@lelouchhe/webagent 0.8.0 → 0.10.0

package/lib/attachments.js

@@ -16,6 +16,11 @@ const MIME_TO_EXT = {
     "image/jpeg": "jpg",
     "image/gif": "gif",
     "image/webp": "webp",
+    "image/heic": "heic",
+    "image/heif": "heif",
+    "image/avif": "avif",
+    "image/bmp": "bmp",
+    "image/tiff": "tif",
     "image/svg+xml": "svg",
     "application/pdf": "pdf",
     "text/plain": "txt",
@@ -70,14 +75,51 @@ function looksLikeUtf8Text(buf) {
         if (byte === 0)
             return false;
     }
-    try {
-        const decoder = new TextDecoder("utf-8", { fatal: true });
-        decoder.decode(buf);
-        return true;
-    }
-    catch {
-        return false;
+    return decodesAsUtf8ToleratingTailTruncation(buf);
+}
+/**
+ * Maximum bytes one UTF-8 code point can occupy. A TRAILING code point that
+ * was cut off by the sampling window contributes at most one byte less than
+ * a full character (a complete 4-byte character would decode), so backing up
+ * `MAX_UTF8_CHAR_BYTES - 1` bytes always reaches the preceding boundary.
+ */
+const MAX_UTF8_CHAR_BYTES = 4;
+/**
+ * Whether `buf` decodes cleanly as UTF-8, allowing its FINAL multi-byte
+ * character to be cut off at the buffer end.
+ *
+ * Why the tolerance: sniffMime only receives the first 4096 bytes of a
+ * larger file (the viewer's `SNIFF_BYTES` window in src/files/routes.ts and
+ * the upload-pipeline head). Content dense in multi-byte characters —
+ * Chinese, Japanese, emoji, ... — regularly leaves that window slicing
+ * clean through a character. A strict whole-buffer fatal decode then
+ * misclassifies perfectly valid UTF-8 text as binary, so the viewer
+ * force-downloads it instead of previewing it (real-world regression:
+ * ~100 of the markdown notes under ~/mine/space downloaded instead of
+ * rendering, even though every one of them was valid UTF-8).
+ *
+ * This relaxes ONLY the tail: a truncated trailing code point occupies at
+ * most 3 bytes of the buffer, so backing up at most 3 bytes reaches a
+ * character boundary — and the loop never trims the whole buffer, because an
+ * empty prefix would trivially "decode" and would turn short garbage buffers
+ * into text. NUL bytes and genuinely invalid sequences elsewhere fail every
+ * prefix attempt and still fall through to application/octet-stream — the
+ * "binary stays binary" security posture of the sniff is unchanged.
+ */
+function decodesAsUtf8ToleratingTailTruncation(buf) {
+    for (let end = buf.length; end >= Math.max(1, buf.length - (MAX_UTF8_CHAR_BYTES - 1)); end--) {
+        try {
+            // Fresh decoder per attempt: reuse-after-throw is not part of the
+            // TextDecoder contract across implementations.
+            new TextDecoder("utf-8", { fatal: true }).decode(buf.subarray(0, end));
+            return true;
+        }
+        catch {
+            // Cut deeper into the tail. Only a trailing truncated character can
+            // make a later attempt succeed — real corruption fails all of them.
+        }
     }
+    return false;
 }
 /**
  * Mimes we are willing to render inline in <img>. Everything else is forced
@@ -93,6 +135,26 @@ const INLINE_MIMES = new Set([
 export function isInlineMime(mime) {
     return INLINE_MIMES.has(mime.toLowerCase());
 }
+/**
+ * Image mimes the upstream model accepts as inline ACP image blocks.
+ *
+ * This is deliberately a SEPARATE set from INLINE_MIMES even though the two
+ * currently hold the same values: INLINE_MIMES is a display/XSS policy (which
+ * mimes may be served `Content-Disposition: inline` in the browser), while
+ * UPSTREAM_IMAGE_MIMES is an upstream compatibility policy (which image
+ * containers the model provider accepts on the wire). They answer different
+ * questions and will diverge — e.g. upstream support for HEIC would change
+ * only this set. Never reference one from the other's check.
+ */
+const UPSTREAM_IMAGE_MIMES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+]);
+export function isUpstreamImageMime(mime) {
+    return UPSTREAM_IMAGE_MIMES.has(mime.toLowerCase());
+}
 /**
  * Classify an upload as "image" (sent as ACP image block, inlined as base64)
  * or "file" (sent as ACP resource_link). Decision is mime-prefix-based —

