@xopcai/xopc 0.0.81 → 0.0.82

package/dist/src/gateway/service.js

@@ -33,9 +33,9 @@ import { AgentService } from "../agent/service.js";
 import { ChannelManager } from "../channels/manager.js";
 import { ConfigHotReloader } from "../config/reload.js";
 import "../config/index.js";
-import { resolveEffectiveGatewayPort } from "./host.js";
 import { CronService } from "../cron/service.js";
 import "../cron/index.js";
+import { resolveEffectiveGatewayPort } from "./host.js";
 import { computeBundledExtensionExtensionsPatch } from "../extensions/bundled-extension-activation.js";
 import { getExtensionLockfileManager } from "../extensions/lockfile.js";
 import { installExtensionFromStoreZip, peekExtensionIdFromStoreZip } from "../extensions/install.js";

package/dist/src/share/share-rate-limit.js

@@ -1,5 +1,9 @@
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
 import { createFixedWindowRateLimiter } from "../infra/rate-limit.js";
 //#region src/share/share-rate-limit.ts
+init_logger();
+const log = createLogger("ShareRateLimit");
 /** Per-IP rate limiter for public share download routes. */
 const SHORT_WINDOW_MAX = 60;
 const SHORT_WINDOW_MS = 6e4;
@@ -17,7 +21,16 @@ function consumeSharePublicLimit(clientIp) {
 		shortLimiters.set(clientIp, shortLimiter);
 	}
 	const shortResult = shortLimiter.consume();
-	if (!shortResult.allowed) return shortResult;
+	if (!shortResult.allowed) {
+		log.warn({
+			clientIp,
+			limit: SHORT_WINDOW_MAX,
+			windowSec: Math.round(SHORT_WINDOW_MS / 1e3),
+			retryAfterSec: Math.ceil(shortResult.retryAfterMs / 1e3),
+			reason: "short_window_exceeded"
+		}, `Share public rate limit exceeded: ${SHORT_WINDOW_MAX} req/${SHORT_WINDOW_MS / 1e3}s per IP`);
+		return shortResult;
+	}
 	let longLimiter = longLimiters.get(clientIp);
 	if (!longLimiter) {
 		longLimiter = createFixedWindowRateLimiter({
@@ -26,7 +39,15 @@ function consumeSharePublicLimit(clientIp) {
 		});
 		longLimiters.set(clientIp, longLimiter);
 	}
-	return longLimiter.consume();
+	const longResult = longLimiter.consume();
+	if (!longResult.allowed) log.warn({
+		clientIp,
+		limit: LONG_WINDOW_MAX,
+		windowSec: Math.round(LONG_WINDOW_MS / 1e3),
+		retryAfterSec: Math.ceil(longResult.retryAfterMs / 1e3),
+		reason: "long_window_exceeded"
+	}, `Share public rate limit exceeded: ${LONG_WINDOW_MAX} req/${LONG_WINDOW_MS / 6e4}min per IP`);
+	return longResult;
 }
 /** @internal */
 function resetSharePublicLimitsForTests() {

