@schlessera/brain-ui-server 0.30.1 → 0.32.0

package/src/config/env.ts

@@ -19,7 +19,10 @@ import type { BillingMode } from "@schlessera/brain-ui-sdk/protocol";
 
 import { SEVERITIES, type Severity } from "../observability/types.js";
 import { envFlag } from "./env-core.js";
-import { WEB_SEARCH_PROVIDERS } from "@schlessera/brain-ui-sdk/server";
+import {
+  filterSubprocessEnv,
+  WEB_SEARCH_PROVIDERS,
+} from "@schlessera/brain-ui-sdk/server";
 
 // --- descriptor -------------------------------------------------------------
 
@@ -126,6 +129,12 @@ export const ENV_VARS: readonly EnvVarDescriptor[] = [
     default: "the shipped pattern set",
     required: false,
   },
+  {
+    name: "BRAIN_UI_WS_MAX_CONNECTIONS",
+    description: "Maximum number of WebSocket connections accepted by one server process.",
+    default: "32",
+    required: false,
+  },
   {
     name: "BRAIN_UI_WS_RATE",
     description:
@@ -471,6 +480,8 @@ export interface ServerConfig {
   logLevel: Severity;
   /** Inbound WebSocket frame metering, per connection. */
   wsRate: { ratePerSecond: number; burst: number };
+  /** Maximum WebSocket connections accepted by one server process. */
+  wsMaxConnections: number;
   auth: AuthConfig;
   webauthn: WebAuthnConfig;
   agent: AgentConfig;
@@ -633,6 +644,7 @@ export function resolveServerConfig(env: EnvRecord = process.env): ServerConfig
       ambientBilling: resolveAmbientBillingMode(env),
     },
     logLevel: parseSeverity(env.BRAIN_UI_LOG_LEVEL),
+    wsMaxConnections: positiveNumber(env.BRAIN_UI_WS_MAX_CONNECTIONS, 32),
     wsRate: {
       ratePerSecond: positiveNumber(env.BRAIN_UI_WS_RATE, 20),
       burst: positiveNumber(env.BRAIN_UI_WS_BURST, 60),
@@ -651,14 +663,13 @@ export function resolveServerConfig(env: EnvRecord = process.env): ServerConfig
 }
 
 /**
- * The parent environment for spawned subprocesses (brain CLI, whatsup), plus
- * overrides. Child processes legitimately inherit the whole environment
- * (PATH, credentials for the tools they run) — that is process plumbing, not
- * configuration, but it still reads `process.env`, so it lives behind this
- * chokepoint.
+ * The filtered parent environment for spawned subprocesses (brain CLI,
+ * whatsup), plus explicit overrides. The shared descriptor strips server-only
+ * material while retaining all known subprocess capabilities and unknown
+ * variables. This reads `process.env`, so it lives behind this chokepoint.
  */
 export function subprocessEnv(extra: Record<string, string> = {}): EnvRecord {
-  return { ...process.env, ...extra };
+  return { ...filterSubprocessEnv(process.env), ...extra };
 }
 
 /**

package/src/files/walker.ts

@@ -1,6 +1,5 @@
-import { readdir, readFile, stat, realpath } from "node:fs/promises";
-import { join, resolve, sep, posix, dirname } from "node:path";
-import { existsSync } from "node:fs";
+import { lstat, readdir, readFile, stat, realpath } from "node:fs/promises";
+import { join, relative, resolve, sep, posix, dirname } from "node:path";
 import ignore, { type Ignore } from "ignore";
 import type { FileEntry, FileContentKind } from "@schlessera/brain-ui-sdk/protocol";
 import { FILE_SIZE_CAP_BYTES } from "@schlessera/brain-ui-sdk/protocol";
@@ -25,6 +24,15 @@ const HARD_EXCLUDE_FILE_NAMES = new Set(
   ].map((n) => n.toLowerCase())
 );
 
