@linxin666/dsh-pet 0.2.8 → 0.3.0

package/src/http.ts

@@ -0,0 +1,105 @@
+// Generated by scripts/sync-shared.mjs from shared/host/http.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
+ * family's route module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-ui-shared/host/http
+ */
+
+import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http'
+
+/** Default body cap for readJsonBody: 64 KiB. */
+const DEFAULT_JSON_BODY_MAX_BYTES = 64 * 1024
+
+/** Family-default JSON response headers; callers may append or override. */
+const JSON_HEADERS = {
+  'content-type': 'application/json; charset=utf-8',
+  'referrer-policy': 'no-referrer',
+} satisfies OutgoingHttpHeaders
+
+/**
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
+ */
+export async function readBoundedJson(req: IncomingMessage, maxBytes: number): Promise<unknown> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = chunk as Buffer
+    size += buffer.length
+    if (size > maxBytes) throw new Error('body too large')
+    chunks.push(buffer)
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+}
+
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export async function readJsonBody(
+  req: IncomingMessage,
+  opts: { maxBytes?: number; objectOnly?: boolean } = {},
+): Promise<unknown | null> {
+  const maxBytes = opts.maxBytes ?? DEFAULT_JSON_BODY_MAX_BYTES
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = chunk as Buffer
+    size += buffer.length
+    if (size > maxBytes) {
+      req.destroy()
+      return null
+    }
+    chunks.push(buffer)
+  }
+  const text = Buffer.concat(chunks).toString('utf8')
+  if (text === '') return null
+  try {
+    const parsed: unknown = JSON.parse(text)
+    if (opts.objectOnly && !isJsonObject(parsed)) return null
+    return parsed
+  } catch {
+    return null
+  }
+}
+
+/** Whether a value is a JSON object: typeof object, not null, not an array. */
+function isJsonObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export function asJsonObject(value: unknown): Record<string, unknown> | undefined {
+  return isJsonObject(value) ? value : undefined
+}
+
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export function writeJson(
+  res: ServerResponse,
+  status: number,
+  body: unknown,
+  headers: OutgoingHttpHeaders = {},
+): void {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, { ...JSON_HEADERS, ...headers })
+  res.end(payload)
+}

package/src/registry.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { closeSync, existsSync, ftruncateSync, mkdirSync, mkdtempSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
@@ -8,6 +8,7 @@ import {
   DEFAULT_TRACK_PATTERNS,
   PET_ROW_ORDER,
   PET_SCAN_JSON_CAP,
+  PET_SCAN_LIVE2D_MODEL_CAP,
   codexPetsDir,
   loadPetRegistry,
   petAtlasFile,
@@ -261,6 +262,41 @@ describe('loadPetRegistry', () => {
       rmSync(root, { recursive: true, force: true })
     }
   })
+
+  it('skips an oversized pet.json with a warning instead of reading it', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'loud'), { recursive: true })
+      writeFileSync(join(petsDir, 'loud', 'pet.json'), '{ ' + 'x'.repeat(PET_SCAN_JSON_CAP) + ' }', 'utf8')
+      // A healthy neighbor keeps listing while the pathological one is skipped.
+      mkdirSync(join(petsDir, 'plain'), { recursive: true })
+      writeFileSync(join(petsDir, 'plain', 'pet.json'), JSON.stringify({
+        id: 'plain', displayName: 'Plain', spritesheetPath: 'spritesheet.webp',
+      }), 'utf8')
+      writeFileSync(join(petsDir, 'plain', 'spritesheet.webp'), 'webp', 'utf8')
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.byId('loud')).toBeUndefined()
+      expect(registry.byId('plain')).toBeDefined()
+      expect(registry.warnings.some(w => w.includes('scan ceiling'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it('skips a non-regular pet.json with a warning', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'odd', 'pet.json'), { recursive: true })
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.entries.map(entry => entry.id)).toEqual([])
+      expect(registry.warnings.some(w => w.includes('not a regular file'))).toBe(true)
+      expect(registry.diagnostics.some(d => d.level === 'warning' && d.message.includes('pet manifest is not a regular file'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
 })
 
