@roj-ai/sdk 0.1.36 → 0.2.2

package/src/transport/http/routes/files.ts

@@ -6,150 +6,17 @@
  */
 
 import { Hono } from 'hono'
-import { extname, resolve } from 'node:path'
-import { SessionId } from '~/core/sessions/schema.js'
-import { type AppContext, type AppEnv, getServices } from '../app.js'
-
-// ============================================================================
-// Constants
-// ============================================================================
-
-/** Known MIME types for specific extensions. */
-const MIME_TYPES: Record<string, string> = {
-	// Images
-	'.jpg': 'image/jpeg',
-	'.jpeg': 'image/jpeg',
-	'.png': 'image/png',
-	'.gif': 'image/gif',
-	'.webp': 'image/webp',
-	'.svg': 'image/svg+xml',
-	'.ico': 'image/x-icon',
-	'.bmp': 'image/bmp',
-	'.avif': 'image/avif',
-	// Video
-	'.mp4': 'video/mp4',
-	'.webm': 'video/webm',
-	'.mov': 'video/quicktime',
-	// Audio
-	'.mp3': 'audio/mpeg',
-	'.wav': 'audio/wav',
-	'.ogg': 'audio/ogg',
-	// Documents
-	'.pdf': 'application/pdf',
-	// Data/markup
-	'.json': 'application/json',
-	'.html': 'text/html',
-	'.css': 'text/css',
-	'.js': 'application/javascript',
-	'.mjs': 'application/javascript',
-	'.xml': 'text/xml',
-	'.yaml': 'text/yaml',
-	'.yml': 'text/yaml',
-	'.md': 'text/markdown',
-	// Archives
-	'.zip': 'application/zip',
-	'.tar': 'application/x-tar',
-	'.gz': 'application/gzip',
-	// Fonts
-	'.woff': 'font/woff',
-	'.woff2': 'font/woff2',
-	'.ttf': 'font/ttf',
-	'.otf': 'font/otf',
-	// Binary
-	'.wasm': 'application/wasm',
-}
-
-/** Extensions known to be binary — files that cannot be displayed as text. */
-const BINARY_EXTENSIONS = new Set([
-	// Images
-	'.jpg',
-	'.jpeg',
-	'.png',
-	'.gif',
-	'.webp',
-	'.bmp',
-	'.ico',
-	'.tiff',
-	'.tif',
-	'.avif',
-	// Video
-	'.mp4',
-	'.webm',
-	'.avi',
-	'.mov',
-	'.mkv',
-	'.flv',
-	'.wmv',
-	// Audio
-	'.mp3',
-	'.wav',
-	'.ogg',
-	'.flac',
-	'.aac',
-	'.wma',
-	'.m4a',
-	// Archives
-	'.zip',
-	'.tar',
-	'.gz',
-	'.bz2',
-	'.xz',
-	'.7z',
-	'.rar',
-	'.zst',
-	// Documents (binary)
-	'.pdf',
-	'.doc',
-	'.docx',
-	'.xls',
-	'.xlsx',
-	'.ppt',
-	'.pptx',
-	'.odt',
-	// Fonts
-	'.woff',
-	'.woff2',
-	'.ttf',
-	'.otf',
-	'.eot',
-	// Compiled/binary
-	'.wasm',
-	'.exe',
-	'.dll',
-	'.so',
-	'.dylib',
-	'.o',
-	'.a',
-	'.class',
-	'.pyc',
-	'.pyo',
-	// Database
-	'.sqlite',
-	'.db',
-	'.sqlite3',
-	// Other
-	'.bin',
-	'.dat',
-])
+import { resolve } from 'node:path'
+import { getMimeType, preventTraversal } from '~/plugins/filesystem/listing.js'
+import { parseSessionId, type SessionId } from '~/core/sessions/schema.js'
+import { type AppContext, type AppEnv, getServices } from '../context.js'
+import { resolveCanonicalPath } from '../path-containment.js'
+import { invalidSessionId } from '../responses.js'
 
 // ============================================================================
 // Helpers
 // ============================================================================
 
