@radaros/transport 0.3.26 → 0.3.28

package/dist/index.cjs

@@ -168,7 +168,7 @@ function createA2AServer(app, opts) {
   app.get("/.well-known/agent.json", (_req, res) => {
     res.json(agentCard);
   });
-  app.use(basePath, express.json());
+  app.use(basePath, express.json({ limit: "1mb" }));
   app.post(basePath, async (req, res) => {
     const body = req.body;
     if (!body || body.jsonrpc !== "2.0" || !body.method) {
@@ -530,9 +530,14 @@ function createAdminRouter(opts) {
   if (opts?.middleware) {
     for (const mw of opts.middleware) router.use(mw);
   }
-  if (!opts?.middleware?.length && process.env.NODE_ENV === "production") {
+  if (!opts?.middleware?.length) {
+    if (process.env.NODE_ENV === "production") {
+      throw new Error(
+        "[admin-router] Admin routes cannot be mounted without authentication middleware in production. Pass middleware in AdminRouterOptions to secure them."
+      );
+    }
     console.warn(
-      "[admin-router] WARNING: Admin routes mounted without authentication middleware. These endpoints can add MCP servers, execute tools, and modify configurations. Pass middleware in AdminRouterOptions to secure them."
+      "[admin-router] WARNING: Admin routes mounted without authentication middleware. These endpoints can add MCP servers, execute tools, and modify configurations. This is allowed in development only. Pass middleware in AdminRouterOptions to secure them."
     );
   }
   router.get("/mcp", (_req, res) => {
@@ -699,7 +704,7 @@ function filesToContentParts(files) {
       type: partType,
       data: base64,
       mimeType: file.mimetype,
-      ...partType === "file" ? { fileName: file.originalname } : {}
+      ...partType === "file" ? { fileName: (file.originalname ?? "attachment").replace(/.*[/\\]/, "").replace(/[^a-zA-Z0-9._-]/g, "_") } : {}
     };
   });
 }
@@ -721,15 +726,18 @@ function errorHandler(options) {
   const log = options?.logger ?? console;
   return (err, _req, res, _next) => {
     log.error("[radaros:transport] Error:", err.message);
-    res.status(err.statusCode ?? 500).json({
-      error: err.message ?? "Internal server error"
+    const statusCode = err.statusCode ?? 500;
+    const isClientError = statusCode >= 400 && statusCode < 500;
+    res.status(statusCode).json({
+      error: isClientError ? err.message ?? "Bad request" : "Internal server error"
     });
   };
 }
 function requestLogger(options) {
   const log = options?.logger ?? console;
   return (req, _res, next) => {
-    log.log(`[radaros:transport] ${req.method} ${req.path}`);
+    const safePath = String(req.path).replace(/[\x00-\x1f\x7f]/g, "");
+    log.log(`[radaros:transport] ${req.method} ${safePath}`);
     next();
   };
 }
@@ -1211,6 +1219,13 @@ function rateLimitMiddleware(config = {}) {
   const windowMs = config.windowMs ?? 6e4;
   const max = config.max ?? 100;
   const hits = /* @__PURE__ */ new Map();
+  const cleanup = setInterval(() => {
+    const now = Date.now();
+    for (const [key, record] of hits) {
+      if (now > record.resetTime) hits.delete(key);
+    }
+  }, windowMs);
+  cleanup.unref();
   return (req, res, next) => {
     const key = req.ip ?? req.socket?.remoteAddress ?? "unknown";
     const now = Date.now();
@@ -1595,7 +1610,8 @@ function createAgentRouter(opts) {
   if (opts.admin) {
     const adminOpts = typeof opts.admin === "object" ? opts.admin : {};
     const { router: adminRouter } = createAdminRouter({
-      mcpManager: adminOpts.mcpManager
+      mcpManager: adminOpts.mcpManager,
+      middleware: adminOpts.middleware ?? opts.middleware
     });
     router.use("/admin", adminRouter);
   }
@@ -1977,11 +1993,17 @@ function createVoiceGateway(opts) {
     socket.on("voice.audio", (data) => {
       const session = activeSessions.get(socket.id);
       if (!session) return;
-      session.sendAudio(Buffer.from(data.data, "base64"));
+      if (typeof data?.data !== "string" || data.data.length > 1e6) return;
+      try {
+        session.sendAudio(Buffer.from(data.data, "base64"));
+      } catch {
+        socket.emit("voice.error", { error: "Invalid audio data" });
+      }
     });
     socket.on("voice.text", (data) => {
       const session = activeSessions.get(socket.id);
       if (!session) return;
+      if (typeof data?.text !== "string" || data.text.length > 1e4) return;
       session.sendText(data.text);
     });
     socket.on("voice.interrupt", () => {
@@ -1992,7 +2014,11 @@ function createVoiceGateway(opts) {
     socket.on("voice.stop", async () => {
       const session = activeSessions.get(socket.id);
       if (!session) return;
-      await session.close();
+      try {
+        await session.close();
+      } catch (err) {
+        console.warn("[voice-gateway] Error closing session:", err);
+      }
       activeSessions.delete(socket.id);
       socket.emit("voice.stopped");
     });

package/dist/index.d.cts

@@ -199,6 +199,7 @@ interface RouterOptions {
      */
     admin?: boolean | {
         mcpManager?: MCPManager;
+        middleware?: any[];
     };
 }
 

package/dist/index.d.ts

@@ -199,6 +199,7 @@ interface RouterOptions {
      */
     admin?: boolean | {
         mcpManager?: MCPManager;
+        middleware?: any[];
     };
 }
 

