@app-vitals/agent-admin 0.0.1 → 0.1.0

package/src/attachment-validation.unit.test.ts

@@ -0,0 +1,218 @@
+/**
+ * admin/src/attachment-validation.unit.test.ts
+ *
+ * Unit tests for pure attachment validation logic — no I/O.
+ */
+
+import { describe, expect, it } from "bun:test";
+import {
+  audioContentTypeForFilename,
+  isAudioFilename,
+  MAX_ATTACHMENT_BYTES,
+  validateAttachment,
+} from "./attachment-validation.ts";
+
+describe("validateAttachment", () => {
+  it("accepts a text/plain file under 10 MB", () => {
+    const result = validateAttachment("notes.txt", 1024, "text/plain");
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.filename).toBe("notes.txt");
+      expect(result.size).toBe(1024);
+    }
+  });
+
+  it("accepts an image/png under the limit", () => {
+    const result = validateAttachment("pic.png", 500_000, "image/png");
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts an application/pdf file", () => {
+    const result = validateAttachment("doc.pdf", 2_000_000, "application/pdf");
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts a file exactly at the size limit", () => {
+    const result = validateAttachment(
+      "big.txt",
+      MAX_ATTACHMENT_BYTES,
+      "text/plain",
+    );
+    expect(result.ok).toBe(true);
+  });
+
+  it("rejects a file over 10 MB with status 413", () => {
+    const result = validateAttachment(
+      "huge.txt",
+      MAX_ATTACHMENT_BYTES + 1,
+      "text/plain",
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(413);
+      expect(result.error).toBeTruthy();
+    }
+  });
+
+  it("rejects a disallowed MIME type like video/mp4 with status 415", () => {
+    const result = validateAttachment("clip.mp4", 1024, "video/mp4");
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(415);
+      expect(result.error).toBeTruthy();
+    }
+  });
+
+  it("rejects application/x-executable with status 415", () => {
+    const result = validateAttachment(
+      "run.bin",
+      1024,
+      "application/x-executable",
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(415);
+    }
+  });
+
+  // CFB-3.1: picking an *existing* photo from an iPhone photo library (not the
+  // camera) can hand the browser a HEIC/HEIF file — these were previously
+  // missing from the allowlist and got a hard 415 rejection.
+  it("accepts an image/heic file under the limit", () => {
+    const result = validateAttachment("photo.heic", 2_000_000, "image/heic");
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts an image/heif file under the limit", () => {
+    const result = validateAttachment("photo.heif", 2_000_000, "image/heif");
+    expect(result.ok).toBe(true);
+  });
+
+  it("rejects application/octet-stream with status 415", () => {
+    const result = validateAttachment(
+      "unknown.bin",
+      1024,
+      "application/octet-stream",
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(415);
+    }
+  });
+
+  it("rejects an empty-string MIME type with status 415", () => {
+    const result = validateAttachment("unknown", 1024, "");
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(415);
+    }
+  });
+
+  // VM-3.1: mic-recorded blobs go through the same upload path as file
+  // attachments, so MediaRecorder's actual output MIME types must be allowed.
+  it("accepts audio/webm (MediaRecorder default in some browsers)", () => {
+    const result = validateAttachment("recording.webm", 1024, "audio/webm");
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts audio/webm;codecs=opus (MediaRecorder's Chrome/Firefox default)", () => {
