@agentsean/adapter-cloudflare 1.0.4 → 1.0.6

package/dist/rewrite.d.ts

@@ -3,14 +3,25 @@ export type Overlay = {
     metaDescription?: string | undefined;
 };
 export type OverlayMap = Record<string, Overlay>;
-/**
- * Identical HTML for every visitor. The worker must never read User-Agent,
- * bot signals, or crawler class. That is cloaking under Google's spam policies
- * (page last updated 2026-08-28).
- */
 export declare function rewriteHtml(html: string, overlay: Overlay | undefined): string;
 export declare function overlayFor(url: string, map: OverlayMap): Overlay | undefined;
 export declare function assertWorkerIsNotCloaking(source: string): void;
-/** Worker module text shipped to Cloudflare. No UA inspection. */
-export declare const WORKER_SOURCE = "\nexport default {\n  async fetch(request, env) {\n    const url = new URL(request.url);\n    const originResp = await fetch(request);\n    const contentType = originResp.headers.get(\"content-type\") || \"\";\n    if (!contentType.includes(\"text/html\")) return originResp;\n    const html = await originResp.text();\n    const key = url.origin + (url.pathname.replace(/\\/+$/, \"\") || \"/\");\n    const raw = await env.SEAN_OVERLAY.get(key);\n    if (!raw) {\n      return new Response(html, originResp);\n    }\n    const overlay = JSON.parse(raw);\n    let out = html;\n    if (overlay.title) {\n      if (/<title[^>]*>[\\s\\S]*?<\\/title>/i.test(out)) {\n        out = out.replace(/<title[^>]*>[\\s\\S]*?<\\/title>/i, \"<title>\" + overlay.title + \"</title>\");\n      }\n    }\n    const headers = new Headers(originResp.headers);\n    return new Response(out, { status: originResp.status, headers });\n  }\n};\n";
+/**
+ * Worker module text shipped to Cloudflare. No UA inspection.
+ *
+ * This runs on every request to the customer's site, outside the daemon and
+ * outside the action validator — so anything it does has to be safe on its own
+ * terms. Two properties it must keep:
+ *
+ *  1. It escapes what it injects. It previously did
+ *     `"<title>" + overlay.title + "</title>"`, so a title containing
+ *     `</title><script>` would have injected script into every page served
+ *     through the overlay. The overlay value is operator-set, not
+ *     crawler-derived, but a rewriter that trusts its input is one bad KV write
+ *     away from persistent XSS on the customer's site.
+ *  2. The title regex is linear — negated-close inner plus a `|$` fallback —
+ *     matching the hardening in `@agentsean/actions`. A stall here is a stall
+ *     in front of the customer's whole site.
+ */
+export declare const WORKER_SOURCE = "\nconst TITLE_EL = /<title\\b[^>]*>(?:[^<]|<(?!\\/title[\\s>]))*(?:<\\/title[^>]*>|$)/i;\n\nfunction escapeHtml(value) {\n  return String(value)\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nexport default {\n  async fetch(request, env) {\n    const url = new URL(request.url);\n    const originResp = await fetch(request);\n    const contentType = originResp.headers.get(\"content-type\") || \"\";\n    if (!contentType.includes(\"text/html\")) return originResp;\n    const html = await originResp.text();\n    const key = url.origin + (url.pathname.replace(/\\/+$/, \"\") || \"/\");\n    const raw = await env.SEAN_OVERLAY.get(key);\n    if (!raw) {\n      return new Response(html, originResp);\n    }\n    const overlay = JSON.parse(raw);\n    let out = html;\n    if (overlay.title && TITLE_EL.test(out)) {\n      out = out.replace(TITLE_EL, \"<title>\" + escapeHtml(overlay.title) + \"</title>\");\n    }\n    const headers = new Headers(originResp.headers);\n    return new Response(out, { status: originResp.status, headers });\n  }\n};\n";
 //# sourceMappingURL=rewrite.d.ts.map

package/dist/rewrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../src/rewrite.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAkB9E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAI5E;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiB9D;AAED,kEAAkE;AAClE,eAAO,MAAM,aAAa,+5BAwBzB,CAAC"}
+{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../src/rewrite.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BjD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAiB9E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAI5E;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiB9D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,inCAgCzB,CAAC"}

package/dist/rewrite.js

@@ -1,9 +1,27 @@
-import { patchHtmlTitle } from "@agentsean/actions";
+import { findMetaByName, findOpenTag, patchHtmlTitle } from "@agentsean/actions";
 /**
  * Identical HTML for every visitor. The worker must never read User-Agent,
  * bot signals, or crawler class. That is cloaking under Google's spam policies
  * (page last updated 2026-08-28).
  */
+/**
+ * Escape a value being written into a double-quoted HTML attribute.
+ *
+ * `patchHtmlTitle` has always escaped what it injects; this file did not, and
+ * interpolated `overlay.metaDescription` straight into `content="..."`. A
+ * description containing a double quote closes the attribute early and
+ * everything after it becomes markup — on every page served through the edge
+ * overlay. The overlay is operator-set rather than crawler-derived, so this is
+ * defence in depth rather than a live exploit, but the writer is the right
+ * place to guarantee it.
+ */
+function escapeAttribute(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
 export function rewriteHtml(html, overlay) {
     if (!overlay)
         return html;
@@ -11,11 +29,17 @@ export function rewriteHtml(html, overlay) {
     if (overlay.title)
         out = patchHtmlTitle(out, overlay.title);
     if (overlay.metaDescription) {
-        if (/<meta\s+name=["']description["'][^>]*>/i.test(out)) {
-            out = out.replace(/<meta\s+name=["']description["'][^>]*>/i, `<meta name="description" content="${overlay.metaDescription}">`);
+        const tag = `<meta name="description" content="${escapeAttribute(overlay.metaDescription)}">`;
+        // Forward scans rather than regexes — the regex forms were O(n^2) on
+        // hostile input (18.5s and 9.9s measured). See @agentsean/actions/tagscan.
+        const existing = findMetaByName(out, "description");
+        if (existing) {
+            out = out.slice(0, existing.start) + tag + out.slice(existing.end);
         }
-        else if (/<head[^>]*>/i.test(out)) {
-            out = out.replace(/<head[^>]*>/i, (h) => `${h}<meta name="description" content="${overlay.metaDescription}">`);
+        else {
+            const head = findOpenTag(out, "head");
+            if (head)
+                out = out.slice(0, head.end) + tag + out.slice(head.end);
         }
     }
     return out;
@@ -41,8 +65,34 @@ export function assertWorkerIsNotCloaking(source) {
         }
     }
 }
-/** Worker module text shipped to Cloudflare. No UA inspection. */
+/**
+ * Worker module text shipped to Cloudflare. No UA inspection.
+ *
+ * This runs on every request to the customer's site, outside the daemon and
+ * outside the action validator — so anything it does has to be safe on its own
+ * terms. Two properties it must keep:
+ *
+ *  1. It escapes what it injects. It previously did
+ *     `"<title>" + overlay.title + "</title>"`, so a title containing
+ *     `</title><script>` would have injected script into every page served
+ *     through the overlay. The overlay value is operator-set, not
+ *     crawler-derived, but a rewriter that trusts its input is one bad KV write
+ *     away from persistent XSS on the customer's site.
+ *  2. The title regex is linear — negated-close inner plus a `|$` fallback —
+ *     matching the hardening in `@agentsean/actions`. A stall here is a stall
+ *     in front of the customer's whole site.
+ */
 export const WORKER_SOURCE = `
+const TITLE_EL = /<title\\b[^>]*>(?:[^<]|<(?!\\/title[\\s>]))*(?:<\\/title[^>]*>|$)/i;
+
+function escapeHtml(value) {
+  return String(value)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
@@ -57,10 +107,8 @@ export default {
     }
     const overlay = JSON.parse(raw);
     let out = html;
-    if (overlay.title) {
-      if (/<title[^>]*>[\\s\\S]*?<\\/title>/i.test(out)) {
-        out = out.replace(/<title[^>]*>[\\s\\S]*?<\\/title>/i, "<title>" + overlay.title + "</title>");
-      }
+    if (overlay.title && TITLE_EL.test(out)) {
+      out = out.replace(TITLE_EL, "<title>" + escapeHtml(overlay.title) + "</title>");
     }
     const headers = new Headers(originResp.headers);
     return new Response(out, { status: originResp.status, headers });

package/dist/rewrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../src/rewrite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AASpD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAA4B;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,OAAO,CAAC,KAAK;QAAE,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,yCAAyC,EACzC,qCAAqC,OAAO,CAAC,eAAe,IAAI,CACjE,CAAC;QACJ,CAAC;aAAM,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,cAAc,EACd,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,qCAAqC,OAAO,CAAC,eAAe,IAAI,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAe;IACrD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;IAClE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,MAAM,GAAG;QACb,aAAa;QACb,WAAW;QACX,YAAY;QACZ,OAAO;QACP,YAAY;QACZ,YAAY;QACZ,eAAe;KAChB,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,8BAA8B,EAAE,yEAAyE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB5B,CAAC"}
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../src/rewrite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AASjF;;;;GAIG;AACH;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAA4B;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,OAAO,CAAC,KAAK;QAAE,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,qCAAqC,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;QAC9F,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,IAAI;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAe;IACrD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;IAClE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,MAAM,GAAG;QACb,aAAa;QACb,WAAW;QACX,YAAY;QACZ,OAAO;QACP,YAAY;QACZ,YAAY;QACZ,eAAe;KAChB,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,8BAA8B,EAAE,yEAAyE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsean/adapter-cloudflare",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "license": "AGPL-3.0-only",
   "type": "module",
   "exports": {
@@ -16,7 +16,7 @@
     "node": ">=22.19.0"
   },
   "dependencies": {
-    "@agentsean/actions": "1.0.4"
+    "@agentsean/actions": "1.0.6"
   },
   "devDependencies": {
     "typescript": "~5.9.3",