@octocodeai/octocode-engine 16.5.0

package/dist/security/withSecurityValidation.js

@@ -0,0 +1,107 @@
+import { ContentSanitizer } from './contentSanitizer.js';
+import { extractResearchFields, extractRepoOwnerFromParams, } from './paramExtractors.js';
+const SECURITY_VALIDATION_FAILED_CODE = 'TOOL_SECURITY_VALIDATION_FAILED';
+const DEFAULT_TOOL_TIMEOUT_MS = 60_000;
+let _deps = {};
+function getSanitizer() {
+    return _deps.sanitizer ?? ContentSanitizer;
+}
+function getTimeoutMs(override) {
+    return override ?? _deps.defaultTimeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS;
+}
+export function configureSecurity(deps) {
+    _deps = { ..._deps, ...deps };
+}
+function createErrorResult(text) {
+    return { content: [{ type: 'text', text }], isError: true };
+}
+function withToolTimeout(toolName, promise, signal, timeoutMs) {
+    const timeout = getTimeoutMs(timeoutMs);
+    if (signal?.aborted) {
+        return Promise.resolve(createErrorResult(`Tool '${toolName}' was cancelled before execution.`));
+    }
+    return new Promise(resolve => {
+        const timer = setTimeout(() => {
+            resolve(createErrorResult(`Tool '${toolName}' timed out after ${timeout / 1000}s. Try reducing query complexity or scope.`));
+        }, timeout);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve(createErrorResult(`Tool '${toolName}' was cancelled by the client.`));
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        if (signal?.aborted) {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', onAbort);
+            resolve(createErrorResult(`Tool '${toolName}' was cancelled before execution.`));
+            return;
+        }
+        promise
+            .then(result => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            resolve(result);
+        })
+            .catch(error => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            resolve(createErrorResult(`Tool '${toolName}' failed: ${error instanceof Error ? error.message : 'Unknown error'}`));
+        });
+    });
+}
+async function runSecure(opts) {
+    const { toolName, handler, args, authInfo, sessionId, signal, timeoutMs } = opts;
+    try {
+        const sanitizer = getSanitizer();
+        const validation = sanitizer.validateInputParameters(args);
+        if (!validation.isValid) {
+            return createErrorResult(`Security validation failed: ${validation.warnings.join('; ')}`);
+        }
+        const sanitizedParams = validation.sanitizedParams;
+        const rawResult = await withToolTimeout(toolName, handler(sanitizedParams, authInfo, sessionId), signal, timeoutMs);
+        if (!rawResult.isError && _deps.isLoggingEnabled?.()) {
+            handleBulk(toolName, sanitizedParams);
+        }
+        return rawResult;
+    }
+    catch (error) {
+        _deps
+            .logSessionError?.(toolName, SECURITY_VALIDATION_FAILED_CODE)
+            .catch(() => { });
+        return createErrorResult(`Security validation error: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+export function withSecurityValidation(toolName, toolHandler, options) {
+    return (args, { authInfo, sessionId, signal, } = {}) => runSecure({
+        toolName,
+        handler: toolHandler,
+        args,
+        authInfo,
+        sessionId,
+        signal,
+        timeoutMs: options?.timeoutMs,
+    });
+}
+export function withBasicSecurityValidation(toolHandler, toolName, options) {
+    const handler = (sanitizedArgs) => toolHandler(sanitizedArgs);
+    const effectiveName = toolName ?? 'tool';
+    return (args, extra) => runSecure({
+        toolName: effectiveName,
+        handler,
+        args,
+        signal: extra?.signal,
+        timeoutMs: options?.timeoutMs,
+    });
+}
+function handleBulk(toolName, params) {
+    const queries = params.queries;
+    const items = queries && Array.isArray(queries) && queries.length > 0
+        ? queries
+        : [params];
+    for (const item of items) {
+        const repos = extractRepoOwnerFromParams(item);
+        const fields = extractResearchFields(item);
+        _deps
+            .logToolCall?.(toolName, repos, fields.mainResearchGoal, fields.researchGoal, fields.reasoning)
+            .catch(() => { });
+    }
+}

package/index.cjs

@@ -0,0 +1,97 @@
+'use strict'
+
+const { existsSync } = require('fs')
+const { join } = require('path')
+
+const packageName = '@octocodeai/octocode-engine'
+const binaryName = 'octocode-engine'
+const { platform, arch } = process
+
+const { readFileSync } = require('fs')
+
+const isFileMusl = (f) => f.includes('libc.musl-') || f.includes('ld-musl-')
+
+function isMuslFromFilesystem() {
+  try {
+    return readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {
+    return null
+  }
+}
+
+function isMuslFromReport() {
+  let report = null
+  if (typeof process.report?.getReport === 'function') {
+    process.report.excludeNetwork = true
+    report = process.report.getReport()
+  }
+  if (!report) return null
+  if (report.header && report.header.glibcVersionRuntime) return false
+  if (Array.isArray(report.sharedObjects)) {
+    if (report.sharedObjects.some(isFileMusl)) return true
+  }
+  return false
+}
+
+function isMuslFromChildProcess() {
+  try {
+    return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')
+  } catch {
+    return false
+  }
+}
+
+function isMusl() {
+  if (process.platform !== 'linux') return false
+  let result = isMuslFromFilesystem()
+  if (result === null) result = isMuslFromReport()
+  if (result === null) result = isMuslFromChildProcess()
+  return !!result
+}
+
+function getPlatformKey() {
+  if (platform === 'darwin') {
+    if (arch === 'arm64') return 'darwin-arm64'
+    if (arch === 'x64') return 'darwin-x64'
+  }
+
+  if (platform === 'linux') {
+    const libc = isMusl() ? 'musl' : 'gnu'
+    if (arch === 'x64') return `linux-x64-${libc}`
+    if (arch === 'arm64' && libc === 'gnu') return 'linux-arm64-gnu'
+  }
+
+  if (platform === 'win32' && arch === 'x64') return 'win32-x64-msvc'
+
+  throw new Error(`${packageName} does not ship a native binary for ${platform}-${arch}`)
+}
+
+function loadNativeBinding() {
+  const key = getPlatformKey()
+  const candidates = [
+    join(__dirname, `${binaryName}.${key}.node`),
+    join(__dirname, 'runtime', 'engine', `${binaryName}.${key}.node`),
+    join(__dirname, '..', 'runtime', 'engine', `${binaryName}.${key}.node`),
+    join(__dirname, '..', '..', 'runtime', 'engine', `${binaryName}.${key}.node`),
+  ]
+
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) {
+      return require(candidate)
+    }
+  }
+
+  return require(`${packageName}-${key}`)
+}
+
+const nativeBinding = loadNativeBinding()
+
+nativeBinding.MINIFY_CONFIG = nativeBinding.getMINIFY_CONFIG()
+nativeBinding.SUPPORTED_SIGNATURE_EXTENSIONS = Object.freeze(
+  nativeBinding.getSupportedSignatureExtensions().sort()
+)
+nativeBinding.SUPPORTED_STRUCTURAL_EXTENSIONS = Object.freeze(
+  nativeBinding.getSupportedStructuralExtensions().sort()
+)
+
+module.exports = nativeBinding