 describe('codexPetsDir', () => {
@@ -479,6 +515,52 @@ describe('loadPetRegistry pet-center v2 (issue #623)', () => {
       rmSync(root, { recursive: true, force: true })
     }
   })
+
+  it('skips a live2d pet whose model3.json exceeds the model scan ceiling with a warning', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'haru'), { recursive: true })
+      writeFileSync(join(petsDir, 'haru', 'pet.json'), JSON.stringify({
+        petManifestVersion: 2, id: 'haru', displayName: 'Haru', license: 'Live2D-Sample',
+        renderer: 'live2d', live2d: { model: 'haru.model3.json', motions: { idle: 'Idle' } },
+      }), 'utf8')
+      // A sparse file one byte past the ceiling: stat reports the size
+      // without materializing 32 MB of bytes on disk.
+      const fd = openSync(join(petsDir, 'haru', 'haru.model3.json'), 'w')
+      try {
+        ftruncateSync(fd, PET_SCAN_LIVE2D_MODEL_CAP + 1)
+      } finally {
+        closeSync(fd)
+      }
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.byId('haru')).toBeUndefined()
+      expect(registry.warnings.some(w => w.includes('scan ceiling'))).toBe(true)
+      expect(registry.diagnostics.some(d => d.level === 'warning'
+        && d.message.includes('exceeds the ' + PET_SCAN_LIVE2D_MODEL_CAP + '-byte scan ceiling'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it('skips a live2d pet whose model3.json is not a regular file with a warning', () => {
+    const root = tempDir()
+    try {
+      const petsDir = join(root, 'pets')
+      mkdirSync(join(petsDir, 'haru', 'haru.model3.json'), { recursive: true })
+      writeFileSync(join(petsDir, 'haru', 'pet.json'), JSON.stringify({
+        petManifestVersion: 2, id: 'haru', displayName: 'Haru', license: 'Live2D-Sample',
+        renderer: 'live2d', live2d: { model: 'haru.model3.json', motions: { idle: 'Idle' } },
+      }), 'utf8')
+      const registry = loadPetRegistry({ packageRoot: join(root, 'none'), petsDir, dshPetsDir: '' })
+      expect(registry.byId('haru')).toBeUndefined()
+      expect(registry.warnings.some(w => w.includes('not a regular file'))).toBe(true)
+      expect(registry.diagnostics.some(d => d.level === 'warning'
+        && d.message.includes('live2d model haru.model3.json is not a regular file'))).toBe(true)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
 })
 
 describe('voice packs (pet-center M4, issue #677)', () => {

package/src/registry.ts

@@ -516,9 +516,20 @@ function resolveLive2dEntry(
     record('error', 'pet ' + manifest.id + ': renderer live2d requires a live2d block')
     return undefined
   }
+  const modelFile = join(dir, block.model)
   let model3: unknown
   try {
-    model3 = JSON.parse(readFileSync(join(dir, block.model), 'utf8'))
+    // Stat guard before the read: a pathological model file — huge, or a
+    // FIFO/device — is skipped with a warning instead of stalling the host
+    // at scan time, mirroring the voice/decoration descriptor discipline.
+    // The guard stays silent on stat errors, so a missing or unreadable
+    // path is re-stat'ed here to fall through to the original fail-closed
+    // 'not readable' diagnostic below.
+    if (guardedScannedJsonStat(modelFile, options, 'live2d model ' + block.model, PET_SCAN_LIVE2D_MODEL_CAP) === undefined) {
+      statSync(modelFile)
+      return undefined
+    }
+    model3 = JSON.parse(readFileSync(modelFile, 'utf8'))
   } catch (error) {
     record('error', 'pet ' + manifest.id + ': live2d model ' + block.model + ' is not readable: '
       + (error instanceof Error ? error.message : String(error)))
@@ -583,7 +594,7 @@ function scanPetDir(dir: string, options: { assetPrefix?: string; warnings?: str
   for (const name of names) {
     const manifestFile = join(dir, name, 'pet.json')
     if (!existsSync(manifestFile)) continue
-    const parsed = readPetJson(manifestFile, options.warnings)
+    const parsed = readPetJson(manifestFile, options)
     if (parsed === undefined) continue
     const entryDir = join(dir, name)
     const verdict = parsePetManifest(parsed, entryDir)
@@ -613,12 +624,21 @@ function scanPetDir(dir: string, options: { assetPrefix?: string; warnings?: str
   return entries
 }
 
-/** Read and parse one manifest file; undefined (warning recorded) on failure. */
-function readPetJson(file: string, warnings: string[] | undefined): unknown {
+/**
+ * Read and parse one pet.json manifest; undefined (warning recorded) on
+ * failure. The descriptor stat guard applies first: a pathological file —
+ * huge, or a FIFO/device — is skipped with a warning instead of stalling
+ * or OOM-ing the host at scan time (same discipline as voice/decoration).
+ */
+function readPetJson(
+  file: string,
+  options: { warnings?: string[]; diagnostics?: PetRegistryDiagnostic[] },
+): unknown {
+  if (guardedScannedJsonStat(file, options, 'pet manifest') === undefined) return undefined
   try {
     return JSON.parse(readFileSync(file, 'utf8'))
   } catch (error) {
-    warnings?.push('skipping ' + file + ': ' + (error instanceof Error ? error.message : String(error)))
+    options.warnings?.push('skipping ' + file + ': ' + (error instanceof Error ? error.message : String(error)))
     return undefined
   }
 }
@@ -632,16 +652,28 @@ function readPetJson(file: string, warnings: string[] | undefined): unknown {
  */
 export const PET_SCAN_JSON_CAP = 64 * 1024
 
