@snowyroad/arp 0.3.2 → 0.3.4

package/dist/cli.js

@@ -251,6 +251,46 @@ var RebootstrapError = class extends Error {
     this.name = "RebootstrapError";
   }
 };
+var MAX_TOKEN_LENGTH = 8192;
+var MAX_TOKEN_TTL_S = 48 * 3600;
+var CLOCK_SKEW_S = 300;
+function decodeJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+    if (typeof header !== "object" || header === null || Array.isArray(header)) return null;
+    const alg = header.alg;
+    if (typeof alg !== "string" || alg.toLowerCase() === "none") return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function validateReplacementToken(newToken, currentToken, nowMs = Date.now()) {
+  if (newToken.length > MAX_TOKEN_LENGTH) return { ok: false, reason: "token too large" };
+  const claims = decodeJwtClaims(newToken);
+  if (!claims) return { ok: false, reason: "not a well-formed JWT" };
+  const exp = claims.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) {
+    return { ok: false, reason: "missing or non-numeric exp claim" };
+  }
+  const nowS = nowMs / 1e3;
+  if (exp <= nowS - CLOCK_SKEW_S) return { ok: false, reason: "already expired" };
+  if (exp > nowS + MAX_TOKEN_TTL_S) return { ok: false, reason: "expiry implausibly far in the future" };
+  const current = decodeJwtClaims(currentToken);
+  if (current) {
+    if (typeof current.sub === "string" && typeof claims.sub === "string" && current.sub !== claims.sub) {
+      return { ok: false, reason: "subject (sub) does not match the current token" };
+    }
+    if (typeof current.iss === "string" && typeof claims.iss === "string" && current.iss !== claims.iss) {
+      return { ok: false, reason: "issuer (iss) does not match the current token" };
+    }
+  }
+  return { ok: true };
+}
 async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch) {
   const res = await fetchFn(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
     method: "POST",
@@ -640,6 +680,33 @@ function redactConfig(cfg) {
 import { randomUUID } from "crypto";
 
 // src/untrusted.ts
+function untrusted(s) {
+  return s;
+}
+function rawUntrusted(u) {
+  return u;
+}
+function utext(strings, ...values) {
+  let out = strings[0];
+  for (let i = 0; i < values.length; i++) out += String(values[i]) + strings[i + 1];
+  return out;
+}
+function joinUntrusted(parts, sep2) {
+  return parts.join(sep2);
+}
+function firstNonEmpty(parts, fallback) {
+  for (const p of parts) if (p !== "") return p;
+  return fallback;
+}
+function hasText(u) {
+  return u !== "";
+}
+function isBlankText(u) {
+  return u.trim() === "";
+}
+function sameText(u, s) {
+  return u === s;
+}
 var MARKER_RE = /<<<(?=[\s\u200B-\u200D\u2060\uFEFF]*(?:END[\s\u200B-\u200D\u2060\uFEFF]+)?UNTRUSTED)/gi;
 function neutralizeMarkers(content) {
   return content.replace(MARKER_RE, "<<\\<");
@@ -650,7 +717,7 @@ function sanitizeLabel(label) {
 function fence(label, content) {
   const l = sanitizeLabel(label);
   return `<<<UNTRUSTED ${l}>>>
-${neutralizeMarkers(content)}
+${neutralizeMarkers(rawUntrusted(content))}
 <<<END UNTRUSTED ${l}>>>`;
 }
 function untrustedPreamble(mode) {
@@ -734,24 +801,24 @@ function normalizeRosterEntry(name, memberDescription, card) {
     if (typeof card.description === "string" && card.description) description = card.description;
     if (Array.isArray(card.skills)) skills = card.skills.map((s) => s && typeof s.name === "string" ? s.name : "").filter(Boolean);
   }
-  return { name, description, skills };
+  return { name: untrusted(name), description: untrusted(description), skills: skills.map(untrusted) };
 }
 function assembleRosterFacts(entries, selfName) {
-  const peers = entries.filter((e) => e.name !== selfName);
+  const peers = entries.filter((e) => !sameText(e.name, selfName));
   if (peers.length === 0) return "";
   const lines = peers.map((p) => {
-    const desc = p.description ? `: ${p.description}` : "";
-    const skills = p.skills.length ? ` [skills: ${p.skills.join(", ")}]` : "";
-    return `- ${p.name}${desc}${skills}`;
+    const desc = hasText(p.description) ? utext`: ${p.description}` : "";
+    const skills = p.skills.length ? utext` [skills: ${joinUntrusted(p.skills, ", ")}]` : "";
+    return utext`- ${p.name}${desc}${skills}`;
   });
   return `Also in this channel:
-${fence("peer roster", lines.join("\n"))}`;
+${fence("peer roster", joinUntrusted(lines, "\n"))}`;
 }
 
 // src/channelContext.ts
 function buildChannelContext(input) {
   let out = "";
-  if (input.memory.trim()) {