-/**
- * Determine MIME type for a file.
- * Known extensions get their specific MIME type, known binary extensions
- * get `application/octet-stream`, everything else defaults to `text/plain`
- * so that code/config files (.astro, .vue, .svelte, .go, .rs, etc.)
- * are previewable as text.
- */
-function getMimeType(filePath: string): string {
-	const ext = extname(filePath).toLowerCase()
-	if (MIME_TYPES[ext]) return MIME_TYPES[ext]
-	if (BINARY_EXTENSIONS.has(ext)) return 'application/octet-stream'
-	return 'text/plain'
-}
-
 /**
  * Extract the wildcard path suffix from a request.
  *
@@ -159,18 +26,14 @@ function getMimeType(filePath: string): string {
 function extractWildcardPath(c: AppContext, marker: string): string {
 	const idx = c.req.path.indexOf(`/${marker}/`)
 	if (idx === -1) return ''
-	return c.req.path.slice(idx + marker.length + 2)
-}
-
-function preventTraversal(baseDir: string, requestedPath: string): string | null {
-	const resolved = resolve(baseDir, requestedPath)
-	if (!resolved.startsWith(baseDir + '/') && resolved !== baseDir) {
-		return null
+	try {
+		return decodeURIComponent(c.req.path.slice(idx + marker.length + 2))
+	} catch {
+		return ''
 	}
-	return resolved
 }
 
-async function serveFile(c: AppContext, filePath: string): Promise<Response> {
+async function serveFile(c: AppContext, filePath: string, mimePath: string): Promise<Response> {
 	const { platform } = getServices(c)
 	let data: Buffer
 	try {
@@ -182,22 +45,29 @@ async function serveFile(c: AppContext, filePath: string): Promise<Response> {
 		)
 	}
 
-	const contentType = getMimeType(filePath)
+	const contentType = getMimeType(mimePath)
 
 	return new Response(data, {
 		headers: {
 			'Content-Type': contentType,
 			'Content-Length': data.length.toString(),
 			'Cache-Control': 'public, max-age=3600',
+			// Bodies here are attacker-influenced (uploads, injected resources, anything the agent writes).
+			'X-Content-Type-Options': 'nosniff',
+			'Content-Security-Policy': "default-src 'none'; sandbox",
 		},
 	})
 }
 
-async function resolveWorkspaceDir(c: AppContext, sessionId: string): Promise<string | null> {
+async function resolveWorkspaceDir(c: AppContext, sessionId: SessionId): Promise<string | null> {
 	const { sessionRuntime } = getServices(c)
-	const result = await sessionRuntime.getSession(SessionId(sessionId))
+	const result = await sessionRuntime.acquireSessionLease(sessionId, 'http:files')
 	if (!result.ok) return null
-	return result.value.state.workspaceDir ?? null
+	try {
+		return result.value.session.state.workspaceDir ?? null
+	} finally {
+		result.value.release()
+	}
 }
 
 // ============================================================================
@@ -215,8 +85,9 @@ export function createFileRoutes(): Hono<AppEnv> {
 
 	// --- Serve session file ---
 	app.get('/:sessionId/files/*', async (c: AppContext) => {
-		const { config } = getServices(c)
-		const sessionId = c.req.param('sessionId')!
+		const { dataFileStore } = getServices(c)
+		const sessionIdResult = parseSessionId(c.req.param('sessionId')!)
+		if (!sessionIdResult.ok) return invalidSessionId(c, sessionIdResult.error)
 		const filePath = extractWildcardPath(c, 'files')
 
 		if (!filePath) {
@@ -226,7 +97,17 @@ export function createFileRoutes(): Hono<AppEnv> {
 			)
 		}
 
-		const sessionDir = resolve(config.dataPath, 'sessions', sessionId)
+		// Build the root through the store's guard: `resolve(dataPath, ...)` would happily
+		// escape the data root on an id Hono decoded from `%2F`.
+		const sessionDirResult = dataFileStore.realPath(`sessions/${sessionIdResult.value}`)
+		if (!sessionDirResult.ok) {
+			return c.json(
+				{ error: { type: 'forbidden', message: 'Path traversal not allowed' } },
+				403,
+			)
+		}
+
+		const sessionDir = sessionDirResult.value
 		const resolvedPath = preventTraversal(sessionDir, filePath)
 
 		if (!resolvedPath) {
@@ -236,12 +117,27 @@ export function createFileRoutes(): Hono<AppEnv> {
 			)
 		}
 