+/**
+ * Scan-time read ceiling for a live2d model3.json, matching the asset
+ * route's model cap (PET_ASSET_CAPS.model). Model descriptors are far
+ * larger than the other scanned JSON, but a pathological file — huge, or a
+ * FIFO/device — must still be skipped with a warning instead of stalling
+ * or OOM-ing the host at plugin startup (same review-spd follow-up).
+ */
+export const PET_SCAN_LIVE2D_MODEL_CAP = 32 * 1024 * 1024
+
 /**
  * Stat one scanned JSON descriptor with a regular-file + size guard, so a
  * pathological user file is skipped with a warning instead of stalling or
  * OOM-ing the host at startup. Returns the Stats, or undefined when the
- * caller must skip the file (a warning was recorded).
+ * caller must skip the file (a warning was recorded). 'cap' defaults to
+ * the descriptor ceiling (PET_SCAN_JSON_CAP); model descriptors pass the
+ * larger live2d ceiling.
  */
 function guardedScannedJsonStat(
   file: string,
   options: { warnings?: string[]; diagnostics?: PetRegistryDiagnostic[] },
   what: string,
+  cap: number = PET_SCAN_JSON_CAP,
 ): ReturnType<typeof statSync> | undefined {
   let st: ReturnType<typeof statSync>
   try {
@@ -657,8 +689,8 @@ function guardedScannedJsonStat(
     warn(what + ' is not a regular file; ignored')
     return undefined
   }
-  if (st.size > PET_SCAN_JSON_CAP) {
-    warn(what + ' exceeds the ' + PET_SCAN_JSON_CAP + '-byte scan ceiling; ignored')
+  if (st.size > cap) {
+    warn(what + ' exceeds the ' + cap + '-byte scan ceiling; ignored')
     return undefined
   }
   return st

package/src/routes.ts

@@ -23,6 +23,7 @@ import type { PetInteraction } from './affinity.ts'
 import { DECORATION_ASSET_PREFIX, petEntryView, petPackageRoot, type PetEntry, type PetRegistry } from './registry.ts'
 import { isPetAllowed } from './access.ts'
 import { dshHome } from './dsh-home.ts'
+import { readJsonBody, writeJson } from './http.ts'
 
 /** Browser-facing base path of the pet API. */
 export const PET_API_PREFIX = '/api/pet'
@@ -97,52 +98,17 @@ function mimeFor(file: string): string {
   return MIME_BY_EXT[file.slice(dot).toLowerCase()] ?? 'application/octet-stream'
 }
 
-/** Write one JSON response. */
-function json(res: ServerResponse, status: number, body: unknown): void {
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' })
-  res.end(JSON.stringify(body))
-}
-
 /** Require the method or answer 405. */
 function requireMethod(req: IncomingMessage, res: ServerResponse, method: string): boolean {
   if (req.method === method) return true
-  json(res, 405, { ok: false, error: 'method-not-allowed' })
+  writeJson(res, 405, { ok: false, error: 'method-not-allowed' })
   return false
 }
 
-/** Read a JSON request body (bounded). */
-function readJsonBody(req: IncomingMessage): Promise<unknown> {
-  return new Promise((resolve, reject) => {
-    let size = 0
-    const chunks: Buffer[] = []
-    req.on('data', (chunk: Buffer) => {
-      size += chunk.length
-      if (size > 64 * 1024) {
-        reject(new Error('body-too-large'))
-        queueMicrotask(() => req.destroy())
-        return
-      }
-      chunks.push(chunk)
-    })
-    req.on('end', () => {
-      if (chunks.length === 0) {
-        resolve({})
-        return
-      }
-      try {
-        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')))
-      } catch {
-        reject(new Error('invalid-json'))
-      }
-    })
-    req.on('error', reject)
-  })
-}
-
 /** Shared route fence: loopback always passes; a live paired-device cookie is an extra allow path. */
 function guard(ctx: Context, req: IncomingMessage, res: ServerResponse): boolean {
   if (isPetAllowed(ctx, req)) return true
-  json(res, 403, { ok: false, error: 'forbidden: loopback-only' })
+  writeJson(res, 403, { ok: false, error: 'forbidden: loopback-only' })
   return false
 }
 
