fix: harden CI portability and bounded parsers

Accept ordinary Windows path aliases without relaxing junction defenses, replace uncontrolled regex parsing with linear scans, and make HTML escaping single-pass so the full Windows and CodeQL gates can run cleanly.

Author: sviat-barbutsa

apps/daemon/src/services/effect-journal.ts

@@ -362,14 +362,7 @@ export class OperationEffectJournal {
 
   private requireSafeDirectory(): string {
     fs.mkdirSync(this.stateRoot, { recursive: true, mode: 0o700 });
-    const stat = fs.lstatSync(this.stateRoot);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-      throw new Error("Operation effect state directory is unsafe.");
-    }
-    const real = fs.realpathSync(this.stateRoot);
-    if (comparablePath(real) !== comparablePath(this.stateRoot)) {
-      throw new Error("Operation effect state directory traverses a link.");
-    }
+    assertLinkFreeDirectoryPath(this.stateRoot);
     return this.stateRoot;
   }
 
@@ -644,12 +637,26 @@ function assertOpenedPathContained(directory: string, filePath: string): void {
   const realFile = fs.realpathSync(filePath);
   if (
     comparablePath(path.dirname(realFile)) !== comparablePath(realDirectory) ||
-    path.basename(realFile) !== path.basename(filePath)
+    comparablePath(path.basename(realFile)) !== comparablePath(path.basename(filePath))
   ) {
     throw new Error("Operation effect file escaped its state directory.");
   }
 }
 
+function assertLinkFreeDirectoryPath(target: string): void {
+  const resolved = path.resolve(target);
+  const root = path.parse(resolved).root;
+  const relative = path.relative(root, resolved);
+  let current = root;
+  for (const component of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, component);
+    const stat = fs.lstatSync(current);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new Error("Operation effect state directory traverses a link.");
+    }
+  }
+}
+
 function assertSameOpenedFile(filePath: string, opened: ReturnType<typeof fs.fstatSync>): void {
   const current = fs.lstatSync(filePath);
   if (

apps/daemon/src/services/session-visibility.ts

@@ -59,7 +59,7 @@ export class SessionAuthorityStore {
   private appendQueue: Promise<void> = Promise.resolve();
 
   constructor(options: SessionAuthorityOptions) {
-    this.stateRoot = options.stateRoot ?? defaultAuthorityStateRoot();
+    this.stateRoot = path.resolve(options.stateRoot ?? defaultAuthorityStateRoot());
     this.namespace = options.namespace;
     if (!/^[a-f0-9]{64}$/.test(this.namespace)) throw new Error("Invalid authority namespace.");
     this.suppliedKey = options.key ? Buffer.from(options.key) : undefined;
@@ -253,14 +253,7 @@ export class SessionAuthorityStore {
   }
 
   private async requireExistingSafeDirectory(): Promise<string> {
-    const stat = await fs.lstat(this.stateRoot);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-      throw new Error("Session authority state directory is unsafe.");
-    }
-    const real = await fs.realpath(this.stateRoot);
-    if (comparablePath(real) !== comparablePath(path.resolve(this.stateRoot))) {
-      throw new Error("Session authority state directory traverses a link.");
-    }
+    await assertLinkFreeDirectoryPath(this.stateRoot);
     return this.stateRoot;
   }
 
@@ -390,11 +383,28 @@ async function rejectLinkIfPresent(filePath: string): Promise<void> {
 
 async function assertOpenedPathContained(directory: string, filePath: string): Promise<void> {
   const [realDirectory, realFile] = await Promise.all([fs.realpath(directory), fs.realpath(filePath)]);
-  if (path.dirname(realFile) !== realDirectory || path.basename(realFile) !== path.basename(filePath)) {
+  if (
+    comparablePath(path.dirname(realFile)) !== comparablePath(realDirectory) ||
+    comparablePath(path.basename(realFile)) !== comparablePath(path.basename(filePath))
+  ) {
     throw new Error("Authority file escaped its state directory.");
   }
 }
 
