openvibers/openvibe.tools Commits

openvibe-shared v4.59.0 (was v4.57.1) (#160)

OP OpenVibers committed 13 days ago · 4c7036e0c7 · 18 files, +22 −24

* openvibe-shared v4.59.0 (was v4.57.1)

Opened by scripts/pin-bump.js in OpenVibers/OpenVibe.Shared after the v4.59.0 release.

* The Pair: Tools's logo files are the new mark

The logo files this repo ships itself, rebuilt with openvibe-shared/app-icon (scripts/build-app-icons.js) from
Shared 4.59.0: the ring O and the round V on the network's navy.

* Perf budgets for openvibe-shared 4.59.0: the Pair mark beside the name, set in the brand face

Raised to the sizes this PR's CI measured (over budget: jsRawKB 294 > 292;jsBrotliKB 72.5 > 72;), with a dated note.

* The audio hardening test holds on an ffmpeg that already refuses a local segment

The test first proved the playlist attack works on unhardened ffprobe. The CI runner's newer ffmpeg (2026-10-31) refuses the local segment by itself, so that precondition failed the suite. It is now checked only where the attack is real; the tools' whitelists, sniffing, duration cap and deadlines are checked as before.

Changes

ddiff --git a/README.md b/README.md
iindex 592e071..5a59925 100644
---- a/README.md
++++ b/README.md
@@@ -31,7 +31,7 @@ offline against the Network's public key (JWKS).
    OpenVibe.Search (tool documents), OpenVibe.Community (the paste hand-over), OpenVibe.Billing (job usage
    readings)
  - host programs some tools need (ffmpeg, yt-dlp, qpdf, poppler, libheif; [Host packages](#host-packages-some-tools-need))
--- in each app: `openvibe-contracts` v0.92.0 (img, audio, docs, gateway), `openvibe-sdk` v0.12.0 and `openvibe-shared` v4.57.1, pinned
++- in each app: `openvibe-contracts` v0.92.0 (img, audio, docs, gateway), `openvibe-sdk` v0.12.0 and `openvibe-shared` v4.59.0, pinned
    by release tarball, and `apps/_shared` (openvibe-tools-shared) by relative path
  
  ## Capabilities
@@@ -642,5 +642,5 @@ counters and salt use Valkey through `VALKEY_URL`, with process-local state when
  <!-- versions:start -->
  - openvibe-contracts: v0.222.0
  - openvibe-sdk: v0.74.0
--- openvibe-shared: v4.57.1
++- openvibe-shared: v4.59.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 85b59d5..6d96ae2 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -18,7 +18,7 @@
    "domain": "openvibe.tools and *.openvibe.tools",
    "contracts": "openvibe-contracts v0.222.0 (the gateway, img, audio and docs apps' package.json; the root package.json pins none)",
    "sdk": "openvibe-sdk v0.74.0 (the gateway's package.json; the other apps are still on v0.67.0)",
--  "shared": "openvibe-shared v4.57.1 (each app's package.json; the root package.json pins none)",
++  "shared": "openvibe-shared v4.59.0 (each app's package.json; the root package.json pins none)",
    "capabilities": [
      "tools.job.create",
      "tools.job.read",
ddiff --git a/apps/audio/package.json b/apps/audio/package.json
iindex fe4ea67..1fdfc39 100644
---- a/apps/audio/package.json
++++ b/apps/audio/package.json
@@@ -25,7 +25,7 @@
      "multer": "^1.4.5-lts.1",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0",
      "uuid": "^11.1.0"
    }
  }
ddiff --git a/apps/audio/test/hardening.test.js b/apps/audio/test/hardening.test.js
iindex d099ddf..1645e5f 100644
---- a/apps/audio/test/hardening.test.js
++++ b/apps/audio/test/hardening.test.js
@@@ -27,9 +27,12 @@ try { execFileSync('ffmpeg', ['-version'], { stdio: 'ignore' }); } catch {
      fs.writeFileSync(hls, `#EXTM3U\n#EXT-X-TARGETDURATION:10\n#EXTINF:2,\nfile://${secret}\n#EXT-X-ENDLIST\n`);
      const concat = path.join(data, 'evil.ffconcat');
      fs.writeFileSync(concat, "ffconcat version 1.0\nfile 'secret.wav'\n");
--    // The attack is real on this ffmpeg: unhardened, the playlist reads the local file.
--    const plain = execFileSync('ffprobe', ['-v', 'error', '-show_entries', 'format=format_name,duration', '-of', 'csv=p=0', hls]).toString();
--    assert.match(plain, /hls/, 'without the whitelists ffprobe follows the playlist');
++    // The attack is real on an older ffmpeg: unhardened, the playlist reads the local file. A newer one (the CI runner's
++    // since 2026-10-31) refuses the local segment by itself ("extension none mismatches allowed extensions"); then
++    // there is nothing to prove here, and the checks below still hold the tools' own whitelists and caps.
++    let plain = '';
++    try { plain = execFileSync('ffprobe', ['-v', 'error', '-show_entries', 'format=format_name,duration', '-of', 'csv=p=0', hls], { stdio: ['ignore', 'pipe', 'ignore'] }).toString(); } catch { plain = ''; }
++    if (plain) assert.match(plain, /hls/, 'without the whitelists ffprobe follows the playlist');
  
