@helpfeel/cosense-cli 1.16.2 → 1.17.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helpfeel/cosense-cli",
-  "version": "1.16.2",
+  "version": "1.17.1",
   "description": "Cosense (旧Scrapbox) のページを読み・調べ・編集するAgent Skillのハーネス",
   "homepage": "https://github.com/helpfeel/cosense-cli",
   "license": "MIT",
@@ -27,10 +27,10 @@
     "tsx": "4.23.15"
   },
   "devDependencies": {
-    "@types/node": "24.19.1",
+    "@types/node": "24.19.2",
     "npm-run-all": "4.1.5",
-    "oxfmt": "0.71.0",
-    "oxlint": "1.86.0",
+    "oxfmt": "0.72.0",
+    "oxlint": "1.87.0",
     "typescript": "7.0.2"
   },
   "engines": {

package/src/commands/browsePageChanges.ts

@@ -10,7 +10,7 @@ import {
   serviceAccountSuffix,
   type UserMap
 } from '../lib/resolveUsers.ts';
-import { resolveCredential } from '../lib/settings.ts';
+import { resolveCredential, type Credential } from '../lib/settings.ts';
 
 export const browsePageChangesSummary =
   'ページの編集履歴(commit)をpageId起点で取得し、誰がいつ何をどう変えたかを自然言語で説明する。タイトル変更(リネーム)も検出する';
@@ -58,6 +58,7 @@ interface Change {
 
 interface Commit {
   id?: string;
+  parentId?: string | null;
   changes?: Change[];
   userId?: string;
   created?: number;
@@ -65,6 +66,7 @@ interface Commit {
 
 interface CommitsResponse {
   commits?: Commit[];
+  hasMore?: boolean;
 }
 
 interface ParsedArgs {
@@ -116,6 +118,46 @@ const resolveUserName = (
 
 const quote = (text: string | undefined): string => `「${text ?? ''}」`;
 
+// 1回の応答は件数と大きさで打ち切られ、続きがある時はhasMoreが真になる
+const fetchAllCommits = async (
+  apiUrl: string,
+  since: string | undefined,
+  credential: Credential | undefined
+): Promise<Commit[]> => {
+  const commits: Commit[] = [];
+  let head = since;
+  let continuing = false;
+  const requestedHeads = new Set<string>(since ? [since] : []);
+  while (true) {
+    const url = head ? `${apiUrl}?head=${encodeURIComponent(head)}` : apiUrl;
+    const data = (await requestJson(url, { credential })) as CommitsResponse;
+    const batch = data.commits ?? [];
+    const first = batch[0];
+    // 続きが空だと、取れた分を完全な結果として出してしまうので止める。hasMoreは次の要求が空でない事まで保証しない
+    if (continuing && !first) {
+      throw new Error(`no commits follow head "${head}"`);
+    }
+    // headに続かない応答を辿ると、同じ応答を取り続けて終わらないので止める
+    if (head && first && first.parentId !== head) {
+      throw new Error(`commits do not follow head "${head}"`);
+    }
+    // spreadで足すと、1回の応答が大きい時に引数の上限を超える
+    for (const commit of batch) commits.push(commit);
+    if (!data.hasMore) return commits;
+    const next = batch.at(-1)?.id;
+    if (!next) {
+      throw new Error('hasMore is true but the last commit has no id');
+    }
+    // 親子が循環した応答はparentIdの確認を通るので、同じheadを2度要求しない事で止める
+    if (requestedHeads.has(next)) {
+      throw new Error(`commit "${next}" appears again as head`);
+    }
+    requestedHeads.add(next);
+    head = next;
+    continuing = true;
+  }
+};
+
 // 時系列の変更イベント。同一行への連続updateは1件に畳む
 type ChangeEvent =
   | { kind: 'title'; userIds: string[]; created?: number; title: string }
@@ -205,18 +247,14 @@ export const browsePageChanges = async (args: string[]): Promise<void> => {
   const { projectUrl, pageId, since } = parseArgs(args);
   const { origin, projectName } = parseProjectUrlStrict(projectUrl);
 
-  let apiUrl = `${origin}/api/commits/${projectName}/${pageId}`;
-  if (since) {
-    apiUrl += `?head=${encodeURIComponent(since)}`;
-  }
+  const apiUrl = `${origin}/api/commits/${projectName}/${pageId}`;
   const credential = resolveCredential(origin, projectName);
 
