net-mesh-cli 0.25.2__tar.gz → 0.26.0__tar.gz

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/Cargo.lock

@@ -2277,7 +2277,7 @@ dependencies = [
 
 [[package]]
 name = "net-aggregator-daemon"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "assert_cmd",
  "blake3",
@@ -2299,7 +2299,7 @@ dependencies = [
 
 [[package]]
 name = "net-cli"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "assert_cmd",
  "clap",
@@ -2326,7 +2326,7 @@ dependencies = [
 
 [[package]]
 name = "net-compute-ffi"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "bytes",
  "dashmap",
@@ -2341,7 +2341,7 @@ dependencies = [
 
 [[package]]
 name = "net-deck"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "bytes",
  "chrono",
@@ -2359,7 +2359,7 @@ dependencies = [
 
 [[package]]
 name = "net-deck-ffi"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "futures",
  "net-mesh",
@@ -2371,7 +2371,7 @@ dependencies = [
 
 [[package]]
 name = "net-mesh"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "arc-swap",
  "async-nats",
@@ -2417,7 +2417,7 @@ dependencies = [
 
 [[package]]
 name = "net-mesh-sdk"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2440,7 +2440,7 @@ dependencies = [
 
 [[package]]
 name = "net-mesh-sdk-macros"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2449,7 +2449,7 @@ dependencies = [
 
 [[package]]
 name = "net-meshdb-ffi"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "futures",
  "net-mesh",
@@ -2461,7 +2461,7 @@ dependencies = [
 
 [[package]]
 name = "net-meshos-ffi"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "bytes",
  "net-mesh",
@@ -2472,7 +2472,7 @@ dependencies = [
 
 [[package]]
 name = "net-node"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -2495,7 +2495,7 @@ dependencies = [
 
 [[package]]
 name = "net-python"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "async-trait",
  "bytes",
@@ -2516,7 +2516,7 @@ dependencies = [
 
 [[package]]
 name = "net-rpc-ffi"
-version = "0.25.2"
+version = "0.26.0"
 dependencies = [
  "async-trait",
  "bytes",

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/Cargo.toml

@@ -3,7 +3,7 @@ members = [".", "sdk", "cli", "aggregator-daemon"]
 
 [package]
 name = "net-mesh"
-version = "0.25.2"
+version = "0.26.0"
 edition = "2021"
 description = "High-performance, schema-agnostic, backend-agnostic event bus"
 license = "Apache-2.0"

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: net-mesh-cli
-Version: 0.25.2
+Version: 0.26.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/aggregator-daemon/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "net-aggregator-daemon"
-version = "0.25.2"
+version = "0.26.0"
 edition = "2021"
 description = "Long-running daemon that hosts net-mesh AggregatorRegistry + aggregator groups"
 license = "Apache-2.0"
@@ -18,14 +18,14 @@ path = "src/main.rs"
 [dependencies]
 # Substrate primitives — aggregator + lifecycle + registry +
 # RPC service all live behind the SDK's `net` feature surface.
-net-sdk = { package = "net-mesh-sdk", version = "0.25.2", path = "../sdk", default-features = false, features = [
+net-sdk = { package = "net-mesh-sdk", version = "0.26.0", path = "../sdk", default-features = false, features = [
     "net",
     "nat-traversal",
 ] }
 # Direct dep on the underlying crate so the binary can reach
 # the typed surfaces the SDK doesn't re-export (AggregatorConfig,
 # LifecycleGroup, etc).
-net = { package = "net-mesh", version = "0.25.2", path = ".." }
+net = { package = "net-mesh", version = "0.26.0", path = ".." }
 
 # Argv parsing.
 clap = { version = "4", features = ["derive", "env"] }

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "net-cli"
-version = "0.25.2"
+version = "0.26.0"
 edition = "2021"
 description = "Unified `net-mesh` command-line tool for the Net mesh"
 license = "Apache-2.0"
@@ -13,7 +13,7 @@ name = "net-mesh"
 path = "src/main.rs"
 
 [dependencies]
-net-sdk = { package = "net-mesh-sdk", version = "0.25.2", path = "../sdk", default-features = false, features = [
+net-sdk = { package = "net-mesh-sdk", version = "0.26.0", path = "../sdk", default-features = false, features = [
     "net",
     "nat-traversal",
     "cortex",

