@gmickel/gno 1.24.0 → 1.25.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -1
- package/assets/skill/SKILL.md +11 -0
- package/assets/skill/recipes/capture-and-file.md +20 -5
- package/browser-extension/artifacts/gno-browser-clipper-v1.25.1.zip +0 -0
- package/browser-extension/artifacts/gno-browser-clipper-v1.25.1.zip.sha256 +1 -0
- package/browser-extension/dist/PRIVACY.md +55 -0
- package/browser-extension/dist/chunk-vn5f663b.js +50 -0
- package/browser-extension/dist/chunk-ydfx5d7p.css +1 -0
- package/browser-extension/dist/content.js +1 -0
- package/browser-extension/dist/manifest.json +25 -0
- package/browser-extension/dist/preview.html +13 -0
- package/browser-extension/dist/service-worker.js +40 -0
- package/package.json +13 -3
- package/spec/cli.md +50 -0
- package/spec/db/schema.sql +101 -0
- package/spec/mcp.md +10 -0
- package/spec/output-schemas/browser-clip-preview.schema.json +83 -0
- package/spec/output-schemas/browser-clip.schema.json +586 -0
- package/spec/output-schemas/capture-receipt.schema.json +22 -1
- package/spec/output-schemas/clipper-csrf.schema.json +12 -0
- package/spec/output-schemas/clipper-error.schema.json +46 -0
- package/spec/output-schemas/clipper-pair-approval.schema.json +17 -0
- package/spec/output-schemas/clipper-pair-start.schema.json +26 -0
- package/spec/output-schemas/clipper-pair-status.schema.json +46 -0
- package/spec/output-schemas/clipper-revoke.schema.json +28 -0
- package/spec/output-schemas/mcp-capture-result.schema.json +12 -1
- package/src/core/browser-clip-provenance.ts +139 -0
- package/src/core/browser-clip.ts +473 -0
- package/src/core/capture-write.ts +5 -0
- package/src/core/capture.ts +75 -18
- package/src/core/file-lock.ts +20 -6
- package/src/serve/capture-service.ts +420 -0
- package/src/serve/clipper-body.ts +62 -0
- package/src/serve/clipper-capture.ts +248 -0
- package/src/serve/clipper-contract.ts +57 -0
- package/src/serve/clipper-idempotency.ts +35 -0
- package/src/serve/clipper-pairing.ts +297 -0
- package/src/serve/clipper-security-errors.ts +23 -0
- package/src/serve/clipper-security.ts +449 -0
- package/src/serve/public/app.tsx +8 -1
- package/src/serve/public/globals.built.css +1 -1
- package/src/serve/public/index.html +1 -0
- package/src/serve/public/lib/clipper-approval.ts +206 -0
- package/src/serve/public/pages/ClipperPairing.tsx +210 -0
- package/src/serve/routes/api.ts +19 -115
- package/src/serve/routes/clipper.ts +394 -0
- package/src/serve/server.ts +22 -0
- package/src/store/migrations/020-browser-clipper-security.ts +128 -0
- package/src/store/migrations/index.ts +2 -0
- package/src/store/sqlite/clipper-store-types.ts +104 -0
- package/src/store/sqlite/clipper-store.ts +496 -0
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "gno://schemas/clipper-error@1.0",
|
|
4
|
+
"title": "Browser Clipper Error",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["error"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"error": {