package/dist/src/share/share-rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"share-rate-limit.js","names":[],"sources":["../../../src/share/share-rate-limit.ts"],"sourcesContent":["import { createFixedWindowRateLimiter, type RateLimitResult } from '../infra/rate-limit.js';\n\n/** Per-IP rate limiter for public share download routes. */\nconst SHORT_WINDOW_MAX = 60;\nconst SHORT_WINDOW_MS = 60_000;\n\nconst LONG_WINDOW_MAX = 300;\nconst LONG_WINDOW_MS = 15 * 60_000;\n\nconst shortLimiters = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\nconst longLimiters = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\nexport function consumeSharePublicLimit(clientIp: string): RateLimitResult {\n  let shortLimiter = shortLimiters.get(clientIp);\n  if (!shortLimiter) {\n    shortLimiter = createFixedWindowRateLimiter({ maxRequests: SHORT_WINDOW_MAX, windowMs: SHORT_WINDOW_MS });\n    shortLimiters.set(clientIp, shortLimiter);\n  }\n  const shortResult = shortLimiter.consume();\n  if (!shortResult.allowed) return shortResult;\n\n  let longLimiter = longLimiters.get(clientIp);\n  if (!longLimiter) {\n    longLimiter = createFixedWindowRateLimiter({ maxRequests: LONG_WINDOW_MAX, windowMs: LONG_WINDOW_MS });\n    longLimiters.set(clientIp, longLimiter);\n  }\n  return longLimiter.consume();\n}\n\n/** @internal */\nexport function resetSharePublicLimitsForTests(): void {\n  shortLimiters.clear();\n  longLimiters.clear();\n}\n"],"mappings":";;;AAGA,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AAExB,MAAM,kBAAkB;AACxB,MAAM,iBAAiB,KAAK;AAE5B,MAAM,gCAAgB,IAAI,KAA8D;AACxF,MAAM,+BAAe,IAAI,KAA8D;AAEvF,SAAgB,wBAAwB,UAAmC;CACzE,IAAI,eAAe,cAAc,IAAI,SAAS;AAC9C,KAAI,CAAC,cAAc;AACjB,iBAAe,6BAA6B;GAAE,aAAa;GAAkB,UAAU;GAAiB,CAAC;AACzG,gBAAc,IAAI,UAAU,aAAa;;CAE3C,MAAM,cAAc,aAAa,SAAS;AAC1C,KAAI,CAAC,YAAY,QAAS,QAAO;CAEjC,IAAI,cAAc,aAAa,IAAI,SAAS;AAC5C,KAAI,CAAC,aAAa;AAChB,gBAAc,6BAA6B;GAAE,aAAa;GAAiB,UAAU;GAAgB,CAAC;AACtG,eAAa,IAAI,UAAU,YAAY;;AAEzC,QAAO,YAAY,SAAS;;;AAI9B,SAAgB,iCAAuC;AACrD,eAAc,OAAO;AACrB,cAAa,OAAO"}
+{"version":3,"file":"share-rate-limit.js","names":[],"sources":["../../../src/share/share-rate-limit.ts"],"sourcesContent":["import { createFixedWindowRateLimiter, type RateLimitResult } from '../infra/rate-limit.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('ShareRateLimit');\n\n/** Per-IP rate limiter for public share download routes. */\nconst SHORT_WINDOW_MAX = 60;\nconst SHORT_WINDOW_MS = 60_000;\n\nconst LONG_WINDOW_MAX = 300;\nconst LONG_WINDOW_MS = 15 * 60_000;\n\nconst shortLimiters = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\nconst longLimiters = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\nexport function consumeSharePublicLimit(clientIp: string): RateLimitResult {\n  let shortLimiter = shortLimiters.get(clientIp);\n  if (!shortLimiter) {\n    shortLimiter = createFixedWindowRateLimiter({ maxRequests: SHORT_WINDOW_MAX, windowMs: SHORT_WINDOW_MS });\n    shortLimiters.set(clientIp, shortLimiter);\n  }\n  const shortResult = shortLimiter.consume();\n  if (!shortResult.allowed) {\n    log.warn(\n      {\n        clientIp,\n        limit: SHORT_WINDOW_MAX,\n        windowSec: Math.round(SHORT_WINDOW_MS / 1000),\n        retryAfterSec: Math.ceil(shortResult.retryAfterMs / 1000),\n        reason: 'short_window_exceeded',\n      },\n      `Share public rate limit exceeded: ${SHORT_WINDOW_MAX} req/${SHORT_WINDOW_MS / 1000}s per IP`,\n    );\n    return shortResult;\n  }\n\n  let longLimiter = longLimiters.get(clientIp);\n  if (!longLimiter) {\n    longLimiter = createFixedWindowRateLimiter({ maxRequests: LONG_WINDOW_MAX, windowMs: LONG_WINDOW_MS });\n    longLimiters.set(clientIp, longLimiter);\n  }\n  const longResult = longLimiter.consume();\n  if (!longResult.allowed) {\n    log.warn(\n      {\n        clientIp,\n        limit: LONG_WINDOW_MAX,\n        windowSec: Math.round(LONG_WINDOW_MS / 1000),\n        retryAfterSec: Math.ceil(longResult.retryAfterMs / 1000),\n        reason: 'long_window_exceeded',\n      },\n      `Share public rate limit exceeded: ${LONG_WINDOW_MAX} req/${LONG_WINDOW_MS / 60000}min per IP`,\n    );\n  }\n  return longResult;\n}\n\n/** @internal */\nexport function resetSharePublicLimitsForTests(): void {\n  shortLimiters.clear();\n  longLimiters.clear();\n}\n"],"mappings":";;;;aACkD;AAElD,MAAM,MAAM,aAAa,iBAAiB;;AAG1C,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AAExB,MAAM,kBAAkB;AACxB,MAAM,iBAAiB,KAAK;AAE5B,MAAM,gCAAgB,IAAI,KAA8D;AACxF,MAAM,+BAAe,IAAI,KAA8D;AAEvF,SAAgB,wBAAwB,UAAmC;CACzE,IAAI,eAAe,cAAc,IAAI,SAAS;AAC9C,KAAI,CAAC,cAAc;AACjB,iBAAe,6BAA6B;GAAE,aAAa;GAAkB,UAAU;GAAiB,CAAC;AACzG,gBAAc,IAAI,UAAU,aAAa;;CAE3C,MAAM,cAAc,aAAa,SAAS;AAC1C,KAAI,CAAC,YAAY,SAAS;AACxB,MAAI,KACF;GACE;GACA,OAAO;GACP,WAAW,KAAK,MAAM,kBAAkB,IAAK;GAC7C,eAAe,KAAK,KAAK,YAAY,eAAe,IAAK;GACzD,QAAQ;GACT,EACD,qCAAqC,iBAAiB,OAAO,kBAAkB,IAAK,UACrF;AACD,SAAO;;CAGT,IAAI,cAAc,aAAa,IAAI,SAAS;AAC5C,KAAI,CAAC,aAAa;AAChB,gBAAc,6BAA6B;GAAE,aAAa;GAAiB,UAAU;GAAgB,CAAC;AACtG,eAAa,IAAI,UAAU,YAAY;;CAEzC,MAAM,aAAa,YAAY,SAAS;AACxC,KAAI,CAAC,WAAW,QACd,KAAI,KACF;EACE;EACA,OAAO;EACP,WAAW,KAAK,MAAM,iBAAiB,IAAK;EAC5C,eAAe,KAAK,KAAK,WAAW,eAAe,IAAK;EACxD,QAAQ;EACT,EACD,qCAAqC,gBAAgB,OAAO,iBAAiB,IAAM,YACpF;AAEH,QAAO;;;AAIT,SAAgB,iCAAuC;AACrD,eAAc,OAAO;AACrB,cAAa,OAAO"}