package/lib/auth-middleware.js

@@ -1,5 +1,6 @@
-// All whitelisted paths must be GETs that read non-sensitive data, or static
-// assets needed before the user can present a token.
+// All whitelisted paths must be GETs that either read non-sensitive data,
+// serve static assets needed before the user can present a token, or enforce
+// independent ticket/HMAC authentication inside their route handler.
 const WHITELIST = [
     // Public probes
     { method: "GET", test: (p) => p === "/api/v1/version" },
@@ -26,15 +27,21 @@ const WHITELIST = [
     { method: "GET", test: (p) => p === "/api/v1/events/stream" },
     {
         method: "GET",
-        test: (p) => /^\/api\/v1\/sessions\/[A-Za-z0-9_-]+\/events\/stream$/.test(p),
+        test: (p) => /^\/api\/v1\/tasks\/[A-Za-z0-9_-]+\/events\/stream$/.test(p),
     },
     // Image GETs — authenticated via HMAC sig+exp query string (an <img>
     // tag cannot send Authorization headers). The image route handler does
     // its own verification before serving bytes.
     {
         method: "GET",
-        test: (p) => /^\/api\/v1\/sessions\/[A-Za-z0-9_-]+\/attachments\/[A-Za-z0-9._-]+$/.test(p),
+        test: (p) => /^\/api\/v1\/tasks\/[A-Za-z0-9_-]+\/attachments\/[A-Za-z0-9._-]+$/.test(p),
     },
+    // File viewer content — read-only bytes for one confirmed path,
+    // authenticated via HMAC sig+exp query string for the same reason as
+    // image GETs above (media tags / downloads cannot send Authorization
+    // headers). The content handler verifies the signature before serving:
+    // without a valid sig+exp it returns 401, never bytes.
+    { method: "GET", test: (p) => p === "/api/v1/files/content" },
     // --- Share viewer (public read-only snapshots) ---
     // Viewer HTML shell + image proxy + viewer-namespaced static assets
     // (CSS/JS) all live under /s/* — see src/share/routes.ts. The auth gate

package/lib/auth.js

@@ -75,12 +75,12 @@ export function verifyAttachmentSig(path, expRaw, sigHex, secret) {
     return timingSafeEqual(actual, expected);
 }
 /**
- * Rewrite every `/api/v1/sessions/:id/attachments/:file` URL inside a JSON-serialized
+ * Rewrite every `/api/v1/tasks/:id/attachments/:file` URL inside a JSON-serialized
  * payload to carry a fresh `?exp=&sig=`. Applied at egress (history GET, SSE
  * push) so a 1h-old stored URL is re-signed on the way out — the user can
  * reload history days later and images still resolve.
  */
-const ATTACHMENT_URL_RE = /\/api\/v1\/sessions\/[A-Za-z0-9_-]+\/attachments\/[A-Za-z0-9._-]+(?:\?(?:exp=\d+&sig=[a-f0-9]+|sig=[a-f0-9]+&exp=\d+))?/g;
+const ATTACHMENT_URL_RE = /\/api\/v1\/tasks\/[A-Za-z0-9_-]+\/attachments\/[A-Za-z0-9._-]+(?:\?(?:exp=\d+&sig=[a-f0-9]+|sig=[a-f0-9]+&exp=\d+))?/g;
 export function reSignAttachmentUrlsInJson(json, secret, ttlSeconds = 3600) {
     return json.replace(ATTACHMENT_URL_RE, (match) => {
         const basePath = match.split("?")[0];