@saadnvd1/agent-os 0.3.560 → 0.3.561

package/lib/share/redact.ts

@@ -0,0 +1,190 @@
+/**
+ * What a shared snapshot must not carry: credentials, the machine's paths,
+ * addresses and names, and email addresses. Pure: everything about this
+ * machine comes in through the context (lib/share/context), so the rules can
+ * be tested with invented values.
+ *
+ * Public hostnames (github.com) are left alone on purpose: masking every
+ * domain would destroy ordinary content. Only names that identify the
+ * reader's own machines and network are masked.
+ */
+
+import {
+  PRIVATE_KEY_BLOCK,
+  SECRET_ASSIGNMENT,
+  SECRET_PARAM,
+  SECRET_TOKENS,
+  URL_USERINFO,
+  BASE64_RUN,
+  looksRandom,
+} from "@/lib/orchestrator/untrusted";
+import { HOME } from "@/lib/session-audit/normalize";
+
+export type Kind = "secret" | "path" | "ip" | "host" | "email";
+export type Hits = Record<Kind, number>;
+export const noHits = (): Hits => ({
+  secret: 0,
+  path: 0,
+  ip: 0,
+  host: 0,
+  email: 0,
+});
+export const addHits = (a: Hits, b: Hits): Hits => ({
+  secret: a.secret + b.secret,
+  path: a.path + b.path,
+  ip: a.ip + b.ip,
+  host: a.host + b.host,
+  email: a.email + b.email,
+});
+
+export interface ShareContext {
+  /** The user's home directory. */
+  home: string;
+  /** The OS account name. */
+  user: string;
+  /** Values of secret-looking environment variables, masked wherever they appear. */
+  secrets: string[];
+  /** This machine's names, and the hosts its ssh config knows. */
+  hosts: string[];
+}
+
+export const NO_CONTEXT: ShareContext = {
+  home: "",
+  user: "",
+  secrets: [],
+  hosts: [],
+};
+
+const SECRET = "[secret]";
+const BEARER = /(\bbearer\s+)(?!\[secret\])[A-Za-z0-9._~+/=-]{8,}/gi;
+const INLINE_ASSIGNMENT =
+  /(\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CREDENTIALS?|AUTH)[A-Z0-9_]*=)(?!\[secret\])[^\s'"]+/g;
+const LONG_HEX = /\b[a-fA-F0-9]{40,}\b/g;
+
+const IPV4 =
+  /(?<![\w.])(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)(?![\w.]*\w)/g;
+const KEEP_IPV4 = new Set(["127.0.0.1", "0.0.0.0"]);
+const G = "[0-9a-f]{1,4}";
+// Eight groups, or a "::" compression; a lone "12:30:45" is a time, not this.
+const IPV6 = new RegExp(
+  `(?<![\\w:])(?:(?:${G}:){7}${G}|(?:${G}:){1,7}:(?:${G}(?::${G}){0,6})?|::(?:${G}(?::${G}){0,6})?)(?![\\w:])`,
+  "gi"
+);
+const KEEP_IPV6 = new Set(["::1", "::"]);
+
+const LOCAL_HOST =
+  /\b(?:[a-z0-9][a-z0-9-]*\.)+(?:ts\.net|local|lan|internal|home\.arpa)\b/gi;
+const CONNECT_HOST = /\bm-[0-9a-f]{16}\.runagentos\.com\b/gi;
+const EMAIL = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+\b/g;
+
+const escape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/** A replacement that counts what it replaced. */
+function sub(
+  text: string,
+  re: RegExp,
+  to: string | ((m: string, ...g: string[]) => string),
+  hits: Hits,
+  kind: Kind,
+  keep?: (m: string) => boolean
+): string {
+  return text.replace(re, (m: string, ...g: string[]) => {
+    if (keep?.(m)) return m;
+    hits[kind]++;
+    return typeof to === "function" ? to(m, ...g) : to;
+  });
+}
+
+export function redactForShare(
+  input: string,
+  ctx: ShareContext = NO_CONTEXT
+): { text: string; hits: Hits } {
+  const hits = noHits();
+  let t = input;
+
+  // 1. Credentials by shape.
