@shiyuphan/follow-me 0.9.1 → 0.9.2

package/dist/src/cli.js

@@ -11,6 +11,7 @@ import { BranchRefusedError, blobsAt, branchHead, GitError, isOwnWork, pathsAt,
 import { fetchCarried, fetchComments, fetchReport, fetchWaitingOffers, findServer, followEvents, idleMs, listSessions, openBrowser, pollEvents, portFallbackMessage, postComment, postCoverage, postReply, probeHealth, readServerRecord, registerWith, sessionUrl, spawnDetached, startOrAttach, stateDir, stillHosted, stopServer, swapVersion, } from "./host.js";
 import { findSkillDir, InstallError, runInstall, runUninstall, syncSkills, } from "./install.js";
 import { naiveDraft } from "./naive.js";
+import { plainNumber, plainText } from "./plain.js";
 import { isCommentId, isConcernId, isFields, OFFERS_PER_COMMIT, OFFERS_PER_PLAN, serializePlanFile, validatePlan, } from "./plan.js";
 import { renderEvents, renderPrompt, renderReport, renderShownComment, renderShownConcern, renderShownDefinitions, renderShownUnit, reportItems, } from "./prompt.js";
 import { parseRefText, refsIn, repoPathOfTyped, resolveRefs } from "./refs.js";
@@ -1103,9 +1104,18 @@ function readCursor(session, summary) {
     const counts = log === logOf(summary) && typeof seq === "number" && Number.isInteger(seq) && seq >= 0;
     return { session: logOf(summary), seq: counts ? seq : 0, seen };
 }
+const ID_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789_";
+const LOG_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-@.:+";
+const CURSOR_ID = /^[a-z]_[a-z0-9]+$/;
+const CURSOR_LOG = /^[\w-]+@[\w.:+-]+$/;
+/** The cursor holds data the server sent, so only ids and a log name of the expected shape are written. */
 function writeCursor(session, cursor) {
     const { session: log, seq, seen } = cursor;
-    writeFileSync(cursorPath(session), `${JSON.stringify({ session: log, seq, seen: [...seen] })}\n`);
+    if (!CURSOR_LOG.test(log) || !Number.isInteger(seq))
+        throw new Error(`refusing to save the cursor for ${log}`);
+    const ids = [...seen].filter((id) => CURSOR_ID.test(id)).map((id) => plainText(id, ID_CHARS));
+    const saved = { session: plainText(log, LOG_CHARS), seq: plainNumber(seq), seen: ids };
+    writeFileSync(cursorPath(session), `${JSON.stringify(saved)}\n`);
 }
 /** The comment or reply id an event first carries, or null for events without one. */
 function saidId(event) {

