@helpfeel/cosense-cli 1.16.1 → 1.17.0

package/README.md

@@ -46,7 +46,6 @@ cosense --help
 - install [direnv](https://direnv.net/)
 - run `npm install`
 - install [Codex CLI](https://github.com/openai/codex) and run `codex login`
-  - modelは `gpt-5.6-sol`、reasoning effortは `high` 以上を推奨
 - run `claude` or `codex`
 
 Claude Codeでこのディレクトリをtrustすると、開発フローで使うpluginが `.claude/settings.json` によりインストールされる。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helpfeel/cosense-cli",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "Cosense (旧Scrapbox) のページを読み・調べ・編集するAgent Skillのハーネス",
   "homepage": "https://github.com/helpfeel/cosense-cli",
   "license": "MIT",
@@ -27,10 +27,10 @@
     "tsx": "4.23.15"
   },
   "devDependencies": {
-    "@types/node": "24.13.6",
+    "@types/node": "24.19.1",
     "npm-run-all": "4.1.5",
-    "oxfmt": "0.70.0",
-    "oxlint": "1.85.0",
+    "oxfmt": "0.71.0",
+    "oxlint": "1.86.0",
     "typescript": "7.0.2"
   },
   "engines": {

package/src/commands/downloadFile.ts

@@ -30,9 +30,6 @@ Usage:
 HTTPエラー:
   401/403: 認証・権限が無い。private projectのファイルはproject member権限が必要
   404: fileIdに対応するファイルが存在しない
-
-注記:
-  動画ファイルはサーバー側の制限により取得できない場合がある
 `;
 
 interface ParsedArgs {

package/src/commands/uploadFile.ts

@@ -76,8 +76,8 @@ const parseArgs = (args: string[]): ParsedArgs => {
   };
 };
 
-// request.tsのHttpErrorは401/403でcosense loginを案内するが、GCSのsigned URLへの
-// PUT失敗にログイン案内は誤誘導なので専用のエラーメッセージを組み立てる
+// request.tsのHttpErrorは401/403でcosense loginか権限の確認を案内するが、GCSのsigned URLへの
+// PUT失敗にはどちらも誤誘導なので専用のエラーメッセージを組み立てる
 const uploadToSignedUrl = async (
   url: string,
   body: Uint8Array,

package/src/lib/fileMarkup.ts

@@ -1,3 +1,4 @@
+import { isEquivalentOrigin } from './parseUrl.ts';
 import { requestJson } from './request.ts';
 import type { Credential } from './settings.ts';
 
@@ -107,13 +108,13 @@ export const fetchFileMarkups = async (
   const gyazos = collectMatches(lines, GYAZO_URL_PATTERN);
   const markups = new Map<string, string>();
 
-  // ページと同じhostのアップロードファイルだけタグ展開する。cross-originのURLに
+  // ページと同一視できるoriginのアップロードファイルだけタグ展開する。cross-originのURLに
   // ページのcredential（env COSENSE_PATを含む）を送るとPAT漏洩になるため、別host・
   // 不正URL・取得失敗（404・権限なし・非公開Gyazo等）はいずれもURLのまま本文に残す。
   // 従来の出力と同じに劣化するだけで、AIはURLからファイルの存在を認知できる
   const fileTasks = [...files].map(async ([url, fileId]) => {
     try {
-      if (new URL(url).origin !== pageOrigin) return;
+      if (!isEquivalentOrigin(url, pageOrigin)) return;
       const info = (await requestJson(`${pageOrigin}/api/gcs/${fileId}/info`, {
         credential: pageCredential
       })) as FileInfo;

package/src/lib/parseUrl.ts

@@ -20,6 +20,26 @@ export const parseOrigin = (input: string): string => {
   return url.origin;
 };
 