+const UNRESOLVABLE_PATH_CODES = new Set([
+  "ENOENT",
+  "ENOTDIR",
+  "ENAMETOOLONG",
+  "ELOOP",
+  "EACCES",
+  "EPERM",
+]);
+
 export class PathEscapeError extends Error {
   constructor(rel: string) {
     super(`path_escape: ${rel}`);
@@ -52,8 +60,14 @@ export class TooLargeError extends Error {
  */
 export async function safeResolve(rel: string, root: string): Promise<string> {
   if (typeof rel !== "string") throw new PathEscapeError(String(rel));
-  // Reject absolute paths and null bytes
-  if (rel.startsWith("/") || rel.startsWith("\\") || rel.includes("\0")) {
+  const requestSegments = rel.split("/");
+  // Reject absolute paths, null bytes, and Windows path syntax before resolving.
+  if (
+    rel.startsWith("/") ||
+    rel.startsWith("\\") ||
+    rel.includes("\0") ||
+    requestSegments.some((segment) => segment.includes(":") || segment.includes("\\"))
+  ) {
     throw new PathEscapeError(rel);
   }
   // Normalize separators; reject ".." segments anywhere
@@ -61,14 +75,49 @@ export async function safeResolve(rel: string, root: string): Promise<string> {
   for (const seg of normalized.split("/")) {
     if (seg === "..") throw new PathEscapeError(rel);
   }
-  const absRoot = resolve(root);
+  const lexicalRoot = resolve(root);
+  let absRoot: string;
+  try {
+    absRoot = await realpath(lexicalRoot);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+    absRoot = lexicalRoot;
+  }
   const abs = resolve(absRoot, normalized);
   if (abs !== absRoot && !abs.startsWith(absRoot + sep)) {
     throw new PathEscapeError(rel);
   }
-  // Check for symlink escape via realpath when the path exists
-  if (existsSync(abs)) {
-    const real = await realpath(abs);
+  // Canonicalize every existing component. Stopping at the first genuinely
+  // missing component permits callers to create a new path, while lstat
+  // distinguishes that case from a dangling symlink, which must fail closed.
+  let candidate = absRoot;
+  const candidates = [candidate];
+  for (const segment of relative(absRoot, abs).split(sep)) {
+    if (!segment || segment === ".") continue;
+    candidate = join(candidate, segment);
+    candidates.push(candidate);
+  }
+
+  for (const existing of candidates) {
+    try {
+      await lstat(existing);
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code && UNRESOLVABLE_PATH_CODES.has(code)) break;
+      throw err;
+    }
+
+    let real: string;
+    try {
+      real = await realpath(existing);
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code === "ENOENT" || code === "ENOTDIR") {
+        throw new PathEscapeError(rel);
+      }
+      if (code && UNRESOLVABLE_PATH_CODES.has(code)) break;
+      throw err;
+    }
     if (real !== absRoot && !real.startsWith(absRoot + sep)) {
       throw new PathEscapeError(rel);
     }
@@ -373,7 +422,14 @@ export async function buildWikilinkMap(root: string): Promise<Record<string, str
       }
 
       if (childStat.isDirectory()) {
-        await walk(relChild);
+        try {
+          await walk(relChild);
+        } catch (err) {
+          // Directory names come from readdir rather than an external request.
+          // Keep request-facing validation strict, but skip a discovered path
+          // that safeResolve rejects instead of discarding the whole map.
+          if (!(err instanceof PathEscapeError)) throw err;
+        }
         continue;
       }
       const lower = d.name.toLowerCase();

package/src/index.ts

@@ -40,6 +40,9 @@ export {
   type ModelDiscoveryState,
 } from "./agent/backend.js";
 export {
+  authGuard,
+  bumpSessionsEpoch,
+  isWsAuthorized,
   resolveAuthMode,
   type AuthMode,
   type AuthRuntime,
@@ -107,6 +110,11 @@ export {
 // intake route also sweeps opportunistically on every share.
 export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
 
+// Skill archive transport sizing for deployment shells. The route keeps the
+// application-level check; consumers use this value only to avoid setting a
+// smaller process-level request ceiling.
+export { MAX_ARCHIVE_BYTES } from "./skills/install.js";
+
 // Observability: the producing side is the OpenTelemetry API, the consuming
 // side is ours. Swap the consumer to change where a deployment reports; a test
 // swaps in the recording one and asserts on what the server actually said.