@agent-native/core 0.149.0 → 0.149.1

package/corpus/templates/slides/server/lib/fetch-remote-image.ts

@@ -0,0 +1,192 @@
+import { lookup as dnsLookup, type LookupAddress } from "node:dns";
+import http from "node:http";
+import https from "node:https";
+import type { LookupFunction } from "node:net";
+
+import {
+  isPrivateAddress,
+  MAX_PROXIED_IMAGE_BYTES,
+  MAX_PROXY_REDIRECTS,
+  parseProxyableImageUrl,
+} from "./image-proxy-url.js";
+
+export type RemoteImageFailure =
+  | "unsupported-url"
+  | "blocked-address"
+  | "fetch-failed"
+  | "too-many-redirects"
+  | "not-an-image"
+  | "too-large";
+
+export type RemoteImageResult =
+  | { ok: true; contentType: string; body: Buffer }
+  | { ok: false; reason: RemoteImageFailure };
+
+const REQUEST_TIMEOUT_MS = 15_000;
+
+/**
+ * A `lookup` implementation that only ever hands the socket an address we have
+ * classified as public.
+ *
+ * Validating the hostname separately and then calling `fetch` leaves a gap: the
+ * two resolutions are independent, so a DNS-rebinding host can answer with a
+ * public address for the check and a loopback or metadata address for the
+ * actual connection. Because Node passes this straight to `net.connect`, the
+ * address that is checked here is the address that gets dialled.
+ */
+export const publicOnlyLookup: LookupFunction = (
+  hostname,
+  options,
+  callback,
+) => {
+  const wantsAll =
+    typeof options === "object" && options !== null && options.all === true;
+  const hints = typeof options === "object" && options !== null ? options : {};
+
+  dnsLookup(hostname, { ...hints, all: true }, (err, addresses) => {
+    if (err) {
+      (callback as (e: NodeJS.ErrnoException) => void)(err);
+      return;
+    }
+    const safe = (addresses as LookupAddress[]).filter(
+      (entry) => !isPrivateAddress(entry.address),
+    );
+    if (safe.length === 0) {
+      const blocked: NodeJS.ErrnoException = new Error(
+        `Refusing to connect to a non-public address for ${hostname}`,
+      );
+      blocked.code = "EBLOCKED";
+      (callback as (e: NodeJS.ErrnoException) => void)(blocked);
+      return;
+    }
+    if (wantsAll) {
+      (callback as unknown as (e: null, a: LookupAddress[]) => void)(
+        null,
+        safe,
+      );
+      return;
+    }
+    callback(null, safe[0].address, safe[0].family);
+  });
+};
+
+interface HopResult {
+  status: number;
+  headers: http.IncomingHttpHeaders;
+  read: () => Promise<Buffer | "too-large">;
+  discard: () => void;
+}
+
+function requestHop(target: URL): Promise<HopResult> {
+  return new Promise<HopResult>((resolve, reject) => {
+    const transport = target.protocol === "https:" ? https : http;
+    const request = transport.request(
+      target,
+      {
+        method: "GET",
+        headers: { Accept: "image/*" },
+        lookup: publicOnlyLookup,
+      },
+      (response) => {
+        resolve({
+          status: response.statusCode ?? 0,
+          headers: response.headers,
+          discard: () => response.destroy(),
+          read: () =>
+            new Promise<Buffer | "too-large">((resolveBody, rejectBody) => {
+              const chunks: Buffer[] = [];
+              let total = 0;
+              response.on("data", (chunk: Buffer) => {
+                total += chunk.length;
+                // Stop at the cap instead of buffering first and measuring
+                // after: a chunked response, or one that lies about
+                // Content-Length, would otherwise pull the whole body into
+                // memory before anyone checks it.
+                if (total > MAX_PROXIED_IMAGE_BYTES) {
+                  response.destroy();
+                  resolveBody("too-large");
+                  return;
+                }
+                chunks.push(chunk);
+              });
+              response.on("end", () => resolveBody(Buffer.concat(chunks)));
+              response.on("error", rejectBody);
+            }),
+        });
+      },
+    );
+
+    request.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      request.destroy(new Error("Timed out fetching image"));
+    });
+    request.on("error", reject);
+    request.end();
+  });
+}
+
+/**
+ * Fetch a remote image for the proxy route. Every hop is re-parsed against the
+ * URL policy and every connection is pinned to a validated public address.
+ */
+export async function fetchRemoteImage(
+  raw: string,
+): Promise<RemoteImageResult> {
+  const firstTarget = parseProxyableImageUrl(raw);
+  if (!firstTarget) return { ok: false, reason: "unsupported-url" };
+  let target: URL = firstTarget;
+
+  for (let hop = 0; hop <= MAX_PROXY_REDIRECTS; hop++) {
+    let response: HopResult;
+    try {
+      response = await requestHop(target);
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException)?.code;
+      return {
+        ok: false,
+        reason: code === "EBLOCKED" ? "blocked-address" : "fetch-failed",
+      };
+    }
+
+    if (response.status >= 300 && response.status < 400) {
+      response.discard();
+      const location = response.headers.location;
+      const next: URL | null = location
+        ? parseProxyableImageUrl(new URL(location, target).href)
+        : null;
+      if (!next) return { ok: false, reason: "fetch-failed" };
+      target = next;
+      continue;
+    }
+
+    if (response.status < 200 || response.status >= 300) {
+      response.discard();
+      return { ok: false, reason: "fetch-failed" };
+    }
+
+    const contentType = String(response.headers["content-type"] ?? "");
+    if (!contentType.startsWith("image/")) {
+      response.discard();
+      return { ok: false, reason: "not-an-image" };
+    }
+
+    const declared = Number(response.headers["content-length"]);
+    if (Number.isFinite(declared) && declared > MAX_PROXIED_IMAGE_BYTES) {
+      response.discard();
+      return { ok: false, reason: "too-large" };
+    }
+
+    let body: Buffer | "too-large";
+    try {
+      body = await response.read();
+    } catch {
+      // coercion-ok: a truncated transfer has no partial-success form here;
+      // the caller answers 502 either way.
+      return { ok: false, reason: "fetch-failed" };
+    }
+    if (body === "too-large") return { ok: false, reason: "too-large" };
+
+    return { ok: true, contentType, body };
+  }
+
+  return { ok: false, reason: "too-many-redirects" };
+}

