gamertan/sandwich-hime
1
0
Fork 0
Code Issues Pull Requests Actions Releases 3 Activity

security: publish hardened v1 initiative snapshot

Browse Source 
Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan.

This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility.

Himesan-Output-Permission: v1.0
Signed-off-by: Cole Speelman <gamertan@noreply.localhost>
This commit is contained in:
gamertan
2026-08-12 03:54:46 -04:00
parent 4166a66c66
commit 113c95c21e
22 changed files with 1028 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/compiler/context.go
+12 -10
View File
@@ -34,7 +34,8 @@ const (
)
type contextAnalyzer struct {
file *sourceFile
file *sourceFile
positions positionTable
state htmlState
currentTag string
@@ -79,7 +80,12 @@ var unsupportedDynamicAttributes = map[string]string{
}
func analyzeContexts(file *sourceFile) []Diagnostic {
analyzer := &contextAnalyzer{file: file, state: htmlData, attrFirstDynamic: -1}
analyzer := &contextAnalyzer{
file: file,
positions: newPositionTable(file.Source),
state: htmlData,
attrFirstDynamic: -1,
}
var diagnostics []Diagnostic
for nodeIndex := range file.Nodes {
node := &file.Nodes[nodeIndex]
@@ -136,20 +142,20 @@ func analyzeContexts(file *sourceFile) []Diagnostic {
}
}
end := analyzer.positions.at(len(file.Source))
if analyzer.state != htmlData {
diagnostics = append(diagnostics, diagnostic(file.Path, endPosition(file.Source), "HIM1310", "template ends in an incomplete or ambiguous HTML parser context"))
diagnostics = append(diagnostics, diagnostic(file.Path, end, "HIM1310", "template ends in an incomplete or ambiguous HTML parser context"))
}
if len(analyzer.stack) != 0 {
diagnostics = append(diagnostics, diagnostic(file.Path, endPosition(file.Source), "HIM1311", fmt.Sprintf("component must finish in its starting HTML context; unclosed <%s>", analyzer.stack[len(analyzer.stack)-1])))
diagnostics = append(diagnostics, diagnostic(file.Path, end, "HIM1311", fmt.Sprintf("component must finish in its starting HTML context; unclosed <%s>", analyzer.stack[len(analyzer.stack)-1])))
}
return diagnostics
}
func (a *contextAnalyzer) consumeText(text string, start sourcePosition) *Diagnostic {
positionTable := newPositionTable(a.file.Source)
for index := 0; index < len(text); index++ {
b := text[index]
position := positionTable.at(start.Offset + index)
position := a.positions.at(start.Offset + index)
if a.rawTag == "script" {
a.scriptTail += string(b)
if len(a.scriptTail) > len("<!--") {
@@ -614,7 +620,3 @@ func isAttributeNameChar(b byte) bool {
func isHTMLSpace(b byte) bool {
return b == ' ' || b == '\t' || b == '\r' || b == '\n' || b == '\f'
}
func endPosition(source []byte) sourcePosition {
return newPositionTable(source).at(len(source))
}