@bbigbang/core 0.1.0

package/dist/web/panelPathPolicy.js

@@ -0,0 +1,63 @@
+import path from 'node:path';
+function isPathWithinRoot(candidatePath, rootPath) {
+    const relativePath = path.relative(rootPath, candidatePath);
+    return !(relativePath.startsWith('..') || path.isAbsolute(relativePath));
+}
+function resolveAllowedAbsolutePath(rawPath, allowedRoots) {
+    const absolutePath = path.resolve(rawPath);
+    let matchedRoot = null;
+    for (const rawRoot of allowedRoots) {
+        const normalizedRoot = path.resolve(rawRoot);
+        if (!isPathWithinRoot(absolutePath, normalizedRoot))
+            continue;
+        if (!matchedRoot || normalizedRoot.length > matchedRoot.length) {
+            matchedRoot = normalizedRoot;
+        }
+    }
+    if (!matchedRoot) {
+        return {
+            ok: false,
+            reason: 'Absolute panel paths require an allowlisted root.',
+        };
+    }
+    return {
+        ok: true,
+        absolutePath,
+        allowedRoot: matchedRoot,
+    };
+}
+export function resolvePanelDatasetPath(workspaceRoot, datasetPath, config) {
+    if (path.isAbsolute(datasetPath)) {
+        return resolveAllowedAbsolutePath(datasetPath, config.panelAbsolutePathRoots);
+    }
+    const allowedRoot = path.resolve(workspaceRoot);
+    const absolutePath = path.resolve(allowedRoot, datasetPath);
+    if (!isPathWithinRoot(absolutePath, allowedRoot)) {
+        return { ok: false, reason: 'Dataset path escapes agent workspace.' };
+    }
+    return { ok: true, absolutePath, allowedRoot };
+}
+export function resolvePanelMediaPath(agentWorkspacePath, mediaPath, config, options) {
+    if (path.isAbsolute(mediaPath)) {
+        const resolved = resolveAllowedAbsolutePath(mediaPath, config.panelAbsolutePathRoots);
+        if (!resolved.ok) {
+            return { ok: false, statusCode: 403, error: resolved.reason };
+        }
+        return resolved;
+    }
+    if (!agentWorkspacePath) {
+        return { ok: false, statusCode: 503, error: 'Agent workspace unavailable' };
+    }
+    const workspaceRoot = path.resolve(agentWorkspacePath);
+    const allowedRoot = options?.allowedRelativeRoot
+        ? path.resolve(workspaceRoot, options.allowedRelativeRoot)
+        : workspaceRoot;
+    if (!isPathWithinRoot(allowedRoot, workspaceRoot)) {
+        return { ok: false, statusCode: 403, error: 'Path outside workspace' };
+    }
+    const absolutePath = path.resolve(workspaceRoot, mediaPath);
+    if (!isPathWithinRoot(absolutePath, allowedRoot)) {
+        return { ok: false, statusCode: 403, error: 'Path outside workspace' };
+    }
+    return { ok: true, absolutePath, allowedRoot };
+}

