siteread 0.2.1 → 0.2.2

package/README.md

@@ -81,8 +81,9 @@ so `--host` keeps them and says so. For nginx JSON, the common field names are r
 `http_user_agent` or `user_agent`, `http_referer` or `referer`, `host` or `http_host`), with
 `escape=json` or nginx's default escaping.
 
-`npx siteread --help` lists every option. The `seo-read` skill for Claude Code, in this project's
-`skill/` folder, turns the JSON into a weekly memo.
+`npx siteread --help` lists every option. The `seo-read` skill, in siteread's Claude Code plugin
+(`/plugin install siteread@siteread` after `/plugin marketplace add synacl-iot/siteread`), turns the
+JSON into a weekly memo.
 
 ## Share (opt-in)
 
@@ -295,8 +296,12 @@ All of them answer `{ "creationTime": …, "prefixes": [{ "ipv4Prefix": … } |
   failure, not as an empty list.
 - **Drop:** a copy nobody could refresh for 8 days is dropped, so a vendor's moved ranges cannot mark
   its new IPs as spoofed forever. With no copy, the verdict is `unknown`, never `spoofed`.
-- **Bounds:** a body over 2,000,000 characters, more than 20,000 prefixes, or a prefix broader than
-  /8 (IPv4) or /16 (IPv6) is rejected. A `/0` would verify every address.
+- **Bounds:** a body over 2,000,000 characters or more than 20,000 prefixes is rejected, and a list
+  holding a prefix broader than /16 (IPv4) or /32 (IPv6) is refused whole, keeping the previous
+  copy. The broadest real prefix in any list is a /16 (IPv4) and a /64 (IPv6); a `/0` would verify
+  every address, and since the CLI reads the hosted feed, the limit is what stops a tampered feed
+  from vouching for a whole provider's range. From the feed, a refused list is fetched from its
+  vendor instead.
 
 ## Privacy
 

package/package.json

@@ -1,7 +1,16 @@
 {
   "name": "siteread",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Is that crawler who it says it is? Checks an IP + User-Agent against the AI and search vendors' published IP lists. Zero dependencies.",
+  "homepage": "https://siteread.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/synacl-iot/siteread.git",
+    "directory": "packages/verify"
+  },
+  "bugs": {
+    "url": "https://github.com/synacl-iot/siteread/issues"
+  },
   "type": "module",
   "engines": {
     "node": ">=20"

package/src/ip-ranges.js

@@ -32,9 +32,15 @@ export const FETCH_TIMEOUT_MS = 8_000;
 // A list is a few hundred prefixes; these bound what a broken (or hostile) response can cost.
 export const MAX_BODY_CHARS = 2_000_000;
 export const MAX_PREFIXES = 20_000;
-// No vendor publishes anything near this broad. A /0 in a list would verify EVERY address,
-// so a prefix shorter than these is a broken list, not a big one.
-export const MIN_PREFIX = Object.freeze({ ipv4: 8, ipv6: 16 });
+// The broadest prefix a list may hold. A /0 would verify EVERY address, and since the CLI reads
+// the hosted feed by default, the feed's server vouches for every client's "verified": if it were
+// ever taken over, it could add a broad range to any agent and every spoofer in it would pass.
+// Measured 2026-10-22, the broadest real prefix in any list is OpenAI's /16 (chatgpt-user) for
+// IPv4 and Google's /64 for IPv6, so these limits cost nothing real and cut the worst case from
+// a /8 to a /16. A list holding a broader prefix is refused whole (its previous copy kept, the
+// error reported), never trimmed: trimming would silently turn a vendor's real new range into
+// "spoofed", and a refusal says out loud that a limit or a list needs a look.
+export const MIN_PREFIX = Object.freeze({ ipv4: 16, ipv6: 32 });
 // Two processes sharing a store can disagree on the time by a little. A fetchedAt further in
 // the future than this is not skew: it would keep a list "fresh" forever and defeat the drop.
 const CLOCK_SKEW_MS = 5 * 60_000;
@@ -64,8 +70,14 @@ export const SOURCES = Object.freeze([
     { agent: 'bingbot',          url: 'https://www.bing.com/toolbox/bingbot.json' },
 ].map(Object.freeze));
 
