nx_fetchclean.nx source
↩ module page · 194 lines · 8636 B
1// nx_fetchclean.nx -- REMOVE OUR OWN FETCH LANE'S DIAGNOSTIC PREAMBLE FROM A DOWNLOADED ASSET.
2//
3// WHY (measured 2026-08-07, caught by nx_assetprobe on its first real binary): nx_https_get prints
4// transport diagnostics (nishi-tcc / nishi-cert / nishi-xfer) on the captured stream, AHEAD of the
5// entity body. A genuine PNG fetched through our lane therefore read:
6// bytes=13933 magic=UNKNOWN ext_claim=PNG verdict=UNIDENTIFIED
7// because a 38-byte preamble displaced the magic from offset 0. Two real BVH files landed at
8// exactly +38 bytes over their upstream size for the same reason; they survived only because BVH
9// is text and gets a bounded scan. EVERY binary asset -- PMX, VMD, PNG, ZIP, GLB -- is broken by
10// this, and each would have failed later, inside a loader, as an unexplained corruption.
11//
12// *THE FIX BELONGS IN THE PIPE, NOT IN THE RULER. Widening the magic check to "somewhere in the
13// first N bytes" would have hidden this and destroyed the guarantee that makes a magic a magic.
14//
15// CLOSED PREFIX SET, LEADING RUN ONLY. We strip a line only if it begins with one of the four
16// KNOWN diagnostic prefixes, and we stop at the first line that does not. A generic "starts with
17// nishi-" rule would eat a legitimate body, and a whole-file rule would eat a payload that merely
18// mentions the string. Never silent: the stripped byte and line counts are always printed.
19//
20// usage: nx_fetchclean <in> <out>
21// nx_fetchclean --kat selftest: 5 teeth, 3 of them anti-vacuity
22// exit 0 ok | 2 unreadable | 3 usage | 9 write-failed | 1 KAT RED
23// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
24import "nx_syscalls.nx"
25
26const FC_KATBUF: i64 = 4096
27const FC_MODE: i64 = 420
28const FC_NPFX: i64 = 4
29
30func fc_slen(s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { i = i + 1 } return i }
31func fc_puts(s: *u8) -> i64 { sys_write(1, s, fc_slen(s)); return 0 }
32func fc_num(v: i64) -> i64 {
33 let t: *u8 = sys_mmap(32)
34 var m: i64 = v
35 var w: i64 = 0
36 if m < 0 { t[0] = 45 as u8; sys_write(1, t, 1); m = 0 - m }
37 if m == 0 { t[0] = 48 as u8; sys_write(1, t, 1); return 0 }
38 let d: *u8 = sys_mmap(32)
39 var k: i64 = 0
40 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
41 var j: i64 = 0
42 while j < k { t[w] = d[k - 1 - j]; w = w + 1; j = j + 1 }
43 sys_write(1, t, w)
44 return 0
45}
46
47func fc_at(b: *u8, len: i64, off: i64, pat: *u8) -> i64 {
48 let n: i64 = fc_slen(pat)
49 if off + n > len { return 0 }
50 var i: i64 = 0
51 while i < n { if b[off + i] != pat[i] { return 0 } i = i + 1 }
52 return 1
53}
54
55// THE CLOSED SET. Adding a prefix is a deliberate edit here, never a widening of the rule.
56func fc_is_diag(b: *u8, len: i64, off: i64) -> i64 {
57 if fc_at(b, len, off, "nishi-xfer " as *u8) == 1 { return 1 }
58 if fc_at(b, len, off, "nishi-cert " as *u8) == 1 { return 1 }
59 if fc_at(b, len, off, "nishi-tcc " as *u8) == 1 { return 1 }
60 if fc_at(b, len, off, "nishi-hs " as *u8) == 1 { return 1 }
61 return 0
62}
63
64// Returns the offset of the true body: the end of the LEADING RUN of diagnostic lines.
