@songsid/agend 2.1.0-beta.14 → 2.1.0-beta.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/access-path.js
CHANGED
|
@@ -9,10 +9,10 @@ import { join } from "node:path";
|
|
|
9
9
|
* entry points and the consequence of a traversal here is reading or writing
|
|
10
10
|
* an attacker-supplied file path.
|
|
11
11
|
*/
|
|
12
|
-
const
|
|
12
|
+
const SAFE_INSTANCE_NAME = /^[^/\\]+$/;
|
|
13
13
|
function assertSafeInstanceName(instance) {
|
|
14
|
-
if (!
|
|
15
|
-
throw new Error(`Invalid instance name "${instance}" — must
|
|
14
|
+
if (!instance || !SAFE_INSTANCE_NAME.test(instance) || instance === "." || instance === ".." || instance.includes("..")) {
|
|
15
|
+
throw new Error(`Invalid instance name "${instance}" — must not contain path separators or traversal`);
|
|
16
16
|
}
|
|
17
17
|
}
|
|
18
18
|
/**
|
package/dist/access-path.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-path.js","sourceRoot":"","sources":["../src/access-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,
|
|
1
|
+
{"version":3,"file":"access-path.js","sourceRoot":"","sources":["../src/access-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,mDAAmD,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,QAAgB,EAChB,YAA2C;IAE3C,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IACD,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC"}
|
package/dist/agent-endpoint.js
CHANGED
|
@@ -5,7 +5,8 @@ import { outboundHandlers } from "./outbound-handlers.js";
|
|
|
5
5
|
import { routeToolCall } from "./channel/tool-router.js";
|
|
6
6
|
/** Read the last real channel target persisted by the instance daemon. */
|
|
7
7
|
export function readPersistedReplyContext(dataDir, instance) {
|
|
8
|
-
|
|
8
|
+
// Prevent path traversal; allow Unicode (e.g. Chinese instance names)
|
|
9
|
+
if (!instance || instance.includes("/") || instance.includes("\\") || instance.includes(".."))
|
|
9
10
|
return null;
|
|
10
11
|
try {
|
|
11
12
|
const raw = JSON.parse(readFileSync(join(dataDir, "instances", instance, "last-chat.json"), "utf-8"));
|
|
@@ -61,8 +62,8 @@ const OP_MAP = {
|
|
|
61
62
|
function verifyInstanceToken(ctx, instance, provided) {
|
|
62
63
|
if (!provided)
|
|
63
64
|
return false;
|
|
64
|
-
// instance name must be a safe filename component
|
|
65
|
-
if (
|
|
65
|
+
// instance name must be a safe filename component (allow Unicode, block traversal)
|
|
66
|
+
if (!instance || instance.includes("/") || instance.includes("\\") || instance.includes(".."))
|
|
66
67
|
return false;
|
|
67
68
|
const tokenPath = join(ctx.dataDir, "instances", instance, "agent.token");
|
|
68
69
|
let expected;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agent-endpoint.js","sourceRoot":"","sources":["../src/agent-endpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAQzD,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,QAAgB;IACzE,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"agent-endpoint.js","sourceRoot":"","sources":["../src/agent-endpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAQzD,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,QAAgB;IACzE,sEAAsE;IACtE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAA4B,CAAC;QACjI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,MAAM,GAA2B;IACrC,UAAU;IACV,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,cAAc;IACpB,QAAQ,EAAE,qBAAqB;IAC/B,gBAAgB;IAChB,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,eAAe;IACvB,GAAG,EAAE,qBAAqB;IAC1B,SAAS,EAAE,WAAW;IACtB,sBAAsB;IACtB,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,mBAAmB;IAC7B,KAAK,EAAE,gBAAgB;IACvB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,iBAAiB,EAAE,iBAAiB;IACpC,QAAQ;IACR,aAAa,EAAE,aAAa;IAC5B,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,YAAY;IACzB,aAAa,EAAE,aAAa;IAC5B,cAAc;IACd,MAAM,EAAE,iBAAiB;IACzB,QAAQ,EAAE,qBAAqB;IAC/B,aAAa,EAAE,kBAAkB;CAClC,CAAC;AAeF;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,GAAyB,EACzB,QAAgB,EAChB,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,mFAAmF;IACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC1E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAmB,EACnB,GAAyB;IAEzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAIlD,CAAC;YAEF,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,OAAO,WAAW,KAAK,QAAQ;gBACnD,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAyB,EACzB,QAAgB,EAChB,EAAU,EACV,IAA6B;IAE7B,gBAAgB;IAChB,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,gBAAgB;IAChB,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,aAAa;IACb,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,6BAA6B;IAC7B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAc,IAAI,IAAI,CAAC,YAAsB,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,EAAE,KAAK,iBAAiB,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAqB,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,mCAAmC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACxF,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,MAAM,kBAAkB,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ,IAAI,IAAI;gBAC/E,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;gBACtD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,gBAAgB,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ;gBACnG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,CAAC,CAAC,EAAE,CAAC,CAAC;YACR,MAAM,gBAAgB,GAAG,GAAG,CAAC,eAAe,EAAE,sBAAsB,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,gBAAgB,IAAI,SAAS,EAAE,MAAM,IAAI,gBAAgB,CAAC;YACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,IAAI,kBAAkB,CAAC,CAAC;YAC5F,IAAI,IAAI,KAAK,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC9C,OAAO,CAAC,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5F,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;mBACtF,GAAG,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAQ,CAAC;YAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBACjF,0EAA0E;gBAC1E,wEAAwE;gBACxE,uEAAuE;gBACvE,oEAAoE;gBACpE,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,OAAO;oBAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAClE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,EAAE,KAAK,EAAE,2BAA2B,IAAI,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,wBAAwB,IAAI,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACnC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;AACL,CAAC"}
|