@clawos-dev/clawd 0.2.648 → 0.2.650

package/dist/app-builder-plugin/mcp-server.cjs

@@ -34364,6 +34364,40 @@ var CloudVolumeGetResultSchema = external_exports.object({
   volume: CloudVolumeUsageSchema.nullable()
 }).strict();
 
+// ../protocol/src/attachment-upload-policy.ts
+var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+var EXTENSION_MIME = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".md": "text/plain",
+  ".markdown": "text/plain",
+  ".csv": "text/plain",
+  ".log": "text/plain",
+  ".json": "application/json",
+  ".xml": "application/xml",
+  ".yaml": "application/yaml",
+  ".yml": "application/yaml",
+  ".html": "text/html",
+  ".conf": "text/plain",
+  ".cfg": "text/plain",
+  ".ini": "text/plain",
+  ".toml": "text/plain"
+};
+var ACCEPTED_MIME = /* @__PURE__ */ new Set([
+  ...Object.values(EXTENSION_MIME),
+  "application/x-yaml"
+]);
+var CHAT_INPUT_FILE_ACCEPT = [
+  ...ACCEPTED_MIME,
+  "text/*",
+  ...Object.keys(EXTENSION_MIME)
+].join(",");
+
 // ../protocol/src/log.ts
 var LOG_SOURCES = ["daemon", "main", "renderer"];
 var LogSourceSchema = external_exports.enum(LOG_SOURCES);

package/dist/cli.cjs

@@ -9669,6 +9669,55 @@ var init_persona_mode = __esm({
   }
 });
 