@@ -154,8 +120,8 @@ function getRoute(ctx: Context, path: string, run: () => Promise<unknown>): WebR
     handler: (req: IncomingMessage, res: ServerResponse): void => {
       if (!guard(ctx, req, res)) return
       if (!requireMethod(req, res, 'GET')) return
-      run().then((value) => json(res, 200, value), (error) => {
-        json(res, 500, { ok: false, error: error instanceof Error ? error.message : String(error) })
+      run().then((value) => writeJson(res, 200, value), (error) => {
+        writeJson(res, 500, { ok: false, error: error instanceof Error ? error.message : String(error) })
       })
     },
   }
@@ -169,16 +135,21 @@ function postRoute(ctx: Context, path: string, run: (body: Record<string, unknow
     handler: (req: IncomingMessage, res: ServerResponse): Promise<void> => {
       if (!guard(ctx, req, res)) return Promise.resolve()
       if (!requireMethod(req, res, 'POST')) return Promise.resolve()
-      return readJsonBody(req).then((body) => {
-        const record = (typeof body === 'object' && body !== null) ? body as Record<string, unknown> : {}
+      // Shared lenient reader (64 KiB cap): an empty body yields null and is
+      // restored to {} at the call site (legacy empty-body semantics); invalid
+      // JSON and over-limit bodies also yield null, so the endpoint validators
+      // below keep answering 400 with the same { ok: false, error } envelope.
+      return readJsonBody(req, { maxBytes: 64 * 1024 }).then((parsed) => {
+        const payload = parsed ?? {}
+        const record = (typeof payload === 'object' && payload !== null) ? payload as Record<string, unknown> : {}
         return run(record).then(
-          (value) => json(res, 200, value),
+          (value) => writeJson(res, 200, value),
           (error) => {
-            json(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
+            writeJson(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
           },
         )
       }, (error) => {
-        json(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
+        writeJson(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) })
       })
     },
   }
@@ -393,7 +364,7 @@ function runtimeHandler(ctx: Context, roots: { runtimeDir: string; vendorDir: st
     const base = spec.root === 'runtimeDir' ? roots.runtimeDir : roots.vendorDir
     const file = join(base, name)
     if (!existsSync(file)) {
-      json(res, 404, { ok: false, error: 'runtime-file-missing', file: name })
+      writeJson(res, 404, { ok: false, error: 'runtime-file-missing', file: name })
       return
     }
     const resolved = containedRealpath(base, file)

package/src/service.ts

@@ -234,6 +234,12 @@ export class PetService extends Service {
    * disposed sessions are removed by the 'session/disposed' listener.
    */
   private readonly sessionActivity = new Map<Session, SessionActivity>()
+  /**
+   * Sessions whose reward source is the official event stream. This metadata
+   * outlives transient visual resets so a derived legacy `done` cannot reward
+   * the same turn again after the pet is disabled and re-enabled.
+   */
+  private readonly officialEventSessions = new WeakSet<Session>()
 
   constructor(ctx: Context, config: PetConfig = {}) {
     super(ctx, 'pet')
@@ -356,6 +362,7 @@ export class PetService extends Service {
   setEnabled(enabled: boolean): void {
     this.enabled = enabled
     this.syncActivity()
+    if (!enabled) this.resetActivity()
   }
 
   private syncActivity(): void {
@@ -391,6 +398,7 @@ export class PetService extends Service {
           const transition = projectOfficialEvent(event, runtime)
           if (transition === undefined) return
           runtime.officialEventsSeen = true
+          this.officialEventSessions.add(session)
           this.applyActivity(session, transition.input, transition.whisper)
           if (transition.completedTurn !== undefined) {
             this.rewardTurn(String(session.id), transition.completedTurn)
@@ -398,6 +406,7 @@ export class PetService extends Service {
         }),
         this.ctx.on('session/disposed', (session: Session) => {
           this.ledger.forgetSession(String(session.id))
+          this.officialEventSessions.delete(session)
           this.sessionActivity.delete(session)
           if (session !== this.displaySession) return
           // The display session is gone: fall back to the most recent
@@ -418,12 +427,21 @@ export class PetService extends Service {
     })()
   }
 
+  /** Drop transient activity because terminal events missed while disabled cannot be replayed safely. */
+  private resetActivity(): void {
+    this.displaySession = undefined
+    this.sessionActivity.clear()
+    this.machine.onSessionDisposed()
+  }
+
   /** Return the per-session activity record, creating it on first sight. */
   private activityOf(session: Session): SessionActivity {
     let activity = this.sessionActivity.get(session)
     if (activity === undefined) {
+      const runtime = emptyProjectionRuntime(this.voicePools())
+      runtime.officialEventsSeen = this.officialEventSessions.has(session)
       activity = {
-        runtime: emptyProjectionRuntime(this.voicePools()),
+        runtime,
         machine: new PetStateMachine(this.stateConfig),
       }
       this.sessionActivity.set(session, activity)