@tequila99/githuman 0.7.0 → 0.9.0

package/dist/server/services/terminal/registry.js

@@ -42,15 +42,18 @@ export class TerminalRegistry {
     }
     get(id) {
         const entry = this.entries.get(id);
-        if (!entry)
+        if (!entry) {
             throw new TerminalNotFoundError('Terminal session no longer exists.');
+        }
         return entry.session;
     }
     async create(cols, rows) {
-        if (this.stopped)
+        if (this.stopped) {
             throw new TerminalNotFoundError('Terminal server is stopping.');
-        if (this.entries.size + this.creating >= MAX_TERMINAL_SESSIONS)
+        }
+        if (this.entries.size + this.creating >= MAX_TERMINAL_SESSIONS) {
             throw new TerminalLimitError('The terminal limit has been reached.');
+        }
         this.creating++;
         try {
             const backend = await (this.options.backend ?? createBackend)(this.options.repositoryPath, cols, rows);
@@ -78,16 +81,18 @@ export class TerminalRegistry {
     }
     attach(id, subscriber) {
         const entry = this.entries.get(id);
-        if (!entry)
+        if (!entry) {
             throw new TerminalNotFoundError('Terminal session no longer exists.');
+        }
         entry.subscribers.add(subscriber);
         entry.orphanedSince = null;
         entry.idleSince = null;
     }
     detach(subscriber) {
         for (const entry of this.entries.values()) {
-            if (!entry.subscribers.delete(subscriber) || entry.subscribers.size)
+            if (!entry.subscribers.delete(subscriber) || entry.subscribers.size) {
                 continue;
+            }
             entry.orphanedSince = this.now();
             entry.idleSince = entry.session.running === 'idle' ? this.now() : null;
         }

package/dist/server/services/terminal/session.js

@@ -99,8 +99,9 @@ export class TerminalSession {
             let end = Math.min(data.length, offset + FRAME_PART_UNITS);
             if (end < data.length &&
                 data.charCodeAt(end - 1) >= HIGH_SURROGATE_FIRST &&
-                data.charCodeAt(end - 1) <= HIGH_SURROGATE_LAST)
+                data.charCodeAt(end - 1) <= HIGH_SURROGATE_LAST) {
                 end--;
+            }
             const part = data.slice(offset, end);
             offset = end;
             const bytes = Buffer.byteLength(part);
@@ -131,8 +132,9 @@ export class TerminalSession {
                 .catch(() => this.onExit())
                 .finally(() => {
                 this.pendingBytes -= bytes;
-                if (!this.stopped && this.pendingBytes < QUEUE_RESUME_BYTES)
+                if (!this.stopped && this.pendingBytes < QUEUE_RESUME_BYTES) {
                     this.updateFlow();
+                }
             });
         }
     }
@@ -167,8 +169,9 @@ export class TerminalSession {
                 scrollback = Math.floor(scrollback / 2);
                 data = this.serializer.serialize({ scrollback }) + this.tail.tail;
             }
-            if (Buffer.byteLength(data) > TERMINAL_SNAPSHOT_BYTES)
+            if (Buffer.byteLength(data) > TERMINAL_SNAPSHOT_BYTES) {
                 throw new TerminalError('Terminal snapshot exceeds its limit.');
+            }
             send({
                 type: 'snapshot',
                 terminalId: this.id,
@@ -186,8 +189,9 @@ export class TerminalSession {
             this.backend.write(data);
     }
     line(data) {
-        if (this.backend.mode !== 'pipe')
+        if (this.backend.mode !== 'pipe') {
             throw new TerminalError('Line input requires limited mode.');
+        }
         this.output(data.replace(/\n/g, '\r\n') + '\r\n');
         this.backend.write(data + '\n');
     }
@@ -203,8 +207,9 @@ export class TerminalSession {
         this.flush();
         this.queue = this.queue
             .then(() => {
-            if (this.stopped || (cols === this.cols && rows === this.rows))
+            if (this.stopped || (cols === this.cols && rows === this.rows)) {
                 return undefined;
+            }
             this.backend.resize(cols, rows);
             this.terminal.resize(cols, rows);
             this.cols = cols;

