@vellumai/assistant 0.4.49 → 0.4.50

package/src/security/token-manager.ts

@@ -9,6 +9,7 @@
 
 import {
   getApp,
+  getConnection,
   getConnectionByProvider,
   getProvider,
   updateConnection,
@@ -116,14 +117,14 @@ function recordRefreshFailure(service: string): void {
 
 const inflightRefreshes = new Map<string, Promise<string>>();
 
-function deduplicatedRefresh(service: string): Promise<string> {
-  const existing = inflightRefreshes.get(service);
+function deduplicatedRefresh(service: string, connId: string): Promise<string> {
+  const existing = inflightRefreshes.get(connId);
   if (existing) return existing;
 
-  const promise = doRefresh(service).finally(() => {
-    inflightRefreshes.delete(service);
+  const promise = doRefresh(service, connId).finally(() => {
+    inflightRefreshes.delete(connId);
   });
-  inflightRefreshes.set(service, promise);
+  inflightRefreshes.set(connId, promise);
   return promise;
 }
 
@@ -157,18 +158,11 @@ export class TokenExpiredError extends Error {
 }
 
 /**
- * Check whether the access token for a service is expired or will expire
- * within the buffer window, based on the `expiresAt` field in the
- * oauth_connection row.
+ * Check whether a token is expired or will expire within the buffer window.
  */
-function isTokenExpired(service: string): boolean {
-  try {
-    const conn = getConnectionByProvider(service);
-    if (!conn?.expiresAt) return false;
-    return Date.now() >= conn.expiresAt - EXPIRY_BUFFER_MS;
-  } catch {
-    return false;
-  }
+function isTokenExpired(expiresAt: number | null): boolean {
+  if (!expiresAt) return false;
+  return Date.now() >= expiresAt - EXPIRY_BUFFER_MS;
 }
 
 // ── Refresh config resolution ─────────────────────────────────────────
@@ -191,8 +185,8 @@ interface RefreshConfig {
  * authMethod. Throws `TokenExpiredError` if the connection is not found
  * or incomplete.
  */
-function resolveRefreshConfig(service: string): RefreshConfig {
-  const conn = getConnectionByProvider(service);
+function resolveRefreshConfig(service: string, connId: string): RefreshConfig {
+  const conn = getConnection(connId);
   if (!conn) {
     throw new TokenExpiredError(
       service,
@@ -217,15 +211,15 @@ function resolveRefreshConfig(service: string): RefreshConfig {
   }
 
   const tokenUrl = provider.tokenUrl;
-  const clientId = app.clientId;
-  if (!tokenUrl || !clientId) {
+  const resolvedClientId = app.clientId;
+  if (!tokenUrl || !resolvedClientId) {
     throw new TokenExpiredError(
       service,
       `Missing OAuth2 refresh config for "${service}".${recoveryHint(service)}`,
     );
   }
 
-  const secret = getSecureKey(`oauth_app/${app.id}/client_secret`);
+  const secret = getSecureKey(app.clientSecretCredentialPath);
 
   const refreshToken = getSecureKey(
     `oauth_connection/${conn.id}/refresh_token`,
@@ -238,7 +232,7 @@ function resolveRefreshConfig(service: string): RefreshConfig {
   return {
     connId: conn.id,
     tokenUrl,
-    clientId,
+    clientId: resolvedClientId,
     secret,
     refreshToken,
     authMethod,
@@ -254,10 +248,15 @@ function resolveRefreshConfig(service: string): RefreshConfig {
  * Returns the new access token on success.
  * Throws `TokenExpiredError` if refresh is not possible.
  */
-async function doRefresh(service: string): Promise<string> {
-  const refreshConfig = resolveRefreshConfig(service);
-  const { tokenUrl, clientId, secret, authMethod, connId, refreshToken } =
-    refreshConfig;
+async function doRefresh(service: string, connId: string): Promise<string> {
+  const refreshConfig = resolveRefreshConfig(service, connId);
+  const {
+    tokenUrl,
+    clientId: resolvedClientId,
+    secret,
+    authMethod,
+    refreshToken,
+  } = refreshConfig;
 
   if (!refreshToken) {
     throw new TokenExpiredError(
@@ -266,8 +265,8 @@ async function doRefresh(service: string): Promise<string> {
     );
   }
 