|
|
10
|
+
"type": "object",
|
|
11
|
+
"additionalProperties": false,
|
|
12
|
+
"required": ["code", "message"],
|
|
13
|
+
"properties": {
|
|
14
|
+
"code": {
|
|
15
|
+
"enum": [
|
|
16
|
+
"CLIPPER_ABORTED",
|
|
17
|
+
"CLIPPER_BODY_TOO_LARGE",
|
|
18
|
+
"CLIPPER_BUSY",
|
|
19
|
+
"CLIPPER_FORBIDDEN",
|
|
20
|
+
"CLIPPER_INVALID_JSON",
|
|
21
|
+
"CLIPPER_RATE_LIMITED",
|
|
22
|
+
"CLIPPER_UNAUTHORIZED",
|
|
23
|
+
"CLIPPER_PAIRING_UNAVAILABLE",
|
|
24
|
+
"CLIPPER_CSRF",
|
|
25
|
+
"CLIPPER_INVALID_REQUEST",
|
|
26
|
+
"CLIPPER_PAIR_NOT_FOUND",
|
|
27
|
+
"CLIPPER_PAIR_EXPIRED",
|
|
28
|
+
"CLIPPER_PAIR_INVALID_CODE",
|
|
29
|
+
"CLIPPER_PAIR_ALREADY_USED",
|
|
30
|
+
"CLIPPER_PREVIEW_MISMATCH",
|
|
31
|
+
"CLIPPER_PREVIEW_REQUIRED",
|
|
32
|
+
"CLIPPER_IDEMPOTENCY_PENDING",
|
|
33
|
+
"CLIPPER_IDEMPOTENCY_CONFLICT",
|
|
34
|
+
"CLIPPER_IDEMPOTENCY_RECOVERY_CONFLICT",
|
|
35
|
+
"CLIPPER_IDEMPOTENCY_GRANT_INACTIVE",
|
|
36
|
+
"CLIPPER_CAPTURE_FAILED",
|
|
37
|
+
"NOT_FOUND",
|
|
38
|
+
"RUNTIME",
|
|
39
|
+
"VALIDATION"
|
|
40
|
+
]
|
|
41
|
+
},
|
|
42
|
+
"message": { "type": "string", "minLength": 1 }
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
}
|
|
46
|
+
}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "gno://schemas/clipper-pair-approval@1.0",
|
|
4
|
+
"title": "Browser Clipper Pair Approval",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["schemaVersion", "status", "origin", "expiresAt"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"schemaVersion": { "const": "1.0" },
|
|
10
|
+
"status": { "const": "approved" },
|
|
11
|
+
"origin": {
|
|
12
|
+
"type": "string",
|
|
13
|
+
"pattern": "^chrome-extension://[a-p]{32}$"
|
|
14
|
+
},
|
|
15
|
+
"expiresAt": { "type": "string", "format": "date-time" }
|
|
16
|
+
}
|
|
17
|
+
}
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "gno://schemas/clipper-pair-start@1.0",
|
|
4
|
+
"title": "Browser Clipper Pair Start",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": [
|
|
8
|
+
"schemaVersion",
|
|
9
|
+
"pairId",
|
|
10
|
+
"pairingCode",
|
|
11
|
+
"expiresAt",
|
|
12
|
+
"origin",
|
|
13
|
+
"approvalPath"
|
|
14
|
+
],
|
|
15
|
+
"properties": {
|
|
16
|
+
"schemaVersion": { "const": "1.0" },
|
|
17
|
+
"pairId": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
|
|
18
|
+
"pairingCode": { "type": "string", "pattern": "^[0-9]{8}$" },
|
|
19
|
+
"expiresAt": { "type": "string", "format": "date-time" },
|
|
20
|
+
"origin": {
|
|
21
|
+
"type": "string",
|
|
22
|
+
"pattern": "^chrome-extension://[a-p]{32}$"
|
|
23
|
+
},
|
|
24
|
+
"approvalPath": { "const": "/api/clipper/pair/approve" }
|
|
25
|
+
}
|
|
26
|
+
}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "gno://schemas/clipper-pair-status@1.0",
|
|
4
|
+
"title": "Browser Clipper Pair Status",
|
|
5
|
+
"oneOf": [
|
|
6
|
+
{
|
|
7
|
+
"type": "object",
