@forwardimpact/libbridge 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forwardimpact/libbridge",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Threaded-channel bridge primitives — relay messages between human channels (GitHub Discussions, Microsoft Teams) and the Kata agent team.",
   "keywords": [
     "bridge",
@@ -50,7 +50,7 @@
   },
   "engines": {
     "bun": ">=1.2.0",
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "publishConfig": {
     "access": "public"

package/src/callback-handler.js

@@ -134,6 +134,19 @@ async function resolveContext(
   return { token, ctx, meta, payload };
 }
 
+const STATUS_MESSAGES = {
+  400: "Bad request",
+  404: "Not found",
+  410: "Gone",
+  429: "Too many requests",
+  500: "Internal error",
+};
+
+/** Map a CallbackHandlerError status to a safe generic message. */
+function sanitizeErrorMessage(status) {
+  return STATUS_MESSAGES[status] ?? `Error ${status}`;
+}
+
 async function runHandleReply(
   c,
   { ctx, meta, payload, handleReply, store, logger, tracer, spanName },
@@ -154,7 +167,7 @@ async function runHandleReply(
     if (err instanceof CallbackHandlerError) {
       span.addEvent("short_circuit", { status: err.status });
       span.setOk();
-      return c.json({ error: err.message }, err.status);
+      return c.json({ error: sanitizeErrorMessage(err.status) }, err.status);
     }
     logger.error?.("callback", err, {
       correlation_id: meta.correlationId,

package/src/callback-payload.js

@@ -1,4 +1,5 @@
 export const MAX_FIELD_LENGTH = 2000;
+export const MAX_REPLY_COUNT = 50;
 
 /**
  * Validate and sanitize the kata-dispatch callback payload. Lenient by
@@ -23,11 +24,17 @@ export function validateCallbackPayload(body) {
     typeof body.summary === "string"
       ? body.summary.slice(0, MAX_FIELD_LENGTH)
       : "";
-  const replies = Array.isArray(body.replies) ? body.replies : [];
+  const rawReplies = Array.isArray(body.replies) ? body.replies : [];
+  const replies = rawReplies.slice(0, MAX_REPLY_COUNT).map((r) => {
+    if (!r || typeof r !== "object") return r;
+    if (typeof r.body === "string") {
+      return { ...r, body: r.body.slice(0, MAX_FIELD_LENGTH) };
+    }
+    return r;
+  });
   const discussionId =
     typeof body.discussion_id === "string" ? body.discussion_id : undefined;
-  const trigger =
-    body.trigger && typeof body.trigger === "object" ? body.trigger : undefined;
+  const trigger = validateTrigger(body.trigger);
   const runUrl = typeof body.run_url === "string" ? body.run_url : undefined;
 
   return {
@@ -41,6 +48,33 @@ export function validateCallbackPayload(body) {
   };
 }
 
+const ALLOWED_TRIGGER_KINDS = new Set(["responses", "elapsed", "any"]);
+
+/**
+ * Validate and sanitize a trigger object at the payload boundary.
+ * Rejects triggers with unknown `kind` values or invalid field types.
+ *
+ * @param {unknown} raw
+ * @returns {object | undefined}
+ */
+function validateTrigger(raw) {
+  if (!raw || typeof raw !== "object") return undefined;
+  if (typeof raw.kind !== "string" || !ALLOWED_TRIGGER_KINDS.has(raw.kind)) {
+    return undefined;
+  }
+  const trigger = { kind: raw.kind };
+  if (raw.responses !== undefined) {
+    const n = Number(raw.responses);
+    if (!Number.isFinite(n) || n < 0) return undefined;
+    trigger.responses = n;
+  }
+  if (raw.elapsed !== undefined) {
+    if (typeof raw.elapsed !== "string") return undefined;
+    trigger.elapsed = raw.elapsed;
+  }
+  return trigger;
+}
+
 /**
  * Strip trailing slashes from a base URL so callback URL composition is
  * deterministic regardless of operator input.

package/src/index.js

@@ -17,6 +17,7 @@ export { appendHistory } from "./history.js";
 export { RateLimiter } from "./rate-limit.js";
 export { dispatchWorkflow } from "./dispatch.js";
 export { DiscussionContextStore } from "./discussion-context.js";
+export { OriginIndex } from "./origin-index.js";
 export { ProgressTicker } from "./progress-ticker.js";
 export {
   Acknowledgement,
@@ -31,6 +32,7 @@ export { ElapsedScheduler } from "./elapsed-scheduler.js";
 export { ResumeScheduler } from "./resume-scheduler.js";
 export {
   MAX_FIELD_LENGTH,
+  MAX_REPLY_COUNT,
   newDiscussionContext,
   normalizeBaseUrl,
   validateCallbackPayload,

package/src/origin-index.js

@@ -0,0 +1,49 @@
+import { BufferedIndex } from "@forwardimpact/libindex";
+
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Tracks comment IDs posted by the bridge so webhook handlers can skip
+ * dispatching for self-originated events. Wraps `BufferedIndex` with
+ * caller-injected `StorageInterface` per the libbridge invariant.
+ *
+ * Record shape: `{ id: "<comment_node_id>", discussion_id, posted_at }`
+ *
+ * @augments BufferedIndex
+ */
+export class OriginIndex extends BufferedIndex {
+  #ttlMs;
+
+  /**
+   * @param {import("@forwardimpact/libstorage").StorageInterface} storage
+   * @param {object} [options]
+   * @param {string} [options.indexKey]
+   * @param {number} [options.ttlMs] - Eviction window (default 24h)
+   */
+  constructor(
+    storage,
+    { indexKey = "origins.jsonl", ttlMs = DEFAULT_TTL_MS } = {},
+  ) {
+    super(storage, indexKey, {
+      flush_interval: 1_000,
+      max_buffer_size: 100,
+    });
+    this.#ttlMs = ttlMs;
+  }
+
+  /**
+   * Evict records older than `ttlMs`.
+   * @param {number} now
+   * @returns {number} count evicted
+   */
+  sweep(now) {
+    let evicted = 0;
+    for (const [id, record] of this.index) {
+      if (now - (record?.posted_at ?? 0) > this.#ttlMs) {
+        this.index.delete(id);
+        evicted++;
+      }
+    }
+    return evicted;
+  }
+}

package/src/server.js

@@ -1,4 +1,5 @@
 import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
 import { serve } from "@hono/node-server";
 
 /**
@@ -44,6 +45,17 @@ export function createBridgeServer({
 
   const app = new Hono();
 
+  // Security headers — standard hardening for a backend service.
+  app.use("*", async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "DENY");
+    c.header("Cache-Control", "no-store");
+  });
+
+  // Request body size limit — 1 MB is generous for JSON callback payloads.
+  app.use("*", bodyLimit({ maxSize: 1024 * 1024 }));
+
   // Capture the raw POST body once, before downstream handlers parse it.
   // Channel adapters use this buffer to verify HMAC signatures.
   app.use("*", async (c, next) => {