+    const result = validateAttachment(
+      "recording.webm",
+      1024,
+      "audio/webm;codecs=opus",
+    );
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts audio/ogg (MediaRecorder's Firefox alternative)", () => {
+    const result = validateAttachment("recording.ogg", 1024, "audio/ogg");
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts video/webm;codecs=opus and video/webm for a .webm filename (Chromium audio-only recordings)", () => {
+    expect(
+      validateAttachment("recording.webm", 1024, "video/webm;codecs=opus").ok,
+    ).toBe(true);
+    expect(validateAttachment("recording.webm", 1024, "video/webm").ok).toBe(
+      true,
+    );
+  });
+
+  it("rejects video/webm with a non-.webm filename", () => {
+    const result = validateAttachment("clip.mp4", 1024, "video/webm");
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(415);
+    }
+  });
+
+  it("accepts audio/mp4, audio/mpeg and audio/wav", () => {
+    expect(validateAttachment("recording.m4a", 1024, "audio/mp4").ok).toBe(
+      true,
+    );
+    expect(validateAttachment("a.mp3", 1024, "audio/mpeg").ok).toBe(true);
+    expect(validateAttachment("a.wav", 1024, "audio/wav").ok).toBe(true);
+  });
+
+  it("strips MIME parameters and case before matching", () => {
+    expect(
+      validateAttachment("a.m4a", 1024, "Audio/MP4;codecs=mp4a.40.2").ok,
+    ).toBe(true);
+    expect(
+      validateAttachment("a.txt", 1024, "TEXT/Plain; charset=utf-8").ok,
+    ).toBe(true);
+  });
+
+  it("still rejects an unrelated audio type not in the allowlist", () => {
+    const result = validateAttachment("clip.aac", 1024, "audio/aac");
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(415);
+    }
+  });
+});
+
+describe("isAudioFilename", () => {
+  it("returns true for MediaRecorder output extensions (.webm, .ogg)", () => {
+    expect(isAudioFilename("recording-123.webm")).toBe(true);
+    expect(isAudioFilename("recording-123.ogg")).toBe(true);
+  });
+
+  it("returns true for TTS output extensions (.wav, .mp3) — VM-2.1 assistant replies", () => {
+    expect(isAudioFilename("1700000000000-response.wav")).toBe(true);
+    expect(isAudioFilename("1700000000000-response.mp3")).toBe(true);
+  });
+
+  it("is case-insensitive", () => {
+    expect(isAudioFilename("Recording.WEBM")).toBe(true);
+  });
+
+  it("returns false for non-audio filenames", () => {
+    expect(isAudioFilename("notes.txt")).toBe(false);
+    expect(isAudioFilename("photo.png")).toBe(false);
+    expect(isAudioFilename("doc.pdf")).toBe(false);
+  });
+
+  it("returns false for null/undefined/empty filenames without throwing", () => {
+    expect(isAudioFilename(null)).toBe(false);
+    expect(isAudioFilename(undefined)).toBe(false);
+    expect(isAudioFilename("")).toBe(false);
+  });
+});
+
+describe("audioContentTypeForFilename", () => {
+  it("maps each recognized audio extension to a real audio/* Content-Type", () => {
+    expect(audioContentTypeForFilename("a.webm")).toBe("audio/webm");
+    expect(audioContentTypeForFilename("a.ogg")).toBe("audio/ogg");
+    expect(audioContentTypeForFilename("a.wav")).toBe("audio/wav");
+    expect(audioContentTypeForFilename("a.mp3")).toBe("audio/mpeg");
+    expect(audioContentTypeForFilename("x.m4a")).toBe("audio/mp4");
+    expect(isAudioFilename("x.m4a")).toBe(true);
+  });
+
+  it("returns null for a non-audio or missing filename", () => {
+    expect(audioContentTypeForFilename("notes.txt")).toBeNull();
+    expect(audioContentTypeForFilename(null)).toBeNull();
+    expect(audioContentTypeForFilename(undefined)).toBeNull();
+  });
+});

