory
+ *      traversal by an adversarial input.
+ *
+ * Note on existing directories: ensurePrivateDir only sets mode on
+ * directories it CREATES. Directories that already exist (from older
+ * DeepADB versions) keep their existing permissions. To remediate, the
+ * operator can chmod 700 the affected directories manually, or just
+ * delete them so they are recreated with the new mode.
+ */
+import { mkdirSync, writeFileSync, renameSync, unlinkSync, readFileSync, openSync, fsyncSync, closeSync } from "fs";
+import { resolve } from "path";
+import { randomBytes } from "crypto";
+/** Create directory with owner-only permissions. Idempotent. */
+export function ensurePrivateDir(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+}
+/** Atomic write: unique .tmp + rename. Throws on failure (caller handles). */
+export function writeAtomicSync(path, data) {
+    // Unique per call: process + time + 4 random bytes. Defends against
+    // concurrent writers to the same target path (each picks its own .tmp).
+    const suffix = randomBytes(4).toString("hex");
+    const tmp = `${path}.${process.pid}.${Date.now()}.${suffix}.tmp`;
+    try {
+        writeFileSync(tmp, data);
+        // A4 fix: fsync the .tmp file's contents to durable storage BEFORE the
+        // atomic rename. Without this, a system crash between write and rename
+        // could leave the target file pointing at an empty or partial inode
+        // (the rename is atomic at the directory-entry level, but the data
+        // blocks of the renamed inode may not have been flushed yet on some
+        // filesystems). Cost: one extra syscall per write; negligible compared
+        // to the protection against crash-induced corruption of profiles,
+        // baselines, snapshots, and other persistent state. Falls through on
+        // platforms where fsync raises (rare in practice) — the rename still
+        // happens, matching pre-fix behavior.
+        try {
+            const fd = openSync(tmp, "r+");
+            try {
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch { /* fsync best-effort; do not block the rename */ }
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        // Cleanup any partial state. If writeFileSync failed early, tmp may
+        // not exist; that is fine - unlinkSync just throws which we swallow.
+        try {
+            unlinkSync(tmp);
+        }
+        catch { /* ignore */ }
+        throw e;
+    }
+}
+/**
+ * Sanitize a string for use as a filename component. Replaces every
+ * character outside [a-zA-Z0-9_-] with "_".
+ *
+ * Safe against path traversal because `.`, `/`, and `\\` are all outside
+ * the allowlist (they become `_`). For cases where rejection is preferable
+ * to silent replacement, validate the raw input against /^[a-zA-Z0-9_-]+$/
+ * before calling tools.
+ *
+ * @param name  Raw user-supplied identifier.
+ * @param maxLen Optional length cap applied after sanitization. Callers
+ *               that build long paths (Windows MAX_PATH-sensitive) should
+ *               always pass this.
+ * @returns Sanitized string, guaranteed non-empty (empty input collapses
+ *          to "_" so callers never receive a zero-length component).
+ */
+export function sanitizeFilenameComponent(name, maxLen) {
+    let s = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+    // A6 fix: truncation can also produce empty (maxLen=0 edge case). Apply
+    // the empty-check AFTER truncation, matching the order used in
+    // sanitizeFilenameComponentDotted post-A7. Defense in depth: empty input
+    // would produce an empty component, which then concatenated with an
+    // extension yields a hidden file like ".json".
+    if (maxLen !== undefined && s.length > maxLen)
+        s = s.substring(0, maxLen);
+    // Collapse empty to "_" so the caller always gets a real component.
+    if (s.length === 0)
+        s = "_";
+    return s;
+}
+/**
+ * Like sanitizeFilenameComponent but ALSO allows "." in the output.
+ * Intended for Android-style package identifiers ("com.example.app") and
+ * similar dotted names where stripping dots would damage the identifier.
+ *
+ * Pure-dot strings (".", "..", "...", etc.) are coerced to "_" so a
+ * caller that uses the result directly as a path component cannot be
+ * steered into parent-directory traversal by an adversarial input.
+ *
+ * @param name  Raw user-supplied dotted identifier (e.g., package name).
+ * @param maxLen Optional length cap applied after sanitization.
+ * @returns Sanitized string, guaranteed non-empty AND not a pure-dot
+ *          traversal sequence.
+ */
+/**
+ * A8 note: a LEADING dot is preserved (only character-class filtering
+ * applies — the dot is in the allowed set). On Unix, a result like
+ * `.hidden` becomes an actual hidden file in the result-handle store and
