@openclaw/crabline 0.1.10 → 0.1.12

package/dist/src/servers/signal.js

@@ -1,12 +1,15 @@
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
+import { isIP } from "node:net";
 import path from "node:path";
-import { adminAuthError, closeServer, drainRequestBody, hasAdminToken, InvalidJsonBodyError, isJsonObject, jsonResponse, parseUnknownRequestBody, queryRecord, readInteger, readTrimmedString, RequestBodyTooLargeError, writeResponse, } from "./http.js";
-import { recordCommittedServerEvent, recordServerEvent, } from "./recorder.js";
+import { adminAuthError, closeServer, drainRequestBody, formatUrlHost, hasAdminToken, InvalidJsonBodyError, isJsonObject, jsonResponse, parseUnknownRequestBody, queryRecord, readInteger, readTrimmedString, RequestBodyTooLargeError, writeResponse, } from "./http.js";
+import { recordCommittedServerEvent, recordServerEvent, ServerRecorderCommittedError, } from "./recorder.js";
 import { resolveMaxPendingInboundEvents } from "./pending-events.js";
 const SIGNAL_CLI_SSE_KEEPALIVE_MS = 15_000;
 const DEFAULT_MAX_SIGNAL_SSE_CLIENTS = 32;
 const MAX_SIGNAL_SSE_BUFFER_BYTES = 2 * 1024 * 1024;
+const SIGNAL_PHONE_NUMBER_RE = /^\+[1-9]\d{2,14}$/u;
+const SIGNAL_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 async function appendEvent(state, event, committed = false) {
     const params = { event, onEvent: state.onEvent, recorderPath: state.recorderPath };
     await (committed ? recordCommittedServerEvent(params) : recordServerEvent(params));
@@ -25,12 +28,18 @@ function removeSignalClient(state, client, destroy) {
     const buffer = state.clientBuffers.get(client);
     state.clients.delete(client);
     state.clientBuffers.delete(client);
+    const bufferedEvents = new Set([
+        ...state.pendingEvents,
+        ...[...state.clientBuffers.values()].flatMap((entry) => [...entry.inFlight, ...entry.events]),
+        ...(buffer ? [...buffer.inFlight, ...buffer.events] : []),
+    ]);
+    for (const event of bufferedEvents) {
+        event.recipients?.delete(client);
+    }
     if (buffer) {
-        const undeliveredEvents = [...buffer.inFlight, ...buffer.events].filter((event) => {
-            event.recipients?.delete(client);
-            return event.sequence !== undefined && event.recipients?.size === 0;
-        });
-        const restoredEvents = undeliveredEvents.filter((event) => !state.pendingEvents.includes(event));
+        const restoredEvents = [...new Set([...buffer.inFlight, ...buffer.events])].filter((event) => event.sequence !== undefined &&
+            event.recipients?.size === 0 &&
+            !isSignalEventBuffered(state, event));
         if (restoredEvents.length > 0) {
             state.pendingEvents.push(...restoredEvents);
             state.pendingEvents.sort((left, right) => (left.sequence ?? Number.MAX_SAFE_INTEGER) - (right.sequence ?? 0));
@@ -223,14 +232,67 @@ function emitSignalEvent(state, payload) {
     }
     return delivered || queueSignalEvent(state, event);
 }
+function normalizeSignalPhoneNumber(value) {
+    const number = readTrimmedString(value)?.replace(/[\s().-]/gu, "");
+    return number && SIGNAL_PHONE_NUMBER_RE.test(number) ? number : undefined;
+}
+function isSignalDirectRecipient(value) {
+    const recipient = readSignalRpcString(value);
+    if (!recipient) {
+        return false;
+    }
+    if (SIGNAL_UUID_RE.test(recipient)) {
+        return true;
+    }
+    // signal-cli treats recognized prefixes as terminal instead of retrying them as phone numbers.
