@browserbridge/bbx 1.11.0 → 1.11.2

package/packages/native-host/src/daemon.js

@@ -44,7 +44,12 @@ import {
   getSocketPath,
 } from './config.js';
 import { ArtifactStore } from './artifact-store.js';
-import { bridgeAuthTokensEqual, ensureBridgeAuthToken, readBridgeAuthToken } from './auth-token.js';
+import {
+  bridgeAuthTokensEqual,
+  ensureBridgeAuthToken,
+  ensureBridgeExtensionAuthToken,
+  readBridgeAuthToken,
+} from './auth-token.js';
 import { normalizeDaemonLogger } from './daemon-logger.js';
 import { DomBaselineOwnerRegistry, isValidBaselineId } from './dom-baseline-owners.js';
 import { writeJsonLine } from './framing.js';
@@ -59,7 +64,7 @@ setProtocolPackageVersion(DAEMON_VERSION);
 /** @typedef {import('./config.js').BridgeTransport} BridgeTransport */
 /** @typedef {import('./daemon-logger.js').DaemonLoggerLike} DaemonLoggerLike */
 /** @typedef {'agent' | 'extension'} SocketRole */
-/** @typedef {import('node:net').Socket & { readonly __role?: SocketRole, __clientId?: string, __extensionId?: string, __browserName?: string, __profileLabel?: string, __browserExtensionId?: string, __accessEnabled?: boolean, __lastActiveAt?: number }} ClientSocket */
+/** @typedef {import('node:net').Socket & { readonly __role?: SocketRole, __localControl?: boolean, __registrationTimeoutId?: NodeJS.Timeout, __invalidLineCount?: number, __clientId?: string, __extensionId?: string, __browserName?: string, __profileLabel?: string, __browserExtensionId?: string, __accessEnabled?: boolean, __lastActiveAt?: number }} ClientSocket */
 /** @typedef {{ socket: ClientSocket, timeoutId: NodeJS.Timeout, source?: string, mcpEra?: string, method?: string, protocolVersion?: string, baselineId?: string | null, automaticMcpRetry?: boolean, targets: Set<ClientSocket>, lastErrorResponse?: import('../../protocol/src/types.js').BridgeResponse }} PendingEntry */
 /**
  * @typedef {{
@@ -123,6 +128,14 @@ const DIAGNOSTIC_METHODS = new Set([
   'setup.get_status',
   'setup.install',
 ]);
+export const DAEMON_REGISTRATION_TIMEOUT_MS = 5_000;
+export const MAX_DAEMON_CONNECTIONS = 64;
+export const MAX_DAEMON_PENDING_REQUESTS = 128;
+export const MAX_DAEMON_PENDING_REQUESTS_PER_CLIENT = 16;
+export const MAX_DAEMON_ACTIVE_HANDLERS_PER_CLIENT = 32;
+export const MAX_DAEMON_INVALID_LINES = 3;
+const MAX_CLIENT_ID_LENGTH = 128;
+const MAX_ROUTING_LABEL_LENGTH = 128;
 
 /**
  * @param {unknown} value
@@ -134,6 +147,42 @@ function asHealthRecord(value) {
     : null;
 }
 