package/dist/server/services/terminal/tokens.js

@@ -10,8 +10,9 @@ export class TerminalTokens {
     }
     issue(origin) {
         this.prune();
-        if (this.tokens.size >= MAX_TOKENS)
+        if (this.tokens.size >= MAX_TOKENS) {
             this.tokens.delete(this.tokens.keys().next().value ?? '');
+        }
         const token = randomBytes(32).toString('base64url');
         this.tokens.set(token, { origin, expires: this.now() + TERMINAL_TOKEN_MS });
         return token;
@@ -22,9 +23,10 @@ export class TerminalTokens {
         return !!info && info.expires > this.now() && info.origin === origin;
     }
     prune() {
-        for (const [token, info] of this.tokens)
+        for (const [token, info] of this.tokens) {
             if (info.expires <= this.now())
                 this.tokens.delete(token);
+        }
     }
     clear() {
         this.tokens.clear();

package/dist/server/utils/hash.js

@@ -0,0 +1,4 @@
+import { createHash } from 'node:crypto';
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}

package/dist/server/utils/note-asset-format.js

@@ -0,0 +1,19 @@
+import { fileTypeFromBuffer } from 'file-type';
+import { NOTE_ASSET_FORMATS, SUPPORTED_NOTE_ASSETS } from "../../shared/notes/asset-formats.js";
+import { BadRequestError } from "../errors/http.js";
+export async function detectNoteAssetFormat(bytes) {
+    let detected;
+    try {
+        detected = await fileTypeFromBuffer(bytes);
+    }
+    catch (cause) {
+        throw new BadRequestError('Could not identify attachment format', { cause });
+    }
+    const format = detected &&
+        NOTE_ASSET_FORMATS.find(candidate => candidate.extension === detected.ext ||
+            candidate.aliases.some(alias => alias === detected.ext));
+    if (!format) {
+        throw new BadRequestError('Supported attachments: ' + SUPPORTED_NOTE_ASSETS);
+    }
+    return format;
+}