+    if (recipient.startsWith("PNI:")) {
+        return SIGNAL_UUID_RE.test(recipient.slice(4));
+    }
+    if (recipient.startsWith("u:")) {
+        return recipient.length > 2;
+    }
+    return SIGNAL_PHONE_NUMBER_RE.test(recipient);
+}
+function nextSignalTimestamp(state) {
+    return Math.max(state.nextTimestamp, (state.lastCommittedTimestamp ?? -1) + 1);
+}
+function commitSignalTimestamp(state, timestamp) {
+    state.lastCommittedTimestamp = timestamp;
+    state.nextTimestamp = Math.max(state.nextTimestamp, timestamp + 1);
+}
 async function handleAdminInbound(params) {
     const text = typeof params.body.text === "string" ? params.body.text : undefined;
-    const sourceNumber = readTrimmedString(params.body.sourceNumber ?? params.body.senderId);
-    const sourceUuid = readTrimmedString(params.body.sourceUuid);
+    const sourceNumberValue = params.body.sourceNumber ?? params.body.senderId;
+    const sourceNumber = normalizeSignalPhoneNumber(sourceNumberValue);
+    const sourceUuidValue = readTrimmedString(params.body.sourceUuid);
+    const sourceUuid = sourceUuidValue && SIGNAL_UUID_RE.test(sourceUuidValue)
+        ? sourceUuidValue.toLowerCase()
+        : undefined;
+    if (sourceNumberValue !== undefined && sourceNumber === undefined) {
+        return jsonResponse({ error: "sourceNumber must be an E.164 telephone number", ok: false }, 400);
+    }
+    if (params.body.sourceUuid !== undefined && sourceUuid === undefined) {
+        return jsonResponse({ error: "sourceUuid must be a UUID", ok: false }, 400);
+    }
     if (!text || text.trim().length === 0 || (!sourceNumber && !sourceUuid)) {
         return jsonResponse({ error: "text and at least one source identity are required", ok: false }, 400);
     }
-    const timestamp = readInteger(params.body.timestamp) ?? params.state.nextTimestamp++;
+    const suppliedTimestamp = params.body.timestamp === undefined ? undefined : readInteger(params.body.timestamp);
+    if (params.body.timestamp !== undefined &&
+        (suppliedTimestamp === undefined ||
+            suppliedTimestamp < 0 ||
+            suppliedTimestamp >= Number.MAX_SAFE_INTEGER)) {
+        return jsonResponse({ error: "timestamp must be a non-negative safe integer with room to advance", ok: false }, 400);
+    }
+    if (suppliedTimestamp !== undefined &&
+        params.state.lastCommittedTimestamp !== undefined &&
+        suppliedTimestamp <= params.state.lastCommittedTimestamp) {
+        return jsonResponse({ error: "timestamp must be greater than the last committed timestamp", ok: false }, 409);
+    }
+    const timestamp = suppliedTimestamp ?? nextSignalTimestamp(params.state);
+    if (timestamp >= Number.MAX_SAFE_INTEGER) {
+        return jsonResponse({ error: "timestamp capacity exhausted", ok: false }, 503);
+    }
     const groupId = readTrimmedString(params.body.groupId);
     const payload = {
         envelope: {
@@ -251,6 +313,7 @@ async function handleAdminInbound(params) {
             ok: false,
         }, 503);
     }
+    commitSignalTimestamp(params.state, timestamp);
     return jsonResponse({ event: payload, ok: true });
 }
 async function handleRpc(params) {
@@ -259,7 +322,9 @@ async function handleRpc(params) {
     const validId = !hasId ||
         id === null ||
         typeof id === "string" ||
-        (typeof id === "number" && Number.isFinite(id));
+        (typeof id === "number" &&
+            Number.isFinite(id) &&
+            (!Number.isInteger(id) || Number.isSafeInteger(id)));
     const method = params.body.method;
     if (typeof method !== "string" || !validId) {
         return {
@@ -301,16 +366,36 @@ async function handleRpc(params) {
                 record: false,
                 response: notification
                     ? new Response(null, { status: 204 })
-                    : rpcError(-32602, "Invalid params", id),
+                    : rpcError(-32602, "Invalid params", id, 200),
+            };
+        }
+        const account = params.body.params.account;
+        if (typeof account === "string" && account !== params.state.account) {
+            return {
+                accepted: false,
+                record: false,
+                response: notification
+                    ? new Response(null, { status: 204 })
+                    : rpcError(-32602, "Specified account does not exist", id, 200),
+            };
+        }
+        const timestamp = nextSignalTimestamp(params.state);
+        if (timestamp >= Number.MAX_SAFE_INTEGER) {
+            return {