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/cli/npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@net-mesh/cli",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "description": "net-mesh — unified command-line interface for the Net mesh",
   "license": "Apache-2.0",
   "repository": {
@@ -27,13 +27,13 @@
   },
   "//": "Per-platform binary packages are listed as optionalDependencies. npm fetches only the one whose `os`/`cpu`/`libc` constraints match the install host; bin/net-mesh.js resolves whichever landed at runtime and execs the bundled binary.",
   "optionalDependencies": {
-    "@net-mesh/cli-linux-x64-gnu": "0.25.2",
-    "@net-mesh/cli-linux-x64-musl": "0.25.2",
-    "@net-mesh/cli-linux-arm64-gnu": "0.25.2",
-    "@net-mesh/cli-linux-arm64-musl": "0.25.2",
-    "@net-mesh/cli-darwin-x64": "0.25.2",
-    "@net-mesh/cli-darwin-arm64": "0.25.2",
-    "@net-mesh/cli-win32-x64": "0.25.2",
-    "@net-mesh/cli-win32-arm64": "0.25.2"
+    "@net-mesh/cli-linux-x64-gnu": "0.26.0",
+    "@net-mesh/cli-linux-x64-musl": "0.26.0",
+    "@net-mesh/cli-linux-arm64-gnu": "0.26.0",
+    "@net-mesh/cli-linux-arm64-musl": "0.26.0",
+    "@net-mesh/cli-darwin-x64": "0.26.0",
+    "@net-mesh/cli-darwin-arm64": "0.26.0",
+    "@net-mesh/cli-win32-x64": "0.26.0",
+    "@net-mesh/cli-win32-arm64": "0.26.0"
   }
 }

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/cli/python/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "maturin"
 # the deck keeps the bare `net-deck` name — see the cross-registry
 # table in the top-level README.
 name = "net-mesh-cli"
-version = "0.25.2"
+version = "0.26.0"
 description = "net-mesh — unified command-line interface for the Net mesh"
 readme = "README.md"
 license = { text = "Apache-2.0" }

