@pellux/goodvibes-sdk 0.25.8 → 0.25.11

package/dist/_internal/platform/utils/logger.js

@@ -5,6 +5,8 @@ import { join } from 'path';
 const LOG_BUFFER_MAX = 10;
 /** Flush interval in milliseconds when buffer is below max. */
 const LOG_FLUSH_INTERVAL_MS = 100;
+const REDACTED = '[REDACTED]';
+const SENSITIVE_KEY_PATTERN = /(authorization|api[-_]?key|token|password|passwd|secret|credential|cookie|set-cookie)/i;
 /**
  * ActivityLogger — Persistent debug logger for GoodVibes.
  * Writes to .goodvibes/logs/activity.md
@@ -30,6 +32,7 @@ class ActivityLogger {
         if (this.flushTimer !== null)
             return;
         this.flushTimer = setTimeout(() => this.flush(), LOG_FLUSH_INTERVAL_MS);
+        this.flushTimer.unref?.();
     }
     flush() {
         this.flushTimer = null;
@@ -49,7 +52,7 @@ class ActivityLogger {
         const timestamp = new Date().toISOString();
         let entry = `[${timestamp}] [${level}] ${message}\n`;
         if (data) {
-            entry += '```json\n' + JSON.stringify(data, null, 2) + '\n```\n';
+            entry += '```json\n' + JSON.stringify(redactLogData(data), null, 2) + '\n```\n';
         }
         this.buffer.push(entry);
         if (this.buffer.length >= LOG_BUFFER_MAX) {
@@ -73,3 +76,18 @@ export const logger = new ActivityLogger();
 export function configureActivityLogger(logDir) {
     logger.configure(logDir);
 }
+function redactLogData(value, seen = new WeakSet()) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((item) => redactLogData(item, seen));
+    }
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+        out[key] = SENSITIVE_KEY_PATTERN.test(key) ? REDACTED : redactLogData(nested, seen);
+    }
+    return out;
+}

package/dist/_internal/platform/utils/request-body.d.ts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_MAX_REQUEST_BODY_BYTES = 1000000;
+export declare function readTextBodyWithinLimit(req: Request, maxBytes?: number): Promise<string | Response>;
+export declare function readJsonBodyWithinLimit(req: Request, maxBytes?: number): Promise<unknown | Response>;
+//# sourceMappingURL=request-body.d.ts.map

package/dist/_internal/platform/utils/request-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/utils/request-body.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,8BAA8B,UAAY,CAAC;AAMxD,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,QAAQ,SAAiC,GACxC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CA4B5B;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,QAAQ,SAAiC,GACxC,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAQ7B"}

package/dist/_internal/platform/utils/request-body.js

@@ -0,0 +1,45 @@
+export const DEFAULT_MAX_REQUEST_BODY_BYTES = 1_000_000;
+function ignoreCancelError() {
+    // Best-effort stream cancellation.
+}
+export async function readTextBodyWithinLimit(req, maxBytes = DEFAULT_MAX_REQUEST_BODY_BYTES) {
+    const contentLength = Number.parseInt(req.headers.get('content-length') ?? '0', 10);
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        return Response.json({ error: 'Payload too large' }, { status: 413 });
+    }
+    if (!req.body)
+        return '';
+    const reader = req.body.getReader();
+    const decoder = new TextDecoder();
+    let total = 0;
+    let body = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel('Payload too large').catch(ignoreCancelError);
+                return Response.json({ error: 'Payload too large' }, { status: 413 });
+            }
+            body += decoder.decode(value, { stream: true });
+        }
+        body += decoder.decode();
+        return body;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+export async function readJsonBodyWithinLimit(req, maxBytes = DEFAULT_MAX_REQUEST_BODY_BYTES) {
+    const raw = await readTextBodyWithinLimit(req, maxBytes);
+    if (raw instanceof Response)
+        return raw;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return Response.json({ error: 'Invalid JSON body' }, { status: 400 });
+    }
+}

package/dist/_internal/platform/version.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-let version = '0.25.8';
+let version = '0.25.11';
 try {
     const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf-8'));
     version = pkg.version ?? version;

