slidemind 0.2.4 → 0.3.1

package/src/bridge/http-json.mjs

@@ -1,6 +1,9 @@
-// Minimal JSON-over-HTTP transport shared by setup-claim redemption and session
-// management. Validates real TLS certificates; loopback development may use a
-// self-signed HTTPS certificate or plain HTTP.
+// Minimal JSON-over-HTTP transport shared by setup-claim redemption, session
+// management and the Entra token endpoint. Validates real TLS certificates;
+// loopback development may use a self-signed HTTPS certificate or plain HTTP.
+//
+// `form` covers OAuth's one deviation: the token endpoint answers JSON but
+// insists on an x-www-form-urlencoded request body.
 
 import http from "node:http";
 import https from "node:https";
@@ -9,13 +12,19 @@ function isLoopbackHostname(hostname) {
   return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1";
 }
 
-export function httpJson(method, urlStr, { body = null, token = null } = {}) {
+export function httpJson(method, urlStr, { body = null, form = null, token = null } = {}) {
   const url = new URL(urlStr);
   const transport = url.protocol === "https:" ? https : http;
-  const payload = body != null ? JSON.stringify(body) : null;
+  const payload = form != null
+    ? new URLSearchParams(form).toString()
+    : body != null
+      ? JSON.stringify(body)
+      : null;
   const headers = { accept: "application/json" };
   if (payload) {
-    headers["content-type"] = "application/json";
+    headers["content-type"] = form != null
+      ? "application/x-www-form-urlencoded"
+      : "application/json";
     headers["content-length"] = Buffer.byteLength(payload);
   }
   if (token) headers.authorization = `Bearer ${token}`;

package/src/bridge/secrets.mjs

@@ -0,0 +1,75 @@
+// Credential containment for everything this process prints.
+//
+// The CLI holds four kinds of secret — the per-backend `sessionToken`, a
+// Microsoft Graph refresh token, a short-lived Graph access token, and the
+// one-time `smc1_…` setup claim. None of them is ever printed on purpose, and
+// an audit found no path that does. What it did find is a repeating shape that
+// could: a server-controlled RESPONSE body used verbatim as an error detail
+// (`setup-claim.mjs` redeem failures, the Entra token endpoint, every non-2xx
+// bridge call), plus `unknown command: <argv>` echoing a mis-pasted claim.
+// Patching those four sites would leave the fifth one to the next route added.
+//
+// So the containment is value-based and lives at the output boundary instead:
+// this process KNOWS its own secrets, so scrubbing is exact — no regex guessing
+// at what "looks like a token", no false positives on ordinary text. Register a
+// value when it enters memory; `bin/slidemind.mjs` wraps stdout/stderr once so
+// every line, JSON payload and error message passes through `scrub()` on its
+// way out.
+//
+// The replacement reveals ZERO characters of the secret but stays correlatable:
+// the same credential always renders the same tag, so two occurrences in one
+// message are recognisably the same thing — enough to debug with, useless to
+// anyone reading over a shoulder or a pasted transcript.
+
+import crypto from "node:crypto";
+
+// Below this length a value cannot be told apart from ordinary prose, and
+// scrubbing it would corrupt unrelated output. Every real credential here is
+// far longer; a test fixture that is not simply goes unscrubbed, which is why
+// the containment tests use realistic lengths.
+const MIN_SECRET_LENGTH = 8;
+
+const secrets = new Set();
+
+// Stable, non-reversible tag for one secret. Four hex characters of sha256 is
+// ~65k buckets: plenty to tell two credentials apart in a single message, far
+// too little to attack the value behind it.
+export function tagFor(value) {
+  const hash = crypto.createHash("sha256").update(String(value)).digest("hex");
+  return `«secret:${hash.slice(0, 4)}»`;
+}
+
+// Add a live secret. Safe to call repeatedly with the same value (a rotating
+// refresh token registers its replacement on every refresh, and the old one
+// stays registered — a stale credential in a printed line is still a leak).
+export function register(value) {
+  if (typeof value !== "string") return;
+  if (value.length < MIN_SECRET_LENGTH) return;
+  secrets.add(value);
+}
+
+// Replace every registered secret in `text` with its tag. The common case is an
+// empty set (nothing has been loaded yet) or a handful of entries — one session
+// token plus at most two Graph tokens per connected backend — so this returns
+// the input untouched rather than allocating when there is nothing to do.
+export function scrub(text) {
+  if (secrets.size === 0) return text;
+  let out = text;
+  for (const secret of secrets) {
+    if (out.includes(secret)) out = out.replaceAll(secret, tagFor(secret));
+  }
+  return out;
+}
+
+// Test-only: the containment suite drives several fake deployments in one
+// process and must not have one case's credentials scrubbed out of another's
+// output.
+export function resetSecrets() {
+  secrets.clear();
+}
+
+// How many secrets are currently registered. Test-only introspection — nothing
+// in the CLI branches on this.
+export function secretCount() {
+  return secrets.size;
+}

package/src/bridge/setup-claim.mjs

@@ -16,6 +16,7 @@
 import os from "node:os";
 
 import { httpJson } from "./http-json.mjs";
+import { register as registerSecret } from "./secrets.mjs";
 
 export const SETUP_CLAIM_PREFIX = "smc1_";
 
