pkgIndex.tcl.in now branches on [package vsatisfies [package provide Tcl] 9.0-] and loads libtcl9websh<version> under Tcl 9 and libwebsh<version> under Tcl 8.6 (same pattern as tzint/tserialport), passing the init prefix [string totitle websh] explicitly instead of relying on filename derivation. Verified by loading the package from a single directory containing both libraries with tclsh8.6 and tclsh9.0.

Makefile.in install rules were hardcoded to the libwebsh prefix and would have missed a Tcl 9 build's library; install-binaries and install-libraries now use $(web_LIB_FILE) throughout (pkgdir copy, libdir symlinks, moddir symlink). A Tcl 9 "make install" lands under its own TCL_PREFIX (/opt/tcl/9.0), separate from the 8.6 deployment. leaf check-in: 47e9a57ea8 user: alex tags: towardsTcl9

Tcl 9 sources scripts strictly as UTF-8 and aborts on invalid byte sequences ("invalid or incomplete multibyte or wide character"). Content is unchanged; on Tcl 8.6 with a UTF-8 locale the files read identically. Affected: context, dehtmlify, dispatch, encrypt, filecontext, htmlify, messages, ncad, nocrypt, script, time, uricode, webout. check-in: e49f5c8924 user: alex tags: towardsTcl9

Tcl 9 reports [file attributes -permissions] as 0o644 while Tcl 8.6 reports 00644, and Tcl 9 no longer parses leading-zero integers as octal. New helper cfgTestPerms normalizes both forms via scan %o and compares as 0644; golden values in cfg-4.2 - cfg-4.6 updated accordingly (00644 -> 0644). No change in what is being tested. check-in: 61e3e0699f user: alex tags: towardsTcl9

New src/generic/webtclcompat.h: Tcl_Size/TCL_SIZE_MAX/TCL_SIZE_MODIFIER shims for Tcl <= 8.6, per the official migration guide (core.tcl-lang.org tclconfig wiki).

Mechanical API migration: 34 length out-parameters converted from int to Tcl_Size (Tcl_GetStringFromObj, Tcl_GetByteArrayFromObj, Tcl_ListObjGetElements/Length, Tcl_SplitList); CONST -> const (130 sites, removed in Tcl 9); Tcl_InitStubs "8.2" -> "8.6-" (5 sites, web.c now checks the return value); tclAppInit.c rewritten as a modern Tcl_Main template (_ANSI_ARGS_/Tcl_StaticPackage gone); log.c includes stdarg.h (no longer transitive via tcl.h) and uses Tcl_SetObjResult instead of Tcl_SetResult+Tcl_Free (freeProc signature mismatch in Tcl 9).

Channel types (apchannel.c, varchannel.c): lifted to TCL_CHANNEL_VERSION_5 with close2Proc wrappers — Tcl 9 accepts only v5; identical behaviour on 8.6.

Runtime fixes surfaced by the Tcl 9 test runs, all version-guarded and behaviour-preserving on 8.6: - Octal permissions: Tcl 9 parses a leading zero as decimal. web::config filepermissions (cfg.c) and web::filecounter -perms (filecounter.c) now parse base-8 explicitly (0o prefix accepted); sessctx.ws3 converts via scan %o before open. - nca_d.c decryptNcaD: assemble decrypted bytes in a Tcl_DString and create the string object in one go — Tcl 9 validates UTF-8 on append, byte-wise Tcl_AppendToObj corrupted multi-byte sequences. - checksum.c crcCalc: emulate the historic char&0xFF semantics explicitly (Tcl 9's Tcl_GetByteArrayFromObj returns NULL for chars > U+00FF); checksums stay bit-identical to existing ciphertexts for BMP content. Known limitation: chars > U+FFFF have different string reps on 8.6 vs 9, so astral-char ciphertexts do not decrypt cross-version (round-trip within one version always works). - formdata.c: multipart channel gets -profile tcl8 on Tcl 9 (strict would abort on 8-bit bytes); readAndDumpBody now reads upload bodies byte-faithfully via iso8859-1 — this also fixes a latent 8.6 bug where valid UTF-8 sequences inside binary uploads were collapsed by the utf-8 channel encoding (silently truncated files). - varchannel.c: NULL guard after Tcl_GetByteArrayFromObj (Tcl 9 returns NULL for chars > U+00FF -> EILSEQ instead of crash); Tcl_ExternalToUtf uses TCL_ENCODING_PROFILE_TCL8 on Tcl 9 so binary bytes keep flowing. - webutils.tcl web::getContent: normalize IANA charset names to Tcl encoding names (iso-8859-1 -> iso8859-1 etc.) — the previous behaviour only worked by accident through Tcl 8.6's lenient utf-8 decoding; uses -profile replace on Tcl 9. - htmlify.c: silence set-but-unused err counter (0 warnings on both builds). - tclconfig/tcl.m4 to TEA 3.14 check-in: 6b5597a451 user: alex tags: towardsTcl9