-  const [data, userMap] = await Promise.all([
-    requestJson(apiUrl, { credential }) as Promise<CommitsResponse>,
+  const [commits, userMap] = await Promise.all([
+    fetchAllCommits(apiUrl, since, credential),
     fetchUserMap(origin, projectName)
   ]);
 
-  const commits = data.commits ?? [];
   const events = buildEvents(commits);
 
   const titleEvents = events.filter(e => e.kind === 'title');

package/src/lib/fileMarkup.ts

@@ -1,3 +1,4 @@
+import { isEquivalentOrigin } from './parseUrl.ts';
 import { requestJson } from './request.ts';
 import type { Credential } from './settings.ts';
 
@@ -107,13 +108,13 @@ export const fetchFileMarkups = async (
   const gyazos = collectMatches(lines, GYAZO_URL_PATTERN);
   const markups = new Map<string, string>();
 
-  // ページと同じhostのアップロードファイルだけタグ展開する。cross-originのURLに
+  // ページと同一視できるoriginのアップロードファイルだけタグ展開する。cross-originのURLに
   // ページのcredential（env COSENSE_PATを含む）を送るとPAT漏洩になるため、別host・
   // 不正URL・取得失敗（404・権限なし・非公開Gyazo等）はいずれもURLのまま本文に残す。
   // 従来の出力と同じに劣化するだけで、AIはURLからファイルの存在を認知できる
   const fileTasks = [...files].map(async ([url, fileId]) => {
     try {
-      if (new URL(url).origin !== pageOrigin) return;
+      if (!isEquivalentOrigin(url, pageOrigin)) return;
       const info = (await requestJson(`${pageOrigin}/api/gcs/${fileId}/info`, {
         credential: pageCredential
       })) as FileInfo;

package/src/lib/parseUrl.ts

@@ -20,6 +20,26 @@ export const parseOrigin = (input: string): string => {
   return url.origin;
 };
 
+// scrapbox.ioとcosen.seはドメイン移行中の同じCosenseで、どちらのURLも同じサーバーに届くのでcredentialを共有してよい
+const EQUIVALENT_HOSTS = new Set(['scrapbox.io', 'cosen.se']);
+
+// http(s)のURL同士で、credentialを共有してよいoriginかを判定する
+export const isEquivalentOrigin = (
+  a: URL | string,
+  b: URL | string
+): boolean => {
+  const from = new URL(a);
+  const to = new URL(b);
+  if (from.protocol !== 'http:' && from.protocol !== 'https:') return false;
+  return (
+    from.protocol === to.protocol &&
+    from.port === to.port &&
+    (from.hostname === to.hostname ||
+      (EQUIVALENT_HOSTS.has(from.hostname) &&
+        EQUIVALENT_HOSTS.has(to.hostname)))
+  );
+};
+
 export const parseProjectUrl = (input: string): ProjectUrl => {
   const u = new URL(input);
   const parts = u.pathname.split('/').filter(Boolean);

package/src/lib/request.ts

@@ -3,6 +3,7 @@ import { rename, rm, stat } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
+import { isEquivalentOrigin } from './parseUrl.ts';
 import type { Credential } from './settings.ts';
 
 const describeCredentialDenied = (credential: Credential): string =>
@@ -67,29 +68,74 @@ const buildCredentialHeaders = (
   return headers;
 };
 
