fix(ca-trust): reject the whitespace node rejects, and never publish an unparseable CA

Two false-accept paths found by Codex review, both reproduced here before
being agreed with.

STRIP ASCII WHITESPACE ONLY. isBase64Body stripped with /\s+/, which is the
Unicode whitespace set. Node's PEM reader accepts space, tab, CR and LF and
nothing else. Measured one character at a time against a real
NODE_EXTRA_CA_CERTS load: those four load 1, while U+00A0 U+2003 U+2028 U+2029
U+FEFF U+1680 U+205F U+3000 and ASCII VTAB and FORMFEED each load 0 with
`bad base64 decode`. All ten are stripped by \s, so a body damaged by any of
them read as clean and the guard accepted a bundle that costs the session every
extra root. A NBSP is what a paste through a rich-text field leaves behind.

PARSE BEFORE PUBLISHING. The copy into ca-trust.d/ccf.pem happened before the
X509 parse, so a corrupt ca.pem was handed to every OTHER component. Our own
session degrades fine (it falls back to node's built-in store), but the builder
concatenates sort(*.pem) and "ccf" sorts first — the same fatal leading
position the torn-write guard already protects, reached by a different cause.
Atomicity guarantees whole bytes, never loadable ones. Now the parse throws
into the existing catch, which warns and leaves any previous good ccf.pem for
siblings to keep trusting.

Both TDD: each test fails on the pre-fix code and passes after. Both
mutation-checked: reverting [ \t\r\n] to \s fails proxy-forward-ca, removing
the pre-publish parse fails proxy-wrapper.

Suite 1505/1507. The 2 failures are the inotify EMFILE (max_user_instances=128
on this host) and fail identically at the merge base.

Four of the six review findings were against upstream code outside this PR's
diff — session-budget-breaker and tier-advisor — and are not touched here.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

bin/ca-trust.mjs

@@ -15,8 +15,14 @@ import { X509Certificate } from "node:crypto";
 // A body containing `-` reads as damaged here even though node accepts it
 // (openssl stops at the dash), which is the conservative direction and the only
 // measured disagreement.
+//
+// Whitespace is stripped as `[ \t\r\n]`, NOT `\s`: node's reader accepts those
+// four, and rejects every other character `\s` covers. Measured one at a time —
+// U+00A0 U+2003 U+2028 U+2029 U+FEFF U+1680 U+205F U+3000 and ASCII VTAB and
+// FORMFEED each load 0 with `bad base64 decode`. Stripping them read a damaged
+// body as clean, and a NBSP is what a paste through a rich-text field leaves.
 function isBase64Body(body) {
-  const b = body.replace(/\s+/g, "");
+  const b = body.replace(/[ \t\r\n]+/g, "");
   return b.length > 0 && b.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(b);
 }
 

bin/claude-via-proxy.mjs

@@ -242,6 +242,15 @@ if (remoteControl) {
   try {
     mkdirSync(caTrustDir, { recursive: true });
     const ours = readFileSync(caPem);
+    // Parse BEFORE publishing. Validating later (we do, at the own-CA step
+    // below) still handed a corrupt ca.pem to every OTHER component: "ccf" sorts
+    // first in the builder's sort(*.pem), so a bad entry lands in the same fatal
+    // leading position the torn-write guard above protects — measured, such a
+    // bundle loads 0 extra CAs and warns `bad base64 decode`. Atomicity
+    // guarantees whole bytes, never loadable ones. Throwing lands in the catch
+    // below, leaving any previous good ccf.pem in place for siblings to keep
+    // trusting.
+    new X509Certificate(ours);
     const dst = join(caTrustDir, "ccf.pem");
     // Byte-compare skip so a bundle builder keying on mtime is not woken by a
     // launch that changed nothing.

