@phnx-labs/agents-cli 1.22.62 → 1.22.64

package/dist/lib/share/worker-template.js

@@ -251,21 +251,70 @@ export default {
       // segments deep (an unsupported shape outside the CLI) landing on the same
       // literal revision key.
       const noRevision = !!request.headers.get('x-share-no-revision');
-      if (!noRevision) {
-        const existing = await env.BUCKET.get(path);
-        if (existing) {
-          const existingHeaders = new Headers();
-          if (typeof existing.writeHttpMetadata === 'function') existing.writeHttpMetadata(existingHeaders);
-          const existingContentType = existingHeaders.get('content-type');
-          const revKey = path + '/rev-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8);
-          await env.BUCKET.put(revKey, existing.body, {
-            httpMetadata: existingContentType ? { contentType: existingContentType } : undefined,
-            customMetadata: existing.customMetadata || {},
-          });
+      // PHNX-3542: per-user storage quota + object count + per-file size cap +
+      // publish rate limit, enforced ONLY for a managed Phoenix identity. A BYO
+      // WRITE_TOKEN publish writes to the operator's OWN bucket at their own
+      // cost, so it skips all four — a deliberate, documented policy, NOT a
+      // silent no-op. The current object is needed for BOTH the revision copy and
+      // the charge math, so read it once here; a BYO no-revision publish still
+      // skips the read entirely (nothing consumes it).
+      const needExisting = !noRevision || auth.kind === 'phoenix';
+      const existing = needExisting ? await env.BUCKET.get(path) : null;
+      // Enforcement measures the REAL request body, never a client-declared size.
+      // A spoofed-low content-length must NOT (a) slip an oversized body past the
+      // per-file cap, (b) let real bytes exceed the total quota, or — most
+      // dangerously — (c) reach the destructive revision-copy + canonical
+      // overwrite before the size is known and DESTROY the existing page. So for a
+      // Phoenix write we buffer the body bounded by the plan's per-file cap and
+      // reject on the REAL size BEFORE any write; only then do we copy the
+      // revision and store the buffered bytes. BYO streams unbuffered (uncapped,
+      // its own bucket).
+      let putBody = request.body;
+      if (auth.kind === 'phoenix') {
+        const limits = planLimits((await readUsage(env, auth.owner)).usage.plan);
+        // Fast-reject an HONEST oversized content-length without reading the body.
+        // A dishonest (absent or lied-low) length falls through to the bounded
+        // read below, which measures the truth.
+        const declaredLen = parseInt(request.headers.get('content-length') || '', 10);
+        if (Number.isFinite(declaredLen) && declaredLen > limits.maxFileBytes) {
+          return json({ error: 'file too large', maxBytes: limits.maxFileBytes, gotBytes: declaredLen }, 413);
+        }
+        // readBodyBounded aborts the moment it passes the cap, so a chunked/
+        // streaming body can never buffer more than the cap (+ one chunk).
+        const read = await readBodyBounded(request, limits.maxFileBytes);
+        if (read.oversize) {
+          return json({ error: 'file too large', maxBytes: limits.maxFileBytes, gotBytes: read.size }, 413);
         }
+        const realBytes = read.size;
+        const existingSize = existing && typeof existing.size === 'number' ? existing.size : 0;
+        const newCanonical = !existing;
+        // Keeping a revision retains the old canonical bytes AND adds the new
+        // ones, so storage grows by the full new size. A no-revision or first
+        // publish grows by new minus the bytes it replaces (may be negative on a
+        // shrink; the ledger clamps at >= 0).
+        const charge = (!noRevision && existing) ? realBytes : realBytes - existingSize;
+        const charged = await chargeShareWrite(env, auth, {
+          charge: charge,
+          newCanonical: newCanonical,
+          fileBytes: realBytes,
+          countRate: true,
+        });
+        if (charged.error) return charged.error; // rejected BEFORE any destructive write
+        putBody = read.bytes;
       }
 
