carlos / todomvc-bakeoff Public

LIVE https://todo-zig.bfj.oncarlos.com e5042a9

What's live

• todo-zig on account bfj, one instance on channel edge, build probe /api/version. The deployed version is e5042a9; /api/version and X-Carlos-Version both report it.
• The shared behaviour suite passed locally (67 passed, 3 skipped) and again against https://todo-zig.bfj.oncarlos.com (67 passed, 3 skipped). The skips are the suite's own: blur and Escape with JavaScript off, and the screenshot comparison with JavaScript off.
• scripts/boot-check.sh dist/app-linux-arm64 passed: /healthz and /api/version answer 200 on a unix socket under qemu, and SIGTERM exits 0.
• make test: 11 Zig unit tests pass (view, routing, form and cookie parsing, title trimming, origin check, store scoping).

Notes

• Binary: static aarch64 musl, 1.9 MB, stripped, CSS and JS embedded.
• Cold make build-arm64 after make clean-deps took 8m06s on docs-t1, with Zig compiling its build runner, musl and the SQLite amalgamation from scratch (other builders were compiling at the same time).
• Zig 0.17 unpacks fetched packages into a project-local directory; the Makefile points it (and both Zig caches) into .cache/, so clean-deps keeps the downloaded SQLite sources (.cache/zig/p, .cache/pkg) and drops everything compiled.
• Nothing in the contract seemed wrong.

Review fixes (576c3b8)

Both findings are fixed. After the fixes, the shared suite passed locally and against the live site (67 passed, 3 skipped each time), and boot-check.sh passed on the new arm64 binary.

1. An open editor was lost when an earlier response arrived. static/app.js now leaves an item being edited in place when it applies a response. It never detaches that item, so the editor keeps its focus and unsaved text. It replaces the items around it and refreshes the item's checkbox, label and classes. If the response no longer contains that item (deleted, or filtered out), the list is replaced as before. I checked this in a browser: I delayed a toggle by 1 s and opened another item's editor while it was pending. When the answer arrived, the editor kept its text and focus and the counter updated. Enter then saved the edited text.
2. Titles were trimmed of ASCII whitespace only. Adding and editing now trim Unicode White_Space characters (U+00A0, U+2003, U+3000 and the rest) and U+FEFF from both ends (trimTitle in src/app.zig, with a unit test). A whitespace-only add creates nothing, and editing an item to whitespace only deletes it. Both were checked with curl.

Review findings not fixed

None.

Second review round

The second review request listed no findings, so the code is unchanged and nothing was redeployed: rebuilding and redeploying the same commit would change nothing. The live site still reports 576c3b8, and the shared suite run against it again passed (67 passed, 3 skipped).

Third review round (e5042a9)

1. [security] Malformed UTF-8 in a title aborted the server. Fixed. The backward scan in trimTitle (src/app.zig) passed every byte after a lead byte to std.unicode.utf8Decode. That function asserts it gets exactly one sequence, so title=a%80%80%80%80 reached unreachable and the ReleaseSafe build aborted. I reproduced the abort on the previous binary. The scan now checks that the lead byte's sequence length matches the bytes found before it decodes; anything else is treated as non-whitespace and ends the trim, so a malformed title is stored as sent, untrimmed at that end. Regression cases are in the trimTitle unit test. Verified: locally the four malformed payloads answer 303 and /healthz stays 200, and the live site answers 303 to the reported payload. The shared suite passed locally and against the live site (67 passed, 3 skipped each time), and boot-check.sh passed on the new arm64 binary.

No findings from this round were left unfixed.