package/dist/server/utils/remote-asset-request.js

@@ -0,0 +1,193 @@
+import { lookup } from 'node:dns/promises';
+import { BlockList, isIP } from 'node:net';
+import { Agent, request } from 'undici';
+import { BadRequestError } from "../errors/http.js";
+import { isCredentialFreeWebUrl } from "../../shared/utils/web-url.js";
+// Stop connection attempts that cannot establish a socket promptly.
+const CONNECTION_TIMEOUT_MS = 10000;
+// Stop responses that send no headers or no body data.
+const RESPONSE_IDLE_TIMEOUT_MS = 15000;
+// Bound the size of response headers.
+const MAX_HEADER_BYTES = 16384;
+// Stop redirect chains and loops.
+const MAX_REDIRECTS = 5;
+// Only these statuses ask the client to follow a Location header.
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+// Network failures that mean the remote server cannot serve the attachment.
+const UNREACHABLE_CODES = new Set([
+    'ENOTFOUND',
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ETIMEDOUT',
+    'UND_ERR_SOCKET'
+]);
+// Ask servers for the exact bytes: compressed bodies are not supported.
+const REQUEST_HEADERS = {
+    'accept-encoding': 'identity',
+    'user-agent': 'githuman-note-assets'
+};
+// Exclude non-public IPv4 ranges before opening any socket.
+const BLOCKED_IPV4 = new BlockList();
+// IPv6 routing must be public and must exclude special-purpose ranges.
+const PUBLIC_IPV6 = new BlockList();
+const BLOCKED_IPV6 = new BlockList();
+for (const [address, prefix] of [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.0.2.0', 24],
+    ['192.88.99.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['198.51.100.0', 24],
+    ['203.0.113.0', 24],
+    ['224.0.0.0', 3]
+]) {
+    BLOCKED_IPV4.addSubnet(address, prefix, 'ipv4');
+}
+// Only globally routable IPv6 is eligible, with special-purpose ranges excluded.
+PUBLIC_IPV6.addSubnet('2000::', 3, 'ipv6');
+BLOCKED_IPV6.addSubnet('2001::', 23, 'ipv6');
+BLOCKED_IPV6.addSubnet('2001:db8::', 32, 'ipv6');
+BLOCKED_IPV6.addSubnet('2002::', 16, 'ipv6');
+BLOCKED_IPV6.addSubnet('3fff::', 20, 'ipv6');
+export function isPublicAssetAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return !BLOCKED_IPV4.check(address, 'ipv4');
+    return (family === 6 &&
+        PUBLIC_IPV6.check(address, 'ipv6') &&
+        !BLOCKED_IPV6.check(address, 'ipv6'));
+}
+/**
+ * Resolves a host name and refuses non-public results. The socket connects to
+ * the checked address, so no second lookup can change the target.
+ */
+export function createPublicLookup(resolveHost = lookup) {
+    return (hostname, options, callback) => {
+        void (async () => {
+            let addresses;
+            try {
+                addresses = await resolveHost(hostname, { all: true, verbatim: true });
+            }
+            catch (error) {
+                callback(error instanceof Error ? error : new Error(String(error)), '');
+                return;
+            }
+            const first = addresses[0];
+            if (!first ||
+                addresses.some(item => !isPublicAssetAddress(item.address))) {
+                callback(new BadRequestError('Attachment address is not public'), '');
+            }
+            else if (options.all) {
+                callback(null, addresses);
+            }
+            else {
+                callback(null, first.address, first.family);
+            }
+        })();
+    };
+}
+function createAgent(resolveHost) {
+    return new Agent({
+        connect: {
+            lookup: createPublicLookup(resolveHost),
+            timeout: CONNECTION_TIMEOUT_MS
+        },
+        connectTimeout: CONNECTION_TIMEOUT_MS,
+        headersTimeout: RESPONSE_IDLE_TIMEOUT_MS,
+        bodyTimeout: RESPONSE_IDLE_TIMEOUT_MS,
+        maxHeaderSize: MAX_HEADER_BYTES
+    });
+}
+// Undici ignores an abort while it waits for a socket, so the wait ends here.
+async function untilAborted(work, signal, discard) {
+    let abort;
+    const aborted = new Promise((_resolve, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+    });
+    try {
+        return await Promise.race([work, aborted]);
+    }
+    catch (error) {
+        // A request that finishes after the abort still owns a socket.
+        work.then(discard, () => undefined);
+        throw error;
+    }
+    finally {
+        if (abort)
+            signal.removeEventListener('abort', abort);
+    }
+}
+let sharedAgent;
+function parseAssetUrl(value, message, base) {
+    let url;
+    try {
+        url = new URL(value, base);
+    }
+    catch {
+        throw new BadRequestError(message);
+    }
+    if (!isCredentialFreeWebUrl(url)) {
+        throw new BadRequestError('Only public HTTP and HTTPS attachments are supported');
+    }
+    return url;
+}
+export async function remoteAssetRequest(source, method, signal, options = {}) {
+    const dispatcher = options.dispatcher ??
+        (options.resolveHost
+            ? createAgent(options.resolveHost)
+            : (sharedAgent ??= createAgent()));
+    let url = parseAssetUrl(source, 'Invalid attachment URL');
+    for (let redirects = 0;; redirects++) {
+        signal.throwIfAborted();
+        // The socket layer skips the lookup for IP literals, so check them here.
+        const host = url.hostname.replace(/^\[|\]$/g, '');
+        if (isIP(host) && !isPublicAssetAddress(host)) {
+            throw new BadRequestError('Attachment address is not public');
+        }
+        const { statusCode, headers, body } = await untilAborted(request(url, { method, signal, dispatcher, headers: REQUEST_HEADERS }), signal, late => late.body.destroy());
+        if (!REDIRECT_STATUSES.includes(statusCode)) {
+            return Object.assign(body, { statusCode, headers });
+        }
+        body.destroy();
+        if (redirects >= MAX_REDIRECTS) {
+            throw new BadRequestError('Too many attachment redirects');
+        }
+        const location = headers.location;
+        if (!location || Array.isArray(location)) {
+            throw new BadRequestError('Attachment redirect has no valid location');
+        }
+        const next = parseAssetUrl(location, 'Invalid attachment redirect', url);
+        if (url.protocol === 'https:' && next.protocol !== 'https:') {
+            throw new BadRequestError('Insecure attachment redirect');
+        }
+        url = next;
+    }
+}
+/** Maps transport failures to client errors; other errors pass through. */
+export function translateRemoteAssetError(error) {
+    const code = typeof error === 'object' && error !== null && 'code' in error
+        ? error.code
+        : undefined;
+    if (error instanceof DOMException && error.name === 'TimeoutError') {
+        return new BadRequestError('Attachment download took too long');
+    }
+    if (code === 'UND_ERR_CONNECT_TIMEOUT') {
+        return new BadRequestError('Attachment connection timed out');
+    }
+    if (code === 'UND_ERR_HEADERS_TIMEOUT' || code === 'UND_ERR_BODY_TIMEOUT') {
+        return new BadRequestError('Attachment download stalled');
+    }
+    if (typeof code === 'string' && UNREACHABLE_CODES.has(code)) {
+        return new BadRequestError('Attachment server could not be reached');
+    }
+    return error;
+}

