arisa 4.0.16 → 4.0.20

package/src/runtime/web/route-validation.js

@@ -1,115 +0,0 @@
-import path from "node:path";
-
-export const RESERVED_EXACT = ["/"];
-export const RESERVED_PATHS = ["/health"];
-export const RESERVED_PREFIXES = ["/telegram-", "/api", "/auth"];
-
-const DEFAULT_METHODS = ["GET"];
-
-function isObject(value) {
-  return value != null && typeof value === "object" && !Array.isArray(value);
-}
-
-function normalizeMethods(methods, isPublic) {
-  const requested = methods == null ? DEFAULT_METHODS : methods;
-  if (!Array.isArray(requested) || requested.length === 0) {
-    throw new Error("methods must be a non-empty array");
-  }
-
-  const normalized = requested.map((method) => {
-    if (typeof method !== "string" || !method.trim()) {
-      throw new Error("methods must contain only non-empty strings");
-    }
-    return method.trim().toUpperCase();
-  });
-
-  if (!isPublic && methods == null) return normalized;
-  return [...new Set(normalized)];
-}
-
-export function isReservedPath(routePath) {
-  return RESERVED_EXACT.includes(routePath)
-    || RESERVED_PATHS.includes(routePath)
-    || RESERVED_PREFIXES.some((prefix) => routePath === prefix || routePath.startsWith(prefix));
-}
-
-export function validateRoutePath(routePath) {
-  if (typeof routePath !== "string" || !routePath.startsWith("/")) {
-    throw new Error("path must be a string that starts with /");
-  }
-  if (routePath.includes("..")) {
-    throw new Error("path must not contain ..");
-  }
-  if (isReservedPath(routePath)) {
-    throw new Error(`path is reserved: ${routePath}`);
-  }
-  return routePath;
-}
-
-export function resolveHandlerWithinTool(toolDir, handlerRel) {
-  if (typeof handlerRel !== "string" || !handlerRel.trim()) {
-    throw new Error("handler must be a non-empty string");
-  }
-  if (path.isAbsolute(handlerRel)) {
-    throw new Error("handler must be relative to the tool directory");
-  }
-  if (handlerRel.includes("..")) {
-    throw new Error("handler must not contain ..");
-  }
-
-  const root = path.resolve(toolDir);
-  const handlerPath = path.resolve(root, handlerRel);
-  const relative = path.relative(root, handlerPath);
-  if (relative.startsWith("..") || path.isAbsolute(relative)) {
-    throw new Error("handler must resolve inside the tool directory");
-  }
-  return handlerPath;
-}
-
-export function validateToolWebRoutes(manifest, toolDir, claimedPaths = new Map()) {
-  const routes = [];
-  const errors = [];
-  const toolName = manifest?.name;
-  const manifestRoutes = manifest?.web?.routes;
-
-  if (manifestRoutes == null) return { routes, errors };
-  if (!Array.isArray(manifestRoutes)) {
-    return { routes, errors: [{ toolName, error: "web.routes must be an array" }] };
-  }
-
-  for (const [index, route] of manifestRoutes.entries()) {
-    try {
-      if (!isObject(route)) {
-        throw new Error("route must be an object");
-      }
-
-      const routePath = validateRoutePath(route.path);
-      const previousTool = claimedPaths.get(routePath);
-      if (previousTool && previousTool !== toolName) {
-        throw new Error(`path collides with tool ${previousTool}: ${routePath}`);
-      }
-
-      const isPublic = route.public === true;
-      const methods = normalizeMethods(route.methods, isPublic);
-      const handlerPath = resolveHandlerWithinTool(toolDir, route.handler);
-
-      claimedPaths.set(routePath, toolName);
-      routes.push({
-        toolName,
-        path: routePath,
-        methods,
-        public: isPublic,
-        handlerPath
-      });
-    } catch (error) {
-      errors.push({
-        toolName,
-        index,
-        path: route?.path,
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-
-  return { routes, errors };
-}