+/**
+ * @param {unknown} value
+ * @returns {string | undefined}
+ */
+function normalizeRoutingLabel(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_ROUTING_LABEL_LENGTH) {
+    return undefined;
+  }
+  return hasAsciiControlCharacters(value) ? undefined : value;
+}
+
+/** @param {string} value @returns {boolean} */
+function hasAsciiControlCharacters(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function normalizeClientId(value) {
+  if (value == null || value === '') return randomUUID();
+  if (
+    typeof value !== 'string' ||
+    value.length > MAX_CLIENT_ID_LENGTH ||
+    !/^[A-Za-z0-9_.:-]+$/u.test(value)
+  ) {
+    return null;
+  }
+  return value;
+}
+
 /**
  * @param {unknown} value
  * @returns {number | undefined}
@@ -383,6 +432,7 @@ export class BridgeDaemon {
    *   setupInstaller?: (params: Record<string, unknown>) => Promise<SetupInstallResult>,
    *   logger?: DaemonLoggerLike | Pick<Console, 'log' | 'error'>,
    *   authToken?: string | null,
+   *   extensionAuthToken?: string | null,
    *   artifactStore?: ArtifactStore
    * }} [options={}]
    */
@@ -394,6 +444,7 @@ export class BridgeDaemon {
     setupInstaller = installSetupTarget,
     logger = undefined,
     authToken = undefined,
+    extensionAuthToken = undefined,
     artifactStore = new ArtifactStore(getArtifactStorePath()),
   } = {}) {
     this.transport = socketPath ? createSocketBridgeTransport(socketPath) : transport;
@@ -412,6 +463,11 @@ export class BridgeDaemon {
     this.extensionSockets = new Map();
     /** @type {Map<string, ClientSocket>} */
     this.agentSockets = new Map();
+    /** @type {Set<ClientSocket>} */
+    this.clientSockets = new Set();
+    /** @type {Map<ClientSocket, number>} */
+    this.activeHandlers = new Map();
+    this.activeHandlerCount = 0;
     /** @type {Map<string, PendingEntry>} */
     this.pendingRequests = new Map();
     /** @type {Map<ClientSocket, Set<string>>} */
@@ -437,6 +493,8 @@ export class BridgeDaemon {
     this.requestStartTimes = new Map();
     /** @type {string | null | undefined} */
     this.authToken = authToken;
+    /** @type {string | null | undefined} */
+    this.extensionAuthToken = extensionAuthToken;
     this.artifactStore = artifactStore;
     this.artifactStoreInitialized = false;
     this.domBaselines = new DomBaselineOwnerRegistry({
@@ -516,7 +574,7 @@ export class BridgeDaemon {
     pending = this.pendingRequests.get(requestId),
     preserveArtifacts = false
   ) {
-    if (!pending) {
+    if (!pending || this.pendingRequests.get(requestId) !== pending) {
       return undefined;
     }
     clearTimeout(pending.timeoutId);
@@ -569,6 +627,7 @@ export class BridgeDaemon {
    * @returns {void}
    */
   registerSocket(socket, message) {
+    this.clientSockets.add(socket);
     if (socket.__role) {
       void writeJsonLine(socket, {
         type: 'registration_failed',
@@ -576,30 +635,38 @@ export class BridgeDaemon {
           code: ERROR_CODES.INVALID_REQUEST,
           message: `Socket is already registered as ${socket.__role}.`,
         },
-      });
+      }).catch(() => socket.destroy());
       return;
     }
 
-    if (this.isAuthRequired() && !bridgeAuthTokensEqual(message.authToken, this.authToken)) {
-      this.logger.error('socket registration rejected', { role: message.role ?? null });
+    if (message.role !== 'extension' && message.role !== 'agent') {
       void writeJsonLine(socket, {
         type: 'registration_failed',
         error: {
-          code: ERROR_CODES.ACCESS_DENIED,
-          message: 'Bridge daemon authentication failed.',
+          code: ERROR_CODES.INVALID_REQUEST,
+          message: 'Socket role must be "agent" or "extension".',
         },
-      }).finally(() => socket.destroy());
+      }).catch(() => socket.destroy());
       return;
     }
 
-    if (message.role !== 'extension' && message.role !== 'agent') {
+    const expectedToken =
+      message.role === 'extension'
+        ? this.extensionAuthToken
+        : this.isAuthRequired()
+          ? this.authToken
+          : null;
+    if (expectedToken && !bridgeAuthTokensEqual(message.authToken, expectedToken)) {
+      this.logger.error('socket registration rejected', { role: message.role ?? null });
       void writeJsonLine(socket, {
         type: 'registration_failed',
         error: {
-          code: ERROR_CODES.INVALID_REQUEST,
-          message: 'Socket role must be "agent" or "extension".',
+          code: ERROR_CODES.ACCESS_DENIED,
+          message: 'Bridge daemon authentication failed.',
         },
-      });
+      })
+        .catch(() => {})
+        .finally(() => socket.destroy());
       return;
     }
 