package/dist/server/utils/request-abort.js

@@ -0,0 +1,20 @@
+/**
+ * Runs `work` with a signal that aborts when the client closes the connection
+ * before the response ends. A normal finish does not abort the signal.
+ */
+export async function withRequestSignal(reply, work) {
+    const controller = new AbortController();
+    const abort = () => {
+        if (!reply.raw.writableFinished)
+            controller.abort();
+    };
+    if (reply.raw.destroyed)
+        abort();
+    reply.raw.once('close', abort);
+    try {
+        return await work(controller.signal);
+    }
+    finally {
+        reply.raw.removeListener('close', abort);
+    }
+}

package/dist/server/utils/system-error.js

@@ -0,0 +1,14 @@
+export function hasErrorCode(error, ...codes) {
+    return (error !== null &&
+        typeof error === 'object' &&
+        'code' in error &&
+        typeof error.code === 'string' &&
+        codes.includes(error.code));
+}
+export function isSystemError(error, code) {
+    return error instanceof Error && hasErrorCode(error, code);
+}
+// Git file reads treat a non-directory path component as a missing path.
+export function isMissingPathError(error) {
+    return hasErrorCode(error, 'ENOENT', 'ENOTDIR');
+}

package/dist/shared/agents/schemas.js

@@ -37,6 +37,20 @@ export const FileSearchQuery = Type.Object({
     }))
 });
 export const ContextItem = Type.Union([
+    Type.Object({
+        kind: Type.Literal('note', { description: 'A project note.' }),
+        noteId: Type.String({ minLength: 1, description: 'Stable note UUID.' }),
+        storageId: Type.String({
+            minLength: 1,
+            description: 'Notes storage identity.'
+        }),
+        name: Type.String({
+            minLength: 1,
+            description: 'Display name when attached.'
+        })
+    }, {
+        description: 'The current Markdown of a note, including YAML properties.'
+    }),
     Type.Object({
         kind: Type.Literal('diff', { description: 'Live working-tree diff.' }),
         source: DiffSourceNameSchema,