-      await env.BUCKET.put(path, request.body, {
+      if (!noRevision && existing) {
+        const existingHeaders = new Headers();
+        if (typeof existing.writeHttpMetadata === 'function') existing.writeHttpMetadata(existingHeaders);
+        const existingContentType = existingHeaders.get('content-type');
+        const revKey = path + '/rev-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8);
+        await env.BUCKET.put(revKey, existing.body, {
+          httpMetadata: existingContentType ? { contentType: existingContentType } : undefined,
+          customMetadata: existing.customMetadata || {},
+        });
+      }
+
+      await env.BUCKET.put(path, putBody, {
         httpMetadata: { contentType },
         customMetadata,
       });
@@ -508,6 +557,22 @@ export default {
       const expiresAt = obj.customMetadata && obj.customMetadata['expires-at'];
       if (expiresAt && Date.now() > Date.parse(expiresAt)) {
         await env.BUCKET.delete(path);
+        // PHNX-3542: expiry is a lazy delete with no auth context. Refund the
+        // stamped owner's quota (bytes + object count) best-effort — a refund
+        // failure must never break serving the 410. A canonical page is 2
+        // segments; covers are excluded (never charged) so refund is safe here
+        // because only canonical pages ever carry an expires-at.
+        const expiredOwner = obj.customMetadata && obj.customMetadata['owner'];
+        if (expiredOwner && !path.endsWith('.png')) {
+          try {
+            await refundShareWrite(env, expiredOwner, {
+              refund: typeof obj.size === 'number' ? obj.size : 0,
+              freeCanonical: path.split('/').filter(Boolean).length === 2,
+            });
+          } catch (e) {
+            // best-effort: serving the expiry 410 must never depend on the refund
+          }
+        }
         return new Response('gone — this link has expired', { status: 410, headers: { 'content-type': 'text/plain' } });
       }
       // Resolve the viewer ONCE — needed both to gate me/org reads AND to decide
@@ -615,7 +680,24 @@ export default {
           return json({ error: 'namespace mismatch', owner: handle || uid }, 403);
         }
       }
+      // PHNX-3542: capture the object's size BEFORE deleting so a managed
+      // Phoenix owner's quota can be refunded. A canonical page (2 segments, not
+      // a .png cover) refunds both bytes and the object count; a retained
+      // revision (3+ segments) refunds bytes only; a server-generated .png cover
+      // was never charged, so it is skipped entirely.
+      let doomed = null;
+      const isCover = path.endsWith('.png');
+      if (auth.kind === 'phoenix' && !isCover && !firstSeg.startsWith('__')) {
+        doomed = typeof env.BUCKET.head === 'function' ? await env.BUCKET.head(path) : await env.BUCKET.get(path);
+      }
       await env.BUCKET.delete(path);
+      if (doomed) {
+        const delSegs = path.split('/').filter(Boolean);
+        await refundShareWrite(env, auth.owner, {
+          refund: typeof doomed.size === 'number' ? doomed.size : 0,
+          freeCanonical: delSegs.length === 2,
+        });
+      }
       return json({ ok: true, deleted: path }, 200);
     }
 
@@ -819,6 +901,23 @@ var PUBLIC_INBOX_DOMAINS = ['gmail.com', 'googlemail.com', 'outlook.com', 'hotma
 var SHARE_COOKIE = '__Host-phoenix_share';
 var SHARE_COOKIE_MAX_AGE = 604800;
 
+// PHNX-3542 — per-user storage limits for the MANAGED share endpoint. The plan
+// map is the seam for future paid tiers: only 'free' is defined today, and a
+// ledger with no plan (or an unknown one) resolves to it via planLimits(). Paid
+// tiers and the write path that sets a user's plan arrive with billing (follow-up
+// PHNX-3569); this is a legitimately-deferred seam, not a stub — 'free' IS
+// enforced. Covers/views are server-generated overhead and excluded from the
+// quota, which counts canonical pages + their retained revisions only.
+var MiB = 1024 * 1024;
+var SHARE_PLANS = {
+  free: { maxBytes: 200 * MiB, maxObjects: 150, maxFileBytes: 20 * MiB, ratePerHour: 60 },
+};
+var DEFAULT_SHARE_PLAN = 'free';
+var RATE_WINDOW_MS = 3600 * 1000; // fixed 1h publish-rate window
+function planLimits(plan) { return SHARE_PLANS[plan] || SHARE_PLANS[DEFAULT_SHARE_PLAN]; }
+function freshUsage() { return { bytes: 0, count: 0, plan: DEFAULT_SHARE_PLAN, rlStart: 0, rlUsed: 0 }; }
+function usageNumber(v, fallback) { return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : fallback; }
+
 // Everything in customMetadata that ISN'T one of the reserved provenance/label
 // keys above — i.e. the caller's own \`--meta key=value\` entries. Surfaced on
 // every read route (listing, revisions) so a value stored with \`--meta
@@ -1313,6 +1412,163 @@ async function writeViews(env, path, count) {
   }
 }
 
