npm - @automagik/omni - Versions diffs - 2.260624.3 → 2.260624.4 - Mend

@automagik/omni 2.260624.3 → 2.260624.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.js CHANGED Viewed

@@ -125004,7 +125004,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260624.3",
+  version: "2.260624.4",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js CHANGED Viewed

@@ -225291,7 +225291,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260624.3",
+    version: "2.260624.4",
     type: "module",
     exports: {
       ".": {
@@ -332957,6 +332957,62 @@ var init_batch_pricing = __esm(() => {
 // ../api/src/services/media-storage.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname6, extname as extname2, join as join21, relative as relative2 } from "path";
+function normalizeMimeType2(value) {
+  return value?.split(";")[0]?.trim().toLowerCase() || undefined;
+}
+function isHtmlMime2(value) {
+  const mimeType = normalizeMimeType2(value);
+  return mimeType === "text/html" || mimeType === "application/xhtml+xml";
+}
+function looksLikeHtml2(buffer3) {
+  const preview = buffer3.subarray(0, 512).toString("utf8").trimStart().toLowerCase();
+  return preview.startsWith("<!doctype html") || preview.startsWith("<html>") || preview.startsWith("<html ");
+}
+function shouldRejectHtmlMedia(expectedMimeType, responseMimeType, buffer3) {
+  const expected = normalizeMimeType2(expectedMimeType);
+  if (!expected || isHtmlMime2(expected))
+    return false;
+  return isHtmlMime2(responseMimeType) || looksLikeHtml2(buffer3);
+}
+function hostMatchesSuffix2(hostname3, suffix) {
+  const normalizedHost = hostname3.toLowerCase();
+  const normalizedSuffix = suffix.toLowerCase();
+  return normalizedHost === normalizedSuffix || normalizedHost.endsWith(`.${normalizedSuffix}`);
+}
+function shouldPreserveAuthForRedirect(url, suffixes) {
+  return Boolean(suffixes?.some((suffix) => hostMatchesSuffix2(url.hostname, suffix)));
+}
+function headersWithOptionalAuthorization2(headers, preserveAuthorization) {
+  const nextHeaders = new Headers(headers);
+  if (!preserveAuthorization)
+    nextHeaders.delete("authorization");
+  return nextHeaders;
+}
+async function fetchWithOptionalAuthenticatedRedirects(url, fetchOptions) {
+  const { preserveAuthRedirectHostSuffixes, ...init5 } = fetchOptions ?? {};
+  if (!preserveAuthRedirectHostSuffixes?.length) {
+    return fetch(url, init5);
+  }
+  let currentUrl = new URL(url);
+  let currentHeaders = new Headers(init5.headers);
+  for (let redirects = 0;redirects <= 5; redirects++) {
+    const response = await fetch(currentUrl.toString(), {
+      ...init5,
+      headers: currentHeaders,
+      redirect: "manual"
+    });
+    if (response.status < 300 || response.status >= 400)
+      return response;
+    const location = response.headers.get("location");
+    if (!location)
+      return response;
+    const nextUrl = new URL(location, currentUrl);
+    const preserveAuthorization = shouldPreserveAuthForRedirect(currentUrl, preserveAuthRedirectHostSuffixes) && shouldPreserveAuthForRedirect(nextUrl, preserveAuthRedirectHostSuffixes);
+    currentHeaders = headersWithOptionalAuthorization2(init5.headers, preserveAuthorization);
+    currentUrl = nextUrl;
+  }
+  throw new Error("Failed to download media: too many redirects");
+}
 function getExtensionFromMime2(mimeType) {
   const mimeToExt = {
     "image/jpeg": ".jpg",
@@ -333045,12 +333101,16 @@ class MediaStorageService {
     };
   }
   async storeFromUrl(instanceId, messageId, url, mimeType, timestamp3, fetchOptions) {
-    const response = await fetch(url, fetchOptions);
+    const response = await fetchWithOptionalAuthenticatedRedirects(url, fetchOptions);
     if (!response.ok) {
       throw new Error(`Failed to download media: ${response.status}`);
     }
+    const responseContentType = response.headers.get("content-type") ?? undefined;
     const buffer3 = Buffer.from(await response.arrayBuffer());
-    const contentType = mimeType ?? response.headers.get("content-type") ?? undefined;
