@snowyroad/arp 0.3.2 → 0.3.3

package/dist/cli.js

@@ -251,6 +251,46 @@ var RebootstrapError = class extends Error {
     this.name = "RebootstrapError";
   }
 };
+var MAX_TOKEN_LENGTH = 8192;
+var MAX_TOKEN_TTL_S = 48 * 3600;
+var CLOCK_SKEW_S = 300;
+function decodeJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+    if (typeof header !== "object" || header === null || Array.isArray(header)) return null;
+    const alg = header.alg;
+    if (typeof alg !== "string" || alg.toLowerCase() === "none") return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function validateReplacementToken(newToken, currentToken, nowMs = Date.now()) {
+  if (newToken.length > MAX_TOKEN_LENGTH) return { ok: false, reason: "token too large" };
+  const claims = decodeJwtClaims(newToken);
+  if (!claims) return { ok: false, reason: "not a well-formed JWT" };
+  const exp = claims.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) {
+    return { ok: false, reason: "missing or non-numeric exp claim" };
+  }
+  const nowS = nowMs / 1e3;
+  if (exp <= nowS - CLOCK_SKEW_S) return { ok: false, reason: "already expired" };
+  if (exp > nowS + MAX_TOKEN_TTL_S) return { ok: false, reason: "expiry implausibly far in the future" };
+  const current = decodeJwtClaims(currentToken);
+  if (current) {
+    if (typeof current.sub === "string" && typeof claims.sub === "string" && current.sub !== claims.sub) {
+      return { ok: false, reason: "subject (sub) does not match the current token" };
+    }
+    if (typeof current.iss === "string" && typeof claims.iss === "string" && current.iss !== claims.iss) {
+      return { ok: false, reason: "issuer (iss) does not match the current token" };
+    }
+  }
+  return { ok: true };
+}
 async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch) {
   const res = await fetchFn(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
     method: "POST",
@@ -811,6 +851,21 @@ var AUTH_GRACE_MS = 1500;
 var CATCHUP_WINDOW_MS = 8e3;
 var SEEN_CAP = 5e3;
 var RESUME_MAX_PAGES = 200;
+var WS_MAX_PAYLOAD_BYTES = 4 * 1024 * 1024;
+var MAX_MESSAGE_CONTENT_CHARS = 65536;
+var MAX_BACKFILL_CHARS_PER_CATCHUP = 2e6;
+var MAX_BACKFILL_CHARS_PER_CONNECTION = 8e6;
+var MAX_CONCURRENT_CATCHUPS = 3;
+var GAP_RESUME_MIN_INTERVAL_MS = 5e3;
+function clampContent(s) {
+  if (s.length <= MAX_MESSAGE_CONTENT_CHARS) return s;
+  return `${s.slice(0, MAX_MESSAGE_CONTENT_CHARS)}
+[message truncated by bridge: exceeded ${MAX_MESSAGE_CONTENT_CHARS} chars]`;
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(s) {
+  return UUID_RE.test(s);
+}
 var FATAL_CLOSE_CODES = /* @__PURE__ */ new Set([
   4001,
   // auth failed (bad/expired/tampered token) — recoverable via key re-mint when cfg.mintToken exists
@@ -824,6 +879,7 @@ var FATAL_CLOSE_CODES = /* @__PURE__ */ new Set([
 var MAX_REMINT_ATTEMPTS = 3;
 var PRE_HELLO_HINT_AFTER = 5;
 var RelayClient = class {
+  // per-channel gap-backfill rate limit
   constructor(cfg, deps) {
     this.cfg = cfg;
     this.deps = deps;
@@ -861,8 +917,22 @@ var RelayClient = class {
   fatalCb = null;
   removedCb = null;
   addedCb = null;
+  backfillCharsThisConn = 0;
+  // per-connection backfill budget (BRIDGE-09/12)
+  activeCatchUps = 0;
+  // concurrent catch-up limiter (BRIDGE-12)
+  catchUpWaiters = [];
+  lastGapResumeAt = /* @__PURE__ */ new Map();
+  // Every multi-listener subscription returns an unsubscribe (BRIDGE-18) so no
+  // handler array can grow without a way to shrink it. The router registers each
+  // once per process, but parity here means future per-channel subscribers cannot
+  // accumulate across channel churn the way pre-unsubscribe onRoster handlers did.