-		return serveFile(c, resolvedPath)
+		const canonicalPath = await resolveCanonicalPath(c, sessionDir, resolvedPath)
+		if (canonicalPath.status === 'forbidden') {
+			return c.json(
+				{ error: { type: 'forbidden', message: 'Symlink traversal not allowed' } },
+				403,
+			)
+		}
+		if (canonicalPath.status === 'not_found') {
+			return c.json(
+				{ error: { type: 'not_found', message: 'File not found' } },
+				404,
+			)
+		}
+
+		return serveFile(c, canonicalPath.path, resolvedPath)
 	})
 
 	// --- Serve workspace file ---
 	app.get('/:sessionId/workspace/*', async (c: AppContext) => {
-		const sessionId = c.req.param('sessionId')!
+		const sessionIdResult = parseSessionId(c.req.param('sessionId')!)
+		if (!sessionIdResult.ok) return invalidSessionId(c, sessionIdResult.error)
 		const filePath = extractWildcardPath(c, 'workspace')
 
 		if (!filePath) {
@@ -251,7 +147,7 @@ export function createFileRoutes(): Hono<AppEnv> {
 			)
 		}
 
-		const workspaceDir = await resolveWorkspaceDir(c, sessionId)
+		const workspaceDir = await resolveWorkspaceDir(c, sessionIdResult.value)
 		if (!workspaceDir) {
 			return c.json(
 				{ error: { type: 'not_found', message: 'No workspace configured for this session' } },
@@ -267,7 +163,21 @@ export function createFileRoutes(): Hono<AppEnv> {
 			)
 		}
 
-		return serveFile(c, resolvedPath)
+		const canonicalPath = await resolveCanonicalPath(c, workspaceDir, resolvedPath)
+		if (canonicalPath.status === 'forbidden') {
+			return c.json(
+				{ error: { type: 'forbidden', message: 'Symlink traversal not allowed' } },
+				403,
+			)
+		}
+		if (canonicalPath.status === 'not_found') {
+			return c.json(
+				{ error: { type: 'not_found', message: 'File not found' } },
+				404,
+			)
+		}
+
+		return serveFile(c, canonicalPath.path, resolvedPath)
 	})
 
 	return app

package/src/transport/http/routes/resources.ts

@@ -8,107 +8,138 @@
  */
 
 import { Hono } from 'hono'
-import type { AppContext, AppEnv } from '../app.js'
-import { getServices } from '../app.js'
-import { SessionId } from '~/core/sessions/schema.js'
+import z from 'zod/v4'
+import { parseSessionId } from '~/core/sessions/schema.js'
+import { ResourceBasenameSchema } from '~/plugins/resources/filename.js'
+import type { AppContext, AppEnv } from '../context.js'
+import { getServices } from '../context.js'
+import { readBodyWithLimit, safeFetch } from '../fetch-guard.js'
+import { invalidSessionId, parseError, sessionNotFound } from '../responses.js'
+
+const ResourceRequestSchema = z.object({
+	url: z.string().min(1),
+	filename: z.string().min(1),
+	mimeType: z.string().min(1),
+	metadata: z.object({
+		slug: z.string().optional(),
+		name: z.string().optional(),
+	}).optional(),
+}).superRefine((body, refinement) => {
+	if (body.mimeType !== 'application/zip' && !ResourceBasenameSchema.safeParse(body.filename).success) {
+		refinement.addIssue({
+			code: 'custom',
+			path: ['filename'],
+			message: 'Resource filename must be a basename',
+		})
+	}
+})
+
+const ResourceInjectResultSchema = z.object({
+	resourceId: z.string(),
+	paths: z.array(z.string()),
+})
 
 export function createResourceRoutes(): Hono<AppEnv> {
 	const app = new Hono<AppEnv>()
 
