@openclaw/crabline 0.1.11 → 0.1.13

package/dist/src/config/schema.js

@@ -1,8 +1,20 @@
+import { validateHeaderValue } from "node:http";
+import { BlockList, isIP } from "node:net";
 import { z } from "zod";
+import { isCanonicalHttpPath } from "../core/http-path.js";
+import { isValidNonceFixtureId, NONCE_FIXTURE_ID_ERROR } from "../core/nonces.js";
 import { inboundRegexSafetyError } from "../core/safe-regex.js";
 export const FIXTURE_MODES = ["probe", "send", "roundtrip", "agent"];
-const FIXTURE_ID_PATTERN = /^[a-z0-9-]+$/i;
+const LOOPBACK_ADDRESSES = new BlockList();
+LOOPBACK_ADDRESSES.addSubnet("127.0.0.0", 8, "ipv4");
+LOOPBACK_ADDRESSES.addAddress("::1", "ipv6");
+LOOPBACK_ADDRESSES.addSubnet("::ffff:127.0.0.0", 104, "ipv6");
+const MAX_FIXTURE_RETRIES = 10;
 const MAX_TIMER_MS = 2_147_483_647;
+const TimerMsSchema = z
+    .number()
+    .int()
+    .max(MAX_TIMER_MS, "timer duration must be at most 2147483647ms");
 export const INBOUND_AUTHORS = ["assistant", "user", "system", "any"];
 export const INBOUND_STRATEGIES = ["contains", "exact", "regex"];
 export const INBOUND_NONCE_MODES = ["contains", "exact", "ignore"];
@@ -46,6 +58,25 @@ export const PROVIDER_PLATFORMS = [
     "zalo",
     "zalouser",
 ];
+export function fixtureModeValidationIssue(value) {
+    if ((value.mode === "roundtrip" || value.mode === "agent") &&
+        value.retries > 0 &&
+        value.inboundMatch.nonce === "ignore") {
+        return {
+            message: `${value.mode} mode cannot retry when inboundMatch.nonce=ignore because a late reply from an earlier attempt could be accepted`,
+            path: ["inboundMatch", "nonce"],
+        };
+    }
+    if (value.mode === "agent" &&
+        value.inboundMatch.strategy === "exact" &&
+        value.inboundMatch.pattern) {
+        return {
+            message: "agent mode cannot use inboundMatch.strategy=exact with a static pattern because replies must include the generated ACK nonce",
+            path: ["inboundMatch", "strategy"],
+        };
+    }
+    return undefined;
+}
 const HttpUrlSchema = z
     .string()
     .url()
@@ -58,6 +89,53 @@ const HttpUrlSchema = z
         return false;
     }
 }, "URL must use http or https");
+const HttpsUrlSchema = HttpUrlSchema.refine((value) => {
+    try {
+        return new URL(value).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}, "URL must use https");
+const NonBlankSecretSchema = z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, "secret must not be blank");
+const HeaderValueSchema = z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, "secret must not be blank")
+    .refine((value) => value === value.trim(), "secret must not contain surrounding whitespace")
+    .refine((value) => {
+    try {
+        validateHeaderValue("x-crabline-secret", value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, "secret must be a valid HTTP header value");
+const WebhookPathSchema = z
+    .string()
+    .min(1)
+    .startsWith("/", "webhook path must start with /")
+    .refine(isCanonicalHttpPath, "webhook path must be a canonical URL pathname");
+function isLoopbackHost(host) {
+    const normalized = host
+        .trim()
+        .replace(/^\[(.*)\]$/u, "$1")
+        .toLowerCase()
+        .replace(/\.$/u, "");
+    if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+        return true;
+    }
+    const family = isIP(normalized);
+    return family === 4
+        ? LOOPBACK_ADDRESSES.check(normalized, "ipv4")
+        : family === 6
+            ? LOOPBACK_ADDRESSES.check(normalized, "ipv6")
+            : false;
+}
 function inferProviderPlatform(adapter) {
     if (adapter === "script") {
         return undefined;
@@ -89,6 +167,15 @@ const InboundMatchSchema = z
     if (value.strategy !== "regex" || !value.pattern) {
         return;
     }
+    const safetyError = inboundRegexSafetyError(value.pattern);
+    if (safetyError?.startsWith("must contain at most ")) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `inboundMatch.pattern ${safetyError}`,
+            path: ["pattern"],
+        });
+        return;
+    }
     try {
         RegExp(value.pattern, "u");