@@ -69,6 +70,11 @@ export function decodeSetupClaim(raw) {
 
   const secret = typeof parsed.s === "string" ? parsed.s : "";
   if (!secret) throw invalid("this setup command carries no connection secret.");
+  // Both halves: the secret itself, and the whole claim — the blob is a
+  // container for the secret, so a message that echoes the claim (a redeem
+  // failure quoting the request, an argv echo) leaks it just as surely.
+  registerSecret(secret);
+  registerSecret(text);
 
   let url;
   try {

package/src/builders/build.mjs

@@ -32,6 +32,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { FAVICON_LINK } from "./gate-server.mjs";
 import { lintSlidesOrThrow } from "./lint.mjs";
 import { resolveSkillForDeck } from "./resolve-skill.mjs";
 import { slideOrderWarning, sortSlideFilenames } from "../lib/slide-order.mjs";
@@ -195,7 +196,8 @@ const HTML_TEMPLATE = `<!doctype html>
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>__TITLE__</title>
+  <title>__TITLE__ — slidemind</title>
+  ${FAVICON_LINK}
   <!-- Arimo: open-source Arial-metric-compatible font. We alias it to
        "Arial" so master text pinned to Arial gets a font with the same
        horizontal extents PowerPoint/LibreOffice use, instead of macOS

package/src/builders/gate-server.mjs

@@ -13,6 +13,10 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const GATE_SESSION_PATH = path.join(__dirname, "gate-session.js");
 
 // Tab-reuse timing contract, shared by both gates and injected into their
 // overlays as CFG.pollMs / CFG.pollTtlMs:
@@ -20,6 +24,19 @@ import path from "node:path";
 //              open-browser grace window;
 //   POLL_TTL_MS > the gates' 30-min decision timeout so an abandoned tab stops
 //              polling only after the server side has certainly given up.
+// One favicon for every page slidemind opens in a browser (gates, previews,
+// sign-in): an inline data URI, so no server needs a /favicon.ico route and
+// the static preview file stays self-contained.
+export const FAVICON_LINK =
+  '<link rel="icon" href="data:image/svg+xml,' +
+  encodeURIComponent(
+    '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">' +
+      '<rect width="32" height="32" rx="7" fill="#10131b"/>' +
+      '<rect x="6.5" y="9.5" width="19" height="13" rx="3" fill="none" stroke="#a9c2ff" stroke-width="2"/>' +
+      "</svg>",
+  ) +
+  '">';
+
 export const GRACE_MS = 1500;
 export const POLL_MS = 1000;
 export const POLL_TTL_MS = 35 * 60 * 1000;
@@ -77,6 +94,138 @@ export function serveStaticFile({ roots, pathname, res }) {
   return false;
 }
 