+    if (shouldRejectHtmlMedia(mimeType, responseContentType, buffer3)) {
+      throw new Error(`Downloaded media content mismatch: expected ${mimeType}, received ${responseContentType ?? "unknown content type"}`);
+    }
+    const contentType = mimeType ?? responseContentType;
     return this.storeFromBuffer(instanceId, messageId, buffer3, contentType, timestamp3);
   }
   async updateMessageLocalPath(messageId, localPath) {
@@ -356791,6 +356851,27 @@ async function resolveMessageFromRef(services, ref) {
   if ("messageId" in ref) {
     return services.messages.getById(ref.messageId);
   }
+  if ("chatExternalId" in ref) {
+    const chat2 = await services.chats.findByExternalIdSmart(ref.instanceId, ref.chatExternalId);
+    if (!chat2) {
+      throw new OmniError({
+        code: ERROR_CODES.NOT_FOUND,
+        message: `Chat not found for instanceId=${ref.instanceId}, chatExternalId=${ref.chatExternalId}`,
+        context: { instanceId: ref.instanceId, chatExternalId: ref.chatExternalId },
+        recoverable: false
+      });
+    }
+    const found2 = await services.messages.getByExternalId(chat2.id, ref.externalId);
+    if (!found2) {
+      throw new OmniError({
+        code: ERROR_CODES.NOT_FOUND,
+        message: `Message not found for chatExternalId=${ref.chatExternalId}, externalId=${ref.externalId}`,
+        context: { instanceId: ref.instanceId, chatExternalId: ref.chatExternalId, externalId: ref.externalId },
+        recoverable: false
+      });
+    }
+    return found2;
+  }
   const found = await services.messages.getByExternalId(ref.chatId, ref.externalId);
   if (!found) {
     throw new OmniError({
@@ -356802,6 +356883,17 @@ async function resolveMessageFromRef(services, ref) {
   }
   return found;
 }
+function buildMediaDownloadFetchOptions(instance4) {
+  if (instance4.channel !== "slack")
+    return;
+  const slackBotToken = typeof instance4.slackBotToken === "string" ? instance4.slackBotToken : undefined;
+  if (!slackBotToken)
+    return;
+  return {
+    headers: { Authorization: `Bearer ${slackBotToken}` },
+    preserveAuthRedirectHostSuffixes: ["slack.com"]
+  };
+}
 async function computeCloseContactTerminalState(db2, chatUuid, outcome, auditRowId) {
   const cfg = resolveCloseContactConfig(outcome, null);
   if (isHardTerminalOutcome(outcome)) {
@@ -357089,7 +357181,8 @@ var init_messages5 = __esm(() => {
   });
   messageRefSchema = exports_external.union([
     exports_external.object({ messageId: exports_external.string().uuid() }),
-    exports_external.object({ chatId: exports_external.string().uuid(), externalId: exports_external.string().min(1) })
+    exports_external.object({ chatId: exports_external.string().uuid(), externalId: exports_external.string().min(1) }),
+    exports_external.object({ instanceId: exports_external.string().uuid(), chatExternalId: exports_external.string().min(1), externalId: exports_external.string().min(1) })
   ]);
   messagesRoutes.post("/media/download", zValidator("json", messageRefSchema), async (c) => {
     const body = c.req.valid("json");
@@ -357107,6 +357200,7 @@ var init_messages5 = __esm(() => {
         recoverable: false
       });
     }
+    const instance4 = await services.instances.getById(instanceId);
     checkInstanceAccess2(apiKey, instanceId);
     if (!message2.hasMedia || !message2.mediaUrl) {
       return c.json({
@@ -357134,7 +357228,7 @@ var init_messages5 = __esm(() => {
     }
     if (!cached) {
       try {
-        const result = await mediaStorage2.storeFromUrl(instanceId, message2.id, mediaUrl, message2.mediaMimeType ?? undefined, message2.platformTimestamp ?? undefined);
+        const result = await mediaStorage2.storeFromUrl(instanceId, message2.id, mediaUrl, message2.mediaMimeType ?? undefined, message2.platformTimestamp ?? undefined, buildMediaDownloadFetchOptions(instance4));
         mediaLocalPath = result.localPath;
         await mediaStorage2.updateMessageLocalPath(message2.id, result.localPath);
