openclacky 1.3.2 → 1.3.4

data/lib/clacky/server/api_extension_dispatcher.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require "json"
+require "timeout"
+require "uri"
+
+module Clacky
+  module Server
+    # Routes /api/ext/<name>/<sub-path> requests to the matching ApiExtension
+    # subclass. Wraps each handler invocation with a timeout and a unified
+    # JSON error envelope so a misbehaving extension cannot break neighboring
+    # extensions or the host process.
+    module ApiExtensionDispatcher
+      MOUNT_PREFIX = "/api/ext/"
+
+      class << self
+        # Public entry called from HttpServer#_dispatch_rest.
+        # Returns true to indicate the request was handled (200/4xx/5xx).
+        def handle(req, res, http_server:)
+          ext_id, sub_path = parse_path(req.path)
+          return not_found(res, "extension id missing") unless ext_id
+
+          klass = Clacky::ApiExtension.registry[ext_id]
+          return not_found(res, "extension '#{ext_id}' not found") unless klass
+
+          method = req.request_method.to_s.downcase.to_sym
+          route, params = find_route(klass, method, sub_path)
+          return not_found(res, "no route for #{req.request_method} #{req.path}") unless route
+
+          # Public-endpoint check is done at HttpServer level (it owns access-key
+          # logic); by the time we get here, auth has already been resolved.
+
+          timeout_sec = route.options[:timeout] || klass.class_timeout || Clacky::ApiExtension::DEFAULT_TIMEOUT
+          invoke_route(klass, route, params, req, res, http_server, timeout_sec)
+          true
+        end
+
+        # Tells HttpServer whether a given /api/ext/... path can skip access-key
+        # auth, so the host can keep its single-source-of-truth auth logic.
+        def public_path?(path, method)
+          ext_id, sub_path = parse_path(path)
+          return false unless ext_id
+
+          klass = Clacky::ApiExtension.registry[ext_id]
+          return false unless klass
+          return false if klass.public_paths.empty?
+
+          route, _params = find_route(klass, method.to_s.downcase.to_sym, sub_path)
+          return false unless route
+
+          klass.public_paths.include?(route.pattern)
+        end
+
+        private def parse_path(path)
+          return [nil, nil] unless path.to_s.start_with?(MOUNT_PREFIX)
+
+          tail = path[MOUNT_PREFIX.length..]
+          slash = tail.index("/")
+          if slash
+            [tail[0...slash], tail[slash..]]
+          else
+            [tail, "/"]
+          end
+        end
+
+        private def find_route(klass, method, sub_path)
+          klass.routes.each do |route|
+            next unless route.method == method
+            next unless (m = route.regex.match(sub_path))
+
+            params = {}
+            route.param_names.each_with_index do |name, i|
+              params[name] = URI.decode_www_form_component(m[i + 1].to_s)
+            end
+            return [route, params]
+          end
+          [nil, nil]
+        end
+
+        private def invoke_route(klass, route, params, req, res, http_server, timeout_sec)
+          instance = klass.new(req: req, res: res, route: route, params: params, http_server: http_server)
+          Timeout.timeout(timeout_sec) { instance.invoke }
+
+          # Handler exited without writing — empty 204
+          empty_response(res)
+        rescue Clacky::ApiExtension::Halt => halt
+          write_response(res, halt.status, halt.payload, halt.content_type)
+        rescue Timeout::Error
+          Clacky::Logger.warn("[api_ext:#{klass.ext_id}] Timed out after #{timeout_sec}s on #{route.method.upcase} #{route.pattern}")
+          write_json(res, 503, error: "request timed out")
+        rescue StandardError => e
+          Clacky::Logger.warn("[api_ext:#{klass.ext_id}] #{e.class}: #{e.message}\n#{e.backtrace.first(5).join("\n")}")
+          write_json(res, 500, error: e.message)
+        end
+
+        private def write_response(res, status, body, content_type)
+          res.status = status
+          res.content_type = content_type
+          res["Access-Control-Allow-Origin"] = "*"
+          res.body = body
+        end
+
+        private def write_json(res, status, payload)
+          write_response(res, status, JSON.generate(payload), "application/json; charset=utf-8")
+        end
+
+        private def empty_response(res)
+          res.status = 204
+          res["Access-Control-Allow-Origin"] = "*"
+          res.body = ""
+        end
+
+        private def not_found(res, message)
+          write_json(res, 404, error: message)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/clacky/server/channel/channel_manager.rb

@@ -43,6 +43,8 @@ module Clacky
         @running           = false
         @mutex             = Mutex.new
         @session_counters  = Hash.new(0)
+        @dedup_mutex       = Mutex.new
+        @last_message      = {}  # channel_key => [digest, monotonic_time]
       end
 
       # Start all enabled adapters in background threads. Non-blocking.
@@ -242,6 +244,16 @@ module Clacky
         files = event[:files] || []
         return if (text.nil? || text.empty?) && files.empty?
 