+async function assertLinkFreeDirectoryPath(target: string): Promise<void> {
+  const resolved = path.resolve(target);
+  const root = path.parse(resolved).root;
+  const relative = path.relative(root, resolved);
+  let current = root;
+  for (const component of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, component);
+    const stat = await fs.lstat(current);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new Error("Session authority state directory traverses a link.");
+    }
+  }
+}
+
 function comparablePath(value: string): string {
   const normalized = path.normalize(value);
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;

packages/assistant-runtime/src/openai-compatible.test.ts

@@ -4,9 +4,40 @@ import {
   callAiProviderJson,
   callOpenAiCompatibleJson,
   checkAiProvider,
+  openAiChatCompletionsUrl,
+  openAiModelsUrl,
+  parseJsonObjectFromText,
   runWithAuthorizedProviderRequestForTesting
 } from "./openai-compatible.js";
 
+test("provider URL normalization handles long slash runs without regex backtracking", () => {
+  const slashes = "/".repeat(100_000);
+  assert.equal(
+    openAiChatCompletionsUrl(`http://127.0.0.1:1234/v1${slashes}`),
+    "http://127.0.0.1:1234/v1/chat/completions"
+  );
+  assert.equal(
+    openAiModelsUrl(`http://127.0.0.1:1234/v1/chat/completions${slashes}`),
+    "http://127.0.0.1:1234/v1/models"
+  );
+});
+
+test("provider JSON parser extracts fenced objects with a linear delimiter scan", () => {
+  assert.deepEqual(
+    parseJsonObjectFromText('preface\n```JSON \n {"ok":true,"ticks":"``"} \n```\nafter'),
+    { ok: true, value: { ok: true, ticks: "``" } }
+  );
+  assert.deepEqual(
+    parseJsonObjectFromText(`preface\n\`\`\`json\n${" ".repeat(100_000)}{"ok":true}\n\`\`\`\nafter`),
+    { ok: true, value: { ok: true } }
+  );
+  assert.deepEqual(
+    parseJsonObjectFromText("```json\n{\"ok\":true}"),
+    { ok: true, value: { ok: true } },
+    "an unterminated fence still falls back to balanced JSON extraction"
+  );
+});
+
 test("callOpenAiCompatibleJson accepts array-form message content", async (t) => {
   const originalFetch = globalThis.fetch;
   globalThis.fetch = (async () => new Response(JSON.stringify({

packages/assistant-runtime/src/openai-compatible.ts

@@ -857,12 +857,15 @@ function openAiCompatibleDefaultEndpoint(
 }
 
 function nativeApiBase(endpoint: string | undefined, fallback: string): string {
-  const trimmed = (endpoint || fallback).trim().replace(/\/+$/g, "");
+  const trimmed = stripTrailingSlashes((endpoint || fallback).trim());
   if (!trimmed) throw new Error("Provider endpoint is required.");
-  return trimmed
-    .replace(/\/v1(?:\/.*)?$/g, "")
-    .replace(/\/api\/v1(?:\/.*)?$/g, "")
-    .replace(/\/api(?:\/.*)?$/g, "");
+  return stripPathFromSegment(
+    stripPathFromSegment(
+      stripPathFromSegment(trimmed, "/v1"),
+      "/api/v1"
+    ),
+    "/api"
+  );
 }
 
 function ollamaApiUrl(endpoint: string | undefined, route: "chat" | "tags"): string {
@@ -880,28 +883,31 @@ function requireAnthropicApiKey(apiKey: string | undefined): string {
 }
 
 export function openAiChatCompletionsUrl(endpoint: string): string {
-  const trimmed = endpoint.trim().replace(/\/+$/g, "");
+  const trimmed = stripTrailingSlashes(endpoint.trim());
   if (!trimmed) throw new Error("OpenAI-compatible endpoint is required.");
   if (trimmed.endsWith("/chat/completions")) return trimmed;
   if (trimmed.endsWith("/v1")) return `${trimmed}/chat/completions`;
   return `${trimmed}/v1/chat/completions`;
 }
 
 export function openAiModelsUrl(endpoint: string): string {
-  const trimmed = endpoint.trim().replace(/\/+$/g, "");
+  const trimmed = stripTrailingSlashes(endpoint.trim());
   if (!trimmed) throw new Error("OpenAI-compatible endpoint is required.");
   if (trimmed.endsWith("/models")) return trimmed;
-  if (trimmed.endsWith("/chat/completions")) return `${trimmed.replace(/\/chat\/completions$/g, "")}/models`;
+  if (trimmed.endsWith("/chat/completions")) {
+    return `${trimmed.slice(0, -"/chat/completions".length)}/models`;
+  }
   if (trimmed.endsWith("/v1")) return `${trimmed}/models`;
   return `${trimmed}/v1/models`;
 }
 
