@mulmobridge/chat-service 0.1.4 → 0.1.7

package/dist/chat-state.d.ts

@@ -11,9 +11,26 @@ export interface ChatStateStore {
     getChatState(transportId: string, externalChatId: string): Promise<TransportChatState | null>;
     setChatState(transportId: string, state: TransportChatState): Promise<void>;
     resetChatState(transportId: string, externalChatId: string, roleId: string): Promise<TransportChatState>;
-    connectSession(transportId: string, externalChatId: string, chatSessionId: string): Promise<TransportChatState | null>;
+    /** Repoint the persisted chat state at another session. `roleId` is
+     *  optional: when omitted, the existing state's roleId is preserved
+     *  (the old default, kept for HTTP `/connect` callers that only know
+     *  the session ID). Callers that DO know the target session's role —
+     *  notably the `/switch` command, which already has `SessionSummary.roleId`
+     *  from `/sessions` — MUST pass it, otherwise the file-backed state
+     *  drifts into a stale-role / new-session pair and the next relay's
+     *  `startChat` uses the mismatched pair (issue #1888). */
+    connectSession(transportId: string, externalChatId: string, chatSessionId: string, roleId?: string): Promise<TransportChatState | null>;
     generateSessionId(transportId: string, externalChatId: string): string;
 }
+/** True iff `sessionId` is safe to persist into transport state and later
+ *  hand to session-metadata / event-log readers on the host side. Adds an
+ *  explicit `..` rejection on top of `isSafeId` — the safe-id character
+ *  class alone would accept the literal `..` and let a state file written
+ *  by `/connect` poison downstream commands (e.g. `/history` reading the
+ *  poisoned sessionId back through `readSessionJsonl`). Applied at the
+ *  `/connect` route entry AND inside `connectSession` as defense-in-depth
+ *  (issue #1896 follow-up to #1888 / #1895). */
+export declare function isSafeSessionId(sessionId: string): boolean;
 export declare function createChatStateStore(opts: {
     transportsDir: string;
     logger: Logger;

package/dist/chat-state.js

@@ -15,6 +15,23 @@ import { writeFileAtomic } from "./atomic-write.js";
 function isSafeId(id) {
     return /^[\w.-]+$/.test(id) && id.length > 0 && id.length <= 200;
 }
+/** True iff `sessionId` is safe to persist into transport state and later
+ *  hand to session-metadata / event-log readers on the host side. Adds an
+ *  explicit `..` rejection on top of `isSafeId` — the safe-id character
+ *  class alone would accept the literal `..` and let a state file written
+ *  by `/connect` poison downstream commands (e.g. `/history` reading the
+ *  poisoned sessionId back through `readSessionJsonl`). Applied at the
+ *  `/connect` route entry AND inside `connectSession` as defense-in-depth
+ *  (issue #1896 follow-up to #1888 / #1895). */
+export function isSafeSessionId(sessionId) {
+    if (typeof sessionId !== "string")
+        return false;
+    if (!isSafeId(sessionId))
+        return false;
+    if (sessionId.includes(".."))
+        return false;
+    return true;
+}
 // ── Factory ──────────────────────────────────────────────────
 export function createChatStateStore(opts) {
     const { transportsDir, logger } = opts;
@@ -57,13 +74,30 @@ export function createChatStateStore(opts) {
         });
         return state;
     };
-    const connectSession = async (transportId, externalChatId, chatSessionId) => {
+    const connectSession = async (transportId, externalChatId, chatSessionId, roleId) => {
+        // Defense-in-depth: even though the /connect route validates chatSessionId
+        // at entry, refuse to persist an unsafe value here too. Otherwise a caller
+        // that bypasses the route (test harness, alternate transport, direct store
+        // access) could still write a hostile sessionId into the state file — and
+        // downstream commands like /history would later read that back into
+        // path-traversing filesystem operations. Return null so the route surfaces
+        // it as 404 (same as "no state for this chat"); either way the caller
+        // can't succeed with a hostile input. Issue #1896.
+        if (!isSafeSessionId(chatSessionId)) {
+            logger.warn("chat-state", "refused to connect unsafe sessionId", { transportId, externalChatId });
+            return null;
+        }
         const existing = await getChatState(transportId, externalChatId);
         if (!existing)
             return null;
         const updated = {
             ...existing,
             sessionId: chatSessionId,
+            // A missing `roleId` arg means "preserve the current role" (that's
+            // the HTTP `/connect` route, which doesn't know the target's role);
+            // when the caller passes one (`/switch`), take theirs so state and
+            // downstream `startChat` agree on which role runs the resumed session.
+            ...(roleId !== undefined ? { roleId } : {}),
             updatedAt: new Date().toISOString(),
         };
         await setChatState(transportId, updated);
@@ -71,6 +105,7 @@ export function createChatStateStore(opts) {
             transportId,
             externalChatId,
             sessionId: chatSessionId,
+            roleId: updated.roleId,
         });
         return updated;
     };

