@bolloon/bolloon-agent 0.2.4 → 0.2.5

package/dist/cli-entry.js

@@ -13,6 +13,7 @@
 import { spawn } from 'child_process';
 import * as path from 'path';
 import * as fs from 'fs';
+import { fileURLToPath } from 'url';
 const isWindows = process.platform === 'win32';
 // ANSI 颜色
 const RESET = '\x1b[0m';
@@ -66,8 +67,11 @@ ${BOLD}环境变量:${RESET}
 `);
 }
 function getDistDir() {
-    // 对于打包后的应用，__dirname 是 dist 目录
-    return __dirname;
+    // 2026-07-01: ESM 模块无 __dirname, 用 import.meta.url + path.dirname 拿当前文件所在目录.
+    // 对于打包后的应用, 这是 dist 目录; 对于 tsx 跑 src/index.ts 时, 是 src/ 目录
+    // (后续 getMainScript 会优先用 dist/cli-entry.js, 不依赖这里的返回值)
+    const __filename_esm = fileURLToPath(import.meta.url);
+    return path.dirname(__filename_esm);
 }
 function getMainScript() {
     const distDir = getDistDir();

package/dist/web/input-validator.js

@@ -0,0 +1,103 @@
+/**
+ * input-validator — web 接口输入验证 (v0.2.5)
+ *
+ * 2026-07-01: 抽到独立模块, claude code / 前端都能 import 验证.
+ *   - 后端用: POST /api/validate-input 调 validate()
+ *   - 前端用: 实时 UI 反馈 (发送前预校验, 不阻塞)
+ *
+ * 验证规则 (bolloon web 当前业务):
+ *   - text 非空 (trim 后)
+ *   - text 长度 <= MAX_TEXT_LENGTH
+ *   - text 不包含 NUL / 不可打印控制字符
+ *   - channelId 非空
+ *   - channelName (新建频道) 长度 <= MAX_NAME_LENGTH
+ *   - 不含 SQL/XSS payload 触发 (sanitize-only: 不是阻止, 是 warn)
+ *
+ * 设计: 纯函数 + 返回结构化 ValidationResult.
+ *   { ok: true, reason?, severity? }
+ *   严重等级: 'info' | 'warn' | 'block'
+ */
+export const MAX_TEXT_LENGTH = 16_000; // 大约 4K tokens, 单条 user 消息够用
+export const MAX_NAME_LENGTH = 200; // channel name 上限
+export const MAX_AGENT_ID_LENGTH = 200;
+/** 校验单条 /message 请求 (text + channelId) */
+export function validateMessageInput(input) {
+    // 1. channelId
+    if (typeof input.channelId !== 'string' || input.channelId.trim() === '') {
+        return { ok: false, severity: 'block', reason: 'channelId 必填' };
+    }
+    if (input.channelId.length > 256) {
+        return { ok: false, severity: 'block', reason: `channelId 长度超过 256 字符 (${input.channelId.length})` };
+    }
+    // 2. text
+    if (typeof input.text !== 'string') {
+        return { ok: false, severity: 'block', reason: 'text 必填且必须是字符串' };
+    }
+    const trimmed = input.text.trim();
+    if (trimmed === '') {
+        return { ok: false, severity: 'block', reason: 'text 不能为空 (trim 后)' };
+    }
+    if (trimmed.length > MAX_TEXT_LENGTH) {
+        return {
+            ok: false,
+            severity: 'block',
+            reason: `text 长度 ${trimmed.length} 超过最大 ${MAX_TEXT_LENGTH} 字符`,
+        };
+    }
+    // 3. 控制字符检测 — 拒绝 NUL + 不可打印 char (< 0x20 除了 \n \r \t)
+    // eslint-disable-next-line no-control-regex
+    const controlCharRe = /[\x00-\x08\x0B-\x0C\x0E-\x1F]/g;
+    const controlMatches = trimmed.match(controlCharRe);
+    if (controlMatches && controlMatches.length > 0) {
+        return {
+            ok: false,
+            severity: 'block',
+            reason: `text 含 ${controlMatches.length} 个不可打印控制字符`,
+        };
+    }
+    // 4. 通用安全 check — 大段 HTML/JS 注入 (sanitize 是另一层, 这里只 warn)
+    const htmlRe = /<\/?[a-z][\s\S]*>/i;
+    if (htmlRe.test(trimmed) && trimmed.length > 500) {
+        return {
+            ok: true,
+            severity: 'warn',
+            reason: 'text 包含 HTML 标签 (>500 字符), 确认发送前预览',
+            cleaned: trimmed,
+        };
+    }
+    return { ok: true, severity: 'info', cleaned: trimmed };
+}
+/** 校验 channel 创建输入 */
+export function validateChannelInput(input) {
+    if (typeof input.name !== 'string' || input.name.trim() === '') {
+        return { ok: false, severity: 'block', reason: 'name 必填' };
+    }
+    const trimmedName = input.name.trim();
+    if (trimmedName.length > MAX_NAME_LENGTH) {
+        return {
+            ok: false,
+            severity: 'block',
+            reason: `name 长度 ${trimmedName.length} 超过最大 ${MAX_NAME_LENGTH}`,
+        };
+    }
+    if (typeof input.agentId === 'string' && input.agentId.length > MAX_AGENT_ID_LENGTH) {
+        return {
+            ok: false,
+            severity: 'block',
+            reason: `agentId 长度 ${input.agentId.length} 超过最大 ${MAX_AGENT_ID_LENGTH}`,
+        };
+    }
+    return { ok: true, severity: 'info', cleaned: trimmedName };
+}
+const BOOT_TIME = Date.now();
+export function healthCheck(version) {
+    return {
+        ok: true,
+        version,
+        uptime_sec: Math.floor((Date.now() - BOOT_TIME) / 1000),
+        validators_loaded: [
+            'validateMessageInput',
+            'validateChannelInput',
+        ],
+    };
+}