+ * other directory listings. This is intentional under the design (callers
+ * who want to allow package names like com.example.app need the dot), but
+ * means operators browsing the temp directory should pass `ls -A` not
+ * bare `ls` to see all entries. If a future caller wants the no-leading-
+ * dot behavior, it should sanitize the input before calling this helper.
+ */
+export function sanitizeFilenameComponentDotted(name, maxLen) {
+    let s = name.replace(/[^a-zA-Z0-9_.-]/g, "_");
+    // A7 fix: defenses run AFTER truncation, not before. The previous order
+    // (defang → empty-check → truncate) had a gap: input "..a" with maxLen=2
+    // would pass the defang (not pure-dot), then truncate to "..", and a
+    // pure-dot traversal string would reach the caller. Same hazard if
+    // truncation produces an empty string. Apply both the pure-dot defang
+    // and the empty-check LAST so any reduction-by-truncation is caught.
+    if (maxLen !== undefined && s.length > maxLen)
+        s = s.substring(0, maxLen);
+    // Defang pure-dot strings: ".", "..", "..." would resolve to current-dir
+    // or parent-dir if passed as a path component without an extension.
+    // `join(dir, "..")` escapes dir entirely; this prevents that.
+    if (/^\.+$/.test(s))
+        s = "_";
+    // Empty-input defense (sanitizeFilenameComponent has the same).
+    if (s.length === 0)
+        s = "_";
+    return s;
+}
+/**
+ * Returns true iff `candidatePath`, after path resolution, is contained
+ * within `dir` — either equal to `dir` or strictly underneath it.
+ *
+ * Containment uses a path-separator boundary check, NOT a string prefix.
+ * Without the boundary, `candidatePath = /parent/tempDir_evil/x` would
+ * pass containment against `dir = /parent/tempDir` because the absolute
+ * path string-prefix-matches — even though the two are sibling directories.
+ *
+ * Both POSIX `/` and Windows `\\` separators are recognized so a candidate
+ * resolved on either platform is handled correctly.
+ *
+ * Usage:
+ *   if (!isWithinDir(userOutputDir, ctx.config.tempDir)) {
+ *     throw new Error("Output directory must be inside tempDir");
+ *   }
+ *
+ * This is the centralized successor to the inline pattern that previously
+ * lived in tools/qemu.ts (verifyContainment, correctly using a separator
+ * boundary) and tools/split-apk.ts / tools/registry.ts (which used a bare
+ * string-prefix check and were vulnerable to the sibling-directory bypass).
+ * Lifting to shared middleware fixes the bypass at both call sites.
+ */
+export function isWithinDir(candidatePath, dir) {
+    const resolvedCandidate = resolve(candidatePath);
+    const resolvedDir = resolve(dir);
+    if (resolvedCandidate === resolvedDir)
+        return true;
+    // A9 note: the two startsWith checks are intentionally redundant. After
+    // path.resolve(), the separator is platform-native — `/` on POSIX, `\\`
+    // on Windows — so one of the two checks ALWAYS misses on a given run.
+    // Keeping both means the code reads correctly regardless of platform,
+    // and the dead branch costs one extra string comparison per call. If a
+    // future contributor "cleans up" by removing one of the checks, they
+    // would break the code on the other platform. The dual check is a
+    // platform-portability defense, not a bug.
+    return resolvedCandidate.startsWith(resolvedDir + "/")
+        || resolvedCandidate.startsWith(resolvedDir + "\\");
+}
+/**
+ * Read and JSON-parse a file. On any failure (missing, unreadable, malformed),
+ * log a warning via the supplied logger and return null. Used by tools that
+ * walk a directory of JSON files (fingerprints, baselines, marketplace
+ * workflows, plugin metadata) and want to skip-but-surface corruption rather
+ * than abort the whole walk OR silently drop the entry.
+ *
+ * Closes audit findings AE8 / AO6 / AU6 / BJ7 / BN7 — the recurring silent
+ * `} catch { /* skip corrupt * / }` pattern. Surfaces corruption to the
+ * operator so a quietly-shrinking handle count doesn't go unnoticed.
+ *
+ * The logger is optional so this is safe to call from contexts without a
+ * Logger in scope (some loadFingerprints / listing functions don't take a
+ * ToolContext). When absent, the warning goes to stderr — non-silent.
+ *
+ * Returns null on any failure; caller should skip the entry.
+ */
+export function tryReadJsonOrWarn(filePath, context, logger) {
+    try {
+        return JSON.parse(readFileSync(filePath, "utf-8"));
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        const msg = `tryReadJsonOrWarn[${context}]: skipped ${filePath} — ${detail}`;
+        if (logger)
+            logger.warn(msg);
+        else
+            process.stderr.write(msg + "\n");
+        return null;
+    }
+}
+//# sourceMappingURL=fs-utils.js.map

