feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web
Problem: the hexagonal refactor churns the backend tree for nine more phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper, compose/web image) must move to its own repo first so doc/layout rewrites land once on a backend-only tree. Change: - New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/ (updateURL repointed to oikos-web releases), compose/, own CI (web + desktop jobs), own deploy script (CI-green gate, TOCTOU guard, version-tagged images, prune-to-3), own webhook receiver on :9798 + launchd unit, own compose project publishing the same 8091:80. - Cutover executed on mac-mini in order: oikos stack's web service stopped+removed, oikos-web project brought up on 8091; outer Caddy untouched (targets the published port) — serving + Authentik flow + /wails 404 quirk verified post-cutover. - Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install targets, the compose web service, oikos-web from deploy.sh's fallback prune list; wails + go-keyring dropped from go.mod, vendor synced. - README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now point at the new repo; mbse + mascot design docs carry a path note. Risk: production SPA serving depends on the new pipeline now; rollback is versioned-image re-up of the old web service from a pre-split checkout (port 8091). Desktop builds installed before the split still check dtoro/oikos releases — one manual reinstall, noted in the oikos-web release notes. Verification: go vet, make test (race), make generate-check, golangci (no new findings; baseline down 400→365); post-cutover curls — localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.
This commit is contained in:
382
web/node_modules/brace-expansion/index.js
generated
vendored
Normal file
382
web/node_modules/brace-expansion/index.js
generated
vendored
Normal file
@@ -0,0 +1,382 @@
|
||||
var concatMap = require('concat-map');
|
||||
var balanced = require('balanced-match');
|
||||
|
||||
module.exports = expandTop;
|
||||
|
||||
var escSlash = '\0SLASH'+Math.random()+'\0';
|
||||
var escOpen = '\0OPEN'+Math.random()+'\0';
|
||||
var escClose = '\0CLOSE'+Math.random()+'\0';
|
||||
var escComma = '\0COMMA'+Math.random()+'\0';
|
||||
var escPeriod = '\0PERIOD'+Math.random()+'\0';
|
||||
|
||||
var EXPANSION_MAX = 100000
|
||||
|
||||
// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
|
||||
// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
|
||||
// truncated to 100k results - while making every result ~1500 characters
|
||||
// long. The result set, and the intermediate arrays built while combining
|
||||
// brace sets, then grow large enough to exhaust memory and crash the process
|
||||
// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
|
||||
// characters the accumulator may hold at any point, so memory stays flat no
|
||||
// matter how many brace groups are chained. The limit sits well above any
|
||||
// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
|
||||
// characters) so legitimate input is unaffected.
|
||||
var EXPANSION_MAX_LENGTH = 4000000
|
||||
|
||||
function numeric(str) {
|
||||
return parseInt(str, 10) == str
|
||||
? parseInt(str, 10)
|
||||
: str.charCodeAt(0);
|
||||
}
|
||||
|
||||
function escapeBraces(str) {
|
||||
return str.split('\\\\').join(escSlash)
|
||||
.split('\\{').join(escOpen)
|
||||
.split('\\}').join(escClose)
|
||||
.split('\\,').join(escComma)
|
||||
.split('\\.').join(escPeriod);
|
||||
}
|
||||
|
||||
function unescapeBraces(str) {
|
||||
return str.split(escSlash).join('\\')
|
||||
.split(escOpen).join('{')
|
||||
.split(escClose).join('}')
|
||||
.split(escComma).join(',')
|
||||
.split(escPeriod).join('.');
|
||||
}
|
||||
|
||||
|
||||
// Basically just str.split(","), but handling cases
|
||||
// where we have nested braced sections, which should be
|
||||
// treated as individual members, like {a,{b,c},d}
|
||||
function parseCommaParts(str) {
|
||||
if (!str)
|
||||
return [''];
|
||||
|
||||
var parts = [];
|
||||
var m = balanced('{', '}', str);
|
||||
|
||||
if (!m)
|
||||
return str.split(',');
|
||||
|
||||
var pre = m.pre;
|
||||
var body = m.body;
|
||||
var post = m.post;
|
||||
var p = pre.split(',');
|
||||
|
||||
p[p.length-1] += '{' + body + '}';
|
||||
var postParts = parseCommaParts(post);
|
||||
if (post.length) {
|
||||
p[p.length-1] += postParts.shift();
|
||||
p.push.apply(p, postParts);
|
||||
}
|
||||
|
||||
parts.push.apply(parts, p);
|
||||
|
||||
return parts;
|
||||
}
|
||||
|
||||
function expandTop(str, options) {
|
||||
if (!str)
|
||||
return [];
|
||||
|
||||
options = options || {};
|
||||
var max = options.max == null ? EXPANSION_MAX : options.max;
|
||||
var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength;
|
||||
|
||||
// I don't know why Bash 4.3 does this, but it does.