|
|
8
|
+
"additionalProperties": false,
|
|
9
|
+
"required": ["schemaVersion", "status", "expiresAt"],
|
|
10
|
+
"properties": {
|
|
11
|
+
"schemaVersion": { "const": "1.0" },
|
|
12
|
+
"status": { "const": "pending" },
|
|
13
|
+
"expiresAt": { "type": "string", "format": "date-time" }
|
|
14
|
+
}
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"type": "object",
|
|
18
|
+
"additionalProperties": false,
|
|
19
|
+
"required": [
|
|
20
|
+
"schemaVersion",
|
|
21
|
+
"status",
|
|
22
|
+
"grantId",
|
|
23
|
+
"grantToken",
|
|
24
|
+
"expiresAt"
|
|
25
|
+
],
|
|
26
|
+
"properties": {
|
|
27
|
+
"schemaVersion": { "const": "1.0" },
|
|
28
|
+
"status": { "const": "approved" },
|
|
29
|
+
"grantId": { "type": "string", "format": "uuid" },
|
|
30
|
+
"grantToken": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
|
|
31
|
+
"expiresAt": { "type": "string", "format": "date-time" }
|
|
32
|
+
}
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"type": "object",
|
|
36
|
+
"additionalProperties": false,
|
|
37
|
+
"required": ["schemaVersion", "status"],
|
|
38
|
+
"properties": {
|
|
39
|
+
"schemaVersion": { "const": "1.0" },
|
|
40
|
+
"status": {
|
|
41
|
+
"enum": ["consumed", "expired", "not_found", "origin_mismatch"]
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
]
|
|
46
|
+
}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "gno://schemas/clipper-revoke@1.0",
|
|
4
|
+
"title": "Browser Clipper Grant Revocation",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["schemaVersion", "grantId", "status"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"schemaVersion": { "const": "1.0" },
|
|
10
|
+
"grantId": { "type": "string", "format": "uuid" },
|
|
11
|
+
"status": {
|
|
12
|
+
"enum": ["revoked", "already_revoked", "expired", "not_found"]
|
|
13
|
+
},
|
|
14
|
+
"revokedAt": { "type": "string", "format": "date-time" }
|
|
15
|
+
},
|
|
16
|
+
"allOf": [
|
|
17
|
+
{
|
|
18
|
+
"if": { "properties": { "status": { "const": "revoked" } } },
|
|
19
|
+
"then": {
|
|
20
|
+
"properties": {
|
|
21
|
+
"revokedAt": { "type": "string", "format": "date-time" }
|
|
22
|
+
},
|
|
23
|
+
"required": ["revokedAt"]
|
|
24
|
+
},
|
|
25
|
+
"else": { "not": { "required": ["revokedAt"] } }
|
|
26
|
+
}
|
|
27
|
+
]
|
|
28
|
+
}
|
|
@@ -89,9 +89,20 @@
|
|
|
89
89
|
"mime": { "type": "string" },
|
|
90
90
|
"ext": { "type": "string" },
|
|
91
91
|
"author": { "type": "string" },
|
|
92
|
+
"canonicalUrl": { "type": "string", "format": "uri" },
|
|
93
|
+
"site": { "type": "string" },
|
|
94
|
+
"publishedAt": {
|
|
95
|
+
"oneOf": [
|
|
96
|
+
{ "type": "string", "format": "date" },
|
|
97
|
+
{ "type": "string", "format": "date-time" }
|
|
98
|
+
]
|
|
99
|
+
},
|
|
92
100
|
"observedAt": { "type": "string", "format": "date-time" },
|
|
93
101
|
"capturedAt": { "type": "string", "format": "date-time" },
|
|
94
|
-
"externalId": { "type": "string" }