     }
@@ -100,7 +187,6 @@ const InboundMatchSchema = z
         });
         return;
     }
-    const safetyError = inboundRegexSafetyError(value.pattern);
     if (safetyError) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
@@ -120,7 +206,7 @@ const ScriptCommandsSchema = z.strictObject({
     watch: ScriptCommandSchema.optional(),
 });
 const LoopbackConfigSchema = z.strictObject({
-    delayMs: z.number().int().min(0).max(MAX_TIMER_MS).default(25),
+    delayMs: TimerMsSchema.min(0).default(25),
 });
 const ScriptConfigSchema = z.strictObject({
     commands: ScriptCommandsSchema,
@@ -132,13 +218,13 @@ const SlackRecorderSchema = z.strictObject({
 });
 const SlackWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/slack/events"),
+    path: WebhookPathSchema.default("/slack/events"),
     port: z.number().int().min(0).max(65_535).default(8787),
     publicUrl: HttpUrlSchema.optional(),
 });
 const SlackConfigSchema = z.strictObject({
     recorder: SlackRecorderSchema.default({}),
-    signingSecret: z.string().min(1).optional(),
+    signingSecret: NonBlankSecretSchema.optional(),
     webhook: SlackWebhookSchema.default({
         host: "127.0.0.1",
         path: "/slack/events",
@@ -150,14 +236,14 @@ const DiscordRecorderSchema = z.strictObject({
 });
 const DiscordWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/discord/interactions"),
+    path: WebhookPathSchema.default("/discord/interactions"),
     port: z.number().int().min(0).max(65_535).default(8788),
     publicUrl: HttpUrlSchema.optional(),
 });
 const DiscordConfigSchema = z.strictObject({
     applicationId: z.string().min(1).optional(),
     botToken: z.string().min(1).optional(),
-    gatewayDurationMs: z.number().int().min(1000).default(180_000),
+    gatewayDurationMs: TimerMsSchema.min(1000).default(180_000),
     mentionRoleIds: z.array(z.string().min(1)).optional(),
     publicKey: z.string().min(1).optional(),
     recorder: DiscordRecorderSchema.default({}),
@@ -172,7 +258,7 @@ const WhatsAppRecorderSchema = z.strictObject({
 });
 const WhatsAppWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/whatsapp/webhook"),
+    path: WebhookPathSchema.default("/whatsapp/webhook"),
     port: z.number().int().min(0).max(65_535).default(8789),
     publicUrl: HttpUrlSchema.optional(),
 });
@@ -200,9 +286,9 @@ const MsTeamsRecorderSchema = z.strictObject({
 });
 const MsTeamsWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/msteams/webhook"),
+    path: WebhookPathSchema.default("/msteams/webhook"),
     port: z.number().int().min(0).max(65_535).default(8791),
-    publicUrl: HttpUrlSchema.optional(),
+    publicUrl: HttpsUrlSchema.optional(),
 });
 const MsTeamsConfigSchema = z.strictObject({
     apiUrl: HttpUrlSchema.optional(),
@@ -210,7 +296,7 @@ const MsTeamsConfigSchema = z.strictObject({
     appPassword: z.string().min(1).optional(),
     appTenantId: z.string().min(1).optional(),
     appType: z.enum(["MultiTenant", "SingleTenant"]).optional(),
-    dialogOpenTimeoutMs: z.number().int().min(0).optional(),
+    dialogOpenTimeoutMs: TimerMsSchema.min(0).optional(),
     federated: MsTeamsFederatedSchema.optional(),
     recorder: MsTeamsRecorderSchema.default({}),
     userName: z.string().min(1).optional(),
@@ -232,11 +318,12 @@ const GoogleChatRecorderSchema = z.strictObject({
 });
 const GoogleChatWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/googlechat/webhook"),
+    path: WebhookPathSchema.default("/googlechat/webhook"),
     port: z.number().int().min(0).max(65_535).default(8792),
     publicUrl: HttpUrlSchema.optional(),
 });
-const GoogleChatConfigSchema = z.strictObject({
+const GoogleChatConfigSchema = z
+    .strictObject({
     apiUrl: HttpUrlSchema.optional(),
     credentials: GoogleChatCredentialsSchema.optional(),
     disableSignatureVerification: z.boolean().optional(),
@@ -254,13 +341,25 @@ const GoogleChatConfigSchema = z.strictObject({
         path: "/googlechat/webhook",
         port: 8792,
     }),
+})
+    .superRefine((value, ctx) => {
+    if (value.pubsubAudience &&
+        !value.disableSignatureVerification &&
+        !value.pubsubServiceAccountEmail &&