doc/quickref.xml: brought the DocBook reference from the 2014 3.6.0b5 state to 3.7.6. Recovered the 15 misc commands (ts, configSetup, sessionSetup, loggingSetup, sessionGet/New/Init/Close/Refresh, uuidV4, getContent, mimeType, returnJson/Text/Binary) from the previously published 3.7.3 HTML (fossil uv; the XML source of those edits was never committed). Added new sections: JSON Web Tokens (::jwt::sign/::jwt::verify incl. -json/-claims/-leeway), web::sseStart/sseSend, web::response -flush, web::randombytes, web::filerandom, web::genPasswd, web::list2uri/uri2list, web::logfilter alias. Removed stale $Id keywords, fixed two DTD validity errors present since 2014.

doc build: network URLs for DocBook XSL/DTD are dead; quickref.xsl now imports the catalog-resolvable current/ URI and doc/Makefile resolves via the local XML catalog (brew docbook + docbook-xsl on macOS, distro packages on Linux), builds with --nonet, and gains a "make check" DTD validation target. Chunker output switched to UTF-8 (was ISO-8859-1) to fix U+FFFD mojibake in the served pages. Generated doc/html/ is fossil-ignored; publishing works via fossil uv add --as basename + uv sync.

webutils.tcl: web::getContent now decodes JSON content types (application/json*, *+json) without a charset parameter as UTF-8 per RFC 8259; previously the C layer's iso8859-1 CONTENT_ENCODING default won and mangled UTF-8 JSON bodies.

genpasswd.tcl: class renamed genPasswd -> web::genPasswd (consistency with web::filerandom), randomness switched from Tcl rand() to web::randombytes with rejection sampling (no modulo bias), shuffle replaced by Fisher-Yates (the old n-random-swaps shuffle produced a biased permutation), new constructor length argument and configure API for all rules; package genpasswd 1.1. Now suitable for real secrets.

tests: new src/tests/webutils.test (32 cases) covering web::response -flush, SSE framing, getContent encoding resolution, charset extraction in the raw POST path, multipart UTF-8 roundtrip, returnJson/Text/Binary headers, randombytes, uuidV4, ts, mimeType, full session lifecycle, JSON POST dispatch incl. invalid-JSON error path, and web::genPasswd. mintest.test now cleans up its temp files on the error path too (removed leftover mintest1_1a/b.tcl). Suite: 526 total, 521 passed, 5 skipped, 0 failed. check-in: 8688b218c4 user: alex tags: trunk

- web::sessionInit now treats the uuid parameter as an override - previously it was only a fallback used when AUTH_BEARER was empty (set id [web::request AUTH_BEARER $uuid]); this made it impossible to load a known session when the request was already authenticated with a different bearer - Use case: server-side sliding-idle keyed off the access-JWT — the refresh session id lives in the JWT claims (rjti), but the HTTP bearer is the access-JWT itself; without this patch the caller had to overwrite AUTH_BEARER via web::request -set before the call and restore it afterwards - API change is formally backwards-incompatible - in practice the fallback default has no real users since there would be no session-id source either; the previous doc wording „uuid arg for testing" was misleading anyway and is now explicit check-in: f62d197a53 user: alex tags: trunk

::jwt::verify -json embedded payload/header as nested rl_json objects, so `json get $res payload` returned non-re-parsable Tcl-dict form — an undocumented footgun. Not yet in production; deliberate breaking redesign.

- -json: header/payload now raw JSON *string* values (re-parsable). Read claims in two steps: `set c [json get $res payload]; json get $c exp`. verify without -json unchanged (boolean, signature only). - -claims: opt-in RFC 7519 exp/nbf check (default stays signature only). Adds `reason` field to -json (ok|signature|notbefore| expired|payload), only when -claims given. - -leeway sec: opt-in clock-skew tolerance for -claims (default 0, no-op without -claims).

jwt.tcl is in SCRIPT_SOURCES (compiled into script.h via make). New src/tests/jwt.test (24 cases). Baseline unchanged (470: 465 passed, 5 skipped, 0 failed); full suite 494/489/5/0. SKILL.md: new "JWT (jwt.tcl)" section. check-in: d9c28bbfee user: alex tags: trunk

mod_websh.so loaded fine when started via `httpd -X` from /opt/homebrew/etc/httpd, but failed under the LaunchAgent (CWD=/) with no error_log entry — dyld could not resolve the bare-name LC_LOAD_DYLIB for libwebsh.