+  t = sub(t, PRIVATE_KEY_BLOCK, SECRET, hits, "secret");
+  t = sub(
+    t,
+    SECRET_ASSIGNMENT,
+    (_m, k) => `${k}${SECRET}`,
+    hits,
+    "secret",
+    (m) => m.endsWith(SECRET)
+  );
+  t = sub(t, INLINE_ASSIGNMENT, (_m, k) => `${k}${SECRET}`, hits, "secret");
+  t = sub(t, BEARER, (_m, k) => `${k}${SECRET}`, hits, "secret");
+  t = sub(
+    t,
+    URL_USERINFO,
+    (_m, s) => `${s}${SECRET}@`,
+    hits,
+    "secret",
+    (m) => m.endsWith(`${SECRET}@`)
+  );
+  t = sub(
+    t,
+    SECRET_PARAM,
+    (_m, k) => `${k}${SECRET}`,
+    hits,
+    "secret",
+    (m) => m.endsWith(SECRET)
+  );
+  for (const re of SECRET_TOKENS) t = sub(t, re, SECRET, hits, "secret");
+  t = sub(t, LONG_HEX, SECRET, hits, "secret");
+  t = sub(t, BASE64_RUN, SECRET, hits, "secret", (m) => !looksRandom(m));
+
+  // 2. This machine's own secrets, wherever they appear.
+  for (const value of ctx.secrets) {
+    if (value.length < 8 || !t.includes(value)) continue;
+    const parts = t.split(value);
+    hits.secret += parts.length - 1;
+    t = parts.join(SECRET);
+  }
+
+  // 3. Home paths, and the account name before an @.
+  if (ctx.home.length > 1)
+    t = sub(
+      t,
+      new RegExp(escape(ctx.home) + "(?![\\w.-])", "g"),
+      "~",
+      hits,
+      "path"
+    );
+  t = sub(t, new RegExp(HOME.source, "g"), "~", hits, "path");
+  if (ctx.user.length > 2)
+    t = sub(
+      t,
+      new RegExp(`\\b${escape(ctx.user)}(?=@)`, "g"),
+      "user",
+      hits,
+      "path"
+    );
+
+  // 4. Addresses.
+  t = sub(t, IPV4, "[ip]", hits, "ip", (m) => KEEP_IPV4.has(m));
+  t = sub(t, IPV6, "[ip]", hits, "ip", (m) => KEEP_IPV6.has(m));
+
+  // 5. This machine's names, and private-network suffixes.
+  const names = [...new Set(ctx.hosts.filter((h) => h.length > 2))].sort(
+    (a, b) => b.length - a.length
+  );
+  if (names.length)
+    t = sub(
+      t,
+      new RegExp(
+        `(?<![\\w.-])(?:${names.map(escape).join("|")})(?![\\w-])`,
+        "gi"
+      ),
+      "[host]",
+      hits,
+      "host"
+    );
+  t = sub(t, CONNECT_HOST, "[host]", hits, "host");
+  t = sub(t, LOCAL_HOST, "[host]", hits, "host");
+
+  // 6. Email addresses.
+  t = sub(t, EMAIL, "[email]", hits, "email");
+
+  return { text: t, hits };
+}

package/lib/share/render.tsx

@@ -0,0 +1,161 @@
+/**
+ * A snapshot as one self-contained HTML page: inline CSS, no script, no
+ * request on load. Output depends only on (snapshot, sharedAt), so what the
+ * preview showed is byte-for-byte what gets uploaded.
+ *
+ * Markdown goes through react-markdown with raw HTML off (the default: do
+ * not add rehype-raw), so nothing a message says becomes markup.