package/src/caller-scope.ts

@@ -0,0 +1,131 @@
+/**
+ * admin/src/caller-scope.ts
+ *
+ * Single resolver for "which agents may this caller see/act on" (SSP-2.1),
+ * shared by the admin UI (assertAgentAccess, resolveAccessibleAgents), the
+ * session-visibility helpers and the JSON API auth middleware.
+ *
+ * Resolved per request from the caller's email — the account is deliberately
+ * NOT stored in the session JWT, so membership changes take effect
+ * immediately. Account membership contributes agents only when the self-serve
+ * flag is on; with it off the scope is exactly the AgentMember-only scope.
+ */
+
+import type { AccountService } from "./accounts.ts";
+import type { AgentMemberService } from "./agent-members.ts";
+
+export type CallerScope =
+  | { kind: "all" }
+  | { kind: "scoped"; accountId: string | null; agentIds: string[] };
+
+interface CallerScopeInput {
+  email: string;
+  isAdmin: boolean;
+  flagEnabled: boolean;
+}
+
+/** I/O boundary of the resolver — injected so the logic stays unit-testable. */
+export interface CallerScopeDeps {
+  /** Account the email belongs to, or null. */
+  getAccountIdByEmail(email: string): Promise<string | null>;
+  /** Ids of every agent whose accountId matches. */
+  listAgentIdsByAccount(accountId: string): Promise<string[]>;
+  /** Ids of agents the email holds an AgentMember row for. */
+  listMemberAgentIds(email: string): Promise<string[]>;
+}
+
+export async function resolveCallerScope(
+  input: CallerScopeInput,
+  deps: CallerScopeDeps,
+): Promise<CallerScope> {
+  if (input.isAdmin) return { kind: "all" };
+  const email = input.email.toLowerCase();
+
+  const accountId = input.flagEnabled
+    ? await deps.getAccountIdByEmail(email)
+    : null;
+  const [accountAgentIds, memberAgentIds] = await Promise.all([
+    accountId ? deps.listAgentIdsByAccount(accountId) : [],
+    deps.listMemberAgentIds(email),
+  ]);
+  return {
+    kind: "scoped",
+    accountId,
+    agentIds: [...new Set([...accountAgentIds, ...memberAgentIds])],
+  };
+}
+
+export function scopeIncludesAgent(
+  scope: CallerScope,
+  agentId: string,
+): boolean {
+  return scope.kind === "all" || scope.agentIds.includes(agentId);
+}
+
+/**
+ * How a caller may read the admin UI's task-store views — Tasks, PRs and
+ * Sessions (SSP-6.8). Platform admins see every account; an account user
+ * (self-serve flag on, so the resolver produced an accountId) sees exactly
+ * their account, filtered server-side via the task-store's `?accountId=`;
+ * anyone else keeps today's admin-only gate.
+ */
+export type TaskStoreViewScope =
+  | { kind: "all" }
+  | { kind: "account"; accountId: string; agentIds: string[] }
+  | { kind: "none" };
+
+export function taskStoreViewScope(scope: CallerScope): TaskStoreViewScope {
+  if (scope.kind === "all") return { kind: "all" };
+  if (scope.accountId === null) return { kind: "none" };
+  return {
+    kind: "account",
+    accountId: scope.accountId,
+    agentIds: scope.agentIds,
+  };
+}
+
+/** Per-request resolver with the flag already bound. */
+export type CallerScopeResolver = (
+  email: string,
+  isAdmin: boolean,
+) => Promise<CallerScope>;
+
+export function createCallerScopeResolver(
+  deps: CallerScopeDeps,
+  flagEnabled: boolean,
+): CallerScopeResolver {
+  return (email, isAdmin) =>
+    resolveCallerScope({ email, isAdmin, flagEnabled }, deps);
+}
+
+/** Wire the resolver's I/O to the real services. */
+export function callerScopeDepsFromServices(services: {
+  accountService: Pick<AccountService, "getByMemberEmail" | "listAgentIds">;
+  agentMemberService: Pick<AgentMemberService, "listByEmail">;
+}): CallerScopeDeps {
+  return {
+    getAccountIdByEmail: async (email) =>
+      (await services.accountService.getByMemberEmail(email))?.id ?? null,
+    listAgentIdsByAccount: (accountId) =>
+      services.accountService.listAgentIds(accountId),
+    listMemberAgentIds: async (email) =>
+      (await services.agentMemberService.listByEmail(email)).map(
+        (m) => m.agentId,
+      ),
+  };
+}
+
+/** Flag-off resolver backed only by AgentMember rows (today's behavior). */
+export function memberOnlyCallerScopeResolver(
+  agentMemberService: Pick<AgentMemberService, "listByEmail">,
+): CallerScopeResolver {
+  return createCallerScopeResolver(
+    {
+      getAccountIdByEmail: async () => null,
+      listAgentIdsByAccount: async () => [],
+      listMemberAgentIds: async (email) =>
+        (await agentMemberService.listByEmail(email)).map((m) => m.agentId),
+    },
+    false,
+  );
+}

