agent-canvas 0.1.34 → 0.1.36

package/workers/canvas-share/src/index.test.ts

@@ -116,6 +116,50 @@ describe("validateFeedbackBody", () => {
       annotations: [{ id: "a1", snippet: 123, note: "y", createdAt: "2026-04-09T00:00:00.000Z" }],
     })).toBe("string");
   });
+
+  test("accepts encrypted feedback with oversized ciphertext fields", () => {
+    // In encrypted mode plaintext caps don't apply: ciphertext is opaque
+    // base64 that can legitimately exceed AUTHOR_NAME_LENGTH /
+    // GENERAL_NOTE_LENGTH while staying well under the wire-size caps.
+    const result = validateFeedbackBody({
+      ...valid,
+      author: { name: "x".repeat(LIMITS.AUTHOR_NAME_LENGTH + 200) },
+      generalNote: "x".repeat(LIMITS.GENERAL_NOTE_LENGTH + 5000),
+      encryption: { alg: "AES-GCM", v: 1 },
+    });
+    expect(typeof result).toBe("object");
+  });
+
+  test("still rejects unknown encryption algorithm", () => {
+    expect(typeof validateFeedbackBody({
+      ...valid,
+      encryption: { alg: "RSA", v: 1 },
+    })).toBe("string");
+  });
+});
+
+describe("validateSharePayload encryption", () => {
+  test("accepts the encryption marker", () => {
+    const result = validateSharePayload({
+      version: 1,
+      encryption: { alg: "AES-GCM", v: 1 },
+      origin: { sessionId: "ciphertext", revision: 1, createdAt: "2026-04-09T00:00:00.000Z" },
+      canvasFiles: [{ filename: "plan.jsx", compiledJs: "ciphertext-blob" }],
+      runtime: { componentsVersion: "0.1.0" },
+    });
+    expect(typeof result).toBe("object");
+  });
+
+  test("rejects unknown version of encryption", () => {
+    const result = validateSharePayload({
+      version: 1,
+      encryption: { alg: "AES-GCM", v: 99 },
+      origin: { sessionId: "x", revision: 1, createdAt: "2026-04-09T00:00:00.000Z" },
+      canvasFiles: [{ filename: "plan.jsx", compiledJs: "x" }],
+      runtime: { componentsVersion: "0.1.0" },
+    });
+    expect(typeof result).toBe("string");
+  });
 });
 
 describe("validateShareId", () => {

package/workers/canvas-share/src/index.ts

@@ -81,6 +81,7 @@ async function handleCreateShare(req: Request, env: Env, origin: string): Promis
     componentsVersion: payload.runtime.componentsVersion,
     origin: payload.origin,
     canvasFilenames: payload.canvasFiles.map((cf) => cf.filename),
+    ...(payload.encryption ? { encryption: payload.encryption } : {}),
   };
 
   const prefix = `shares/${shareId}`;
@@ -159,6 +160,9 @@ async function handleGetMeta(shareId: string, env: Env): Promise<Response> {
     shares: [],
     shareEnabled: false,
     runtime: { componentsVersion: record.componentsVersion },
+    // Lets the browser know whether origin.sessionId / origin.label and
+    // canvas JS bodies need decrypting with the URL-fragment key.
+    ...(record.encryption ? { encryption: record.encryption } : {}),
   });
 }
 
@@ -211,10 +215,14 @@ async function handleSubmitFeedback(shareId: string, req: Request, env: Env): Pr
     submittedAt: new Date().toISOString(),
     author: {
       id: body.author.id || randomHexId(8),
-      name: body.author.name.slice(0, LIMITS.AUTHOR_NAME_LENGTH),
+      // Ciphertext names are opaque — slicing them would corrupt the IV /
+      // tag and make the entry undecryptable. The schema already caps the
+      // overall length so the abuse-protection still holds.
+      name: body.encryption ? body.author.name : body.author.name.trim().slice(0, LIMITS.AUTHOR_NAME_LENGTH),
     },
     annotations: body.annotations || [],
     ...(body.generalNote ? { generalNote: body.generalNote } : {}),
+    ...(body.encryption ? { encryption: body.encryption } : {}),
   };
 
   // KV key is sortable so `since` queries can use prefix listing efficiently.

package/workers/canvas-share/src/types.ts

@@ -16,8 +16,15 @@ export interface Env {
   SHARE_TTL_SECONDS?: string;
 }
 
+export interface EncryptionMeta {
+  alg: "AES-GCM";
+  v: 1;
+}
+
 export interface SharePayload {
   version: 1;
+  /** Present when sessionId/label/compiledJs/sourceJsx are ciphertext. */
+  encryption?: EncryptionMeta;
   origin: {
     sessionId: string;
     revision: number;
@@ -40,6 +47,9 @@ export interface ShareRecord {
   componentsVersion: string;
   origin: SharePayload["origin"];
   canvasFilenames: string[];
+  /** Mirrored from the SharePayload so consumers (meta endpoint, daemon
+   *  feedback poller) know whether they're looking at ciphertext fields. */
+  encryption?: EncryptionMeta;
 }
 
 export interface FeedbackPostBody {
@@ -56,6 +66,10 @@ export interface FeedbackPostBody {
   }>;
   generalNote?: string;
   revision: number;
+  /** Present when name/snippet/note/etc. fields are ciphertext. The worker
+   *  stores the marker verbatim; the daemon uses it to decide whether to
+   *  decrypt with the share's encryption key. */
+  encryption?: EncryptionMeta;
 }
 
 export interface FeedbackEntry {
@@ -66,6 +80,7 @@ export interface FeedbackEntry {
   author: { id: string; name: string };
   annotations: FeedbackPostBody["annotations"];
   generalNote?: string;
+  encryption?: EncryptionMeta;
 }
 