+ */
+
+import { isValidElement, type ReactNode } from "react";
+import { renderToStaticMarkup } from "./static-markup";
+import ReactMarkdown, { type Components } from "react-markdown";
+import remarkGfm from "remark-gfm";
+import { Prism as Highlighter } from "react-syntax-highlighter";
+import type { Snapshot, SnapshotItem } from "./snapshot";
+import { STYLES } from "./styles";
+
+export const MAX_SHARE_BYTES = 5 * 1024 * 1024;
+
+const escape = (s: string) =>
+  s
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+
+const METAS = `<meta name="robots" content="noindex,nofollow"><meta name="referrer" content="no-referrer"><meta name="color-scheme" content="light dark">`;
+
+function textOf(node: ReactNode): string {
+  if (typeof node === "string" || typeof node === "number") return String(node);
+  if (Array.isArray(node)) return node.map(textOf).join("");
+  if (isValidElement<{ children?: ReactNode }>(node))
+    return textOf(node.props.children);
+  return "";
+}
+
+const components: Components = {
+  pre: ({ children }) => <>{children}</>,
+  code({ className, children }) {
+    const language = className?.match(/language-([\w+-]+)/)?.[1];
+    const text = textOf(children);
+    if (!language && !text.includes("\n")) return <code>{children}</code>;
+    return (
+      <Highlighter
+        language={language ?? "text"}
+        useInlineStyles={false}
+        PreTag="pre"
+        CodeTag="code"
+      >
+        {text.replace(/\n$/, "")}
+      </Highlighter>
+    );
+  },
+  a: ({ href, children }) => (
+    <a href={href} target="_blank" rel="noopener noreferrer">
+      {children}
+    </a>
+  ),
+  // A remote image would phone home when the page is opened.
+  img: ({ alt }) => <span>[image{alt ? `: ${alt}` : ""}]</span>,
+};
+
+function Markdown({ text }: { text: string }) {
+  return (
+    <ReactMarkdown remarkPlugins={[remarkGfm]} components={components}>
+      {text}
+    </ReactMarkdown>
+  );
+}
+
+function Item({ item }: { item: SnapshotItem }) {
+  switch (item.type) {
+    case "user":
+      return (
+        <div className="msg user">
+          <div className="bubble">{item.text}</div>
+        </div>
+      );
+    case "assistant":
+      return (
+        <div className="msg assistant">
+          <Markdown text={item.text} />
+        </div>
+      );
+    case "plan":
+      return (
+        <div className="msg plan">
+          <div className="kicker">Plan</div>
+          <Markdown text={item.text} />
+        </div>
+      );
+    case "error":
+      return <div className="msg error">{item.text}</div>;
+    case "divider":
+      return <div className="msg divider">{item.text}</div>;
+    case "artifact":
+      return (
+        <div className="msg artifact">
+          <div className="kicker">{item.label}</div>
+          <iframe
+            sandbox="allow-scripts"
+            referrerPolicy="no-referrer"
+            loading="lazy"
+            title={item.label}
+            style={{ height: item.height ?? 480 }}
+            srcDoc={withMetas(item.html ?? "")}
+          />
+        </div>
+      );
+    case "detail":
+      return (
+        <details className="msg tool">
+          <summary>{item.label}</summary>
+          <pre>{item.text}</pre>