package/dist/commands.js

@@ -211,7 +211,12 @@ export function createCommandHandler(opts) {
                 };
             }
         }
-        const updated = await connectSession(transportId, chatState.externalChatId, target.id);
+        // Pass `target.roleId` so the persisted state's role tracks the session
+        // we just repointed at. Without this, `connectSession` would swap the
+        // sessionId but leave the previous role in place, and the next relay's
+        // `startChat` would run the resumed session under the wrong role
+        // (issue #1888).
+        const updated = await connectSession(transportId, chatState.externalChatId, target.id, target.roleId);
         if (!updated) {
             return { reply: "Failed to switch session." };
         }

package/dist/index.js

@@ -17,7 +17,7 @@
 // standalone npm package without internal edits. See #269 / #305.
 import { Router } from "express";
 import { CHAT_SERVICE_ROUTES } from "@mulmobridge/protocol";
-import { createChatStateStore } from "./chat-state.js";
+import { createChatStateStore, isSafeSessionId } from "./chat-state.js";
 import { createCommandHandler } from "./commands.js";
 import { createRelay } from "./relay.js";
 import { createPushQueue } from "./push-queue.js";
@@ -97,7 +97,42 @@ export function createChatService(deps) {
             badRequest(res, "chatSessionId is required");
             return;
         }
-        const updated = await store.connectSession(transportId, externalChatId, chatSessionId);
+        // Reject hostile / malformed sessionIds at the entry so they can't be
+        // persisted into transport state. Without this gate a caller could POST
+        // `{"chatSessionId": "../../etc/x"}`, the value would land in the state
+        // file, and a later `/history` command would read it back and hand it to
+        // `readSessionJsonl` — whose backing reader is documented as "internal
+        // fixed paths only, no `..` traversal guard". Also defended inside
+        // `connectSession` for defense-in-depth (issue #1896 follow-up to #1895).
+        if (!isSafeSessionId(chatSessionId)) {
+            badRequest(res, "chatSessionId has an unsafe format");
+            return;
+        }
+        // Resolve the target session's role BEFORE calling connectSession so the
+        // persisted state's `roleId` tracks the new session's role — otherwise the
+        // next relay's `startChat` would resume the new session under the previous
+        // role (#1888 / #1894). Three fallback paths all treated as "preserve
+        // existing role":
+        //   1. No `getSessionRole` wired at all (backward compat for older hosts).
+        //   2. Resolver returns null (unknown / corrupt session metadata).
+        //   3. Resolver throws (host bug / timeout / IO error) — catch here so
+        //      the route can never bubble the failure as a 500 to the API caller
+        //      (codex review on #1895; the MulmoClaude host's resolver is
+        //      hardened but the DI contract doesn't require hosts to be).
+        let resolvedRole = null;
+        if (deps.getSessionRole) {
+            try {
+                resolvedRole = await deps.getSessionRole(chatSessionId);
+            }
+            catch (err) {
+                logger.warn("chat-service", "getSessionRole threw; falling back to preserving existing role", {
+                    chatSessionId,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                resolvedRole = null;
+            }
+        }
+        const updated = await store.connectSession(transportId, externalChatId, chatSessionId, resolvedRole ?? undefined);
         if (!updated) {
             notFound(res, "No chat state found for this transport");
             return;

package/dist/types.d.ts

@@ -122,6 +122,17 @@ export interface ChatServiceDeps {
         }>;
         total: number;
     }>;
+    /**
+     * Resolve the roleId a given session was started with. Used by the HTTP
+     * `/connect` route so the persisted bridge state's role tracks the target
+     * session's role after a repoint — same drift-fix as bridge `/switch`
+     * (issue #1888 / #1894), but for API callers that only supply a session ID.
+     * Returns null when the session isn't found OR when its role isn't known;
+     * on null the route falls back to the previous "preserve current role"
+     * behaviour (safe default). Omit this dep entirely to keep the old
+     * session-id-only semantics.
+     */
+    getSessionRole?: (sessionId: string) => Promise<string | null>;
     /**
      * Return the skills the bridge command handler should expose. The
      * handler uses the result for two things:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmobridge/chat-service",
-  "version": "0.1.4",
+  "version": "0.1.7",
   "description": "Server-side chat service for MulmoBridge — socket.io + REST bridge to Claude Code agents",
   "type": "module",
   "main": "./dist/index.js",