@@ -609,13 +676,16 @@ export class BridgeDaemon {
       configurable: false,
       writable: false,
     });
+    if (socket.__registrationTimeoutId) {
+      clearTimeout(socket.__registrationTimeoutId);
+      socket.__registrationTimeoutId = undefined;
+    }
     if (message.role === 'extension') {
+      socket.__localControl = true;
       const extensionId = randomUUID();
       socket.__extensionId = extensionId;
-      socket.__browserName =
-        typeof message.browserName === 'string' ? message.browserName : undefined;
-      socket.__profileLabel =
-        typeof message.profileLabel === 'string' ? message.profileLabel : undefined;
+      socket.__browserName = normalizeRoutingLabel(message.browserName);
+      socket.__profileLabel = normalizeRoutingLabel(message.profileLabel);
       socket.__browserExtensionId = normalizeBrowserExtensionId(message.browserExtensionId);
       socket.__lastActiveAt = Date.now();
       this.extensionSockets.set(extensionId, socket);
@@ -625,12 +695,27 @@ export class BridgeDaemon {
         browserName: socket.__browserName ?? null,
         profileLabel: socket.__profileLabel ?? null,
       });
-      void writeJsonLine(socket, { type: 'registered', role: 'extension' });
+      void writeJsonLine(socket, { type: 'registered', role: 'extension' }).catch(() =>
+        socket.destroy()
+      );
       return;
     }
 
     if (message.role === 'agent') {
-      const clientId = message.clientId || randomUUID();
+      socket.__localControl = this.transport.type === 'socket';
+      const clientId = normalizeClientId(message.clientId);
+      if (!clientId) {
+        void writeJsonLine(socket, {
+          type: 'registration_failed',
+          error: {
+            code: ERROR_CODES.INVALID_REQUEST,
+            message: 'Agent clientId is invalid.',
+          },
+        })
+          .catch(() => {})
+          .finally(() => socket.destroy());
+        return;
+      }
       this.agentSockets.set(clientId, socket);
       socket.__clientId = clientId;
       this.logger.info('agent registered', { clientId });
@@ -638,7 +723,7 @@ export class BridgeDaemon {
         type: 'registered',
         role: 'agent',
         clientId,
-      });
+      }).catch(() => socket.destroy());
       return;
     }
   }
@@ -649,6 +734,10 @@ export class BridgeDaemon {
     if (this.authToken === undefined) {
       this.authToken = this.transport.type === 'tcp' ? await ensureBridgeAuthToken() : null;
     }
+    if (this.extensionAuthToken === undefined) {
+      this.extensionAuthToken =
+        this.transport.type === 'tcp' ? await ensureBridgeExtensionAuthToken() : null;
+    }
 
     if (this.transport.type === 'socket' && !isWindowsNamedPipePath(this.socketPath)) {
       const socketDir = path.dirname(this.socketPath);
@@ -658,7 +747,7 @@ export class BridgeDaemon {
       }
       try {
         await fs.promises.access(this.socketPath);
-        if (await pingExistingDaemon(this.transport)) {
+        if (await hasLiveListener(this.transport)) {
           throw new Error(
             `Another daemon is already running on ${this.socketPath}. Stop it before starting a new one.`
           );
@@ -666,38 +755,79 @@ export class BridgeDaemon {
         this.logger.info('Removing stale socket from previous run', {
           socketPath: this.socketPath,
         });
+        await fs.promises.rm(this.socketPath, { force: true });
       } catch (error) {
-        if (error instanceof Error && error.message.startsWith('Another daemon')) {
+        if (!error || typeof error !== 'object' || !('code' in error) || error.code !== 'ENOENT')
           throw error;
-        }
         // Socket does not exist - normal startup.
       }
-      await fs.promises.rm(this.socketPath, { force: true });
     }
 
