@or3/cloud 0.1.100 → 0.1.107

package/assets/Caddyfile

@@ -5,13 +5,34 @@
 	header {
 		Strict-Transport-Security "max-age=31536000"
 		X-Content-Type-Options "nosniff"
-		X-Frame-Options "DENY"
 		Referrer-Policy "strict-origin-when-cross-origin"
 		Permissions-Policy "camera=(), microphone=(), geolocation=()"
+	}
+
+	# Only the two host-owned bridge documents can be embedded. Ordinary app
+	# pages still deny every ancestor, including same-origin frames.
+	@hostDocument {
+		not path /or3/portable-frame /streamsaver/mitm.html
+	}
+	header @hostDocument {
+		X-Frame-Options "DENY"
 		# Nuxt needs same-origin scripts plus inline hydration styles/scripts. The
 		# browser exchanges OpenRouter PKCE authorization codes directly with the
 		# OpenRouter API, so that origin must remain available to connect-src.
-		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://openrouter.ai; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'none'; upgrade-insecure-requests"
+		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://openrouter.ai; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'self'; upgrade-insecure-requests"
+	}
+
+	# Preserve the portable route's hash-authorized, opaque-origin sandbox CSP.
+	# Applying the app policy here would block its worker or weaken containment.
+	@portableFrame path /or3/portable-frame
+	header @portableFrame X-Frame-Options "SAMEORIGIN"
+
+	# The fallback streaming exporter uses this bundled same-origin bridge to
+	# register its download service worker; it cannot use an opaque origin.
+	@downloadBridge path /streamsaver/mitm.html
+	header @downloadBridge {
+		X-Frame-Options "SAMEORIGIN"
+		Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'; worker-src 'self'; frame-ancestors 'self'; base-uri 'none'; form-action 'none'"
 	}
 
 	encode zstd gzip

package/assets/dashboard-lifecycle.mjs

@@ -20354,6 +20354,10 @@ async function writeEnvFileDetailed(updates, options = {}) {
 
 // ../../shared/admin/configuration.ts
 var siteSettingPaths = {
+  OR3_STORAGE_CAPACITY_WARNING_PERCENT: ["storageCapacityWarningPercent"],
+  OR3_STORAGE_CAPACITY_CRITICAL_PERCENT: ["storageCapacityCriticalPercent"],
+  OR3_CHAT_TOOL_ITERATIONS: ["chatToolIterations"],
+  OR3_CHAT_GENERATED_IMAGES: ["chatGeneratedImages"],
   OR3_SITE_NAME: ["or3", "site", "name"],
   OR3_SITE_DESCRIPTION: ["or3", "site", "description"],
   OR3_LOGO_URL: ["or3", "site", "logoUrl"],
@@ -20851,6 +20855,8 @@ var ALLOWED_ENV_KEYS = new Set([
   "OR3_CLOUD_STORAGE_ENABLED",
   "NUXT_PUBLIC_STORAGE_PROVIDER",
   "OR3_STORAGE_FS_ROOT",
+  "OR3_STORAGE_FS_CLEANUP_NAMESPACE_ID",
+  "OR3_STORAGE_RETENTION_WORKSPACES",
   "OR3_STORAGE_FS_TOKEN_SECRET",
   "OR3_STORAGE_FS_URL_TTL_SECONDS",
   "OR3_ADMIN_USERNAME",

