@helpfeel/cosense-cli 1.16.2 → 1.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helpfeel/cosense-cli",
-  "version": "1.16.2",
+  "version": "1.17.0",
   "description": "Cosense (旧Scrapbox) のページを読み・調べ・編集するAgent Skillのハーネス",
   "homepage": "https://github.com/helpfeel/cosense-cli",
   "license": "MIT",

package/src/lib/fileMarkup.ts

@@ -1,3 +1,4 @@
+import { isEquivalentOrigin } from './parseUrl.ts';
 import { requestJson } from './request.ts';
 import type { Credential } from './settings.ts';
 
@@ -107,13 +108,13 @@ export const fetchFileMarkups = async (
   const gyazos = collectMatches(lines, GYAZO_URL_PATTERN);
   const markups = new Map<string, string>();
 
-  // ページと同じhostのアップロードファイルだけタグ展開する。cross-originのURLに
+  // ページと同一視できるoriginのアップロードファイルだけタグ展開する。cross-originのURLに
   // ページのcredential（env COSENSE_PATを含む）を送るとPAT漏洩になるため、別host・
   // 不正URL・取得失敗（404・権限なし・非公開Gyazo等）はいずれもURLのまま本文に残す。
   // 従来の出力と同じに劣化するだけで、AIはURLからファイルの存在を認知できる
   const fileTasks = [...files].map(async ([url, fileId]) => {
     try {
-      if (new URL(url).origin !== pageOrigin) return;
+      if (!isEquivalentOrigin(url, pageOrigin)) return;
       const info = (await requestJson(`${pageOrigin}/api/gcs/${fileId}/info`, {
         credential: pageCredential
       })) as FileInfo;

package/src/lib/parseUrl.ts

@@ -20,6 +20,26 @@ export const parseOrigin = (input: string): string => {
   return url.origin;
 };
 
+// scrapbox.ioとcosen.seはドメイン移行中の同じCosenseで、どちらのURLも同じサーバーに届くのでcredentialを共有してよい
+const EQUIVALENT_HOSTS = new Set(['scrapbox.io', 'cosen.se']);
+
+// http(s)のURL同士で、credentialを共有してよいoriginかを判定する
+export const isEquivalentOrigin = (
+  a: URL | string,
+  b: URL | string
+): boolean => {
+  const from = new URL(a);
+  const to = new URL(b);
+  if (from.protocol !== 'http:' && from.protocol !== 'https:') return false;
+  return (
+    from.protocol === to.protocol &&
+    from.port === to.port &&
+    (from.hostname === to.hostname ||
+      (EQUIVALENT_HOSTS.has(from.hostname) &&
+        EQUIVALENT_HOSTS.has(to.hostname)))
+  );
+};
+
 export const parseProjectUrl = (input: string): ProjectUrl => {
   const u = new URL(input);
   const parts = u.pathname.split('/').filter(Boolean);

package/src/lib/request.ts

@@ -3,6 +3,7 @@ import { rename, rm, stat } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
+import { isEquivalentOrigin } from './parseUrl.ts';
 import type { Credential } from './settings.ts';
 
 const describeCredentialDenied = (credential: Credential): string =>
@@ -67,29 +68,74 @@ const buildCredentialHeaders = (
   return headers;
 };
 