+// --- PHNX-3542 per-user usage ledger (R2 conditional-put CAS) ---------------
+// The ledger is a single R2 object at __usage/<owner> holding the running
+// { bytes, count, plan, rlStart, rlUsed } for one user. It mirrors the __views /
+// __handles precedent: a __-prefixed key, GET-blocked and outside every gallery/
+// listing/revision prefix. R2 has no atomic increment, so mutations use a
+// read → mutate → conditional-put loop (onlyIf.etagMatches), the same primitive
+// the PATCH metadata-edit path already relies on.
+function usageKey(owner) { return '__usage/' + sanitizeNamespace(owner); }
+
+async function readUsage(env, owner) {
+  const obj = await env.BUCKET.get(usageKey(owner));
+  if (!obj) return { etag: null, usage: freshUsage() };
+  let usage = freshUsage();
+  try {
+    const raw = typeof obj.text === 'function' ? await obj.text() : '';
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object') {
+      usage = {
+        bytes: usageNumber(parsed.bytes, 0),
+        count: usageNumber(parsed.count, 0),
+        plan: typeof parsed.plan === 'string' ? parsed.plan : DEFAULT_SHARE_PLAN,
+        rlStart: usageNumber(parsed.rlStart, 0),
+        rlUsed: usageNumber(parsed.rlUsed, 0),
+      };
+    }
+  } catch (e) {
+    // Malformed ledger — treat as fresh zero but KEEP the etag so the next CAS
+    // put overwrites the corrupt object rather than looping against it forever.
+  }
+  return { etag: obj.etag || null, usage: usage };
+}
+
+async function writeUsageCas(env, owner, prevEtag, usage) {
+  const body = JSON.stringify(usage);
+  const opts = { httpMetadata: { contentType: 'application/json' } };
+  if (prevEtag) {
+    // Existing object: conditional put. R2 returns null when the etag no longer
+    // matches (a concurrent writer won the race) → report failure so the caller
+    // re-reads and retries.
+    opts.onlyIf = { etagMatches: prevEtag };
+    const res = await env.BUCKET.put(usageKey(owner), body, opts);
+    return res !== null;
+  }
+  // Fresh key: plain create. Neither R2 nor the test harness exposes a
+  // conditional-create predicate, so the only race is two simultaneous
+  // first-creates of the same owner's ledger — a benign, one-time bounded loss.
+  await env.BUCKET.put(usageKey(owner), body, opts);
+  return true;
+}
+
+// CAS retry loop. fn(usage) returns { reject: Response } to fail loud without
+// committing, or { commit: usage, result } to persist and return result. On CAS
+// contention it re-reads and retries; exhausting the retries fails loud with 503.
+async function withUsage(env, owner, fn) {
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const state = await readUsage(env, owner);
+    const outcome = fn(state.usage);
+    if (outcome.reject) return outcome.reject;
+    const ok = await writeUsageCas(env, owner, state.etag, outcome.commit);
+    if (ok) return outcome.result;
+  }
+  return json({ error: 'usage ledger contended, retry' }, 503);
+}
+
+function rateLimited(retryAfterSec, ratePerHour) {
+  return new Response(
+    JSON.stringify({ error: 'rate limit: too many publishes, retry later', retryAfterSec: retryAfterSec, ratePerHour: ratePerHour }),
+    { status: 429, headers: { 'content-type': 'application/json', 'retry-after': String(retryAfterSec) } },
+  );
+}
+
+// Charge one authed PUT against the owner's ledger. Rate → per-file cap → object
+// count → byte quota, each failing loud (429 / 413) before anything is written.
+// Returns { error: Response } on any rejection, else { limits } (the resolved
+// plan limits, reused by the post-write real-size reconcile). Managed only: the
+// caller guards on auth.kind === 'phoenix'.
+async function chargeShareWrite(env, auth, params) {
+  const now = Date.now();
+  const out = await withUsage(env, auth.owner, function (usage) {
+    const limits = planLimits(usage.plan);
+    // Rate limit — only a user-initiated page PUT counts (countRate). A fixed 1h
+    // window: reset when the window has rolled over, otherwise reject at the cap.
+    if (params.countRate) {
+      if (now - usage.rlStart >= RATE_WINDOW_MS) { usage.rlStart = now; usage.rlUsed = 0; }
+      if (usage.rlUsed >= limits.ratePerHour) {
+        const retryAfterSec = Math.max(1, Math.ceil((usage.rlStart + RATE_WINDOW_MS - now) / 1000));
+        return { reject: rateLimited(retryAfterSec, limits.ratePerHour) };
+      }
+      usage.rlUsed += 1;
+    }
+    // Per-file size cap.
+    if (typeof params.fileBytes === 'number' && params.fileBytes > limits.maxFileBytes) {
+      return { reject: json({ error: 'file too large', maxBytes: limits.maxFileBytes, gotBytes: params.fileBytes }, 413) };
+    }
+    // Object (canonical page) count.
+    if (params.newCanonical) {
+      if (usage.count + 1 > limits.maxObjects) {
+        return { reject: json({ error: 'artifact limit reached', maxObjects: limits.maxObjects }, 413) };
+      }
+      usage.count += 1;
+    }
+    // Total byte quota. charge may be negative on a shrink — clamp at >= 0.
+    if (usage.bytes + params.charge > limits.maxBytes) {
+      return { reject: json({ error: 'storage limit reached', maxBytes: limits.maxBytes, usedBytes: usage.bytes }, 413) };
+    }
+    usage.bytes = Math.max(0, usage.bytes + params.charge);
+    return { commit: usage, result: { limits: limits } };
+  });
+  if (out instanceof Response) return { error: out };
+  return { limits: out.limits };
+}
+
+// Read a request body fully into memory, BOUNDED: abort the moment it exceeds
+// maxBytes, so a chunked/streaming body can never buffer more than the cap (plus
+// one in-flight chunk) and OOM the Worker. Returns { oversize: true, size } once
+// the cap is passed (size is a lower bound, >= cap), else { bytes, size } with
+// the exact bytes. A body-less request yields an empty buffer. This is what lets
+// enforcement key on the REAL size instead of a spoofable declared header.
+async function readBodyBounded(request, maxBytes) {
+  if (!request.body || typeof request.body.getReader !== 'function') {
+    const buf = await request.arrayBuffer();
+    const bytes = new Uint8Array(buf);
+    if (bytes.byteLength > maxBytes) return { oversize: true, size: bytes.byteLength };
+    return { bytes: bytes, size: bytes.byteLength };
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const step = await reader.read();
+    if (step.done) break;
+    const chunk = step.value;
+    size += chunk.byteLength;
+    if (size > maxBytes) {
+      try { await reader.cancel(); } catch (e) { /* best-effort */ }
+      return { oversize: true, size: size };
+    }
+    chunks.push(chunk);
+  }
+  const out = new Uint8Array(size);
+  let offset = 0;
+  for (let i = 0; i < chunks.length; i++) { out.set(chunks[i], offset); offset += chunks[i].byteLength; }
+  return { bytes: out, size: size };
+}
+
+// Refund on DELETE / expiry. Never rejects, never creates a ledger: if the owner
+// was never charged (no __usage object) it is a pure no-op.
+async function refundShareWrite(env, owner, params) {
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const state = await readUsage(env, owner);
+    if (!state.etag) return; // no ledger — owner never charged, nothing to refund
+    state.usage.bytes = Math.max(0, state.usage.bytes - (params.refund || 0));
+    if (params.freeCanonical) state.usage.count = Math.max(0, state.usage.count - 1);
+    if (await writeUsageCas(env, owner, state.etag, state.usage)) return;
+  }
+}
+
 function viewerMayRead(visibility, meta, identity) {
   if (visibility === 'me') {
     const owner = meta && meta.owner;

package/dist/lib/types.d.ts

@@ -929,7 +929,9 @@ export interface Meta {
     /**
      * `agents feed post` fan-out. `broadcast` maps a sink name to either an argv
      * template (`command:`, run for each post) or an in-process channel delivery
-     * (`channel:`, the same registry `agents send`/`agents notify` use), so
+     * (`channel:`, the same registry `agents send`/`agents notify` use). Channel
+     * sinks may set `message:` with feed placeholders; a missing placeholder
+     * skips that sink, so `{ticket}` cleanly gates a tracker-specific channel. Thus
      * mirroring to a tracker, a messaging CLI, or a channel provider is the
      * operator's config rather than an integration compiled into this CLI. When
      * this is unset/empty, an important-level post falls back to `notify.owner`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.62",
+  "version": "1.22.64",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",