-/** 'a.b.c.d/n' or 'x::/n' → { type, net, prefix, cidr } (normalised), or null. */
+/** 'a.b.c.d/n' or 'x::/n' → { type, net, prefix, cidr } (normalised), or null; MIN_PREFIX applies. */
 export function parseCidr(raw) {
+    const p = cidrOf(raw);
+    return p && p.prefix >= MIN_PREFIX[p.type] ? p : null;
+}
+
+/** parseCidr without the breadth limit, so a list parser can tell "too broad" from "not a prefix". */
+function cidrOf(raw) {
     if (typeof raw !== 'string') return null;
     const s = raw.trim();
     const slash = s.indexOf('/');
@@ -76,30 +88,35 @@ export function parseCidr(raw) {
     const prefix = Number(bits);
     const type = net.isIPv4(addr) ? 'ipv4' : net.isIPv6(addr) ? 'ipv6' : null;
     if (!type) return null;
-    if (prefix < MIN_PREFIX[type] || prefix > (type === 'ipv4' ? 32 : 128)) return null;
+    if (prefix > (type === 'ipv4' ? 32 : 128)) return null;
     return { type, net: addr.toLowerCase(), prefix, cidr: `${addr.toLowerCase()}/${prefix}` };
 }
 
-/** The vendors' shared format: { prefixes: [{ ipv4Prefix } | { ipv6Prefix }] } → [cidr]. */
+// One prefix of a list: skipped when it is not a prefix at all, the whole list refused when it
+// is one broader than MIN_PREFIX (see there).
+function addPrefix(out, raw) {
+    const p = cidrOf(raw);
+    if (!p) return;
+    if (p.prefix < MIN_PREFIX[p.type]) throw new Error(`${p.cidr} is broader than /${MIN_PREFIX[p.type]}; list refused`);
+    out.add(p.cidr);
+}
+
+/** The vendors' shared format: { prefixes: [{ ipv4Prefix } | { ipv6Prefix }] } → [cidr]. Throws on a too-broad prefix. */
 export function parseList(body) {
     const items = Array.isArray(body?.prefixes) ? body.prefixes : [];
     const out = new Set();
     for (const it of items) {
         if (out.size >= MAX_PREFIXES) break;
-        const p = parseCidr(it?.ipv4Prefix ?? it?.ipv6Prefix);
-        if (p) out.add(p.cidr);
+        addPrefix(out, it?.ipv4Prefix ?? it?.ipv6Prefix);
     }
     return [...out];
 }
 
-/** A stored copy's prefixes ([cidr]) → [cidr], re-validated and bounded. */
+/** A feed's or a stored copy's prefixes ([cidr]) → [cidr], re-validated and bounded. Throws on a too-broad prefix. */
 export function parsePrefixes(list) {
     if (!Array.isArray(list)) return [];
     const out = new Set();
-    for (const c of list.slice(0, MAX_PREFIXES)) {
-        const p = parseCidr(c);
-        if (p) out.add(p.cidr);
-    }
+    for (const c of list.slice(0, MAX_PREFIXES)) addPrefix(out, c);
     return [...out];
 }
 

package/src/verifier.js

@@ -95,7 +95,8 @@ export function createVerifier({
         const lists = body && typeof body.lists === 'object' && body.lists ? body.lists : {};
         for (const { agent } of due) {
             const l = Object.hasOwn(lists, agent) ? lists[agent] : null;
-            const prefixes = parsePrefixes(l?.prefixes);
+            let prefixes;
+            try { prefixes = parsePrefixes(l?.prefixes); } catch (err) { fail(out, agent, err, 'feed'); continue; }
             // A future fetchedAt is clamped to now: it would otherwise keep the copy fresh forever.
             const at = Math.min(fetchedAtMs(l), t);
             const stored = fetchedAtMs(doc.lists[agent]);

package/src/version.js

@@ -1,2 +1,2 @@
 // Kept in step with package.json by test/package.test.js (no JSON import: Node 20 needs no flag for this).
-export const VERSION = '0.2.1';
+export const VERSION = '0.2.2';