@nextclaw/channel-plugin-feishu 0.2.14 → 0.2.16

package/src/nextclaw-sdk/network-fetch.ts

@@ -0,0 +1,129 @@
+import crypto from "node:crypto";
+import os from "node:os";
+import { mkdtemp, rm } from "node:fs/promises";
+import path from "node:path";
+
+function sanitizePrefix(prefix: string): string {
+  const normalized = prefix.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || "tmp";
+}
+
+function sanitizeFileName(fileName: string): string {
+  const normalized = path.basename(fileName).replace(/[^a-zA-Z0-9._-]+/g, "-");
+  return normalized.replace(/^-+|-+$/g, "") || "download.bin";
+}
+
+function resolveTempRoot(tmpDir?: string): string {
+  return tmpDir ?? process.env.NEXTCLAW_TMP_DIR?.trim() ?? os.tmpdir();
+}
+
+export async function withTempDownloadPath<T>(
+  params: {
+    prefix: string;
+    fileName?: string;
+    tmpDir?: string;
+  },
+  fn: (tmpPath: string) => Promise<T>,
+): Promise<T> {
+  const root = resolveTempRoot(params.tmpDir);
+  const dir = await mkdtemp(path.join(root, `${sanitizePrefix(params.prefix)}-`));
+  const tempPath = path.join(dir, sanitizeFileName(params.fileName ?? "download.bin"));
+  try {
+    return await fn(tempPath);
+  } finally {
+    try {
+      await rm(dir, { recursive: true, force: true });
+    } catch {}
+  }
+}
+
+export async function fetchWithSsrFGuard(params: {
+  url: string;
+  fetchImpl?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+  init?: RequestInit;
+  timeoutMs?: number;
+  signal?: AbortSignal;
+  policy?: {
+    allowedHostnames?: string[];
+  };
+  auditContext?: string;
+}): Promise<{
+  response: Response;
+  finalUrl: string;
+  release: () => Promise<void>;
+}> {
+  const fetcher = params.fetchImpl ?? globalThis.fetch;
+  if (!fetcher) {
+    throw new Error("fetch is not available");
+  }
+  const parsed = new URL(params.url);
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error("Invalid URL: must be http or https");
+  }
+  const allowedHostnames = params.policy?.allowedHostnames?.map((entry) => entry.trim()).filter(Boolean) ?? [];
+  if (allowedHostnames.length > 0 && !allowedHostnames.includes(parsed.hostname)) {
+    throw new Error(
+      `${params.auditContext ?? "guarded-fetch"} blocked hostname "${parsed.hostname}"`,
+    );
+  }
+
+  const controller = new AbortController();
+  const timeoutId =
+    params.timeoutMs && params.timeoutMs > 0
+      ? setTimeout(() => controller.abort(), params.timeoutMs)
+      : undefined;
+  const relay = () => controller.abort();
+  if (params.signal) {
+    if (params.signal.aborted) {
+      controller.abort();
+    } else {
+      params.signal.addEventListener("abort", relay, { once: true });
+    }
+  }
+
+  const response = await fetcher(parsed.toString(), {
+    ...(params.init ?? {}),
+    signal: controller.signal,
+  });
+  const finalUrl = response.url || parsed.toString();
+  const finalHostname = new URL(finalUrl).hostname;
+  if (allowedHostnames.length > 0 && !allowedHostnames.includes(finalHostname)) {
+    clearTimeout(timeoutId);
+    if (params.signal) {
+      params.signal.removeEventListener("abort", relay);
+    }
+    throw new Error(
+      `${params.auditContext ?? "guarded-fetch"} blocked redirected hostname "${finalHostname}"`,
+    );
+  }
+
+  return {
+    response,
+    finalUrl,
+    release: async () => {
+      clearTimeout(timeoutId);
+      if (params.signal) {
+        params.signal.removeEventListener("abort", relay);
+      }
+    },
+  };
+}
+
+export function buildRandomTempFilePath(params: {
+  prefix: string;
+  extension?: string;
+  tmpDir?: string;
+  now?: number;
+  uuid?: string;
+}): string {
+  const prefix = sanitizePrefix(params.prefix);
+  const extension = params.extension
+    ? `.${params.extension.replace(/^\.+/, "").replace(/[^a-zA-Z0-9._-]+/g, "")}`
+    : "";
+  const now =
+    typeof params.now === "number" && Number.isFinite(params.now)
+      ? Math.trunc(params.now)
+      : Date.now();
+  const uuid = params.uuid?.trim() || crypto.randomUUID();
+  return path.join(resolveTempRoot(params.tmpDir), `${prefix}-${now}-${uuid}${extension}`);
+}