package/dist/workers.d.ts

@@ -15,6 +15,8 @@ export interface GoodVibesCloudflareExecutionContext {
 export interface GoodVibesCloudflareWorkerEnv {
     GOODVIBES_DAEMON_URL?: string;
     GOODVIBES_OPERATOR_TOKEN?: string;
+    GOODVIBES_WORKER_TOKEN?: string;
+    GOODVIBES_QUEUE_JOB_PAYLOADS?: string;
     GOODVIBES_BATCH_QUEUE?: GoodVibesCloudflareQueue<GoodVibesCloudflareQueuePayload>;
 }
 export type GoodVibesCloudflareQueuePayload = {
@@ -29,7 +31,14 @@ export type GoodVibesCloudflareQueuePayload = {
 export interface GoodVibesCloudflareWorkerOptions {
     readonly daemonUrl?: string;
     readonly authToken?: string;
+    readonly workerAuthToken?: string;
     readonly queueJobPayloads?: boolean;
+    /**
+     * Explicitly allow unauthenticated non-health endpoints.
+     * Default is false: GOODVIBES_WORKER_TOKEN or workerAuthToken is required.
+     */
+    readonly allowUnauthenticated?: boolean;
+    readonly maxRequestBodyBytes?: number;
 }
 export interface GoodVibesCloudflareWorker {
     fetch(request: Request, env: GoodVibesCloudflareWorkerEnv, ctx: GoodVibesCloudflareExecutionContext): Promise<Response>;

package/dist/workers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB,CAAC,IAAI,GAAG,OAAO;IACtD,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,+BAA+B,CAAC,IAAI,GAAG,OAAO;IAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,GAAG,CAAC,IAAI,IAAI,CAAC;IACb,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B,CAAC,IAAI,GAAG,OAAO;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;CACrE;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,4BAA4B;IAC3C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,wBAAwB,CAAC,+BAA+B,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,+BAA+B,GACvC;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,mCAAmC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxH,KAAK,CAAC,KAAK,EAAE,+BAA+B,CAAC,+BAA+B,CAAC,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3K,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvH;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,gCAAqC,GAC7C,yBAAyB,CAgE3B"}
+{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB,CAAC,IAAI,GAAG,OAAO;IACtD,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,+BAA+B,CAAC,IAAI,GAAG,OAAO;IAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,GAAG,CAAC,IAAI,IAAI,CAAC;IACb,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B,CAAC,IAAI,GAAG,OAAO;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;CACrE;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,4BAA4B;IAC3C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,qBAAqB,CAAC,EAAE,wBAAwB,CAAC,+BAA+B,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,+BAA+B,GACvC;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,mCAAmC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxH,KAAK,CAAC,KAAK,EAAE,+BAA+B,CAAC,+BAA+B,CAAC,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3K,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvH;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,gCAAqC,GAC7C,yBAAyB,CAqE3B"}