      const { jobContext, runTool, runSync, limitsFor } = require('../server/process');
      const { getTool } = require('../server/tools');
ddiff --git a/apps/docs/package.json b/apps/docs/package.json
iindex aca4ddb..8df11e9 100644
---- a/apps/docs/package.json
++++ b/apps/docs/package.json
@@@ -24,7 +24,7 @@
      "multer": "^1.4.5-lts.1",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0",
      "pdf-lib": "^1.17.1",
      "sharp": "^0.33.5",
      "uuid": "^11.1.0"
ddiff --git a/apps/food/package.json b/apps/food/package.json
iindex 4425d4f..34a3cd1 100644
---- a/apps/food/package.json
++++ b/apps/food/package.json
@@@ -20,6 +20,6 @@
      "express-rate-limit": "^7.1.5",
      "helmet": "^7.1.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0"
    }
  }
ddiff --git a/apps/gateway/package.json b/apps/gateway/package.json
iindex 53c2444..0f46afe 100644
---- a/apps/gateway/package.json
++++ b/apps/gateway/package.json
@@@ -23,7 +23,7 @@
      "jsonwebtoken": "^9.0.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0",
      "bwip-js": "4.11.4",
      "zxing-wasm": "3.1.5"
    }
ddiff --git a/apps/gateway/public/assets/logo-192.png b/apps/gateway/public/assets/logo-192.png
iindex dacd1b9..40e3b59 100644
BBinary files a/apps/gateway/public/assets/logo-192.png and b/apps/gateway/public/assets/logo-192.png differ
ddiff --git a/apps/gateway/public/assets/logo-512.png b/apps/gateway/public/assets/logo-512.png
iindex 287f361..fff6aba 100644
BBinary files a/apps/gateway/public/assets/logo-512.png and b/apps/gateway/public/assets/logo-512.png differ
ddiff --git a/apps/gateway/public/assets/logo-72.png b/apps/gateway/public/assets/logo-72.png
iindex ca932bd..493c249 100644
BBinary files a/apps/gateway/public/assets/logo-72.png and b/apps/gateway/public/assets/logo-72.png differ
ddiff --git a/apps/gateway/public/assets/logo-maskable-192.png b/apps/gateway/public/assets/logo-maskable-192.png
iindex a561ed4..4311c42 100644
BBinary files a/apps/gateway/public/assets/logo-maskable-192.png and b/apps/gateway/public/assets/logo-maskable-192.png differ
ddiff --git a/apps/gateway/public/assets/logo-maskable-512.png b/apps/gateway/public/assets/logo-maskable-512.png
iindex 5786557..652e004 100644
BBinary files a/apps/gateway/public/assets/logo-maskable-512.png and b/apps/gateway/public/assets/logo-maskable-512.png differ
ddiff --git a/apps/gateway/public/assets/logo.svg b/apps/gateway/public/assets/logo.svg
iindex 5746fde..0ddbf69 100644
---- a/apps/gateway/public/assets/logo.svg
++++ b/apps/gateway/public/assets/logo.svg
@@@ -1,8 +1,3 @@
--<svg xmlns="http://www.w3.org/2000/svg" viewBox="-32 -32 64 64"><defs><linearGradient id="ring" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#38bdf8"/><stop offset="1" stop-color="#2563eb"/></linearGradient>
--<radialGradient id="glow"><stop offset="0" stop-color="#38bdf8" stop-opacity=".34"/><stop offset="1" stop-color="#38bdf8" stop-opacity="0"/></radialGradient>
--<radialGradient id="bg" cx=".5" cy=".38" r=".8"><stop offset="0" stop-color="#16223a"/><stop offset=".6" stop-color="#0a0f1c"/><stop offset="1" stop-color="#060912"/></radialGradient></defs><rect x="-32" y="-32" width="64" height="64" rx="15" fill="url(#bg)"/><g transform="scale(1.22)">
--<circle r="21" fill="url(#glow)"/>
--<circle r="18" fill="none" stroke="url(#ring)" stroke-width="4" opacity=".38"/>
--<path d="M0,-18 A18,18 0 0,1 17.4,4.6" fill="none" stroke="url(#ring)" stroke-width="4.4" stroke-linecap="round"/>