package/dist/src/host.js

@@ -5,10 +5,12 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseCarried, parseComment, parseEvent, parseEventBatch, } from "./comments.js";
 import { carryComments } from "./evolve.js";
+import { plainNumber, plainText } from "./plain.js";
 import { isPlanVersion, serializePlanFile, validatePlan } from "./plan.js";
 import { HEALTH_APP, isSessionId, loadDraft, PortInUseError, RegistrationError, startServer, } from "./server.js";
 import { BranchMovedError, diffOfPlan, isAlive, openSessionAt, SessionFileError, SessionLockedError, sessionComments, } from "./session.js";
 const RECORD = "server.json";
+const PATH_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/._~-?=&";
 const DEFAULT_IDLE_MS = 30_000;
 const START_TIMEOUT_MS = 10_000;
 const STOP_TIMEOUT_MS = 5_000;
@@ -28,6 +30,13 @@ export function idleMs(env = process.env) {
 function isPort(value) {
     return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= 65535;
 }
+/** Every request this client makes goes to the loopback server, on a port and a path that are plain. */
+function loopbackUrl(port, path) {
+    if (!isPort(port) || !/^\/[\w./~-]*(\?[\w=&.-]*)?$/.test(path)) {
+        throw new RegistrationError("refusing a request to an unexpected address");
+    }
+    return `http://127.0.0.1:${plainNumber(port)}${plainText(path, PATH_CHARS)}`;
+}
 function isFields(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -52,7 +61,7 @@ export function readServerRecord(dir) {
 /** The pid of the follow-me server answering on this port, or null for anything else. */
 export async function probeHealth(port) {
     try {
-        const res = await fetch(`http://127.0.0.1:${port}/api/health`, {
+        const res = await fetch(loopbackUrl(port, "/api/health"), {
             signal: AbortSignal.timeout(1_000),
         });
         const body = await res.json();
@@ -252,7 +261,7 @@ export async function spawnDetached(dir, port) {
     throw new Error(`the review server did not start; see ${logPath}`);
 }
 async function call(port, method, path, body) {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+    const res = await fetch(loopbackUrl(port, path), {
         method,
         headers: { "content-type": "application/json" },
         ...(body === undefined ? {} : { body: JSON.stringify(body) }),
@@ -357,7 +366,7 @@ export async function pollEvents(port, summary, since, timeoutMs) {
  * the server closes the stream, which it does after the `ended` event.
  */
 export async function followEvents(port, summary, since, onEvent) {
-    const res = await fetch(`${sessionUrl(port, summary)}api/events/stream?since=${since}`);
+    const res = await fetch(loopbackUrl(port, `${summary.url}api/events/stream?since=${Number(since)}`));
     if (!res.ok || res.body === null) {
         throw new RegistrationError(`GET api/events/stream failed with ${res.status}`);
     }
@@ -403,7 +412,7 @@ export async function postCoverage(port, summary) {
 }
 /** The consolidated report of the hosted session as it stands. */
 export async function fetchReport(port, summary, format = "markdown") {
-    const res = await fetch(`${sessionUrl(port, summary)}api/report?format=${format}`);
+    const res = await fetch(loopbackUrl(port, `${summary.url}api/report?format=${format}`));
     if (!res.ok)
         throw new RegistrationError(`GET api/report failed with ${res.status}`);
     return res.text();
@@ -423,7 +432,7 @@ export function sessionUrl(port, summary) {
 /** Whether the server on this port still serves the session's state; a gone server serves none. */
 export async function stillHosted(port, summary) {
     try {
-        const res = await fetch(`${sessionUrl(port, summary)}api/state`, {
+        const res = await fetch(loopbackUrl(port, `${summary.url}api/state`), {
             signal: AbortSignal.timeout(2_000),
         });
         await res.body?.cancel();

package/dist/src/install.js

@@ -60,9 +60,19 @@ export function planSkillFiles(options, home, repoRoot) {
     }
     return [...byPath.values()];
 }
+function readIfPresent(path) {
+    try {
+        return readFileSync(path);
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
 function writeSkill(skillDir, file, dryRun) {
     const content = readFileSync(join(skillDir, file.source));
-    const current = existsSync(file.path) ? readFileSync(file.path) : null;
+    const current = readIfPresent(file.path);
     if (current?.equals(content))
         return `unchanged ${file.path}`;
     if (dryRun)

package/dist/src/plain.js

@@ -0,0 +1,20 @@
+const DIGITS = "0123456789";
+/**
+ * Rebuilds `text` one character at a time from `alphabet`, and throws on a character outside it. What comes
+ * back is made only of characters that were checked, so a port read from a file or an id sent by the server
+ * cannot carry anything else into a request address or a file.
+ */
+export function plainText(text, alphabet) {
+    let out = "";
+    for (const char of text) {
+        const at = alphabet.indexOf(char);
+        if (at < 0)
+            throw new Error(`unexpected character ${JSON.stringify(char)}`);
+        out += alphabet.charAt(at);
+    }
+    return out;
+}
+/** A whole number, rebuilt from its digits; throws on anything else. */
+export function plainNumber(value) {
+    return Number(plainText(String(value), DIGITS));
+}

package/dist/src/session.js

@@ -385,9 +385,14 @@ async function locate(repo, branch) {
         throw new Error("HEAD is detached; pass --branch <name>");
     const top = join(root, ".follow-me");
     mkdirSync(top, { recursive: true });
-    const ignore = join(top, ".gitignore");
-    if (!existsSync(ignore))
-        writeFileSync(ignore, "*\n");
+    try {
+        // "wx" creates the file only if it is not there, so no check can go stale before the write.
+        writeFileSync(join(top, ".gitignore"), "*\n", { flag: "wx" });
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "EEXIST"))
+            throw error;
+    }
     return { root, branch: name, dir: join(top, slugOf(name)) };
 }
 function readAnchorIn(dir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shiyuphan/follow-me",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Split a branch's final changes into fine, ordered commits that read like the author's thought process, review them hunk by hunk, and hand the review back to a coding agent.",
   "license": "MIT",
   "type": "module",