package/assets/dashboard-operator.mjs

@@ -317,6 +317,22 @@ async function readLastReceipt() {
   }
 }
 
+/** Read-only allowlist: a recorded snapshot is not current checksum evidence. */
+export function projectRecoveryState(state) {
+  const safeId = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,100}$/.test(value) ? value : null;
+  const safeTime = value => typeof value === 'string' && value.length <= 64 && Number.isFinite(Date.parse(value)) ? value : null;
+  const snapshotId = safeId(state?.rollback?.backupId);
+  const pending = state?.incompleteOperation;
+  return {
+    observedAt: new Date().toISOString(), source: 'managed_operator',
+    snapshot: snapshotId ? { id: snapshotId, capturedAt: safeTime(state.rollback.createdAt), verification: 'operator_reported' } : null,
+    coverage: ['canonical', 'auth', 'files', 'configuration', 'billing_trials_support', 'credential_escrow', 'independent_copy'].map(component => ({ component, status: 'unknown', verifiedAt: null })),
+    lastRecoveryTestAt: null,
+    incompleteOperation: pending && safeId(pending.id) && ['init', 'update', 'restore', 'adopt', 'credentials-reset', 'backup', 'rollback'].includes(pending.operation)
+      ? { id: pending.id, operation: pending.operation, startedAt: safeTime(pending.startedAt) } : null,
+  };
+}
+
 async function status(includeReceipt = false) {
   const version = await currentVersion();
   const [job, checked] = await Promise.all([readJob(), readReleaseCheck()]);
@@ -992,6 +1008,7 @@ async function main() {
           if (await service.handle(service.controller, request, response)) return;
         } catch { return send(response, 503, { code: 'controller_unavailable' }); }
       }
+      if (request.method === 'GET' && request.url === '/v2/recovery') return send(response, 200, { protocolVersion: 2, recovery: projectRecoveryState(await managedState()) });
       if (request.method === 'GET' && route === '/status') return reply(200, await status(isV2));
       if (request.method === 'POST' && route === '/check') {
         if (!consumeRateLimit(checkAttempts, Date.now(), 30, 60_000)) {

package/dist/cli.mjs

@@ -179,7 +179,7 @@ import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.100";
+var PACKAGE_VERSION = "0.1.107";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var SHA256_DIGEST = /^sha256:[0-9a-f]{64}$/;
@@ -402,6 +402,8 @@ var ALLOWED_ENV_KEYS = new Set([
   "OR3_CLOUD_STORAGE_ENABLED",
   "NUXT_PUBLIC_STORAGE_PROVIDER",
   "OR3_STORAGE_FS_ROOT",
+  "OR3_STORAGE_FS_CLEANUP_NAMESPACE_ID",
+  "OR3_STORAGE_RETENTION_WORKSPACES",
   "OR3_STORAGE_FS_TOKEN_SECRET",
   "OR3_STORAGE_FS_URL_TTL_SECONDS",
   "OR3_ADMIN_USERNAME",
@@ -4518,6 +4520,201 @@ import { join as join24 } from "node:path";
 
