@m8i-51/shoal 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m8i-51/shoal",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "description": "Multi-agent web exploration framework — finds bugs, UX issues, and missing features by running AI agents against your app",
   "repository": {
@@ -38,6 +38,7 @@
     "@clack/prompts": "^1.3.0",
     "dotenv": "^17.3.1",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.5.0",
     "openai": "^6.33.0",
     "playwright": "^1.59.1",
     "tsx": "^4.21.0"

package/server/index.ts

@@ -1,7 +1,8 @@
 import "dotenv/config";
 import express from "express";
+import { rateLimit } from "express-rate-limit";
 import { fileURLToPath } from "url";
-import { dirname, join } from "path";
+import { dirname, join, resolve } from "path";
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { listRuns, getReportPath } from "./runs.js";
 import { activeSessions, spawnRun, cancelSession } from "./runner.js";
@@ -15,11 +16,23 @@ function specFilePath(baseUrl: string): string {
   }
 }
 
+const RUN_ID_RE = /^run_\d+$/;
+function isValidRunId(id: string): boolean {
+  return RUN_ID_RE.test(id);
+}
+
+const logsBase = resolve(process.cwd(), "logs");
+function safeLogPath(filename: string): string | null {
+  const p = resolve(logsBase, filename);
+  return p.startsWith(logsBase + "/") ? p : null;
+}
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const app = express();
 const PORT = parseInt(process.env.PORT ?? "4000", 10);
 
 app.use(express.json());
+app.use(rateLimit({ windowMs: 60_000, limit: 120 }));
 
 // ----------------------------------------------------------------
 // API: product spec (goals)
@@ -80,7 +93,12 @@ app.get("/api/runs", (_req, res) => {
 // API: serve HTML report for a run
 // ----------------------------------------------------------------
 app.get("/api/runs/:runId/report", (req, res) => {
-  const reportPath = getReportPath(req.params.runId);
+  const { runId } = req.params;
+  if (!isValidRunId(runId)) {
+    res.status(400).json({ error: "invalid run id" });
+    return;
+  }
+  const reportPath = getReportPath(runId);
   if (!reportPath) {
     res.status(404).json({ error: "report not found" });
     return;
@@ -157,14 +175,18 @@ function sseStream(req: express.Request, res: express.Response, sessionId: strin
 // API: SSE — /api/sessions/:sessionId/events（後方互換）
 // ----------------------------------------------------------------
 app.get("/api/sessions/:sessionId/events", (req, res) => {
-  sseStream(req, res, req.params.sessionId);
+  const { sessionId } = req.params;
+  if (!isValidRunId(sessionId)) { res.status(400).json({ error: "invalid session id" }); return; }
+  sseStream(req, res, sessionId);
 });
 
 // ----------------------------------------------------------------
 // API: SSE — /api/runs/:runId/events（詳細ページ用）
 // ----------------------------------------------------------------
 app.get("/api/runs/:runId/events", (req, res) => {
-  sseStream(req, res, req.params.runId);
+  const { runId } = req.params;
+  if (!isValidRunId(runId)) { res.status(400).json({ error: "invalid run id" }); return; }
+  sseStream(req, res, runId);
 });
 
 // ----------------------------------------------------------------
@@ -172,6 +194,10 @@ app.get("/api/runs/:runId/events", (req, res) => {
 // ----------------------------------------------------------------
 app.get("/api/runs/:runId/log", (req, res) => {
   const { runId } = req.params;
+  if (!isValidRunId(runId)) {
+    res.status(400).json({ error: "invalid run id" });
+    return;
+  }
 
   // 1. アクティブセッション（インメモリ）を優先
   const session = activeSessions.get(runId);
@@ -181,8 +207,8 @@ app.get("/api/runs/:runId/log", (req, res) => {
   }
 
   // 2. 保存済みログファイルにフォールバック
-  const logFilePath = join(process.cwd(), "logs", `log_${runId}.txt`);
-  if (existsSync(logFilePath)) {
+  const logFilePath = safeLogPath(`log_${runId}.txt`);
+  if (logFilePath && existsSync(logFilePath)) {
     const lines = readFileSync(logFilePath, "utf-8").split("\n").filter((l) => l !== "");
     res.json({ lines, done: true, exitCode: null });
     return;

package/server/runs.ts

@@ -98,6 +98,7 @@ export function listRuns(): RunSummary[] {
 }
 
 export function getReportPath(runId: string): string | null {
+  if (!/^run_\d+$/.test(runId)) return null;
   const p = path.join(process.cwd(), "logs", `report_${runId}.html`);
   return fs.existsSync(p) ? p : null;
 }