 function providerModelsUrls(endpoint: string): string[] {
-  const trimmed = endpoint.trim().replace(/\/+$/g, "");
+  const trimmed = stripTrailingSlashes(endpoint.trim());
   const urls = [openAiModelsUrl(trimmed)];
-  const withoutVersion = trimmed
-    .replace(/\/v1(?:\/.*)?$/g, "")
-    .replace(/\/api\/v1(?:\/.*)?$/g, "");
+  const withoutVersion = stripPathFromSegment(
+    stripPathFromSegment(trimmed, "/v1"),
+    "/api/v1"
+  );
   if (withoutVersion) {
     urls.push(`${withoutVersion}/api/v1/models`);
     urls.push(`${withoutVersion}/v1/models`);
@@ -934,10 +940,10 @@ export function parseJsonObjectFromText(input: string): { ok: true; value: unkno
   const trimmed = input.trim();
   if (!trimmed) return { ok: false, error: "empty response" };
 
-  const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(trimmed);
+  const fenced = extractMarkdownFence(trimmed);
   const candidates = [
     trimmed,
-    fenced?.[1],
+    fenced,
     extractBalancedJson(trimmed)
   ].filter((candidate): candidate is string => Boolean(candidate?.trim()));
 
@@ -956,6 +962,51 @@ export function parseJsonObjectFromText(input: string): { ok: true; value: unkno
   return { ok: false, error: "no parseable JSON object found" };
 }
 
+/** Removes only terminal slash characters with one bounded reverse scan. */
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
+  return end === value.length ? value : value.slice(0, end);
+}
+
+/**
+ * Mirrors the former endpoint suffix normalization without an unanchored
+ * wildcard expression. A segment qualifies only at the end or before another
+ * slash, and the first qualifying segment wins just as left-to-right matching
+ * did. Provider egress still crosses authorizedProviderFetch afterwards.
+ */
+function stripPathFromSegment(value: string, segment: string): string {
+  let offset = 0;
+  while (offset < value.length) {
+    const index = value.indexOf(segment, offset);
+    if (index < 0) return value;
+    const boundary = index + segment.length;
+    if (boundary === value.length || value.charCodeAt(boundary) === 47) {
+      return value.slice(0, index);
+    }
+    offset = index + 1;
+  }
+  return value;
+}
+
+/** Extracts the first Markdown fence in linear time without regex backtracking. */
+function extractMarkdownFence(value: string): string | undefined {
+  const opening = value.indexOf("```");
+  if (opening < 0) return undefined;
+  let contentStart = opening + 3;
+  if (value.slice(contentStart, contentStart + 4).toLowerCase() === "json") {
+    contentStart += 4;
+  }
+  while (
+    contentStart < value.length &&
+    value[contentStart]!.trim().length === 0
+  ) {
+    contentStart += 1;
+  }
+  const closing = value.indexOf("```", contentStart);
+  return closing < 0 ? undefined : value.slice(contentStart, closing);
+}
+
 async function callOllamaText(
   config: AiProviderConfig,
   messages: AiChatMessage[],

packages/core/src/text.test.ts

@@ -0,0 +1,13 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { normalizeSlug } from "./text.js";
+
+test("normalizeSlug trims boundary dashes while preserving allowed internal runs", () => {
+  const internal = "-".repeat(32_768);
+  assert.equal(
+    normalizeSlug(`---Alpha${internal}Beta---`, {
+      collapse: /[^a-z0-9-]+/g
+    }),
+    `alpha${internal}beta`
+  );
+});

packages/core/src/text.ts

@@ -62,12 +62,19 @@ export function normalizeSlug(input: string | undefined, options: NormalizeSlugO
     .toLowerCase();
   if (options.strip) value = value.replace(options.strip, "");
   if (options.mapToDash) value = value.replace(options.mapToDash, "-");
-  value = value
-    .replace(options.collapse ?? /[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+  value = value.replace(options.collapse ?? /[^a-z0-9]+/g, "-");
+  value = trimAsciiDashes(value);
   return value || options.fallback || "";
 }
 