package/dist/web/server.js

@@ -6,6 +6,32 @@ import * as fs from 'fs/promises';
 import * as fsSync from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { validateMessageInput, validateChannelInput, healthCheck, } from './input-validator.js';
+// 读自身 package.json 拿 version (health endpoint 用)
+//   路径: src/web/server.ts → ../../package.json (编译后 dist/web/server.js)
+let cachedVersion = null;
+function getPackageVersion() {
+    if (cachedVersion)
+        return cachedVersion;
+    try {
+        const here = fileURLToPath(import.meta.url);
+        const hereDir = path.dirname(here);
+        // 试 ../package.json (相对 dist/web/) 或 ../../package.json (相对 src/web/)
+        let raw = null;
+        for (const rel of ['../package.json', '../../package.json']) {
+            try {
+                raw = fsSync.readFileSync(path.join(hereDir, rel), 'utf-8');
+                break;
+            }
+            catch { }
+        }
+        cachedVersion = raw ? (JSON.parse(raw).version ?? '0.0.0') : 'unknown';
+    }
+    catch {
+        cachedVersion = 'unknown';
+    }
+    return cachedVersion;
+}
 // 2026-06-17: 终端静默 — server.ts 高频 spam (LLM 流式每个 token 一次 broadcast,
 // 每次 P2P 收发 [v3]/[v3-meta]/[v3-cross]/[v3-friend] 各一次) 全部走 console.log proxy,
 // 默认 (BOLLOON_VERBOSE != '1') 完全不打;VERBOSE=1 时恢复.
@@ -1410,6 +1436,36 @@ export async function createWebServer(port = 3000, options = {}) {
     }
     app.get('/', serveStaticHtml('index.html', 'index.html not found; please run `npm run build:web`', 'index'));
     app.get('/api-config', serveStaticHtml('api-config.html', 'api-config.html not found; please run `npm run build:web`', 'api-config'));
+    // 2026-07-01 (v0.2.5): 输入验证 + 健康检查 API
+    //   - POST /api/validate-input: 前端发送前预校验, 避免后端 reject
+    //   - GET  /api/health: liveness probe + validators 清单
+    //   这些端点不依赖 LLM / P2P, 永远可以响应.
+    app.post('/api/validate-input', async (req, res) => {
+        try {
+            const body = req.body ?? {};
+            const kind = body.kind || 'message';
+            let result;
+            if (kind === 'channel') {
+                result = validateChannelInput({ name: body.name, agentId: body.agentId });
+            }
+            else {
+                result = validateMessageInput({ text: body.text, channelId: body.channelId });
+            }
+            res.json({
+                ok: result.ok,
+                severity: result.severity ?? (result.ok ? 'info' : 'block'),
+                reason: result.reason,
+                cleaned: result.cleaned,
+                kind,
+            });
+        }
+        catch (e) {
+            res.status(400).json({ ok: false, severity: 'block', reason: e?.message ?? 'parse error' });
+        }
+    });
+    app.get('/api/health', (_req, res) => {
+        res.json(healthCheck(getPackageVersion()));
+    });
     // 全局兜底: 任何 next(err) 走到这里, 给出结构化 4xx/5xx 而不是默认 HTML
     app.use((err, req, res, _next) => {
         console.error('[server] unhandled error on', req.method, req.path, '-', err?.message || err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli-entry.js",