jerboa-scintilla

Jerboa bindings for Scintilla using the scintilla-termbox backend. This repository is experimental Lane B native/FFI infrastructure for editor-style tools.

The native boundary is intentionally narrow:

• Statically registered native symbols are preferred. Development-only dynamic loading is lazy and requires an explicit trusted absolute directory.
• Text arguments cross into C as UTF-8 bytevectors with explicit lengths.
• Text results cross into caller-owned bytevectors with a checked capacity and an explicit 64 MiB API limit; there is no fixed 64 KiB receive buffer.
• Embedded NUL bytes are rejected before native calls.
• Opaque numeric editor IDs are never reused. Native operations, notification delivery, and destruction use synchronized lifecycle references.
• Vendored Scintilla, Lexilla, and termbox_next archives are required only for native shim builds.
• Pure API tests can run without a terminal or native vendor checkout.

Build

Run the pure build and API tests:

make security
make test

Populate the ignored native vendor checkout, then build and test the native shim:

make vendor-deps
make vendor-provenance-enforce
make test-native
make native-boundary-corpus
make native-security-tests
make native-thread-tests
make audit

By default, the Makefile uses the ignored ./scintilla-vendor directory. Set SCINTILLA_VENDOR=/path/to/scintilla-vendor to use another checkout.

The Makefile supplies the development loader controls for its native tests. Other dynamic development hosts must set both JERBOA_SCINTILLA_DEV_NATIVE=1 and JERBOA_SCINTILLA_LIB to a trusted, canonical absolute directory containing the shim. Production hosts should statically register the shim symbols instead. Current-directory, relative, bare-name, symlinked, unexpected-owner, and world-writable native paths are rejected by the shared (std native-loader) policy, which validates every ancestor. Group-write is allowed only on same-user components in explicit unprivileged development mode. Privileged processes ignore the development environment entirely.

Security

Review SECURITY.md, docs/ffi-boundary.md, docs/vendor-provenance.md, and docs/threat-model.md before using this library in release candidates. make release-evidence records test output, vendor provenance status, SBOM manifests, native linkage, sanitized target evidence, and hash-only reproducibility output under dist/release-evidence/. Target proof files are rejected before copying when they contain overlarge, host-private, or high-confidence secret material. Public production release still requires sanitizer coverage of the complete vendored C++ graph, terminal smoke tests, and marker-complete target-platform evidence. The checked-in shim harness already runs ASan/UBSan boundary cases and ThreadSanitizer over the deterministic lifecycle/concurrency suite.