@goodandready/dsh-messenger-gateway 0.4.10 → 0.4.11

package/lib/ask.js

@@ -56,7 +56,9 @@ export function buildInlineKeyboard(token, buttons) {
 
 export function normalizeAskOptions(options = []) {
   if (Array.isArray(options)) {
-    const flat = options.flat ? options.flat() : [].concat(...options)
+    const flat = typeof options.flat === 'function'
+      ? options.flat()
+      : options.reduce((acc, item) => acc.concat(item), [])
     return flat.map((opt, i) => {
       if (typeof opt === 'string') return { id: String(i + 1), text: opt, selected: false }
       const id = String(opt?.id ?? opt?.buttonId ?? i + 1).trim()

package/lib/documents.js

@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises'
+import { open } from 'node:fs/promises'
 import { extname } from 'node:path'
 import { inflateRawSync } from 'node:zlib'
 
@@ -132,7 +132,36 @@ export async function parseDocument(filePath, opts = {}) {
   const ext = extname(filePath).toLowerCase()
 
   try {
-    const rawBuffer = await readFile(filePath)
+    const handle = await open(filePath, 'r')
+    let rawBuffer
+    let truncated = false
+    let originalLength = 0
+
+    try {
+      const st = await handle.stat()
+      originalLength = st.size
+
+      if (TEXT_INJECT_EXTS.has(ext)) {
+        const toRead = Math.min(st.size, maxBytes)
+        const buf = Buffer.alloc(toRead)
+        const { bytesRead } = await handle.read(buf, 0, toRead, 0)
+        rawBuffer = buf.subarray(0, bytesRead)
+        truncated = st.size > toRead
+      } else if (ext === '.pdf' || ext === '.docx') {
+        const maxBinary = Math.max(maxBytes * 4, 10 * 1024 * 1024)
+        if (st.size > maxBinary) {
+          return { parsed: false, error: `File size (${st.size} bytes) exceeds safety parse limit` }
+        }
+        const buf = Buffer.alloc(st.size)
+        const { bytesRead } = await handle.read(buf, 0, st.size, 0)
+        rawBuffer = buf.subarray(0, bytesRead)
+      } else {
+        return { parsed: false, type: 'unsupported' }
+      }
+    } finally {
+      await handle.close()
+    }
+
     let text = ''
     let parsedType = 'text'
 
@@ -145,15 +174,11 @@ export async function parseDocument(filePath, opts = {}) {
     } else if (TEXT_INJECT_EXTS.has(ext)) {
       parsedType = ext.slice(1)
       text = rawBuffer.toString('utf8')
-    } else {
-      return { parsed: false, type: 'unsupported' }
     }
 
     text = text.trim()
     if (!text) return { parsed: false, type: parsedType }
 
-    const originalLength = text.length
-    let truncated = false
     if (text.length > maxBytes) {
       text = text.slice(0, maxBytes)
       truncated = true
@@ -164,9 +189,10 @@ export async function parseDocument(filePath, opts = {}) {
       type: parsedType,
       text,
       truncated,
-      originalLength,
+      originalLength: originalLength || text.length,
     }
   } catch (err) {
     return { parsed: false, error: err.message }
   }
 }
+

package/lib/messenger-api.js

@@ -110,7 +110,29 @@ export function normalizeFiles(files) {
       err.status = 400
       throw err
     }
-    if (file.bytes) return file
+    if (file.bytes !== undefined) {
+      let buf = null
+      if (Buffer.isBuffer(file.bytes) || file.bytes instanceof Uint8Array) {
+        buf = Buffer.from(file.bytes)
+      } else if (Array.isArray(file.bytes)) {
+        buf = Buffer.from(file.bytes)
+      } else if (file.bytes && typeof file.bytes === 'object' && file.bytes.type === 'Buffer' && Array.isArray(file.bytes.data)) {
+        buf = Buffer.from(file.bytes.data)
+      } else if (typeof file.bytes === 'string') {
+        buf = Buffer.from(file.bytes, 'utf8')
+      }
+      if (!buf) {
+        const err = new Error(`files[${i}].bytes must be a Buffer, Uint8Array, or array of bytes`)
+        err.status = 400
+        throw err
+      }
+      return {
+        bytes: buf,
+        mime: file.mime || 'application/octet-stream',
+        kind: file.kind || 'document',
+        name: file.name || 'file',
+      }
+    }
     if (typeof file.dataBase64 === 'string') {
       return {
         bytes: Buffer.from(file.dataBase64, 'base64'),

package/lib/outbound.js

@@ -72,12 +72,54 @@ export async function readAttachmentBytes(ctx, ref) {
   }
 }
 