|
||||
// Anything starting with {} will have the first two bytes preserved
|
||||
// but *only* at the top level, so {},a}b will not expand to anything,
|
||||
// but a{},b}c will be expanded to [a}c,abc].
|
||||
// One could argue that this is a bug in Bash, but since the goal of
|
||||
// this module is to match Bash's rules, we escape a leading {}
|
||||
if (str.substr(0, 2) === '{}') {
|
||||
str = '\\{\\}' + str.substr(2);
|
||||
}
|
||||
|
||||
return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
|
||||
}
|
||||
|
||||
function identity(e) {
|
||||
return e;
|
||||
}
|
||||
|
||||
function embrace(str) {
|
||||
return '{' + str + '}';
|
||||
}
|
||||
function isPadded(el) {
|
||||
return /^-?0\d/.test(el);
|
||||
}
|
||||
|
||||
function lte(i, y) {
|
||||
return i <= y;
|
||||
}
|
||||
function gte(i, y) {
|
||||
return i >= y;
|
||||
}
|
||||
|
||||
// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
|
||||
// number of results at `max` and the total number of characters at `maxLength`.
|
||||
// This is the one place output grows, so bounding it here keeps the single
|
||||
// accumulator - and therefore memory - flat regardless of how many brace groups
|
||||
// are combined (CVE-2026-14257).
|
||||
//
|
||||
// `base[a]` is the length of the part of `acc[a]` that predates the current
|
||||
// empty-drop baseline (see `expand`). The matching baselines for the results
|
||||
// are appended to `outBase`, which the caller carries forward alongside them.
|
||||
function combine(
|
||||
acc,
|
||||
base,
|
||||
pre,
|
||||
values,
|
||||
max,
|
||||
maxLength,
|
||||
dropEmpties,
|
||||
outBase
|
||||
) {
|
||||
var out = []
|
||||
var length = 0
|
||||
for (var a = 0; a < acc.length; a++) {
|
||||
for (var v = 0; v < values.length; v++) {
|
||||
if (out.length >= max) return out
|
||||
var expansion = acc[a] + pre + values[v]
|
||||
// Bash drops empty results at the top level. Skip them before they count
|
||||
// against `max`, so `max` bounds the number of *kept* results. "Empty"
|
||||
// means "adds nothing past the baseline", not "empty overall".
|
||||
if (dropEmpties && expansion.length === base[a]) continue
|
||||
if (length + expansion.length > maxLength) return out
|
||||
out.push(expansion)
|
||||
outBase.push(base[a])
|
||||
length += expansion.length
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
|
||||
// sequence body.
|
||||
function expandSequence(
|
||||
body,
|
||||
isAlphaSequence,
|
||||
max,
|
||||
maxLength
|
||||
) {
|
||||
var n = body.split(/\.\./)
|
||||
var N = []
|
||||
// A sequence body always splits into two or three parts, but the compiler
|
||||
// can't know that.
|
||||
/* c8 ignore start */
|
||||
if (n[0] === undefined || n[1] === undefined) {
|
||||
return N
|
||||
}
|
||||
/* c8 ignore stop */
|
||||
var x = numeric(n[0])
|
||||
var y = numeric(n[1])
|
||||
var width = Math.max(n[0].length, n[1].length)
|
||||
var incr =
|
||||
n.length === 3 && n[2] !== undefined ?