+        !value.credentials?.client_email) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "pubsubAudience requires a Pub/Sub service-account identity",
+            path: ["pubsubAudience"],
+        });
+    }
 });
 const TelegramLongPollingSchema = z.strictObject({
     allowedUpdates: z.array(z.string().min(1)).optional(),
     deleteWebhook: z.boolean().optional(),
     dropPendingUpdates: z.boolean().optional(),
     limit: z.number().int().min(1).max(100).optional(),
-    retryDelayMs: z.number().int().min(0).optional(),
+    retryDelayMs: TimerMsSchema.min(0).optional(),
     timeout: z.number().int().min(0).optional(),
 });
 const TelegramRecorderSchema = z.strictObject({
@@ -268,7 +367,7 @@ const TelegramRecorderSchema = z.strictObject({
 });
 const TelegramWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/telegram/webhook"),
+    path: WebhookPathSchema.default("/telegram/webhook"),
     port: z.number().int().min(0).max(65_535).default(8790),
     publicUrl: HttpUrlSchema.optional(),
 });
@@ -278,7 +377,10 @@ const TelegramConfigSchema = z.strictObject({
     longPolling: TelegramLongPollingSchema.optional(),
     mode: z.enum(["auto", "polling", "webhook"]).default("auto"),
     recorder: TelegramRecorderSchema.default({}),
-    secretToken: z.string().min(1).optional(),
+    secretToken: z
+        .string()
+        .regex(/^[A-Za-z0-9_-]{1,256}(?![\s\S])/u, "Telegram secretToken must use 1-256 letters, digits, underscores, or hyphens")
+        .optional(),
     userName: z.string().min(1).optional(),
     webhook: TelegramWebhookSchema.default({
         host: "127.0.0.1",
@@ -289,14 +391,14 @@ const TelegramConfigSchema = z.strictObject({
 const FeishuConfigSchema = z.strictObject({
     appId: z.string().min(1).optional(),
     appSecret: z.string().min(1).optional(),
-    encryptKey: z.string().min(1).optional(),
+    encryptKey: NonBlankSecretSchema.optional(),
     recorder: z.strictObject({ path: z.string().min(1).optional() }).default({}),
     userName: z.string().min(1).optional(),
-    verificationToken: z.string().min(1).optional(),
+    verificationToken: NonBlankSecretSchema.optional(),
     webhook: z
         .strictObject({
         host: z.string().min(1).default("127.0.0.1"),
-        path: z.string().min(1).default("/feishu/webhook"),
+        path: WebhookPathSchema.default("/feishu/webhook"),
         port: z.number().int().min(0).max(65_535).default(8795),
         publicUrl: HttpUrlSchema.optional(),
     })
@@ -311,14 +413,14 @@ const MattermostRecorderSchema = z.strictObject({
 });
 const MattermostWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/mattermost/webhook"),
+    path: WebhookPathSchema.default("/mattermost/webhook"),
     port: z.number().int().min(0).max(65_535).default(8793),
     publicUrl: HttpUrlSchema.optional(),
 });
 const MattermostWebsocketSchema = z.strictObject({
     enabled: z.boolean().optional(),
-    maxReconnectDelayMs: z.number().int().min(0).optional(),
-    reconnectDelayMs: z.number().int().min(0).optional(),
+    maxReconnectDelayMs: TimerMsSchema.min(0).optional(),
+    reconnectDelayMs: TimerMsSchema.min(0).optional(),
 });
 const MattermostConfigSchema = z.strictObject({
     baseUrl: HttpUrlSchema.optional(),
@@ -331,6 +433,11 @@ const MattermostConfigSchema = z.strictObject({
         path: "/mattermost/webhook",
         port: 8793,
     }),
+    webhookToken: z
+        .string()
+        .min(1)
+        .refine((value) => value.trim().length > 0, "webhookToken must not be blank")
+        .optional(),
     websocket: MattermostWebsocketSchema.optional(),
 });
 const ZaloRecorderSchema = z.strictObject({
@@ -338,12 +445,12 @@ const ZaloRecorderSchema = z.strictObject({
 });
 const ZaloWebhookSchema = z.strictObject({
     host: z.string().min(1).default("127.0.0.1"),
-    path: z.string().min(1).default("/zalo/webhook"),
+    path: WebhookPathSchema.default("/zalo/webhook"),
     port: z.number().int().min(0).max(65_535).default(8794),
     publicUrl: HttpUrlSchema.optional(),
 });
 const ZaloConfigSchema = z.strictObject({
-    botToken: z.string().min(1).optional(),