package/dist/src/tunnel/tunnel-rate-limit.js

@@ -1,6 +1,10 @@
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
 import { createFixedWindowRateLimiter } from "../infra/rate-limit.js";
 import { createHash } from "node:crypto";
 //#region src/tunnel/tunnel-rate-limit.ts
+init_logger();
+const log = createLogger("TunnelRateLimit");
 /** Mutating tunnel API calls per gateway token (consent / start / stop / release). */
 const TUNNEL_MUTATION_MAX = 12;
 const TUNNEL_MUTATION_WINDOW_MS = 5 * 6e4;
@@ -18,7 +22,15 @@ function consumeTunnelMutationLimit(token) {
 		});
 		limiters.set(key, limiter);
 	}
-	return limiter.consume();
+	const result = limiter.consume();
+	if (!result.allowed) log.warn({
+		tokenPrefix: token.slice(0, 8),
+		limit: TUNNEL_MUTATION_MAX,
+		windowSec: Math.round(TUNNEL_MUTATION_WINDOW_MS / 1e3),
+		retryAfterSec: Math.ceil(result.retryAfterMs / 1e3),
+		reason: "tunnel_mutation_limit"
+	}, `Tunnel mutation rate limit exceeded: ${TUNNEL_MUTATION_MAX} mutations per ${TUNNEL_MUTATION_WINDOW_MS / 6e4}min`);
+	return result;
 }
 /** @internal Test helper */
 function resetTunnelMutationLimitsForTests() {