 // --- Limits — single source of truth -------------------------------------
@@ -77,12 +92,19 @@ export const LIMITS = {
   FEEDBACK_BODY_BYTES: 256 * 1024, // 256 KB
   /** Maximum size of an annotation upload. */
   UPLOAD_BYTES: 5 * 1024 * 1024, // 5 MB
-  /** Maximum length of a reviewer-supplied display name. */
+  /** Maximum length of a reviewer-supplied display name (plaintext mode). */
   AUTHOR_NAME_LENGTH: 80,
+  /** Loose upper bound for `author.name` accepted by validation. Plaintext
+   *  names are sliced down to AUTHOR_NAME_LENGTH in the handler; ciphertext
+   *  names from encrypted shares need extra headroom for IV + tag + base64
+   *  overhead and the unknown plaintext length. 1 KB is plenty. */
+  AUTHOR_NAME_CIPHERTEXT_LENGTH: 1024,
   /** Maximum number of annotations per feedback submission. */
   MAX_ANNOTATIONS_PER_FEEDBACK: 200,
-  /** Maximum length of generalNote markdown. */
+  /** Maximum length of generalNote markdown (plaintext mode). */
   GENERAL_NOTE_LENGTH: 10_000,
+  /** Loose upper bound for `generalNote` accepted by validation. */
+  GENERAL_NOTE_CIPHERTEXT_LENGTH: 32_000,
   /** Default share TTL when SHARE_TTL_SECONDS env var is not set. */
   DEFAULT_SHARE_TTL_SECONDS: 30 * 24 * 60 * 60,
 } as const;

package/workers/canvas-share/src/validation.ts

@@ -11,6 +11,19 @@
 import { z } from "zod";
 import { LIMITS } from "./types";
 
+// --- Encryption marker ------------------------------------------------------
+
+/** Marker on a SharePayload / FeedbackPostBody that tells consumers the
+ *  associated string fields contain ciphertext rather than plaintext. The
+ *  worker itself never inspects encrypted contents — it just stores them
+ *  as opaque strings. The marker exists so the *daemon* (when polling
+ *  feedback) and the *browser* (when rendering a share) know whether to
+ *  decrypt. */
+const encryptionSchema = z.object({
+  alg: z.literal("AES-GCM"),
+  v: z.literal(1),
+});
+
 // --- Share creation payload -------------------------------------------------
 
 const canvasFileSchema = z.object({
@@ -26,6 +39,7 @@ const canvasFileSchema = z.object({
 
 const sharePayloadSchema = z.object({
   version: z.literal(1),
+  encryption: encryptionSchema.optional(),
   origin: z.object({
     sessionId: z.string(),
     revision: z.number().int(),
@@ -63,25 +77,54 @@ const annotationSchema = z.object({
     .optional(),
 });
 
-const feedbackBodySchema = z.object({
-  author: z.object({
-    id: z.string().optional(),
-    name: z
+// In encrypted mode `name` / `generalNote` are ciphertext blobs (base64)
+// and cannot be sensibly length-bound to plaintext limits. The base schema
+// uses the looser ciphertext caps; a post-parse refine then re-applies the
+// strict plaintext bounds when no `encryption` marker is present.
+const feedbackBodySchema = z
+  .object({
+    author: z.object({
+      id: z.string().optional(),
+      name: z
+        .string()
+        .min(1, "author.name is required")
+        .max(LIMITS.AUTHOR_NAME_CIPHERTEXT_LENGTH, "author.name too long"),
+    }),
+    revision: z.number().int(),
+    annotations: z
+      .array(annotationSchema)
+      .max(LIMITS.MAX_ANNOTATIONS_PER_FEEDBACK, `Too many annotations (max ${LIMITS.MAX_ANNOTATIONS_PER_FEEDBACK})`)
+      .optional(),
+    generalNote: z
       .string()
-      .trim()
-      .min(1, "author.name is required")
-      .max(LIMITS.AUTHOR_NAME_LENGTH, `author.name must be ≤ ${LIMITS.AUTHOR_NAME_LENGTH} chars`),
-  }),
-  revision: z.number().int(),
-  annotations: z
-    .array(annotationSchema)
-    .max(LIMITS.MAX_ANNOTATIONS_PER_FEEDBACK, `Too many annotations (max ${LIMITS.MAX_ANNOTATIONS_PER_FEEDBACK})`)
-    .optional(),
-  generalNote: z
-    .string()
-    .max(LIMITS.GENERAL_NOTE_LENGTH, `generalNote too long (max ${LIMITS.GENERAL_NOTE_LENGTH} chars)`)
-    .optional(),
-});
+      .max(LIMITS.GENERAL_NOTE_CIPHERTEXT_LENGTH, `generalNote too long`)
+      .optional(),
+    encryption: encryptionSchema.optional(),
+  })
+  .superRefine((body, ctx) => {
+    if (body.encryption) return;
+    if (body.author.name.trim().length === 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["author", "name"],
+        message: "author.name is required",
+      });
+    }
+    if (body.author.name.length > LIMITS.AUTHOR_NAME_LENGTH) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["author", "name"],
+        message: `author.name must be ≤ ${LIMITS.AUTHOR_NAME_LENGTH} chars`,
+      });
+    }
+    if (body.generalNote && body.generalNote.length > LIMITS.GENERAL_NOTE_LENGTH) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["generalNote"],
+        message: `generalNote too long (max ${LIMITS.GENERAL_NOTE_LENGTH} chars)`,
+      });
+    }
+  });
 
 export type FeedbackBodyParsed = z.infer<typeof feedbackBodySchema>;