+                accepted: false,
+                record: false,
+                response: notification
+                    ? new Response(null, { status: 204 })
+                    : rpcError(-32603, "Timestamp capacity exhausted", id, 200),
             };
         }
-        const timestamp = params.state.nextTimestamp++;
         return {
             accepted: true,
             record: true,
             response: notification
                 ? new Response(null, { status: 204 })
                 : rpcResponse(id, method === "sendTyping" ? {} : { timestamp }),
+            timestamp,
         };
     }
     return {
@@ -360,34 +445,115 @@ function hasStringArray(value) {
         value.length > 0 &&
         value.every((entry) => typeof entry === "string" && entry.trim().length > 0));
 }
+function readSignalRpcString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function hasValidSignalRecipientFieldTypes(params) {
+    return ["recipient", "recipients", "groupId", "groupIds", "username", "usernames"].every((field) => {
+        const value = params[field];
+        return (value === undefined ||
+            (typeof value === "string" && value.trim().length > 0) ||
+            hasStringArray(value));
+    });
+}
+function hasValidOptionalSignalString(params, field) {
+    return params[field] === undefined || typeof params[field] === "string";
+}
+function hasValidSignalDirectRecipients(params) {
+    return ["recipient", "recipients"].every((field) => {
+        const value = params[field];
+        return (value === undefined ||
+            (Array.isArray(value)
+                ? value.length > 0 && value.every(isSignalDirectRecipient)
+                : isSignalDirectRecipient(value)));
+    });
+}
 function validSignalRpcParams(method, value) {
-    if (!isJsonObject(value)) {
+    if (!isJsonObject(value) ||
+        !hasValidSignalRecipientFieldTypes(value) ||
+        !hasValidSignalDirectRecipients(value) ||
+        !hasValidOptionalSignalString(value, "account") ||
+        (value.noteToSelf !== undefined && typeof value.noteToSelf !== "boolean")) {
         return false;
     }
     if (method === "send") {
-        return (hasRecipients(value) &&
-            (readTrimmedString(value.message) !== undefined ||
-                readTrimmedString(value.attachment) !== undefined ||
+        return (hasValidOptionalSignalString(value, "message") &&
+            hasValidOptionalSignalString(value, "attachment") &&
+            (value.attachments === undefined || hasStringArray(value.attachments)) &&
+            hasRecipients(value) &&
+            (readSignalRpcString(value.message) !== undefined ||
+                readSignalRpcString(value.attachment) !== undefined ||
                 hasStringArray(value.attachments)));
     }
     if (method === "sendReaction") {
-        return (hasRecipients(value) &&
-            readTrimmedString(value.emoji) !== undefined &&
-            readTrimmedString(value.targetAuthor) !== undefined &&
+        return (hasValidOptionalSignalString(value, "emoji") &&
+            hasValidOptionalSignalString(value, "targetAuthor") &&
+            hasRecipients(value) &&
+            readSignalRpcString(value.emoji) !== undefined &&
+            isSignalDirectRecipient(value.targetAuthor) &&
             validTimestamp(value.targetTimestamp));
     }
     if (method === "sendReceipt") {
         const targetTimestamps = value.targetTimestamps ?? value.targetTimestamp;
         const timestamps = Array.isArray(targetTimestamps) ? targetTimestamps : [targetTimestamps];
-        return ((readTrimmedString(value.recipient) !== undefined ||
-            readTrimmedString(value.username) !== undefined ||
-            hasStringArray(value.usernames)) &&
+        return (hasValidOptionalSignalString(value, "type") &&
+            (readSignalRpcString(value.recipient) !== undefined ||
+                readSignalRpcString(value.username) !== undefined ||
+                hasStringArray(value.usernames)) &&
             timestamps.length > 0 &&
             timestamps.every(validTimestamp) &&
             (value.type === undefined || value.type === "read" || value.type === "viewed"));
     }
     return method === "sendTyping" && hasTypingRecipients(value);
 }
+function serializeSignalTimestampCommit(state, operation) {
+    const run = state.pendingTimestampCommits.catch(() => { }).then(operation);
+    state.pendingTimestampCommits = run.then(() => undefined, () => undefined);
+    return run;
+}
+function processSignalAdminInbound(params) {