   onInbound(cb) {
     this.inboundCbs.push(cb);
+    return () => {
+      const i = this.inboundCbs.indexOf(cb);
+      if (i >= 0) this.inboundCbs.splice(i, 1);
+    };
   }
   /** Subscribe to roster updates; returns an unsubscribe so a per-channel session can drop
    *  its subscription on teardown (otherwise handlers accumulate across channel churn). */
@@ -875,9 +945,17 @@ var RelayClient = class {
   }
   onFlowSignal(cb) {
     this.flowCbs.push(cb);
+    return () => {
+      const i = this.flowCbs.indexOf(cb);
+      if (i >= 0) this.flowCbs.splice(i, 1);
+    };
   }
   onCatchUp(cb) {
     this.catchUpCbs.push(cb);
+    return () => {
+      const i = this.catchUpCbs.indexOf(cb);
+      if (i >= 0) this.catchUpCbs.splice(i, 1);
+    };
   }
   onReady(cb) {
     this.readyCb = cb;
@@ -894,8 +972,17 @@ var RelayClient = class {
   start() {
     this.connect();
   }
+  /** Validate a relay-supplied id as a UUID and return it URL-encoded, or null
+   *  (with a warning) when it is not one — the REST call is then refused (BRIDGE-11). */
+  pathId(id, what) {
+    if (!isUuid(id)) {
+      console.warn(`[arp-bridge] refusing REST call: ${what} is not a UUID: ${sanitizeForTty(id).slice(0, 80)}`);
+      return null;
+    }
+    return encodeURIComponent(id);
+  }
   connect() {
-    const url = `${this.cfg.relayWsUrl}/ws/agent/${this.cfg.agentId}`;
+    const url = `${this.cfg.relayWsUrl}/ws/agent/${encodeURIComponent(this.cfg.agentId)}`;
     const ws = this.deps.wsFactory(url, ["bearer.arp.v1", this.cfg.token]);
     this.ws = ws;
     ws.on("open", () => this.onOpen());
@@ -906,6 +993,7 @@ var RelayClient = class {
   }
   onOpen() {
     this.caughtUp.clear();
+    this.backfillCharsThisConn = 0;
     this.connectedAt = Date.now();
     this.heartbeatTimer = setInterval(() => this.send({ type: "ping" }), HEARTBEAT_MS);
     this.armWatchdog();
@@ -945,9 +1033,12 @@ var RelayClient = class {
    *  infinite loop if a misbehaving server keeps claiming hasMore. */
   async fetchAfterSeq(channelId, afterSeq) {
     const out = [];
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return out;
     let cursor = afterSeq;
+    let takenChars = 0;
     for (let page = 0; page < RESUME_MAX_PAGES; page++) {
-      const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/messages?afterSeq=${cursor}`;
+      const url = `${this.cfg.relayHttpUrl}/channels/${ch}/messages?afterSeq=${cursor}`;
       let res;
       try {
         res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
@@ -966,11 +1057,14 @@ var RelayClient = class {
       for (const m of list) {
         const seq = Number(m.seq ?? 0);
         if (seq > maxSeq) maxSeq = seq;
+        const content = clampContent(String(m.content ?? ""));
+        takenChars += content.length;
+        this.backfillCharsThisConn += content.length;
         out.push({
           id: String(m.id ?? ""),
           seq,
           channelId,
-          content: String(m.content ?? ""),
+          content,
           senderId: String(m.agentId ?? ""),
           senderName: String(m.agentName ?? ""),
           senderType: String(m.messageType ?? m.type ?? ""),
@@ -981,11 +1075,29 @@ var RelayClient = class {
         });
       }
       if (!body.hasMore) return out;
+      if (takenChars >= MAX_BACKFILL_CHARS_PER_CATCHUP || this.backfillCharsThisConn >= MAX_BACKFILL_CHARS_PER_CONNECTION) {
+        console.warn("[arp-bridge] backfill content budget exhausted; truncating catch-up");
+        return out;
+      }
       cursor = maxSeq;
     }
     console.warn("[arp-bridge] backfill hit page cap", RESUME_MAX_PAGES);
     return out;
   }
+  /** Run a catch-up with bounded concurrency (BRIDGE-12): at most
+   *  MAX_CONCURRENT_CATCHUPS paginated backfill loops in flight; extras queue FIFO. */
+  scheduleCatchUp(channelId, afterSeq) {
+    const run = () => {
+      this.activeCatchUps++;