+  if (!isBlankText(input.memory)) {
     out += `## Channel Memory (shared context for this channel)
 ${fence("channel memory", input.memory)}
 ---
@@ -759,8 +826,7 @@ ${fence("channel memory", input.memory)}
 `;
   }
   if (input.pins.length > 0) {
-    const sections = input.pins.map((p) => fence("pinned file", `\u{1F4CC} ${p.label}
-${p.content}`));
+    const sections = input.pins.map((p) => fence("pinned file", utext`📌 ${p.label}\n${p.content}`));
     out += `## Pinned Files (from GitHub)
 ${sections.join("\n\n")}
 ---
@@ -770,10 +836,10 @@ ${sections.join("\n\n")}
   if (input.topics.length > 0) {
     const lines = input.topics.map((t) => {
       const count = t.count != null ? ` (${t.count} messages)` : "";
-      return `- ${t.title}${count}`;
+      return utext`- ${t.title}${count}`;
     });
     out += `## Channel Topics
-${fence("channel topic titles", lines.join("\n"))}
+${fence("channel topic titles", joinUntrusted(lines, "\n"))}
 ---
 
 `;
@@ -785,21 +851,21 @@ ${fence("channel topic titles", lines.join("\n"))}
 function isAddressed(content, agentName) {
   const name = agentName.trim();
   if (!name) return false;
-  const c = content.toLowerCase();
+  const c = rawUntrusted(content).toLowerCase();
   const forms = /* @__PURE__ */ new Set([name.toLowerCase(), name.toLowerCase().replace(/\s+/g, "_")]);
   for (const f of forms) if (c.includes("@" + f)) return true;
   return false;
 }
 function classifyCatchUp(messages, agentName, nowMs, opts) {
-  const inWindow = messages.filter((m) => {
-    const t = Date.parse(m.createdAt);
-    return Number.isFinite(t) ? t >= nowMs - opts.ttlMs : true;
+  const mentions = messages.filter((m) => {
+    if (m.seq <= opts.deliveredMaxSeq) return false;
+    const t = Date.parse(rawUntrusted(m.createdAt));
+    const withinTtl = Number.isFinite(t) ? t >= nowMs - opts.ttlMs : true;
+    if (!withinTtl) return false;
+    return !sameText(m.senderName, agentName) && isAddressed(m.content, agentName);
   });
-  const mentions = inWindow.filter(
-    (m) => m.senderName !== agentName && isAddressed(m.content, agentName)
-  );
   const capped = mentions.slice(-opts.maxMentions);
-  return { context: inWindow, mentions: capped };
+  return { context: messages, mentions: capped };
 }
 
 // src/relayClient.ts
@@ -811,6 +877,22 @@ var AUTH_GRACE_MS = 1500;
 var CATCHUP_WINDOW_MS = 8e3;
 var SEEN_CAP = 5e3;
 var RESUME_MAX_PAGES = 200;
+var WS_MAX_PAYLOAD_BYTES = 4 * 1024 * 1024;
+var MAX_MESSAGE_CONTENT_CHARS = 65536;
+var MAX_BACKFILL_CHARS_PER_CATCHUP = 2e6;
+var MAX_BACKFILL_CHARS_PER_CONNECTION = 8e6;
+var MAX_CONCURRENT_CATCHUPS = 3;
+var GAP_RESUME_MIN_INTERVAL_MS = 5e3;
+var REBUILD_LOOKBACK_SEQS = 100;
+function clampContent(s) {
+  if (s.length <= MAX_MESSAGE_CONTENT_CHARS) return s;
+  return `${s.slice(0, MAX_MESSAGE_CONTENT_CHARS)}
+[message truncated by bridge: exceeded ${MAX_MESSAGE_CONTENT_CHARS} chars]`;
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(s) {
+  return UUID_RE.test(s);
+}
 var FATAL_CLOSE_CODES = /* @__PURE__ */ new Set([
   4001,
   // auth failed (bad/expired/tampered token) — recoverable via key re-mint when cfg.mintToken exists
@@ -824,6 +906,7 @@ var FATAL_CLOSE_CODES = /* @__PURE__ */ new Set([
 var MAX_REMINT_ATTEMPTS = 3;
 var PRE_HELLO_HINT_AFTER = 5;
 var RelayClient = class {
+  // per-channel gap-backfill rate limit
   constructor(cfg, deps) {
     this.cfg = cfg;
     this.deps = deps;
@@ -848,6 +931,8 @@ var RelayClient = class {
   graceTimer = null;
   confirmed = false;
   // single-shot: onReady has fired (relay accepted the agent)
+  reconnectAnnounced = false;
+  // per-connection: "reconnected" printed for this connection
   catchUpCbs = [];
   caughtUp = /* @__PURE__ */ new Set();
   // channels caught up this connection
@@ -861,8 +946,22 @@ var RelayClient = class {
   fatalCb = null;
   removedCb = null;
   addedCb = null;
+  backfillCharsThisConn = 0;
+  // per-connection backfill budget (BRIDGE-09/12)
+  activeCatchUps = 0;
+  // concurrent catch-up limiter (BRIDGE-12)
+  catchUpWaiters = [];
+  lastGapResumeAt = /* @__PURE__ */ new Map();
+  // Every multi-listener subscription returns an unsubscribe (BRIDGE-18) so no
+  // handler array can grow without a way to shrink it. The router registers each
+  // once per process, but parity here means future per-channel subscribers cannot
+  // accumulate across channel churn the way pre-unsubscribe onRoster handlers did.
