@goodandready/dsh-messenger-gateway 0.4.8 → 0.4.10

package/lib/file-manager.js

@@ -1,5 +1,6 @@
+import { realpathSync } from 'node:fs'
 import { readdir, stat, readFile } from 'node:fs/promises'
-import { resolve, normalize, relative, join, extname, isAbsolute } from 'node:path'
+import { resolve, normalize, relative, join, extname, isAbsolute, sep, dirname } from 'node:path'
 
 export function formatFileSize(bytes) {
   if (!Number.isFinite(bytes) || bytes <= 0) return '0 B'
@@ -9,6 +10,17 @@ export function formatFileSize(bytes) {
   return `${val} ${units[i]}`
 }
 
+function isSubpath(parent, child) {
+  const normParent = normalize(parent)
+  const normChild = normalize(child)
+  if (process.platform === 'win32') {
+    const p = normParent.toLowerCase()
+    const c = normChild.toLowerCase()
+    return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep)
+  }
+  return normChild === normParent || normChild.startsWith(normParent.endsWith(sep) ? normParent : normParent + sep)
+}
+
 export function resolveSafePath(baseCwd, userPath = '.') {
   const base = resolve(normalize(baseCwd || process.cwd()))
   const cleanUser = String(userPath || '').trim() || '.'
@@ -21,6 +33,46 @@ export function resolveSafePath(baseCwd, userPath = '.') {
     err.code = 'ERR_PATH_TRAVERSAL'
     throw err
   }
+
+  try {
+    const realBase = realpathSync(base)
+    try {
+      const realTarget = realpathSync(target)
+      if (!isSubpath(realBase, realTarget)) {
+        const err = new Error('Access denied: symlink resolves out of workspace')
+        err.code = 'ERR_PATH_TRAVERSAL'
+        throw err
+      }
+    } catch (targetErr) {
+      if (targetErr?.code === 'ERR_PATH_TRAVERSAL') throw targetErr
+      if (targetErr?.code === 'ENOENT') {
+        let curr = dirname(target)
+        while (curr === base || isSubpath(base, curr)) {
+          try {
+            const realCurr = realpathSync(curr)
+            if (!isSubpath(realBase, realCurr)) {
+              const err = new Error('Access denied: symlink ancestor resolves out of workspace')
+              err.code = 'ERR_PATH_TRAVERSAL'
+              throw err
+            }
+            break
+          } catch (ancestorErr) {
+            if (ancestorErr?.code === 'ERR_PATH_TRAVERSAL') throw ancestorErr
+            if (ancestorErr?.code === 'ENOENT') {
+              const parent = dirname(curr)
+              if (parent === curr) break
+              curr = parent
+              continue
+            }
+            break
+          }
+        }
+      }
+    }
+  } catch (baseErr) {
+    if (baseErr?.code === 'ERR_PATH_TRAVERSAL') throw baseErr
+  }
+
   return { base, target, relativePath: rel || '.' }
 }
 

package/lib/http.js

@@ -36,7 +36,7 @@ export function isLoopback(value) {
     || address.startsWith('::ffff:127.')
 }
 
-export function isTrustedSettingsRequest(req) {
+export function isTrustedSettingsRequest(req, expectedSecret) {
   const remote = req?.socket?.remoteAddress
   const host = String(req?.headers?.host || '')
   if (!host) return false
@@ -44,6 +44,21 @@ export function isTrustedSettingsRequest(req) {
   const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (site === 'cross-site') return false
 
+  const secret = String(expectedSecret || '').trim()
+  if (secret) {
+    const authHeader = req?.headers?.authorization || ''
+    const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''
+    const tokenHeader = req?.headers?.['x-webhook-secret'] || ''
+    const provided = bearer || tokenHeader
+    if (provided && timingSafeCompare(provided, secret)) {
+      return true
+    }
+  }
+
+  if (remote !== undefined && !isLoopback(remote)) {
+    return false
+  }
+
   const origin = String(req?.headers?.origin || '')
   if (origin) {
     try {
@@ -67,7 +82,6 @@ export function isTrustedSettingsRequest(req) {
   }
 
   if (site === 'same-origin') {
-    if (remote !== undefined && !isLoopback(remote)) return false
     return true
   }
 
@@ -78,10 +92,9 @@ export function isAuthorizedMessengerRequest(req, webhooksConfig) {
   const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (site === 'cross-site') return false
 
