@robosystems/core 0.8.4 → 0.8.6

package/auth-core/sso.js

@@ -9,6 +9,28 @@ const debugLog = (message, error) => {
         console.debug(`[SSO] ${message}`, error);
     }
 };
+/**
+ * Reduce a `returnUrl` to a same-origin path, or reject it.
+ *
+ * The value reaches us from a query parameter (or the sessionStorage mirror of
+ * one), so it is attacker-controlled on any crafted SSO link: an absolute URL
+ * would bounce the freshly authenticated user to another site, and a
+ * `javascript:` payload would execute as this origin. Cross-app returns don't
+ * need the escape hatch — `getSSORedirectUrl` hands the path to the *target*
+ * app, which resolves it against its own origin — so a bare absolute path is
+ * the only shape we ever legitimately produce.
+ */
+const sanitizeReturnUrl = (returnUrl) => {
+    if (!returnUrl)
+        return null;
+    // `//host` and `/\host` are both protocol-relative once a browser
+    // normalises them, so a leading slash alone isn't enough.
+    if (!returnUrl.startsWith('/'))
+        return null;
+    if (returnUrl.startsWith('//') || returnUrl.startsWith('/\\'))
+        return null;
+    return returnUrl;
+};
 export class SSOManager {
     constructor(apiUrl) {
         this.authClient = new RoboSystemsAuthClient(apiUrl);
@@ -84,7 +106,7 @@ export class SSOManager {
             debugLog('sessionStorage read failed during SSO login', error);
         }
         const finalSessionId = sessionId; // Only use URL parameter for session ID
-        const finalReturnUrl = returnUrl || sessionStorageReturn;
+        const finalReturnUrl = sanitizeReturnUrl(returnUrl || sessionStorageReturn);
         if (!finalSessionId) {
             return null;
         }

package/components/console/ConsoleContent.js

@@ -68,6 +68,10 @@ export function ConsoleContent({ config }) {
     const [historyIndex, setHistoryIndex] = useState(-1);
     const terminalEndRef = useRef(null);
     const terminalScrollRef = useRef(null);
+    // Prior operator exchanges, sent as `history` so a follow-up like "and for
+    // June?" resolves against the previous answer. Bounded to the last three
+    // exchanges — the backend seeds only its last five turns anyway.
+    const conversationRef = useRef([]);
     const [currentQueryStartTime, setCurrentQueryStartTime] = useState(null);
     const [apiVersion, setApiVersion] = useState(null);
     const [operatorProgress, setOperatorProgress] = useState({ isRunning: false, message: '' });
@@ -190,6 +194,9 @@ export function ConsoleContent({ config }) {
                 streamingQuery.cancelQuery();
             }
             setTerminalMessages([]);
+            // A follow-up on the new graph must not resolve against the previous
+            // graph's answers.
+            conversationRef.current = [];
             setCurrentQueryStartTime(null);
             addSystemMessage(`═══════════════════════════════════════════════════════════════\n` +
                 `${config.welcome.contextLabel} context changed: ${previousGraphId.current} → ${graphId}\n` +
@@ -317,10 +324,11 @@ export function ConsoleContent({ config }) {
         const startTime = Date.now();
         try {
             const { clients } = await import('@robosystems/client/clients');
-            const result = await clients.operator.executeQuery(graphId, {
-                message: userQuery,
-                mode: 'quick',
-            }, {
+            const history = conversationRef.current;
+            const result = await clients.operator.executeQuery(graphId, Object.assign({ message: userQuery, 
+                // `standard` gives the operator loop six tool turns; `quick` (three)
+                // was exhausted by schema + examples before the first query ran.
+                mode: 'standard' }, (history.length > 0 ? { history } : {})), {
                 mode: 'auto',
                 onProgress: (message, percentage) => {
                     setOperatorProgress({
@@ -331,6 +339,19 @@ export function ConsoleContent({ config }) {
                 },
             });
             setOperatorProgress({ isRunning: false, message: '' });
+            // The API reports operator failures (credit pre-flight, timeouts,
+            // unbilled calls) as HTTP 200 with `error_details` set and an
+            // explanatory `content`. Render those as errors, not as answers.
+            const errorDetails = result.error_details;
+            if (errorDetails) {
+                const detail = [
+                    errorDetails.message,
+                    errorDetails.error,
+                    errorDetails.detail,
+                ].find((v) => typeof v === 'string' && v.length > 0);
+                addErrorMessage(`Operator error: ${detail || result.content || 'The operator could not complete this request.'}`);
+                return;
+            }
             const duration = Date.now() - startTime;
             const metadata = (result.metadata || {});
             const creditsUsed = metadata.credits_consumed;
@@ -385,6 +406,13 @@ export function ConsoleContent({ config }) {
             // plain footer, matching the direct-query result style.
             if (narrative) {
                 addResultMessage(narrative, rows, cypher, { markdown: true, footer });
+                // Record the exchange for follow-ups. Only a narrative answer is
+                // worth carrying; the answer is clipped so history stays cheap.
+                conversationRef.current = [
+                    ...conversationRef.current,
+                    { role: 'user', content: userQuery },
+                    { role: 'assistant', content: narrative.slice(0, 2000) },
+                ].slice(-6);
             }
             else {
                 addResultMessage(footer, rows, cypher);
@@ -611,6 +639,7 @@ export function ConsoleContent({ config }) {
                     return;
                 case '/clear':
                     setTerminalMessages([]);
+                    conversationRef.current = [];
                     addSystemMessage('Console cleared.', true);
                     return;
                 case '/examples': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,