   onInbound(cb) {
     this.inboundCbs.push(cb);
+    return () => {
+      const i = this.inboundCbs.indexOf(cb);
+      if (i >= 0) this.inboundCbs.splice(i, 1);
+    };
   }
   /** Subscribe to roster updates; returns an unsubscribe so a per-channel session can drop
    *  its subscription on teardown (otherwise handlers accumulate across channel churn). */
@@ -875,9 +974,17 @@ var RelayClient = class {
   }
   onFlowSignal(cb) {
     this.flowCbs.push(cb);
+    return () => {
+      const i = this.flowCbs.indexOf(cb);
+      if (i >= 0) this.flowCbs.splice(i, 1);
+    };
   }
   onCatchUp(cb) {
     this.catchUpCbs.push(cb);
+    return () => {
+      const i = this.catchUpCbs.indexOf(cb);
+      if (i >= 0) this.catchUpCbs.splice(i, 1);
+    };
   }
   onReady(cb) {
     this.readyCb = cb;
@@ -894,8 +1001,17 @@ var RelayClient = class {
   start() {
     this.connect();
   }
+  /** Validate a relay-supplied id as a UUID and return it URL-encoded, or null
+   *  (with a warning) when it is not one — the REST call is then refused (BRIDGE-11). */
+  pathId(id, what) {
+    if (!isUuid(id)) {
+      console.warn(`[arp-bridge] refusing REST call: ${what} is not a UUID: ${sanitizeForTty(id).slice(0, 80)}`);
+      return null;
+    }
+    return encodeURIComponent(id);
+  }
   connect() {
-    const url = `${this.cfg.relayWsUrl}/ws/agent/${this.cfg.agentId}`;
+    const url = `${this.cfg.relayWsUrl}/ws/agent/${encodeURIComponent(this.cfg.agentId)}`;
     const ws = this.deps.wsFactory(url, ["bearer.arp.v1", this.cfg.token]);
     this.ws = ws;
     ws.on("open", () => this.onOpen());
@@ -906,7 +1022,9 @@ var RelayClient = class {
   }
   onOpen() {
     this.caughtUp.clear();
+    this.backfillCharsThisConn = 0;
     this.connectedAt = Date.now();
+    this.reconnectAnnounced = false;
     this.heartbeatTimer = setInterval(() => this.send({ type: "ping" }), HEARTBEAT_MS);
     this.armWatchdog();
     this.stableTimer = setTimeout(() => {
@@ -917,13 +1035,20 @@ var RelayClient = class {
     this.graceTimer = setTimeout(() => this.confirmReady(), AUTH_GRACE_MS);
     this.onConnected();
   }
-  /** Single-shot: fires onReady at most once, on the FIRST successful connect. */
+  /** Fires onReady at most once, on the FIRST successful connect; on later
+   *  connections it announces the reconnect instead (once per connection). */
   confirmReady() {
     if (this.graceTimer) {
       clearTimeout(this.graceTimer);
       this.graceTimer = null;
     }
-    if (this.confirmed) return;
+    if (this.confirmed) {
+      if (!this.reconnectAnnounced) {
+        this.reconnectAnnounced = true;
+        console.log("[arp-bridge] reconnected");
+      }
+      return;
+    }
     this.confirmed = true;
     this.readyCb?.();
   }
@@ -945,9 +1070,12 @@ var RelayClient = class {
    *  infinite loop if a misbehaving server keeps claiming hasMore. */
   async fetchAfterSeq(channelId, afterSeq) {
     const out = [];
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return out;
     let cursor = afterSeq;
+    let takenChars = 0;
     for (let page = 0; page < RESUME_MAX_PAGES; page++) {
-      const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/messages?afterSeq=${cursor}`;
+      const url = `${this.cfg.relayHttpUrl}/channels/${ch}/messages?afterSeq=${cursor}`;
       let res;
       try {
         res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
@@ -966,40 +1094,62 @@ var RelayClient = class {
       for (const m of list) {
         const seq = Number(m.seq ?? 0);
         if (seq > maxSeq) maxSeq = seq;
+        const content = clampContent(String(m.content ?? ""));
+        takenChars += content.length;
+        this.backfillCharsThisConn += content.length;
         out.push({
           id: String(m.id ?? ""),
           seq,
           channelId,
-          content: String(m.content ?? ""),
-          senderId: String(m.agentId ?? ""),
-          senderName: String(m.agentName ?? ""),
+          content: untrusted(content),
+          senderId: untrusted(String(m.agentId ?? "")),
+          senderName: untrusted(String(m.agentName ?? "")),
           senderType: String(m.messageType ?? m.type ?? ""),
           // relay live/resume key is messageType; history path uses type
-          createdAt: String(m.createdAt ?? ""),
+          createdAt: untrusted(String(m.createdAt ?? "")),
           isHistory: false
           // shape parity with live messages; the caller decides how to handle them
         });
       }
       if (!body.hasMore) return out;
+      if (takenChars >= MAX_BACKFILL_CHARS_PER_CATCHUP || this.backfillCharsThisConn >= MAX_BACKFILL_CHARS_PER_CONNECTION) {
+        console.warn("[arp-bridge] backfill content budget exhausted; truncating catch-up");
+        return out;
+      }
       cursor = maxSeq;
     }
     console.warn("[arp-bridge] backfill hit page cap", RESUME_MAX_PAGES);
     return out;
   }
+  /** Run a catch-up with bounded concurrency (BRIDGE-12): at most
+   *  MAX_CONCURRENT_CATCHUPS paginated backfill loops in flight; extras queue FIFO. */