-  if (isTrustedSettingsRequest(req)) return true
-  if (isLoopback(req?.socket?.remoteAddress)) return true
-
   const secret = String(webhooksConfig?.secret || '').trim()
+  if (isTrustedSettingsRequest(req, secret)) return true
+  if (isLoopback(req?.socket?.remoteAddress)) return true
   if (secret) {
     const authHeader = req?.headers?.authorization || ''
     const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''

package/lib/index.js

@@ -22,7 +22,8 @@ export { Config }
 
 function resolveConfig(raw) {
   // Unwrap once here: everything downstream reads plain values.
-  const cfg = plainConfig(Config(raw))
+  const plain = plainConfig(raw)
+  const cfg = plainConfig(Config(plain))
   const home = process.env.DSH_HOME || join(homedir(), '.dsh')
   if (!cfg.media.cacheDir) {
     cfg.media = { ...cfg.media, cacheDir: join(home, 'messenger-gateway', 'cache') }
@@ -141,7 +142,7 @@ function isExcludedSession(sessionId, prefixes) {
 }
 
 export function apply(ctx, config) {
-  const entry = resolveConfig(structuredClone(config || {}))
+  const entry = resolveConfig(structuredClone(plainConfig(config || {})))
   let gateway
   let source = () => entry
   let settingsApi
@@ -379,7 +380,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)
@@ -456,7 +457,7 @@ export function apply(ctx, config) {
     handler: async (req, res) => {
       if (req.method === 'GET') return writeJson(res, 200, { ok: true, config: publicConfig(source()) })
       if (req.method !== 'PUT') return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       if (!settingsApi?.isReady?.()) return writeJson(res, 503, { ok: false, error: 'settings not ready' })
       const parsedConfig = await readJsonSafe(req, res, 1_048_576)
       if (!parsedConfig.ok) return
@@ -498,7 +499,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       writeJson(res, 200, {
@@ -513,7 +514,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing/approve',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)
@@ -527,7 +528,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing/reject',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)

package/lib/locales/index.js

@@ -9,11 +9,20 @@ export function getLocaleDictionary(locale = 'en') {
   return en
 }
 
-export function t(key, params = {}, locale = 'en') {
+export function escapeHtml(text) {
+  return String(text ?? '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
+export function t(key, params = {}, locale = 'en', options = {}) {
   const dict = getLocaleDictionary(locale)
   let template = dict[key] || en[key] || key
+  const escape = options.escape !== false
   for (const [k, v] of Object.entries(params)) {
-    template = template.replaceAll(`{${k}}`, String(v))
+    const val = escape ? escapeHtml(v) : String(v)
+    template = template.replaceAll(`{${k}}`, val)
   }
   return template
 }

package/lib/settings-bridge.js

@@ -1,6 +1,30 @@
 export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfig, sync, logger }) {
   let settingsApi
-  let source = () => resolveConfig(baseConfig ?? {})
+  let currentConfig = resolveConfig(ctx.fiber?.config ?? baseConfig ?? {})
+  let source = () => currentConfig
+  const watchers = new Set()
+  let readLive = () => null
+
+  const applyLiveConfig = (nextRaw) => {
+    const live = nextRaw ?? readLive() ?? ctx.fiber?.config ?? baseConfig
+    if (live) {
+      currentConfig = resolveConfig(live)
+      sync()
+      for (const cb of watchers) {
+        try { cb(currentConfig) } catch (err) { logger?.debug?.(`${namespace}: watcher error:`, err?.message || err) }
+      }
+    }
+  }
+
+  const unbinds = []
+  if (typeof ctx?.on === 'function') {
+    const u1 = ctx.on('loader/volatile-update', () => applyLiveConfig())
+    if (typeof u1 === 'function') unbinds.push(u1)
+    const u2 = ctx.on('internal/update', (cfg) => applyLiveConfig(cfg))
+    if (typeof u2 === 'function') unbinds.push(u2)
+    const u3 = ctx.on('app-boot/config-reload', () => applyLiveConfig())
+    if (typeof u3 === 'function') unbinds.push(u3)
+  }
 
   const mountSettings = (sctx) => {
     const service = sctx?.settings || (typeof sctx?.get === 'function' ? sctx.get('settings') : null)
@@ -26,7 +50,8 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
     const getRevision = () => {
       try {
         return service.describe?.()?.find?.((row) => row.ns === namespace)?.revision
-      } catch {
+      } catch (err) {
+        logger?.debug?.(`${namespace}: getRevision failed:`, err?.message || err)
         return undefined
       }
     }
@@ -47,8 +72,9 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
       return null
     }
 
