Harden security artifact review handling

Author: elkaix

.github/workflows/security.yml

@@ -56,6 +56,7 @@ jobs:
           node-version-file: .nvmrc
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: node --test scripts/security/*.test.mjs
       - run: pnpm -C apps/pythinker-code run prepack
       - run: pnpm -C apps/desktop run package
       - run: pnpm -C docs run build

docs/security/dependency-remediation-2026-08.md

@@ -10,7 +10,7 @@ Advisories. The remediated lockfile returns zero vulnerabilities at every severi
 An unreachable advisory is still a valid dependency finding. Reachability affects urgency and
 test scope. It does not change an advisory to a false positive.
 
-## Evidence Authority
+## Evidence authority
 
 Use evidence in this order:
 
@@ -21,7 +21,7 @@ Use evidence in this order:
 
 Discovery sources can corroborate a result. They do not establish a safe version floor.
 
-## Remediation Ownership
+## Remediation ownership
 
 | Phase | Package families |
 | --- | --- |
@@ -32,7 +32,7 @@ Discovery sources can corroborate a result. They do not establish a safe version
 
 Each family has one phase owner. Browser DOMPurify work includes both Mermaid and Monaco.
 
-## Reachability Record
+## Reachability record
 
 | Code | Family | Repository evidence and reachability |
 | --- | --- | --- |
@@ -48,7 +48,7 @@ Each family has one phase owner. Browser DOMPurify work includes both Mermaid an
 | R10 | Monaco | The web editor loads Monaco. Monaco 0.55.1 embedded DOMPurify 3.2.7 in its ESM, development, and minified distributions. A pnpm patch replaces the ESM implementation with DOMPurify 3.4.14 and removes CommonJS metadata. Post-install pruning removes the two unused vulnerable distributions. A lockfile override alone is not accepted. |
 | R11 | Tooling and package families | brace-expansion, js-yaml, Vite, esbuild, PostCSS, nanoid, linkify-it, qs, and body-parser occur in build, package, docs, test, or transitive runtime graphs. Full-workspace audit and artifact checks cover them even when production-only audit classification excludes them. |
 
-## Verification Contract
+## Verification contract
 
 The following checks are required:
 
@@ -61,7 +61,7 @@ The following checks are required:
 The browser check does not rely only on license banners or version strings. It verifies that event
 handlers, script elements, and `javascript:` URLs cannot execute or remain active in rendered DOM.
 
-## Alert and Recurrence Policy
+## Alert and recurrence policy
 
 - Pull requests block every net-new dependency vulnerability, at every severity.
 - Critical and High disclosures receive triage within 24 hours and a fix target of 72 hours.

scripts/security/check-built-browser.mjs

@@ -253,13 +253,35 @@ class CdpClient {
   constructor(url) {
     this.nextId = 1;
     this.pending = new Map();
+    this.failure = null;
     this.socket = new WebSocket(url);
+    this.socket.addEventListener('close', () => {
+      this.rejectPending(new Error('CDP WebSocket closed.'));
+    });
+    this.socket.addEventListener('error', () => {
+      this.rejectPending(new Error('CDP WebSocket failed.'));
+    });
   }
 
   async connect() {
+    if (this.failure) throw this.failure;
     await new Promise((resolveOpen, reject) => {
-      this.socket.addEventListener('open', resolveOpen, { once: true });
-      this.socket.addEventListener('error', reject, { once: true });
+      const cleanup = () => {
+        this.socket.removeEventListener('open', onOpen);
+        this.socket.removeEventListener('close', onFailure);
+        this.socket.removeEventListener('error', onFailure);
+      };
+      const onOpen = () => {
+        cleanup();
+        resolveOpen();
+      };
+      const onFailure = () => {
+        cleanup();
+        reject(this.failure ?? new Error('CDP WebSocket failed before opening.'));
+      };
+      this.socket.addEventListener('open', onOpen, { once: true });
+      this.socket.addEventListener('close', onFailure, { once: true });
+      this.socket.addEventListener('error', onFailure, { once: true });
     });
     this.socket.addEventListener('message', (event) => {
       const message = JSON.parse(String(event.data));
@@ -273,14 +295,30 @@ class CdpClient {
   }
 
   call(method, params = {}) {
+    if (this.failure) return Promise.reject(this.failure);
+    if (this.socket.readyState !== WebSocket.OPEN) {
+      return Promise.reject(new Error('CDP WebSocket is not open.'));
+    }
     const id = this.nextId++;
     return new Promise((resolveCall, reject) => {
       this.pending.set(id, { resolve: resolveCall, reject });
-      this.socket.send(JSON.stringify({ id, method, params }));
+      try {
+        this.socket.send(JSON.stringify({ id, method, params }));
+      } catch (error) {
+        this.pending.delete(id);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
     });
   }
 
+  rejectPending(error) {
+    this.failure ??= error;
+    for (const pending of this.pending.values()) pending.reject(this.failure);
+    this.pending.clear();
+  }
+
   close() {
+    this.rejectPending(new Error('CDP WebSocket closed.'));
     this.socket.close();
   }
 }
@@ -454,11 +492,15 @@ async function main() {
   }
 }
 
-try {
-  await main();
-} catch (error) {
-  process.stderr.write(
-    `Built browser security failed: ${error instanceof Error ? error.message : String(error)}\n`,
-  );
-  process.exitCode = 1;
+if (process.argv[1] && resolve(process.argv[1]) === import.meta.filename) {
+  try {
+    await main();
+  } catch (error) {
+    process.stderr.write(
+      `Built browser security failed: ${error instanceof Error ? error.message : String(error)}\n`,
+    );
+    process.exitCode = 1;
+  }
 }
+
+export { CdpClient };

scripts/security/check-built-browser.test.mjs

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { CdpClient } from './check-built-browser.mjs';
+
+class FakeWebSocket extends EventTarget {
+  static OPEN = 1;
+
+  readyState = FakeWebSocket.OPEN;
+
+  send() {}
+
+  close() {
+    this.dispatchEvent(new Event('close'));
+  }
+}
+
+async function expectPendingCallRejection(eventName) {
+  const OriginalWebSocket = globalThis.WebSocket;
+  globalThis.WebSocket = FakeWebSocket;
+  try {
+    const client = new CdpClient('ws://artifact-security.test');
+    const pending = client.call('Runtime.enable');
+    client.socket.dispatchEvent(new Event(eventName));
+    for (const call of [pending, client.call('Page.enable')]) {
+      await assert.rejects(
+        Promise.race([
+          call,
+          new Promise((_, reject) => {
+            setTimeout(() => {
+              reject(new Error('CDP call did not reject.'));
+            }, 50);
+          }),
+        ]),
+        /CDP WebSocket (closed|failed)/,
+      );
+    }
+  } finally {
+    globalThis.WebSocket = OriginalWebSocket;
+  }
+}
+
+void test('rejects pending calls when the CDP socket closes', async () => {
+  await expectPendingCallRejection('close');
+});
+
+void test('rejects pending calls when the CDP socket fails', async () => {
+  await expectPendingCallRejection('error');
+});