+    botToken: HeaderValueSchema.optional(),
     recorder: ZaloRecorderSchema.default({}),
     userName: z.string().min(1).optional(),
     webhook: ZaloWebhookSchema.default({
@@ -351,7 +458,7 @@ const ZaloConfigSchema = z.strictObject({
         path: "/zalo/webhook",
         port: 8794,
     }),
-    webhookSecret: z.string().min(1).optional(),
+    webhookSecret: HeaderValueSchema.optional(),
 });
 const MatrixAccessTokenAuthSchema = z.strictObject({
     accessToken: z.string().min(1),
@@ -374,7 +481,7 @@ const MatrixConfigSchema = z.strictObject({
     webhook: z
         .strictObject({
         host: z.string().min(1).default("127.0.0.1"),
-        path: z.string().min(1).default("/matrix/webhook"),
+        path: WebhookPathSchema.default("/matrix/webhook"),
         port: z.number().int().min(0).max(65_535).default(8797),
         publicUrl: HttpUrlSchema.optional(),
     })
@@ -386,14 +493,14 @@ const MatrixConfigSchema = z.strictObject({
 });
 const IMessageConfigSchema = z.strictObject({
     apiKey: z.string().min(1).optional(),
-    gatewayDurationMs: z.number().int().min(1000).default(180_000),
+    gatewayDurationMs: TimerMsSchema.min(1000).default(180_000),
     local: z.boolean().optional(),
     recorder: z.strictObject({ path: z.string().min(1).optional() }).default({}),
     serverUrl: HttpUrlSchema.optional(),
     webhook: z
         .strictObject({
         host: z.string().min(1).default("127.0.0.1"),
-        path: z.string().min(1).default("/imessage/webhook"),
+        path: WebhookPathSchema.default("/imessage/webhook"),
         port: z.number().int().min(0).max(65_535).default(8796),
         publicUrl: HttpUrlSchema.optional(),
     })
@@ -565,13 +672,11 @@ export const ProviderConfigSchema = z
     ...value,
     platform: value.platform ?? inferProviderPlatform(value.adapter) ?? "loopback",
 }));
-export const FixtureSchema = z.strictObject({
+export const FixtureSchema = z
+    .strictObject({
     accountId: z.string().min(1).optional(),
     env: z.array(z.string().min(1)).default([]),
-    id: z
-        .string()
-        .min(1)
-        .regex(FIXTURE_ID_PATTERN, "fixture id must contain only letters, numbers, and hyphens"),
+    id: z.string().min(1).refine(isValidNonceFixtureId, NONCE_FIXTURE_ID_ERROR),
     inboundMatch: InboundMatchSchema.default({
         author: "assistant",
         nonce: "contains",
@@ -580,10 +685,20 @@ export const FixtureSchema = z.strictObject({
     mode: z.enum(FIXTURE_MODES),
     notes: z.string().optional(),
     provider: z.string().min(1),
-    retries: z.number().int().min(0).default(0),
+    retries: z.number().int().min(0).max(MAX_FIXTURE_RETRIES).default(0),
     tags: z.array(z.string().min(1)).default([]),
     target: TargetSchema,
-    timeoutMs: z.number().int().min(100).max(MAX_TIMER_MS).default(30_000),
+    timeoutMs: TimerMsSchema.min(100).default(30_000),
+})
+    .superRefine((value, ctx) => {
+    const validationIssue = fixtureModeValidationIssue(value);
+    if (validationIssue) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: validationIssue.message,
+            path: validationIssue.path,
+        });
+    }
 });
 const MANIFEST_EXTENSION_KEY_PATTERN = /^x-[a-z0-9][a-z0-9._-]*$/u;
 function omitManifestExtensions(value) {
@@ -602,6 +717,19 @@ const StrictManifestSchema = z
     userName: z.string().min(1).default("crabline"),
 })
     .superRefine((manifest, ctx) => {
+    for (const [providerId, provider] of Object.entries(manifest.providers)) {
+        if (provider.adapter !== "matrix" && provider.adapter !== "imessage") {
+            continue;
+        }
+        const webhook = provider[provider.adapter]?.webhook;
+        if (webhook?.publicUrl || (webhook && !isLoopbackHost(webhook.host))) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `${provider.adapter} provider ${providerId} does not support external webhook ingress`,
+                path: ["providers", providerId, provider.adapter, "webhook"],
+            });
+        }
+    }
     const seenFixtureIds = new Set();
     for (const [index, fixture] of manifest.fixtures.entries()) {
         if (seenFixtureIds.has(fixture.id)) {