@goodandready/dsh-plugin-notify 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-10-10
+
+### Fixed
+- **Request trust enforcement on HTTP/SSE routes** (#46): Route SSE and Push subscriptions through `isTrustedRequest` / `getRequestRejection`, ensuring origin and session checks with loopback fallback.
+- **Webhook error logging diagnostic** (#49): Log human-readable channel name instead of truncated webhook URL on POST failure, preventing credential token leakage.
+- **Multi-instance SSE client isolation** (#50): Isolate SSE client sets per plugin lifecycle context on dispose, avoiding cross-instance connection drops on reload.
+- **Deterministic memory bound on turnStarts map** (#51): Enforce deterministic FIFO eviction bound (`maxSize = 100`) on `turnStarts` map under session bursts.
+
 ## [0.4.1] - 2026-10-10
 
 ### Fixed

package/lib/index.js

@@ -94,7 +94,7 @@ const warnedLegacyUrls = new Set();
  * Purge turnStarts entries older than maxAgeMs (default 2 hours) to prevent
  * memory leaks from abandoned or cancelled sessions.
  */
-export function cleanupTurnStarts(maxAgeMs = 7200000, now = Date.now()) {
+export function cleanupTurnStarts(maxAgeMs = 7200000, now = Date.now(), maxSize = 100) {
     let deleted = 0;
     for (const [sid, start] of turnStarts.entries()) {
         if (now - start > maxAgeMs) {
@@ -102,6 +102,13 @@ export function cleanupTurnStarts(maxAgeMs = 7200000, now = Date.now()) {
             deleted++;
         }
     }
+    if (typeof maxSize === 'number' && maxSize > 0 && turnStarts.size >= maxSize) {
+        for (const [sid] of turnStarts.entries()) {
+            if (turnStarts.size < maxSize) break;
+            turnStarts.delete(sid);
+            deleted++;
+        }
+    }
     return deleted;
 }
 
@@ -168,17 +175,23 @@ function connectionOf(ctx) {
  * Delegates to DSH connection service (Host/Origin fence + browser authentication session),
  * with loopback-only fallback when connection service is absent (e.g. standalone tests).
  */
-export function isTrustedRequest(request, targetCtx) {
-    if (!request || !request.headers) return false;
+export function getRequestRejection(request, targetCtx) {
+    if (!request || !request.headers) return 403;
 
     const conn = connectionOf(targetCtx);
     if (conn && typeof conn.requestRejection === 'function') {
         const rejection = conn.requestRejection(request);
-        return rejection === void 0;
+        if (rejection !== void 0) return rejection;
+        return void 0;
     }
 
     const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress;
-    return Boolean(remoteAddr && isLoopback(remoteAddr));
+    if (!remoteAddr || !isLoopback(remoteAddr)) return 403;
+    return void 0;
+}
+
+export function isTrustedRequest(request, targetCtx) {
+    return getRequestRejection(request, targetCtx) === void 0;
 }
 
 export function broadcastSse(eventData) {
@@ -196,7 +209,7 @@ export function broadcastSse(eventData) {
     return sent;
 }
 
-export function handleSseConnection(req, res, targetCtx) {
+export function handleSseConnection(req, res, targetCtx, instanceClients = null) {
     if (req.method !== 'GET') {
         res.statusCode = 405;
         if (typeof res.setHeader === 'function') res.setHeader('allow', 'GET');
@@ -205,31 +218,16 @@ export function handleSseConnection(req, res, targetCtx) {
         return;
     }
 
-    const conn = connectionOf(targetCtx);
-    if (conn && typeof conn.requestRejection === 'function') {
-        const rejection = conn.requestRejection(req);
-        if (rejection !== void 0) {
-            res.statusCode = rejection;
-            if (typeof res.writeHead === 'function') {
-                res.writeHead(rejection, { 'Content-Type': 'text/plain; charset=utf-8' });
-            }
-            if (typeof res.end === 'function') {
-                res.end(rejection === 401 ? 'Unauthorized' : 'Forbidden');
-            }
-            return;
+    const rejection = getRequestRejection(req, targetCtx);
+    if (rejection !== void 0) {
+        res.statusCode = rejection;
+        if (typeof res.writeHead === 'function') {
+            res.writeHead(rejection, { 'Content-Type': 'text/plain; charset=utf-8' });
         }
-    } else {
-        const remoteAddr = req.socket?.remoteAddress || req.connection?.remoteAddress;
-        if (!remoteAddr || !isLoopback(remoteAddr)) {
-            res.statusCode = 403;
-            if (typeof res.writeHead === 'function') {
-                res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
-            }
-            if (typeof res.end === 'function') {
-                res.end('Forbidden');
-            }
-            return;
+        if (typeof res.end === 'function') {
+            res.end(rejection === 401 ? 'Unauthorized' : 'Forbidden');
         }
+        return;
     }
 
     if (typeof res.writeHead === 'function') {
@@ -243,9 +241,15 @@ export function handleSseConnection(req, res, targetCtx) {
         res.write(': connected\n\n');
     }
     sseClients.add(res);
+    if (instanceClients) {
+        instanceClients.add(res);
+    }
 
     const onEnd = () => {
         sseClients.delete(res);
+        if (instanceClients) {
+            instanceClients.delete(res);
+        }
     };
     if (typeof req.on === 'function') req.on('close', onEnd);
     if (typeof res.on === 'function') {
@@ -254,8 +258,9 @@ export function handleSseConnection(req, res, targetCtx) {
     }
 }
 