package/build/middleware/fs-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-utils.js","sourceRoot":"","sources":["../../src/middleware/fs-utils.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAqB;IACjE,oEAAoE;IACpE,wEAAwE;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,MAAM,CAAC;IACjE,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;QAC5D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,oEAAoE;QACpE,qEAAqE;QACrE,IAAI,CAAC;YAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAe;IACrE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC7C,wEAAwE;IACxE,+DAA+D;IAC/D,yEAAyE;IACzE,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;QAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1E,oEAAoE;IACpE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,GAAG,GAAG,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAY,EAAE,MAAe;IAC3E,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC9C,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;QAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,GAAG,CAAC;IAC7B,gEAAgE;IAChE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,GAAG,GAAG,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,WAAW,CAAC,aAAqB,EAAE,GAAW;IAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,iBAAiB,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACnD,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,OAAO,iBAAiB,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;WAC/C,iBAAiB,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AACD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,OAAe,EACf,MAAwC;IAExC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAM,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,qBAAqB,OAAO,cAAc,QAAQ,MAAM,MAAM,EAAE,CAAC;QAC7E,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/build/middleware/logger.d.ts

@@ -3,6 +3,22 @@
  *
  * IMPORTANT: MCP stdio servers MUST NOT write to stdout.
  * All logging goes to stderr to avoid corrupting JSON-RPC messages.
+ *
+ * M1 THREAT-MODEL NOTE: This Logger does NOT redact sensitive content.
+ * Direct calls like `logger.info(\`token=${token}\`)` log credentials
+ * verbatim. Redaction lives at the SecurityMiddleware layer for audit-log
+ * entries (see middleware/security.ts `redactForLog`) and does NOT cover
+ * arbitrary Logger calls. Adding redaction at the Logger level was
+ * considered and rejected — too aggressive, it would hide useful debug
+ * info (e.g., truncated stack traces with hex offsets that look like
+ * tokens to a redactor). The divergent behavior IS the design:
+ *
+ *   • SecurityMiddleware audit log → redacted (untrusted command strings)
+ *   • Logger.info/warn/error      → verbatim (callers are trusted code)
+ *
+ * Callers writing secret values into log strings are responsible for
+ * pre-redaction. The Logger trusts its own callers; it does not trust the
+ * commands flowing through SecurityMiddleware.
  */
 export type LogLevel = "debug" | "info" | "warn" | "error";
 export declare class Logger {

package/build/middleware/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAS3D,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAS;gBAEV,KAAK,GAAE,QAAiB;IAIpC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhD,OAAO,CAAC,GAAG;CAOZ"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAS3D,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAS;gBAEV,KAAK,GAAE,QAAiB;IAIpC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhD,OAAO,CAAC,GAAG;CAOZ"}

package/build/middleware/logger.js

@@ -1,8 +1,26 @@
+// Copyright 2026 Jason <fullread@github>
+// SPDX-License-Identifier: Apache-2.0
 /**
  * Logger — Simple stderr-based logger for MCP servers.
  *
  * IMPORTANT: MCP stdio servers MUST NOT write to stdout.
  * All logging goes to stderr to avoid corrupting JSON-RPC messages.
+ *
+ * M1 THREAT-MODEL NOTE: This Logger does NOT redact sensitive content.
+ * Direct calls like `logger.info(\`token=${token}\`)` log credentials
+ * verbatim. Redaction lives at the SecurityMiddleware layer for audit-log
+ * entries (see middleware/security.ts `redactForLog`) and does NOT cover
+ * arbitrary Logger calls. Adding redaction at the Logger level was
+ * considered and rejected — too aggressive, it would hide useful debug
+ * info (e.g., truncated stack traces with hex offsets that look like
+ * tokens to a redactor). The divergent behavior IS the design:
+ *
+ *   • SecurityMiddleware audit log → redacted (untrusted command strings)
+ *   • Logger.info/warn/error      → verbatim (callers are trusted code)
+ *
+ * Callers writing secret values into log strings are responsible for
+ * pre-redaction. The Logger trusts its own callers; it does not trust the
+ * commands flowing through SecurityMiddleware.
  */
 const LOG_LEVELS = {
     debug: 0,