package/src/nextclaw-sdk/network-webhook.ts

@@ -0,0 +1,182 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+function pruneMapToMaxSize<K, V>(map: Map<K, V>, maxSize: number): void {
+  while (map.size > maxSize) {
+    const firstKey = map.keys().next().value;
+    if (firstKey === undefined) {
+      break;
+    }
+    map.delete(firstKey);
+  }
+}
+
+export const WEBHOOK_RATE_LIMIT_DEFAULTS = Object.freeze({
+  windowMs: 60_000,
+  maxRequests: 120,
+  maxTrackedKeys: 4_096,
+});
+
+export const WEBHOOK_ANOMALY_COUNTER_DEFAULTS = Object.freeze({
+  maxTrackedKeys: 4_096,
+  ttlMs: 6 * 60 * 60_000,
+  logEvery: 25,
+});
+
+export function createFixedWindowRateLimiter(options: {
+  windowMs: number;
+  maxRequests: number;
+  maxTrackedKeys: number;
+  pruneIntervalMs?: number;
+}) {
+  const state = new Map<string, { count: number; windowStartMs: number }>();
+  const windowMs = Math.max(1, Math.floor(options.windowMs));
+  const maxRequests = Math.max(1, Math.floor(options.maxRequests));
+  const maxTrackedKeys = Math.max(1, Math.floor(options.maxTrackedKeys));
+  const pruneIntervalMs = Math.max(1, Math.floor(options.pruneIntervalMs ?? windowMs));
+  let lastPruneMs = 0;
+
+  const touch = (key: string, value: { count: number; windowStartMs: number }) => {
+    state.delete(key);
+    state.set(key, value);
+  };
+
+  const prune = (nowMs: number) => {
+    for (const [key, entry] of state) {
+      if (nowMs - entry.windowStartMs >= windowMs) {
+        state.delete(key);
+      }
+    }
+  };
+
+  return {
+    isRateLimited(key: string, nowMs = Date.now()): boolean {
+      if (!key) {
+        return false;
+      }
+      if (nowMs - lastPruneMs >= pruneIntervalMs) {
+        prune(nowMs);
+        lastPruneMs = nowMs;
+      }
+      const existing = state.get(key);
+      if (!existing || nowMs - existing.windowStartMs >= windowMs) {
+        touch(key, { count: 1, windowStartMs: nowMs });
+        pruneMapToMaxSize(state, maxTrackedKeys);
+        return false;
+      }
+      const nextCount = existing.count + 1;
+      touch(key, { count: nextCount, windowStartMs: existing.windowStartMs });
+      pruneMapToMaxSize(state, maxTrackedKeys);
+      return nextCount > maxRequests;
+    },
+    size: () => state.size,
+    clear: () => {
+      state.clear();
+      lastPruneMs = 0;
+    },
+  };
+}
+
+export function createWebhookAnomalyTracker(options?: {
+  maxTrackedKeys?: number;
+  ttlMs?: number;
+  logEvery?: number;
+  trackedStatusCodes?: readonly number[];
+}) {
+  const trackedStatusCodes = new Set(options?.trackedStatusCodes ?? [400, 401, 408, 413, 415, 429]);
+  const counters = new Map<string, { count: number; updatedAtMs: number }>();
+  const maxTrackedKeys = Math.max(
+    1,
+    Math.floor(options?.maxTrackedKeys ?? WEBHOOK_ANOMALY_COUNTER_DEFAULTS.maxTrackedKeys),
+  );
+  const ttlMs = Math.max(
+    0,
+    Math.floor(options?.ttlMs ?? WEBHOOK_ANOMALY_COUNTER_DEFAULTS.ttlMs),
+  );
+  const logEvery = Math.max(
+    1,
+    Math.floor(options?.logEvery ?? WEBHOOK_ANOMALY_COUNTER_DEFAULTS.logEvery),
+  );
+
+  const prune = (nowMs: number) => {
+    if (ttlMs <= 0) {
+      return;
+    }
+    for (const [key, entry] of counters) {
+      if (nowMs - entry.updatedAtMs >= ttlMs) {
+        counters.delete(key);
+      }
+    }
+  };
+
+  return {
+    record(params: {
+      key: string;
+      statusCode: number;
+      message: (count: number) => string;
+      log?: (message: string) => void;
+      nowMs?: number;
+    }): number {
+      if (!trackedStatusCodes.has(params.statusCode)) {
+        return 0;
+      }
+      const nowMs = params.nowMs ?? Date.now();
+      prune(nowMs);
+      const existing = counters.get(params.key);
+      const nextCount = (existing?.count ?? 0) + 1;
+      counters.set(params.key, { count: nextCount, updatedAtMs: nowMs });
+      pruneMapToMaxSize(counters, maxTrackedKeys);
+      if (params.log && (nextCount === 1 || nextCount % logEvery === 0)) {
+        params.log(params.message(nextCount));
+      }
+      return nextCount;
+    },
+    size: () => counters.size,
+    clear: () => counters.clear(),
+  };
+}
+
+function isJsonContentType(value: string | string[] | undefined): boolean {
+  const first = Array.isArray(value) ? value[0] : value;
+  if (!first) {
+    return false;
+  }
+  const mediaType = first.split(";", 1)[0]?.trim().toLowerCase();
+  return mediaType === "application/json" || Boolean(mediaType?.endsWith("+json"));
+}
+
+export function applyBasicWebhookRequestGuards(params: {
+  req: IncomingMessage;
+  res: ServerResponse;
+  allowMethods?: readonly string[];
+  rateLimiter?: { isRateLimited: (key: string, nowMs?: number) => boolean };
+  rateLimitKey?: string;
+  nowMs?: number;
+  requireJsonContentType?: boolean;
+}): boolean {
+  const allowMethods = params.allowMethods?.length ? params.allowMethods : null;
+  if (allowMethods && !allowMethods.includes(params.req.method ?? "")) {
+    params.res.statusCode = 405;
+    params.res.setHeader("Allow", allowMethods.join(", "));
+    params.res.end("Method Not Allowed");
+    return false;
+  }
+  if (
+    params.rateLimiter &&
+    params.rateLimitKey &&
+    params.rateLimiter.isRateLimited(params.rateLimitKey, params.nowMs ?? Date.now())
+  ) {
+    params.res.statusCode = 429;
+    params.res.end("Too Many Requests");
+    return false;
+  }
+  if (
+    params.requireJsonContentType &&
+    params.req.method === "POST" &&
+    !isJsonContentType(params.req.headers["content-type"])
+  ) {
+    params.res.statusCode = 415;
+    params.res.end("Unsupported Media Type");
+    return false;
+  }
+  return true;
+}