+    return serializeSignalTimestampCommit(params.state, () => handleAdminInbound(params));
+}
+async function processSignalRpc(params) {
+    return serializeSignalTimestampCommit(params.state, async () => {
+        const rpc = await handleRpc({ body: params.body, state: params.state });
+        if (rpc.record) {
+            const event = {
+                accepted: rpc.accepted,
+                at: new Date().toISOString(),
+                body: params.body,
+                method: "POST",
+                path: params.url.pathname,
+                query: queryRecord(params.url),
+                type: "api",
+            };
+            if (rpc.accepted) {
+                try {
+                    await appendEvent(params.state, event);
+                }
+                catch (error) {
+                    if (!(error instanceof ServerRecorderCommittedError)) {
+                        throw error;
+                    }
+                }
+                commitSignalTimestamp(params.state, rpc.timestamp);
+            }
+            else {
+                await appendEvent(params.state, event, rpc.response.status === 204);
+            }
+        }
+        return rpc.response;
+    });
+}
+function hasSignalJsonContentType(request) {
+    const contentType = request.headers["content-type"];
+    const values = Array.isArray(contentType) ? contentType : [contentType];
+    return values.some((value) => value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json");
+}
 async function handleRequest(params) {
     const url = new URL(params.request.url ?? "/", "http://localhost");
     if (url.pathname === "/api/v1/events" && params.request.method === "GET") {
@@ -416,7 +582,6 @@ async function handleRequest(params) {
             connection: "keep-alive",
             "content-type": "text/event-stream",
         });
-        params.response.flushHeaders();
         params.response.once("close", () => {
             removeSignalClient(params.state, params.response, false);
         });
@@ -427,6 +592,7 @@ async function handleRequest(params) {
             events: [],
             inFlight: [],
         });
+        params.response.flushHeaders();
         replayExclusiveSignalEvents(params.state, params.response);
         if (params.state.clients.has(params.response)) {
             flushPendingSignalEvents(params.state);
@@ -454,11 +620,12 @@ async function handleRequest(params) {
                 query: queryRecord(url),
                 type: "admin",
             });
-            fetchResponse = await handleAdminInbound({ body, state: params.state });
+            fetchResponse = await processSignalAdminInbound({ body, state: params.state });
         }
     }
     else if (url.pathname === "/api/v1/check" && params.request.method === "GET") {
         await appendEvent(params.state, {
+            accepted: true,
             at: new Date().toISOString(),
             method: "GET",
             path: url.pathname,
@@ -468,37 +635,93 @@ async function handleRequest(params) {
         fetchResponse = new Response(null, { status: 200 });
     }
     else if (url.pathname === "/api/v1/rpc" && params.request.method === "POST") {
-        const body = await parseUnknownRequestBody(params.request);
-        if (!isJsonObject(body)) {
-            await writeResponse(params.response, rpcError(-32600, "Invalid Request"));
-            return;
+        if (!hasSignalJsonContentType(params.request)) {
+            drainRequestBody(params.request);
+            fetchResponse = new Response(null, { status: 415 });
         }
-        const rpc = await handleRpc({ body, state: params.state });
-        if (rpc.record) {
-            const event = {
-                accepted: rpc.accepted,
-                at: new Date().toISOString(),
-                body,
-                method: "POST",
-                path: url.pathname,
-                query: queryRecord(url),
-                type: "api",
-            };
-            await appendEvent(params.state, event, rpc.accepted || rpc.response.status === 204);
+        else {
+            const body = await parseUnknownRequestBody(params.request);
+            if (!isJsonObject(body)) {
+                await writeResponse(params.response, rpcError(-32600, "Invalid Request"));
+                return;
+            }
+            fetchResponse = await processSignalRpc({ body, state: params.state, url });
         }
-        fetchResponse = rpc.response;
     }
     else {
         fetchResponse = new Response("not found", { status: 404 });
     }