|
||||
Math.max(Math.abs(numeric(n[2])), 1)
|
||||
: 1
|
||||
var test = lte
|
||||
var reverse = y < x
|
||||
if (reverse) {
|
||||
incr *= -1
|
||||
test = gte
|
||||
}
|
||||
var pad = n.some(isPadded)
|
||||
|
||||
var length = 0
|
||||
for (var i = x; test(i, y) && N.length < max; i += incr) {
|
||||
var c
|
||||
if (isAlphaSequence) {
|
||||
c = String.fromCharCode(i)
|
||||
if (c === '\\') {
|
||||
c = ''
|
||||
}
|
||||
} else {
|
||||
c = String(i)
|
||||
if (pad) {
|
||||
var need = width - c.length
|
||||
if (need > 0) {
|
||||
var z = new Array(need + 1).join('0')
|
||||
if (i < 0) {
|
||||
c = '-' + z + c.slice(1)
|
||||
} else {
|
||||
c = z + c
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if (length + c.length > maxLength) break
|
||||
N.push(c)
|
||||
length += c.length
|
||||
}
|
||||
return N
|
||||
}
|
||||
|
||||
function expand(
|
||||
str,
|
||||
max,
|
||||
maxLength,
|
||||
isTop
|
||||
) {
|
||||
// Consume the string's top-level brace groups left to right, threading a
|
||||
// running set of combined prefixes (`acc`). Expanding the tail iteratively -
|
||||
// rather than recursing on `m.post` once per group - keeps the native stack
|
||||
// depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
|
||||
// longer overflow the stack, and leaves a single accumulator whose size
|
||||
// `maxLength` bounds directly (CVE-2026-14257).
|
||||
var acc = ['']
|
||||
|
||||
// Bash drops empty results, but only when the *first* group of the run is a
|
||||
// comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
|
||||
// is on the final strings, so it is applied to whichever `combine` produces
|
||||
// them (the one with no brace set left in the tail).
|
||||
//
|
||||
// The old implementation recursed on `m.post`, so the drop tested only the
|
||||
// expansion of the current call's substring. The `{a},b}` rewrite below turns
|
||||
// `isTop` back on part-way through a string, starting a fresh such run, so
|
||||
// the drop must ignore whatever `acc` already holds from earlier groups.
|
||||
// `accBase[a]` records how much of `acc[a]` predates the current run;
|
||||
// `combine` treats an expansion as empty when it adds nothing past that.
|
||||
var accBase = [0]
|
||||
var dropEmpties = false
|
||||
var firstGroup = true
|
||||
var nextBase
|
||||
|
||||
for (;;) {
|
||||
var m = balanced('{', '}', str);
|
||||
|
||||
// No brace set left: the rest of the string is literal.
|
||||
if (!m) {
|
||||
return combine(acc, accBase, str, [''], max, maxLength, dropEmpties, [])
|
||||
}
|
||||
|
||||
// no need to expand pre, since it is guaranteed to be free of brace-sets
|
||||
var pre = m.pre;
|
||||
|
||||
// For compatibility reasons, `${` is not eligible for brace expansion, and
|
||||
// on the 1.x line it suppresses expansion of the rest of the string too:
|
||||
// the whole remainder is literal. The 2.x and 5.x lines instead keep
|
||||
// expanding the tail, which is what bash does, but changing that here would
|
||||
// be a breaking change for 1.x consumers. Routed through `combine` so the
|
||||
// result is still bounded by `max` and `maxLength`.
|
||||
if (/\$$/.test(pre)) {
|
||||
return combine(acc, accBase, str, [''], max, maxLength, dropEmpties, [])
|
||||
}
|
||||
|
||||
var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
|
||||
var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
|
||||
var isSequence = isNumericSequence || isAlphaSequence;
|
||||
var isOptions = m.body.indexOf(',') >= 0;
|
||||
if (!isSequence && !isOptions) {
|
||||
// {a},b}
|
||||
if (m.post.match(/,(?!,).*\}/)) {
|
||||
str = m.pre + '{' + m.body + escClose + m.post;
|
||||
// The rewritten string is expanded as if it were a fresh top-level one,
|
||||
// so start a new empty-drop run: anchor the baseline at what `acc`
|
||||
// holds now, and let the next expanding group decide whether to drop.