package/src/nextclaw-sdk/network.ts

@@ -0,0 +1,13 @@
+export {
+  buildRandomTempFilePath,
+  fetchWithSsrFGuard,
+  withTempDownloadPath,
+} from "./network-fetch.js";
+export {
+  applyBasicWebhookRequestGuards,
+  createFixedWindowRateLimiter,
+  createWebhookAnomalyTracker,
+  WEBHOOK_ANOMALY_COUNTER_DEFAULTS,
+  WEBHOOK_RATE_LIMIT_DEFAULTS,
+} from "./network-webhook.js";
+export { installRequestBodyLimitGuard, readJsonBodyWithLimit } from "./network-body.js";

package/src/nextclaw-sdk/runtime-store.ts

@@ -0,0 +1,26 @@
+export function createPluginRuntimeStore<T>(errorMessage: string): {
+  setRuntime: (next: T) => void;
+  clearRuntime: () => void;
+  tryGetRuntime: () => T | null;
+  getRuntime: () => T;
+} {
+  let runtime: T | null = null;
+
+  return {
+    setRuntime(next: T) {
+      runtime = next;
+    },
+    clearRuntime() {
+      runtime = null;
+    },
+    tryGetRuntime() {
+      return runtime;
+    },
+    getRuntime() {
+      if (!runtime) {
+        throw new Error(errorMessage);
+      }
+      return runtime;
+    },
+  };
+}