+  scheduleCatchUp(channelId, afterSeq, deliveredMaxSeq) {
+    const run = () => {
+      this.activeCatchUps++;
+      void this.catchUp(channelId, afterSeq, deliveredMaxSeq).finally(() => {
+        this.activeCatchUps--;
+        const next = this.catchUpWaiters.shift();
+        if (next) next();
+      });
+    };
+    if (this.activeCatchUps < MAX_CONCURRENT_CATCHUPS) run();
+    else this.catchUpWaiters.push(run);
+  }
   /** Mid-session gap-fill: replay missed messages live (each dedupes via emitInbound). */
   async resumeAfterSeq(channelId, afterSeq) {
     for (const m of await this.fetchAfterSeq(channelId, afterSeq)) this.emitInbound(m);
   }
   /** Offline-rejoin catch-up: classify the missed window and hand it to onCatchUp once.
    *  Does NOT route through emitInbound/onInbound to avoid per-message passive submits. */
-  async catchUp(channelId, afterSeq) {
+  async catchUp(channelId, afterSeq, deliveredMaxSeq) {
     const missed = await this.fetchAfterSeq(channelId, afterSeq);
     if (missed.length === 0) return;
     for (const m of missed) if (m.id) this.markSeen(channelId, m.id);
     this.bumpCursor(channelId, missed[missed.length - 1].seq);
     const result = classifyCatchUp(missed, this.cfg.agentName, Date.now(), {
       ttlMs: this.cfg.catchUpTtlMs,
-      maxMentions: this.cfg.catchUpMaxMentions
+      maxMentions: this.cfg.catchUpMaxMentions,
+      deliveredMaxSeq
     });
     this.catchUpCbs.forEach((cb) => cb(channelId, result));
   }
@@ -1011,6 +1161,8 @@ var RelayClient = class {
       this.remintAttempts++;
       console.log("[arp-bridge] access token rejected; re-minting from agent key");
       void this.cfg.mintToken().then((token) => {
+        const verdict = validateReplacementToken(token, this.cfg.token);
+        if (!verdict.ok) throw new Error(`re-minted token failed validation: ${verdict.reason}`);
         this.cfg.token = token;
         if (!this.stopped) this.connect();
       }).catch((err) => {
@@ -1075,7 +1227,7 @@ var RelayClient = class {
   }
   onMessage(raw) {
     this.armWatchdog();
-    if (!this.confirmed) this.confirmReady();
+    this.confirmReady();
     let msg;
     try {
       msg = JSON.parse(raw);
@@ -1089,18 +1241,24 @@ var RelayClient = class {
       case "channel_message":
         this.handleChannelMessage(msg);
         break;
-      case "token_refresh":
-        if (typeof msg.token === "string" && msg.token.length > 0) {
-          this.cfg.token = msg.token;
-          console.log("[arp-bridge] token refreshed");
+      case "token_refresh": {
+        if (typeof msg.token !== "string" || msg.token.length === 0) break;
+        const verdict = validateReplacementToken(msg.token, this.cfg.token);
+        if (!verdict.ok) {
+          console.warn(`[arp-bridge] rejected token_refresh (${verdict.reason}); keeping the current token`);
+          break;
         }
+        this.cfg.token = msg.token;
+        console.log("[arp-bridge] token refreshed");
         break;
+      }
       case "removed": {
         const ch = String(msg.channelId ?? "");
         if (!ch) break;
         this.cursors.delete(ch);
         this.seenByChannel.delete(ch);
         this.caughtUp.delete(ch);
+        this.lastGapResumeAt.delete(ch);
         this.removedCb?.(ch);
         break;
       }
@@ -1135,10 +1293,11 @@ var RelayClient = class {
           for (const [ch, seqRaw] of Object.entries(resume)) {
             const seq = Number(seqRaw);
             if (Number.isFinite(seq) && seq > this.cursorOf(ch)) this.cursors.set(ch, seq);
-            const floor = this.cursorOf(ch);
-            if (!this.caughtUp.has(ch) && floor > 0) {
+            const deliveredMax = this.cursorOf(ch);
+            if (!this.caughtUp.has(ch) && deliveredMax > 0) {
               this.caughtUp.add(ch);
-              void this.catchUp(ch, floor);
+              const rebuildFloor = Math.max(0, deliveredMax - REBUILD_LOOKBACK_SEQS);
+              this.scheduleCatchUp(ch, rebuildFloor, deliveredMax);
             }
           }
         }
@@ -1159,18 +1318,25 @@ var RelayClient = class {
       id: String(m.id ?? ""),
       seq: Number(m.seq ?? 0),
       channelId,
-      content: String(m.content ?? ""),
-      senderId: String(m.agentId ?? ""),
-      senderName: String(m.agentName ?? ""),
+      content: untrusted(clampContent(String(m.content ?? ""))),
+      // bound per-message memory/prompt size (BRIDGE-09)
+      senderId: untrusted(String(m.agentId ?? "")),
+      senderName: untrusted(String(m.agentName ?? "")),
       senderType: String(m.messageType ?? m.type ?? ""),
       // relay live/resume key is messageType; history path uses type
-      createdAt: String(m.createdAt ?? ""),
+      createdAt: untrusted(String(m.createdAt ?? "")),
       isHistory: Boolean(msg.isHistory)
     };
     const gapDetected = !inbound.isHistory && this.cursorOf(channelId) > 0 && inbound.seq > this.cursorOf(channelId) + 1;
     const gapFrom = this.cursorOf(channelId);
     this.emitInbound(inbound);