+        </details>
+      );
+  }
+}
+
+export function renderChatSnapshot(
+  snapshot: Snapshot,
+  opts: { sharedAt: string }
+): string {
+  const body = renderToStaticMarkup(
+    <>
+      {snapshot.items.map((item) => (
+        <Item key={item.id} item={item} />
+      ))}
+    </>
+  );
+  const date = opts.sharedAt.slice(0, 10);
+  const note = snapshot.toolsHidden
+    ? " · Read-only snapshot; tool calls hidden"
+    : " · Read-only snapshot";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">${METAS}<title>${escape(snapshot.title)}</title><style>${STYLES}</style></head><body><div class="wrap"><header><h1 class="title">${escape(snapshot.title)}</h1><p class="meta">Shared from AgentOS · ${escape(date)}${note}</p></header><main>${body}</main><footer>Made with <a href="https://github.com/saadnvd1/agent-os" target="_blank" rel="noopener noreferrer">AgentOS</a></footer></div></body></html>`;
+}
+
+/** An artifact's page with the privacy metas added to its head. */
+export function withMetas(html: string): string {
+  if (/<head[\s>]/i.test(html))
+    return html.replace(/<head(\s[^>]*)?>/i, (m) => m + METAS);
+  if (/<html[\s>]/i.test(html))
+    return html.replace(
+      /<html(\s[^>]*)?>/i,
+      (m) => `${m}<head>${METAS}</head>`
+    );
+  return `<!doctype html><html><head><meta charset="utf-8">${METAS}</head><body>${html}</body></html>`;
+}
+
+export function renderArtifactSnapshot(html: string, title: string): string {
+  const page = withMetas(html);
+  return /<title[\s>]/i.test(page)
+    ? page
+    : page.replace(
+        /<head(\s[^>]*)?>/i,
+        (m) => `${m}<title>${escape(title)}</title>`
+      );
+}
+
+export const tooBig = (html: string) =>
+  Buffer.byteLength(html, "utf8") > MAX_SHARE_BYTES;

package/lib/share/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { demoMode } from "@/lib/security/demo";
+import { readCapped } from "@/lib/security/read-capped";
+import { BadShare } from "./service";
+import { ShareError } from "./connect";
+
+const MAX_BODY = 64 * 1024;
+
+export const fail = (error: string, status: number) =>
+  NextResponse.json({ error }, { status });
+
+export const refuseDemo = () =>
+  demoMode() ? fail("Not in the demo.", 403) : null;
+
+/** The JSON body, capped, or a response saying why not. */
+export async function readJson(
+  request: Request
+): Promise<{ body: unknown } | { refused: NextResponse }> {
+  const text = await readCapped(request, MAX_BODY);
+  if (text === null) return { refused: fail("Request too large.", 413) };
+  try {
+    return { body: text ? JSON.parse(text) : {} };
+  } catch {
+    return { refused: fail("Invalid JSON.", 400) };
+  }
+}
+
+export function toResponse(err: unknown): NextResponse {
+  if (err instanceof BadShare || err instanceof ShareError)
+    return fail(err.message, err.status);
+  console.error(`share: ${(err as Error)?.message ?? err}`);
+  return fail("Couldn't share that.", 500);
+}

package/lib/share/service.ts

@@ -0,0 +1,159 @@
+/**
+ * The share flow, shared by the preview and create routes: the same inputs
+ * always render the same page, so create can prove it uploads exactly what
+ * the preview showed (by hash) without trusting any markup from the client.