package/src/nextclaw-sdk/secrets-config.ts

@@ -0,0 +1,109 @@
+import type { ClawdbotConfig, DmPolicy, GroupPolicy } from "./types.js";
+
+export function mergeAllowFromEntries(
+  current: Array<string | number> | null | undefined,
+  additions: Array<string | number>,
+): string[] {
+  const merged = [...(current ?? []), ...additions].map((entry) => String(entry).trim()).filter(Boolean);
+  return [...new Set(merged)];
+}
+
+export function splitOnboardingEntries(raw: string): string[] {
+  return raw
+    .split(/[\n,;]+/g)
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+function patchTopLevelChannelConfig(params: {
+  cfg: ClawdbotConfig;
+  channel: string;
+  enabled?: boolean;
+  patch: Record<string, unknown>;
+}): ClawdbotConfig {
+  const channelConfig =
+    (params.cfg.channels?.[params.channel] as Record<string, unknown> | undefined) ?? {};
+  return {
+    ...params.cfg,
+    channels: {
+      ...params.cfg.channels,
+      [params.channel]: {
+        ...channelConfig,
+        ...(params.enabled ? { enabled: true } : {}),
+        ...params.patch,
+      },
+    },
+  };
+}
+
+function addWildcardAllowFrom(allowFrom?: Array<string | number> | null): string[] {
+  const next = (allowFrom ?? []).map((entry) => String(entry).trim()).filter(Boolean);
+  if (!next.includes("*")) {
+    next.push("*");
+  }
+  return next;
+}
+
+export function setTopLevelChannelAllowFrom(params: {
+  cfg: ClawdbotConfig;
+  channel: string;
+  allowFrom: string[];
+  enabled?: boolean;
+}): ClawdbotConfig {
+  return patchTopLevelChannelConfig({
+    cfg: params.cfg,
+    channel: params.channel,
+    enabled: params.enabled,
+    patch: { allowFrom: params.allowFrom },
+  });
+}
+
+export function setTopLevelChannelDmPolicyWithAllowFrom(params: {
+  cfg: ClawdbotConfig;
+  channel: string;
+  dmPolicy: DmPolicy;
+  getAllowFrom?: (cfg: ClawdbotConfig) => Array<string | number> | undefined;
+}): ClawdbotConfig {
+  const channelConfig =
+    (params.cfg.channels?.[params.channel] as Record<string, unknown> | undefined) ?? {};
+  const existingAllowFrom =
+    params.getAllowFrom?.(params.cfg) ??
+    (channelConfig.allowFrom as Array<string | number> | undefined) ??
+    undefined;
+  const allowFrom = params.dmPolicy === "open" ? addWildcardAllowFrom(existingAllowFrom) : undefined;
+  return patchTopLevelChannelConfig({
+    cfg: params.cfg,
+    channel: params.channel,
+    patch: {
+      dmPolicy: params.dmPolicy,
+      ...(allowFrom ? { allowFrom } : {}),
+    },
+  });
+}
+
+export function setTopLevelChannelGroupPolicy(params: {
+  cfg: ClawdbotConfig;
+  channel: string;
+  groupPolicy: GroupPolicy;
+  enabled?: boolean;
+}): ClawdbotConfig {
+  return patchTopLevelChannelConfig({
+    cfg: params.cfg,
+    channel: params.channel,
+    enabled: params.enabled,
+    patch: { groupPolicy: params.groupPolicy },
+  });
+}
+
+export function buildSingleChannelSecretPromptState(params: {
+  accountConfigured: boolean;
+  hasConfigToken: boolean;
+  allowEnv: boolean;
+  envValue?: string;
+}) {
+  return {
+    accountConfigured: params.accountConfigured,
+    hasConfigToken: params.hasConfigToken,
+    canUseEnv: params.allowEnv && Boolean(params.envValue?.trim()) && !params.hasConfigToken,
+  };
+}