-    if (gapDetected) void this.resumeAfterSeq(channelId, gapFrom);
+    if (gapDetected) {
+      const now = Date.now();
+      if (now - (this.lastGapResumeAt.get(channelId) ?? 0) >= GAP_RESUME_MIN_INTERVAL_MS) {
+        this.lastGapResumeAt.set(channelId, now);
+        void this.resumeAfterSeq(channelId, gapFrom);
+      }
+    }
   }
   /** Normalize a turn_notification / synthesis_request / direction_request into a FlowSignal and emit it. */
   handleFlowSignal(kind, msg) {
@@ -1178,8 +1344,9 @@ var RelayClient = class {
     if (!flowId) return;
     const rawHistory = kind === "synthesis" || kind === "direction" ? msg.flowHistory ?? msg.messages ?? [] : msg.recentMessages ?? [];
     const history = (Array.isArray(rawHistory) ? rawHistory : []).map((e) => ({
-      agentName: String(e.agentName ?? ""),
-      content: String(e.content ?? ""),
+      agentName: untrusted(String(e.agentName ?? "")),
+      content: untrusted(clampContent(String(e.content ?? ""))),
+      // bound per-entry size (BRIDGE-09)
       messageType: e.messageType ?? e.type,
       turnNumber: e.turnNumber,
       createdAt: e.createdAt
@@ -1188,11 +1355,11 @@ var RelayClient = class {
       kind,
       flowId,
       channelId: String(msg.channelId ?? ""),
-      topic: String(msg.topic ?? ""),
-      rolePrompt: typeof msg.rolePrompt === "string" ? msg.rolePrompt : void 0,
-      contextPrompt: typeof msg.contextPrompt === "string" ? msg.contextPrompt : void 0,
-      synthesisPrompt: typeof msg.synthesisPrompt === "string" ? msg.synthesisPrompt : void 0,
-      candidates: Array.isArray(msg.candidates) ? msg.candidates : void 0,
+      topic: untrusted(String(msg.topic ?? "")),
+      rolePrompt: typeof msg.rolePrompt === "string" ? untrusted(msg.rolePrompt) : void 0,
+      contextPrompt: typeof msg.contextPrompt === "string" ? untrusted(msg.contextPrompt) : void 0,
+      synthesisPrompt: typeof msg.synthesisPrompt === "string" ? untrusted(msg.synthesisPrompt) : void 0,
+      candidates: Array.isArray(msg.candidates) ? msg.candidates.map((c) => untrusted(String(c ?? ""))) : void 0,
       history
     };
     this.flowCbs.forEach((cb) => cb(signal));
@@ -1258,7 +1425,9 @@ var RelayClient = class {
   }
   /** Fetch the channel roster and return normalized bot entries (with cards). */
   async fetchRoster(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1274,7 +1443,9 @@ var RelayClient = class {
     }
   }
   async postMessage(channelId, content) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/messages`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return;
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/messages`;
     const body = JSON.stringify({
       id: randomUUID(),
       // client-generated -> server idempotent on retry
@@ -1300,7 +1471,10 @@ var RelayClient = class {
    *  agentId MUST be the agent NAME — the relay's flow gate resolves turn ownership and
    *  synthesis role via resolveAgentUUID (a name lookup); a UUID resolves to uuid.Nil -> 403. */
   async postFlowMessage(channelId, flowId, content) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/flows/${flowId}/messages`;
+    const ch = this.pathId(channelId, "channelId");
+    const fl = this.pathId(flowId, "flowId");
+    if (!ch || !fl) return;
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/flows/${fl}/messages`;
     const body = JSON.stringify({
       id: randomUUID(),
       content,
@@ -1320,26 +1494,30 @@ var RelayClient = class {
       console.warn("[arp-bridge] flow post failed:", sanitizeForTty(String(err)));
     }
   }
-  /** Channel memory text ("" if none or on error — never throws). */
+  /** Channel memory text (empty if none or on error — never throws). Branded (H2-4). */
   async fetchChannelMemory(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/memory`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return untrusted("");
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/memory`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
         console.warn("[arp-bridge] memory HTTP", res.status);
-        return "";
+        return untrusted("");
       }
       const data = await res.json();
-      return typeof data?.content === "string" ? data.content : "";
+      return untrusted(typeof data?.content === "string" ? data.content : "");
     } catch (err) {
       console.warn("[arp-bridge] memory fetch failed:", sanitizeForTty(String(err)));
-      return "";
+      return untrusted("");
     }
   }
   /** Channel topics with message counts ([] if none or on error). The relay returns
    *  topics with a `title` plus a separate `messageCounts` map keyed by topic id. */
   async fetchChannelTopics(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/topics`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/topics`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1349,7 +1527,7 @@ var RelayClient = class {
       const data = await res.json();
       const topics = data?.topics ?? [];
       const counts = data?.messageCounts ?? {};