--<path d="M-9.5,-7 L0,10 L9.5,-7" fill="none" stroke="#fff" stroke-width="4.8" stroke-linecap="round" stroke-linejoin="round"/>
--<circle cx="17.4" cy="4.6" r="3.2" fill="#ffffff"/></g></svg>
\\ No newline at end of file
++<svg xmlns="http://www.w3.org/2000/svg" viewBox="-32 -32 64 64"><defs><mask id="ovh" maskUnits="userSpaceOnUse" x="-20" y="-20" width="140" height="140"><rect x="-20" y="-20" width="140" height="140" fill="#fff"/><path d="M70.59 68.5L53.31 31.5M70.59 68.5L88.41 31.5" fill="none" stroke="#000" stroke-width="24" stroke-linecap="round"/></mask>
++<radialGradient id="glow"><stop offset="0" stop-color="#38bdf8" stop-opacity=".3"/><stop offset="1" stop-color="#38bdf8" stop-opacity="0"/></radialGradient>
++<radialGradient id="bg" cx=".5" cy=".38" r=".8"><stop offset="0" stop-color="#16223a"/><stop offset=".6" stop-color="#0a0f1c"/><stop offset="1" stop-color="#060912"/></radialGradient></defs><rect x="-32" y="-32" width="64" height="64" rx="15" fill="url(#bg)"/><g transform="scale(0.58) translate(-50 -50)"><ellipse cx="50" cy="50" rx="52" ry="40" fill="url(#glow)"/><circle cx="30.09" cy="50" r="18" fill="none" stroke="#4f7cff" stroke-width="18" mask="url(#ovh)"/><path d="M70.59 68.5L53.31 31.5M70.59 68.5L88.41 31.5" fill="none" stroke="#8b5cf6" stroke-width="17" stroke-linecap="round" stroke-linejoin="round"/></g></svg>
\\ No newline at end of file
ddiff --git a/apps/gateway/test/perf-budget.test.js b/apps/gateway/test/perf-budget.test.js
iindex da852b3..63acd98 100644
---- a/apps/gateway/test/perf-budget.test.js
++++ b/apps/gateway/test/perf-budget.test.js
@@@ -13,8 +13,8 @@ const BUDGETS = {
      htmlRawKB: 160,       // measured 135.5 (production; the catalogue is server-rendered)
      htmlBrotliKB: 23,     // 19.5
      jsFiles: 6,           // 5
--    jsRawKB: 292,   // 291.9 with openvibe-shared 4.53.0: the footer's columns fold on phones (2026-10-30); 288.9 with openvibe-shared 4.52.0: the Dock's loader and its Chats tab (2026-10-30); 286.4 with openvibe-shared 4.48.0 (the site switcher on the mark, the menu's Start tab and quick tools; Kit's touch hit areas and the phone navbar fix, 4.44-4.47.3); 278.6 with openvibe-shared 4.43.0 (room.css carries the kit tokens, 4.39.1; the kit's 4.39.0 rules); 271.5 with openvibe-shared 4.27.0 and the home's live demo (the design pass, 2026-10-29: +1.2 KB, four real transform previews); 269.3 with openvibe-shared 4.25.0 (the menu's orb beside the brand, both balances on phones, messages, the phone account sheet, the bar stepping away on phones); 263.1 with openvibe-shared 4.22.0 (the navbar's magnifier search and More; search.js and loading.js load only when used); 257.4 with openvibe-shared 4.17.0 (the folded balance chip, Across OpenVibe marks, wallet chips); 243.4 with openvibe-shared 4.15.0 (the compact footer opens into the whole one, the pulse line); 207.9 before
--    jsBrotliKB: 72,   // 71.3 with openvibe-shared 4.52.0: the Dock's loader and its Chats tab (2026-10-30); 70.6 with openvibe-shared 4.48.0 (the site switcher on the mark, the menu's Start tab and quick tools; Kit's touch hit areas and the phone navbar fix, 4.44-4.47.3); 69.1 with openvibe-shared 4.43.0 (room.css carries the kit tokens, 4.39.1; the kit's 4.39.0 rules); 67.3 with openvibe-shared 4.27.0 and the live demo; 66.6 with openvibe-shared 4.25.0; 64.7 with openvibe-shared 4.22.0; 63.2 with openvibe-shared 4.17.0; 60.6 with openvibe-shared 4.15.0; 58.0 with openvibe-shared 4.12.0 (light/dark switch, seasonal mark, theme pairs); 48.5 before