package/src/nextclaw-sdk/secrets-core.ts

@@ -0,0 +1,170 @@
+import { z } from "zod";
+import type { SecretRef, SecretRefSource } from "./types.js";
+
+export const DEFAULT_SECRET_PROVIDER_ALIAS = "default";
+export const ENV_SECRET_REF_ID_RE = /^[A-Z][A-Z0-9_]{0,127}$/;
+export const SECRET_PROVIDER_ALIAS_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const ENV_SECRET_TEMPLATE_RE = /^\$\{([A-Z][A-Z0-9_]{0,127})\}$/;
+const FILE_SECRET_REF_SEGMENT_PATTERN = /^(?:[^~]|~0|~1)*$/;
+const EXEC_SECRET_REF_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/;
+
+type SecretDefaults = {
+  env?: string;
+  file?: string;
+  exec?: string;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isSecretRef(value: unknown): value is SecretRef {
+  return (
+    isRecord(value) &&
+    (value.source === "env" || value.source === "file" || value.source === "exec") &&
+    typeof value.provider === "string" &&
+    value.provider.trim().length > 0 &&
+    typeof value.id === "string" &&
+    value.id.trim().length > 0
+  );
+}
+
+function coerceSecretRef(value: unknown, defaults?: SecretDefaults): SecretRef | null {
+  if (isSecretRef(value)) {
+    return value;
+  }
+  if (typeof value === "string") {
+    const match = ENV_SECRET_TEMPLATE_RE.exec(value.trim());
+    if (match) {
+      return {
+        source: "env",
+        provider: defaults?.env ?? DEFAULT_SECRET_PROVIDER_ALIAS,
+        id: match[1],
+      };
+    }
+  }
+  if (!isRecord(value)) {
+    return null;
+  }
+  if (
+    (value.source === "env" || value.source === "file" || value.source === "exec") &&
+    typeof value.id === "string" &&
+    value.id.trim().length > 0 &&
+    value.provider === undefined
+  ) {
+    const source = value.source as SecretRefSource;
+    return {
+      source,
+      provider:
+        source === "env"
+          ? (defaults?.env ?? DEFAULT_SECRET_PROVIDER_ALIAS)
+          : source === "file"
+            ? (defaults?.file ?? DEFAULT_SECRET_PROVIDER_ALIAS)
+            : (defaults?.exec ?? DEFAULT_SECRET_PROVIDER_ALIAS),
+      id: value.id,
+    };
+  }
+  return null;
+}
+
+function resolveSecretInputRef(params: {
+  value: unknown;
+  refValue?: unknown;
+  defaults?: SecretDefaults;
+}): SecretRef | null {
+  return coerceSecretRef(params.refValue, params.defaults) ?? coerceSecretRef(params.value, params.defaults);
+}
+
+export function normalizeSecretInputString(value: unknown): string | undefined {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+
+export function hasConfiguredSecretInput(value: unknown, defaults?: SecretDefaults): boolean {
+  return Boolean(normalizeSecretInputString(value) || coerceSecretRef(value, defaults));
+}
+
+export function normalizeResolvedSecretInputString(params: {
+  value: unknown;
+  refValue?: unknown;
+  defaults?: SecretDefaults;
+  path: string;
+}): string | undefined {
+  const normalized = normalizeSecretInputString(params.value);
+  if (normalized) {
+    return normalized;
+  }
+  const ref = resolveSecretInputRef(params);
+  if (ref) {
+    throw new Error(
+      `${params.path}: unresolved SecretRef "${ref.source}:${ref.provider}:${ref.id}".`,
+    );
+  }
+  return undefined;
+}
+
+export function isValidFileSecretRefId(value: string): boolean {
+  if (value === "value") {
+    return true;
+  }
+  if (!value.startsWith("/")) {
+    return false;
+  }
+  return value
+    .slice(1)
+    .split("/")
+    .every((segment) => FILE_SECRET_REF_SEGMENT_PATTERN.test(segment));
+}
+
+export function isValidExecSecretRefId(value: string): boolean {
+  if (!EXEC_SECRET_REF_ID_PATTERN.test(value)) {
+    return false;
+  }
+  return value.split("/").every((segment) => segment !== "." && segment !== "..");
+}
+
+export function formatExecSecretRefIdValidationMessage(): string {
+  return [
+    "Exec secret reference id must match /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/",
+    'and must not include "." or ".." path segments',
+    '(example: "vault/openai/api-key").',
+  ].join(" ");
+}
+
+export function buildSecretInputSchema() {
+  const providerSchema = z
+    .string()
+    .regex(
+      SECRET_PROVIDER_ALIAS_PATTERN,
+      'Secret reference provider must match /^[a-z][a-z0-9_-]{0,63}$/ (example: "default").',
+    );
+
+  return z.union([
+    z.string(),
+    z.discriminatedUnion("source", [
+      z.object({
+        source: z.literal("env"),
+        provider: providerSchema,
+        id: z
+          .string()
+          .regex(
+            ENV_SECRET_REF_ID_RE,
+            'Env secret reference id must match /^[A-Z][A-Z0-9_]{0,127}$/ (example: "OPENAI_API_KEY").',
+          ),
+      }),
+      z.object({
+        source: z.literal("file"),
+        provider: providerSchema,
+        id: z.string().refine(isValidFileSecretRefId, "Invalid file secret reference id."),
+      }),
+      z.object({
+        source: z.literal("exec"),
+        provider: providerSchema,
+        id: z.string().refine(isValidExecSecretRefId, formatExecSecretRefIdValidationMessage()),
+      }),
+    ]),
+  ]);
+}