package/dist/web/panelPreviews.js

@@ -0,0 +1,175 @@
+import { randomUUID } from 'node:crypto';
+export const PANEL_PREVIEW_TTL_MS = 24 * 60 * 60 * 1000;
+export function insertPanelPreview(db, params) {
+    const id = params.id ?? randomUUID();
+    const now = params.createdAt ?? Date.now();
+    const expiresAt = params.expiresAt ?? now + PANEL_PREVIEW_TTL_MS;
+    db.prepare(`INSERT INTO panel_previews(
+       id, agent_id, conversation_id, owner_user_id, run_id,
+       component, props_json, actions_json, dataset_source_json, source_json,
+       row_count, created_at, expires_at
+     )
+     VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, params.agentId, params.conversationId, params.ownerUserId ?? null, params.runId ?? null, params.component, JSON.stringify(params.props ?? {}), JSON.stringify(params.actions ?? []), params.datasetSource ? JSON.stringify(params.datasetSource) : null, JSON.stringify(params.source ?? {}), params.rowCount ?? 0, now, expiresAt);
+    return id;
+}
+export function insertPanelPreviewRows(db, rows) {
+    const insert = db.prepare(`INSERT INTO panel_preview_rows(
+       preview_id, row_index, row_id, fields_json, media_json,
+       node_id, cached_asset_ids_json
+     )
+     VALUES(?, ?, ?, ?, ?, ?, ?)`);
+    for (const row of rows) {
+        const previewId = row.previewId ?? row.panelId;
+        insert.run(previewId, row.rowIndex, row.rowId ?? null, JSON.stringify(row.fields), JSON.stringify(row.media), row.nodeId ?? null, JSON.stringify(row.cachedAssetIds ?? {}));
+    }
+}
+export function getPanelPreviewById(db, id) {
+    const row = db.prepare(`SELECT
+       id, agent_id as agentId, conversation_id as conversationId, owner_user_id as ownerUserId,
+       run_id as runId, component, props_json as propsJson, actions_json as actionsJson,
+       dataset_source_json as datasetSourceJson, source_json as sourceJson,
+       row_count as rowCount, created_at as createdAt, expires_at as expiresAt
+     FROM panel_previews
+     WHERE id = ?
+     LIMIT 1`).get(id);
+    if (!row)
+        return null;
+    const datasetSource = parseNullableJsonObject(row.datasetSourceJson);
+    return {
+        id: row.id,
+        agentId: row.agentId,
+        conversationId: row.conversationId,
+        ownerUserId: row.ownerUserId ?? undefined,
+        scopeType: 'direct',
+        scopeId: row.conversationId,
+        component: row.component,
+        props: parseJsonObject(row.propsJson),
+        actions: parseJsonArray(row.actionsJson),
+        rowCount: row.rowCount,
+        rowCountKnown: row.rowCount >= 0,
+        datasetSource: datasetSource ?? undefined,
+        status: 'idle',
+        progress: null,
+        result: null,
+        version: 1,
+        createdByRunId: row.runId ?? undefined,
+        createdAt: new Date(row.createdAt).toISOString(),
+        updatedAt: new Date(row.createdAt).toISOString(),
+        archivedAt: null,
+        source: parseJsonObject(row.sourceJson),
+        expiresAt: new Date(row.expiresAt).toISOString(),
+    };
+}
+export function isPanelPreviewExpired(preview) {
+    return Date.parse(preview.expiresAt) <= Date.now();
+}
+export function listPanelPreviewRows(db, previewId, options) {
+    const limit = Math.max(1, Math.min(100, Math.floor(options.limit || 50)));
+    const cursorRowIndex = parseCursor(options.cursor);
+    const conditions = ['preview_id = ?'];
+    const params = [previewId];
+    if (options.filterField && options.filterValue !== undefined) {
+        conditions.push(`${panelPreviewFieldJsonExtractExpression(options.filterField)} = ?`);
+        params.push(toSqlJsonValue(options.filterValue));
+    }
+    if (cursorRowIndex !== null) {
+        conditions.push('row_index > ?');
+        params.push(cursorRowIndex);
+    }
+    const orderBy = options.sortField
+        ? `${panelPreviewFieldJsonExtractExpression(options.sortField)} ${options.sortDirection === 'desc' ? 'DESC' : 'ASC'}, row_index ASC`
+        : 'row_index ASC';
+    const rows = db.prepare(`SELECT row_index as rowIndex, row_id as rowId, fields_json as fieldsJson, media_json as mediaJson
+       FROM panel_preview_rows
+      WHERE ${conditions.join(' AND ')}
+      ORDER BY ${orderBy}
+      LIMIT ?`).all(...params, limit + 1);
+    const hasMore = rows.length > limit;
+    const resultRows = hasMore ? rows.slice(0, limit) : rows;
+    const lastRow = resultRows[resultRows.length - 1];
+    return {
+        rows: resultRows.map((row) => ({
+            rowIndex: row.rowIndex,
+            rowId: row.rowId,
+            fields: parseJsonObject(row.fieldsJson),
+            media: parseJsonObject(row.mediaJson),
+        })),
+        nextCursor: hasMore && lastRow
+            ? Buffer.from(JSON.stringify({ ri: lastRow.rowIndex }), 'utf8').toString('base64')
+            : null,
+    };
+}
+export function getPanelPreviewRowByIndex(db, previewId, rowIndex) {
+    const row = db.prepare(`SELECT row_index as rowIndex, row_id as rowId, fields_json as fieldsJson, media_json as mediaJson,
+            node_id as nodeId
+       FROM panel_preview_rows
+      WHERE preview_id = ?
+        AND row_index = ?
+      LIMIT 1`).get(previewId, rowIndex);
+    if (!row)
+        return null;
+    return {
+        rowIndex: row.rowIndex,
+        rowId: row.rowId,
+        fields: parseJsonObject(row.fieldsJson),
+        media: parseJsonObject(row.mediaJson),
+        nodeId: row.nodeId,
+        cachedAssetIds: {},
+    };
+}
+export function deleteExpiredPanelPreviews(db, now = Date.now()) {
+    const result = db.prepare('DELETE FROM panel_previews WHERE expires_at <= ?').run(now);
+    return result.changes;
+}
+function parseJsonObject(value) {
+    if (!value)
+        return {};
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+function parseNullableJsonObject(value) {
+    if (!value)
+        return null;
+    const parsed = parseJsonObject(value);
+    return Object.keys(parsed).length > 0 ? parsed : null;
+}
+function parseJsonArray(value) {
+    if (!value)
+        return [];
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function parseCursor(cursor) {
+    if (!cursor)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(cursor, 'base64').toString('utf8'));
+        return Number.isInteger(parsed.ri) ? Number(parsed.ri) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function panelPreviewFieldJsonExtractExpression(field) {
+    const safePath = field
+        .split('.')
+        .map((part) => part.replace(/[^A-Za-z0-9_]/g, ''))
+        .filter(Boolean)
+        .join('.');
+    return `json_extract(fields_json, '$.${safePath}')`;
+}
+function toSqlJsonValue(value) {
+    return typeof value === 'boolean' ? (value ? 1 : 0) : value;
+}