docs(adr): accept residual rustyscript transitive-CVE risk (#193)

docs/adr/0005-rustyscript-residual-cve-risk.md

@@ -0,0 +1,46 @@
+# ADR 0005: Accept residual CVE risk in rustyscript's transitive dependencies
+
+Date: 2026-10-22 · Status: accepted
+
+## Context
+The `scripting` feature embeds `rustyscript` 0.12.3, whose
+`deno_core` → `deno_crypto` / `swc_ecma_*` stack transitively pulls
+known-vulnerable and unmaintained crates:
+
+- `rsa` 0.9.10 — CVE-2023-49092 (Marvin timing attack on RSA private keys,
+  CVSS 5.9). No fixed `0.9.x` release exists; `0.10.0` is pre-release only.
+- `rand` 0.8.5 — RUSTSEC-2026-0097 (unsoundness).
+- `bincode` 1.3.3, `smartstring` 1.0.1, `unic-*` 0.9.0 — unmaintained
+  (RUSTSEC-2025/2026 series), pulled via `deno_core` → `deno_url` → `urlpattern`.
+
+`rustyscript` is at its latest stable release (0.12.3). No newer release
+bumps `deno_core` / `deno_crypto` / `swc_ecma_*` to non-vulnerable
+dependencies, and the engine cannot depend on `0.10.0-rc` for a shipped
+Flatpak. The `scripting` feature is compiled into the shipped Flatpak
+(`ci.yml`, `flatpak.yml`: `--features preview,scripting,vector`).
+
+## Decision
+Accept the residual risk as a documented, tracked known issue (#82, #193) and
+keep `scripting` enabled. It is core to dualcut's dual-mode value — a
+programmatic, agent-editable JSON document (ADR 0002) — and disabling it by
+default in production builds would remove that capability. The alternative
+(upgrade) is not available: there is no fixed stable dependency to move to.
+
+## Mitigations
+- The HTTP agent API binds `127.0.0.1` only (`engine/src/api.rs`): the
+  in-process script runtime has no remote network reachability.
+- Realistic exposure is a *malicious project file's* `edit()` script reaching
+  WebCrypto RSA via `deno_crypto` — an actor who already authored the project
+  document — not a network attacker.
+
+## Revisit when
+- `rustyscript` releases a version that bumps `deno_core` / `deno_crypto` /
+  `swc_ecma_*` to non-vulnerable dependencies — then bump
+  `engine/Cargo.toml`, re-scan `Cargo.lock`, and close this out; or
+- `rsa` 0.10.0 stabilises, or a `ring` / `aws-lc-rs` migration becomes viable;
+  or
+- the `scripting` feature is removed or gated behind an explicit opt-in in a
+  production build.
+
+See also: the `rustyscript` dependency comment in `engine/Cargo.toml`, and
+issues #82 and #193.

engine/Cargo.toml

@@ -20,7 +20,7 @@ libadwaita = { features = ["v1_8"],  version = "0.9.2", optional = true }
 pango = { version = "0.22.8", optional = true } # keep <0.22.9 until the serde pin below is lifted: pango-sys 0.22.9 pulls system-deps 9 -> serde_core/serde_derive 1.0.225, which conflicts with serde =1.0.219 (see renovate.json)
 pangocairo = { version = "0.22.8", optional = true }
 pollster = { version = "1.0.1", optional = true }
-rustyscript = { version = "0.12.3", optional = true } # 0.12.3 is latest; its deno_core/deno_crypto/swc_ecma_* stack transitively pins rsa 0.9.10 (CVE-2023-49092 Marvin attack, no fixed 0.9.x — only an unreleased 0.10.0-rc exists), rand 0.8.5 (RUSTSEC-2026-0097), and unmaintained bincode/smartstring/unic-* (RUSTSEC-2025-00xx series, pulled in via deno_core -> deno_url -> urlpattern) — no newer rustyscript release resolves any of them. `scripting` is compiled into the shipped Flatpak (ci.yml, flatpak.yml: --features preview,scripting,vector), so this is live, not dormant. Realistic exposure is a malicious project's edit() script reaching WebCrypto RSA via deno_crypto, not a network attacker — the HTTP agent API (api.rs) binds 127.0.0.1 only. See #82.
+rustyscript = { version = "0.12.3", optional = true } # 0.12.3 is latest; its deno_core/deno_crypto/swc_ecma_* stack transitively pins rsa 0.9.10 (CVE-2023-49092 Marvin attack, no fixed 0.9.x — only an unreleased 0.10.0-rc exists), rand 0.8.5 (RUSTSEC-2026-0097), and unmaintained bincode/smartstring/unic-* (RUSTSEC-2025-00xx series, pulled in via deno_core -> deno_url -> urlpattern) — no newer rustyscript release resolves any of them. `scripting` is compiled into the shipped Flatpak (ci.yml, flatpak.yml: --features preview,scripting,vector), so this is live, not dormant. Realistic exposure is a malicious project's edit() script reaching WebCrypto RSA via deno_crypto, not a network attacker — the HTTP agent API (api.rs) binds 127.0.0.1 only. See ADR 0005 (#193); #82.
 serde = { version = "=1.0.219", features = ["derive"] }
 serde_json = "1.0.120"
 tempfile = "3.12.0"