     this.server = net.createServer((socket) => {
       const typedSocket = /** @type {ClientSocket} */ (socket);
+      this.clientSockets.add(typedSocket);
+      typedSocket.__invalidLineCount = 0;
+      typedSocket.__registrationTimeoutId = setTimeout(() => {
+        if (!typedSocket.__role) {
+          this.logger.warn('unregistered socket timed out');
+          typedSocket.destroy();
+        }
+      }, DAEMON_REGISTRATION_TIMEOUT_MS);
+      typedSocket.__registrationTimeoutId.unref?.();
       typedSocket.on('error', (err) => {
         this.logger.error('socket error', { message: err.message });
       });
       parseJsonLines(
         typedSocket,
         (raw) => {
+          if (typedSocket.destroyed) return;
           const message = /** @type {DaemonMessage} */ (raw);
-          void this.handleClientMessage(typedSocket, message).catch((err) => {
-            this.logger.error('handler error', {
-              message: err instanceof Error ? err.message : String(err),
+          const admitted =
+            message?.type === 'agent.request' || message?.type === 'extension.setup_status.request';
+          const active = this.activeHandlers.get(typedSocket) ?? 0;
+          if (
+            admitted &&
+            (active >= MAX_DAEMON_ACTIVE_HANDLERS_PER_CLIENT ||
+              this.activeHandlerCount >= MAX_DAEMON_PENDING_REQUESTS)
+          ) {
+            typedSocket.destroy();
+            return;
+          }
+          if (admitted) {
+            this.activeHandlers.set(typedSocket, active + 1);
+            this.activeHandlerCount += 1;
+          }
+          void this.handleClientMessage(typedSocket, message)
+            .catch((err) => {
+              this.logger.error('handler error', {
+                message: err instanceof Error ? err.message : String(err),
+              });
+            })
+            .finally(() => {
+              if (admitted) {
+                const remaining = (this.activeHandlers.get(typedSocket) ?? 1) - 1;
+                if (remaining) this.activeHandlers.set(typedSocket, remaining);
+                else this.activeHandlers.delete(typedSocket);
+                this.activeHandlerCount -= 1;
+              }
             });
-          });
         },
         {
           onProtocolError: (error) => {
             this.logger.error('socket protocol error', { message: error.message });
           },
+          onInvalidLine: () => {
+            typedSocket.__invalidLineCount = (typedSocket.__invalidLineCount ?? 0) + 1;
+            if (typedSocket.__invalidLineCount >= MAX_DAEMON_INVALID_LINES) {
+              this.logger.warn('socket sent too many malformed JSON lines');
+              typedSocket.destroy();
+            }
+          },
         }
       );
       typedSocket.on('close', () => this.handleSocketClose(typedSocket));
     });
+    this.server.maxConnections = MAX_DAEMON_CONNECTIONS;
 
     const server = this.server;
     await new Promise((resolve, reject) => {
@@ -753,6 +883,10 @@ export class BridgeDaemon {
     this.pendingRequests.clear();
     this.pendingRequestsByOwnerSocket.clear();
     this.pendingRequestsByTargetSocket.clear();
+    this.requestStartTimes.clear();
+
+    for (const socket of this.clientSockets) socket.destroy();
+    this.clientSockets.clear();
 
     for (const socket of this.agentSockets.values()) {
       socket.destroy();
@@ -772,6 +906,7 @@ export class BridgeDaemon {
 
     if (this.server) {
       const server = this.server;
+      const ownedListener = server.listening;
       this.server = null;
       try {
         await new Promise((resolve, reject) => {
@@ -784,7 +919,11 @@ export class BridgeDaemon {
           });
         });
       } finally {
-        if (this.transport.type === 'socket' && !isWindowsNamedPipePath(this.socketPath)) {
+        if (
+          ownedListener &&
+          this.transport.type === 'socket' &&
+          !isWindowsNamedPipePath(this.socketPath)
+        ) {
           await fs.promises.rm(this.socketPath, { force: true });
         }
       }
@@ -1076,7 +1215,7 @@ export class BridgeDaemon {
     }
 
     if (request.method === 'setup.install') {
-      if (socket.__role === 'agent' && !this.isLocalSocket(socket)) {
+      if (!socket.__localControl) {
         const response = createFailure(
           request.id,
           ERROR_CODES.ACCESS_DENIED,
@@ -1115,6 +1254,26 @@ export class BridgeDaemon {
       typeof request.meta?.target_profile === 'string' ? request.meta.target_profile : null;
     const hasExplicitTarget = Boolean(targetBrowser || targetProfile);
 