package/dist/workers.js

@@ -5,11 +5,16 @@ export function createGoodVibesCloudflareWorker(options = {}) {
             if (url.pathname === '/health' || url.pathname === '/batch/health') {
                 return json({ ok: true, service: 'goodvibes-cloudflare-worker' });
             }
+            const authError = requireWorkerAuth(request, env, options);
+            if (authError)
+                return authError;
             if (url.pathname === '/batch/tick/enqueue' && request.method === 'POST') {
                 const queue = env.GOODVIBES_BATCH_QUEUE;
                 if (!queue)
                     return json({ error: 'GOODVIBES_BATCH_QUEUE is not bound', code: 'QUEUE_NOT_CONFIGURED' }, 503);
                 const body = await optionalJson(request);
+                if (body instanceof Response)
+                    return body;
                 await queue.send({
                     type: 'batch.tick',
                     force: toRecord(body)['force'] === true,
@@ -21,7 +26,7 @@ export function createGoodVibesCloudflareWorker(options = {}) {
             if (!daemonPath)
                 return json({ error: 'Not found', code: 'NOT_FOUND' }, 404);
             if (url.pathname === '/batch/jobs/enqueue' && request.method === 'POST') {
-                if (!options.queueJobPayloads) {
+                if (!options.queueJobPayloads && env.GOODVIBES_QUEUE_JOB_PAYLOADS !== 'true') {
                     return json({
                         error: 'Queueing full batch job payloads is disabled. Post /batch/jobs to proxy directly to the daemon, or enable queueJobPayloads explicitly.',
                         code: 'QUEUE_PAYLOADS_DISABLED',
@@ -31,6 +36,8 @@ export function createGoodVibesCloudflareWorker(options = {}) {
                 if (!queue)
                     return json({ error: 'GOODVIBES_BATCH_QUEUE is not bound', code: 'QUEUE_NOT_CONFIGURED' }, 503);
                 const body = await optionalJson(request);
+                if (body instanceof Response)
+                    return body;
                 await queue.send({
                     type: 'batch.job.create',
                     body: toRecord(body),
@@ -83,7 +90,17 @@ async function handleQueuePayload(payload, env, options) {
     });
 }
 async function proxyDaemonBatch(request, env, options, daemonPath) {
-    const body = request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.text();
+    if (request.method !== 'GET' && request.method !== 'HEAD') {
+        const contentType = request.headers.get('content-type') ?? '';
+        if (contentType && !contentType.toLowerCase().includes('application/json')) {
+            return json({ error: 'Only application/json batch payloads are supported', code: 'UNSUPPORTED_MEDIA_TYPE' }, 415);
+        }
+    }
+    const body = request.method === 'GET' || request.method === 'HEAD'
+        ? undefined
+        : await readTextBodyWithinLimit(request, options.maxRequestBodyBytes);
+    if (body instanceof Response)
+        return body;
     return proxyDaemonJson(env, options, daemonPath, {
         method: request.method,
         body,
@@ -116,12 +133,29 @@ function toDaemonBatchPath(pathname) {
         return '/api/batch';
     return null;
 }
+function requireWorkerAuth(request, env, options) {
+    const expected = options.workerAuthToken ?? env.GOODVIBES_WORKER_TOKEN ?? '';
+    if (!expected && options.allowUnauthenticated === true)
+        return null;
+    if (!expected) {
+        return json({
+            error: 'GOODVIBES_WORKER_TOKEN is required for non-health endpoints',
+            code: 'WORKER_AUTH_TOKEN_REQUIRED',
+        }, 503);
+    }
+    const auth = request.headers.get('authorization') ?? '';
+    if (auth === `Bearer ${expected}`)
+        return null;
+    return json({ error: 'Worker authorization required', code: 'WORKER_AUTH_REQUIRED' }, 401);
+}
 function resolveDaemonUrl(env, options) {
     const raw = options.daemonUrl ?? env.GOODVIBES_DAEMON_URL ?? '';
     return raw.replace(/\/+$/, '');
 }
 async function optionalJson(request) {
-    const text = await request.text();
+    const text = await readTextBodyWithinLimit(request);
+    if (text instanceof Response)
+        return text;
     if (!text.trim())
         return {};
     try {
@@ -131,6 +165,36 @@ async function optionalJson(request) {
         return {};
     }
 }
+async function readTextBodyWithinLimit(request, maxBytes = 1_000_000) {
+    const contentLength = Number.parseInt(request.headers.get('content-length') ?? '0', 10);
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        return json({ error: 'Payload too large', code: 'PAYLOAD_TOO_LARGE' }, 413);
+    }
+    if (!request.body)
+        return '';
+    const reader = request.body.getReader();
+    const decoder = new TextDecoder();
+    let total = 0;
+    let body = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel('Payload too large').catch(() => { });
+                return json({ error: 'Payload too large', code: 'PAYLOAD_TOO_LARGE' }, 413);
+            }
+            body += decoder.decode(value, { stream: true });
+        }
+        body += decoder.decode();
+        return body;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
 function json(body, status = 200) {
     return new Response(JSON.stringify(body), {
         status,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-sdk",
-  "version": "0.25.8",
+  "version": "0.25.11",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mgd34msu/goodvibes-sdk.git"
@@ -13,6 +13,7 @@
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
     "bash-language-server": "file:vendor/bash-language-server",
+    "cloudflare": "5.2.0",
     "fuse.js": "^7.1.0",
     "google-auth-library": "10.6.2",
     "graphql": "^16.13.2",