package/dist/index.js

@@ -125,7 +125,7 @@ function createA2AServer(app, opts) {
   app.get("/.well-known/agent.json", (_req, res) => {
     res.json(agentCard);
   });
-  app.use(basePath, express.json());
+  app.use(basePath, express.json({ limit: "1mb" }));
   app.post(basePath, async (req, res) => {
     const body = req.body;
     if (!body || body.jsonrpc !== "2.0" || !body.method) {
@@ -487,9 +487,14 @@ function createAdminRouter(opts) {
   if (opts?.middleware) {
     for (const mw of opts.middleware) router.use(mw);
   }
-  if (!opts?.middleware?.length && process.env.NODE_ENV === "production") {
+  if (!opts?.middleware?.length) {
+    if (process.env.NODE_ENV === "production") {
+      throw new Error(
+        "[admin-router] Admin routes cannot be mounted without authentication middleware in production. Pass middleware in AdminRouterOptions to secure them."
+      );
+    }
     console.warn(
-      "[admin-router] WARNING: Admin routes mounted without authentication middleware. These endpoints can add MCP servers, execute tools, and modify configurations. Pass middleware in AdminRouterOptions to secure them."
+      "[admin-router] WARNING: Admin routes mounted without authentication middleware. These endpoints can add MCP servers, execute tools, and modify configurations. This is allowed in development only. Pass middleware in AdminRouterOptions to secure them."
     );
   }
   router.get("/mcp", (_req, res) => {
@@ -656,7 +661,7 @@ function filesToContentParts(files) {
       type: partType,
       data: base64,
       mimeType: file.mimetype,
-      ...partType === "file" ? { fileName: file.originalname } : {}
+      ...partType === "file" ? { fileName: (file.originalname ?? "attachment").replace(/.*[/\\]/, "").replace(/[^a-zA-Z0-9._-]/g, "_") } : {}
     };
   });
 }
@@ -678,15 +683,18 @@ function errorHandler(options) {
   const log = options?.logger ?? console;
   return (err, _req, res, _next) => {
     log.error("[radaros:transport] Error:", err.message);
-    res.status(err.statusCode ?? 500).json({
-      error: err.message ?? "Internal server error"
+    const statusCode = err.statusCode ?? 500;
+    const isClientError = statusCode >= 400 && statusCode < 500;
+    res.status(statusCode).json({
+      error: isClientError ? err.message ?? "Bad request" : "Internal server error"
     });
   };
 }
 function requestLogger(options) {
   const log = options?.logger ?? console;
   return (req, _res, next) => {
-    log.log(`[radaros:transport] ${req.method} ${req.path}`);
+    const safePath = String(req.path).replace(/[\x00-\x1f\x7f]/g, "");
+    log.log(`[radaros:transport] ${req.method} ${safePath}`);
     next();
   };
 }
@@ -1168,6 +1176,13 @@ function rateLimitMiddleware(config = {}) {
   const windowMs = config.windowMs ?? 6e4;
   const max = config.max ?? 100;
   const hits = /* @__PURE__ */ new Map();
+  const cleanup = setInterval(() => {
+    const now = Date.now();
+    for (const [key, record] of hits) {
+      if (now > record.resetTime) hits.delete(key);
+    }
+  }, windowMs);
+  cleanup.unref();
   return (req, res, next) => {
     const key = req.ip ?? req.socket?.remoteAddress ?? "unknown";
     const now = Date.now();
@@ -1552,7 +1567,8 @@ function createAgentRouter(opts) {
   if (opts.admin) {
     const adminOpts = typeof opts.admin === "object" ? opts.admin : {};
     const { router: adminRouter } = createAdminRouter({
-      mcpManager: adminOpts.mcpManager
+      mcpManager: adminOpts.mcpManager,
+      middleware: adminOpts.middleware ?? opts.middleware
     });
     router.use("/admin", adminRouter);
   }
@@ -1934,11 +1950,17 @@ function createVoiceGateway(opts) {
     socket.on("voice.audio", (data) => {
       const session = activeSessions.get(socket.id);
       if (!session) return;
-      session.sendAudio(Buffer.from(data.data, "base64"));
+      if (typeof data?.data !== "string" || data.data.length > 1e6) return;
+      try {
+        session.sendAudio(Buffer.from(data.data, "base64"));
+      } catch {
+        socket.emit("voice.error", { error: "Invalid audio data" });
+      }
     });
     socket.on("voice.text", (data) => {
       const session = activeSessions.get(socket.id);
       if (!session) return;
+      if (typeof data?.text !== "string" || data.text.length > 1e4) return;
       session.sendText(data.text);
     });
     socket.on("voice.interrupt", () => {
@@ -1949,7 +1971,11 @@ function createVoiceGateway(opts) {
     socket.on("voice.stop", async () => {
       const session = activeSessions.get(socket.id);
       if (!session) return;
-      await session.close();
+      try {
+        await session.close();
+      } catch (err) {
+        console.warn("[voice-gateway] Error closing session:", err);
+      }
       activeSessions.delete(socket.id);
       socket.emit("voice.stopped");
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radaros/transport",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "HTTP and WebSocket transport layer for RadarOS agents",
   "license": "MIT",
   "repository": {
@@ -42,7 +42,7 @@
     "typescript": "^5.6.0"
   },
   "peerDependencies": {
-    "@radaros/core": "^0.3.26",
+    "@radaros/core": "^0.3.28",
     "@types/express": "^4.0.0 || ^5.0.0",
     "express": "^4.0.0 || ^5.0.0",
     "multer": ">=2.0.0",