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+const MAX_REDIRECTS = 5;
+
 export const requestJson = async (
   url: string,
   options?: RequestOptions
 ): Promise<unknown> => {
   const headers = buildCredentialHeaders(options?.credential);
   const method = options?.method ?? 'GET';
-  const init: RequestInit = { method, headers };
+  // Node.jsのfetchは別originへのredirectでもこの独自credential headerを転送するので、自動redirectにしない
+  const init: RequestInit = { method, headers, redirect: 'manual' };
   if (options?.body !== undefined) {
     headers['Content-Type'] = 'application/json';
     init.body = JSON.stringify(options.body);
   }
-  const res = await fetch(url, init);
-  if (!res.ok) {
-    const body = await res.text().catch(() => '');
-    throw new HttpError({
-      status: res.status,
-      statusText: res.statusText,
-      url,
-      body,
-      credential: options?.credential
-    });
+  const requestUrl = new URL(url);
+  let currentUrl = url;
+  for (let redirects = 0; ; redirects++) {
+    const res = await fetch(currentUrl, init);
+    if (!REDIRECT_STATUSES.has(res.status)) {
+      if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new HttpError({
+          status: res.status,
+          statusText: res.statusText,
+          url: currentUrl,
+          body,
+          credential: options?.credential
+        });
+      }
+      return res.json();
+    }
+    const location = res.headers.get('location');
+    await res.body?.cancel().catch(() => {});
+    if (!location) {
+      throw new Error(
+        `HTTP ${res.status} without Location header: ${currentUrl}`
+      );
+    }
+    const redirectUrl = URL.parse(location, currentUrl);
+    if (!redirectUrl) {
+      throw new Error(
+        `HTTP ${res.status} with invalid Location header: ${currentUrl}`
+      );
+    }
+    if (redirectUrl.protocol !== 'http:' && redirectUrl.protocol !== 'https:') {
+      throw new Error(
+        `HTTP ${res.status} redirect to ${redirectUrl.protocol} URL was not followed: ${currentUrl}`
+      );
+    }
+    if (!isEquivalentOrigin(requestUrl, redirectUrl)) {
+      throw new Error(
+        `HTTP ${res.status} redirect to ${redirectUrl.origin}${redirectUrl.pathname} was not followed because it leaves ${requestUrl.origin}. ` +
+          `Retry with URLs on ${redirectUrl.origin}.`
+      );
+    }
+    // GETだけ追うのは、ページ改名の追従(followRename)が改名後のAPI URLへの302で返るため
+    if (method !== 'GET') {
+      throw new Error(
+        `HTTP ${res.status} redirect of ${method} ${currentUrl} is not followed.`
+      );
+    }
+    if (redirects >= MAX_REDIRECTS) {
+      throw new Error(`Too many redirects: ${url}`);
+    }
+    currentUrl = redirectUrl.href;
   }
-  return res.json();
 };
 
 export interface DownloadResult {
@@ -98,8 +144,6 @@ export interface DownloadResult {
   size: number;
 }
 
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-
 export const downloadToFile = async (
   url: string,
   outputPath: string,

package/src/lib/resolveFileCredential.ts

@@ -1,4 +1,4 @@
-import { parseProjectUrlStrict } from './parseUrl.ts';
+import { isEquivalentOrigin, parseProjectUrlStrict } from './parseUrl.ts';
 import {
   resolveCredential,
   resolveUserCredential,
@@ -15,7 +15,7 @@ export const resolveFileCredential = (
     return resolveUserCredential(fileOrigin);
   }
   const { origin, projectName } = parseProjectUrlStrict(projectUrl);
-  if (origin !== fileOrigin) {
+  if (!isEquivalentOrigin(origin, fileOrigin)) {
     throw new Error(
       `--project origin mismatch: ${origin} (--project) vs ${fileOrigin} (file URL)`
     );

package/src/lib/settings.ts

@@ -1,6 +1,7 @@
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { isEquivalentOrigin } from './parseUrl.ts';
 
 interface ProjectSetting {
   origin: string;
@@ -204,7 +205,7 @@ export const writeUserToken = (origin: string, token: string): void => {
     const url = (entry as { url?: unknown }).url;
     if (typeof url !== 'string') return true;
     try {
-      return new URL(url).origin !== origin;
+      return !isEquivalentOrigin(url, origin);
     } catch {
       return true;
     }
@@ -233,7 +234,8 @@ export const writeProjectServiceAccount = (
       const existingName = parsed.pathname.split('/').filter(Boolean)[0];
       if (!existingName) return true;
       return !(
-        parsed.origin === origin && existingName.toLowerCase() === projectNameLc
+        isEquivalentOrigin(parsed, origin) &&
+        existingName.toLowerCase() === projectNameLc
       );
     } catch {
       return true;
@@ -264,12 +266,15 @@ export const resolveCredential = (
   if (!settings) return undefined;
   const projectNameLc = projectName.toLowerCase();
   for (const project of settings.projects) {
-    if (project.origin === origin && project.projectNameLc === projectNameLc) {
+    if (
+      isEquivalentOrigin(project.origin, origin) &&
+      project.projectNameLc === projectNameLc
+    ) {
       return { type: 'serviceAccount', value: project.serviceAccount };
     }
   }
   for (const user of settings.users) {
-    if (user.origin === origin) {
+    if (isEquivalentOrigin(user.origin, origin)) {
       return { type: 'personalAccessToken', value: user.token };
     }
   }
@@ -284,7 +289,7 @@ export const resolveUserCredential = (
   const settings = loadSettings();
   if (!settings) return undefined;
   for (const user of settings.users) {
-    if (user.origin === origin) {
+    if (isEquivalentOrigin(user.origin, origin)) {
       return { type: 'personalAccessToken', value: user.token };
     }
   }