package/corpus/templates/slides/server/lib/image-proxy-url.ts

@@ -0,0 +1,192 @@
+import net from "node:net";
+
+/**
+ * Hostnames that never belong to a legitimate slide image but are classic
+ * SSRF targets. Cloud metadata endpoints resolve to a link-local address
+ * that `isPrivateAddress` already rejects; they are listed here so the
+ * request is refused before a DNS query is issued.
+ */
+const BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata",
+]);
+
+const BLOCKED_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa"];
+
+/** Largest image we are willing to buffer and hand back to the browser. */
+export const MAX_PROXIED_IMAGE_BYTES = 15 * 1024 * 1024;
+
+/** Redirect hops to follow. Each hop is re-validated before it is fetched. */
+export const MAX_PROXY_REDIRECTS = 3;
+
+/**
+ * Whether an IP literal points somewhere inside our own infrastructure.
+ * Anything unroutable, loopback, link-local, or RFC1918 is refused, as is
+ * any address we cannot parse — unknown means unsafe here.
+ */
+export function isPrivateAddress(address: string): boolean {
+  const version = net.isIP(address);
+
+  if (version === 4) {
+    const parts = address.split(".").map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => Number.isNaN(part))) {
+      return true;
+    }
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    if (a >= 224) return true;
+    return false;
+  }
+
+  if (version === 6) {
+    // Classify on the expanded hextets, never on the text. `::ffff:127.0.0.1`
+    // and `::ffff:7f00:1` are the same address, and a prefix-matching check
+    // sees only the first.
+    const hextets = expandIpv6(address);
+    if (!hextets) return true;
+
+    const embedsIpv4 =
+      hextets.slice(0, 5).every((part) => part === 0) &&
+      (hextets[5] === 0xffff || hextets[5] === 0);
+    if (embedsIpv4 && (hextets[6] !== 0 || hextets[7] !== 0)) {
+      const ipv4 = [
+        hextets[6] >> 8,
+        hextets[6] & 0xff,
+        hextets[7] >> 8,
+        hextets[7] & 0xff,
+      ].join(".");
+      return isPrivateAddress(ipv4);
+    }
+
+    // Unspecified (::) and loopback (::1).
+    if (hextets.every((part) => part === 0)) return true;
+    if (hextets.slice(0, 7).every((part) => part === 0) && hextets[7] === 1) {
+      return true;
+    }
+    // Unique-local fc00::/7, link-local fe80::/10, multicast ff00::/8.
+    if ((hextets[0] & 0xfe00) === 0xfc00) return true;
+    if ((hextets[0] & 0xffc0) === 0xfe80) return true;
+    if ((hextets[0] & 0xff00) === 0xff00) return true;
+    // NAT64 well-known prefix 64:ff9b::/96 tunnels an IPv4 destination.
+    if (hextets[0] === 0x0064 && hextets[1] === 0xff9b) {
+      const ipv4 = [
+        hextets[6] >> 8,
+        hextets[6] & 0xff,
+        hextets[7] >> 8,
+        hextets[7] & 0xff,
+      ].join(".");
+      return isPrivateAddress(ipv4);
+    }
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * Expand any textual IPv6 form into its 8 hextets, including `::` elision and
+ * a dotted IPv4 tail. Returns null when the input is not parseable.
+ */
+export function expandIpv6(address: string): number[] | null {
+  // Zone indices ("fe80::1%eth0") are routing hints, not part of the address.