package/build/middleware/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,GAA6B;IAC3C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,OAAO,MAAM;IACT,KAAK,CAAS;IAEtB,YAAY,QAAkB,MAAM;QAClC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,GAAG,IAAe;QACvC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,GAAG,IAAe;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,GAAG,IAAe;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,GAAG,IAAe;QACvC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,GAAG,IAAe;QAC9D,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,SAAS,MAAM,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,UAAU,GAA6B;IAC3C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,OAAO,MAAM;IACT,KAAK,CAAS;IAEtB,YAAY,QAAkB,MAAM;QAClC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,GAAG,IAAe;QACvC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,GAAG,IAAe;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,GAAG,IAAe;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,GAAG,IAAe;QACvC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,GAAG,IAAe;QAC9D,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,SAAS,MAAM,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}

package/build/middleware/output-processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output-processor.d.ts","sourceRoot":"","sources":["../../src/middleware/output-processor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,qBAAa,eAAe;IAC1B;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IA2BvD;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAOlC;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAItD;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAO1C;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAWzD;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CACjB,MAAM,EAAE,oBAAoB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAChD,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,SAAgB,GACvB,MAAM;IAST;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAgCxC;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAmBxC;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAUzD"}
+{"version":3,"file":"output-processor.d.ts","sourceRoot":"","sources":["../../src/middleware/output-processor.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAIH,qBAAa,eAAe;IAC1B;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAmCvD;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAOlC;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAItD;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAuB1C;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAWzD;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CACjB,MAAM,EAAE,oBAAoB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAChD,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,SAAgB,GACvB,MAAM;IAST;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAyCxC;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAmBxC;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAUzD"}

package/build/middleware/output-processor.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Jason <fullread@github>
+// SPDX-License-Identifier: Apache-2.0
 /**
  * Output Processor — Truncation, formatting, structured parsing, and binary handling.
  *
@@ -15,10 +17,17 @@ export class OutputProcessor {
         const limit = maxSize ?? config.maxOutputSize;
         if (text.length <= limit)
             return text;
-        // Scan backward from the limit to find a clean break point
+        // G1 fix: budget the truncation-suffix size into the limit BEFORE
+        // searching for a cut point. The suffix is appended after the cut,
+        // so without this reservation the returned string overshoots `limit`
+        // by ~75 chars (varies with the comma-formatted "remaining" count).
+        // Worst-case remaining count length: ~20 chars (for ~10^16 chars omitted).
+        const SUFFIX_RESERVE = 80;
+        const effectiveLimit = Math.max(0, limit - SUFFIX_RESERVE);
+        // Scan backward from the effective limit to find a clean break point
         // Look within the last 500 chars of the allowed range
-        const searchStart = Math.max(0, limit - 500);
-        const searchRegion = text.substring(searchStart, limit);
+        const searchStart = Math.max(0, effectiveLimit - 500);
+        const searchRegion = text.substring(searchStart, effectiveLimit);
         // Prefer section separators, then newlines
         let breakOffset = -1;
         const sectionBreak = searchRegion.lastIndexOf("\n\n");
@@ -31,7 +40,7 @@ export class OutputProcessor {
                 breakOffset = searchStart + lineBreak;
             }
         }
-        const cutPoint = breakOffset > 0 ? breakOffset : limit;
+        const cutPoint = breakOffset > 0 ? breakOffset : effectiveLimit;
         const truncated = text.substring(0, cutPoint);
         const remaining = text.length - cutPoint;
         return `${truncated}\n\n--- OUTPUT TRUNCATED (${remaining.toLocaleString()} characters omitted) ---`;
@@ -56,9 +65,26 @@ export class OutputProcessor {
      * Format a structured error response.
      */
     static formatError(error) {
+        // G2 fix: handle structured-object exceptions (some third-party libs
+        // throw plain objects rather than Error instances). Probe for a
+        // .message property first, then fall back to JSON for structured
+        // values, and finally String() for primitives. Avoids the
+        // unhelpful "Error: [object Object]" output.
         if (error instanceof Error) {
             return `Error: ${error.message}`;
         }
+        if (error && typeof error === "object") {
+            const msg = error.message;
+            if (typeof msg === "string" && msg.length > 0) {
+                return `Error: ${msg}`;
+            }
+            try {
+                return `Error: ${JSON.stringify(error)}`;
+            }
+            catch {
+                // Circular references or BigInt — fall through.
+            }
+        }
         return `Error: ${String(error)}`;
     }
     /**
@@ -118,10 +144,19 @@ export class OutputProcessor {
             const plugMap = { "0": "Unplugged", "1": "AC", "2": "USB", "4": "Wireless" };
             pairs.push(`Plugged: ${plugMap[plugged] ?? plugged}`);
         }
-        if (temperature)
-            pairs.push(`Temperature: ${(parseInt(temperature, 10) / 10).toFixed(1)}°C`);
-        if (voltage)
-            pairs.push(`Voltage: ${(parseInt(voltage, 10) / 1000).toFixed(3)}V`);
+        // G4 fix: skip non-numeric temperature/voltage values rather than emit
+        // "Temperature: NaN°C" or "Voltage: NaNV". Quirky ROMs or partial dumpsys
+        // output occasionally produce non-integer values here.
+        if (temperature) {
+            const tempNum = parseInt(temperature, 10);
+            if (Number.isFinite(tempNum))
+                pairs.push(`Temperature: ${(tempNum / 10).toFixed(1)}°C`);
+        }
+        if (voltage) {
+            const voltNum = parseInt(voltage, 10);
+            if (Number.isFinite(voltNum))
+                pairs.push(`Voltage: ${(voltNum / 1000).toFixed(3)}V`);
+        }
         return pairs.length > 0 ? pairs.join(" | ") : raw.trim();
     }
     /**

