[Change] Vendored lib sync: tlog_lib 2.0.5, alert_lib 1.0.6, elog_lib 1.0.5, pkg_lib 1.0.7

[Change] tlog_lib 2.0.4 → 2.0.5: symlink guards on cursor reads and stale-protection touches
[Change] alert_lib 1.0.5 → 1.0.6: Slack JSON-escape, email header injection defense, HTTPS validation
[Change] elog_lib 1.0.4 → 1.0.5: C0 control char escape, symlink write guards, trap restore
[Change] pkg_lib 1.0.6 → 1.0.7: rc.local permission preservation, metachar escape, TOCTOU fix

Author: rfxn

CHANGELOG

@@ -80,6 +80,8 @@ v2.0.1 | Mar 25 2026:
 
   -- Changes --
 
+[Change] Vendored lib sync: tlog_lib 2.0.5, alert_lib 1.0.6, elog_lib 1.0.5,
+        pkg_lib 1.0.7
 [Change] Alert templates: consolidate summary into headers; drop "TOTAL" prefix from
          labels (HITS/CLEANED/QUARANTINED); add quarantine metrics; aligned column spacing
 [Change] Hook scans write to rolling hook.hits.log instead of creating session files;

CHANGELOG.RELEASE

@@ -80,6 +80,8 @@ v2.0.1 | Mar 25 2026:
 
   -- Changes --
 
+[Change] Vendored lib sync: tlog_lib 2.0.5, alert_lib 1.0.6, elog_lib 1.0.5,
+        pkg_lib 1.0.7
 [Change] Alert templates: consolidate summary into headers; drop "TOTAL" prefix from
          labels (HITS/CLEANED/QUARANTINED); add quarantine metrics; aligned column spacing
 [Change] Hook scans write to rolling hook.hits.log instead of creating session files;