 // src/backup/restore.ts
 import { join as join21 } from "node:path";
+
+// src/backup/generation-restore.ts
+function rebindRestoredGenerations(fs, path, crypto, db, root, options = {}) {
+  const preserveMissing = options.previousSafetySnapshot === true;
+  const fail = () => {
+    throw new Error("Restored generation identity or payload is invalid");
+  };
+  const info = (name) => {
+    try {
+      return fs.lstatSync(name, { bigint: true });
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return null;
+      throw error;
+    }
+  };
+  const dir = (name) => {
+    const s = info(name);
+    if (!s?.isDirectory())
+      fail();
+    return s;
+  };
+  const json = (name) => {
+    const s = info(name);
+    if (!s?.isFile() || s.nlink !== 1n || s.size > 4096n)
+      fail();
+    return JSON.parse(fs.readFileSync(name, "utf8"));
+  };
+  const base = path.join(root, "generations-v1");
+  const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((row) => row.name));
+  const required = new Set;
+  if (tables.has("storage_object_generations")) {
+    for (const row of db.prepare("SELECT generation_id FROM storage_object_generations WHERE storage_provider_id = 'fs'").all())
+      required.add(String(row.generation_id));
+  }
+  if (tables.has("storage_generation_uploads")) {
+    for (const row of db.prepare("SELECT generation_id FROM storage_generation_uploads WHERE storage_provider_id = 'fs' AND ready_receipt_id IS NOT NULL").all())
+      required.add(String(row.generation_id));
+  }
+  if (!info(base)) {
+    if (required.size && !preserveMissing)
+      fail();
+    return;
+  }
+  dir(root);
+  dir(base);
+  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+  const namespaceFile = path.join(base, "namespace.json");
+  if (!info(namespaceFile) && preserveMissing)
+    return;
+  const ns = json(namespaceFile);
+  if (ns.version !== 1 || !uuid.test(ns.namespaceId))
+    fail();
+  if (!tables.has("storage_object_generations"))
+    fail();
+  const workspaceRoot = path.join(base, "workspaces");
+  if (!info(workspaceRoot) && preserveMissing)
+    return;
+  dir(workspaceRoot);
+  const changes = [];
+  for (const workspace of fs.readdirSync(workspaceRoot)) {
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(workspace))
+      fail();
+    const work = path.join(workspaceRoot, workspace);
+    dir(work);
+    for (const id2 of fs.readdirSync(work)) {
+      if (!uuid.test(id2))
+        fail();
+      const slot = path.join(work, id2);
+      dir(slot);
+      const file = path.join(slot, "ready.json");
+      if (!info(file)) {
+        if (required.has(id2) && !preserveMissing)
+          fail();
+        continue;
+      }
+      const ready = json(file);
+      if (ready.version !== 1 || ready.namespaceId !== ns.namespaceId || ready.workspaceId !== workspace || ready.generationId !== id2 || !/^sha256:[a-f0-9]{64}$/.test(ready.hash) || !Number.isSafeInteger(ready.sizeBytes) || ready.sizeBytes < 0 || !uuid.test(ready.readyReceiptId) || ready.storageId !== `fs-generation-v1:${ns.namespaceId}:${workspace}:${id2}:${ready.hash.slice(7)}`)
+        fail();
+      const generation = db.prepare("SELECT * FROM storage_object_generations WHERE generation_id = ?").get(id2);
+      const upload = tables.has("storage_generation_uploads") ? db.prepare("SELECT * FROM storage_generation_uploads WHERE generation_id = ?").get(id2) : null;
+      const record = generation ?? upload;
+      if (!record || record.workspace_id !== workspace || record.storage_provider_id !== "fs" || record.storage_id !== ready.storageId || record.hash.replace(/^sha256:/i, "").toLowerCase() !== ready.hash.slice(7) || record.size_bytes !== ready.sizeBytes)
+        fail();
+      if (upload && (upload.namespace_id !== ns.namespaceId || upload.ready_receipt_id && upload.ready_receipt_id !== ready.readyReceiptId))
+        fail();
+      required.delete(id2);
+      const payload = path.join(slot, "payload");
+      const payloadInfo = info(payload);
+      const needsBlob = generation?.state === "verified";
+      if (!payloadInfo) {
+        if (needsBlob && !preserveMissing)
+          fail();
+        continue;
+      }
+      dir(payload);
+      if (generation?.state === "deleted" || !generation && upload?.state === "abandoned")
+        fail();
+      const entries = fs.readdirSync(payload);
+      const links = new Map;
+      for (const entry of entries) {
+        if (entry !== "blob" && !/^\.upload-[0-9a-f-]{36}$/.test(entry))
+          fail();
+        const s = info(path.join(payload, entry));
+        if (!s?.isFile())
+          fail();
+        const key = `${s.dev}:${s.ino}`;
+        const previous = links.get(key);
+        links.set(key, { count: (previous?.count ?? 0n) + 1n, expected: s.nlink });
+      }
+      if ([...links.values()].some((value) => value.count !== value.expected))
+        fail();
+      const blob = path.join(payload, "blob");