 	app.post('/:sessionId/inject-resource', async (c: AppContext) => {
-		const { sessionRuntime, logger } = getServices(c)
-		const sessionId = SessionId(c.req.param('sessionId')!)
-
-		// 1. Verify session exists
-		const sessionResult = await sessionRuntime.getSession(sessionId)
-		if (!sessionResult.ok) {
-			return c.json(
-				{ error: { type: 'session_not_found', message: `Session not found: ${sessionId}` } },
-				404,
-			)
+		const { sessionRuntime, logger, config } = getServices(c)
+		const sessionIdResult = parseSessionId(c.req.param('sessionId')!)
+		if (!sessionIdResult.ok) return invalidSessionId(c, sessionIdResult.error)
+		const sessionId = sessionIdResult.value
+
+		const leaseResult = await sessionRuntime.acquireSessionLease(sessionId, 'http:inject-resource')
+		if (!leaseResult.ok) {
+			return sessionNotFound(c, sessionId)
 		}
-
-		// 2. Parse JSON body
-		let body: { url: string; filename: string; mimeType: string; metadata?: { slug?: string; name?: string } }
 		try {
-			body = await c.req.json()
-		} catch {
-			return c.json(
-				{ error: { type: 'parse_error', message: 'Failed to parse JSON body' } },
-				400,
-			)
+			// 2. Parse JSON body
+			let rawBody: unknown
+			try {
+				rawBody = await c.req.json()
+			} catch {
+				return parseError(c, 'Failed to parse JSON body')
+			}
+
+			const parsedBody = ResourceRequestSchema.safeParse(rawBody)
+			if (!parsedBody.success) {
+				return c.json(
+					{ error: { type: 'validation_error', message: parsedBody.error.message } },
+					400,
+				)
+			}
+			const body = parsedBody.data
+
+			// 3. Fetch URL — guarded, redirects included (twin of upload-from-url)
+			const maxSize = 50 * 1024 * 1024 // 50MB
+			const fetched = await safeFetch(body.url, { timeoutMs: 120_000, allowedHosts: config.remoteFetchAllowedHosts })
+			if (!fetched.ok) {
+				return c.json(
+					{ error: { type: fetched.error.type, message: fetched.error.message } },
+					400,
+				)
+			}
+			const response = fetched.value
+
+			if (!response.ok) {
+				return c.json(
+					{ error: { type: 'fetch_error', message: `URL returned ${response.status}` } },
+					400,
+				)
+			}
+
+			// 4. Read response with size limit, capped on real bytes rather than the declared length
+			const contentLength = response.headers.get('Content-Length')
+			if (contentLength && Number.parseInt(contentLength, 10) > maxSize) {
+				return c.json(
+					{ error: { type: 'validation_error', message: 'File too large (max 50MB)' } },
+					400,
+				)
+			}
+
+			const fileBuffer = await readBodyWithLimit(response, maxSize)
+			if (!fileBuffer) {
+				return c.json(
+					{ error: { type: 'validation_error', message: 'File too large (max 50MB)' } },
+					400,
+				)
+			}
+
+			// 5. Call resources plugin
+			const result = await sessionRuntime.callPluginMethod(sessionId, 'resources.inject', {
+				sessionId: String(sessionId),
+				filename: body.filename,
+				mimeType: body.mimeType,
+				size: fileBuffer.length,
+				fileBuffer,
+				metadata: body.metadata,
+			})
+
+			if (!result.ok) {
+				logger.error('Resource injection failed', undefined, { sessionId: String(sessionId), error: result.error })
+				return c.json(
+					{ error: { type: result.error.type, message: 'Resource injection failed' } },
+					400,
+				)
+			}
+
+			const injectResult = ResourceInjectResultSchema.safeParse(result.value)
+			if (!injectResult.success) {
+				logger.error('Resource injection returned an invalid result', undefined, { sessionId: String(sessionId) })
+				return c.json(
+					{ error: { type: 'internal_error', message: 'Resource injection returned an invalid result' } },
+					500,
+				)
+			}
+
+			return c.json({
+				ok: true,
+				resourceId: injectResult.data.resourceId,
+				paths: injectResult.data.paths,
+			}, 201)
+		} finally {
+			leaseResult.value.release()
 		}
-
-		if (!body.url || !body.filename || !body.mimeType) {
-			return c.json(
-				{ error: { type: 'validation_error', message: 'Missing required fields: url, filename, mimeType' } },
-				400,
-			)
-		}
-
-		// 3. Fetch URL
-		const maxSize = 50 * 1024 * 1024 // 50MB
-		let response: Response
-		try {
-			response = await fetch(body.url, { signal: AbortSignal.timeout(120_000) })
-		} catch (err) {
-			return c.json(
-				{ error: { type: 'fetch_error', message: `Failed to fetch URL: ${err instanceof Error ? err.message : String(err)}` } },
-				400,
-			)
-		}
-
-		if (!response.ok) {
-			return c.json(
-				{ error: { type: 'fetch_error', message: `URL returned ${response.status}` } },
-				400,
-			)
-		}
-
-		// 4. Read response with size limit
-		const contentLength = response.headers.get('Content-Length')
-		if (contentLength && Number.parseInt(contentLength, 10) > maxSize) {
-			return c.json(
-				{ error: { type: 'validation_error', message: 'File too large (max 50MB)' } },
-				400,
-			)
-		}
-
-		const arrayBuffer = await response.arrayBuffer()
-		if (arrayBuffer.byteLength > maxSize) {
-			return c.json(
-				{ error: { type: 'validation_error', message: 'File too large (max 50MB)' } },
-				400,
-			)
-		}
-
-		const fileBuffer = Buffer.from(arrayBuffer)
-
-		// 5. Call resources plugin
-		const result = await sessionRuntime.callPluginMethod(sessionId, 'resources.inject', {
-			sessionId: String(sessionId),
-			filename: body.filename,
-			mimeType: body.mimeType,
-			size: fileBuffer.length,
-			fileBuffer,
-			metadata: body.metadata,
-		})
-
-		if (!result.ok) {
-			logger.error('Resource injection failed', undefined, { sessionId: String(sessionId), error: result.error })
-			return c.json(
-				{ error: { type: result.error.type, message: 'Resource injection failed' } },
-				400,
-			)
-		}
-
-		const injectResult = result.value as { resourceId: string; paths: string[] }
-
-		return c.json({
-			ok: true,
-			resourceId: injectResult.resourceId,
-			paths: injectResult.paths,
-		}, 201)
 	})
 