+        # Safety net against adapter-side message storms: drop an identical message
+        # repeated on the same channel within a short window. A real user never
+        # sends the exact same text+files twice within DEDUP_WINDOW seconds, but a
+        # misbehaving adapter (or noisy IM system messages) can, which would
+        # otherwise spin the interrupt→restart loop below indefinitely.
+        if duplicate_message?(event, text, files)
+          Clacky::Logger.info("[ChannelManager] Dropping duplicate message on #{channel_key(event)} within #{DEDUP_WINDOW}s")
+          return
+        end
+
         # Handle built-in commands
         if text&.match?(KNOWN_COMMAND) || text&.match?(/\A([\?h]|help)\z/i)
           handle_command(adapter, event, text)
@@ -749,6 +761,20 @@ module Clacky
         adapter.send_text(chat_id, "Recent sessions:\n#{lines.join("\n")}\n\nUse `/bind <n>` to switch.")
       end
 
+      DEDUP_WINDOW = 2.0  # seconds; identical messages on the same channel within this window are dropped
+
+      private def duplicate_message?(event, text, files)
+        key    = channel_key(event)
+        digest = [text, files.map { |f| f.is_a?(Hash) ? f[:name] : f.to_s }].hash
+        now    = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+
+        @dedup_mutex.synchronize do
+          prev_digest, prev_time = @last_message[key]
+          @last_message[key] = [digest, now]
+          !prev_digest.nil? && prev_digest == digest && (now - prev_time) < DEDUP_WINDOW
+        end
+      end
+
       def channel_key(event)
         platform = event[:platform].to_s
         case @binding_mode

data/lib/clacky/server/git_panel.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "open3"
+
+module Clacky
+  module Server
+    # Read-mostly git operations scoped to a session's working directory, backing
+    # the official "git" WebUI panel. Commands run with explicit argv (no shell),
+    # so user-supplied values (paths, messages) cannot inject. Write operations
+    # are limited to a guarded `commit`; history-rewriting / remote-mutating
+    # commands are never exposed here.
+    module GitPanel
+      module_function
+
+      # Run a git subcommand in `dir` with argv-style args (no shell). Returns
+      # [stdout, stderr, success_bool]. Never raises on git failure.
+      def git(dir, *args)
+        out, err, status = Open3.capture3("git", "-C", dir.to_s, *args)
+        [out, err, status.success?]
+      rescue StandardError => e
+        ["", e.message, false]
+      end
+
+      # Whether `dir` is inside a git work tree.
+      def repo?(dir)
+        out, _err, ok = git(dir, "rev-parse", "--is-inside-work-tree")
+        ok && out.strip == "true"
+      end
+
+      # { branch:, ahead:, behind:, files: [{ path:, x:, y:, staged:, untracked: }] }
+      # Parsed from `git status --porcelain=v2 --branch`.
+      def status(dir)
+        out, _err, ok = git(dir, "status", "--porcelain=v2", "--branch")
+        return { branch: nil, files: [] } unless ok
+
+        branch = nil
+        ahead = behind = 0
+        files = []
+        out.each_line do |line|
+          line = line.chomp
+          if line.start_with?("# branch.head ")
+            branch = line.sub("# branch.head ", "")
+          elsif line.start_with?("# branch.ab ")
+            m = line.match(/\+(\d+) -(\d+)/)
+            ahead, behind = m[1].to_i, m[2].to_i if m
+          elsif line.start_with?("1 ", "2 ")
+            xy = line.split(" ")[1]
+            path = line.split(" ", 9).last
+            files << { path: path, x: xy[0], y: xy[1],
+                       staged: xy[0] != ".", untracked: false }
+          elsif line.start_with?("? ")
+            files << { path: line.sub("? ", ""), x: "?", y: "?",
+                       staged: false, untracked: true }
+          end
+        end
+        { branch: branch, ahead: ahead, behind: behind, files: files }
+      end
+
+      # Unified diff. `file` (optional, relative) limits to one path; omitted =
+      # whole working tree (tracked changes). `--` guards path from being read
+      # as an option.
+      def diff(dir, file: nil)
+        args = ["diff"]
+        args += ["--", file] if file && !file.empty?
+        out, _err, _ok = git(dir, *args)
+        out
+      end
+
+      # Recent commits: [{ hash:, short:, author:, date:, subject: }].
+      def log(dir, limit: 50)
+        limit = limit.to_i.clamp(1, 200)
+        fmt = "%H%x1f%h%x1f%an%x1f%ad%x1f%s"
+        out, _err, ok = git(dir, "log", "-n", limit.to_s, "--date=short", "--pretty=format:#{fmt}")
+        return [] unless ok
+
+        out.each_line.filter_map do |line|
+          h, short, author, date, subject = line.chomp.split("\x1f")
+          next unless h
+          { hash: h, short: short, author: author, date: date, subject: subject }
+        end
+      end
+
+      # [{ name:, current: bool }] from `git branch`.
+      def branches(dir)
+        out, _err, ok = git(dir, "branch", "--format=%(refname:short)%00%(HEAD)")
+        return [] unless ok
+
+        out.each_line.filter_map do |line|
+          name, head = line.chomp.split("\x00")
+          next unless name && !name.empty?
+          { name: name, current: head == "*" }
+        end
+      end
+
+      # Stage `files` (relative paths) and commit with `message`. Returns
+      # { ok:, error?:, hash? }. Refuses empty message / empty file set. Uses
+      # argv so paths/message cannot inject; no --no-verify, no amend.
+      def commit(dir, message:, files:)
+        msg   = message.to_s.strip
+        paths = Array(files).map(&:to_s).reject(&:empty?)
+        return { ok: false, error: "commit message is required" } if msg.empty?
+        return { ok: false, error: "no files selected" } if paths.empty?
+
+        _out, add_err, add_ok = git(dir, "add", "--", *paths)
+        return { ok: false, error: "git add failed: #{add_err.strip}" } unless add_ok
+
+        _out, c_err, c_ok = git(dir, "commit", "-m", msg, "--", *paths)
+        return { ok: false, error: "git commit failed: #{c_err.strip}" } unless c_ok
+
+        head, _err, _ok = git(dir, "rev-parse", "--short", "HEAD")
+        { ok: true, hash: head.strip }
+      end
+    end
+  end
+end