package/src/caller-scope.unit.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it } from "bun:test";
+import {
+  type CallerScope,
+  type CallerScopeDeps,
+  resolveCallerScope,
+  scopeIncludesAgent,
+  taskStoreViewScope,
+} from "./caller-scope.ts";
+
+function makeDeps(opts: {
+  account?: Record<string, string>;
+  accountAgents?: Record<string, string[]>;
+  members?: Record<string, string[]>;
+}): CallerScopeDeps {
+  return {
+    getAccountIdByEmail: async (e) => opts.account?.[e] ?? null,
+    listAgentIdsByAccount: async (id) => opts.accountAgents?.[id] ?? [],
+    listMemberAgentIds: async (e) => opts.members?.[e] ?? [],
+  };
+}
+
+const deps = makeDeps({
+  account: { "a@x.com": "acct-a", "both@x.com": "acct-a" },
+  accountAgents: { "acct-a": ["ag-1", "ag-2"] },
+  members: { "m@x.com": ["ag-9"], "both@x.com": ["ag-2", "ag-9"] },
+});
+
+const run = (email: string, isAdmin = false, flagEnabled = true) =>
+  resolveCallerScope({ email, isAdmin, flagEnabled }, deps);
+
+describe("resolveCallerScope", () => {
+  it("returns all for admins", async () => {
+    expect(await run("a@x.com", true)).toEqual({ kind: "all" });
+  });
+
+  it("account member gets every account agent", async () => {
+    expect(await run("a@x.com")).toEqual({
+      kind: "scoped",
+      accountId: "acct-a",
+      agentIds: ["ag-1", "ag-2"],
+    });
+  });
+
+  it("explicit member gets only AgentMember agents", async () => {
+    expect(await run("m@x.com")).toEqual({
+      kind: "scoped",
+      accountId: null,
+      agentIds: ["ag-9"],
+    });
+  });
+
+  it("account + explicit membership is unioned and deduplicated", async () => {
+    const scope = await run("BOTH@x.com");
+    expect(scope.kind === "scoped" && scope.agentIds.sort()).toEqual([
+      "ag-1",
+      "ag-2",
+      "ag-9",
+    ]);
+  });
+
+  it("caller with neither gets an empty scope", async () => {
+    expect(await run("none@x.com")).toEqual({
+      kind: "scoped",
+      accountId: null,
+      agentIds: [],
+    });
+  });
+
+  it("flag off: account membership contributes nothing", async () => {
+    expect(await run("both@x.com", false, false)).toEqual({
+      kind: "scoped",
+      accountId: null,
+      agentIds: ["ag-2", "ag-9"],
+    });
+    expect(await run("a@x.com", false, false)).toEqual({
+      kind: "scoped",
+      accountId: null,
+      agentIds: [],
+    });
+  });
+});
+
+describe("scopeIncludesAgent", () => {
+  it("all includes anything; scoped only listed ids", () => {
+    expect(scopeIncludesAgent({ kind: "all" }, "x")).toBe(true);
+    const s: CallerScope = {
+      kind: "scoped",
+      accountId: null,
+      agentIds: ["a"],
+    };
+    expect(scopeIncludesAgent(s, "a")).toBe(true);
+    expect(scopeIncludesAgent(s, "b")).toBe(false);
+  });
+});
+
+describe("taskStoreViewScope (SSP-6.8)", () => {
+  it("platform admins see every account", () => {
+    expect(taskStoreViewScope({ kind: "all" })).toEqual({ kind: "all" });
+  });
+
+  it("an account user is narrowed to their account, keeping their agent ids", () => {
+    expect(
+      taskStoreViewScope({
+        kind: "scoped",
+        accountId: "acct-a",
+        agentIds: ["a1"],
+      }),
+    ).toEqual({ kind: "account", accountId: "acct-a", agentIds: ["a1"] });
+  });
+
+  it("a caller with no account (flag off, or no membership) gets no task-store views", () => {
+    expect(
+      taskStoreViewScope({ kind: "scoped", accountId: null, agentIds: ["a1"] }),
+    ).toEqual({ kind: "none" });
+  });
+});