65func fc_body_off(b: *u8, len: i64, lines: *i64) -> i64 {
66 var p: i64 = 0
67 var n: i64 = 0
68 var done: i64 = 0
69 while done == 0 {
70 if fc_is_diag(b, len, p) == 0 { done = 1 }
71 else {
72 var q: i64 = p
73 var eol: i64 = 0 - 1
74 var scan: i64 = 0
75 while scan == 0 {
76 if q >= len { scan = 1 }
77 else {
78 if (b[q] & 0xff) as i64 == 10 { eol = q; scan = 1 } else { q = q + 1 }
79 }
80 }
81 if eol < 0 { done = 1 }
82 else { p = eol + 1; n = n + 1 }
83 }
84 }
85 lines[0] = n
86 return p
87}
88
89func fc_write(path: *u8, b: *u8, off: i64, len: i64) -> i64 {
90 let fd: i64 = sys_openat_wr(path, FC_MODE)
91 if fd < 0 { return 0 - 1 }
92 let n: i64 = len - off
93 if n > 0 { sys_write(fd, ((b as i64) + off) as *u8, n) }
94 sys_close(fd)
95 return n
96}
97
98// ===== KAT ========================================================
99func fc_put(b: *u8, o: i64, s: *u8) -> i64 {
100 let n: i64 = fc_slen(s)
101 var i: i64 = 0
102 while i < n { b[o + i] = s[i]; i = i + 1 }
103 return o + n
104}
105
106func fc_kat() -> i64 {
107 var red: i64 = 0
108 let b: *u8 = sys_mmap(FC_KATBUF)
109 let lines: *i64 = sys_mmap(16) as *i64
110
111 // T1 the measured real case: one nishi-xfer line, then PNG magic
112 var i: i64 = 0
113 while i < FC_KATBUF { b[i] = 0 as u8; i = i + 1 }
114 var o: i64 = fc_put(b, 0, "nishi-xfer recv=49ms dec=1ms cl-stop\n" as *u8)
115 let pre: i64 = o
116 b[o] = 0x89 as u8
117 o = fc_put(b, o + 1, "PNG" as *u8)
118 var off: i64 = fc_body_off(b, o, lines)
119 if off != pre { fc_puts("T1 RED off=" as *u8); fc_num(off); fc_puts("\n" as *u8); red = red + 1 }
120 else {
121 if lines[0] != 1 { fc_puts("T1 RED lines\n" as *u8); red = red + 1 }
122 else { fc_puts("T1 GREEN stripped=" as *u8); fc_num(off); fc_puts("B magic-now-at-0\n" as *u8) }
123 }
124
125 // T2 ANTI-VACUITY: a CLEAN file must pass through byte-identical. A stripper that always
126 // removes something corrupts every already-clean input it is handed.
127 var j: i64 = 0
128 while j < FC_KATBUF { b[j] = 0 as u8; j = j + 1 }
129 b[0] = 0x89 as u8
130 let cn: i64 = fc_put(b, 1, "PNG" as *u8)
131 off = fc_body_off(b, cn, lines)
132 if off != 0 { fc_puts("T2 RED clean-file-stripped off=" as *u8); fc_num(off); fc_puts("\n" as *u8); red = red + 1 }
133 else { fc_puts("T2 GREEN clean-passthrough stripped=0\n" as *u8) }
134
135 // T3 ANTI-VACUITY: the CLOSED SET holds. A body that merely starts with "nishi-" but is not
136 // one of the four diagnostics must survive untouched.