+      if (info(blob)) {
+        const fd = fs.openSync(blob, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        try {
+          const hash = crypto.createHash("sha256"), buffer = Buffer.alloc(65536);
+          let size = 0, count = 0;
+          while ((count = fs.readSync(fd, buffer, 0, buffer.length, null)) > 0) {
+            hash.update(buffer.subarray(0, count));
+            size += count;
+          }
+          if (size !== ready.sizeBytes || hash.digest("hex") !== ready.hash.slice(7))
+            fail();
+        } finally {
+          fs.closeSync(fd);
+        }
+      } else if (needsBlob) {
+        if (!preserveMissing)
+          fail();
+        continue;
+      }
+      changes.push({ file, ready: { ...ready, payloadDevice: String(payloadInfo.dev), payloadInode: String(payloadInfo.ino) } });
+    }
+  }
+  if (required.size && !preserveMissing)
+    fail();
+  for (const { file, ready } of changes) {
+    const temp = file + ".restore-" + crypto.randomUUID();
+    const fd = fs.openSync(temp, "wx", 384);
+    try {
+      fs.writeFileSync(fd, JSON.stringify(ready));
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(temp, file);
+    const directory = fs.openSync(path.dirname(file), "r");
+    try {
+      fs.fsyncSync(directory);
+    } finally {
+      fs.closeSync(directory);
+    }
+  }
+}
+
+// src/backup/restore.ts
+async function restoreGenerationIdentities(directory, state, env, backupPath, options = {}) {
+  await readManifest(backupPath, directory);
+  const script = `
+const fs = require('node:fs'), path = require('node:path'), crypto = require('node:crypto');
+const root = path.resolve(process.env.OR3_STORAGE_FS_ROOT || '/data/storage');
+if (root !== '/data' && !root.startsWith('/data/')) throw new Error('Generation restore requires managed storage');
+{
+  const Database = require('/app/.output/server/node_modules/better-sqlite3');
+  const db = new Database(process.env.OR3_SQLITE_DB_PATH, { readonly: true, fileMustExist: true });
+  try {
+    if (db.pragma('quick_check', { simple: true }) !== 'ok') throw new Error('Restored SQLite integrity check failed');
+    (${rebindRestoredGenerations.toString()})(fs, path, crypto, db, root, ${JSON.stringify({ previousSafetySnapshot: options.previousSafetySnapshot === true })});
+  } finally { db.close(); }
+}`;
+  const result = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--security-opt",
+    "no-new-privileges:true",
+    "--cap-drop",
+    "ALL",
+    "-v",
+    `${state.volumeName}:/data`,
+    "--env",
+    `OR3_SQLITE_DB_PATH=${env.OR3_SQLITE_DB_PATH ?? ""}`,
+    "--env",
+    `OR3_STORAGE_FS_ROOT=${env.OR3_STORAGE_FS_ROOT ?? "/data/storage"}`,
+    "--entrypoint",
+    "sh",
+    env.OR3_IMAGE,
+    ...containerNodeCommand(script).slice(1)
+  ], directory);
+  if (!result.ok)
+    throw new Error(`Restored generation verification failed. ${redact(result.stderr, secretValues(env))}`);
+}
 function assertFilesystemPayloadHash(key, readChunk, createHash3) {
   const match = /^(sha256|md5)_([a-fA-F0-9]+)$/.exec(key);
   const algorithm = match?.[1];
@@ -4647,6 +4844,7 @@ async function restoreBackupData(directory, state, env, backupPath, options = {}
   if (!snapshotCheck.ok) {
     throw new Error(`Restored snapshot integrity verification failed. ${redact(snapshotCheck.stderr, secretValues(restoredEnv))}`);
   }
+  await restoreGenerationIdentities(directory, state, restoredEnv, backupPath, { previousSafetySnapshot: options.previousSafetySnapshot });
   await options.beforeStart?.();
   await startProject(directory, state.mode, restoredEnv);
   return manifest2;
@@ -25902,6 +26100,7 @@ async function runUpdateCommand(directory, flags, asJson) {
       await copyAssets(loaded.directory, state.mode);
       if (migrateLegacyVolume || recreateDataVolume) {
         await restoreVolumeArchive(loaded.directory, state.mode, nextEnv, backup.backupDir);
+        await restoreGenerationIdentities(loaded.directory, state, nextEnv, backup.backupDir);
       }
     } catch (error62) {
       await updatePending(loaded.directory, state, { phase: "restoring-previous" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.100",
+  "version": "0.1.107",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",
@@ -19,9 +19,9 @@
     "dashboardUpdateProtocol": 1,
     "dashboardUpdateMinimumSourceVersion": "0.1.40",
     "stateSchema": 1,
-    "imageDigest": "sha256:674186a2f176c5b400ab9379b82d48242ff9c64bd4ebf0af4eaee07a4307929f",
-    "operatorImageDigest": "sha256:c2106191c2053df14d1212a8462f7dc125121f10e0ae2437e14752707e6cbf3f",
-    "sourceRevision": "a79b927b87de07c407472b741ebbe8af7064d237"
+    "imageDigest": "sha256:345b221ce8716552bccbc0bebfbc9fe5d698cd4b486ab18b3a398c924eb48b7d",
+    "operatorImageDigest": "sha256:82df52a0b952907d7a1dbcdb2eebe411e654b3f6ad47439d1a89901399f18061",
+    "sourceRevision": "68b263584dc64d0e3a7b0035a90845d438678cd4"
   },
   "files": [
     "dist",