|
||||
isTop = true
|
||||
firstGroup = true
|
||||
dropEmpties = false
|
||||
accBase = []
|
||||
for (var b = 0; b < acc.length; b++) {
|
||||
accBase.push(acc[b].length)
|
||||
}
|
||||
continue
|
||||
}
|
||||
// Nothing here expands, so the whole remaining string is literal.
|
||||
return combine(
|
||||
acc,
|
||||
accBase,
|
||||
pre + '{' + m.body + '}' + m.post,
|
||||
[''],
|
||||
max,
|
||||
maxLength,
|
||||
dropEmpties,
|
||||
[]
|
||||
)
|
||||
}
|
||||
|
||||
if (firstGroup) {
|
||||
dropEmpties = isTop && !isSequence
|
||||
firstGroup = false
|
||||
}
|
||||
|
||||
var values;
|
||||
if (isSequence) {
|
||||
values = expandSequence(m.body, isAlphaSequence, max, maxLength);
|
||||
} else {
|
||||
var n = parseCommaParts(m.body);
|
||||
if (n.length === 1 && n[0] !== undefined) {
|
||||
// x{{a,b}}y ==> x{a}y x{b}y
|
||||
n = expand(n[0], max, maxLength, false).map(embrace);
|
||||
//XXX is this necessary? Can't seem to hit it in tests.
|
||||
/* c8 ignore start */
|
||||
if (n.length === 1) {
|
||||
nextBase = []
|
||||
acc = combine(
|
||||
acc,
|
||||
accBase,
|
||||
pre + n[0],
|
||||
[''],
|
||||
max,
|
||||
maxLength,
|
||||
dropEmpties && !m.post.length,
|
||||
nextBase
|
||||
)
|
||||
accBase = nextBase
|
||||
if (!m.post.length) break
|
||||
str = m.post
|
||||
continue
|
||||
}
|
||||
/* c8 ignore stop */
|
||||
}
|
||||
|
||||
// Values that `combine` is going to drop as empty produce no result, so
|
||||
// they must not count against `max` - otherwise `{a,,b}` with `max: 2`
|
||||
// would stop at `['a', '']` and yield one result instead of two. Skipping
|
||||
// them outright keeps `values` bounded while leaving `max` a bound on
|
||||
// *kept* results. A value is dropped when it adds nothing past the
|
||||
// baseline, which is what `combine` tests.
|
||||
var dropsEmpties = dropEmpties && !m.post.length && !pre
|
||||
for (var d = 0; dropsEmpties && d < acc.length; d++) {
|
||||
if (acc[d].length !== accBase[d]) {
|
||||
dropsEmpties = false
|
||||
}
|
||||
}
|
||||
|
||||
values = []
|
||||
var valuesLength = 0
|
||||
outer: for (var j = 0; j < n.length; j++) {
|
||||
var expanded = expand(n[j], max, maxLength, false)
|
||||
for (var k = 0; k < expanded.length; k++) {
|
||||
var v = expanded[k]
|
||||
if (dropsEmpties && !v) continue
|
||||
if (values.length >= max || valuesLength + v.length > maxLength) {
|
||||
break outer
|
||||
}
|
||||
values.push(v)
|
||||
valuesLength += v.length
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
nextBase = []
|
||||
acc = combine(
|
||||
acc,
|
||||
accBase,
|
||||
pre,
|
||||
values,
|
||||
max,
|
||||
maxLength,
|
||||
dropEmpties && !m.post.length,
|
||||
nextBase
|
||||
)
|
||||
accBase = nextBase
|
||||
if (!m.post.length) break
|
||||
str = m.post
|
||||
}
|
||||
|
||||
return acc
|
||||
}
|
||||
Reference in New Issue
Block a user