++    jsRawKB: 295,   // 294 with openvibe-shared 4.59.0: the Pair mark beside the name, set in the brand face (2026-10-31); 291.9 with openvibe-shared 4.53.0: the footer's columns fold on phones (2026-10-30); 288.9 with openvibe-shared 4.52.0: the Dock's loader and its Chats tab (2026-10-30); 286.4 with openvibe-shared 4.48.0 (the site switcher on the mark, the menu's Start tab and quick tools; Kit's touch hit areas and the phone navbar fix, 4.44-4.47.3); 278.6 with openvibe-shared 4.43.0 (room.css carries the kit tokens, 4.39.1; the kit's 4.39.0 rules); 271.5 with openvibe-shared 4.27.0 and the home's live demo (the design pass, 2026-10-29: +1.2 KB, four real transform previews); 269.3 with openvibe-shared 4.25.0 (the menu's orb beside the brand, both balances on phones, messages, the phone account sheet, the bar stepping away on phones); 263.1 with openvibe-shared 4.22.0 (the navbar's magnifier search and More; search.js and loading.js load only when used); 257.4 with openvibe-shared 4.17.0 (the folded balance chip, Across OpenVibe marks, wallet chips); 243.4 with openvibe-shared 4.15.0 (the compact footer opens into the whole one, the pulse line); 207.9 before
++    jsBrotliKB: 73,   // 72.5 with openvibe-shared 4.59.0: the Pair mark beside the name, set in the brand face (2026-10-31); 71.3 with openvibe-shared 4.52.0: the Dock's loader and its Chats tab (2026-10-30); 70.6 with openvibe-shared 4.48.0 (the site switcher on the mark, the menu's Start tab and quick tools; Kit's touch hit areas and the phone navbar fix, 4.44-4.47.3); 69.1 with openvibe-shared 4.43.0 (room.css carries the kit tokens, 4.39.1; the kit's 4.39.0 rules); 67.3 with openvibe-shared 4.27.0 and the live demo; 66.6 with openvibe-shared 4.25.0; 64.7 with openvibe-shared 4.22.0; 63.2 with openvibe-shared 4.17.0; 60.6 with openvibe-shared 4.15.0; 58.0 with openvibe-shared 4.12.0 (light/dark switch, seasonal mark, theme pairs); 48.5 before
      cssFiles: 1,          // 0
      externalFiles: 3,     // 1 in production
  };
ddiff --git a/apps/img/package.json b/apps/img/package.json
iindex 846f17a..506c6e1 100644
---- a/apps/img/package.json
++++ b/apps/img/package.json
@@@ -24,7 +24,7 @@
      "multer": "^1.4.5-lts.1",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0",
      "sharp": "^0.33.5",
      "to-ico": "^1.1.5",
      "uuid": "^11.1.0"
ddiff --git a/apps/maps/package.json b/apps/maps/package.json
iindex 3c19cbc..6b37f87 100644
---- a/apps/maps/package.json
++++ b/apps/maps/package.json
@@@ -15,7 +15,7 @@
      "pg": "^8.23.0",
      "@electric-sql/pglite": "^0.5.8",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0",
      "cheerio": "^1.0.0-rc.12",
      "cookie-parser": "^1.4.7",
      "cors": "^2.8.5",
ddiff --git a/apps/text/package.json b/apps/text/package.json
iindex a04d5f4..227aa1b 100644
---- a/apps/text/package.json
++++ b/apps/text/package.json
@@@ -20,7 +20,7 @@
      "express-rate-limit": "^7.1.5",
      "dotenv": "^16.3.1",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0"
    },
    "license": "MIT"
  }
ddiff --git a/apps/yt/package.json b/apps/yt/package.json
iindex 17bd3da..c794e33 100644
---- a/apps/yt/package.json
++++ b/apps/yt/package.json
@@@ -21,7 +21,7 @@
      "pg": "^8.23.0",
      "@electric-sql/pglite": "^0.5.8",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.57.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.59.0",
      "jsonwebtoken": "^9.0.2",
      "uuid": "^11.1.0"
    }