     await writeResponse(params.response, fetchResponse);
 }
+function normalizeSignalHost(value) {
+    const normalized = value
+        .trim()
+        .replace(/^\[(.*)\]$/u, "$1")
+        .toLowerCase()
+        .replace(/\.$/u, "");
+    if (isIP(normalized) !== 6) {
+        return normalized;
+    }
+    const canonical = new URL(`http://[${normalized}]`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/u.exec(canonical);
+    if (!mapped?.[1] || !mapped[2]) {
+        return canonical;
+    }
+    const high = Number.parseInt(mapped[1], 16);
+    const low = Number.parseInt(mapped[2], 16);
+    return `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;
+}
+function parseSignalHostHeader(value) {
+    const match = value.startsWith("[")
+        ? /^\[([^\]]+)\](?::(\d{1,5}))?$/u.exec(value)
+        : /^([^:]+)(?::(\d{1,5}))?$/u.exec(value);
+    if (!match?.[1]) {
+        return undefined;
+    }
+    const port = match[2] === undefined ? undefined : Number(match[2]);
+    if (port !== undefined && port > 65_535) {
+        return undefined;
+    }
+    const hostname = normalizeSignalHost(match[1]);
+    if (isIP(hostname) !== 0) {
+        return hostname;
+    }
+    const labels = hostname.split(".");
+    return hostname.length <= 253 &&
+        labels.every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
+        ? hostname
+        : undefined;
+}
+function signalRequestHostAllowed(request, bindHost, allowedHosts) {
+    const hostHeader = request.headers.host;
+    if (!hostHeader) {
+        return false;
+    }
+    const requestedHost = parseSignalHostHeader(hostHeader);
+    if (requestedHost === undefined) {
+        return false;
+    }
+    const normalizedBindHost = normalizeSignalHost(bindHost);
+    if (allowedHosts.has(requestedHost)) {
+        return true;
+    }
+    if (normalizedBindHost !== "0.0.0.0" && normalizedBindHost !== "::") {
+        return false;
+    }
+    const localAddress = normalizeSignalHost(request.socket.localAddress ?? "");
+    return isIP(requestedHost) !== 0 && requestedHost === localAddress;
+}
 export async function startSignalServer(params = {}) {
+    const account = normalizeSignalPhoneNumber(params.account ?? "+15550000000");
+    if (!account) {
+        throw new Error("account must be an E.164 telephone number.");
+    }
     const state = {
-        account: params.account ?? "+15550000000",
+        account,
         adminToken: params.adminToken ?? randomBytes(24).toString("base64url"),
         clients: new Set(),
         clientBuffers: new Map(),
+        lastCommittedTimestamp: undefined,
         maxPendingInboundEvents: resolveMaxPendingInboundEvents(params.maxPendingInboundEvents),
         maxSseClients: Number.isSafeInteger(params.maxSseClients) && (params.maxSseClients ?? 0) > 0
             ? params.maxSseClients
@@ -508,11 +731,22 @@ export async function startSignalServer(params = {}) {
         onEvent: params.onEvent,
         pendingEventBytes: 0,
         pendingEvents: [],
+        pendingTimestampCommits: Promise.resolve(),
         pendingSseClients: 0,
         recorderPath: params.recorderPath ?? path.resolve(".crabline", "servers", "signal.jsonl"),
     };
     const host = params.host ?? "127.0.0.1";
+    const normalizedHost = normalizeSignalHost(host);
+    const allowedHosts = new Set([
+        ...(normalizedHost === "0.0.0.0" || normalizedHost === "::" ? [] : [normalizedHost]),
+        ...(params.allowedHosts ?? []).map((allowedHost) => normalizeSignalHost(allowedHost)),
+    ]);
     const server = createServer((request, response) => {
+        if (!signalRequestHostAllowed(request, host, allowedHosts)) {
+            drainRequestBody(request);
+            void writeResponse(response, jsonResponse({ error: "Host header is not allowed", ok: false }, 400)).catch(() => response.destroy());
+            return;
+        }
         void handleRequest({ request, response, state }).catch(async (error) => {
             if (!response.headersSent) {
                 let errorResponse;
@@ -560,7 +794,8 @@ export async function startSignalServer(params = {}) {
         }
     }, SIGNAL_CLI_SSE_KEEPALIVE_MS);
     keepalive.unref();
-    const baseUrl = `http://${host.includes(":") ? `[${host}]` : host}:${address.port}`;
+    const advertisedHost = normalizedHost === "0.0.0.0" ? "127.0.0.1" : normalizedHost === "::" ? "::1" : host;
+    const baseUrl = `http://${formatUrlHost(advertisedHost)}:${address.port}`;
     return {
         async close() {
             clearInterval(keepalive);