-export function closeAllSseClients() {
-    for (const res of Array.from(sseClients)) {
+export function closeAllSseClients(clientsToClose = sseClients) {
+    const list = Array.from(clientsToClose);
+    for (const res of list) {
         try {
             if (!res.writableEnded) {
                 if (typeof res.write === 'function' && res.headersSent) {
@@ -273,9 +278,16 @@ export function closeAllSseClients() {
             // ignore close error
         } finally {
             sseClients.delete(res);
+            if (clientsToClose !== sseClients) {
+                clientsToClose.delete(res);
+            }
         }
     }
-    sseClients.clear();
+    if (clientsToClose !== sseClients) {
+        clientsToClose.clear();
+    } else {
+        sseClients.clear();
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -547,18 +559,9 @@ function writeText(res, status, text, headers = {}) {
 
 /** Shared auth for push routes: same fence as the SSE stream. Returns true when accepted. */
 export function authorizePushRequest(req, res, targetCtx) {
-    const conn = connectionOf(targetCtx);
-    if (conn && typeof conn.requestRejection === 'function') {
-        const rejection = conn.requestRejection(req);
-        if (rejection !== void 0) {
-            writeText(res, rejection, rejection === 401 ? 'Unauthorized' : 'Forbidden');
-            return false;
-        }
-        return true;
-    }
-    const remoteAddr = req.socket?.remoteAddress || req.connection?.remoteAddress;
-    if (!remoteAddr || !isLoopback(remoteAddr)) {
-        writeText(res, 403, 'Forbidden');
+    const rejection = getRequestRejection(req, targetCtx);
+    if (rejection !== void 0) {
+        writeText(res, rejection, rejection === 401 ? 'Unauthorized' : 'Forbidden');
         return false;
     }
     return true;
@@ -649,6 +652,7 @@ export async function handlePushTest(req, res, targetCtx, getConfig) {
 
 function mountWebServer(targetCtx, hostCtx, getConfig) {
     if (!targetCtx?.webServer?.register) return () => {};
+    const instanceClients = new Set();
     // Async route wrapper: an unexpected rejection becomes a 500 instead of an
     // unhandled rejection; authorized handlers have already written their response.
     const asyncRoute = (handler) => (req, res) => {
@@ -660,7 +664,7 @@ function mountWebServer(targetCtx, hostCtx, getConfig) {
         {
             kind: 'exact',
             path: '/dsh-plugin-notify/events',
-            handler: (req, res) => handleSseConnection(req, res, targetCtx),
+            handler: (req, res) => handleSseConnection(req, res, targetCtx, instanceClients),
         },
         {
             kind: 'exact',
@@ -716,7 +720,7 @@ function mountWebServer(targetCtx, hostCtx, getConfig) {
             }
             unregister = null;
         }
-        closeAllSseClients();
+        closeAllSseClients(instanceClients);
     };
 
     if (typeof targetCtx.effect === 'function') {
@@ -755,7 +759,6 @@ export function apply(ctx, config = {}) {
             try { unmountWebServer(); } catch { /* ignore */ }
             unmountWebServer = null;
         }
-        closeAllSseClients();
         turnStarts.clear();
         webServerMounted = false;
     };
@@ -870,8 +873,8 @@ export function apply(ctx, config = {}) {
         const excludeSessionPrefixes = cfg.excludeSessionPrefixes ?? [];
 
         if (event.type === 'turn/start') {
-            if (turnStarts.size > 100) {
-                cleanupTurnStarts();
+            if (turnStarts.size >= 100) {
+                cleanupTurnStarts(7200000, Date.now(), 100);
             }
             turnStarts.set(String(session.id), Date.now());
             return;
@@ -923,28 +926,28 @@ function send(ctx, n, webhooks, timeoutMs, local, includeSession, includeDuratio
     const signal = AbortSignal.timeout(timeoutMs);
     const channels = Object.keys(webhooks);
     (ctx?.logger?.debug ?? ctx?.logger?.info)?.(`[plugin-notify] ${n.kind} · ${n.title} · session ${n.sessionId} · channels ${channels.join(',') || 'none'} · local ${local}`);
-    const post = (url, body) => {
+    const post = (channel, url, body) => {
         fetch(url, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify(body),
             signal,
         }).catch(error => {
-            ctx?.logger?.warn?.(`[plugin-notify] webhook POST failed (${String(url).slice(0, 64)}…): ${String(error)}`);
+            ctx?.logger?.warn?.(`[plugin-notify] ${channel} webhook POST failed: ${String(error)}`);
         });
     };
     if (webhooks.feishu)
-        post(webhooks.feishu, { msg_type: 'text', content: { text } });
+        post('feishu', webhooks.feishu, { msg_type: 'text', content: { text } });
     if (webhooks.wecom)
-        post(webhooks.wecom, { msgtype: 'text', text: { content: text } });
+        post('wecom', webhooks.wecom, { msgtype: 'text', text: { content: text } });
     if (webhooks.dingtalk)
-        post(webhooks.dingtalk, { msgtype: 'text', text: { content: text } });
+        post('dingtalk', webhooks.dingtalk, { msgtype: 'text', text: { content: text } });
     if (webhooks.slack)
-        post(webhooks.slack, { text });
+        post('slack', webhooks.slack, { text });
     if (webhooks.discord)
-        post(webhooks.discord, { content: text });
+        post('discord', webhooks.discord, { content: text });
     if (webhooks.custom) {
-        post(webhooks.custom, {
+        post('custom', webhooks.custom, {
             text,
             kind: n.kind,
             title: n.title,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-plugin-notify",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "DSH plugin: audio chimes, cross-session toasts, desktop push, IM webhooks, and web push (PWA) for turn completion, errors, and approvals.",
   "license": "MIT",
   "type": "module",