+  const bare = address.toLowerCase().split("%")[0];
+  if (!bare) return null;
+
+  let head = bare;
+  let tail = "";
+  const elision = bare.indexOf("::");
+  if (elision !== -1) {
+    head = bare.slice(0, elision);
+    tail = bare.slice(elision + 2);
+  }
+
+  const parseGroups = (segment: string): string[] =>
+    segment.length === 0 ? [] : segment.split(":");
+
+  const headGroups = parseGroups(head);
+  const tailGroups = parseGroups(tail);
+  const all = [...headGroups, ...tailGroups];
+
+  // A dotted IPv4 tail occupies the final two hextets.
+  const last = all[all.length - 1];
+  let ipv4Tail: number[] | null = null;
+  if (last?.includes(".")) {
+    if (net.isIP(last) !== 4) return null;
+    const octets = last.split(".").map((part) => Number(part));
+    if (
+      octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)
+    )
+      return null;
+    ipv4Tail = [(octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]];
+    if (tailGroups.length > 0) tailGroups.pop();
+    else headGroups.pop();
+  }
+
+  const toHextets = (groups: string[]): number[] | null => {
+    const out: number[] = [];
+    for (const group of groups) {
+      if (!/^[0-9a-f]{1,4}$/.test(group)) return null;
+      out.push(parseInt(group, 16));
+    }
+    return out;
+  };
+
+  const headParts = toHextets(headGroups);
+  const tailParts = toHextets(tailGroups);
+  if (!headParts || !tailParts) return null;
+
+  const explicit = [...headParts, ...tailParts, ...(ipv4Tail ? ipv4Tail : [])]
+    .length;
+  if (explicit > 8) return null;
+
+  if (elision === -1) {
+    if (explicit !== 8) return null;
+    return [...headParts, ...(ipv4Tail ?? [])];
+  }
+
+  const fill = new Array(8 - explicit).fill(0) as number[];
+  return [...headParts, ...fill, ...tailParts, ...(ipv4Tail ?? [])];
+}
+
+/**
+ * Parse a caller-supplied image URL, refusing anything that is not a plain
+ * public http(s) resource. Returns null rather than throwing so callers can
+ * answer with a single 400.
+ */
+export function parseProxyableImageUrl(raw: string): URL | null {
+  if (!raw) return null;
+
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    // coercion-ok: null is this function's documented "refused" result and
+    // the caller answers 400; an unparseable URL carries no other detail.
+    return null;
+  }
+
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  // Credentials in the URL would be replayed by the server on the user's
+  // behalf against a host they may not control.
+  if (url.username || url.password) return null;
+
+  const host = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (!host) return null;
+  if (BLOCKED_HOSTNAMES.has(host)) return null;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix))) return null;
+
+  const literal = host.startsWith("[") ? host.slice(1, -1) : host;
+  if (net.isIP(literal) && isPrivateAddress(literal)) return null;
+
+  return url;
+}
+
+// A hostname is no longer validated here before fetching. Resolving once for
+// the check and again for the connection let a DNS-rebinding host answer
+// differently each time, so the address check now lives in the socket's
+// `lookup` — see `publicOnlyLookup` in fetch-remote-image.ts.

