@asterxsk/kiln 0.4.0 → 0.4.2

package/agent/extensions/pi-web-access/SECURITY.md

@@ -1,5 +1,5 @@
-# Security Policy
-
-Please report suspected vulnerabilities through GitHub private vulnerability reporting for this repository. Do not post exploit details, secrets, or proof-of-concept payloads in public issues or pull requests.
-
-If private vulnerability reporting is unavailable for your account or this repository, open a minimal public issue asking for a private contact path without including technical details.
+# Security Policy
+
+Please report suspected vulnerabilities through GitHub private vulnerability reporting for this repository. Do not post exploit details, secrets, or proof-of-concept payloads in public issues or pull requests.
+
+If private vulnerability reporting is unavailable for your account or this repository, open a minimal public issue asking for a private contact path without including technical details.

package/agent/extensions/pi-web-access/activity.ts

@@ -1,101 +1,101 @@
-// Types
-export interface ActivityEntry {
-	id: string;
-	type: "api" | "fetch";
-	startTime: number;
-	endTime?: number;
-
-	// For API calls
-	query?: string;
-
-	// For URL fetches
-	url?: string;
-
-	// Result - status is number (HTTP code) or null (pending/network error)
-	status: number | null;
-	error?: string;
-}
-
-export interface RateLimitInfo {
-	used: number;
-	max: number;
-	oldestTimestamp: number | null;
-	windowMs: number;
-}
-
-export class ActivityMonitor {
-	private entries: ActivityEntry[] = [];
-	private readonly maxEntries = 10;
-	private listeners = new Set<() => void>();
-	private rateLimitInfo: RateLimitInfo = { used: 0, max: 10, oldestTimestamp: null, windowMs: 60000 };
-	private nextId = 1;
-
-	logStart(partial: Omit<ActivityEntry, "id" | "startTime" | "status">): string {
-		const id = `act-${this.nextId++}`;
-		const entry: ActivityEntry = {
-			...partial,
-			id,
-			startTime: Date.now(),
-			status: null,
-		};
-		this.entries.push(entry);
-		if (this.entries.length > this.maxEntries) {
-			this.entries.shift();
-		}
-		this.notify();
-		return id;
-	}
-
-	logComplete(id: string, status: number): void {
-		const entry = this.entries.find((e) => e.id === id);
-		if (entry) {
-			entry.endTime = Date.now();
-			entry.status = status;
-			this.notify();
-		}
-	}
-
-	logError(id: string, error: string): void {
-		const entry = this.entries.find((e) => e.id === id);
-		if (entry) {
-			entry.endTime = Date.now();
-			entry.error = error;
-			this.notify();
-		}
-	}
-
-	getEntries(): readonly ActivityEntry[] {
-		return this.entries;
-	}
-
-	getRateLimitInfo(): RateLimitInfo {
-		return this.rateLimitInfo;
-	}
-
-	updateRateLimit(info: RateLimitInfo): void {
-		this.rateLimitInfo = info;
-		this.notify();
-	}
-
-	onUpdate(callback: () => void): () => void {
-		this.listeners.add(callback);
-		return () => this.listeners.delete(callback);
-	}
-
-	clear(): void {
-		this.entries = [];
-		this.rateLimitInfo = { used: 0, max: 10, oldestTimestamp: null, windowMs: 60000 };
-		this.notify();
-	}
-
-	private notify(): void {
-		for (const cb of this.listeners) {
-			try {
-				cb();
-			} catch {
-			}
-		}
-	}
-}
-
-export const activityMonitor = new ActivityMonitor();
+// Types
+export interface ActivityEntry {
+	id: string;
+	type: "api" | "fetch";
+	startTime: number;
+	endTime?: number;
+
+	// For API calls
+	query?: string;
+
+	// For URL fetches
+	url?: string;
+
+	// Result - status is number (HTTP code) or null (pending/network error)
+	status: number | null;
+	error?: string;
+}
+
+export interface RateLimitInfo {
+	used: number;
+	max: number;
+	oldestTimestamp: number | null;
+	windowMs: number;
+}
+
+export class ActivityMonitor {
+	private entries: ActivityEntry[] = [];
+	private readonly maxEntries = 10;
+	private listeners = new Set<() => void>();
+	private rateLimitInfo: RateLimitInfo = { used: 0, max: 10, oldestTimestamp: null, windowMs: 60000 };
+	private nextId = 1;
+
+	logStart(partial: Omit<ActivityEntry, "id" | "startTime" | "status">): string {
+		const id = `act-${this.nextId++}`;
+		const entry: ActivityEntry = {
+			...partial,
+			id,
+			startTime: Date.now(),
+			status: null,
+		};
+		this.entries.push(entry);
+		if (this.entries.length > this.maxEntries) {
+			this.entries.shift();
+		}
+		this.notify();