+ */
+
+import { createHash } from "crypto";
+import type { ShareExpiry } from "@/lib/connect/control-api";
+import { getSession } from "@/lib/chat/registry";
+import { getArtifact } from "@/lib/artifacts/store";
+import { shareContext } from "./context";
+import type { Hits } from "./redact";
+import {
+  MAX_SHARE_BYTES,
+  renderArtifactSnapshot,
+  renderChatSnapshot,
+} from "./render";
+import { buildArtifactSnapshot, buildChatSnapshot } from "./snapshot";
+
+export interface ShareRequest {
+  kind: "chat" | "artifact";
+  sessionId?: string;
+  artifactId?: string;
+  includeTools: boolean;
+  /** Messages the reader left out in the preview. */
+  dropIds?: string[];
+  sharedAt: string;
+}
+
+export interface ItemRow {
+  id: string;
+  type: string;
+  tools: boolean;
+  excerpt: string;
+}
+
+export interface Page {
+  html: string;
+  title: string;
+  bytes: number;
+  hash: string;
+  hits: Hits;
+  /** Every item that could be shared, for the dialog's list. */
+  items: ItemRow[];
+  tooBig: boolean;
+}
+
+export class BadShare extends Error {
+  constructor(
+    message: string,
+    readonly status: number
+  ) {
+    super(message);
+  }
+}
+
+export const EXPIRIES: ShareExpiry[] = ["1d", "7d", "30d", "never"];
+const ID = /^[\w-]{1,80}$/;
+
+/** The request body as a ShareRequest, or a BadShare saying what's wrong. */
+export function parseRequest(raw: unknown, sharedAt?: unknown): ShareRequest {
+  const b = (raw ?? {}) as Record<string, unknown>;
+  const kind = b.kind;
+  if (kind !== "chat" && kind !== "artifact")
+    throw new BadShare("kind must be chat or artifact", 400);
+  const sessionId = typeof b.sessionId === "string" ? b.sessionId : undefined;
+  const artifactId =
+    typeof b.artifactId === "string" ? b.artifactId : undefined;
+  if (
+    kind === "chat"
+      ? !sessionId || !ID.test(sessionId)
+      : !artifactId || !ID.test(artifactId)
+  )
+    throw new BadShare(
+      `${kind === "chat" ? "sessionId" : "artifactId"} is required`,
+      400
+    );
+  let dropIds: string[] | undefined;
+  if (b.dropIds !== undefined) {
+    if (
+      !Array.isArray(b.dropIds) ||
+      b.dropIds.some((i) => typeof i !== "string")
+    )
+      throw new BadShare("dropIds must be a list of ids", 400);
+    dropIds = b.dropIds as string[];
+  }
+  const at = typeof sharedAt === "string" ? sharedAt : new Date().toISOString();
+  if (Number.isNaN(Date.parse(at)))
+    throw new BadShare("sharedAt is not a date", 400);
+  return {
+    kind,
+    sessionId,
+    artifactId,
+    includeTools: b.includeTools === true,
+    dropIds,
+    sharedAt: at,
+  };
+}
+
+const sha256 = (s: string) => createHash("sha256").update(s).digest("hex");
+
+export async function buildPage(req: ShareRequest): Promise<Page> {
+  const ctx = shareContext();
+  let html: string;
+  let title: string;
+  let hits: Hits;
+  let items: ItemRow[] = [];
+
+  if (req.kind === "chat") {
+    let session;
+    try {
+      session = getSession(req.sessionId!);
+    } catch {
+      throw new BadShare("No such chat", 404);
+    }
+    if (session.view !== "chat")
+      throw new BadShare("Only chats can be shared", 400);
+    const all = await buildChatSnapshot(req.sessionId!, ctx, {
+      includeTools: req.includeTools,
+    });
+    items = all.items.map(({ id, type, tools, excerpt }) => ({
+      id,
+      type,
+      tools,
+      excerpt,
+    }));
+    const snap = req.dropIds?.length
+      ? await buildChatSnapshot(req.sessionId!, ctx, {
+          includeTools: req.includeTools,
+          dropIds: req.dropIds,
+        })
+      : all;
+    if (!snap.items.length)
+      throw new BadShare("Nothing to share: every message is left out", 400);
+    html = renderChatSnapshot(snap, { sharedAt: req.sharedAt });
+    title = snap.title;
+    hits = snap.hits;
+  } else {
+    if (!getArtifact(req.artifactId!)) throw new BadShare("No such page", 404);
+    const snap = await buildArtifactSnapshot(req.artifactId!, ctx);
+    if (!snap) throw new BadShare("That page is gone", 404);
+    html = renderArtifactSnapshot(snap.html, snap.title);
+    title = snap.title;
+    hits = snap.hits;
+  }
+  const bytes = Buffer.byteLength(html, "utf8");
+  return {
+    html,
+    title,
+    bytes,
+    hash: sha256(html),
+    hits,
+    items,
+    tooBig: bytes > MAX_SHARE_BYTES,
+  };
+}
+
+export const TOO_BIG =
+  "Too big to share; drop some messages or turn tool calls off.";