package/corpus/templates/slides/server/routes/api/image-proxy.get.ts

@@ -0,0 +1,65 @@
+import { getSession } from "@agent-native/core/server";
+import { defineEventHandler, getQuery, setResponseStatus } from "h3";
+
+import {
+  fetchRemoteImage,
+  type RemoteImageFailure,
+} from "../../lib/fetch-remote-image.js";
+
+/**
+ * Re-serve a remote image from our own origin.
+ *
+ * PDF/PPTX export rasterizes the slide DOM through a canvas, and the browser
+ * blanks out any image whose host does not send `Access-Control-Allow-Origin`.
+ * No client-side flag can override that, so images on hosts without CORS have
+ * to come back through us to be same-origin.
+ *
+ * This is an authenticated, image-only, size-capped fetcher — not a general
+ * proxy. See `fetch-remote-image.ts` for the address pinning that keeps it
+ * from being turned into an SSRF primitive.
+ */
+const FAILURE_STATUS: Record<RemoteImageFailure, number> = {
+  "unsupported-url": 400,
+  "blocked-address": 400,
+  "fetch-failed": 502,
+  "too-many-redirects": 502,
+  "not-an-image": 415,
+  "too-large": 413,
+};
+
+const FAILURE_MESSAGE: Record<RemoteImageFailure, string> = {
+  "unsupported-url": "Unsupported image URL",
+  "blocked-address": "Unsupported image URL",
+  "fetch-failed": "Could not fetch image",
+  "too-many-redirects": "Too many redirects",
+  "not-an-image": "Not an image",
+  "too-large": "Image too large",
+};
+
+export default defineEventHandler(async (event) => {
+  const session = await getSession(event);
+  if (!session?.email) {
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
+  }
+
+  const raw = getQuery(event).url;
+  if (typeof raw !== "string") {
+    setResponseStatus(event, 400);
+    return { error: "Missing url" };
+  }
+
+  const result = await fetchRemoteImage(raw);
+  if (!result.ok) {
+    setResponseStatus(event, FAILURE_STATUS[result.reason]);
+    return { error: FAILURE_MESSAGE[result.reason] };
+  }
+
+  event.node?.res?.setHeader("Content-Type", result.contentType);
+  event.node?.res?.setHeader("Content-Length", String(result.body.byteLength));
+  event.node?.res?.setHeader("Cache-Control", "private, max-age=3600");
+  // The canvas reads these pixels back, so the response must be explicitly
+  // usable cross-origin even though it is served from our own host.
+  event.node?.res?.setHeader("Access-Control-Allow-Origin", "*");
+  return result.body;
+});

package/dist/client/progress/RunsTray.js

@@ -9,6 +9,15 @@ import { useChangeVersion } from "../use-change-version.js";
 import { usePollLoop } from "../use-poll-loop.js";
 import { cn } from "../utils.js";
 const RUN_CHANGE_SETTLE_MS = 250;
+/**
+ * Cadence used while a run still reads as active, even for hosts that opted
+ * out of idle polling with `pollMs={0}`. Those hosts only refresh on mount and
+ * on a `runs` change event, and a run abandoned mid-flight (budget exhausted,
+ * dead worker) emits neither — so the spinner has no path back to a terminal
+ * status. Polling only while something looks active keeps the idle cost at
+ * zero and still lets the server's stale sweep terminalize the row.
+ */
+const ACTIVE_RUN_POLL_MS = 5000;
 function useRunsTrayState({ pollMs = 3000, limit = 5, hideWhenIdle = true, showRecent, }) {
     const t = useT();
     const [runs, setRuns] = useState([]);
@@ -39,7 +48,11 @@ function useRunsTrayState({ pollMs = 3000, limit = 5, hideWhenIdle = true, showR
         const timeout = window.setTimeout(() => void refresh(), RUN_CHANGE_SETTLE_MS);
         return () => window.clearTimeout(timeout);
     }, [refresh, runsVersion]);
-    usePollLoop(refresh, { intervalMs: pollMs, enabled: pollMs > 0 });
+    const hasActiveRun = runs.some((run) => run.status === "running");
+    usePollLoop(refresh, {
+        intervalMs: pollMs > 0 ? pollMs : ACTIVE_RUN_POLL_MS,
+        enabled: pollMs > 0 || hasActiveRun,
+    });
     const dismissRun = useCallback(async (runId) => {
         setRuns((current) => current.filter((run) => run.id !== runId));
         try {

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.149.0",
+  "version": "0.149.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {