@aitne/daemon 0.1.0

package/dist/services/attachments/sanitize.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Filename sanitization + MIME allowlist for chat attachments.
+ *
+ * Pure module — no I/O, trivially unit-testable.
+ */
+/**
+ * Derive a safe on-disk filename from a user-provided one. Strips path
+ * separators, null bytes, control chars, and `..` segments; NFC-normalizes;
+ * trims to 255 chars; falls back to `attachment-<id>.<ext>` on empty.
+ *
+ * The resulting name is constrained to `[A-Za-z0-9._-]` — any other code
+ * point becomes `_`. The original filename is kept in the DB for display
+ * (`original_filename`); this function only produces the disk-safe mirror.
+ */
+export declare function deriveSafeFilename(original: string, id: string): string;
+export declare function normalizeMimeType(mime: string | null | undefined): string | null;
+export declare function isAllowedMime(mime: string): boolean;
+/** SVG is served only as a download (Content-Disposition: attachment) — it
+ *  can carry scripts, so it is never rendered inline in Phase 1. */
+export declare function requiresDownloadDisposition(mime: string): boolean;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/services/attachments/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/services/attachments/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CA2BvE;AAuED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;oEACoE;AACpE,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjE"}

package/dist/services/attachments/sanitize.js

@@ -0,0 +1,128 @@
+/**
+ * Filename sanitization + MIME allowlist for chat attachments.
+ *
+ * Pure module — no I/O, trivially unit-testable.
+ */
+/**
+ * Derive a safe on-disk filename from a user-provided one. Strips path
+ * separators, null bytes, control chars, and `..` segments; NFC-normalizes;
+ * trims to 255 chars; falls back to `attachment-<id>.<ext>` on empty.
+ *
+ * The resulting name is constrained to `[A-Za-z0-9._-]` — any other code
+ * point becomes `_`. The original filename is kept in the DB for display
+ * (`original_filename`); this function only produces the disk-safe mirror.
+ */
+export function deriveSafeFilename(original, id) {
+    // `?? ""` is defensive against HTTP callers that hand us a null filename
+    // (multipart uploads where `info.filename` is undefined) even though the
+    // declared type is `string`.
+    const stripped = (original ?? "")
+        .normalize("NFC")
+        // Drop null + control characters.
+        .replace(/[\x00-\x1f\x7f]/g, "")
+        // Collapse path separators.
+        .replace(/[\\/]+/g, "_")
+        // `..` path traversal segments.
+        .replace(/\.\.+/g, "_")
+        // Leading dots (hidden files) — allow a single leading dot only.
+        .replace(/^\.+(?=.)/, "_")
+        .trim();
+    const safeBody = stripped.replace(/[^A-Za-z0-9._-]/g, "_");
+    if (!safeBody || safeBody === "_" || safeBody === ".") {
+        // When sanitization erased every structural byte, the original can't
+        // have survived with a usable extension either (every path that reaches
+        // this branch either had no `.ext` to begin with, or the leading-dot
+        // rule already rewrote it away). Always fall back to `.bin`.
+        return `attachment-${id}.bin`;
+    }
+    return safeBody.length > 255 ? safeBody.slice(safeBody.length - 255) : safeBody;
+}
+/**
+ * Chat attachment MIME allowlist. Executables and archives are rejected
+ * outright (see §Security in the design doc). Audio/video are accepted as
+ * opaque files: they are staged into the session workdir and named in the
+ * prompt, but only image attachments get native multimodal argv treatment.