 	return app

package/src/transport/http/routes/rpc.ts

@@ -8,6 +8,11 @@
  * - Single: { method, input } → { ok: true, value } | { ok: false, error }
  * - Batch:  { batch: [{ method, input }, ...] } → { results: [{ ok: true, value } | { ok: false, error }, ...] }
  *
+ * A batch is all-settled: every item runs and gets its own envelope, so `results`
+ * always has the length of `batch`. A shorter array would leave the caller unable
+ * to tell a completed batch from a truncated one — and because running every item
+ * makes the batch length the work one request buys, the length is capped.
+ *
  * Routing order:
  * 1. Manager methods (session creation, listing, etc.)
  * 2. Session plugin methods (require sessionId in input)
@@ -19,10 +24,10 @@ import type { ContentfulStatusCode } from 'hono/utils/http-status'
 import { AgentId } from '~/core/agents/schema.js'
 import type { DomainError } from '~/core/errors.js'
 import { type CallerContext, DEFAULT_CALLER } from '~/core/plugins/plugin-builder.js'
-import { SessionId } from '~/core/sessions/schema.js'
+import { parseSessionId } from '~/core/sessions/schema.js'
 import type { SessionManager } from '~/core/sessions/session-manager.js'
-import { getServices } from '../app.js'
-import type { AppEnv } from '../app.js'
+import { getServices } from '../context.js'
+import type { AppEnv } from '../context.js'
 
 type MethodResult =
 	| { ok: true; value: unknown }
@@ -54,28 +59,37 @@ async function dispatchMethod(
 
 	// 2. Try session plugin methods (require sessionId in input)
 	if (typeof input === 'object' && input !== null && 'sessionId' in input && typeof input.sessionId === 'string') {
-		const sessionId = SessionId(input.sessionId)
+		// Checked before the lease: acquiring one loads the session, which joins the id into a path.
+		const sessionIdResult = parseSessionId(input.sessionId)
+		if (!sessionIdResult.ok) {
+			return { httpStatus: 400, body: formatError(sessionIdResult.error) }
+		}
+		const sessionId = sessionIdResult.value
 		const agentId = 'agentId' in input && typeof input.agentId === 'string' ? AgentId(input.agentId) : undefined
 