-export async function fetchInternalImage(baseUrl, path, signal) {
+export async function fetchInternalImage(baseUrl, path, signal, opts = {}) {
+  const { timeoutMs = 15_000, maxBytes = 20 * 1024 * 1024 } = opts
+  const timeoutSignal = AbortSignal.timeout(timeoutMs)
+  const effectiveSignal = signal
+    ? (typeof AbortSignal.any === 'function' ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal)
+    : timeoutSignal
+
   const url = new URL(path, baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`)
-  const res = await fetch(url, { signal })
+  const res = await fetch(url, { signal: effectiveSignal })
   if (!res.ok) throw new Error(`image fetch HTTP ${res.status}`)
-  const bytes = new Uint8Array(await res.arrayBuffer())
-  const mime = res.headers.get('content-type') || 'image/png'
+
+  const clHeader = res.headers?.get?.('content-length')
+  const cl = Number(clHeader)
+  if (Number.isFinite(cl) && cl > maxBytes) {
+    throw new Error(`image size (${cl} bytes) exceeds limit of ${maxBytes} bytes`)
+  }
+
+  let bytes
+  if (res.body && typeof res.body.getReader === 'function') {
+    const reader = res.body.getReader()
+    const chunks = []
+    let total = 0
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      total += value.length
+      if (total > maxBytes) {
+        reader.cancel().catch(() => {})
+        throw new Error(`image size exceeds limit of ${maxBytes} bytes`)
+      }
+      chunks.push(value)
+    }
+    const combined = new Uint8Array(total)
+    let offset = 0
+    for (const chunk of chunks) {
+      combined.set(chunk, offset)
+      offset += chunk.length
+    }
+    bytes = combined
+  } else {
+    const ab = await res.arrayBuffer()
+    if (ab.byteLength > maxBytes) {
+      throw new Error(`image size exceeds limit of ${maxBytes} bytes`)
+    }
+    bytes = new Uint8Array(ab)
+  }
+
+  const mime = res.headers?.get?.('content-type') || 'image/png'
   const fromQuery = url.searchParams.get('id') || url.searchParams.get('name')
   const name = fromQuery ? `image-${fromQuery.slice(0, 32)}.png` : 'image.png'
   return { bytes, mime, kind: 'photo', name }
@@ -87,7 +129,7 @@ const DEFAULT_MAX_OUTBOUND_FILES = 10
 
 /** Build Telegram-ready files from assistant image blocks and inline plugin URLs. */
 export async function buildOutboundFiles(ctx, baseUrl, collector, opts = {}) {
-  const { signal, logger, maxFiles = DEFAULT_MAX_OUTBOUND_FILES } = opts
+  const { signal, logger, maxFiles = DEFAULT_MAX_OUTBOUND_FILES, maxImageBytes, imageTimeoutMs } = opts
   const files = []
   const refs = dedupeAttachmentRefs(collector.images)
   for (const ref of refs) {
@@ -104,7 +146,10 @@ export async function buildOutboundFiles(ctx, baseUrl, collector, opts = {}) {
     if (files.length >= maxFiles) break
     if (signal?.aborted) break
     try {
-      files.push(await fetchInternalImage(baseUrl, path, signal))
+      files.push(await fetchInternalImage(baseUrl, path, signal, {
+        maxBytes: maxImageBytes,
+        timeoutMs: imageTimeoutMs,
+      }))
     } catch (e) {
       logger?.warn?.(`outbound url image: ${e.message}`)
     }

package/lib/personas.js

@@ -1,5 +1,5 @@
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
-import { dirname } from 'node:path'
+import { readFileSync } from 'node:fs'
+import { writeJsonAtomicSync } from './storage-atomic.js'
 
 export const BUILTIN_PERSONAS = {
   default: {
@@ -87,8 +87,7 @@ export function createPersonaStore(filePath, { logger } = {}) {
 
   function save() {
     try {
-      mkdirSync(dirname(filePath), { recursive: true })
-      writeFileSync(filePath, JSON.stringify(cache, null, 2), 'utf8')
+      writeJsonAtomicSync(filePath, cache)
     } catch (err) {
       logger?.warn?.('[dsh-messenger-gateway] personas save error:', err?.message || err)
     }