package/build/middleware/output-processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"output-processor.js","sourceRoot":"","sources":["../../src/middleware/output-processor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,OAAO,eAAe;IAC1B;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgB;QAC5C,MAAM,KAAK,GAAG,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;QAEtC,2DAA2D;QAC3D,sDAAsD;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAExD,2CAA2C;QAC3C,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;QACrB,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;YACxC,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACzC,OAAO,GAAG,SAAS,6BAA6B,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC;IACvG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACvB,OAAO,IAAI;aACR,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,KAAc;QAC/B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;QACxC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,iCAAiC,QAAQ,OAAO,CAAC;IAC9F,CAAC;IAED,oEAAoE;IAEpE;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CACjB,MAAgD,EAChD,OAAgB,EAChB,QAAQ,GAAG,aAAa;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAI,MAAgC,CAAC,MAAM,CAAC;QACxD,OAAO,GAAG,QAAQ,KAAK,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,CAAC;IACxG,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,GAAW,EAAsB,EAAE;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAEnC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA2B,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACpH,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA2B,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YAC7G,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAA2B,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YACrG,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7F,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAElF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,kBAAkB;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE5D,uBAAuB;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QACrE,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,CAAC;iBAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAW;QAC7B,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"output-processor.js","sourceRoot":"","sources":["../../src/middleware/output-processor.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,sCAAsC;AACtC;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,OAAO,eAAe;IAC1B;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgB;QAC5C,MAAM,KAAK,GAAG,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;QAEtC,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,oEAAoE;QACpE,2EAA2E;QAC3E,MAAM,cAAc,GAAG,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,CAAC;QAE3D,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAEjE,2CAA2C;QAC3C,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;QACrB,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;YACxC,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACzC,OAAO,GAAG,SAAS,6BAA6B,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC;IACvG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACvB,OAAO,IAAI;aACR,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,KAAc;QAC/B,qEAAqE;QACrE,gEAAgE;QAChE,iEAAiE;QACjE,0DAA0D;QAC1D,6CAA6C;QAC7C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,GAAI,KAA+B,CAAC,OAAO,CAAC;YACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,UAAU,GAAG,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QACD,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;QACxC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,iCAAiC,QAAQ,OAAO,CAAC;IAC9F,CAAC;IAED,oEAAoE;IAEpE;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CACjB,MAAgD,EAChD,OAAgB,EAChB,QAAQ,GAAG,aAAa;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAI,MAAgC,CAAC,MAAM,CAAC;QACxD,OAAO,GAAG,QAAQ,KAAK,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,CAAC;IACxG,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,GAAW,EAAsB,EAAE;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAEnC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA2B,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACpH,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA2B,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YAC7G,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAA2B,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YACrG,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,kBAAkB;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE5D,uBAAuB;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QACrE,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,CAAC;iBAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,GAAW;QAC7B,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/build/middleware/parse-utils.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Parse Utilities — shared numeric/string parsing helpers.
+ *
+ * Q2 fix: previously \`parseIntSafe\` was duplicated in config.ts and
+ * result-handle.ts with slight signature differences. This module is the
+ * single source of truth. Both callers now import from here.
+ */
+/**
+ * Parse a numeric environment variable with a defensive fallback.
+ *
+ * - Returns \`fallback\` when the value is undefined.
+ * - Returns \`fallback\` and logs a warning to stderr when the value is
+ *   non-numeric or negative (operator typos).
+ * - The negative-rejection is intentional: every numeric config in DeepADB
+ *   is a duration, count, or size — none of which has a legitimate
+ *   negative interpretation.
+ */
+export declare function parseIntSafe(value: string | undefined, fallback: number): number;
+//# sourceMappingURL=parse-utils.d.ts.map