         mediaDownloadLog.info("Downloaded and cached media", {
@@ -357155,7 +357249,7 @@ var init_messages5 = __esm(() => {
         });
       }
     }
-    const downloadUrl = `/api/v2/media/${instanceId}/${mediaLocalPath}`;
+    const downloadUrl = `/api/v2/media/${mediaLocalPath}`;
     return c.json({
       data: {
         messageId: message2.id,
@@ -367806,6 +367900,51 @@ function setupCommandHandlers(app, instanceId, commandNames, callbacks, logger5)
 init_src2();
 init_types10();
 var downloadGuard2 = createDownloadGuard();
+function normalizeMimeType(value) {
+  return value?.split(";")[0]?.trim().toLowerCase() || undefined;
+}
+function isHtmlMime(value) {
+  const mimeType = normalizeMimeType(value);
+  return mimeType === "text/html" || mimeType === "application/xhtml+xml";
+}
+function looksLikeHtml(buffer2) {
+  const preview = buffer2.subarray(0, 512).toString("utf8").trimStart().toLowerCase();
+  return preview.startsWith("<!doctype html") || preview.startsWith("<html>") || preview.startsWith("<html ");
+}
+function hostMatchesSuffix(hostname, suffix) {
+  const normalizedHost = hostname.toLowerCase();
+  const normalizedSuffix = suffix.toLowerCase();
+  return normalizedHost === normalizedSuffix || normalizedHost.endsWith(`.${normalizedSuffix}`);
+}
+function isSlackHost(url) {
+  return hostMatchesSuffix(url.hostname, "slack.com");
+}
+function headersWithOptionalAuthorization(botToken, preserveAuthorization) {
+  const headers = new Headers;
+  if (preserveAuthorization)
+    headers.set("Authorization", `Bearer ${botToken}`);
+  headers.set("Accept", "application/octet-stream");
+  return headers;
+}
+async function fetchSlackPrivateUrl(url, botToken) {
+  let currentUrl = new URL(url);
+  let preserveAuthorization = true;
+  for (let redirects = 0;redirects <= 5; redirects++) {
+    const response = await fetch(currentUrl.toString(), {
+      headers: headersWithOptionalAuthorization(botToken, preserveAuthorization),
+      redirect: "manual"
+    });
+    if (response.status < 300 || response.status >= 400)
+      return response;
+    const location = response.headers.get("location");
+    if (!location)
+      return response;
+    const nextUrl = new URL(location, currentUrl);
+    preserveAuthorization = isSlackHost(currentUrl) && isSlackHost(nextUrl);
+    currentUrl = nextUrl;
+  }
+  throw new SlackError(SlackErrorCode.FILE_DOWNLOAD_FAILED, "Failed to download file: too many redirects");
+}
 function extractFileInfo(files) {
   if (!files || !Array.isArray(files))
     return [];
@@ -367822,20 +367961,19 @@ function extractFileInfo(files) {
     };
   });
 }
-async function downloadSlackFile(url, botToken, logger5) {
+async function downloadSlackFile(url, botToken, logger5, expectedMimeType) {
   logger5.debug("Downloading file from Slack CDN", { url: url.substring(0, 50) });
   try {
-    const response = await fetch(url, {
-      headers: {
-        Authorization: `Bearer ${botToken}`
-      }
-    });
+    const response = await fetchSlackPrivateUrl(url, botToken);
     if (!response.ok) {
       throw new SlackError(SlackErrorCode.FILE_DOWNLOAD_FAILED, `Failed to download file: HTTP ${response.status} ${response.statusText}`);
     }
     downloadGuard2.checkResponse(response, logger5, { channel: "slack", url: url.substring(0, 50) });
     const buffer2 = Buffer.from(await response.arrayBuffer());
     const mimeType = response.headers.get("content-type") ?? "application/octet-stream";
+    if (!isHtmlMime(expectedMimeType) && (isHtmlMime(mimeType) || looksLikeHtml(buffer2))) {
+      throw new SlackError(SlackErrorCode.FILE_DOWNLOAD_FAILED, `Failed to download file bytes: Slack returned HTML instead of ${expectedMimeType ?? "media"}`);
+    }
     logger5.debug("File downloaded successfully", { size: buffer2.length, mimeType });
     return { buffer: buffer2, mimeType };
   } catch (error) {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260624.3",
+  "version": "2.260624.4",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {