@pleri/olam-cli 0.1.137 → 0.1.138

package/dist/image-digests.json

@@ -1,10 +1,11 @@
 {
   "auth": "sha256:47f58fad2635727a03382a75bbd0db3cd1357e18c4173f29302c8648c3a01d43",
-  "devbox": "sha256:be650e59173f67754df1ae543d8a5ee543cfc431ed8ae636e912c6441400959c",
-  "devbox-base": "sha256:78a8795dd68815f8e8f1077dd1e78d10c5b34765d96048f41e38c3a74f6658c5",
-  "host-cp": "sha256:08e7fbcd68bc23a24c579067ed2bd451c51cb4dff1e7940af2c743c88d5b7835",
+  "devbox": "sha256:370210d8adad83d6f974c720a1988bfa4e4bc18b2fb5e026eb1820fb4c40d5f4",
+  "devbox-base": "sha256:33de7809b0e53090f2d4d2efb36b4c916ee2a5cc3583606031ca934110b5d16f",
+  "host-cp": "sha256:eeddba15e412e2b913dbcbcc1d314cb2dd83a534fce8168b7445e72c4341e1f5",
+  "kg-service": "sha256:db2219624e4eb423c171391d61f0b46da416b1414b56469a73d67bf6e31fd8ea",
   "mcp-auth": "sha256:452b10df72ac8f7e8f249c171e068e51c7ca846a9b287df81e253b7df1169a95",
   "$schema_version": 1,
-  "$published_version": "0.1.137",
+  "$published_version": "0.1.138",
   "$registry": "ghcr.io/pleri"
 }

package/host-cp/src/plan-chat-service.mjs

@@ -3,8 +3,14 @@
 //   POST /v1/chunks         — bearer-auth write API; server-injects actor_id +
 //                             actor_type from the bearer principal, validates the
 //                             payload, INSERTs into a source Postgres.
-//   GET  /v1/shape          — proxied straight to a backing Electric SQL server
-//                             (read-only by Electric's contract; no extra auth).
+//   GET  /v1/shape          — bearer-auth read API; requires (world_id,
+//                             session_id) query params; rewrites the upstream
+//                             Electric `where` clause server-side so a caller
+//                             can never enumerate cross-world chunks (PB2).
+//                             Streams the upstream response without buffering
+//                             so Electric's `live=true` long-poll round-trips
+//                             stay reactive (PB1). Phase B B1 closes both
+//                             A2-CP3 audit HIGHs.
 //   GET  /livez             — liveness probe (200 on healthy; matches the
 //                             agent-memory-service shape so host-cp uses one
 //                             probe pattern for both sidecars).
@@ -22,6 +28,7 @@
 //   OLAM_PLAN_CHAT_SECRET_PATH   (default ~/.olam/plan-chat-secret)
 
 import http from 'node:http';
+import { Readable } from 'node:stream';
 import { URL } from 'node:url';
 import pg from 'pg';
 import { ensureSecret, timingSafeEqual, SECRET_PATH } from './plan-chat-secret.mjs';
@@ -33,6 +40,27 @@ const DEFAULT_ELECTRIC_URL = 'http://localhost:30001';
 const ACTOR_TYPES = new Set(['agent', 'operator', 'codex', 'system']);
 const ROLES = new Set(['user', 'assistant', 'tool', 'system']);
 
+// PB2 — scope-ID shape. world_id + session_id query params are interpolated
+// into the upstream Electric `where` clause; the regex IS the SQL-injection
+// defence (single-quotes, semicolons, comments can't pass). Same shape as
+// @olam/chunks schema accepts and as measure-in-world.mjs validates. Bump
+// only if the chunks schema bumps; the two must move together.
+const SCOPE_ID_RE = /^[A-Za-z0-9_.-]+$/;
+
+// PB2 — query params the server OWNS on /v1/shape. All three are stripped
+// from what we forward to upstream Electric:
+//   - `world_id` + `session_id` are SEEDS for the server-derived `where`
+//     clause; Electric doesn't read them natively, so dropping them from
+//     the upstream URL is a no-op for Electric semantics. (Per CP3-B1-M2:
+//     this drop is intentional — if a future Electric version adopts these
+//     as native scope params, split this set into SEEDS vs DROPPED.)
+//   - `where` is the actual SQL predicate; we drop the client's value and
+//     replace with the server-derived one. Operator can't bypass scope by
+//     passing their own.
+// Everything else (`table`, `offset`, `handle`, `live`, future Electric
+// params) forwards through verbatim.
+const SCOPED_QUERY_PARAMS = new Set(['world_id', 'session_id', 'where']);
+
 /**
  * Resolve the bearer principal to (actor_id, actor_type). The minimal-A2
  * implementation treats every authenticated bearer as the same shared
@@ -188,24 +216,103 @@ export function createHandler({ pool, bearer, electricUrl }) {
   }
 
   async function handleGetShape(req, res, url) {
-    // Proxy directly to Electric — read-path is shape-server's responsibility,
-    // not ours; we just preserve the URL and add no auth (Electric is read-only).
+    // PB2 — bearer required. Same checkAuth as POST /v1/chunks; rejects with
+    // a constant-time comparison via timingSafeEqual.
+    if (!checkAuth(req)) return unauthorized(res);
+
+    // PB2 — server-derived scope. world_id + session_id query params are
+    // mandatory; the regex check is the SQL-injection defence for the
+    // upstream `where` interpolation below.
+    const worldId = url.searchParams.get('world_id');
+    const sessionId = url.searchParams.get('session_id');
+    if (!worldId || !SCOPE_ID_RE.test(worldId)) {
+      return badRequest(
+        res,
+        'world_id query param required (alphanumerics + _ - . only)',
+      );
+    }
+    if (!sessionId || !SCOPE_ID_RE.test(sessionId)) {
+      return badRequest(
+        res,
+        'session_id query param required (alphanumerics + _ - . only)',
+      );
+    }
+
+    // Forward all client query params EXCEPT the scoped set. Client-supplied
+    // `where` is silently dropped — server-derived `where` always wins.
+    // Operators inspecting traffic see the rewrite in the upstream URL; we
+    // don't 400 on `where=` presence because legitimate Electric clients may
+    // pass it via library defaults.
     const upstream = new URL(electricBase);
     upstream.pathname = '/v1/shape';
-    for (const [key, value] of url.searchParams) upstream.searchParams.set(key, value);
+    for (const [key, value] of url.searchParams) {
+      if (SCOPED_QUERY_PARAMS.has(key)) continue;
+      upstream.searchParams.set(key, value);
+    }
+    // PB2 — server-derived `where` clause; safe because SCOPE_ID_RE has
+    // already rejected single-quotes, semicolons, and SQL meta-characters.
+    upstream.searchParams.set(
+      'where',
+      `world_id='${worldId}' AND session_id='${sessionId}'`,
+    );
+
+    let upstreamRes;
     try {
-      const upstreamRes = await fetch(upstream, {
+      upstreamRes = await fetch(upstream, {
         method: 'GET',
         headers: { accept: 'application/json' },
       });
-      const text = await upstreamRes.text();
-      for (const header of ['electric-handle', 'electric-offset', 'electric-up-to-date', 'electric-schema']) {
-        const value = upstreamRes.headers.get(header);
-        if (value) res.setHeader(header, value);
-      }
-      send(res, upstreamRes.status, text || '[]');
     } catch (err) {
-      send(res, 502, { error: 'shape-upstream-unreachable', message: String(err?.message ?? err) });
+      return send(res, 502, {
+        error: 'shape-upstream-unreachable',
+        message: String(err?.message ?? err),
+      });
+    }
+
+    // Forward upstream electric-* headers BEFORE the stream starts. Once
+    // res.writeHead fires, headers are locked.
+    for (const header of [
+      'electric-handle',
+      'electric-offset',
+      'electric-up-to-date',
+      'electric-schema',
+    ]) {
+      const value = upstreamRes.headers.get(header);
+      if (value) res.setHeader(header, value);
+    }
+    const upstreamContentType = upstreamRes.headers.get('content-type');
+    if (upstreamContentType) res.setHeader('content-type', upstreamContentType);
+
+    res.writeHead(upstreamRes.status);
+
+    // PB1 — stream the body without buffering. Electric SQL long-poll
+    // responses (`live=true`) can sit open for tens of seconds before the
+    // first row arrives; the old `fetch().text()` blocked the response until
+    // upstream closed, which broke reactive UX. `Readable.fromWeb` wraps
+    // upstream's web ReadableStream as a Node Readable; `.pipe(res)` ends
+    // the response automatically when the upstream stream closes.
+    //
+    // CP3-B1-H1 fix: attach an `error` listener BEFORE piping. Without one,
+    // a mid-stream upstream error (Electric SQL restart, network blip mid
+    // long-poll, upstream socket reset after headers) becomes an
+    // uncaughtException and kills the host-cp process — DoS class. On
+    // upstream error we destroy the response so the client sees a
+    // truncated body (the only honest signal once headers are sent) and
+    // the process stays up. Mirrors the established pattern in
+    // packages/host-cp/src/proxy.mjs:205.
+    if (upstreamRes.body) {
+      const src = Readable.fromWeb(upstreamRes.body);
+      src.on('error', (err) => {
+        try {
+          res.destroy(err);
+        } catch {
+          /* response already destroyed; fine */
+        }
+      });
+      src.pipe(res);
+    } else {
+      // Defensive — no body (e.g. HEAD-shaped empty response). Close out.
+      res.end();
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.137",
+  "version": "0.1.138",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"