137 var k: i64 = 0
138 while k < FC_KATBUF { b[k] = 0 as u8; k = k + 1 }
139 let tn: i64 = fc_put(b, 0, "nishi-family is a payload line\nBODY\n" as *u8)
140 off = fc_body_off(b, tn, lines)
141 if off != 0 { fc_puts("T3 RED over-stripped off=" as *u8); fc_num(off); fc_puts("\n" as *u8); red = red + 1 }
142 else { fc_puts("T3 GREEN closed-set-holds\n" as *u8) }
143
144 // T4 the multi-line preamble the cert path actually emits
145 var m: i64 = 0
146 while m < FC_KATBUF { b[m] = 0 as u8; m = m + 1 }
147 var p: i64 = fc_put(b, 0, "nishi-tcc stale (ttl) -> full validate\n" as *u8)
148 p = fc_put(b, p, "nishi-cert link alg=4 ms=5\n" as *u8)
149 p = fc_put(b, p, "nishi-cert link alg=4 ms=17\n" as *u8)
150 p = fc_put(b, p, "nishi-xfer recv=82ms dec=0ms cl-stop\n" as *u8)
151 let pre4: i64 = p
152 p = fc_put(b, p, "HIERARCHY\n" as *u8)
153 off = fc_body_off(b, p, lines)
154 if off != pre4 { fc_puts("T4 RED multiline off=" as *u8); fc_num(off); fc_puts("\n" as *u8); red = red + 1 }
155 else {
156 if lines[0] != 4 { fc_puts("T4 RED lines=" as *u8); fc_num(lines[0]); fc_puts("\n" as *u8); red = red + 1 }
157 else { fc_puts("T4 GREEN 4-line-preamble stripped\n" as *u8) }
158 }
159
160 // T5 ANTI-VACUITY: LEADING RUN ONLY. A diagnostic-looking line deeper in the payload is
161 // payload, not preamble -- stripping it would silently delete real content.
162 var q: i64 = 0
163 while q < FC_KATBUF { b[q] = 0 as u8; q = q + 1 }
164 let rn: i64 = fc_put(b, 0, "HIERARCHY\nnishi-xfer recv=1ms cl-stop\nROOT Hips\n" as *u8)
165 off = fc_body_off(b, rn, lines)
166 if off != 0 { fc_puts("T5 RED mid-file-stripped\n" as *u8); red = red + 1 }
167 else { fc_puts("T5 GREEN leading-run-only\n" as *u8) }
168
169 if red > 0 { fc_puts("nx_fetchclean KAT RED teeth_failed=" as *u8); fc_num(red); fc_puts("\n" as *u8); return 1 }
170 fc_puts("nx_fetchclean KAT GREEN 5/5\n" as *u8)
171 return 0
172}
173
174func main(argc: i64, argv: *i64) -> i64 {
175 if argc < 2 { fc_puts("usage: nx_fetchclean <in> <out> | --kat\n" as *u8); return 3 }
176 let a1: *u8 = argv[1] as *u8
177 if fc_slen(a1) == 5 { if a1[0] == (45 as u8) { return fc_kat() } }
178 if argc < 3 { fc_puts("usage: nx_fetchclean <in> <out> | --kat\n" as *u8); return 3 }
179 let outp: *u8 = argv[2] as *u8
180 let lenp: *i64 = sys_mmap(16) as *i64
181 let buf: *u8 = sys_read_file(a1, lenp)
182 if (buf as i64) == 0 { fc_puts("nx_fetchclean unreadable\n" as *u8); return 2 }
183 let len: i64 = lenp[0]
184 let lines: *i64 = sys_mmap(16) as *i64
185 let off: i64 = fc_body_off(buf, len, lines)
186 let wrote: i64 = fc_write(outp, buf, off, len)
187 if wrote < 0 { fc_puts("nx_fetchclean write-failed\n" as *u8); return 9 }
188 fc_puts("in_bytes=" as *u8); fc_num(len)
189 fc_puts(" stripped_lines=" as *u8); fc_num(lines[0])
190 fc_puts(" stripped_bytes=" as *u8); fc_num(off)
191 fc_puts(" out_bytes=" as *u8); fc_num(wrote)
192 fc_puts("\n" as *u8)
193 return 0
194}