+function trimAsciiDashes(input: string): string {
+  let start = 0;
+  let end = input.length;
+  while (start < end && input.charCodeAt(start) === 45) start += 1;
+  while (end > start && input.charCodeAt(end - 1) === 45) end -= 1;
+  return start === 0 && end === input.length ? input : input.slice(start, end);
+}
+
 /** Splits a comma-separated list, trimming items and dropping empties. */
 export function splitList(input: string): string[] {
   return input

packages/mcp-tools/src/install.test.ts

@@ -24,6 +24,22 @@ test("installs codex HTTP MCP config without auth token in none mode", async ()
   assert.doesNotMatch(config, /bearer_token_env_var/);
 });
 
+test("normalizes a long trailing slash run in the daemon URL", async () => {
+  const temp = await fs.mkdtemp(path.join(os.tmpdir(), "zharwing-mcp-install-"));
+  const configPath = path.join(temp, "config.toml");
+
+  await installMcpClient({
+    client: "codex",
+    transport: "http",
+    authMode: "none",
+    daemonUrl: `http://127.0.0.1:37841${"/".repeat(32_768)}`,
+    configPath
+  });
+
+  const config = await fs.readFile(configPath, "utf8");
+  assert.match(config, /url = "http:\/\/127\.0\.0\.1:37841\/mcp"/);
+});
+
 test("installs the dedicated Zharwing agent credential for Codex HTTP", async () => {
   const temp = await fs.mkdtemp(path.join(os.tmpdir(), "zharwing-mcp-install-"));
   const configPath = path.join(temp, "config.toml");

packages/mcp-tools/src/install.ts

@@ -511,7 +511,9 @@ async function backupFile(filePath: string, contents: string): Promise<string> {
 }
 
 function trimTrailingSlash(input: string): string {
-  return input.replace(/\/+$/, "");
+  let end = input.length;
+  while (end > 0 && input.charCodeAt(end - 1) === 47) end -= 1;
+  return end === input.length ? input : input.slice(0, end);
 }
 
 function ensureTrailingNewline(input: string): string {

packages/storage/src/fs.test.ts

@@ -1,6 +1,9 @@
 import assert from "node:assert/strict";
-import test from "node:test";
-import { normalizeInteropPath } from "./fs.js";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test, { type TestContext } from "node:test";
+import { atomicWriteText, normalizeInteropPath, readBoundedJson } from "./fs.js";
 
 test("normalizeInteropPath maps WSL mount paths for a Windows daemon", () => {
   assert.equal(
@@ -25,3 +28,36 @@ test("normalizeInteropPath leaves native paths unchanged", () => {
   assert.equal(normalizeInteropPath("/srv/project", "linux", false), "/srv/project");
   assert.equal(normalizeInteropPath("D:\\project", "win32", false), "D:\\project");
 });
+
+test("safe storage accepts an ordinary Windows path through an extended-length alias", async (t) => {
+  const ordinaryRoot = await tempRoot(t);
+  const root = process.platform === "win32" ? path.toNamespacedPath(ordinaryRoot) : ordinaryRoot;
+  const target = path.join(root, "records", "record.json");
+  await atomicWriteText(target, '{"ok":true}\n', { root });
+  assert.deepEqual(await readBoundedJson(target, { root, maximumBytes: 1_024 }), { ok: true });
+});
+
+test("safe storage rejects a junction or symlink inside its owner root", async (t) => {
+  const root = await tempRoot(t);
+  const owner = path.join(root, "owner");
+  const outside = path.join(root, "outside");
+  const linked = path.join(owner, "linked");
+  await fs.mkdir(owner);
+  await fs.mkdir(outside);
+  try {
+    await fs.symlink(outside, linked, process.platform === "win32" ? "junction" : "dir");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "EPERM") return;
+    throw error;
+  }
+  await assert.rejects(
+    atomicWriteText(path.join(linked, "record.json"), "{}\n", { root: owner }),
+    /traverses a filesystem link/
+  );
+});
+
+async function tempRoot(t: TestContext): Promise<string> {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "zharwing-storage-paths-"));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  return root;
+}