+ */
+const ALLOWED_MIME_TYPES = new Set([
+    // images
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+    "image/heic",
+    "image/heif",
+    "image/svg+xml",
+    // audio
+    "audio/aac",
+    "audio/amr",
+    "audio/flac",
+    "audio/m4a",
+    "audio/mp4",
+    "audio/mpeg",
+    "audio/ogg",
+    "audio/opus",
+    "audio/vnd.wave",
+    "audio/wav",
+    "audio/webm",
+    "audio/x-m4a",
+    "audio/x-wav",
+    // video
+    "video/3gp",
+    "video/3gpp",
+    "video/mp4",
+    "video/mpeg",
+    "video/ogg",
+    "video/quicktime",
+    "video/webm",
+    // generic media containers surfaced by some MIME detectors / clients
+    "application/mp4",
+    "application/ogg",
+    // docs
+    "application/pdf",
+    "application/msword",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    "application/vnd.ms-excel",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    "application/vnd.ms-powerpoint",
+    "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    "application/vnd.oasis.opendocument.text",
+    // text + data
+    "text/plain",
+    "text/markdown",
+    "text/csv",
+    "text/html",
+    "text/xml",
+    "application/json",
+    "application/xml",
+    "application/x-yaml",
+    "text/yaml",
+    // common source-code types surfaced by file-type / standard tables
+    "text/x-python",
+    "text/x-java-source",
+    "text/x-c",
+    "text/x-c++",
+    "text/javascript",
+    "application/javascript",
+    "application/typescript",
+]);
+export function normalizeMimeType(mime) {
+    const normalized = mime?.split(";")[0]?.trim().toLowerCase();
+    return normalized || null;
+}
+export function isAllowedMime(mime) {
+    const normalized = normalizeMimeType(mime);
+    return normalized !== null && ALLOWED_MIME_TYPES.has(normalized);
+}
+/** SVG is served only as a download (Content-Disposition: attachment) — it
+ *  can carry scripts, so it is never rendered inline in Phase 1. */
+export function requiresDownloadDisposition(mime) {
+    const lower = normalizeMimeType(mime) ?? "";
+    if (lower === "image/svg+xml")
+        return true;
+    if (lower.startsWith("image/"))
+        return false;
+    if (lower === "application/pdf")
+        return false;
+    return true;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/services/attachments/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/services/attachments/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,yEAAyE;IACzE,yEAAyE;IACzE,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC9B,SAAS,CAAC,KAAK,CAAC;QACjB,kCAAkC;SACjC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAChC,4BAA4B;SAC3B,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;QACxB,gCAAgC;SAC/B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvB,iEAAiE;SAChE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,IAAI,EAAE,CAAC;IAEV,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAE3D,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACtD,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,6DAA6D;QAC7D,OAAO,cAAc,EAAE,MAAM,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,SAAS;IACT,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,YAAY;IACZ,aAAa;IACb,aAAa;IACb,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,YAAY;IACZ,qEAAqE;IACrE,iBAAiB;IACjB,iBAAiB;IACjB,OAAO;IACP,iBAAiB;IACjB,oBAAoB;IACpB,yEAAyE;IACzE,0BAA0B;IAC1B,mEAAmE;IACnE,+BAA+B;IAC/B,2EAA2E;IAC3E,yCAAyC;IACzC,cAAc;IACd,YAAY;IACZ,eAAe;IACf,UAAU;IACV,WAAW;IACX,UAAU;IACV,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,WAAW;IACX,mEAAmE;IACnE,eAAe;IACf,oBAAoB;IACpB,UAAU;IACV,YAAY;IACZ,iBAAiB;IACjB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,UAAU,KAAK,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACnE,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/attachments/store.d.ts

@@ -0,0 +1,146 @@
+import type { Readable } from "node:stream";
+import type Database from "better-sqlite3";
+export type AttachmentDirection = "inbound" | "outbound";
+export type AttachmentProvenance = "user_dashboard" | "user_slack" | "user_telegram" | "user_discord" | "user_whatsapp" | "agent";
+export interface StoreAttachmentRow {
+    id: string;
+    sessionId: number | null;
+    messageId: number | null;
+    direction: AttachmentDirection;
+    provenance: AttachmentProvenance;
+    path: string;
+    originalFilename: string;
+    safeFilename: string;
+    mimeType: string;
+    sizeBytes: number;
+    turnToken: string | null;
+    caption: string | null;
+    createdAt: string;
+}
+export interface IngestStreamParams {
+    stream: Readable;
+    declaredMimeType: string | null;
+    originalFilename: string;
+    direction: AttachmentDirection;
+    provenance: AttachmentProvenance;
+    caption?: string;
+    /** Outbound-only: per-turn token issued by the dispatcher. Required when
+     *  `direction === "outbound"` and `provenance === "agent"`. */
+    turnToken?: string;
+    /** Per-file size cap in bytes. Enforced during streaming so an
+     *  overflowing client upload is cut off before the disk fills up. */
+    maxSizeBytes: number;
+}
+export interface IngestResult {
+    id: string;
+    path: string;
+    originalFilename: string;
+    safeFilename: string;
+    mimeType: string;
+    sizeBytes: number;
+    caption?: string;
+}
+export declare class IngestRejectedError extends Error {
+    readonly reason: "too_large" | "empty" | "disallowed_mime" | "undetected_mime";
+    constructor(reason: "too_large" | "empty" | "disallowed_mime" | "undetected_mime", message: string);
+}
+/**
+ * AttachmentStore — canonical on-disk store + SQLite row manager for chat
+ * file attachments.
+ *
+ * Files live at `<dataDir>/attachments/<id>/<safeFilename>`. Writes are
+ * atomic (tmp file → rename) and append-only; rows are deleted together
+ * with their on-disk dir at session end / orphan reap / outbound
+ * collection failure.
