@a9n-shoji/rvw 0.15.0 → 0.15.2

package/CHANGELOG.md

@@ -5,6 +5,20 @@
 
 ## [Unreleased]
 
+## [0.15.2] - 2026-11-02
+
+### Fixed
+
+- ウォークスルーへのコメントを `rvw comment get` で取得する際、`assets` が未認識キーとして拒否される不具合を修正しました。
+- 「この依頼に伴う変更を許可」は新規投稿・返信の送信前だけ表示し、投稿後と編集時には表示しないようにしました。
+
+## [0.15.1] - 2026-11-01
+
+### Security
+
+- ローカルViewerの画面埋め込みを拒否し、CSPで外部通信とインラインスクリプトなどを制限しました。HTML・Mermaidと同梱画像・フォントの表示は維持しています。
+- HTTP APIのリクエスト本文をJSON解析前に8 MiBへ制限し、コメント参照配列にも200件の上限を適用しました。
+
 ## [0.15.0] - 2026-11-01
 
 ### Added

package/dist/cli.mjs

@@ -1009,7 +1009,7 @@ function imageContentTypeHeader(contentType2) {
 }
 
 // src/shared/constants.ts
-var APP_VERSION = "0.15.0";
+var APP_VERSION = "0.15.2";
 var PROTOCOL_VERSION = 7;
 var DEFAULT_VIEWER_PORT = 43117;
 var GIT_OBJECT_ID_PATTERN = /^[0-9a-f]{40,64}$/i;
@@ -1020,6 +1020,7 @@ var MAX_GITHUB_ATTACHMENT_BYTES = 10 * 1024 * 1024;
 var MAX_GITHUB_ATTACHMENT_STDERR_BYTES = 64 * 1024;
 var GITHUB_ATTACHMENT_TIMEOUT_MS = 3e4;
 var MAX_COMMENT_BODY_BYTES = 64 * 1024;
+var MAX_HTTP_BODY_BYTES = 8 * 1024 * 1024;
 var MAX_AUTHOR_LABEL_CHARACTERS = 100;
 var MAX_IDEMPOTENCY_KEY_CHARACTERS = 200;
 var DEFAULT_PULL_REQUEST_LIST_LIMIT = 50;
@@ -59949,6 +59950,34 @@ var serveStatic = (options = { root: "" }) => {
   };
 };
 
+// node_modules/.pnpm/hono@4.13.11/node_modules/hono/dist/http-exception.js
+var HTTPException = class extends Error {
+  res;
+  status;
+  /**
+  * Creates an instance of `HTTPException`.
+  * @param status - HTTP status code for the exception. Defaults to 500.
+  * @param options - Additional options for the exception.
+  */
+  constructor(status = 500, options) {
+    super(options?.message, { cause: options?.cause });
+    this.res = options?.res;
+    this.status = status;
+  }
+  /**
+  * Returns the response object associated with the exception.
+  * If a response object is not provided, a new response is created with the error message and status code.
+  * @returns The response object.
+  */
+  getResponse() {
+    if (this.res) return new Response(this.res.body, {
+      status: this.status,
+      headers: this.res.headers
+    });
+    return new Response(this.message, { status: this.status });
+  }
+};
+
 // node_modules/.pnpm/hono@4.13.11/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
@@ -61719,6 +61748,40 @@ var Hono3 = class extends Hono {
   }
 };
 