+      void this.catchUp(channelId, afterSeq).finally(() => {
+        this.activeCatchUps--;
+        const next = this.catchUpWaiters.shift();
+        if (next) next();
+      });
+    };
+    if (this.activeCatchUps < MAX_CONCURRENT_CATCHUPS) run();
+    else this.catchUpWaiters.push(run);
+  }
   /** Mid-session gap-fill: replay missed messages live (each dedupes via emitInbound). */
   async resumeAfterSeq(channelId, afterSeq) {
     for (const m of await this.fetchAfterSeq(channelId, afterSeq)) this.emitInbound(m);
@@ -1011,6 +1123,8 @@ var RelayClient = class {
       this.remintAttempts++;
       console.log("[arp-bridge] access token rejected; re-minting from agent key");
       void this.cfg.mintToken().then((token) => {
+        const verdict = validateReplacementToken(token, this.cfg.token);
+        if (!verdict.ok) throw new Error(`re-minted token failed validation: ${verdict.reason}`);
         this.cfg.token = token;
         if (!this.stopped) this.connect();
       }).catch((err) => {
@@ -1089,18 +1203,24 @@ var RelayClient = class {
       case "channel_message":
         this.handleChannelMessage(msg);
         break;
-      case "token_refresh":
-        if (typeof msg.token === "string" && msg.token.length > 0) {
-          this.cfg.token = msg.token;
-          console.log("[arp-bridge] token refreshed");
+      case "token_refresh": {
+        if (typeof msg.token !== "string" || msg.token.length === 0) break;
+        const verdict = validateReplacementToken(msg.token, this.cfg.token);
+        if (!verdict.ok) {
+          console.warn(`[arp-bridge] rejected token_refresh (${verdict.reason}); keeping the current token`);
+          break;
         }
+        this.cfg.token = msg.token;
+        console.log("[arp-bridge] token refreshed");
         break;
+      }
       case "removed": {
         const ch = String(msg.channelId ?? "");
         if (!ch) break;
         this.cursors.delete(ch);
         this.seenByChannel.delete(ch);
         this.caughtUp.delete(ch);
+        this.lastGapResumeAt.delete(ch);
         this.removedCb?.(ch);
         break;
       }
@@ -1138,7 +1258,7 @@ var RelayClient = class {
             const floor = this.cursorOf(ch);
             if (!this.caughtUp.has(ch) && floor > 0) {
               this.caughtUp.add(ch);
-              void this.catchUp(ch, floor);
+              this.scheduleCatchUp(ch, floor);
             }
           }
         }
@@ -1159,7 +1279,8 @@ var RelayClient = class {
       id: String(m.id ?? ""),
       seq: Number(m.seq ?? 0),
       channelId,
-      content: String(m.content ?? ""),
+      content: clampContent(String(m.content ?? "")),
+      // bound per-message memory/prompt size (BRIDGE-09)
       senderId: String(m.agentId ?? ""),
       senderName: String(m.agentName ?? ""),
       senderType: String(m.messageType ?? m.type ?? ""),
@@ -1170,7 +1291,13 @@ var RelayClient = class {
     const gapDetected = !inbound.isHistory && this.cursorOf(channelId) > 0 && inbound.seq > this.cursorOf(channelId) + 1;
     const gapFrom = this.cursorOf(channelId);
     this.emitInbound(inbound);
-    if (gapDetected) void this.resumeAfterSeq(channelId, gapFrom);
+    if (gapDetected) {
+      const now = Date.now();
+      if (now - (this.lastGapResumeAt.get(channelId) ?? 0) >= GAP_RESUME_MIN_INTERVAL_MS) {
+        this.lastGapResumeAt.set(channelId, now);
+        void this.resumeAfterSeq(channelId, gapFrom);
+      }
+    }
   }
   /** Normalize a turn_notification / synthesis_request / direction_request into a FlowSignal and emit it. */
   handleFlowSignal(kind, msg) {
@@ -1179,7 +1306,8 @@ var RelayClient = class {
     const rawHistory = kind === "synthesis" || kind === "direction" ? msg.flowHistory ?? msg.messages ?? [] : msg.recentMessages ?? [];
     const history = (Array.isArray(rawHistory) ? rawHistory : []).map((e) => ({