-      return topics.filter((t) => typeof t?.title === "string").map((t) => ({ title: t.title, count: typeof counts[t.id] === "number" ? counts[t.id] : null }));
+      return topics.filter((t) => typeof t?.title === "string").map((t) => ({ title: untrusted(t.title), count: typeof counts[t.id] === "number" ? counts[t.id] : null }));
     } catch (err) {
       console.warn("[arp-bridge] topics fetch failed:", sanitizeForTty(String(err)));
       return [];
@@ -1357,7 +1535,9 @@ var RelayClient = class {
   }
   /** Pinned files marked inject_context=true, labeled with cached content ([] otherwise). */
   async fetchPinnedContext(channelId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/pins`;
+    const ch = this.pathId(channelId, "channelId");
+    if (!ch) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/pins`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1366,7 +1546,10 @@ var RelayClient = class {
       }
       const data = await res.json();
       const pins = data?.pins ?? [];
-      return pins.filter((p) => p?.injectContext && typeof p.cachedContent === "string" && p.cachedContent.trim()).map((p) => ({ label: p.displayName || `${p.repoUrl ?? ""}/${p.filePath ?? ""}`, content: p.cachedContent }));
+      return pins.filter((p) => p?.injectContext && typeof p.cachedContent === "string" && p.cachedContent.trim()).map((p) => ({
+        label: untrusted(p.displayName || `${p.repoUrl ?? ""}/${p.filePath ?? ""}`),
+        content: untrusted(p.cachedContent)
+      }));
     } catch (err) {
       console.warn("[arp-bridge] pins fetch failed:", sanitizeForTty(String(err)));
       return [];
@@ -1387,7 +1570,10 @@ var RelayClient = class {
   }
   /** Fetch a flow's transcript (used to backfill a minimal turn_notification). [] on error. */
   async fetchFlowMessages(channelId, flowId) {
-    const url = `${this.cfg.relayHttpUrl}/channels/${channelId}/flows/${flowId}/messages`;
+    const ch = this.pathId(channelId, "channelId");
+    const fl = this.pathId(flowId, "flowId");
+    if (!ch || !fl) return [];
+    const url = `${this.cfg.relayHttpUrl}/channels/${ch}/flows/${fl}/messages`;
     try {
       const res = await this.deps.fetchFn(url, { headers: { Authorization: `Bearer ${this.cfg.token}` } });
       if (!res.ok) {
@@ -1397,8 +1583,8 @@ var RelayClient = class {
       const data = await res.json();
       const list = Array.isArray(data) ? data : data.messages ?? [];
       return list.map((e) => ({
-        agentName: String(e.agentName ?? ""),
-        content: String(e.content ?? ""),
+        agentName: untrusted(String(e.agentName ?? "")),
+        content: untrusted(String(e.content ?? "")),
         messageType: e.messageType ?? e.type,
         turnNumber: e.turnNumber,
         createdAt: e.createdAt
@@ -1413,15 +1599,15 @@ var RelayClient = class {
 // src/flow.ts
 function renderFlowHistory(entries) {
   if (entries.length === 0) return "";
-  const lines = entries.map((e) => `${e.agentName || "someone"}: ${e.content}`);
+  const lines = entries.map((e) => utext`${firstNonEmpty([e.agentName], "someone")}: ${e.content}`);
   return `DISCUSSION HISTORY:
-${fence("flow discussion history", lines.join("\n"))}
+${fence("flow discussion history", joinUntrusted(lines, "\n"))}
 
 `;
 }
 function buildFlowPrompt(signal, agentName, channelId, toolMode = "readonly") {
   if (signal.kind === "direction") {
-    const candidates = (signal.candidates ?? []).join(", ");
+    const candidates = joinUntrusted(signal.candidates ?? [], ", ");
     const history2 = renderFlowHistory(signal.history);
     const hasHistory = history2 !== "";
     const preamble = hasHistory ? [``, history2.trimEnd(), ``, `Read the conversation above and decide who should speak next.`] : [``, `No turns have been taken yet \u2014 choose who should speak FIRST.`];
@@ -1433,7 +1619,7 @@ function buildFlowPrompt(signal, agentName, channelId, toolMode = "readonly") {
       fence("flow topic", signal.topic),
       ...preamble,
       `Available participants:`,
-      fence("flow participant names", candidates || "(none online)"),
+      fence("flow participant names", firstNonEmpty([candidates], "(none online)")),
       ``,
       `Reply with ONLY the name of the single participant who should speak next,`,
       `or reply with ONLY the word END to conclude the discussion and move to synthesis.`,
@@ -1461,6 +1647,22 @@ ${fence("flow topic", signal.topic)}
 ` + role + ctx + synth + "\n" + history + closer;
 }
 
+// src/promptLimit.ts
+var DEFAULT_MAX_PROMPT_CHARS = 4e5;
+function maxPromptChars(env = process.env) {
+  const n = Number(env.ARP_MAX_PROMPT_CHARS);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_MAX_PROMPT_CHARS;
+}
+function capPrompt(prompt, max = maxPromptChars()) {
+  if (prompt.length <= max) return prompt;
+  const headLen = Math.floor(max * 0.8);
+  const tailLen = max - headLen;
+  const removed = prompt.length - headLen - tailLen;
+  return prompt.slice(0, headLen) + `
+[...prompt truncated by bridge: ${removed} chars of channel content removed...]