+// node_modules/.pnpm/hono@4.13.11/node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var bodyLimit = (options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, { status: 413 });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return async function bodyLimit2(c, next2) {
+    if (!c.req.raw.body) return next2();
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    if (c.req.raw.headers.has("content-length") && !hasTransferEncoding) return parseInt(c.req.raw.headers.get("content-length") || "0", 10) > maxSize ? onError(c) : next2();
+    let size = 0;
+    const chunks = [];
+    const rawReader = c.req.raw.body.getReader();
+    for (; ; ) {
+      const { done, value } = await rawReader.read();
+      if (done) break;
+      size += value.length;
+      if (size > maxSize) return onError(c);
+      chunks.push(value);
+    }
+    const requestInit = {
+      body: new ReadableStream({ start(controller) {
+        for (const chunk of chunks) controller.enqueue(chunk);
+        controller.close();
+      } }),
+      duplex: "half"
+    };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    return next2();
+  };
+};
+
 // src/application/agent-command-schemas.ts
 var nonEmptyString = external_exports.string().min(1);
 var commentUri = external_exports.string().regex(/^rvw:\/\/comment\//);
@@ -62180,7 +62243,7 @@ var createCommentSchema = external_exports.object({
   body: external_exports.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_COMMENT_BODY_BYTES),
   authorLabel: external_exports.string().max(MAX_AUTHOR_LABEL_CHARACTERS).nullable().optional(),
   relatedCommitOid: external_exports.string().regex(GIT_OBJECT_ID_PATTERN).nullable().optional(),
-  references: external_exports.array(codeReferenceInputSchema).optional()
+  references: external_exports.array(codeReferenceInputSchema).max(MAX_CODE_REFERENCES).optional()
 }).superRefine((input2, context) => {
   if ((input2.references?.length ?? 0) > 0 && !input2.relatedCommitOid) {
     context.addIssue({
@@ -62195,7 +62258,7 @@ var replySchema = external_exports.object({
   body: external_exports.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_COMMENT_BODY_BYTES),
   relatedCommitOid: external_exports.string().regex(GIT_OBJECT_ID_PATTERN).nullable().optional(),
   authorLabel: external_exports.string().max(MAX_AUTHOR_LABEL_CHARACTERS).nullable().optional(),
-  references: external_exports.array(codeReferenceInputSchema).optional()
+  references: external_exports.array(codeReferenceInputSchema).max(MAX_CODE_REFERENCES).optional()
 }).superRefine((input2, context) => {
   if ((input2.references?.length ?? 0) > 0 && !input2.relatedCommitOid) {
     context.addIssue({
@@ -62207,7 +62270,7 @@ var replySchema = external_exports.object({
 });
 var editCommentPostSchema = external_exports.object({
   body: external_exports.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_COMMENT_BODY_BYTES),
-  references: external_exports.array(codeReferenceInputSchema).optional()
+  references: external_exports.array(codeReferenceInputSchema).max(MAX_CODE_REFERENCES).optional()
 });
 var placementDocumentRefSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({ kind: external_exports.literal("pull-request-markdown"), pullRequestId: external_exports.uuid() }),
@@ -62235,6 +62298,29 @@ var resolveCodeReferencePlacementSchema = external_exports.object({
   reference: codeReferenceInputSchema
 });
 
+// src/server/security-headers.ts
+var viewerContentSecurityPolicy = [
+  "default-src 'none'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob:",
+  "font-src 'self' data:",
+  "connect-src 'self'",
+  "frame-src 'self'",
+  "worker-src 'none'",
+  "object-src 'none'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'"
+].join("; ");
+var securityHeaders = async (context, next2) => {
+  context.header("Content-Security-Policy", viewerContentSecurityPolicy);
+  context.header("X-Frame-Options", "DENY");
+  context.header("X-Content-Type-Options", "nosniff");
+  context.header("Referrer-Policy", "no-referrer");
+  await next2();
+};
+
 // src/server/app.ts
 var oidSchema = external_exports.string().regex(GIT_OBJECT_ID_PATTERN);
 var contentFingerprintSchema = external_exports.string().regex(CONTENT_FINGERPRINT_PATTERN);
@@ -62317,6 +62403,7 @@ function documentRefFromQuery(pullRequestId, query) {
 }
 function createApp(service, options) {
   const app = new Hono3();
+  app.use("*", securityHeaders);
   app.use("*", async (context, next2) => {
     const expectedHost = options.security.expectedHost;
     if (!expectedHost || context.req.header("host") !== expectedHost) {
@@ -62340,6 +62427,17 @@ function createApp(service, options) {
     }
     await next2();
   });
+  app.use(
+    "/api/*",
+    bodyLimit({
+      maxSize: MAX_HTTP_BODY_BYTES,
+      onError: () => {
+        throw new RvwError("INVALID_INPUT", "HTTP request body\u306F8 MiB\u4EE5\u4E0B\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002", {
+          status: 413
+        });
+      }
+    })
+  );
   app.onError((error62, context) => {
     const rvwError = error62 instanceof external_exports.ZodError ? new RvwError("INVALID_INPUT", "request\u304CAPI schema\u306B\u9069\u5408\u3057\u307E\u305B\u3093\u3002", {
       details: external_exports.treeifyError(error62)
@@ -64223,6 +64321,14 @@ var reviewCommentOutputSchema = external_exports.object({
   posts: external_exports.array(commentPostOutputSchema)
 }).strict();
 var walkthroughOutputSchema = external_exports.object({
+  assets: external_exports.array(
+    external_exports.object({
+      path: external_exports.string(),
+      mediaType: external_exports.string(),
+      byteLength: external_exports.number().int().min(0),
+      sha256: external_exports.string()
+    }).strict()
+  ).optional(),
   id: external_exports.string(),
   ref: external_exports.string(),
   pullRequestId: external_exports.string(),