       agentName: String(e.agentName ?? ""),
-      content: String(e.content ?? ""),
+      content: clampContent(String(e.content ?? "")),
+      // bound per-entry size (BRIDGE-09)
       messageType: e.messageType ?? e.type,
       turnNumber: e.turnNumber,
       createdAt: e.createdAt
@@ -1258,7 +1386,9 @@ var RelayClient = class {
   }
   /** Fetch the channel roster and return normalized bot entries (with cards). */
   async fetchRoster(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1274,7 +1404,9 @@ var RelayClient = class {
     }
   }
   async postMessage(channelId, content) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/messages`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return;
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/messages`;
     const body = JSON.stringify({
       id: randomUUID(),
       // client-generated -> server idempotent on retry
@@ -1300,7 +1432,10 @@ var RelayClient = class {
    *  agentId MUST be the agent NAME — the relay's flow gate resolves turn ownership and
    *  synthesis role via resolveAgentUUID (a name lookup); a UUID resolves to uuid.Nil -> 403. */
   async postFlowMessage(channelId, flowId, content) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/flows/${flowId}/messages`;
+    const ch = this.pathId(channelId, "channelId");
+    const fl = this.pathId(flowId, "flowId");
+    if (!ch || !fl) return;
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/flows/${fl}/messages`;
     const body = JSON.stringify({
       id: randomUUID(),
       content,
@@ -1322,7 +1457,9 @@ var RelayClient = class {
   }
   /** Channel memory text ("" if none or on error — never throws). */
   async fetchChannelMemory(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/memory`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return "";
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/memory`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1339,7 +1476,9 @@ var RelayClient = class {
   /** Channel topics with message counts ([] if none or on error). The relay returns
    *  topics with a `title` plus a separate `messageCounts` map keyed by topic id. */
   async fetchChannelTopics(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/topics`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/topics`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1357,7 +1496,9 @@ var RelayClient = class {
   }
   /** Pinned files marked inject_context=true, labeled with cached content ([] otherwise). */
   async fetchPinnedContext(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/pins`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/pins`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1387,7 +1528,10 @@ var RelayClient = class {
   }
   /** Fetch a flow's transcript (used to backfill a minimal turn_notification). [] on error. */
   async fetchFlowMessages(channelId, flowId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/flows/${flowId}/messages`;
+    const ch = this.pathId(channelId, "channelId");
+    const fl = this.pathId(flowId, "flowId");
+    if (!ch || !fl) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/flows/${fl}/messages`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1461,6 +1605,22 @@ ${fence("flow topic", signal.topic)}
 ` + role + ctx + synth + "\n" + history + closer;
 }
 
+// src/promptLimit.ts
+var DEFAULT_MAX_PROMPT_CHARS = 4e5;
+function maxPromptChars(env = process.env) {
+  const n = Number(env.ARP_MAX_PROMPT_CHARS);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_MAX_PROMPT_CHARS;
+}
+function capPrompt(prompt, max = maxPromptChars()) {
+  if (prompt.length <= max) return prompt;
+  const headLen = Math.floor(max * 0.8);
+  const tailLen = max - headLen;
+  const removed = prompt.length - headLen - tailLen;
+  return prompt.slice(0, headLen) + `
+[...prompt truncated by bridge: ${removed} chars of channel content removed...]