+// scrapbox.ioとcosen.seはドメイン移行中の同じCosenseで、どちらのURLも同じサーバーに届くのでcredentialを共有してよい
+const EQUIVALENT_HOSTS = new Set(['scrapbox.io', 'cosen.se']);
+
+// http(s)のURL同士で、credentialを共有してよいoriginかを判定する
+export const isEquivalentOrigin = (
+  a: URL | string,
+  b: URL | string
+): boolean => {
+  const from = new URL(a);
+  const to = new URL(b);
+  if (from.protocol !== 'http:' && from.protocol !== 'https:') return false;
+  return (
+    from.protocol === to.protocol &&
+    from.port === to.port &&
+    (from.hostname === to.hostname ||
+      (EQUIVALENT_HOSTS.has(from.hostname) &&
+        EQUIVALENT_HOSTS.has(to.hostname)))
+  );
+};
+
 export const parseProjectUrl = (input: string): ProjectUrl => {
   const u = new URL(input);
   const parts = u.pathname.split('/').filter(Boolean);

package/src/lib/request.ts

@@ -3,8 +3,14 @@ import { rename, rm, stat } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
+import { isEquivalentOrigin } from './parseUrl.ts';
 import type { Credential } from './settings.ts';
 
+const describeCredentialDenied = (credential: Credential): string =>
+  credential.type === 'serviceAccount'
+    ? 'Service Account key was sent, but the server denied access. Check that the key belongs to the project of the target resource and that this operation is allowed.'
+    : 'Personal Access Token was sent, but the server denied access. Check that the account has permission for the target resource and this operation.';
+
 export class HttpError extends Error {
   readonly status: number;
   readonly statusText: string;
@@ -16,9 +22,13 @@ export class HttpError extends Error {
     statusText: string;
     url: string;
     body: string;
+    credential?: Credential;
   }) {
     let message = `HTTP ${params.status} ${params.statusText}\n${params.url}\n${params.body.slice(0, 500)}`;
-    if (params.status === 401 || params.status === 403) {
+    if (params.status === 403 && params.credential) {
+      // credential付きの403はtokenの入れ直しでは直らないので、login案内ではなく権限の確認を促す
+      message += `\n\n${describeCredentialDenied(params.credential)}`;
+    } else if (params.status === 401 || params.status === 403) {
       let origin: string | undefined;
       try {
         origin = new URL(params.url).origin;
@@ -58,28 +68,74 @@ const buildCredentialHeaders = (
   return headers;
 };
 
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+const MAX_REDIRECTS = 5;
+
 export const requestJson = async (
   url: string,
   options?: RequestOptions
 ): Promise<unknown> => {
   const headers = buildCredentialHeaders(options?.credential);
   const method = options?.method ?? 'GET';
-  const init: RequestInit = { method, headers };
+  // Node.jsのfetchは別originへのredirectでもこの独自credential headerを転送するので、自動redirectにしない
+  const init: RequestInit = { method, headers, redirect: 'manual' };
   if (options?.body !== undefined) {
     headers['Content-Type'] = 'application/json';
     init.body = JSON.stringify(options.body);
   }
-  const res = await fetch(url, init);
-  if (!res.ok) {
-    const body = await res.text().catch(() => '');
-    throw new HttpError({
-      status: res.status,
-      statusText: res.statusText,
-      url,
-      body
-    });
+  const requestUrl = new URL(url);
+  let currentUrl = url;
+  for (let redirects = 0; ; redirects++) {
+    const res = await fetch(currentUrl, init);
+    if (!REDIRECT_STATUSES.has(res.status)) {
+      if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new HttpError({
+          status: res.status,
+          statusText: res.statusText,
+          url: currentUrl,
+          body,
+          credential: options?.credential
+        });
+      }
+      return res.json();
+    }
+    const location = res.headers.get('location');
+    await res.body?.cancel().catch(() => {});
+    if (!location) {
+      throw new Error(
+        `HTTP ${res.status} without Location header: ${currentUrl}`
+      );
+    }
+    const redirectUrl = URL.parse(location, currentUrl);
+    if (!redirectUrl) {
+      throw new Error(
+        `HTTP ${res.status} with invalid Location header: ${currentUrl}`
+      );
+    }
+    if (redirectUrl.protocol !== 'http:' && redirectUrl.protocol !== 'https:') {
+      throw new Error(
+        `HTTP ${res.status} redirect to ${redirectUrl.protocol} URL was not followed: ${currentUrl}`
+      );
+    }
+    if (!isEquivalentOrigin(requestUrl, redirectUrl)) {
+      throw new Error(
+        `HTTP ${res.status} redirect to ${redirectUrl.origin}${redirectUrl.pathname} was not followed because it leaves ${requestUrl.origin}. ` +
+          `Retry with URLs on ${redirectUrl.origin}.`
+      );
+    }
+    // GETだけ追うのは、ページ改名の追従(followRename)が改名後のAPI URLへの302で返るため
+    if (method !== 'GET') {
+      throw new Error(
+        `HTTP ${res.status} redirect of ${method} ${currentUrl} is not followed.`
+      );
+    }
+    if (redirects >= MAX_REDIRECTS) {
+      throw new Error(`Too many redirects: ${url}`);
+    }
+    currentUrl = redirectUrl.href;
   }
-  return res.json();
 };
 