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+const MAX_REDIRECTS = 5;
+
 export const requestJson = async (
   url: string,
   options?: RequestOptions
 ): Promise<unknown> => {
   const headers = buildCredentialHeaders(options?.credential);
   const method = options?.method ?? 'GET';
-  const init: RequestInit = { method, headers };
+  // Node.jsのfetchは別originへのredirectでもこの独自credential headerを転送するので、自動redirectにしない
+  const init: RequestInit = { method, headers, redirect: 'manual' };
   if (options?.body !== undefined) {
     headers['Content-Type'] = 'application/json';
     init.body = JSON.stringify(options.body);
   }
-  const res = await fetch(url, init);
-  if (!res.ok) {
-    const body = await res.text().catch(() => '');
-    throw new HttpError({
-      status: res.status,
-      statusText: res.statusText,
-      url,
-      body,
-      credential: options?.credential
-    });
+  const requestUrl = new URL(url);
+  let currentUrl = url;
+  for (let redirects = 0; ; redirects++) {
+    const res = await fetch(currentUrl, init);
+    if (!REDIRECT_STATUSES.has(res.status)) {
+      if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new HttpError({
+          status: res.status,
+          statusText: res.statusText,
+          url: currentUrl,
+          body,
+          credential: options?.credential
+        });
+      }
+      return res.json();
+    }
+    const location = res.headers.get('location');
+    await res.body?.cancel().catch(() => {});
+    if (!location) {
+      throw new Error(
+        `HTTP ${res.status} without Location header: ${currentUrl}`
+      );
+    }
+    const redirectUrl = URL.parse(location, currentUrl);
+    if (!redirectUrl) {
+      throw new Error(
+        `HTTP ${res.status} with invalid Location header: ${currentUrl}`
+      );
+    }
+    if (redirectUrl.protocol !== 'http:' && redirectUrl.protocol !== 'https:') {
+      throw new Error(
+        `HTTP ${res.status} redirect to ${redirectUrl.protocol} URL was not followed: ${currentUrl}`
+      );
+    }
+    if (!isEquivalentOrigin(requestUrl, redirectUrl)) {
+      throw new Error(
+        `HTTP ${res.status} redirect to ${redirectUrl.origin}${redirectUrl.pathname} was not followed because it leaves ${requestUrl.origin}. ` +
+          `Retry with URLs on ${redirectUrl.origin}.`
+      );
+    }
+    // GETだけ追うのは、ページ改名の追従(followRename)が改名後のAPI URLへの302で返るため
+    if (method !== 'GET') {
+      throw new Error(
+        `HTTP ${res.status} redirect of ${method} ${currentUrl} is not followed.`
+      );
+    }
+    if (redirects >= MAX_REDIRECTS) {
+      throw new Error(`Too many redirects: ${url}`);
+    }
+    currentUrl = redirectUrl.href;
   }
-  return res.json();
 };
 
 export interface DownloadResult {
@@ -98,8 +144,6 @@ export interface DownloadResult {
   size: number;
 }
 
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-
 export const downloadToFile = async (
   url: string,
   outputPath: string,

package/src/lib/resolveFileCredential.ts

@@ -1,4 +1,4 @@
-import { parseProjectUrlStrict } from './parseUrl.ts';
+import { isEquivalentOrigin, parseProjectUrlStrict } from './parseUrl.ts';
 import {
   resolveCredential,
   resolveUserCredential,
@@ -15,7 +15,7 @@ export const resolveFileCredential = (
     return resolveUserCredential(fileOrigin);
   }
   const { origin, projectName } = parseProjectUrlStrict(projectUrl);
-  if (origin !== fileOrigin) {
+  if (!isEquivalentOrigin(origin, fileOrigin)) {
     throw new Error(
       `--project origin mismatch: ${origin} (--project) vs ${fileOrigin} (file URL)`
     );

package/src/lib/settings.ts

@@ -1,6 +1,7 @@
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { isEquivalentOrigin } from './parseUrl.ts';
 
 interface ProjectSetting {
   origin: string;
@@ -204,7 +205,7 @@ export const writeUserToken = (origin: string, token: string): void => {
     const url = (entry as { url?: unknown }).url;
     if (typeof url !== 'string') return true;
     try {
-      return new URL(url).origin !== origin;
+      return !isEquivalentOrigin(url, origin);
     } catch {
       return true;
     }
@@ -233,7 +234,8 @@ export const writeProjectServiceAccount = (
       const existingName = parsed.pathname.split('/').filter(Boolean)[0];
       if (!existingName) return true;
       return !(
-        parsed.origin === origin && existingName.toLowerCase() === projectNameLc
+        isEquivalentOrigin(parsed, origin) &&
+        existingName.toLowerCase() === projectNameLc
       );
     } catch {
       return true;
@@ -264,12 +266,15 @@ export const resolveCredential = (
   if (!settings) return undefined;
   const projectNameLc = projectName.toLowerCase();
   for (const project of settings.projects) {
-    if (project.origin === origin && project.projectNameLc === projectNameLc) {
+    if (
+      isEquivalentOrigin(project.origin, origin) &&
+      project.projectNameLc === projectNameLc
+    ) {
       return { type: 'serviceAccount', value: project.serviceAccount };
     }
   }
   for (const user of settings.users) {
-    if (user.origin === origin) {
+    if (isEquivalentOrigin(user.origin, origin)) {
       return { type: 'personalAccessToken', value: user.token };
     }
   }
@@ -284,7 +289,7 @@ export const resolveUserCredential = (
   const settings = loadSettings();
   if (!settings) return undefined;
   for (const user of settings.users) {
-    if (user.origin === origin) {
+    if (isEquivalentOrigin(user.origin, origin)) {
       return { type: 'personalAccessToken', value: user.token };
     }
   }