package/lib/scheduler.js

@@ -42,10 +42,16 @@ export function createScheduler(filePath, onDue, options = {}) {
   async function load() {
     try {
       const raw = await readFile(filePath, 'utf8')
-      tasks = JSON.parse(raw)
+      const parsed = JSON.parse(raw)
+      if (Array.isArray(parsed)) {
+        tasks = parsed
+      } else {
+        logger?.warn?.(`[dsh-messenger-gateway] scheduler invalid tasks payload in ${filePath}: expected array, got ${typeof parsed}; resetting to empty list`)
+        tasks = []
+      }
     } catch (err) {
       if (err?.code !== 'ENOENT') {
-        logger?.debug?.('[dsh-messenger-gateway] scheduler load error:', err?.message || err)
+        logger?.warn?.('[dsh-messenger-gateway] scheduler load error:', err?.message || err)
       }
       tasks = []
     }
@@ -56,6 +62,7 @@ export function createScheduler(filePath, onDue, options = {}) {
 
   async function save() {
     if (!filePath) return
+    if (!Array.isArray(tasks)) tasks = []
     try {
       const now = Date.now()
       tasks = tasks.filter((t) => {
@@ -71,6 +78,7 @@ export function createScheduler(filePath, onDue, options = {}) {
 
   async function checkDue() {
     if (!loaded) await load()
+    if (!Array.isArray(tasks)) tasks = []
     const now = Date.now()
     const due = tasks.filter((t) => t.status === 'pending' && t.dueAt <= now)
 
@@ -99,10 +107,10 @@ export function createScheduler(filePath, onDue, options = {}) {
   function start(intervalMs = 5000) {
     if (timer) clearInterval(timer)
     timer = setInterval(() => {
-      checkDue().catch((err) => { logger?.debug?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
+      checkDue().catch((err) => { logger?.warn?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
     }, intervalMs)
     timer.unref?.()
-    checkDue().catch((err) => { logger?.debug?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
+    checkDue().catch((err) => { logger?.warn?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
   }
 
   function stop() {

package/lib/settings-bridge.js

@@ -78,7 +78,7 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
     source = () => currentConfig
 
     const persist = async (next) => {
-      const payload = Config(next)
+      const payload = resolveConfig(next)
       if (typeof service.replace === 'function') {
         await service.replace(namespace, payload, getRevision())
       } else if (typeof service.update === 'function') {
@@ -88,7 +88,7 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
       } else {
         throw new Error('settings service cannot persist configuration')
       }
-      currentConfig = resolveConfig(payload)
+      currentConfig = payload
       sync()
       for (const cb of watchers) {
         try { cb(currentConfig) } catch (err) { logger?.debug?.(`${namespace}: watcher error:`, err?.message || err) }

package/lib/storage-atomic.js

@@ -1,4 +1,5 @@
 import { writeFile, rename, mkdir, unlink } from 'node:fs/promises'
+import { writeFileSync, renameSync, mkdirSync, unlinkSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { randomUUID } from 'node:crypto'
 
@@ -18,4 +19,20 @@ export async function writeJsonAtomic(filePath, data) {
     await unlink(tmpPath).catch(() => {})
     throw err
   }
+}
+
+/**
+ * Synchronous atomic JSON write via temporary file and rename.
+ */
+export function writeJsonAtomicSync(filePath, data) {
+  const dir = dirname(filePath)
+  mkdirSync(dir, { recursive: true })
+  const tmpPath = `${filePath}.${randomUUID().slice(0, 8)}.tmp`
+  try {
+    writeFileSync(tmpPath, JSON.stringify(data, null, 2), 'utf8')
+    renameSync(tmpPath, filePath)
+  } catch (err) {
+    try { unlinkSync(tmpPath) } catch { /* ignore */ }
+    throw err
+  }
 }

package/lib/updater.js

@@ -181,15 +181,20 @@ export async function getUpdateStatus(options, target = runtime()) {
   }
 }
 
+export function buildUpdateArgs(target, packageSpec, options = {}) {
+  return [
+    target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+    packageSpec,
+    `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+  ]
+}
+
 export async function installExact(target, packageSpec, options = {}) {
   if (target.cliEntry === undefined) throw new Error('Automatic update CLI entry is unavailable in this runtime.')
   return new Promise((resolvePromise, reject) => {
-    const args = [
-      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
-      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
-    ]
-    const child = spawn(process.execPath, args, {
+    const args = buildUpdateArgs(target, packageSpec, options)
+    const spawnFn = options.spawn ?? spawn
+    const child = spawnFn(process.execPath, args, {
       cwd: target.profileDir,
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-messenger-gateway",
-  "version": "0.4.10",
+  "version": "0.4.11",
   "description": "Telegram messenger bridge for DeepSeek Harness: sessions, steer, homes, inline asks, notify bridge, and optional TTS voice notes.",
   "license": "MIT",
   "type": "module",