files/internals/alert_lib.sh

@@ -21,7 +21,7 @@
 _ALERT_LIB_LOADED=1
 
 # shellcheck disable=SC2034
-ALERT_LIB_VERSION="1.0.5"
+ALERT_LIB_VERSION="1.0.6"
 
 # Channel registry — consuming projects populate via alert_channel_register()
 # Uses parallel indexed arrays instead of declare -A to avoid scope issues
@@ -321,6 +321,17 @@ _alert_build_mime() {
 _alert_email_local() {
 	local recip="$1" subject="$2" text_file="$3" html_file="$4" format="${5:-text}"
 	local from="${ALERT_SMTP_FROM:-root@$(hostname -f 2>/dev/null || hostname)}"
+	# Defense-in-depth: strip CR/LF from all values used in email headers
+	recip="${recip//$'\r'/}"
+	recip="${recip//$'\n'/}"
+	subject="${subject//$'\r'/}"
+	subject="${subject//$'\n'/}"
+	from="${from//$'\r'/}"
+	from="${from//$'\n'/}"
+	local reply_to="${ALERT_EMAIL_REPLY_TO:-}"
+	reply_to="${reply_to//$'\r'/}"
+	reply_to="${reply_to//$'\n'/}"
+
 	local sendmail_bin mail_bin
 	sendmail_bin=$(command -v sendmail 2>/dev/null || true)
 	mail_bin=$(command -v mail 2>/dev/null || true)
@@ -339,8 +350,8 @@ _alert_email_local() {
 					echo "From: $from"
 					echo "To: $recip"
 					echo "Subject: $subject"
-					if [ -n "${ALERT_EMAIL_REPLY_TO:-}" ]; then
-						echo "Reply-To: $ALERT_EMAIL_REPLY_TO"
+					if [ -n "$reply_to" ]; then
+						echo "Reply-To: $reply_to"
 					fi
 					echo ""
 					cat "$text_file"
@@ -359,8 +370,8 @@ _alert_email_local() {
 					echo "From: $from"
 					echo "To: $recip"
 					echo "Subject: $subject"
-					if [ -n "${ALERT_EMAIL_REPLY_TO:-}" ]; then
-						echo "Reply-To: $ALERT_EMAIL_REPLY_TO"
+					if [ -n "$reply_to" ]; then
+						echo "Reply-To: $reply_to"
 					fi
 					echo "Content-Type: text/html; charset=UTF-8"
 					echo "Content-Transfer-Encoding: base64"
@@ -388,8 +399,8 @@ _alert_email_local() {
 					echo "From: $from"
 					echo "To: $recip"
 					echo "Subject: $subject"
-					if [ -n "${ALERT_EMAIL_REPLY_TO:-}" ]; then
-						echo "Reply-To: $ALERT_EMAIL_REPLY_TO"
+					if [ -n "$reply_to" ]; then
+						echo "Reply-To: $reply_to"
 					fi
 					_alert_build_mime "$text_body" "$html_body"
 				} | "$sendmail_bin" -t -oi
@@ -491,21 +502,25 @@ _alert_deliver_email() {
 	if [ -n "${ALERT_SMTP_RELAY:-}" ]; then
 		# relay path: always build full multipart MIME message
 		local from="${ALERT_SMTP_FROM:-root@$(hostname -f 2>/dev/null || hostname)}"
+		# Defense-in-depth: strip CR/LF from all header values to prevent injection
+		recip="${recip//$'\r'/}"
+		recip="${recip//$'\n'/}"
+		from="${from//$'\r'/}"
+		from="${from//$'\n'/}"
+		local reply_to="${ALERT_EMAIL_REPLY_TO:-}"
+		reply_to="${reply_to//$'\r'/}"
+		reply_to="${reply_to//$'\n'/}"
 		local text_body html_body
 		text_body=$(cat "$text_file")
-		if [ -n "$html_file" ] && [ -f "$html_file" ]; then
-			html_body=$(cat "$html_file")
-		else
-			html_body=""
-		fi
+		html_body=$(cat "$html_file")
 		local msg_file
 		msg_file=$(mktemp "${ALERT_TMPDIR}/alert_relay_msg.XXXXXX")
 		{
 			echo "From: $from"
 			echo "To: $recip"
 			echo "Subject: $subject"
-			if [ -n "${ALERT_EMAIL_REPLY_TO:-}" ]; then
-				echo "Reply-To: $ALERT_EMAIL_REPLY_TO"
+			if [ -n "$reply_to" ]; then
+				echo "Reply-To: $reply_to"
 			fi
 			echo "Date: $(date -R 2>/dev/null || date)"
 			_alert_build_mime "$text_body" "$html_body"
@@ -581,9 +596,10 @@ _alert_slack_post_message() {
 	# Inject "channel" field after opening brace
 	# Uses awk instead of sed to avoid delimiter collision if channel
 	# contains / or & (sed s/// treats both as special characters)
-	local modified_payload
+	local modified_payload escaped_channel
 	modified_payload=$(mktemp "${ALERT_TMPDIR}/alert_slack_msg.XXXXXX")
-	ch="$channel" awk 'NR==1 && /^\{/ { print "{\"channel\":\"" ENVIRON["ch"] "\"," substr($0,2); next } { print }' \
+	escaped_channel=$(_alert_json_escape "$channel")
+	ch="$escaped_channel" awk 'NR==1 && /^\{/ { print "{\"channel\":\"" ENVIRON["ch"] "\"," substr($0,2); next } { print }' \
 		"$payload_file" > "$modified_payload"
 	# Write token to config file — keeps it out of /proc/PID/cmdline
 	local auth_cfg
@@ -638,7 +654,7 @@ _alert_slack_upload() {
 	local url_response upload_url file_id
 	url_response=$(_alert_curl_post "https://slack.com/api/files.getUploadURLExternal" \
 		-K "$auth_cfg" \
-		-d "filename=$filename" \
+		--data-urlencode "filename=$filename" \
 		-d "length=$fsize") || { command rm -f "$auth_cfg"; return 1; }
 	case "$url_response" in
 		*'"ok":true'*) ;;
@@ -653,6 +669,18 @@ _alert_slack_upload() {
 	upload_url=$(printf '%s' "$url_response" | sed -n 's/.*"upload_url" *: *"\([^"]*\)".*/\1/p')
 	file_id=$(printf '%s' "$url_response" | sed -n 's/.*"file_id" *: *"\([^"]*\)".*/\1/p')
 
+	# Validate upload URL is HTTPS (defense-in-depth: reject http, file, ftp, etc.)
+	# Case-insensitive match: MITM attacker could use any casing (${var,,} prohibited on bash 4.1)
+	case "$upload_url" in
+		[hH][tT][tT][pP][sS]://*)
+			;;
+		*)
+			echo "alert_lib: Slack upload URL rejected (not https): ${upload_url:-(empty)}" >&2
+			command rm -f "$auth_cfg"
+			return 1
+			;;
+	esac
+
 	# Step 2: upload file content to presigned URL (no auth header needed)
 	_alert_curl_post "$upload_url" -F "file=@$file_path" > /dev/null || {
 		echo "alert_lib: Slack file upload to presigned URL failed." >&2