+` + prompt.slice(prompt.length - tailLen);
+}
+
 // src/session.ts
 var SILENCE_SENTINEL = "<<silent>>";
 var ChannelSession = class {
@@ -1519,7 +1721,7 @@ ${toolStatusLine(this.toolMode)}
    */
   async submit(msg) {
     if (!this.session) throw new Error("ChannelSession not started");
-    const who = msg.senderName || msg.senderId || "someone";
+    const who = firstNonEmpty([msg.senderName, msg.senderId], "someone");
     const facts = assembleRosterFacts(this.roster, this.agentName);
     const rosterBlock = facts ? `${facts}
 
@@ -1534,7 +1736,7 @@ ${fence("channel message", msg.content)}
 ` + rosterBlock;
     const instructions = isAddressed(msg.content, this.agentName) ? "You were directly addressed (@mentioned), so respond. Output ONLY your channel message itself, concisely. Do NOT include the silence sentinel and do NOT explain whether or why you are responding." : `You received this as a passive channel message. You do NOT need to respond unless it is directly relevant to you. If you have nothing to add, reply with exactly ${SILENCE_SENTINEL} and nothing else. Otherwise output ONLY your channel message, concisely \u2014 do NOT explain whether or why you are responding.`;
     this.beacon?.begin();
-    this.session.submit(head + instructions);
+    this.session.submit(capPrompt(head + instructions));
   }
   /**
    * Run one bounded-flow turn or synthesis. Frames a MUST-RESPOND prompt (no
@@ -1555,7 +1757,7 @@ ${fence("channel message", msg.content)}
       let history = signal.history;
       if (history.length === 0) history = await this.flow.fetchHistory(signal.flowId);
       const prompt = buildFlowPrompt({ ...signal, history }, this.agentName, this.channelId, this.toolMode);
-      const reply = await this.session.converseLocal(prompt);
+      const reply = await this.session.converseLocal(capPrompt(prompt));
       await this.flow.postReply(signal.flowId, reply.trim() || "(no response)");
     } finally {
       this.beacon?.end();
@@ -1590,22 +1792,28 @@ ${fence("channel message", msg.content)}
   async submitCatchUp(result) {
     if (!this.session) throw new Error("ChannelSession not started");
     if (result.context.length === 0) return;
-    const transcript = result.context.map((m) => `[${m.createdAt}] ${m.senderName || m.senderId || "someone"}: ${m.content}`).join("\n");
+    const transcript = joinUntrusted(
+      result.context.map((m) => utext`[${m.createdAt}] ${firstNonEmpty([m.senderName, m.senderId], "someone")}: ${m.content}`),
+      "\n"
+    );
     if (result.mentions.length === 0) {
       if (!this.session.converseLocal) return;
       this.beacon?.begin();
       try {
-        await this.session.converseLocal(
-          this.promptHead() + `You just reconnected to ARP channel ${this.channelId} after being away. Here is what you missed (context only, do NOT reply to it):
-` + fence("missed channel messages", transcript)
-        );
+        await this.session.converseLocal(capPrompt(
+          this.promptHead() + `You just (re)connected to ARP channel ${this.channelId}. Here is recent channel history for context \u2014 you may have already seen some of it. Absorb it so you can follow back-references in later messages; do NOT reply to it:
+` + fence("recent channel history", transcript)
+        ));
       } finally {
         this.beacon?.end();
       }
       return;
     }
     const channelContext = this.fetchContext ? await this.fetchContext() : "";
-    const addressed = result.mentions.map((m) => `[${m.createdAt}] ${m.senderName || m.senderId || "someone"}: ${m.content}`).join("\n");
+    const addressed = joinUntrusted(
+      result.mentions.map((m) => utext`[${m.createdAt}] ${firstNonEmpty([m.senderName, m.senderId], "someone")}: ${m.content}`),
+      "\n"
+    );
     const head = this.promptHead() + channelContext + `You are ${this.agentName}. You just reconnected to ARP channel ${this.channelId} after being away. While you were gone, the channel said (context):
 ${fence("missed channel messages", transcript)}
 
@@ -1615,7 +1823,7 @@ ${fence("messages mentioning you", addressed)}