package/src/chat-credential-config.ts

@@ -0,0 +1,22 @@
+/**
+ * admin/src/chat-credential-config.ts
+ *
+ * Pure parser for the chat-credential mint flag. Takes an injected env object
+ * (no process.env reads) so it is deterministically unit-testable; admin-boot
+ * reads it once at startup and injects the resolved config as deps. Same
+ * "enabled" convention as the self-serve flag (self-serve-config.ts).
+ */
+
+/** Structural env shape — accepts `process.env` or a plain test object. */
+type ChatCredentialEnv = Readonly<Record<string, string | undefined>>;
+
+export interface ChatCredentialConfig {
+  /** True only when SHIPWRIGHT_CHAT_TOKEN_MINT_ENABLED === "enabled". */
+  enabled: boolean;
+}
+
+export function parseChatCredentialConfig(
+  env: ChatCredentialEnv,
+): ChatCredentialConfig {
+  return { enabled: env.SHIPWRIGHT_CHAT_TOKEN_MINT_ENABLED === "enabled" };
+}

package/src/chat-credentials-logging.unit.test.ts

@@ -0,0 +1,92 @@
+/**
+ * Log-capture test for the chat-credentials routes (COS-32.1): the raw token
+ * must never reach a log line, and each mint/revoke emits one structured line.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, spyOn } from "bun:test";
+import {
+  type AdminDeps,
+  createAdminApp,
+  parseAdminApiKeys,
+} from "./agents-api.ts";
+
+const RAW = "ct_super_secret_raw_token_value";
+
+function makeApp() {
+  const deps = {
+    agentService: { exists: async () => true },
+    agentTokenService: { validate: async () => null },
+    agentMemberService: { listByEmail: async () => [] },
+    adminApiKeys: parseAdminApiKeys("root:admin-key:*"),
+    sessionSecret: "s".repeat(32),
+    chatCredentialsEnabled: true,
+    chatCredentials: {
+      mintToken: async () => ({ id: "tok-1", rawToken: RAW }),
+      revokeToken: async () => {},
+      listTokensForAgent: async () => [{ id: "tok-1", label: "lbl" }],
+    },
+  } as unknown as AdminDeps;
+  return createAdminApp(deps);
+}
+
+describe("chat-credentials logging", () => {
+  let lines: string[];
+  const spies: Array<{ mockRestore: () => void }> = [];
+  beforeEach(() => {
+    lines = [];
+    for (const m of ["log", "info", "warn", "error"] as const) {
+      spies.push(
+        spyOn(console, m).mockImplementation((...a: unknown[]) => {
+          lines.push(a.map(String).join(" "));
+        }),
+      );
+    }
+  });
+  afterEach(() => {
+    for (const s of spies.splice(0)) s.mockRestore();
+  });
+
+  const req = (
+    app: ReturnType<typeof makeApp>,
+    method: string,
+    path: string,
+    body?: unknown,
+  ) =>
+    app.request(path, {
+      method,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: "Bearer admin-key",
+      },
+    });
+
+  it("mint and revoke each log one structured line without the raw token", async () => {
+    const app = makeApp();
+    const minted = await req(app, "POST", "/agents/a1/chat-credentials", {
+      label: "lbl",
+    });
+    expect(minted.status).toBe(201);
+    expect(((await minted.json()) as { rawToken: string }).rawToken).toBe(RAW);
+    expect(
+      (await req(app, "DELETE", "/agents/a1/chat-credentials/tok-1")).status,
+    ).toBe(204);
+
+    const events = lines
+      .filter((l) => l.startsWith("{"))
+      .map((l) => JSON.parse(l) as Record<string, unknown>);
+    expect(events.map((e) => e.event)).toEqual([
+      "chat-credential.mint",
+      "chat-credential.revoke",
+    ]);
+    for (const e of events) {
+      expect(e).toMatchObject({
+        agentId: "a1",
+        tokenId: "tok-1",
+        label: "lbl",
+      });
+      expect(typeof e.callerLabel).toBe("string");
+    }
+    expect(lines.join("\n")).not.toContain(RAW);
+  });
+});