+		return id;
+	}
+
+	logComplete(id: string, status: number): void {
+		const entry = this.entries.find((e) => e.id === id);
+		if (entry) {
+			entry.endTime = Date.now();
+			entry.status = status;
+			this.notify();
+		}
+	}
+
+	logError(id: string, error: string): void {
+		const entry = this.entries.find((e) => e.id === id);
+		if (entry) {
+			entry.endTime = Date.now();
+			entry.error = error;
+			this.notify();
+		}
+	}
+
+	getEntries(): readonly ActivityEntry[] {
+		return this.entries;
+	}
+
+	getRateLimitInfo(): RateLimitInfo {
+		return this.rateLimitInfo;
+	}
+
+	updateRateLimit(info: RateLimitInfo): void {
+		this.rateLimitInfo = info;
+		this.notify();
+	}
+
+	onUpdate(callback: () => void): () => void {
+		this.listeners.add(callback);
+		return () => this.listeners.delete(callback);
+	}
+
+	clear(): void {
+		this.entries = [];
+		this.rateLimitInfo = { used: 0, max: 10, oldestTimestamp: null, windowMs: 60000 };
+		this.notify();
+	}
+
+	private notify(): void {
+		for (const cb of this.listeners) {
+			try {
+				cb();
+			} catch {
+			}
+		}
+	}
+}
+
+export const activityMonitor = new ActivityMonitor();

package/agent/extensions/pi-web-access/auth-fetch.ts

@@ -1,148 +1,148 @@
-import { existsSync, readFileSync } from "node:fs";
-import { getWebSearchConfigPath } from "./utils.ts";
-
-const WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();
-const AUTH_PROFILE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
-
-export type AuthFetchRequest = true | string;
-export type AuthFetchCache = "session" | "off";
-
-export interface AuthFetchProfile {
-	name: string;
-	hosts: string[];
-	chromeProfile?: string;
-	redirects: "same-origin";
-	cache: AuthFetchCache;
-}
-
-interface AuthFetchConfigRoot {
-	authFetch?: unknown;
-}
-
-export function resolveAuthFetchProfile(request: AuthFetchRequest): AuthFetchProfile {
-	const profiles = loadAuthFetchProfiles();
-	if (profiles.length === 0) {
-		throw new Error(`auth requires at least one authFetch profile in ${WEB_SEARCH_CONFIG_PATH}`);
-	}
-	if (request === true) {
-		if (profiles.length !== 1) {
-			throw new Error("auth: true requires exactly one authFetch profile; use a profile name instead");
-		}
-		return profiles[0];
-	}
-	const name = request.trim();
-	const profile = profiles.find(candidate => candidate.name === name);
-	if (!profile) throw new Error(`Unknown authFetch profile: ${name}`);
-	return profile;
-}
-
-export function assertAuthFetchUrl(profile: AuthFetchProfile, rawUrl: string): URL {
-	let url: URL;
-	try {
-		url = new URL(rawUrl);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`Authenticated fetch requires an HTTPS URL: ${message}`);
-	}
-	if (url.protocol !== "https:") throw new Error("Authenticated fetch requires an HTTPS URL");
-	const hostname = normalizeHostname(url.hostname);
-	if (!profile.hosts.some(host => hostMatches(hostname, host))) {
-		throw new Error(`URL host ${hostname} is not allowed by authFetch profile ${profile.name}`);
-	}
-	return url;
-}
-
-export function authFetchRedirectGuard(profile: AuthFetchProfile, from: URL, to: URL): void {
-	if (profile.redirects === "same-origin" && to.origin !== from.origin) {
-		throw new Error(`Authenticated fetch refused cross-origin redirect: ${from.origin} -> ${to.origin}`);
-	}
-}
-
-function loadAuthFetchProfiles(): AuthFetchProfile[] {
-	if (!existsSync(WEB_SEARCH_CONFIG_PATH)) return [];
-	const raw = readFileSync(WEB_SEARCH_CONFIG_PATH, "utf-8");
-	let parsed: AuthFetchConfigRoot;
-	try {
-		const value: unknown = JSON.parse(raw);
-		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected a JSON object");
-		parsed = value as AuthFetchConfigRoot;
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);
-	}
-	if (parsed.authFetch === undefined || parsed.authFetch === null) return [];
-	if (typeof parsed.authFetch !== "object" || Array.isArray(parsed.authFetch)) {
-		throw new Error(`authFetch in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
-	}
-	return Object.entries(parsed.authFetch as Record<string, unknown>).map(([name, value]) => parseProfile(name, value));
-}
-
-function parseProfile(name: string, value: unknown): AuthFetchProfile {
-	if (!AUTH_PROFILE_NAME_PATTERN.test(name)) {
-		throw new Error(`authFetch profile name ${JSON.stringify(name)} must start with a letter and contain only letters, numbers, underscores, or hyphens`);