|
|
102
|
+
"externalId": { "type": "string" },
|
|
103
|
+
"browserClip": {
|
|
104
|
+
"$ref": "gno://schemas/browser-clip@1.0#/definitions/provenance"
|
|
105
|
+
}
|
|
95
106
|
}
|
|
96
107
|
},
|
|
97
108
|
"tags": {
|
|
@@ -0,0 +1,139 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
|
|
3
|
+
export const BROWSER_CLIP_SCHEMA_VERSION = "1.0" as const;
|
|
4
|
+
export const BROWSER_CLIP_MAX_BYTES = 512 * 1024;
|
|
5
|
+
|
|
6
|
+
export const BROWSER_CLIP_WARNING_CODES = [
|
|
7
|
+
"authenticated_visible_content",
|
|
8
|
+
"canonical_url_differs",
|
|
9
|
+
"edited_content",
|
|
10
|
+
"line_endings_normalized",
|
|
11
|
+
"reader_partial",
|
|
12
|
+
"selection_truncated",
|
|
13
|
+
"spa_snapshot",
|
|
14
|
+
"unicode_normalized",
|
|
15
|
+
] as const;
|
|
16
|
+
|
|
17
|
+
export const BROWSER_CLIP_HTTP_URL_PATTERN =
|
|
18
|
+
"^[Hh][Tt][Tt][Pp][Ss]?://(?:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)*[A-Za-z](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?::(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:(?:/(?:[A-Za-z0-9._~!$&'()*+,;=:@-]|%[0-9A-Fa-f]{2})*)*)(?:\\?(?:[A-Za-z0-9._~!$&'()*+,;=:@/?-]|%[0-9A-Fa-f]{2})*)?(?:#(?:[A-Za-z0-9._~!$&'()*+,;=:@/?-]|%[0-9A-Fa-f]{2})*)?$";
|
|
19
|
+
|
|
20
|
+
const hasDisallowedControlCharacter = (value: string): boolean => {
|
|
21
|
+
for (const character of value) {
|
|
22
|
+
const codePoint = character.codePointAt(0);
|
|
23
|
+
if (
|
|
24
|
+
codePoint !== undefined &&
|
|
25
|
+
(codePoint <= 8 ||
|
|
26
|
+
codePoint === 11 ||
|
|
27
|
+
codePoint === 12 ||
|
|
28
|
+
(codePoint >= 14 && codePoint <= 31) ||
|
|
29
|
+
(codePoint >= 127 && codePoint <= 159))
|
|
30
|
+
) {
|
|
31
|
+
return true;
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
return false;
|
|
35
|
+
};
|
|
36
|
+
|
|
37
|
+
export const findDisallowedBrowserClipControlPath = (
|
|
38
|
+
value: unknown,
|
|
39
|
+
path: Array<string | number> = []
|
|
40
|
+
): Array<string | number> | null => {
|
|
41
|
+
if (typeof value === "string") {
|
|
42
|
+
return hasDisallowedControlCharacter(value) ? path : null;
|
|
43
|
+
}
|
|
44
|
+
if (Array.isArray(value)) {
|
|
45
|
+
for (const [index, child] of value.entries()) {
|
|
46
|
+
const match = findDisallowedBrowserClipControlPath(child, [
|
|
47
|
+
...path,
|
|
48
|
+
index,
|
|
49
|
+
]);
|
|
50
|
+
if (match !== null) return match;
|
|
51
|
+
}
|
|
52
|
+
return null;
|
|
53
|
+
}
|
|
54
|
+
if (value !== null && typeof value === "object") {
|
|
55
|
+
for (const [key, child] of Object.entries(value)) {
|
|
56
|
+
const match = findDisallowedBrowserClipControlPath(child, [...path, key]);
|
|
57
|
+
if (match !== null) return match;
|
|
58
|
+
}
|
|
59
|
+
}
|
|
60
|
+
return null;
|
|
61
|
+
};
|
|
62
|
+
|
|
63
|
+
export const browserClipHttpUrlSchema = z
|
|
64
|
+
.string()
|
|
65
|
+
.max(4096)
|
|
66
|
+
.regex(
|
|
67
|
+