+` + prompt.slice(prompt.length - tailLen);
+}
+
 // src/session.ts
 var SILENCE_SENTINEL = "<<silent>>";
 var ChannelSession = class {
@@ -1534,7 +1694,7 @@ ${fence("channel message", msg.content)}
 ` + rosterBlock;
     const instructions = isAddressed(msg.content, this.agentName) ? "You were directly addressed (@mentioned), so respond. Output ONLY your channel message itself, concisely. Do NOT include the silence sentinel and do NOT explain whether or why you are responding." : `You received this as a passive channel message. You do NOT need to respond unless it is directly relevant to you. If you have nothing to add, reply with exactly ${SILENCE_SENTINEL} and nothing else. Otherwise output ONLY your channel message, concisely \u2014 do NOT explain whether or why you are responding.`;
     this.beacon?.begin();
-    this.session.submit(head + instructions);
+    this.session.submit(capPrompt(head + instructions));
   }
   /**
    * Run one bounded-flow turn or synthesis. Frames a MUST-RESPOND prompt (no
@@ -1555,7 +1715,7 @@ ${fence("channel message", msg.content)}
       let history = signal.history;
       if (history.length === 0) history = await this.flow.fetchHistory(signal.flowId);
       const prompt = buildFlowPrompt({ ...signal, history }, this.agentName, this.channelId, this.toolMode);
-      const reply = await this.session.converseLocal(prompt);
+      const reply = await this.session.converseLocal(capPrompt(prompt));
       await this.flow.postReply(signal.flowId, reply.trim() || "(no response)");
     } finally {
       this.beacon?.end();
@@ -1595,10 +1755,10 @@ ${fence("channel message", msg.content)}
       if (!this.session.converseLocal) return;
       this.beacon?.begin();
       try {
-        await this.session.converseLocal(
+        await this.session.converseLocal(capPrompt(
           this.promptHead() + `You just reconnected to ARP channel ${this.channelId} after being away. Here is what you missed (context only, do NOT reply to it):
 ` + fence("missed channel messages", transcript)
-        );
+        ));
       } finally {
         this.beacon?.end();
       }
@@ -1615,7 +1775,7 @@ ${fence("messages mentioning you", addressed)}
 `;
     const instructions = `Respond ONCE, concisely, to what was directed at you. If something is already resolved by the later messages above, say so briefly. Output ONLY your channel message \u2014 do NOT include the silence sentinel and do NOT explain whether or why you are responding.`;
     this.beacon?.begin();
-    this.session.submit(head + instructions);
+    this.session.submit(capPrompt(head + instructions));
   }
   async stop() {
     this.beacon?.stop?.();
@@ -1717,13 +1877,13 @@ function dropVendorNotifications(input) {
 
 // src/acp/client.ts
 var MODEL_AUTH_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
-var BRIDGE_CRED_ENV_KEYS = ["ARP_TOKEN", "ARP_INVITE", "ARP_CONFIG_DIR"];
+var BRIDGE_ENV_PREFIX = "ARP_";
 function buildAcpEnv(base, extra) {
   const merged = {};
   for (const [k, v] of Object.entries({ ...base, ...extra ?? {} })) {
     if (v === void 0) continue;
     if (MODEL_AUTH_ENV_KEYS.includes(k)) continue;
-    if (BRIDGE_CRED_ENV_KEYS.includes(k)) continue;
+    if (k.startsWith(BRIDGE_ENV_PREFIX)) continue;
     merged[k] = v;
   }
   return merged;
@@ -2291,7 +2451,7 @@ var ClaudeAdapter = class {
             if (full.length > 0) turnCbs.forEach((cb) => cb(full));
           } else {
             buffer = "";
-            console.warn("[arp-bridge] agent turn ended without success:", m.subtype);
+            console.warn("[arp-bridge] agent turn ended without success:", sanitizeForTty(String(m.subtype)));
           }
         }
       }
@@ -2516,11 +2676,13 @@ function reportFatalClose(code, reason) {
     console.error(`[arp-bridge] relay rejected the connection (close ${code}): ${sanitizeForTty(reason)}. Not retrying.`);
   }
 }
+function makeDefaultWsFactory(WebSocketImpl) {
+  return (url, protocols) => new WebSocketImpl(url, protocols, { maxPayload: WS_MAX_PAYLOAD_BYTES });
+}
 async function createAndStartBridge(cfg, deps = {}) {
   let wsFactory = deps.wsFactory;
   if (!wsFactory) {
-    const WebSocketImpl = (await import("ws")).default;
-    wsFactory = (url, protocols) => new WebSocketImpl(url, protocols);
+    wsFactory = makeDefaultWsFactory((await import("ws")).default);
   }
   const relay = new RelayClient(cfg, {
     wsFactory,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snowyroad/arp",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Connect your own coding agent (Claude Code, Codex, Gemini, Grok) to an Agent Relay Protocol channel and collaborate with other agents and humans.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "SnowyRoad",
@@ -33,7 +33,6 @@
     "prepublishOnly": "pnpm build",
     "dev": "tsx src/index.ts",
     "join": "tsx src/index.ts",
-    "generate-invite": "tsx scripts/generate-invite.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:integration": "vitest run --config vitest.integration.config.ts",