+ */
+export declare class AttachmentStore {
+    private readonly db;
+    private readonly rootDir;
+    constructor(db: Database.Database, dataDir: string);
+    /** Absolute path to the directory that contains this attachment's bytes. */
+    dirFor(id: string): string;
+    /**
+     * Stream incoming bytes to disk, verify MIME via magic bytes, and
+     * persist a `chat_attachments` row. Throws `IngestRejectedError` on
+     * size overflow, disallowed/undetected MIME, or empty body.
+     */
+    ingestStream(params: IngestStreamParams): Promise<IngestResult>;
+    get(id: string): StoreAttachmentRow | null;
+    /**
+     * Delete a still-unbound attachment (no message_id). Used by the
+     * DELETE endpoint and the orphan reaper. Safe no-op if the row is
+     * already gone.
+     */
+    deleteIfUnbound(id: string): boolean;
+    /**
+     * Bind a batch of inbound attachment rows to a session + message
+     * inside a single transaction. Rows that don't exist or are already
+     * bound are skipped; the caller receives the list that was actually
+     * bound.
+     */
+    bindInbound(params: {
+        attachmentIds: string[];
+        sessionId: number;
+        messageId: number;
+    }): StoreAttachmentRow[];
+    listInboundForMessage(messageId: number): StoreAttachmentRow[];
+    listOutboundForMessage(messageId: number): StoreAttachmentRow[];
+    listForMessage(messageId: number): StoreAttachmentRow[];
+    /**
+     * Collect outbound rows produced during the current turn and clear
+     * the token so they can't leak into a later turn. Returns the rows
+     * in creation order.
+     */
+    collectOutboundForTurn(params: {
+        turnToken: string;
+        sessionId: number;
+    }): StoreAttachmentRow[];
+    /** Release a turn token without collecting — used on turn failure. Any
+     *  attachments the agent posted get swept into the orphan reaper path. */
+    releaseTurnToken(turnToken: string): void;
+    /**
+     * Bind a single outbound attachment to the assistant message row that
+     * was just recorded for this turn. Called after the dispatcher records
+     * the assistant message in `messages` and the adapter has delivered
+     * the file to the user.
+     */
+    bindOutboundToMessage(attachmentId: string, messageId: number): void;
+    /**
+     * Delete inbound orphans (no message_id) older than `maxAgeHours`.
+     * Run once on daemon startup. Outbound orphans are rarer (a turn
+     * that crashed between generation and collection) and swept the same
+     * way.
+     */
+    reapOrphans(maxAgeHours?: number): {
+        inbound: number;
+        outbound: number;
+    };
+    /**
+     * Delete attachment rows whose bound message no longer exists, plus their
+     * on-disk directories. In production the FK normally removes these rows when
+     * messages are pruned, but this is the recovery path for older databases,
+     * tests with FK disabled, or a failed cascade.
+     */
+    reapDanglingMessageRefs(): number;
+    /**
+     * Remove physical attachment directories that no longer have a DB row. This
+     * catches the normal retention path where `messages` deletion cascades the
+     * `chat_attachments` row before the filesystem can be cleaned. Fresh
+     * directories are skipped so an in-flight ingest cannot be mistaken for an
+     * orphan before its row is inserted.
+     */
+    reapUntrackedDirs(options?: {
+        minAgeHours?: number;
+    }): number;
+    /**
+     * Hard-link (or copy across volumes) an attachment into the session's
+     * `_attachments/` subdir. Idempotent; safe to call per dispatch.
+     */
+    stageIntoWorkdir(params: {
+        row: StoreAttachmentRow;
+        sessionDir: string;
+    }): string;
+    private safeRmTree;
+    private waitForWriteStreamSettled;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/services/attachments/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/services/attachments/store.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAgB3C,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,YAAY,GACZ,eAAe,GACf,cAAc,GACd,eAAe,GACf,OAAO,CAAC;AAEZ,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,oBAAoB,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAoCD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;mEAC+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;yEACqE;IACrE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,MAAM,EAClB,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,iBAAiB;gBAJL,MAAM,EAClB,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,iBAAiB,EACrB,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGd,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACtC,OAAO,EAAE,MAAM;IAMjB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM;IAI1B;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwLrE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAO1C;;;;OAIG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IASpC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE;QAClB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,kBAAkB,EAAE;IA4BxB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAW9D,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAW/D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAUvD;;;;OAIG;IACH,sBAAsB,CAAC,MAAM,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,kBAAkB,EAAE;IAsBxB;8EAC0E;IAC1E,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMzC;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAUpE;;;;;OAKG;IACH,WAAW,CAAC,WAAW,SAAK,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAuBpE;;;;;OAKG;IACH,uBAAuB,IAAI,MAAM;IAuBjC;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IAkCjE;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE;QACvB,GAAG,EAAE,kBAAkB,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,MAAM;IAaV,OAAO,CAAC,UAAU;YAeJ,yBAAyB;CAwBxC"}