-	}
-	if (Array.isArray(value)) {
-		return { name, hosts: parseHosts(value, `authFetch.${name}`), redirects: "same-origin", cache: "session" };
-	}
-	if (!value || typeof value !== "object") {
-		throw new Error(`authFetch.${name} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hosts or an object`);
-	}
-	const config = value as Record<string, unknown>;
-	if (!Array.isArray(config.hosts)) {
-		throw new Error(`authFetch.${name}.hosts in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
-	}
-	const redirects = config.redirects ?? "same-origin";
-	if (redirects !== "same-origin") {
-		throw new Error(`authFetch.${name}.redirects in ${WEB_SEARCH_CONFIG_PATH} must be "same-origin"`);
-	}
-	const cache = config.cache ?? "session";
-	if (cache !== "session" && cache !== "off") {
-		throw new Error(`authFetch.${name}.cache in ${WEB_SEARCH_CONFIG_PATH} must be "session" or "off"`);
-	}
-	const chromeProfile = parseChromeProfile(config.chromeProfile, `authFetch.${name}.chromeProfile`);
-	return {
-		name,
-		hosts: parseHosts(config.hosts, `authFetch.${name}.hosts`),
-		...(chromeProfile ? { chromeProfile } : {}),
-		redirects,
-		cache,
-	};
-}
-
-function parseHosts(value: unknown[], label: string): string[] {
-	if (value.length === 0) throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
-	const hosts = value.map((entry) => {
-		if (typeof entry !== "string") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames`);
-		return parseHost(entry, label);
-	});
-	return [...new Set(hosts)];
-}
-
-function parseHost(value: string, label: string): string {
-	const host = normalizeHostname(value.trim());
-	if (!host || host.startsWith(".") || host.endsWith(".") || /\s|[\\/?:#@*]/.test(host)) {
-		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
-	}
-	if (host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(host)) {
-		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
-	}
-	return host;
-}
-
-function parseChromeProfile(value: unknown, label: string): string | undefined {
-	if (value === undefined || value === null) return undefined;
-	if (typeof value !== "string") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a string`);
-	const normalized = value.trim();
-	if (!normalized || normalized === "." || normalized === ".." || normalized.includes("/") || normalized.includes("\\")) {
-		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a profile directory name, not a path`);
-	}
-	return normalized;
-}
-
-function normalizeHostname(hostname: string): string {
-	return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
-}
-
-function hostMatches(hostname: string, allowedHost: string): boolean {
-	return hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);
-}
+import { existsSync, readFileSync } from "node:fs";
+import { getWebSearchConfigPath } from "./utils.ts";
+
+const WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();
+const AUTH_PROFILE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+
+export type AuthFetchRequest = true | string;
+export type AuthFetchCache = "session" | "off";
+
+export interface AuthFetchProfile {
+	name: string;
+	hosts: string[];
+	chromeProfile?: string;
+	redirects: "same-origin";
+	cache: AuthFetchCache;
+}
+
+interface AuthFetchConfigRoot {
+	authFetch?: unknown;
+}
+
+export function resolveAuthFetchProfile(request: AuthFetchRequest): AuthFetchProfile {
+	const profiles = loadAuthFetchProfiles();
+	if (profiles.length === 0) {
+		throw new Error(`auth requires at least one authFetch profile in ${WEB_SEARCH_CONFIG_PATH}`);
+	}
+	if (request === true) {
+		if (profiles.length !== 1) {
+			throw new Error("auth: true requires exactly one authFetch profile; use a profile name instead");
+		}
+		return profiles[0];
+	}
+	const name = request.trim();
+	const profile = profiles.find(candidate => candidate.name === name);
+	if (!profile) throw new Error(`Unknown authFetch profile: ${name}`);
+	return profile;
+}
+
+export function assertAuthFetchUrl(profile: AuthFetchProfile, rawUrl: string): URL {
+	let url: URL;
+	try {
+		url = new URL(rawUrl);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Authenticated fetch requires an HTTPS URL: ${message}`);
+	}
+	if (url.protocol !== "https:") throw new Error("Authenticated fetch requires an HTTPS URL");
