fix(launcher): match the ca-trust guard to what node's CA loader accepts - #296

Open

codeslake wants to merge 10 commits into

cnighswonger:mainfrom

codeslake:ca-trust-guard

Commits on Aug 2, 2026

fix(launcher): match the ca-trust guard to what node's CA loader accepts

codeslake
and
claude
committed
refactor(launcher): use process.channel instead of filtering relayed stderr

codeslake
and
claude
committed
fix(launcher): decode every block, bound each END, don't ship a bad ca.pem

codeslake
and
claude
committed
fix(launcher): base64 quanta, full label grammar, explicit launcher signal

codeslake
and
claude
committed
fix(guard): require the END marker to end its own line

codeslake
and
claude
committed
refactor(guard): pass the body to isBase64Body; cover the quanta rule

codeslake
and
claude
committed
docs: state the narrowing limit as a design choice, not a missing capability

codeslake
and
claude
committed
fix(ca-trust): reject the whitespace node rejects, and never publish an unparseable CA

codeslake
and
claude
committed
fix(ca-trust): see a malformed BEGIN line instead of skipping it

codeslake
and
claude
committed
docs(ca-trust): keep the constraints, drop the incident narration

codeslake
and
claude
committed