Root cause: libwebsh.dylib was linked without -install_name, so its LC_ID_DYLIB was just the bare filename. mod_websh.so inherited that bare reference in its LC_LOAD_DYLIB. All other dependencies (APR, APR-util, Tcl framework, libSystem) had absolute paths and worked.

Fix: on Darwin, link libwebsh with -Wl,-install_name,$(pkgdir)/$(web_LIB_FILE) so the embedded install_name is the configured install location. mod_websh picks this up automatically at link time. No post-build install_name_tool or -headerpad_max_install_names dance required. The path is prefix-relative and resolved at build time, so it follows --prefix / --with-tcl correctly.

Implemented as SHLIB_INSTALL_NAME, appended to MAKE_LIB / MAKE_SHARED_LIB. Empty on non-Darwin platforms — Linux uses SONAME + ldconfig and is unaffected. check-in: 95cdb054ae user: alex tags: trunk

Make the build work on macOS (Apple Silicon, Homebrew) without manual configure flags. ./configure --enable-apache, make, make test, and sudo make install all work out of the box.

C23 compatibility (clang on macOS now defaults to -std=gnu23):

* url.c: rename `int bool` to `int boolVal` — `bool` is a reserved type keyword in C23. * tclAppInit.c: convert K&R-style `int main(argc, argv)` to ANSI `int main(int argc, char **argv)` — K&R declarations were removed in C23.

Both changes also compile cleanly under C99/C11/C17, so Linux builds are unaffected.

Build system (configure.ac, Makefile.in):

* Auto-detect APR/APU link flags via `apr-1-config --link-ld --libs` and `apu-1-config --link-ld --libs`, with Homebrew fallbacks. Previously only the headers were auto-detected; the libraries required explicit --with-apr= / --with-apu=. On macOS, mod_websh.so is a bundle linked with -bundle_loader against the httpd binary, which does not export APR symbols (Homebrew httpd loads APR as shared libs at runtime), so explicit -lapr-1 / -laprutil-1 are required.

* Introduce SHLIB_EXT (.dylib on Darwin, .so elsewhere) so the unversioned install symlink (libwebsh.dylib / libwebsh.so) and the SHARED_LIB_SUFFIX match the platform's actual library extension. pkgIndex.tcl already uses [info sharedlibextension] and is unchanged.

* Rename SYSTEMCTL_APACHE to RESTART_APACHE and default it to ":" (no-op) so the install rule is syntactically valid on platforms without an Apache restart hook. LDCONFIG gets the same default. The recipe lines are now `@$(LDCONFIG)` / `@$(RESTART_APACHE)`.

* Add a Darwin case that sets RESTART_APACHE to `brew services restart httpd` when Homebrew httpd is installed. When invoked via sudo, the command runs as the original user via `sudo -u "$SUDO_USER"` so brew does not chown httpd paths to root:admin (which breaks future `brew upgrade httpd`).

* `make clean` now also removes libwebsh*.dylib.

Tests pass on macOS 26.4 (Apple Silicon, Tcl 8.6 framework, Homebrew httpd/apr/apr-util): 470 total, 465 passed, 5 skipped, 0 failed. check-in: 166114797f user: alex tags: trunk

Tcl's -translation binary implicitly sets -encoding binary as a side effect. In parseMultipartFormData this caused text field values to be stored as raw byte sequences rather than decoded Unicode strings: UTF-8 bytes C3 A4 (ä) were kept as two separate chars U+00C3 and U+00A4 instead of the single char U+00E4. On output through a UTF-8 response channel those chars were re-encoded, producing the double-encoded sequence C3 83 C2 A4 (ä) visible in the browser.

Fix: after setting -translation binary, explicitly restore the channel encoding to its saved value so that multi-byte sequences in text fields are decoded correctly during parsing.

websh-test.ws3: switch page charset to utf-8 to match the server's channel encoding and modern browser form submission behaviour; set Content-Type response header explicitly via web::response -set. check-in: 56cc68ed13 user: alex tags: trunk

configure.ac detects /sbin/ldconfig on Linux and sets LDCONFIG accordingly. When Apache support is enabled it also probes for the apache2 or httpd systemd service via "systemctl cat" and sets SYSTEMCTL_APACHE to "systemctl restart <service>". Both variables are empty on non-Linux platforms so the install targets remain portable.

install-binaries runs $(LDCONFIG) after placing the shared library. install-libraries runs $(SYSTEMCTL_APACHE) after installing the Apache module. Both calls are guarded with "test -z" so an empty variable is a silent no-op; the leading "-" prevents a failed restart from aborting the install.