package/src/chat-markers.ts

@@ -0,0 +1,114 @@
+/**
+ * admin/src/chat-markers.ts
+ *
+ * Marker parsing for chat message display in admin UI.
+ * Strips response markers from displayed text and extracts URLs/paths for rendering.
+ *
+ * Supported markers:
+ *   [silent]                        — stripped (Slack-only)
+ *   [upload:/path/to/file]          — path extracted for artifact badge
+ *   [speak:text]                    — stripped (Slack-only)
+ *   [react:emoji1,emoji2]           — stripped (Slack-only)
+ *   [plan:url]                      — URL extracted for link badge
+ *
+ * Note: This is a separate implementation from agent/src/runtime/markers.ts because
+ * admin and agent are separate workspace packages with no cross-imports.
+ */
+
+interface ParseChatMarkersResult {
+  /** Message body with all markers removed. */
+  cleaned: string;
+  /** Extracted upload file paths (in order of occurrence). */
+  uploads: string[];
+  /** Extracted plan URLs (in order of occurrence). */
+  planUrls: string[];
+}
+
+// Regex patterns — greedy non-nested matching.
+const SILENT_REGEX = /\[silent\]\s*$/i;
+const UPLOAD_REGEX = /\[upload:([^\]]+)\]/gi;
+const SPEAK_REGEX = /\[speak:([\s\S]*?)\]/gi;
+const REACT_REGEX = /\[react:([^\]]+)\]/gi;
+const PLAN_REGEX = /\[plan:([^\]]+)\]/gi;
+
+/**
+ * Parse response markers from assistant chat message text.
+ * Returns the cleaned text (all markers stripped) and arrays of extracted URLs/paths.
+ *
+ * @param text - the raw message body potentially containing markers
+ * @returns cleaned text, upload paths, and plan URLs (all in order of occurrence)
+ */
+export function parseChatMarkers(text: string): ParseChatMarkersResult {
+  const uploads: string[] = [];
+  const planUrls: string[] = [];
+  let cleaned = text;
+
+  // [silent]
+  if (SILENT_REGEX.test(cleaned)) {
+    cleaned = cleaned.replace(SILENT_REGEX, "").trim();
+  }
+
+  // [upload:/path]
+  cleaned = cleaned.replace(UPLOAD_REGEX, (_match, pathRaw: string) => {
+    const path = pathRaw.trim();
+    // Note: UPLOAD_REGEX uses [^\]]+ (one-or-more), so `path` is never empty here.
+    // This guard is unreachable but kept for defensive consistency.
+    if (!path) {
+      return _match;
+    }
+    uploads.push(path);
+    return "";
+  });
+  UPLOAD_REGEX.lastIndex = 0;
+  cleaned = cleaned.trim();
+
+  // [speak:text] — Slack-only, strip silently
+  // Note: SPEAK_REGEX uses [\s\S]*? (zero-or-more), so `text` can be empty — this guard is reachable.
+  cleaned = cleaned.replace(SPEAK_REGEX, (_match, textRaw: string) => {
+    const text = textRaw.trim();
+    if (!text) {
+      // Malformed: empty speak text. Leave in text.
+      return _match;
+    }
+    return "";
+  });
+  SPEAK_REGEX.lastIndex = 0;
+  cleaned = cleaned.trim();
+
+  // [react:emoji1,emoji2,...] — Slack-only, strip silently
+  // Note: REACT_REGEX uses [^\]]+ (one-or-more), so `raw` is never empty; after split+filter,
+  // emojis.length === 0 is unreachable. Guard kept for defensive consistency.
+  cleaned = cleaned.replace(REACT_REGEX, (_match, raw: string) => {
+    const emojis = raw
+      .split(",")
+      .map((e) => e.trim())
+      .filter(Boolean);
+    if (emojis.length === 0) {
+      return _match;
+    }
+    return "";
+  });
+  REACT_REGEX.lastIndex = 0;
+  cleaned = cleaned.trim();
+
+  // [plan:url]
+  // Note: PLAN_REGEX uses [^\]]+ (one-or-more), so `url` is never empty here.
+  // Guard kept for defensive consistency. Also filter non-http(s) schemes (e.g. javascript:)
+  // as defense-in-depth against injection via agent-generated messages.
+  cleaned = cleaned.replace(PLAN_REGEX, (_match, urlRaw: string) => {
+    const url = urlRaw.trim();
+    if (!url) {
+      return _match;
+    }
+    if (!url.startsWith("http://") && !url.startsWith("https://")) {
+      // Non-http scheme (e.g. javascript:). Leave in text rather than rendering as a link.
+      return _match;
+    }
+    planUrls.push(url);
+    return "";
+  });
+  PLAN_REGEX.lastIndex = 0;
+  cleaned = cleaned.trim();
+
+  return { cleaned, uploads, planUrls };
+}