-		// Extract caller context injected by worker, strip from input
+		// Stripped from the input before dispatch. Unvalidated: anything holding the bearer
+		// token can set it, so it is a hint about the caller, not proof of one.
 		const caller: CallerContext = '_caller' in input && typeof input._caller === 'object' && input._caller !== null
 			? input._caller as CallerContext
 			: DEFAULT_CALLER
 		const { _caller: _, ...cleanInput } = input as Record<string, unknown>
 
-		const sessionResult = await sessionRuntime.getSession(sessionId)
+		const sessionResult = await sessionRuntime.acquireSessionLease(sessionId, `http:rpc:${method}`)
 		if (sessionResult.ok) {
-			const session = sessionResult.value
-			const pluginMethods = session.getPluginMethods()
+			try {
+				const pluginMethods = sessionResult.value.session.getPluginMethods()
 
-			if (pluginMethods.has(method)) {
-				const result = await sessionRuntime.callPluginMethod(sessionId, method, cleanInput, agentId, caller)
+				if (pluginMethods.has(method)) {
+					const result = await sessionRuntime.callPluginMethod(sessionId, method, cleanInput, agentId, caller)
 
-				if (!result.ok) {
-					return { httpStatus: 200, body: formatError(result.error) }
-				}
+					if (!result.ok) {
+						return { httpStatus: 200, body: formatError(result.error) }
+					}
 
-				return { httpStatus: 200, body: { ok: true, value: result.value } }
+					return { httpStatus: 200, body: { ok: true, value: result.value } }
+				}
+			} finally {
+				sessionResult.value.release()
 			}
 		} else if (sessionResult.error.type === 'session_not_found') {
 			return { httpStatus: 200, body: formatError(sessionResult.error) }
@@ -86,8 +100,22 @@ async function dispatchMethod(
 	return { httpStatus: 400, body: { ok: false, error: { type: 'method_not_found', message: `Unknown method: ${method}` } } }
 }
 
+/** Every item runs, so one request buys this much dispatch and no more. */
+const MAX_BATCH_ITEMS = 100
+
 interface BatchRequest {
-	batch: Array<{ method: string; input?: unknown }>
+	batch: unknown[]
+}
+
+interface BatchCall {
+	method: string
+	input?: unknown
+}
+
+/** Items stay `unknown` until here — `{"batch":[null]}` used to reach `call.method` and 500. */
+function isBatchCall(value: unknown): value is BatchCall {
+	return typeof value === 'object' && value !== null && 'method' in value && typeof value.method === 'string'
+		&& value.method !== ''
 }
 
 function isBatchRequest(body: unknown): body is BatchRequest {
@@ -112,26 +140,35 @@ export function createRpcRoutes(): Hono<AppEnv> {
 			)
 		}
 
-		const { sessionRuntime } = getServices(c)
+		const { sessionRuntime, logger } = getServices(c)
 
-		// Batch request
+		// Batch request. The status describes the envelope, never an item: the body is
+		// `{results}` with no top-level `error`, so a non-2xx here reads as a transport
+		// failure and hides the per-item error the client would otherwise surface.
 		if (isBatchRequest(body)) {
+			if (body.batch.length > MAX_BATCH_ITEMS) {
+				return c.json(
+					{ ok: false, error: { type: 'batch_too_large', message: `Batch holds more than ${MAX_BATCH_ITEMS} calls` } },
+					400,
+				)
+			}
+
 			const results: MethodResult[] = []
 
 			for (const call of body.batch) {
-				if (!call.method || typeof call.method !== 'string') {
+				if (!isBatchCall(call)) {
 					results.push({ ok: false, error: { type: 'missing_method', message: "Missing 'method' field in batch call" } })
-					break
+					continue
 				}
 
-				const { body: resultBody } = await dispatchMethod(sessionRuntime, call.method, call.input)
-
-				if (!resultBody.ok) {
-					results.push(resultBody)
-					break
+				try {
+					results.push((await dispatchMethod(sessionRuntime, call.method, call.input)).body)
+				} catch (error) {
+					logger.error('Batch RPC call failed', error instanceof Error ? error : new Error(String(error)), {
+						method: call.method,
+					})
+					results.push({ ok: false, error: { type: 'internal_error', message: 'Internal server error' } })
 				}
-
-				results.push(resultBody)
 			}
 
 			return c.json({ results })