+    const ownerPendingCount = this.pendingRequestsByOwnerSocket.get(socket)?.size ?? 0;
+    if (
+      this.pendingRequests.size >= MAX_DAEMON_PENDING_REQUESTS ||
+      ownerPendingCount >= MAX_DAEMON_PENDING_REQUESTS_PER_CLIENT
+    ) {
+      const response = createFailure(
+        request.id,
+        ERROR_CODES.INVALID_REQUEST,
+        'Daemon pending-request limit reached. Wait for existing requests to finish.',
+        {
+          maxPendingRequests: MAX_DAEMON_PENDING_REQUESTS,
+          maxPendingRequestsPerClient: MAX_DAEMON_PENDING_REQUESTS_PER_CLIENT,
+        },
+        { method: request.method }
+      );
+      await writeJsonLine(socket, { type: 'agent.response', response });
+      this.recordDaemonRequestOutcome(request, false);
+      return;
+    }
+
     const baselineId =
       typeof request.params.baselineId === 'string' ? request.params.baselineId : null;
     const usesBaselineOwner =
@@ -1209,7 +1368,7 @@ export class BridgeDaemon {
         message: error instanceof Error ? error.message : String(error),
       });
       const pending = this.pendingRequests.get(request.id);
-      if (!pending) {
+      if (!pending || !pending.targets.has(target)) {
         return;
       }
       this.removePendingTarget(request.id, pending, target);
@@ -1222,23 +1381,6 @@ export class BridgeDaemon {
     }
   }
 
-  /**
-   * @param {ClientSocket} socket
-   * @returns {boolean}
-   */
-  isLocalSocket(socket) {
-    if (this.transport.type === 'socket') {
-      return true;
-    }
-    const address = socket.remoteAddress ?? '';
-    return (
-      address === '127.0.0.1' ||
-      address === '::1' ||
-      address === 'localhost' ||
-      address === '::ffff:127.0.0.1'
-    );
-  }
-
   /**
    * Select from a snapshot so routing neither mutates nor observes mutations to
    * the live extension map while candidates are ordered.
@@ -1348,13 +1490,15 @@ export class BridgeDaemon {
    */
   handleExtensionIdentity(socket, message) {
     let changed = false;
-    if (typeof message.browserName === 'string') {
-      changed = changed || socket.__browserName !== message.browserName;
-      socket.__browserName = message.browserName;
+    const browserName = normalizeRoutingLabel(message.browserName);
+    if (browserName) {
+      changed = changed || socket.__browserName !== browserName;
+      socket.__browserName = browserName;
     }
-    if (typeof message.profileLabel === 'string') {
-      changed = changed || socket.__profileLabel !== message.profileLabel;
-      socket.__profileLabel = message.profileLabel;
+    const profileLabel = normalizeRoutingLabel(message.profileLabel);
+    if (profileLabel) {
+      changed = changed || socket.__profileLabel !== profileLabel;
+      socket.__profileLabel = profileLabel;
     }
     if (typeof message.browserExtensionId === 'string') {
       const browserExtensionId = normalizeBrowserExtensionId(message.browserExtensionId);
@@ -1399,6 +1543,20 @@ export class BridgeDaemon {
     const ownerId = pending.socket.__clientId;
     if (!ownerId) return;
     try {
+      if (
+        message.type === 'extension.artifact.chunk' ||
+        message.type === 'extension.artifact.commit'
+      ) {
+        const transfer = this.artifactStore.transfers.get(String(message.artifactId ?? ''));
+        if (
+          !transfer ||
+          transfer.requestId !== requestId ||
+          transfer.ownerId !== ownerId ||
+          transfer.extensionId !== socket.__extensionId
+        ) {
+          throw new Error('Artifact transfer does not belong to this request and extension.');
+        }
+      }
       if (message.type === 'extension.artifact.begin') {
         this.artifactStore.begin({
           artifactId: String(artifact.artifactId ?? ''),
@@ -1457,12 +1615,11 @@ export class BridgeDaemon {
 