+	const hostname = normalizeHostname(url.hostname);
+	if (!profile.hosts.some(host => hostMatches(hostname, host))) {
+		throw new Error(`URL host ${hostname} is not allowed by authFetch profile ${profile.name}`);
+	}
+	return url;
+}
+
+export function authFetchRedirectGuard(profile: AuthFetchProfile, from: URL, to: URL): void {
+	if (profile.redirects === "same-origin" && to.origin !== from.origin) {
+		throw new Error(`Authenticated fetch refused cross-origin redirect: ${from.origin} -> ${to.origin}`);
+	}
+}
+
+function loadAuthFetchProfiles(): AuthFetchProfile[] {
+	if (!existsSync(WEB_SEARCH_CONFIG_PATH)) return [];
+	const raw = readFileSync(WEB_SEARCH_CONFIG_PATH, "utf-8");
+	let parsed: AuthFetchConfigRoot;
+	try {
+		const value: unknown = JSON.parse(raw);
+		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected a JSON object");
+		parsed = value as AuthFetchConfigRoot;
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);
+	}
+	if (parsed.authFetch === undefined || parsed.authFetch === null) return [];
+	if (typeof parsed.authFetch !== "object" || Array.isArray(parsed.authFetch)) {
+		throw new Error(`authFetch in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+	}
+	return Object.entries(parsed.authFetch as Record<string, unknown>).map(([name, value]) => parseProfile(name, value));
+}
+
+function parseProfile(name: string, value: unknown): AuthFetchProfile {
+	if (!AUTH_PROFILE_NAME_PATTERN.test(name)) {
+		throw new Error(`authFetch profile name ${JSON.stringify(name)} must start with a letter and contain only letters, numbers, underscores, or hyphens`);
+	}
+	if (Array.isArray(value)) {
+		return { name, hosts: parseHosts(value, `authFetch.${name}`), redirects: "same-origin", cache: "session" };
+	}
+	if (!value || typeof value !== "object") {
+		throw new Error(`authFetch.${name} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hosts or an object`);
+	}
+	const config = value as Record<string, unknown>;
+	if (!Array.isArray(config.hosts)) {
+		throw new Error(`authFetch.${name}.hosts in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+	}
+	const redirects = config.redirects ?? "same-origin";
+	if (redirects !== "same-origin") {
+		throw new Error(`authFetch.${name}.redirects in ${WEB_SEARCH_CONFIG_PATH} must be "same-origin"`);
+	}
+	const cache = config.cache ?? "session";
+	if (cache !== "session" && cache !== "off") {
+		throw new Error(`authFetch.${name}.cache in ${WEB_SEARCH_CONFIG_PATH} must be "session" or "off"`);
+	}
+	const chromeProfile = parseChromeProfile(config.chromeProfile, `authFetch.${name}.chromeProfile`);
+	return {
+		name,
+		hosts: parseHosts(config.hosts, `authFetch.${name}.hosts`),
+		...(chromeProfile ? { chromeProfile } : {}),
+		redirects,
+		cache,
+	};
+}
+
+function parseHosts(value: unknown[], label: string): string[] {
+	if (value.length === 0) throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+	const hosts = value.map((entry) => {
+		if (typeof entry !== "string") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames`);
+		return parseHost(entry, label);
+	});
+	return [...new Set(hosts)];
+}
+
+function parseHost(value: string, label: string): string {
+	const host = normalizeHostname(value.trim());
+	if (!host || host.startsWith(".") || host.endsWith(".") || /\s|[\\/?:#@*]/.test(host)) {
+		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+	}
+	if (host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(host)) {
+		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+	}
+	return host;
+}
+
+function parseChromeProfile(value: unknown, label: string): string | undefined {
+	if (value === undefined || value === null) return undefined;
+	if (typeof value !== "string") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a string`);
+	const normalized = value.trim();
+	if (!normalized || normalized === "." || normalized === ".." || normalized.includes("/") || normalized.includes("\\")) {
+		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a profile directory name, not a path`);
+	}
+	return normalized;
+}
+
+function normalizeHostname(hostname: string): string {
+	return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+
+function hostMatches(hostname: string, allowedHost: string): boolean {
+	return hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);
+}