opencode-self-improvement 0.3.2 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.3.2",
+  "version": "0.3.5",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/logfmt.ts

@@ -1,7 +1,7 @@
 // Minimal logfmt reader/writer shared by the durable store and the evidence
 // log. Field order is preserved on write so chains are diffable.
 import { dirname } from "node:path";
-import { mkdir } from "node:fs/promises";
+import { appendFile, mkdir } from "node:fs/promises";
 
 export type Fields = Record<string, unknown>;
 
@@ -12,6 +12,16 @@ export type Fields = Record<string, unknown>;
 const ESCAPE: Record<string, string> = { "\\": "\\\\", '"': '\\"', "\n": "\\n", "\r": "\\r", "\t": "\\t" };
 const UNESCAPE: Record<string, string> = { "\\": "\\", '"': '"', n: "\n", r: "\r", t: "\t" };
 
+// Lines written before these escapes existed stored backslashes raw, so in an
+// old line `C:\new` is a backslash and an `n`, not a newline. A line whose
+// values use the escapes ends with this marker, and only fields before it are
+// unescaped; everything else is read the old way, where only `\"` is an escape.
+// Fields after the marker were appended by an older version (supersede adds
+// fields to the end of an existing line). Lines without backslashes, newlines
+// or tabs read the same either way, so they don't carry the marker.
+const MARKER = "esc";
+const MARKER_VALUE = "1";
+
 export function quote(value: unknown): string {
   const s = String(value);
   if (s === "") return '""';
@@ -20,34 +30,47 @@ export function quote(value: unknown): string {
 
 export function formatLine(fields: Fields): string {
   const parts: string[] = [];
+  let escaped = false;
   for (const [k, v] of Object.entries(fields)) {
-    if (v === undefined || v === null) continue;
-    parts.push(`${k}=${quote(v)}`);
+    if (v === undefined || v === null || k === MARKER) continue;
+    const q = quote(v);
+    if (q.startsWith('"') && /[\\\n\r\t]/.test(String(v))) escaped = true;
+    parts.push(`${k}=${q}`);
   }
+  if (escaped) parts.push(`${MARKER}=${MARKER_VALUE}`);
   return parts.join(" ");
 }
 
 // Unescape a quoted logfmt value and read it back. Unknown sequences are kept
-// as written: older files stored backslashes unescaped (`C:\Program Files`).
+// as written.
 function unquote(s: string): string {
   return s.replace(/\\(.)/g, (seq, c: string) => UNESCAPE[c] ?? seq);
 }
 
+function unquoteLegacy(s: string): string {
+  return s.replace(/\\"/g, '"');
+}
+
 export function parseLine(line: string): Fields | null {
   const trimmed = line.trim();
   if (!trimmed || !trimmed.includes("=")) return null;
-  const fields: Fields = {};
+  const tokens: [string, string][] = [];
   const re = /([A-Za-z0-9_.-]+)=("(?:[^"\\]|\\.)*"|[^\s]*)/g;
   for (;;) {
     const m = re.exec(trimmed);
     if (!m) break;
-    const key = m[1];
-    let raw = m[2];
+    tokens.push([m[1], m[2]]);
+  }
+  const marker = tokens.findIndex(([k, v]) => k === MARKER && v === MARKER_VALUE);
+  const fields: Fields = {};
+  tokens.forEach(([key, value], i) => {
+    if (key === MARKER) return;
+    let raw = value;
     if (raw.startsWith('"') && raw.endsWith('"')) {
-      raw = unquote(raw.slice(1, -1));
+      raw = (i < marker ? unquote : unquoteLegacy)(raw.slice(1, -1));
     }
     fields[key] = raw;
-  }
+  });
   // parse booleans/numbers as strings is fine; callers coerce.
   return fields;
 }
@@ -59,9 +82,13 @@ export async function ensureDir(path: string): Promise<void> {
 export async function appendLog(file: string, line: string): Promise<void> {
   await ensureDir(dirname(file));
   const next = line.endsWith("\n") ? line : line + "\n";
-  const f = Bun.file(file);
-  const existing = (await f.exists()) ? await f.text() : "";
-  await Bun.write(file, existing + next);
+  // One O_APPEND write (issue #23). The previous read-modify-write lost rows:
+  // 20 concurrent appends left 2 on disk. appendFile's "a" flag is
+  // O_APPEND|O_CREAT — atomic small writes on local POSIX filesystems,
+  // covering interleaved async tasks in the service AND a second process
+  // (the viewer) appending the same day file. Do NOT "simplify" this to
+  // Bun.write with an options object: on Bun 1.4.3 that silently TRUNCATES.
+  await appendFile(file, next);
 }
 
 export async function readLines(file: string): Promise<string[]> {

package/src/memory.ts

@@ -179,7 +179,10 @@ export async function markSuperseded(ts: string, fields: SupersedeFields): Promi
     if (idx === -1) continue;
     const parsed = parseLine(lines[idx]);
     if (parsed && typeof parsed.superseded_by === "string") return false;
-    const extra = formatLine({
+    // Rewrite the whole line rather than appending to it, so an old-format line
+    // comes out in the current format with its values unchanged.
+    lines[idx] = formatLine({
+      ...parsed,
       superseded_by: fields.superseded_by,
       reason: fields.reason,
       symbol: fields.symbol,
@@ -187,7 +190,6 @@ export async function markSuperseded(ts: string, fields: SupersedeFields): Promi
       to: fields.to,
       entity: fields.entity,
     });
-    lines[idx] = `${lines[idx]} ${extra}`;
     await snapshotBefore(file);
     await Bun.write(file, lines.join("\n") + "\n");
     return true;

package/src/viewer/server.ts

@@ -17,10 +17,20 @@ const PAGE = join(import.meta.dir, "page.html");
 const HOST = process.env.OPENCODE_VIEWER_HOST || "127.0.0.1";
 const PORT = Number(process.env.OPENCODE_VIEWER_PORT || 8787);
 
+// Defense-in-depth headers on every response. CSP: the page uses only inline
+// script/style and same-origin fetch, so everything else is off — a stored-XSS
+// payload (see issue #11) gains no exfil channel and no framing.
+const SECURITY_HEADERS: Record<string, string> = {
+  "x-content-type-options": "nosniff",
+  "content-security-policy":
+    "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; " +
+    "connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+};
+
 function json(body: unknown, status = 200): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "content-type": "application/json" },
+    headers: { ...SECURITY_HEADERS, "content-type": "application/json" },
   });
 }
 
@@ -116,13 +126,21 @@ export async function startViewer(port: number = PORT): Promise<ViewerServer> {
     hostname: HOST,
     port,
     fetch(req, srv) {
-      // Bun builds req.url from the request's Host header.
-      const url = new URL(req.url);
+      // Bun builds req.url from the request's Host header. A malformed Host
+      // makes the URL parse THROW — before rejectRequest could answer. Letting
+      // that escape hands the caller Bun's dev error page (stack + absolute
+      // paths), so the parse itself is the first guarded step (issue #12).
+      let url: URL;
+      try {
+        url = new URL(req.url);
+      } catch {
+        return error("malformed request URL (bad Host header?)", 400);
+      }
       const rejected = rejectRequest(req, url, server.port ?? port);
       if (rejected) return rejected;
       if (url.pathname === "/") {
         return new Response(page, {
-          headers: { "content-type": "text/html; charset=utf-8" },
+          headers: { ...SECURITY_HEADERS, "content-type": "text/html; charset=utf-8" },
         });
       }
       if (req.method === "GET" && url.pathname === "/api/data") {