+    readLive = readLiveSettings
     const liveVal = readLiveSettings()
-    let currentConfig = resolveConfig(liveVal ?? baseConfig ?? {})
+    if (liveVal) currentConfig = resolveConfig(liveVal)
     source = () => currentConfig
 
     const persist = async (next) => {
@@ -64,6 +90,9 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
       }
       currentConfig = resolveConfig(payload)
       sync()
+      for (const cb of watchers) {
+        try { cb(currentConfig) } catch (err) { logger?.debug?.(`${namespace}: watcher error:`, err?.message || err) }
+      }
       return currentConfig
     }
 
@@ -72,27 +101,28 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
       replace: async (next) => persist(next),
       update: async (patch) => persist({ ...source(), ...patch }),
       watch: (cb) => {
-        if (typeof service.watch === 'function') return service.watch(cb)
-        return () => {}
+        if (typeof cb === 'function') watchers.add(cb)
+        const unwatchService = typeof service.watch === 'function' ? service.watch(cb) : null
+        return () => {
+          watchers.delete(cb)
+          if (typeof unwatchService === 'function') unwatchService()
+        }
       },
     }
 
     const onFn = typeof sctx?.on === 'function' ? sctx.on.bind(sctx) : (typeof ctx?.on === 'function' ? ctx.on.bind(ctx) : null)
-    const disposeDocUpdated = onFn
-      ? onFn('settings/document-updated', (updatedNs) => {
-          if (updatedNs === namespace) {
-            const nextVal = readLiveSettings()
-            if (nextVal) {
-              currentConfig = resolveConfig(nextVal)
-              sync()
-            }
-          }
-        })
-      : null
+    if (onFn) {
+      const d1 = onFn('settings/document-updated', (updatedNs) => {
+        if (updatedNs === namespace) applyLiveConfig()
+      })
+      if (typeof d1 === 'function') unbinds.push(d1)
+    }
 
     if (effect) {
       effect(() => () => {
-        if (typeof disposeDocUpdated === 'function') disposeDocUpdated()
+        for (const unbind of unbinds) {
+          try { unbind() } catch (err) { logger?.debug?.(`${namespace}: unbind error:`, err?.message || err) }
+        }
         settingsApi = undefined
       }, `${namespace}: settings`)
     }

package/lib/telegram-format.js

@@ -7,12 +7,33 @@ export function escapeHtml(text) {
 
 const PH = '\uE000'
 
+const SAFE_SCHEMES = new Set(['https:', 'http:', 'tg:'])
+
+export function isSafeUrl(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') return false
+  const clean = rawUrl.replace(/&/g, '&').trim()
+  try {
+    const parsed = new URL(clean)
+    return SAFE_SCHEMES.has(parsed.protocol.toLowerCase())
+  } catch {
+    if (/^tg:\/\//i.test(clean)) return true
+    return false
+  }
+}
+
+export function formatSafeLink(label, url) {
+  if (!isSafeUrl(url)) {
+    return `${label} (${url})`
+  }
+  return `<a href="${url.replace(/"/g, '%22')}">${label}</a>`
+}
+
 // Render inline markdown (bold/italic/code/links) inside already-HTML-escaped text.
 function renderInline(t) {
   let s = escapeHtml(t)
   s = s.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   s = s.replace(/`([^`\n]+)`/g, '<code>$1</code>')
-  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
+  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => formatSafeLink(label, url))
   s = s.replace(/(^|[^*])\*([^*\n]+)\*(?!\*)/g, '$1<i>$2</i>')
   return s
 }
@@ -123,7 +144,7 @@ export function markdownToTelegramHtml(markdown) {
   text = convertDetails(text, stash)
   text = convertTaskLists(text, stash)
   text = escapeHtml(text)
-  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
+  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => formatSafeLink(label, url))
   text = text.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   text = text.replace(/__([^_\n]+)__/g, '<b>$1</b>')
   text = text.replace(/~~([^~\n]+)~~/g, '<s>$1</s>')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-messenger-gateway",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Telegram messenger bridge for DeepSeek Harness: sessions, steer, homes, inline asks, notify bridge, and optional TTS voice notes.",
   "license": "MIT",
   "type": "module",