package/dist/shared/events/types.js

@@ -10,5 +10,6 @@ export const SERVER_EVENT_TYPES = [
     'comment:created',
     'comment:updated',
     'comment:deleted',
+    'notes:changed',
     'files:changed'
 ];

package/dist/shared/notes/asset-formats.js

@@ -0,0 +1,57 @@
+import { MAX_NOTE_ASSET_BYTES, MAX_NOTE_PDF_BYTES } from "./constants.js";
+// Keep upload policy, response MIME types and asset identifiers in agreement.
+export const NOTE_ASSET_FORMATS = [
+    // Animated PNG retains the same storage extension as existing PNG attachments.
+    {
+        extension: 'png',
+        mime: 'image/png',
+        label: 'PNG',
+        display: 'image',
+        maxBytes: MAX_NOTE_ASSET_BYTES,
+        aliases: ['apng']
+    },
+    {
+        extension: 'jpg',
+        mime: 'image/jpeg',
+        label: 'JPEG',
+        display: 'image',
+        maxBytes: MAX_NOTE_ASSET_BYTES,
+        aliases: ['jpeg']
+    },
+    {
+        extension: 'gif',
+        mime: 'image/gif',
+        label: 'GIF',
+        display: 'image',
+        maxBytes: MAX_NOTE_ASSET_BYTES,
+        aliases: []
+    },
+    {
+        extension: 'webp',
+        mime: 'image/webp',
+        label: 'WebP',
+        display: 'image',
+        maxBytes: MAX_NOTE_ASSET_BYTES,
+        aliases: []
+    },
+    {
+        extension: 'pdf',
+        mime: 'application/pdf',
+        label: 'PDF',
+        display: 'link',
+        maxBytes: MAX_NOTE_PDF_BYTES,
+        aliases: []
+    }
+];
+// Existing content hashes and extensions remain valid across server upgrades.
+export const NOTE_ASSET_ID_PATTERN = `^[a-f0-9]{64}\\.(${NOTE_ASSET_FORMATS.map(format => format.extension).join('|')})$`;
+// Error messages follow the same allowlist as upload validation.
+export const SUPPORTED_NOTE_ASSETS = NOTE_ASSET_FORMATS.map(format => format.label).join(', ');
+// Extensions that identify an image attachment, including accepted aliases.
+export const NOTE_IMAGE_EXTENSIONS = NOTE_ASSET_FORMATS.filter(format => format.display === 'image').flatMap(format => [format.extension, ...format.aliases]);
+export function noteAssetFormat(extension) {
+    return NOTE_ASSET_FORMATS.find(format => format.extension === extension);
+}
+export function maxNoteAssetBytes(kind) {
+    return kind === 'pdf' ? MAX_NOTE_PDF_BYTES : MAX_NOTE_ASSET_BYTES;
+}

package/dist/shared/notes/constants.js

@@ -0,0 +1,7 @@
+// Bound image uploads in both the browser and the multipart parser.
+export const MAX_NOTE_ASSET_BYTES = 10_000_000;
+// PDF imports require confirmation above the smaller threshold.
+export const NOTE_PDF_WARNING_BYTES = 50_000_000;
+export const MAX_NOTE_PDF_BYTES = 100_000_000;
+// This bounds useful downloads in one client operation.
+export const MAX_NOTE_IMPORT_BYTES = 200_000_000;