new RegExp(BROWSER_CLIP_HTTP_URL_PATTERN, "u"),
|
|
68
|
+
"URL must use the browser clip HTTP(S) URL subset"
|
|
69
|
+
);
|
|
70
|
+
|
|
71
|
+
const publishedAtSchema = z.union([
|
|
72
|
+
z.string().date(),
|
|
73
|
+
z.string().datetime({ offset: true }),
|
|
74
|
+
]);
|
|
75
|
+
|
|
76
|
+
const browserSchema = z
|
|
77
|
+
.object({
|
|
78
|
+
name: z.string().min(1).max(128),
|
|
79
|
+
version: z.string().max(128).nullable(),
|
|
80
|
+
platform: z.string().max(128).nullable(),
|
|
81
|
+
})
|
|
82
|
+
.strict();
|
|
83
|
+
|
|
84
|
+
const sha256Schema = z.string().regex(/^[a-f0-9]{64}$/);
|
|
85
|
+
|
|
86
|
+
export const browserClipProvenanceSchema = z
|
|
87
|
+
.object({
|
|
88
|
+
schemaVersion: z.literal(BROWSER_CLIP_SCHEMA_VERSION),
|
|
89
|
+
mode: z.enum(["selection", "reader"]),
|
|
90
|
+
sourceUrl: browserClipHttpUrlSchema,
|
|
91
|
+
canonicalUrl: browserClipHttpUrlSchema.nullable(),
|
|
92
|
+
title: z.string().min(1).max(2048),
|
|
93
|
+
author: z.string().max(1024).nullable(),
|
|
94
|
+
site: z.string().max(1024).nullable(),
|
|
95
|
+
publishedAt: publishedAtSchema.nullable(),
|
|
96
|
+
observedAt: z.string().datetime({ offset: true }),
|
|
97
|
+
capturedAt: z.string().datetime({ offset: true }),
|
|
98
|
+
extractionHash: sha256Schema,
|
|
99
|
+
finalBodyHash: sha256Schema,
|
|
100
|
+
clipIdentity: sha256Schema,
|
|
101
|
+
previewDigest: sha256Schema,
|
|
102
|
+
exactSelection: z.string().min(1).max(BROWSER_CLIP_MAX_BYTES).nullable(),
|
|
103
|
+
extractionWarnings: z.array(z.enum(BROWSER_CLIP_WARNING_CODES)).max(16),
|
|
104
|
+
browser: browserSchema,
|
|
105
|
+
})
|
|
106
|
+
.strict()
|
|
107
|
+
.superRefine((value, context) => {
|
|
108
|
+
const controlPath = findDisallowedBrowserClipControlPath(value);
|
|
109
|
+
if (controlPath !== null) {
|
|
110
|
+
context.addIssue({
|
|
111
|
+
code: "custom",
|
|
112
|
+
message: "Browser clip text cannot contain C0 or C1 control characters",
|
|
113
|
+
path: controlPath,
|
|
114
|
+
});
|
|
115
|
+
}
|
|
116
|
+
if (
|
|
117
|
+
new Set(value.extractionWarnings).size !== value.extractionWarnings.length
|
|
118
|
+
) {
|
|
119
|
+
context.addIssue({
|
|
120
|
+
code: "custom",
|
|
121
|
+
message: "Warning codes must be unique",
|
|
122
|
+
path: ["extractionWarnings"],
|
|
123
|
+
});
|
|
124
|
+
}
|
|
125
|
+
if (
|
|
126
|
+
(value.mode === "selection" && value.exactSelection === null) ||
|
|
127
|
+
(value.mode === "reader" && value.exactSelection !== null)
|
|
128
|
+
) {
|
|
129
|
+
context.addIssue({
|
|
130
|
+
code: "custom",
|
|
131
|
+
message: "Exact selection must match the extraction mode",
|
|
132
|
+
path: ["exactSelection"],
|
|
133
|
+
});
|
|
134
|
+
}
|
|
135
|
+
});
|
|
136
|
+
|
|
137
|
+
export type BrowserClipProvenance = z.infer<typeof browserClipProvenanceSchema>;
|
|
138
|
+
export type BrowserClipWarningCode =
|
|
139
|
+
(typeof BROWSER_CLIP_WARNING_CODES)[number];
|