net_mesh_cli-0.26.0/docs/releases/RELEASE_v0.26_MONKEY_BUSINESS.md

@@ -0,0 +1,71 @@
+# Net v0.26 — "Monkey Business"
+
+*Named after Skid Row's 1991 single — the opening track and lead-off shot from Slave to the Grind, the record that blew up the band's bubblegum-metal reputation and, in the same swing, became the first hard-rock album to debut at number one on the Billboard 200 in the SoundScan era. Their 1989 debut had floated on power ballads — "18 and Life," "I Remember You" — and the label wanted more of the same; the band handed back a heavier, meaner, downtuned record and put "Monkey Business" first, Rachel Bolan and Snake Sabo's swampy, menacing strut, all swagger and trouble grinning in the doorway.*
+
+## A full-surface security pass, and the eight places code drifted from its own safety protocols
+
+v0.26 is a security hardening release. It is the result of a full-surface review across the parts of the crate where a mistake costs the most: wire-protocol parsing, the crypto primitives, the C-ABI FFI boundary, identity / token / auth, on-disk storage, and the client SDKs.
+
+Most of the classic traps — the off-by-one slice, the unchecked length prefix, the malleable signature, the path-traversal write — already carry an explicit guard and a regression test pinning it. The eight issues that came out of the pass cluster in one place: where a single piece of code diverged from a safety protocol the rest of the codebase already follows. A blob handle that skipped the quiescing dance every other handle does. An inbound length cast the wide way in one binding and the narrow way in another. A token expiry that had a saturating add but no ceiling. The fixes mostly amount to making the outlier match the rule.
+
+**A blob handle that didn't play by the handle rules.** The crate documents a per-handle quiescing protocol for exactly one hazard: a foreign thread (a Go cgo callback, a Python thread, a Node worker) sitting inside an FFI call while another thread frees the same handle. Every mesh / cortex / redis handle embeds a small guard, gates each operation on it, and on free *leaks the handle box* rather than deallocating it — so a racing call always lands on valid memory, sees the "freeing" flag, decrements, and bails. The mesh blob-adapter handle was the one that never got the treatment: it carried only the inner pointer, and its free did an unconditional deallocation. A store / fetch / exists racing a free read freed memory; a second free was a double-free. v0.26.0 embeds the guard, gates every operation on it, and makes free leak the box and drop only the inner — the adapter now follows the same recipe as every handle around it. A regression test pins both properties: an operation on a freed handle returns the null-pointer code instead of corrupting memory, and a double-free is a no-op.
+
+**An inbound length cast the narrow way.** Inbound nRPC request bodies and the MeshOS causal-event / snapshot-restore payloads were copied from the native buffer with a 64-bit size cast down to a 32-bit signed int. A length with the high bit set went negative and crashed the copy before the handler's panic recovery could catch it; a length at or past 4 GiB modulo 2³² produced a short copy — a truncated body whose framing still claimed the original size, a clean parse-desync primitive. Both are reachable from whatever a peer puts on the wire. One binding file already did this correctly — checking the length against the platform-int maximum and copying through a wide slice — but the inbound trampolines had not been updated, in two separate binding copies. v0.26.0 routes every inbound site through one guarded helper that rejects an over-range length and copies through a wide slice, applied to both copies.
+
+**Tokens that could outlive the heat death.** A permission token's expiry was a saturating add of issue-time plus requested duration, with no cap on the duration — a caller could mint a token with a TTL of `u64::MAX`, whose expiry saturated into a timestamp that never arrives. The only way to retire such a token is an advisory revocation floor that has to be distributed out of band and that a given node might never learn to bump. v0.26.0 rejects any TTL past a one-year ceiling at issue time with a typed `TtlTooLong` error. Delegation only ever copies a parent's expiry, so the bound holds transitively down the whole chain. Long-lived grants now have to be periodically re-issued — which re-checks the issuer's signing key and current policy — and the blast radius of any single leaked token is capped at a year.
+
+**Constructors that skipped the guard.** The registry-client, fold-query-client, and channel-registration entry points, plus the blob-adapter constructor, dereferenced the inner mesh / redex node after only a null check, with no free-race guard. A concurrent free that won its race left them reading a dropped pointer. Same class as H1, narrower blast radius — these run before the handle is widely shared. v0.26.0 gates each on the relevant handle's guard; the node-clone accessors now hold the guard across the clone and return an `Option`, and every caller surfaces a null / error result when the handle is being torn down.
+
+**Clock skew with no ceiling.** The token cache's clock-skew tolerance — a knob for absorbing NTP and container-clock drift — accepted any value. A large skew symmetrically widens every token's validity window: an expired token stays accepted for that many extra seconds, across the whole cache. The default is strict (zero), so this was misconfiguration-gated rather than on by default, but there was no guardrail. v0.26.0 clamps the tolerance to five minutes, which comfortably covers real drift while keeping a fat-fingered config from turning the expiry check into a rubber stamp.
+
+---
+
+## Test hygiene
+
+- **Every fix that could carry a regression test does.** The H1 fix pins that an operation on a freed handle bails with the null-pointer code and that a double-free is a no-op. The H3 fix pins rejection at and past the TTL ceiling and a valid, non-saturating token at exactly the ceiling. The M2 fix pins the skew clamp on both the constructor and the setter. The L3 fix plants a symlink to an out-of-root secret and asserts that fetch, exists, and stream all refuse it.
+- **A follow-up review caught two things the fixes themselves introduced.** Bounding the TTL turned the SDK's infallible token-issue helper — which unwraps the fallible path — into a panic on an over-long TTL; it now soft-clamps to the ceiling instead, matching the existing zero-TTL soft-clamp, with its own release / debug / fallible test trio. The new read-path symlink test was gated to the platforms that can plant a unix symlink, and the blob existence probe re-applied its regular-file contract so a directory sitting at a blob slot is not reported as present.
+- **The full library test suite passes**, including the new regression tests.
+
+---
+
+## Breaking changes
+
+### `TokenError` has a new `TtlTooLong` variant
+
+Additive, but `TokenError` is a plain enum — downstream code that matches it exhaustively without a wildcard arm will need a new arm for the variant. The binding error-string maps were updated in lockstep (`ttl_too_long`).
+
+### Token TTL is capped at one year
+
+`try_issue` returns `TtlTooLong` for any duration past the one-year ceiling; the infallible `issue` wrapper panics on it (use `try_issue` for untrusted input). The SDK's infallible `issue_token` soft-clamps to the ceiling rather than panicking. Callers that were minting multi-year or never-expiring tokens must re-issue inside the bound or move to a periodic re-issue.
+
+### Clock-skew tolerance is capped at five minutes
+
+`TokenCache::with_clock_skew` / `set_clock_skew` clamp any larger value to five minutes. A config that set a larger skew silently receives the clamp.
+
+### New public constants
+
+`MAX_TOKEN_TTL_SECS` (one year) and `MAX_TOKEN_CLOCK_SKEW_SECS` (five minutes) are exported from the identity module for callers that want to check before they call.
+
+---
+
+## How to upgrade
+
+1. **Most consumers — bump the dependency.** The fixes are on by default and need no source changes unless you mint tokens with very long TTLs, configure a large clock skew, or match `TokenError` exhaustively.
+
+2. **Token issuers — check your TTLs.** Anything past one year is now rejected on the fallible path and clamped on the SDK's infallible path. If you were relying on a never-expiring token, switch to a periodic re-issue — that is the point of the cap. `MAX_TOKEN_TTL_SECS` is the ceiling to check against.
+
+3. **Anyone matching `TokenError` — add the `TtlTooLong` arm.** Exhaustive matches without a wildcard will not compile until you do.
+
+4. **Operators who tuned clock skew — confirm your value.** Anything above five minutes is now clamped to it. If you genuinely needed a wider window you were papering over a clock problem; fix the clock instead.
+
+5. **Foreign-language callers sharing handles — no API change, but the race is now safe.** Sharing a blob-adapter handle across threads and racing a free against an in-flight call no longer corrupts memory — the racing call bails with the null-pointer code. No code change required.
+
+6. Wire format is unchanged; v0.25 and v0.26.0 peers handshake cleanly.
+
+---
+
+Released 2026-05-28.
+
+## License
+
+See [LICENSE](../../LICENSE).