-  if (isRefreshBreakerOpen(service)) {
-    const state = refreshBreakers.get(service)!;
+  if (isRefreshBreakerOpen(connId)) {
+    const state = refreshBreakers.get(connId)!;
     const remainingMs = state.cooldownMs - (Date.now() - state.openedAt);
     throw new TokenExpiredError(
       service,
@@ -282,13 +281,13 @@ async function doRefresh(service: string): Promise<string> {
   try {
     result = await refreshOAuth2Token(
       tokenUrl,
-      clientId,
+      resolvedClientId,
       refreshToken,
       secret,
       authMethod,
     );
   } catch (err) {
-    recordRefreshFailure(service);
+    recordRefreshFailure(connId);
     if (isCredentialError(err)) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new TokenExpiredError(
@@ -349,7 +348,7 @@ async function doRefresh(service: string): Promise<string> {
     );
   }
 
-  recordRefreshSuccess(service);
+  recordRefreshSuccess(connId);
   log.info({ service }, "OAuth2 access token refreshed successfully");
   return result.accessToken;
 }
@@ -368,12 +367,13 @@ async function doRefresh(service: string): Promise<string> {
 export async function withValidToken<T>(
   service: string,
   callback: (token: string) => Promise<T>,
+  clientId?: string,
 ): Promise<T> {
-  const conn = getConnectionByProvider(service);
+  const conn = getConnectionByProvider(service, clientId);
   let token = conn
     ? getSecureKey(`oauth_connection/${conn.id}/access_token`)
     : undefined;
-  if (!token) {
+  if (!token || !conn) {
     throw new TokenExpiredError(
       service,
       `No access token found for "${service}". Authorization required.${recoveryHint(service)}`,
@@ -381,15 +381,15 @@ export async function withValidToken<T>(
   }
 
   // Proactively refresh if expired or about to expire.
-  if (isTokenExpired(service)) {
-    token = await deduplicatedRefresh(service);
+  if (isTokenExpired(conn.expiresAt)) {
+    token = await deduplicatedRefresh(service, conn.id);
   }
 
   try {
     return await callback(token);
   } catch (err: unknown) {
     if (is401Error(err)) {
-      token = await deduplicatedRefresh(service);
+      token = await deduplicatedRefresh(service, conn.id);
       return callback(token);
     }
     throw err;

package/src/skills/catalog-install.ts

@@ -10,7 +10,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, posix, resolve, sep } from "node:path";
 import { gunzipSync } from "node:zlib";
 
 import { getLogger } from "../util/logger.js";
@@ -160,16 +160,35 @@ export function extractTarToDir(tarBuffer: Buffer, destDir: string): boolean {
 
     // Skip directories and empty names
     if (name && typeFlag !== 53 /* '5' */) {
-      // Prevent path traversal
-      const normalizedName = name.replace(/^\.\//, "");
-      if (!normalizedName.startsWith("..") && !normalizedName.includes("/..")) {
-        const destPath = join(destDir, normalizedName);
+      // Prevent path traversal and absolute path writes
+      const normalizedName = name.replace(/\\/g, "/").replace(/^\.\/+/, "");
+      const normalizedPath = posix.normalize(normalizedName);
+      const hasWindowsDrivePrefix = /^[a-zA-Z]:\//.test(normalizedPath);
+      const isTraversal =
+        normalizedPath === ".." || normalizedPath.startsWith("../");
+
+      if (
+        normalizedPath &&
+        normalizedPath !== "." &&
+        !normalizedPath.startsWith("/") &&
+        !hasWindowsDrivePrefix &&
+        !isTraversal
+      ) {
+        const destRoot = resolve(destDir);
+        const destPath = resolve(destRoot, normalizedPath);
+        const insideDestination =
+          destPath === destRoot || destPath.startsWith(destRoot + sep);
+        if (!insideDestination) {
+          offset += Math.ceil(size / 512) * 512;
+          continue;
+        }
+
         mkdirSync(dirname(destPath), { recursive: true });
         writeFileSync(destPath, tarBuffer.subarray(offset, offset + size));
 