+// Read a JSON POST body off a gate request and hand the parsed object to `cb`
+// (an unparseable/absent body becomes `{}` — a gate normalizes its own fields
+// anyway). Shared by every gate POST route (plan decision, plan backlog, and
+// the preview gate's decision + backlog next), so the 5 MB flood guard lives in
+// exactly one place. The guard matters: these servers bind loopback but any
+// page in the user's browser can POST to a known localhost port.
+export function readJsonBody(req, cb) {
+  // setEncoding matters: without it Node hands over Buffers, and `raw += chunk`
+  // stringifies each one on its own — a multi-byte character split across a
+  // chunk boundary (the plan gate's editedPlan is 50-60 KB of German markdown)
+  // comes out as U+FFFD. With the encoding set, the stream decoder holds the
+  // partial sequence back until the next chunk completes it.
+  req.setEncoding("utf8");
+  let raw = "";
+  let bytes = 0;
+  req.on("data", (chunk) => {
+    raw += chunk;
+    // The flood guard counts BYTES, not UTF-16 code units — the limit is about
+    // memory, and non-ASCII text costs more bytes than it does string length.
+    bytes += Buffer.byteLength(chunk, "utf8");
+    if (bytes > 5e6) req.destroy();
+  });
+  req.on("end", () => {
+    let payload;
+    try {
+      payload = JSON.parse(raw || "{}");
+    } catch {
+      payload = {};
+    }
+    cb(payload && typeof payload === "object" ? payload : {});
+  });
+}
+
+// ---------------------------------------------------------------------------
+// shared gate ROUTES + comment normalization
+//
+// Both gates ran byte-identical copies of the backlog route, the approve-409
+// guard and the row-normalization preamble. One copy, two per-gate field shapes.
+// ---------------------------------------------------------------------------
+
+// The identity + text core every gate row shares: `id` dedupes a client retry
+// of the same batch, `round` says which round the comment was written against
+// (a queued row is delivered a round later, so the two can differ), and a row
+// without text is dropped — an empty row prints as an instruction-free bullet.
+// `fields(c)` contributes the gate's own anchor columns.
+export function normalizeGateComments(raw, fields) {
+  if (!Array.isArray(raw)) return [];
+  const seen = new Set();
+  const out = [];
+  for (const c of raw) {
+    if (!c || typeof c !== "object") continue;
+    const text = typeof c.text === "string" ? c.text.trim() : "";
+    if (!text) continue;
+    const id = typeof c.id === "string" && c.id ? c.id : crypto.randomUUID();
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push({
+      id,
+      round: Number.isFinite(c.round) ? Number(c.round) : 1,
+      ...(fields ? fields(c) : {}),
+      text,
+      at: typeof c.at === "string" && c.at ? c.at : new Date().toISOString(),
+    });
+  }
+  return out;
+}
+
+// The reloaded tab flushes its queued rows here. Non-empty ⇒ that run never
+// parks: it resolves at once as a drain round. (The page only POSTs when it HAS
+// a backlog, so the empty branch is just a defensive ack.)
+//
+// `isSuperseded` (the gate's settled check): once another tab's drain or
+// decision has resolved this run, a late backlog must NOT be acked "drained" —
+// the client would flip its rows to "sent" while gate.resolve is a no-op and
+// the reviewer's comments silently vanish. "superseded" keeps them queued, and
+// the tab's heartbeat poll carries them into the next run.
+export function serveBacklogPost(req, res, { normalize, onDrained, isSuperseded = () => false }) {
+  readJsonBody(req, (payload) => {
+    const comments = normalize(payload.comments);
+    const state = !comments.length ? "parked" : isSuperseded() ? "superseded" : "drained";
+    res.writeHead(200, { "Content-Type": MIME[".json"] });
+    res.end(JSON.stringify({ ok: state !== "superseded", state }));
+    if (state === "drained") onDrained(comments);
+  });
+}
+
+// The decision POST, with the shared 409 guard: once this run has settled —
+// a backlog drained (the displayed round is superseded by comments the agent
+// has already been told to work) or another tab's decision landed — a late
+// decision of EITHER kind is refused. Acking a late "comments" with 200 would
+// mark them sent while gate.resolve is a no-op; the 409 keeps them queued
+// client-side for the next round.
+export function serveDecisionPost(req, res, { normalize, isSuperseded, onDecision }) {
+  readJsonBody(req, (payload) => {
+    const decision = payload.decision === "comments" ? "comments" : "approve";
+    if (isSuperseded()) {
+      res.writeHead(409, { "Content-Type": MIME[".json"] });
+      res.end(JSON.stringify({ ok: false, error: "backlog_pending" }));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": MIME[".json"] });
+    res.end(JSON.stringify({ ok: true }));
+    onDecision(decision, payload, decision === "comments" ? normalize(payload.comments) : []);
+  });
+}
+
+// ---------------------------------------------------------------------------
+// browser bundling
+// ---------------------------------------------------------------------------
+
+// Turn a dependency-free ESM module's source into plain browser JS that runs
+// inside a shared IIFE scope: drop single-line `import … from "…";` statements
+// and strip the leading `export ` keyword from declarations. The imported names
+// are provided by an earlier module in the concatenation, so removing the
+// import line just leaves the reference resolving to that top-level binding.
+export function stripModuleSyntax(src) {
+  return String(src || "")
+    .replace(/^\s*import\s+[^;]*?from\s*["'][^"']+["'];?\s*$/gm, "")
+    .replace(/^export\s+/gm, "");
+}
+
+// gate-session.js as a browser IIFE exposing window.__SLIDEMIND_GATE__. Both
+// gate pages inline this BEFORE their overlay script — the overlays' whole
+// ledger/backlog/round machinery is that one shared factory.
+export function bundleGateSession() {
+  return (
+    "(function () {\n" +
+    stripModuleSyntax(fs.readFileSync(GATE_SESSION_PATH, "utf8")) +
+    "\nwindow.__SLIDEMIND_GATE__ = { createGateSession: createGateSession };\n})();\n"
+  );
+}
+
 // The decision promise + timeout wrapper both gates block on. `resolve(value)`
 // settles the internal promise once (a Promise never re-settles, so repeat calls
 // are no-ops). `waitForDecision({ timeoutMs })` returns the promise directly when
@@ -91,13 +240,20 @@ export function createDecisionGate({
   timeoutMessage = "review timed out — no decision received",
 } = {}) {
   let resolveDecision;
+  let isSettled = false;
   const decisionPromise = new Promise((res) => {
     resolveDecision = res;
   });
   return {
     resolve(value) {
+      isSettled = true;
       resolveDecision(value);
     },
+    // Whether a decision/drain already resolved this run — the POST routes
+    // refuse late input on it, because a resolve after the first is a no-op.
+    settled() {
+      return isSettled;
+    },
     waitForDecision({ timeoutMs } = {}) {
       if (!timeoutMs) return decisionPromise;
       return new Promise((resolve, reject) => {