package/build/middleware/parse-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-utils.d.ts","sourceRoot":"","sources":["../../src/middleware/parse-utils.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQhF"}

package/build/middleware/parse-utils.js

@@ -0,0 +1,30 @@
+// Copyright 2026 Jason <fullread@github>
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Parse Utilities — shared numeric/string parsing helpers.
+ *
+ * Q2 fix: previously \`parseIntSafe\` was duplicated in config.ts and
+ * result-handle.ts with slight signature differences. This module is the
+ * single source of truth. Both callers now import from here.
+ */
+/**
+ * Parse a numeric environment variable with a defensive fallback.
+ *
+ * - Returns \`fallback\` when the value is undefined.
+ * - Returns \`fallback\` and logs a warning to stderr when the value is
+ *   non-numeric or negative (operator typos).
+ * - The negative-rejection is intentional: every numeric config in DeepADB
+ *   is a duration, count, or size — none of which has a legitimate
+ *   negative interpretation.
+ */
+export function parseIntSafe(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    const parsed = parseInt(value, 10);
+    if (isNaN(parsed) || parsed < 0) {
+        process.stderr.write(`[DeepADB] Invalid config value "${value}", using default: ${fallback}\n`);
+        return fallback;
+    }
+    return parsed;
+}
+//# sourceMappingURL=parse-utils.js.map

package/build/middleware/parse-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-utils.js","sourceRoot":"","sources":["../../src/middleware/parse-utils.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,sCAAsC;AACtC;;;;;;GAMG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB,EAAE,QAAgB;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,qBAAqB,QAAQ,IAAI,CAAC,CAAC;QAChG,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/middleware/png-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"png-utils.d.ts","sourceRoot":"","sources":["../../src/middleware/png-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyDH,iEAAiE;AACjE,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CASlE,CAAC;AAiBX;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAChE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAC9C,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EACxC,SAAS,SAAI,GACZ,IAAI,CAmBN;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAChE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EACjC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GACzC,IAAI,CA4CN;AAID,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAU,MAAM,CAAC;IACtB,MAAM,EAAS,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAS,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAkFhE;AAID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CA0B3F"}
+{"version":3,"file":"png-utils.d.ts","sourceRoot":"","sources":["../../src/middleware/png-utils.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAyDH,iEAAiE;AACjE,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CASlE,CAAC;AA4BX;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAChE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAC9C,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EACxC,SAAS,SAAI,GACZ,IAAI,CAmBN;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAChE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EACjC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GACzC,IAAI,CA4CN;AAID,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAU,MAAM,CAAC;IACtB,MAAM,EAAS,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAS,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAkFhE;AAID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAqC3F"}

