dtoro
d4d99a7473
Problem: the hexagonal refactor churns the backend tree for nine more phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper, compose/web image) must move to its own repo first so doc/layout rewrites land once on a backend-only tree. Change: - New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/ (updateURL repointed to oikos-web releases), compose/, own CI (web + desktop jobs), own deploy script (CI-green gate, TOCTOU guard, version-tagged images, prune-to-3), own webhook receiver on :9798 + launchd unit, own compose project publishing the same 8091:80. - Cutover executed on mac-mini in order: oikos stack's web service stopped+removed, oikos-web project brought up on 8091; outer Caddy untouched (targets the published port) — serving + Authentik flow + /wails 404 quirk verified post-cutover. - Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install targets, the compose web service, oikos-web from deploy.sh's fallback prune list; wails + go-keyring dropped from go.mod, vendor synced. - README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now point at the new repo; mbse + mascot design docs carry a path note. Risk: production SPA serving depends on the new pipeline now; rollback is versioned-image re-up of the old web service from a pre-split checkout (port 8091). Desktop builds installed before the split still check dtoro/oikos releases — one manual reinstall, noted in the oikos-web release notes. Verification: go vet, make test (race), make generate-check, golangci (no new findings; baseline down 400→365); post-cutover curls — localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.
26 lines
1.0 KiB
JavaScript
26 lines
1.0 KiB
JavaScript
"use strict";
|
|
|
|
exports.__esModule = true;
|
|
exports.MAX_NESTING_DEPTH = void 0;
|
|
exports["default"] = resolveMaxNestingDepth;
|
|
/**
|
|
* The default maximum selector nesting depth allowed when parsing or
|
|
* serializing a selector. Going beyond this would otherwise recurse deeply
|
|
* enough to overflow the call stack (CVE-2026-9358 / CWE-674). Real-world
|
|
* selectors never get anywhere near this, so it acts purely as a safety net
|
|
* that turns an uncatchable stack overflow into a catchable error.
|
|
*/
|
|
var MAX_NESTING_DEPTH = exports.MAX_NESTING_DEPTH = 256;
|
|
|
|
/**
|
|
* Coerce a user-supplied nesting-depth limit into a safe value. Anything that
|
|
* is not a non-negative safe integer (NaN, Infinity, negative numbers, or a
|
|
* non-number) would disable or break the guard, so it falls back to the
|
|
* default.
|
|
*
|
|
* @param {unknown} value the limit provided through the `maxNestingDepth` option
|
|
* @returns {number} a safe, non-negative integer limit
|
|
*/
|
|
function resolveMaxNestingDepth(value) {
|
|
return Number.isSafeInteger(value) && value >= 0 ? value : MAX_NESTING_DEPTH;
|
|
} |