+// ../protocol/src/attachment-upload-policy.ts
+function resolveAttachmentUploadMime(fileName, mimeType) {
+  const mime = mimeType.split(";", 1)[0].trim().toLowerCase();
+  if (mime === "" || mime === "application/octet-stream") {
+    const extensionIndex = fileName.lastIndexOf(".");
+    const extension2 = extensionIndex > 0 ? fileName.slice(extensionIndex).toLowerCase() : "";
+    return EXTENSION_MIME[extension2] ?? null;
+  }
+  return ACCEPTED_MIME.has(mime) || mime.startsWith("text/") ? mime : null;
+}
+var MAX_ATTACHMENT_BYTES, EXTENSION_MIME, ACCEPTED_MIME, CHAT_INPUT_FILE_ACCEPT;
+var init_attachment_upload_policy = __esm({
+  "../protocol/src/attachment-upload-policy.ts"() {
+    "use strict";
+    MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+    EXTENSION_MIME = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".pdf": "application/pdf",
+      ".txt": "text/plain",
+      ".md": "text/plain",
+      ".markdown": "text/plain",
+      ".csv": "text/plain",
+      ".log": "text/plain",
+      ".json": "application/json",
+      ".xml": "application/xml",
+      ".yaml": "application/yaml",
+      ".yml": "application/yaml",
+      ".html": "text/html",
+      ".conf": "text/plain",
+      ".cfg": "text/plain",
+      ".ini": "text/plain",
+      ".toml": "text/plain"
+    };
+    ACCEPTED_MIME = /* @__PURE__ */ new Set([
+      ...Object.values(EXTENSION_MIME),
+      "application/x-yaml"
+    ]);
+    CHAT_INPUT_FILE_ACCEPT = [
+      ...ACCEPTED_MIME,
+      "text/*",
+      ...Object.keys(EXTENSION_MIME)
+    ].join(",");
+  }
+});
+
 // ../protocol/src/log.ts
 var LOG_SOURCES, LogSourceSchema, LOG_LEVELS, LogLevelSchema, LogRecordSchema;
 var init_log = __esm({
@@ -9825,6 +9874,7 @@ var init_runtime = __esm({
     init_persona_schemas();
     init_persona_mode();
     init_attachment_schemas();
+    init_attachment_upload_policy();
     init_principal();
     init_capability();
     init_inbox();
@@ -61489,6 +61539,7 @@ async function storeGithubAuth(args) {
 init_zod();
 var SLUG = "ottin4ttc/clawos";
 var WORKFLOW = ".github/workflows/base-image-acr.yml";
+var DOCKERFILE = "cloud-host/Dockerfile.base";
 var SHA = external_exports.string().regex(/^[a-f0-9]{40}$/);
 var SourceSchema = external_exports.object({ cloudHost: SHA, workflow: SHA });
 var BaseSchema = external_exports.object({
@@ -61514,6 +61565,25 @@ async function currentSource(api) {
   if (!source.success) throw new Error("\u5E95\u5EA7\u6E90\u7801\u7248\u672C\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5237\u65B0\u540E\u518D\u53D1\u5E03");
   return { commit, source: source.data };
 }
+function dockerfileInputs(text) {
+  if (!/^\s*FROM\s+/im.test(text)) throw new Error("\u8BFB\u4E0D\u5230\u53EF\u4FE1\u7684\u5E95\u5EA7\u6784\u5EFA\u914D\u65B9");
+  const logical = text.replace(/\\\r?\n/g, " ");
+  if (/^\s*RUN\b.*--mount=/im.test(logical)) throw new Error("\u5E95\u5EA7\u6302\u8F7D\u8F93\u5165\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+  const inputs = /* @__PURE__ */ new Set([DOCKERFILE, "cloud-host/.dockerignore", "cloud-host/Dockerfile.base.dockerignore"]);
+  for (const line of logical.split("\n")) {
+    const instruction = /^\s*(?:COPY|ADD)\s+(.+)$/i.exec(line)?.[1];
+    if (!instruction || /^--from=\S+\s/.test(instruction)) continue;
+    const tokens = instruction.startsWith("[") ? JSON.parse(instruction) : instruction.trim().split(/\s+/);
+    if (!Array.isArray(tokens) || tokens.length < 2) throw new Error("\u5E95\u5EA7 COPY \u8F93\u5165\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+    for (const source of tokens.slice(0, -1)) {
+      if (typeof source !== "string" || !/^[A-Za-z0-9_-][A-Za-z0-9_./-]*$/.test(source) || source.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error("\u5E95\u5EA7 COPY \u8F93\u5165\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+      }
+      inputs.add("cloud-host/" + source.replace(/\/$/, ""));
+    }
+  }
+  return inputs;
+}
 async function readCurrentBase(api) {
   const current = await currentSource(api);
   const listed = await api.getJsonStrict(`/repos/${SLUG}/actions/workflows/base-image-acr.yml/runs?branch=release&per_page=1`);
@@ -61535,10 +61605,23 @@ async function readCurrentBase(api) {
   const parsed = BaseSchema.safeParse(await readReleaseArchive(await api.downloadArtifact(SLUG, artifact.id)));
   if (!parsed.success) throw new Error("\u5E95\u5EA7\u5236\u54C1\u7248\u672C\u8BB0\u5F55\u65E0\u6548\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6784\u5EFA");
   const release2 = parsed.data;
-  const matches = (source) => release2.source.cloudHost === source.cloudHost && release2.source.workflow === source.workflow;
-  if (release2.workflowCommit !== run.head_sha || !matches(current.source)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+  const matches = async (candidate) => {
+    if (release2.source.workflow !== candidate.source.workflow) return false;
+    if (release2.source.cloudHost === candidate.source.cloudHost) return true;
+    if (release2.commit === candidate.commit) return false;
+    const comparison = await api.getJsonStrict(`/repos/${SLUG}/compare/${release2.commit}...${candidate.commit}`);
+    if (comparison.status !== "ahead" || !Array.isArray(comparison.files) || comparison.files.length >= 300 || comparison.files.some((file) => typeof file.filename !== "string" || !file.filename)) {
+      throw new Error("\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\u5E95\u5EA7\u8F93\u5165\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+    }
+    if (comparison.files.some((file) => file.filename === DOCKERFILE || file.previous_filename === DOCKERFILE)) return false;
+    const recipe = await api.getJsonStrict(`/repos/${SLUG}/contents/${DOCKERFILE}?ref=${candidate.commit}`);
+    if (recipe.type !== "file" || recipe.encoding !== "base64" || typeof recipe.content !== "string") throw new Error("\u8BFB\u4E0D\u5230\u5E95\u5EA7\u6784\u5EFA\u914D\u65B9");
+    const inputs = dockerfileInputs(Buffer.from(recipe.content, "base64").toString("utf8"));
+    return comparison.files.every((file) => ![file.filename, file.previous_filename].some((filename) => filename && [...inputs].some((input) => filename === input || filename.startsWith(input + "/"))));
+  };
+  if (release2.commit !== run.head_sha || release2.workflowCommit !== run.head_sha || !await matches(current)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
   const after = await currentSource(api);
-  if (!matches(after.source)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
+  if ((after.source.cloudHost !== current.source.cloudHost || after.source.workflow !== current.source.workflow) && !await matches(after)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
   return release2;
 }
 