 export interface DownloadResult {
@@ -88,8 +144,6 @@ export interface DownloadResult {
   size: number;
 }
 
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-
 export const downloadToFile = async (
   url: string,
   outputPath: string,
@@ -129,7 +183,8 @@ export const downloadToFile = async (
       status: res.status,
       statusText: res.statusText,
       url,
-      body
+      body,
+      credential: options?.credential
     });
   }
   if (!res.body) {

package/src/lib/resolveFileCredential.ts

@@ -1,4 +1,4 @@
-import { parseProjectUrlStrict } from './parseUrl.ts';
+import { isEquivalentOrigin, parseProjectUrlStrict } from './parseUrl.ts';
 import {
   resolveCredential,
   resolveUserCredential,
@@ -15,7 +15,7 @@ export const resolveFileCredential = (
     return resolveUserCredential(fileOrigin);
   }
   const { origin, projectName } = parseProjectUrlStrict(projectUrl);
-  if (origin !== fileOrigin) {
+  if (!isEquivalentOrigin(origin, fileOrigin)) {
     throw new Error(
       `--project origin mismatch: ${origin} (--project) vs ${fileOrigin} (file URL)`
     );

package/src/lib/settings.ts

@@ -1,6 +1,7 @@
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { isEquivalentOrigin } from './parseUrl.ts';
 
 interface ProjectSetting {
   origin: string;
@@ -204,7 +205,7 @@ export const writeUserToken = (origin: string, token: string): void => {
     const url = (entry as { url?: unknown }).url;
     if (typeof url !== 'string') return true;
     try {
-      return new URL(url).origin !== origin;
+      return !isEquivalentOrigin(url, origin);
     } catch {
       return true;
     }
@@ -233,7 +234,8 @@ export const writeProjectServiceAccount = (
       const existingName = parsed.pathname.split('/').filter(Boolean)[0];
       if (!existingName) return true;
       return !(
-        parsed.origin === origin && existingName.toLowerCase() === projectNameLc
+        isEquivalentOrigin(parsed, origin) &&
+        existingName.toLowerCase() === projectNameLc
       );
     } catch {
       return true;
@@ -264,12 +266,15 @@ export const resolveCredential = (
   if (!settings) return undefined;
   const projectNameLc = projectName.toLowerCase();
   for (const project of settings.projects) {
-    if (project.origin === origin && project.projectNameLc === projectNameLc) {
+    if (
+      isEquivalentOrigin(project.origin, origin) &&
+      project.projectNameLc === projectNameLc
+    ) {
       return { type: 'serviceAccount', value: project.serviceAccount };
     }
   }
   for (const user of settings.users) {
-    if (user.origin === origin) {
+    if (isEquivalentOrigin(user.origin, origin)) {
       return { type: 'personalAccessToken', value: user.token };
     }
   }
@@ -284,7 +289,7 @@ export const resolveUserCredential = (
   const settings = loadSettings();
   if (!settings) return undefined;
   for (const user of settings.users) {
-    if (user.origin === origin) {
+    if (isEquivalentOrigin(user.origin, origin)) {
       return { type: 'personalAccessToken', value: user.token };
     }
   }