 `;
     const instructions = `Respond ONCE, concisely, to what was directed at you. If something is already resolved by the later messages above, say so briefly. Output ONLY your channel message \u2014 do NOT include the silence sentinel and do NOT explain whether or why you are responding.`;
     this.beacon?.begin();
-    this.session.submit(head + instructions);
+    this.session.submit(capPrompt(head + instructions));
   }
   async stop() {
     this.beacon?.stop?.();
@@ -1717,13 +1925,13 @@ function dropVendorNotifications(input) {
 
 // src/acp/client.ts
 var MODEL_AUTH_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
-var BRIDGE_CRED_ENV_KEYS = ["ARP_TOKEN", "ARP_INVITE", "ARP_CONFIG_DIR"];
+var BRIDGE_ENV_PREFIX = "ARP_";
 function buildAcpEnv(base, extra) {
   const merged = {};
   for (const [k, v] of Object.entries({ ...base, ...extra ?? {} })) {
     if (v === void 0) continue;
     if (MODEL_AUTH_ENV_KEYS.includes(k)) continue;
-    if (BRIDGE_CRED_ENV_KEYS.includes(k)) continue;
+    if (k.startsWith(BRIDGE_ENV_PREFIX)) continue;
     merged[k] = v;
   }
   return merged;
@@ -2291,7 +2499,7 @@ var ClaudeAdapter = class {
             if (full.length > 0) turnCbs.forEach((cb) => cb(full));
           } else {
             buffer = "";
-            console.warn("[arp-bridge] agent turn ended without success:", m.subtype);
+            console.warn("[arp-bridge] agent turn ended without success:", sanitizeForTty(String(m.subtype)));
           }
         }
       }
@@ -2453,8 +2661,8 @@ async function startBridge(cfg, relay, deps) {
   }
   relay.onInbound((m) => {
     if (m.isHistory) return;
-    if (m.senderId && m.senderId === cfg.agentUuid || m.senderName && m.senderName === cfg.agentName) return;
-    if (!m.content.trim()) return;
+    if (hasText(m.senderId) && sameText(m.senderId, cfg.agentUuid) || hasText(m.senderName) && sameText(m.senderName, cfg.agentName)) return;
+    if (isBlankText(m.content)) return;
     ensureSession(m.channelId).then((s) => s.submit(m)).catch((e) => console.warn(`[arp-bridge] inbound routing failed for channel ${sanitizeForTty(m.channelId)}:`, sanitizeForTty(String(e))));
   });
   relay.onFlowSignal((signal) => {
@@ -2516,11 +2724,13 @@ function reportFatalClose(code, reason) {
     console.error(`[arp-bridge] relay rejected the connection (close ${code}): ${sanitizeForTty(reason)}. Not retrying.`);
   }
 }
+function makeDefaultWsFactory(WebSocketImpl) {
+  return (url, protocols) => new WebSocketImpl(url, protocols, { maxPayload: WS_MAX_PAYLOAD_BYTES });
+}
 async function createAndStartBridge(cfg, deps = {}) {
   let wsFactory = deps.wsFactory;
   if (!wsFactory) {
-    const WebSocketImpl = (await import("ws")).default;
-    wsFactory = (url, protocols) => new WebSocketImpl(url, protocols);
+    wsFactory = makeDefaultWsFactory((await import("ws")).default);
   }
   const relay = new RelayClient(cfg, {
     wsFactory,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snowyroad/arp",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Connect your own coding agent (Claude Code, Codex, Gemini, Grok) to an Agent Relay Protocol channel and collaborate with other agents and humans.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "SnowyRoad",
@@ -20,6 +20,7 @@
   "engines": {
     "node": ">=20"
   },
+  "packageManager": "pnpm@9.15.4",
   "bin": {
     "arp": "dist/cli.js"
   },
@@ -33,23 +34,25 @@
     "prepublishOnly": "pnpm build",
     "dev": "tsx src/index.ts",
     "join": "tsx src/index.ts",
-    "generate-invite": "tsx scripts/generate-invite.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "0.24.0",
-    "@anthropic-ai/claude-agent-sdk": "0.1.77",
-    "ws": "8.21.0"
+    "@agentclientprotocol/sdk": "0.25.1",
+    "@anthropic-ai/claude-agent-sdk": "0.3.177",
+    "@anthropic-ai/sdk": "0.104.1",
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "ws": "8.21.0",
+    "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^25.9.3",
     "@types/ws": "^8.5.12",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
+    "typescript": "^6.0.3",
     "vitest": "^2.1.0"
   }
 }