@@ -69396,25 +69479,12 @@ var EXTENSIONS_IMPORT_CORS_HEADERS = {
   "Access-Control-Allow-Headers": "Authorization, Content-Type",
   "Access-Control-Max-Age": "86400"
 };
-var UPLOAD_MIME_ALLOW = /* @__PURE__ */ new Set([
-  "image/png",
-  "image/jpeg",
-  "image/gif",
-  "image/webp",
-  "application/pdf"
-]);
-var UPLOAD_MIME_ALLOW_PREFIX = ["text/"];
-var UPLOAD_MAX_BYTES = 25 * 1024 * 1024;
 var UPLOAD_CORS_HEADERS = {
   "Access-Control-Allow-Origin": "*",
   "Access-Control-Allow-Methods": "POST, OPTIONS",
   "Access-Control-Allow-Headers": "Authorization, Content-Type",
   "Access-Control-Max-Age": "86400"
 };
-function isUploadMimeAllowed(mime) {
-  if (UPLOAD_MIME_ALLOW.has(mime)) return true;
-  return UPLOAD_MIME_ALLOW_PREFIX.some((p3) => mime.startsWith(p3));
-}
 function isValidUploadFileName(fileName) {
   if (fileName.length === 0) return false;
   if (fileName === "." || fileName === "..") return false;
@@ -69695,14 +69765,15 @@ function createHttpRouter(deps) {
         sendUploadJson(400, { code: "INVALID_PARAM", message: "malformed Content-Length" });
         return true;
       }
-      if (contentLength > UPLOAD_MAX_BYTES) {
+      if (contentLength > MAX_ATTACHMENT_BYTES) {
         sendUploadJson(413, {
           code: "FILE_TOO_LARGE",
-          message: `max ${UPLOAD_MAX_BYTES} bytes`
+          message: `max ${MAX_ATTACHMENT_BYTES} bytes`
         });
         return true;
       }
-      if (!isUploadMimeAllowed(mimeType)) {
+      const resolvedMime = resolveAttachmentUploadMime(fileName, mimeType);
+      if (!resolvedMime) {
         sendUploadJson(400, {
           code: "UNSUPPORTED_MIME",
           message: `mime ${mimeType} not allowed`
@@ -69737,7 +69808,7 @@ function createHttpRouter(deps) {
           sessionId,
           scope,
           fileName,
-          mimeType,
+          mimeType: resolvedMime,
           contentLength,
           body: req,
           groupFileStore: up.groupFileStore
@@ -74335,7 +74406,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.648".length > 0 ? "0.2.648" : "dev";
+var version = "0.2.650".length > 0 ? "0.2.650" : "dev";
 
 // src/cli-probe/probe.ts
 var fs85 = __toESM(require("fs"), 1);