test/proxy-forward-ca.test.mjs

@@ -399,6 +399,25 @@ test("ca-trust: the bundle guard never accepts a bundle NODE_EXTRA_CA_CERTS cann
       // Padding is positional, not merely present: `AAA=` loads, `A===` does not.
       ["PUBLIC KEY body with misplaced padding", `-----BEGIN PUBLIC KEY-----\nA===\n-----END PUBLIC KEY-----\n${ours}`, false],
       ["corrupt X509 CRL ahead", `-----BEGIN X509 CRL-----\n!!!not base64!!!\n-----END X509 CRL-----\n${ours}`, false],
+      // Whitespace inside a body is stripped before the alphabet test, and WHICH
+      // whitespace decides the verdict. JavaScript's `\s` covers the Unicode set;
+      // node's PEM reader accepts only ASCII space, tab, CR and LF. Measured, one
+      // character at a time, against a real NODE_EXTRA_CA_CERTS load:
+      //
+      //   space, tab, CR, LF                                    -> loads 1
+      //   U+00A0 U+2003 U+2028 U+2029 U+FEFF U+1680 U+205F      -> loads 0
+      //   U+3000, and ASCII VTAB (\x0b) and FORMFEED (\x0c)     -> loads 0
+      //
+      // Every one of those ten is stripped by `\s`, so stripping with `\s` makes
+      // the guard read a damaged body as clean. A NBSP is what a paste through a
+      // rich-text field leaves behind, which is exactly how a bundle acquires one.
+      ["PUBLIC KEY body with U+00A0", `-----BEGIN PUBLIC KEY-----\nMFkw EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n-----END PUBLIC KEY-----\n${ours}`, false],
+      ["PUBLIC KEY body with a vertical tab", `-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n-----END PUBLIC KEY-----\n${ours}`, false],
+      ["our CA with U+2028 in its body", ours.replace(/\n/, "\n
"), false],
+      // ...and the other direction, or the fix above becomes an over-strict guard
+      // that drops the sibling CAs this PR exists to keep. A tab and a bare CR
+      // inside a body are both loader-legal.
+      ["PUBLIC KEY body with a tab", `-----BEGIN PUBLIC KEY-----\nMFkw\tEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n-----END PUBLIC KEY-----\n${ours}`, true],
       // ...but a WELL-FORMED one must still be accepted, or the fix above turns
       // into the over-strict guard this PR set out to remove.
       ["valid PUBLIC KEY ahead", `${pubKeyPem(ourCa)}${ours}`, true],

test/proxy-wrapper.test.mjs

@@ -598,6 +598,49 @@ describe("launch wrapper (claude-via-proxy)", { concurrency: 1 }, () => {
       `a healthy bundle must not be blamed for our own CA failing to parse; stderr: ${err}`);
   });
 
+  it("--remote-control does not publish a ca.pem that failed to parse", async () => {
+    // Blaming the right file and not consuming it (the two tests above) covered
+    // what THIS session does with a corrupt ca.pem. It still published those
+    // bytes: the copy into ca-trust.d/ccf.pem happens before the X509 parse, so
+    // an unparseable CA was handed to every OTHER component on the machine.
+    //
+    // That is the worse half. Our own session degrades to node's built-in store
+    // and keeps working; the bundle builder concatenates sort(*.pem) and "ccf"
+    // sorts first, so a corrupt entry in the leading position aborts node's
+    // whole extras load for every sibling — measured on this box, a fused
+    // bundle loads 0 extra CAs and warns `bad base64 decode`. One broken file
+    // here costs every other component its CA, and its corporate roots with it.
+    //
+    // Publishing nothing is the honest state, and it is strictly better than
+    // publishing garbage: a builder that finds no ccf.pem simply builds a bundle
+    // without us, which our own guard then rejects (it does not carry our CA)
+    // and we fall back to our own — exactly the no-builder path that already
+    // works. Any PREVIOUS good ccf.pem must survive, because it is what siblings
+    // are currently trusting and a stale-but-valid CA beats none.
+    const configDir = tempDir("cfftrust-");
+    const caDir = tempDir("cffca-");
+    // Same reuse-guard reasoning as the blame test above: the key must be
+    // present or the proxy regenerates a healthy ca.pem and this exercises
+    // nothing.
+    writeFileSync(join(caDir, "ca.key"), "-----BEGIN PRIVATE KEY-----\nplaceholder\n-----END PRIVATE KEY-----\n");
+    writeFileSync(join(caDir, "ca.pem"), "-----BEGIN CERTIFICATE-----\ntruncated\n");
+    // A previously-published, well-formed entry. Whatever we do with the corrupt
+    // one, this must still be here afterwards.
+    const trustDir = join(configDir, "ca-trust.d");
+    mkdirSync(trustDir, { recursive: true });
+    const priorGood = "-----BEGIN CERTIFICATE-----\ncHJldmlvdXNseS1wdWJsaXNoZWQtb3Vycw==\n-----END CERTIFICATE-----\n";
+    writeFileSync(join(trustDir, "ccf.pem"), priorGood);
+
+    await runWrapper('process.stdout.write("OK\\n")',
+      { CLAUDE_CONFIG_DIR: configDir, CACHE_FIX_CA_DIR: caDir });
+
+    const published = readFileSync(join(trustDir, "ccf.pem"), "utf8");
+    assert.doesNotMatch(published, /truncated/,
+      "the unparseable ca.pem must never reach ca-trust.d — it voids every sibling's CA");
+    assert.equal(published, priorGood,
+      "the last known-good published CA must survive a corrupt ca.pem");
+  });
+
   it("--remote-control does not hand claude a ca.pem that failed to parse", async () => {
     // Naming the broken file in the warning was only half the fix. caForClaude
     // still defaulted to it, so the session was wired to a PEM we had just