         if (
-          normalizedName === "SKILL.md" ||
-          normalizedName.endsWith("/SKILL.md")
+          normalizedPath === "SKILL.md" ||
+          normalizedPath.endsWith("/SKILL.md")
         ) {
           foundSkillMd = true;
         }
@@ -319,27 +338,63 @@ export async function installSkillLocally(
 
 // ─── Auto-install (for skill_load) ──────────────────────────────────────────
 
+/**
+ * Resolve the catalog skill list, checking local (dev mode) first, then remote.
+ *
+ * In dev mode with a local catalog, returns local entries immediately to avoid
+ * unnecessary network latency.  Pass `skillId` to trigger a deferred remote
+ * fetch only when the requested skill is not found locally — this preserves the
+ * ability to discover remote-only skills without penalising every call with a
+ * 10s timeout on flaky networks.
+ *
+ * Callers that install multiple skills in a loop should call this once and pass
+ * the result to `autoInstallFromCatalog` to avoid redundant network requests.
+ */
+export async function resolveCatalog(
+  skillId?: string,
+): Promise<CatalogSkill[]> {
+  const repoSkillsDir = getRepoSkillsDir();
+  if (repoSkillsDir) {
+    const local = readLocalCatalog(repoSkillsDir);
+    if (local.length > 0) {
+      // If no specific skill requested, or it exists locally, skip remote fetch
+      if (!skillId || local.some((s) => s.id === skillId)) {
+        return local;
+      }
+      // Skill not found locally — merge with remote so remote-only skills
+      // can still be discovered. Local entries take precedence by id.
+      try {
+        const remote = await fetchCatalog();
+        const localIds = new Set(local.map((s) => s.id));
+        return [...local, ...remote.filter((s) => !localIds.has(s.id))];
+      } catch {
+        return local;
+      }
+    }
+  }
+
+  return fetchCatalog();
+}
+
 /**
  * Attempt to find and install a skill from the first-party catalog.
  * Returns true if the skill was installed, false if not found in catalog.
  * Throws on install failures (network, filesystem, etc).
+ *
+ * When `catalog` is provided it is used directly, avoiding a redundant
+ * network fetch — pass a pre-resolved catalog when calling in a loop.
  */
 export async function autoInstallFromCatalog(
   skillId: string,
+  catalog?: CatalogSkill[],
 ): Promise<boolean> {
-  // Check local catalog first (dev mode), then remote
-  const repoSkillsDir = getRepoSkillsDir();
-  let entry: CatalogSkill | undefined;
+  let skills: CatalogSkill[];
 
-  if (repoSkillsDir) {
-    const localCatalog = readLocalCatalog(repoSkillsDir);
-    entry = localCatalog.find((s) => s.id === skillId);
-  }
-
-  if (!entry) {
+  if (catalog) {
+    skills = catalog;
+  } else {
     try {
-      const remoteCatalog = await fetchCatalog();
-      entry = remoteCatalog.find((s) => s.id === skillId);
+      skills = await resolveCatalog(skillId);
     } catch (err) {
       log.warn(
         { err, skillId },
@@ -349,6 +404,7 @@ export async function autoInstallFromCatalog(
     }
   }
 
+  const entry = skills.find((s) => s.id === skillId);
   if (!entry) {
     return false;
   }