package/build/middleware/png-utils.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Jason <fullread@github>
+// SPDX-License-Identifier: Apache-2.0
 /**
  * PNG Utilities — Zero-dependency PNG decode and encode for screenshot analysis and annotation.
  *
@@ -66,14 +68,26 @@ export const ELEMENT_COLORS = [
     [160, 50, 220], // purple
 ];
 // ── Pixel operations ───────────────────────────────────────────────────
-/** Write one pixel into a packed row-major RGB/RGBA pixel buffer. No-op if x is out of range. */
-function setPixel(pixels, imgWidth, bpp, x, y, r, g, b) {
+/** Write one pixel into a packed row-major RGB/RGBA pixel buffer. No-op if
+ *  x or y is out of range. Defense in depth: callers (drawRect, drawLabel)
+ *  already pre-check bounds, but having the guard here too means a future
+ *  caller that forgets the check cannot silently corrupt a different row
+ *  — without the y-bound check, a y >= imgHeight produces a positive offset
+ *  that still falls inside the buffer (it just points to a wrong row, or
+ *  past the end where Node's Buffer silently no-ops). */
+function setPixel(pixels, imgWidth, imgHeight, bpp, x, y, r, g, b) {
     if (x < 0 || x >= imgWidth)
         return;
+    if (y < 0 || y >= imgHeight)
+        return;
+    // I1 fix: clamp R/G/B to [0, 255]. Previously out-of-range values were
+    // silently truncated by Buffer coercion — pixels[off]=300 wraps to 44
+    // (300 & 0xFF). Clamping surfaces the caller bug as a visible saturated
+    // pixel instead of producing arbitrary wrong colors.
     const off = (y * imgWidth + x) * bpp;
-    pixels[off] = r;
-    pixels[off + 1] = g;
-    pixels[off + 2] = b;
+    pixels[off] = Math.max(0, Math.min(255, r | 0));
+    pixels[off + 1] = Math.max(0, Math.min(255, g | 0));
+    pixels[off + 2] = Math.max(0, Math.min(255, b | 0));
     if (bpp === 4)
         pixels[off + 3] = 255;
 }
@@ -92,12 +106,12 @@ export function drawRect(pixels, imgWidth, imgHeight, bpp, x1, y1, x2, y2, color
         if (top > bot || left > right)
             break;
         for (let x = left; x <= right; x++) {
-            setPixel(pixels, imgWidth, bpp, x, top, r, g, b);
-            setPixel(pixels, imgWidth, bpp, x, bot, r, g, b);
+            setPixel(pixels, imgWidth, imgHeight, bpp, x, top, r, g, b);
+            setPixel(pixels, imgWidth, imgHeight, bpp, x, bot, r, g, b);
         }
         for (let y = top + 1; y < bot; y++) {
-            setPixel(pixels, imgWidth, bpp, left, y, r, g, b);
-            setPixel(pixels, imgWidth, bpp, right, y, r, g, b);
+            setPixel(pixels, imgWidth, imgHeight, bpp, left, y, r, g, b);
+            setPixel(pixels, imgWidth, imgHeight, bpp, right, y, r, g, b);
         }
     }
 }
@@ -127,7 +141,7 @@ export function drawLabel(pixels, imgWidth, imgHeight, bpp, x, y, num, bgColor)
     // Fill background rectangle
     for (let dy = 0; dy < labelH && ly + dy < imgHeight; dy++) {
         for (let dx = 0; dx < labelW && lx + dx < imgWidth; dx++) {
-            setPixel(pixels, imgWidth, bpp, lx + dx, ly + dy, bgR, bgG, bgB);
+            setPixel(pixels, imgWidth, imgHeight, bpp, lx + dx, ly + dy, bgR, bgG, bgB);
         }
     }
     // Render each digit glyph
@@ -141,7 +155,7 @@ export function drawLabel(pixels, imgWidth, imgHeight, bpp, x, y, num, bgColor)
                     const px = lx + PAD + ci * CHAR_W + col;
                     const py = ly + PAD + row;
                     if (px < imgWidth && py < imgHeight) {
-                        setPixel(pixels, imgWidth, bpp, px, py, fr, fg, fb);
+                        setPixel(pixels, imgWidth, imgHeight, bpp, px, py, fr, fg, fb);
                     }
                 }
             }
@@ -248,6 +262,14 @@ export function decodePngPixels(pngPath) {
  * bpp must be 3 (RGB) or 4 (RGBA) to match the input data.
  */
 export function encodePng(width, height, pixels, bpp) {
+    // I3 fix: pixel buffer size precondition. A mismatched buffer (e.g.,
+    // wrong bpp passed) previously produced a corrupt PNG silently because
+    // pixels.copy(..., over-read) is a no-op. Surface the mismatch as an
+    // error so the caller bug is caught at the boundary.
+    const expectedSize = width * height * bpp;
+    if (pixels.length < expectedSize) {
+        throw new Error(`encodePng: pixel buffer too small. Got ${pixels.length} bytes, expected at least ${expectedSize} (${width}x${height} at ${bpp} bpp).`);
+    }
     const SIG = Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]);
     const ihdr = Buffer.allocUnsafe(13);
     ihdr.writeUInt32BE(width, 0);