@neta-art/cohub-cli 3.10.2 → 3.12.0

package/dist/safe-remote-image.js

@@ -0,0 +1,160 @@
+import dns from "node:dns/promises";
+import http from "node:http";
+import https from "node:https";
+import { isIP } from "node:net";
+import { isPublicBoardRemoteAddress, normalizeBoardRemoteUrl, } from "@neta-art/cohub/board";
+export const REMOTE_IMAGE_MAX_BYTES = 16 * 1024 * 1024;
+export const REMOTE_IMAGE_TIMEOUT_MS = 15_000;
+const MAX_REDIRECTS = 3;
+const IMAGE_MIME_TYPES = new Set([
+    "image/avif",
+    "image/gif",
+    "image/jpeg",
+    "image/png",
+    "image/webp",
+]);
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+async function defaultLookup(hostname) {
+    const records = await dns.lookup(hostname, { all: true, verbatim: true });
+    return records.map((record) => ({
+        address: record.address,
+        family: record.family,
+    }));
+}
+function responseHeaders(input) {
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(input)) {
+        if (Array.isArray(value)) {
+            for (const item of value)
+                headers.append(key, item);
+        }
+        else if (value !== undefined) {
+            headers.set(key, value);
+        }
+    }
+    return headers;
+}
+function requestPinned(url, address, timeoutMs, maxBytes) {
+    return new Promise((resolve, reject) => {
+        const client = url.protocol === "https:" ? https : http;
+        const request = client.request(url, {
+            agent: false,
+            headers: { Accept: "image/avif,image/webp,image/png,image/jpeg,image/gif" },
+            lookup: (_hostname, _options, callback) => {
+                callback(null, address.address, address.family);
+            },
+        }, (response) => {
+            const status = response.statusCode ?? 0;
+            const headers = responseHeaders(response.headers);
+            if (REDIRECT_STATUSES.has(status)) {
+                response.resume();
+                resolve({ status, headers, bytes: new Uint8Array() });
+                return;
+            }
+            const declaredLength = Number(headers.get("content-length") ?? 0);
+            if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+                response.destroy();
+                reject(new Error(`Image exceeds the ${maxBytes} byte download limit`));
+                return;
+            }
+            const chunks = [];
+            let total = 0;
+            response.on("data", (chunk) => {
+                total += chunk.byteLength;
+                if (total > maxBytes) {
+                    response.destroy(new Error(`Image exceeds the ${maxBytes} byte download limit`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.once("error", reject);
+            response.once("end", () => {
+                const bytes = new Uint8Array(total);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    bytes.set(chunk, offset);
+                    offset += chunk.byteLength;
+                }
+                resolve({ status, headers, bytes });
+            });
+        });
+        request.setTimeout(timeoutMs, () => {
+            request.destroy(new Error(`Image download timed out after ${timeoutMs}ms`));
+        });
+        request.once("error", reject);
+        request.end();
+    });
+}
+function remainingMs(deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        throw new Error("Image download timed out");
+    return remaining;
+}
+async function withDeadline(promise, deadline) {
+    const timeoutMs = remainingMs(deadline);
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`Image download timed out after ${timeoutMs}ms`)), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function resolvePublicUrl(value, lookup, deadline) {
+    const normalized = normalizeBoardRemoteUrl(value);
+    if (!normalized)
+        throw new Error("Image URL must be a public HTTP(S) URL");
+    const url = new URL(normalized);
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const addresses = isIP(hostname)
+        ? [{ address: hostname, family: isIP(hostname) }]
+        : await withDeadline(lookup(hostname), deadline);
+    if (addresses.length === 0 ||
+        addresses.some((entry) => !isPublicBoardRemoteAddress(entry.address))) {
+        throw new Error("Image URL resolves to a private address");
+    }
+    return { url, address: addresses[0] };
+}
+export async function downloadPublicImage(input, options = {}) {
+    const lookup = options.lookup ?? defaultLookup;
+    const requester = options.requester ?? requestPinned;
+    const maxBytes = options.maxBytes ?? REMOTE_IMAGE_MAX_BYTES;
+    const deadline = Date.now() + (options.timeoutMs ?? REMOTE_IMAGE_TIMEOUT_MS);
+    let current = input;
+    for (let redirect = 0; redirect <= MAX_REDIRECTS; redirect += 1) {
+        const { url, address } = await resolvePublicUrl(current, lookup, deadline);
+        const response = await withDeadline(requester(url, address, remainingMs(deadline), maxBytes), deadline);
+        if (REDIRECT_STATUSES.has(response.status)) {
+            const location = response.headers.get("location");
+            if (!location)
+                throw new Error("Image redirect is missing a location");
+            if (redirect === MAX_REDIRECTS)
+                throw new Error("Too many image redirects");
+            current = new URL(location, url).toString();
+            continue;
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new Error(`HTTP ${response.status}`);
+        }
+        if (response.bytes.byteLength > maxBytes) {
+            throw new Error(`Image exceeds the ${maxBytes} byte download limit`);
+        }
+        const mimeType = response.headers
+            .get("content-type")
+            ?.split(";", 1)[0]
+            ?.trim()
+            .toLowerCase();
+        if (!mimeType || !IMAGE_MIME_TYPES.has(mimeType)) {
+            throw new Error("Remote background must be a supported raster image");
+        }
+        return { bytes: response.bytes, mimeType };
+    }
+    throw new Error("Too many image redirects");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "3.10.2",
+  "version": "3.12.0",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "license": "Apache-2.0",
@@ -19,7 +19,7 @@
     "commander": "^15.0.0",
     "pixi.js": "^8.19.0",
     "sharp": "^0.35.3",
-    "@neta-art/cohub": "5.8.2"
+    "@neta-art/cohub": "5.10.0"
   },
   "publishConfig": {
     "access": "public"