package/dist/src/tunnel/tunnel-rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-rate-limit.js","names":[],"sources":["../../../src/tunnel/tunnel-rate-limit.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { createFixedWindowRateLimiter, type RateLimitResult } from '../infra/rate-limit.js';\n\n/** Mutating tunnel API calls per gateway token (consent / start / stop / release). */\nconst TUNNEL_MUTATION_MAX = 12;\nconst TUNNEL_MUTATION_WINDOW_MS = 5 * 60_000;\n\nconst limiters = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\nfunction limiterKeyFromToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex').slice(0, 16);\n}\n\nexport function consumeTunnelMutationLimit(token: string): RateLimitResult {\n  const key = limiterKeyFromToken(token);\n  let limiter = limiters.get(key);\n  if (!limiter) {\n    limiter = createFixedWindowRateLimiter({\n      maxRequests: TUNNEL_MUTATION_MAX,\n      windowMs: TUNNEL_MUTATION_WINDOW_MS,\n    });\n    limiters.set(key, limiter);\n  }\n  return limiter.consume();\n}\n\n/** @internal Test helper */\nexport function resetTunnelMutationLimitsForTests(): void {\n  limiters.clear();\n}\n"],"mappings":";;;;AAKA,MAAM,sBAAsB;AAC5B,MAAM,4BAA4B,IAAI;AAEtC,MAAM,2BAAW,IAAI,KAA8D;AAEnF,SAAS,oBAAoB,OAAuB;AAClD,QAAO,WAAW,SAAS,CAAC,OAAO,OAAO,OAAO,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAG9E,SAAgB,2BAA2B,OAAgC;CACzE,MAAM,MAAM,oBAAoB,MAAM;CACtC,IAAI,UAAU,SAAS,IAAI,IAAI;AAC/B,KAAI,CAAC,SAAS;AACZ,YAAU,6BAA6B;GACrC,aAAa;GACb,UAAU;GACX,CAAC;AACF,WAAS,IAAI,KAAK,QAAQ;;AAE5B,QAAO,QAAQ,SAAS;;;AAI1B,SAAgB,oCAA0C;AACxD,UAAS,OAAO"}
+{"version":3,"file":"tunnel-rate-limit.js","names":[],"sources":["../../../src/tunnel/tunnel-rate-limit.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { createFixedWindowRateLimiter, type RateLimitResult } from '../infra/rate-limit.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelRateLimit');\n\n/** Mutating tunnel API calls per gateway token (consent / start / stop / release). */\nconst TUNNEL_MUTATION_MAX = 12;\nconst TUNNEL_MUTATION_WINDOW_MS = 5 * 60_000;\n\nconst limiters = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\nfunction limiterKeyFromToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex').slice(0, 16);\n}\n\nexport function consumeTunnelMutationLimit(token: string): RateLimitResult {\n  const key = limiterKeyFromToken(token);\n  let limiter = limiters.get(key);\n  if (!limiter) {\n    limiter = createFixedWindowRateLimiter({\n      maxRequests: TUNNEL_MUTATION_MAX,\n      windowMs: TUNNEL_MUTATION_WINDOW_MS,\n    });\n    limiters.set(key, limiter);\n  }\n  const result = limiter.consume();\n  if (!result.allowed) {\n    log.warn(\n      {\n        tokenPrefix: token.slice(0, 8),\n        limit: TUNNEL_MUTATION_MAX,\n        windowSec: Math.round(TUNNEL_MUTATION_WINDOW_MS / 1000),\n        retryAfterSec: Math.ceil(result.retryAfterMs / 1000),\n        reason: 'tunnel_mutation_limit',\n      },\n      `Tunnel mutation rate limit exceeded: ${TUNNEL_MUTATION_MAX} mutations per ${TUNNEL_MUTATION_WINDOW_MS / 60000}min`,\n    );\n  }\n  return result;\n}\n\n/** @internal Test helper */\nexport function resetTunnelMutationLimitsForTests(): void {\n  limiters.clear();\n}\n"],"mappings":";;;;;aAGkD;AAElD,MAAM,MAAM,aAAa,kBAAkB;;AAG3C,MAAM,sBAAsB;AAC5B,MAAM,4BAA4B,IAAI;AAEtC,MAAM,2BAAW,IAAI,KAA8D;AAEnF,SAAS,oBAAoB,OAAuB;AAClD,QAAO,WAAW,SAAS,CAAC,OAAO,OAAO,OAAO,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAG9E,SAAgB,2BAA2B,OAAgC;CACzE,MAAM,MAAM,oBAAoB,MAAM;CACtC,IAAI,UAAU,SAAS,IAAI,IAAI;AAC/B,KAAI,CAAC,SAAS;AACZ,YAAU,6BAA6B;GACrC,aAAa;GACb,UAAU;GACX,CAAC;AACF,WAAS,IAAI,KAAK,QAAQ;;CAE5B,MAAM,SAAS,QAAQ,SAAS;AAChC,KAAI,CAAC,OAAO,QACV,KAAI,KACF;EACE,aAAa,MAAM,MAAM,GAAG,EAAE;EAC9B,OAAO;EACP,WAAW,KAAK,MAAM,4BAA4B,IAAK;EACvD,eAAe,KAAK,KAAK,OAAO,eAAe,IAAK;EACpD,QAAQ;EACT,EACD,wCAAwC,oBAAoB,iBAAiB,4BAA4B,IAAM,KAChH;AAEH,QAAO;;;AAIT,SAAgB,oCAA0C;AACxD,UAAS,OAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.81",
+  "version": "0.0.82",
   "description": "The OPC workstation that grows with you: AI assistant for One Person Companies — CLI, gateway, multi-channel (Telegram/WeChat), 20+ LLM providers via pi-ai, extensions and skills.",
   "type": "module",
   "main": "dist/src/index.js",