   /**
    * @param {ClientSocket} socket
-   * @param {DaemonMessage} message
+   * @param {DaemonMessage} _message
    * @returns {void}
    */
-  handleExtensionActivity(socket, message) {
-    socket.__lastActiveAt =
-      typeof message.at === 'number' && Number.isFinite(message.at) ? message.at : Date.now();
+  handleExtensionActivity(socket, _message) {
+    socket.__lastActiveAt = Date.now();
   }
 
   /**
@@ -1495,6 +1652,7 @@ export class BridgeDaemon {
     }
 
     this.removePendingTarget(responseMessage.id, pending, socket);
+    clearTimeout(pending.timeoutId);
 
     if (responseMessage.ok) {
       const result =
@@ -1540,7 +1698,7 @@ export class BridgeDaemon {
           }
         }
         if (!this.domBaselines.register(baselineId, socket, result.expiresAt)) {
-          await this.releaseOrphanDomBaseline(socket, responseMessage);
+          await this.releaseOrphanDomBaseline(socket, responseMessage).catch(() => {});
           pending.lastErrorResponse = createFailure(
             responseMessage.id,
             ERROR_CODES.DOM_BASELINE_INVALIDATED,
@@ -1592,11 +1750,12 @@ export class BridgeDaemon {
           if (baselineId) this.domBaselines.delete(baselineId);
           await this.releaseOrphanDomBaseline(socket, responseMessage).catch(() => {});
         }
-        this.clearPendingRequest(responseMessage.id, pending);
-        this.recordRequestCompletion(responseMessage.id, false, pending);
+        if (this.clearPendingRequest(responseMessage.id, pending)) {
+          this.recordRequestCompletion(responseMessage.id, false, pending);
+        }
         throw error;
       }
-      this.clearPendingRequest(responseMessage.id, pending, true);
+      if (!this.clearPendingRequest(responseMessage.id, pending, true)) return;
       this.recordRequestCompletion(responseMessage.id, true, pending);
       this.pushLog({
         at: new Date().toISOString(),
@@ -1623,6 +1782,11 @@ export class BridgeDaemon {
    * @returns {void}
    */
   handleSocketClose(socket) {
+    this.clientSockets.delete(socket);
+    if (socket.__registrationTimeoutId) {
+      clearTimeout(socket.__registrationTimeoutId);
+      socket.__registrationTimeoutId = undefined;
+    }
     if (socket.__extensionId) {
       this.artifactStore.deleteByExtension(socket.__extensionId);
       this.domBaselines.clearForSocket(socket);
@@ -1681,7 +1845,7 @@ export class BridgeDaemon {
    * @returns {Promise<void>}
    */
   async finishPendingRequestIfExhausted(requestId, pending) {
-    if (pending.targets.size > 0 || !this.pendingRequests.has(requestId)) {
+    if (pending.targets.size > 0 || this.pendingRequests.get(requestId) !== pending) {
       return;
     }
 
@@ -1875,6 +2039,37 @@ export async function pingExistingDaemon(transport) {
   });
 }
 
+/**
+ * Only a refused or missing endpoint proves a Unix socket is stale.
+ * @param {BridgeTransport} transport
+ * @returns {Promise<boolean>}
+ */
+export function hasLiveListener(transport) {
+  return new Promise((resolve, reject) => {
+    const socket =
+      transport.type === 'tcp'
+        ? net.createConnection({ host: transport.host, port: transport.port })
+        : net.createConnection(transport.socketPath);
+    const timer = setTimeout(() => finish(true), DAEMON_EXISTING_SOCKET_PING_TIMEOUT_MS);
+    /** @param {boolean} live @param {Error} [error] */
+    function finish(live, error) {
+      clearTimeout(timer);
+      socket.destroy();
+      if (error) reject(error);
+      else resolve(live);
+    }
+    socket.once('connect', () => finish(true));
+    socket.once('error', (error) => {
+      if (
+        'code' in error &&
+        (error.code === 'ENOENT' || error.code === 'ECONNREFUSED' || error.code === 'ENOTSOCK')
+      )
+        finish(false);
+      else finish(true, error);
+    });
+  });
+}
+
 /**
  * @param {Record<string, unknown>} params
  * @returns {SetupInstallParams & { action: 'install' | 'uninstall', kind: 'mcp' | 'skill', target: string }}