package/dist/shared/notes/document.js

@@ -0,0 +1,118 @@
+import { isRecord } from "../utils/guards.js";
+import { errorMessage } from "../utils/error-message.js";
+import { isMap, isSeq, isScalar, parseDocument } from 'yaml';
+export function splitNote(text) {
+    const bom = text.startsWith('\uFEFF') ? '\uFEFF' : '';
+    const source = text.slice(bom.length);
+    if (!/^---\r?\n/.test(source)) {
+        return {
+            head: bom,
+            body: source,
+            yaml: '',
+            eol: text.includes('\r\n') ? '\r\n' : '\n'
+        };
+    }
+    const match = source.match(/^---\r?\n([\s\S]*?)(?:^---[ \t]*(?:\r?\n|$))/m);
+    if (!match)
+        throw new Error('Unclosed YAML frontmatter');
+    return {
+        head: bom + match[0],
+        body: source.slice(match[0].length),
+        yaml: match[1] ?? '',
+        eol: match[0].includes('\r\n') ? '\r\n' : '\n'
+    };
+}
+export function noteMetadata(text) {
+    try {
+        const { doc } = parseNoteHeader(text);
+        const tags = doc.get('tags');
+        if (tags === undefined)
+            return { tags: [], error: null };
+        if (!isSeq(tags) ||
+            tags.items.some(item => !isScalar(item) || typeof item.value !== 'string')) {
+            throw new Error('tags must be a list of strings');
+        }
+        return {
+            tags: normalizeTags(tags.items.map(item => (isScalar(item) ? String(item.value) : ''))),
+            error: null
+        };
+    }
+    catch (error) {
+        return {
+            tags: [],
+            error: errorMessage(error)
+        };
+    }
+}
+export function normalizeTags(tags) {
+    return [...new Set(tags.map(tag => tag.trim()).filter(Boolean))];
+}
+export function setNoteTags(text, tags) {
+    const metadata = noteMetadata(text);
+    if (metadata.error)
+        throw new Error(metadata.error);
+    const next = normalizeTags(tags);
+    if (JSON.stringify(next) === JSON.stringify(metadata.tags))
+        return text;
+    const { parts, doc } = parseNoteHeader(text);
+    doc.set('tags', next);
+    return writeNoteHeader(text, parts, doc.toString());
+}
+function parseNoteHeader(text) {
+    const parts = splitNote(text);
+    const doc = parseDocument(parts.yaml);
+    if (doc.errors.length)
+        throw new Error(doc.errors[0]?.message);
+    if (doc.contents && !isMap(doc.contents)) {
+        throw new Error('Frontmatter must be a YAML mapping');
+    }
+    return { parts, doc };
+}
+export function noteProperties(text) {
+    const { doc } = parseNoteHeader(text);
+    if (!isMap(doc.contents))
+        return [];
+    const values = doc.toJS({ maxAliasCount: 100 });
+    if (!isRecord(values))
+        return [];
+    return doc.contents.items.map(item => {
+        if (!isScalar(item.key) || typeof item.key.value !== 'string') {
+            throw new Error('Property names must be strings');
+        }
+        const key = item.key.value;
+        return { key, value: values[key] };
+    });
+}
+function writeNoteHeader(text, parts, yaml) {
+    const bom = text.startsWith('\uFEFF') ? '\uFEFF' : '';
+    return (bom +
+        '---' +
+        parts.eol +
+        yaml.replace(/\n/g, parts.eol) +
+        '---' +
+        parts.eol +
+        parts.body);
+}
+export function setNoteProperty(text, key, value) {
+    if (!key.trim())
+        throw new Error('Property name must not be empty');
+    if (key === 'tags') {
+        if (!Array.isArray(value))
+            throw new Error('tags must be a list of strings');
+        return setNoteTags(text, value);
+    }
+    const { parts, doc } = parseNoteHeader(text);
+    const current = noteProperties(text).find(property => property.key === key);
+    if (current && JSON.stringify(current.value) === JSON.stringify(value)) {
+        return text;
+    }
+    doc.set(key, value);
+    return writeNoteHeader(text, parts, doc.toString());
+}
+export function removeNoteProperty(text, key) {
+    const { parts, doc } = parseNoteHeader(text);
+    if (!doc.has(key))
+        return text;
+    doc.delete(key);
+    return writeNoteHeader(text, parts, doc.toString());
+}