The clean target now additionally removes versioned build artifacts via shell globs (websh[0-9]*, libwebsh[0-9]*.so, mod_websh[0-9]*.so) so that old binaries are cleaned up even after a version bump and reconfigure. check-in: 730c03e21c user: alex tags: trunk

install-binaries now installs the Tcl package into lib/websh<VERSION>/ (pkgdir) with pkgIndex.tcl and creates relative symlinks lib/libwebsh<VERSION>.so and lib/libwebsh.so pointing into pkgdir — matching the layout expected by the Tcl package loader and previously handled manually by the ./b script.

install-libraries (Apache only, guarded by INSTALL_APACHE) installs mod_websh<VERSION>.so to lib/httpd/modules/ with mod_websh.so and libwebsh<VERSION>.so symlinks. install-dirs no longer creates the Apache module directory; install-libraries does that itself so the directory is only created when Apache support is enabled.

All ln -s calls changed to ln -sf so repeated installs are idempotent.

The clean target now also removes versioned artifacts via shell globs (websh[0-9]*, libwebsh[0-9]*.so, mod_websh[0-9]*.so) so that old build products are cleaned up even after a version bump and reconfigure. check-in: a7fea1fbef user: alex tags: trunk

Compiler warnings (-Wunused-but-set-variable, dangerous function): - nca_d.c: remove unused keyBytes in Web_DecryptD - formdata.c: remove unused bytesWritten; use (void)readAndDumpBody() - log.c: replace silent ires assignments with proper TCL_OK checks for all four registerLogPlugIn() calls; fixes a logtocmd/logtosyslog WebAssertData typo as a side effect - request.c: replace tempnam() (TOCTOU-unsafe linker warning) with mkstemp() + immediate unlink() + P_tmpdir fallback for missing dirs; add <unistd.h> - interpool.c: check return values of Tcl_Init() and Websh_Init(), log failures via ap_log_error() and return NULL on error

Runtime crash (SIGSEGV in rawReadPostData): - formdata.c: guard CONTENT_TYPE hash lookup against NULL before passing to Tcl_GetString / Tcl_StringCaseMatch; fix cJSON_Delete() call to execute on all code paths; guard cmdTag NULL dereference

Encoding handling (web::getContent, CONTENT_ENCODING): - formdata.c rawReadPostData: derive CONTENT_ENCODING from charset= in the Content-Type header; fall back to iso8859-1 (HTTP/1.1 default) instead of the channel's system locale encoding - webutils.tcl web::getContent: resolve encoding in priority order — charset= from Content-Type, then CONTENT_ENCODING, then utf-8 — so JSON/XML bodies without an explicit charset= are decoded correctly

Missing header: - web.h: add #include "randombytes.h" to fix implicit declaration of randombytes_Init() in web.c check-in: d11b978e8c user: alex tags: trunk

Replace the Scriptics-era SC_* macro build system with the standard TEA (Tcl Extension Architecture) 3.13 framework.

- Add configure.ac (replaces configure.in) using TEA_* macros - Add tclconfig/ with tcl.m4 (TEA 3.13), install-sh, and support files - Add pkgIndex.tcl.in template for package registration - Update aclocal.m4 to include tclconfig/tcl.m4 - Remove obsolete configure.in and standalone tcl.m4 - Update Makefile.in for TEA compatibility: - Apache module build made optional via APACHE_TARGET / INSTALL_APACHE substitution variables; default: auto-detect, --disable-apache skips mod_websh, --enable-apache requires it - Override TEA's MAKE_LIB to preserve websh's $($@_OBJECTS) link pattern - Keep web_LIB_FILE as compatibility alias for PKG_LIB_FILE - Fix LD_LIBRARY_PATH order in test target so the freshly built library takes precedence over any installed version - Auto-detect APR/APU include paths via apr-1-config / apu-1-config; add Homebrew prefix search on macOS (Intel and Apple Silicon) check-in: 26dd4f11e4 user: alex tags: trunk

Introduce real-time Server-Sent Events streaming for mod_websh:

- webout.h: add ResponseFlushHandler typedef and flushHandler pointer to ResponseObj (analogous to existing headerHandler) - weboutint.c: initialise flushHandler to NULL in createResponseObj - webout.c: implement web::response -flush — calls Tcl_Flush on the response channel, then invokes flushHandler if set - response_ap.c: add apFlushHandler (calls ap_rflush) and wire it into createDefaultResponseObj_AP; without this ap_rwrite fills the APR bucket chain but never pushes data to the network until request end - webutils.tcl: web::sseStart sets -buffering none -buffersize 0 instead of -buffering line

Without ap_rflush, SSE events were buffered by Apache and only delivered after the command completed. Tcl_Flush alone is insufficient because it drains Tcl's internal buffer via outputProc but does not call flushProc from Tcl_ChannelType (that is only invoked on channel close). check-in: 40063bce69 user: alex tags: trunk