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "maturin"
 # the deck keeps the bare `net-deck` name — see the cross-registry
 # table in the top-level README.
 name = "net-mesh-cli"
-version = "0.25.2"
+version = "0.26.0"
 description = "net-mesh — unified command-line interface for the Net mesh"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/sdk/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "net-mesh-sdk"
-version = "0.25.2"
+version = "0.26.0"
 edition = "2021"
 description = "Ergonomic Rust SDK for the Net mesh network"
 license = "Apache-2.0"
@@ -22,7 +22,7 @@ name = "net_sdk"
 [dependencies]
 # `version` is required for `cargo publish` to resolve the dep on
 # crates.io; the `path` is preferred during local workspace builds.
-net = { package = "net-mesh", version = "0.25.2", path = "..", features = [] }
+net = { package = "net-mesh", version = "0.26.0", path = "..", features = [] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 bytes = "1"
@@ -40,7 +40,7 @@ schemars = { version = "1", optional = true }
 # `net-mesh-sdk-macros` ships the `#[tool]` attribute proc-macro.
 # Gated by the `macros` feature so users who don't want the
 # proc-macro2 / syn / quote dep tree don't pay for it.
-net-mesh-sdk-macros = { version = "0.25.2", path = "../sdk-macros", optional = true }
+net-mesh-sdk-macros = { version = "0.26.0", path = "../sdk-macros", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "time", "test-util"] }

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/sdk-py/pyproject.toml

@@ -7,11 +7,11 @@ build-backend = "setuptools.build_meta"
 # `net_sdk` (the package directory under `src/` is unchanged) so
 # user code keeps `import net_sdk` working.
 name = "net-mesh-sdk"
-version = "0.25.2"
+version = "0.26.0"
 description = "Ergonomic Python SDK for the Net mesh network"
 license = { text = "Apache-2.0" }
 requires-python = ">=3.10"
-dependencies = ["net-mesh>=0.25.2"]
+dependencies = ["net-mesh>=0.26.0"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/sdk-py/src/net_sdk/__init__.py

@@ -285,4 +285,4 @@ __all__ += [
     "watch_tools",
 ]
 
-__version__ = "0.25.2"
+__version__ = "0.26.0"

{net_mesh_cli-0.25.2 → net_mesh_cli-0.26.0}/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@net-mesh/sdk",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "description": "Ergonomic TypeScript SDK for the Net mesh network",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -39,7 +39,7 @@
     "test:watch": "vitest"
   },
   "peerDependencies": {
-    "@net-mesh/core": ">=0.25.2"
+    "@net-mesh/core": ">=0.26.0"
   },
   "devDependencies": {
     "@net-mesh/core": "file:../bindings/node",