package/src/runtime/web/web-router.js

@@ -1,167 +0,0 @@
-import crypto from "node:crypto";
-import { pathToFileURL } from "node:url";
-
-const DEFAULT_BODY_LIMIT_BYTES = 1024 * 1024;
-const DEFAULT_TIMEOUT_MS = 30_000;
-
-function sendText(res, statusCode, text, headers = {}) {
-  if (res.headersSent || res.writableEnded) return;
-  res.writeHead(statusCode, {
-    "Content-Type": "text/plain; charset=utf-8",
-    ...headers
-  });
-  res.end(text);
-}
-
-function safePathname(req) {
-  try {
-    return new URL(req.url || "/", "http://localhost").pathname;
-  } catch {
-    return "/";
-  }
-}
-
-function methodKey(method, routePath) {
-  return `${String(method || "GET").toUpperCase()} ${routePath}`;
-}
-
-function extractBearerToken(req, parsedUrl) {
-  const authorization = req.headers.authorization || "";
-  const match = authorization.match(/^Bearer\s+(.+)$/i);
-  if (match) return match[1].trim();
-  return parsedUrl.searchParams.get("token") || "";
-}
-
-function timingSafeEqualString(actual, expected) {
-  if (!actual || !expected) return false;
-  const actualBuffer = Buffer.from(actual);
-  const expectedBuffer = Buffer.from(expected);
-  if (actualBuffer.length !== expectedBuffer.length) return false;
-  return crypto.timingSafeEqual(actualBuffer, expectedBuffer);
-}
-
-function installBodyLimit(req, res, limitBytes) {
-  const contentLength = Number(req.headers["content-length"] || 0);
-  if (Number.isFinite(contentLength) && contentLength > limitBytes) {
-    sendText(res, 413, "request body too large\n");
-    req.destroy();
-    return false;
-  }
-
-  let total = 0;
-  const originalEmit = req.emit;
-  req.emit = function emitWithBodyLimit(eventName, ...args) {
-    if (eventName === "data" && !res.writableEnded) {
-      const chunk = args[0];
-      total += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(String(chunk || ""));
-      if (total > limitBytes) {
-        sendText(res, 413, "request body too large\n");
-        req.destroy();
-        return false;
-      }
-    }
-    return originalEmit.call(this, eventName, ...args);
-  };
-  return true;
-}
-
-function parseChatId(parsedUrl) {
-  const raw = parsedUrl.searchParams.get("chatId");
-  if (raw == null || raw.trim() === "") return null;
-  const numberValue = Number(raw);
-  return Number.isSafeInteger(numberValue) ? numberValue : raw;
-}
-
-export function createWebRouter({
-  getRoutes,
-  buildContext,
-  getToken,
-  logger,
-  limits = {}
-} = {}) {
-  const coreRoutes = new Map();
-  const handlerCache = new Map();
-  const bodyLimitBytes = limits.bodyLimitBytes || DEFAULT_BODY_LIMIT_BYTES;
-  const timeoutMs = limits.timeoutMs || DEFAULT_TIMEOUT_MS;
-
-  async function loadHandler(route) {
-    if (!handlerCache.has(route.handlerPath)) {
-      handlerCache.set(route.handlerPath, import(pathToFileURL(route.handlerPath).href));
-    }
-    const module = await handlerCache.get(route.handlerPath);
-    if (typeof module.handleWebRequest !== "function") {
-      throw new Error(`handler does not export handleWebRequest: ${route.handlerPath}`);
-    }
-    return module.handleWebRequest;
-  }
-
-  function registerCoreRoute({ method, path, handler }) {
-    if (typeof method !== "string" || typeof path !== "string" || typeof handler !== "function") {
-      throw new Error("core route requires method, path, and handler");
-    }
-    coreRoutes.set(methodKey(method, path), handler);
-  }
-
-  async function dispatch(req, res) {
-    const parsedUrl = new URL(req.url || "/", "http://localhost");
-    const pathname = parsedUrl.pathname;
-    const method = String(req.method || "GET").toUpperCase();
-    const coreHandler = coreRoutes.get(methodKey(method, pathname));
-    if (coreHandler) {
-      return coreHandler(req, res);
-    }
-
-    const route = (getRoutes?.() || []).find((item) => item.path === pathname);
-    if (!route) {
-      sendText(res, 200, "ok");
-      return undefined;
-    }
-
-    const timeout = setTimeout(() => {
-      sendText(res, 504, "request timed out\n");
-      req.destroy();
-    }, timeoutMs);
-    timeout.unref?.();
-
-    try {
-      if (!installBodyLimit(req, res, bodyLimitBytes)) return undefined;
-
-      const token = getToken?.() || "";
-      if (!route.public && !timingSafeEqualString(extractBearerToken(req, parsedUrl), token)) {
-        sendText(res, 401, "unauthorized\n", { "WWW-Authenticate": "Bearer" });
-        return undefined;
-      }
-
-      const methods = route.methods || ["GET"];
-      if (!methods.includes(method)) {
-        sendText(res, 405, "method not allowed\n", { Allow: methods.join(", ") });
-        return undefined;
-      }
-
-      logger?.log?.("web", `${route.toolName} ${method} ${pathname}`);
-      const handleWebRequest = await loadHandler(route);
-      const context = buildContext?.({
-        toolName: route.toolName,
-        route,
-        req,
-        res,
-        parsedUrl,
-        chatId: parseChatId(parsedUrl)
-      }) || { toolName: route.toolName, chatId: parseChatId(parsedUrl) };
-      await handleWebRequest(req, res, context);
-      return undefined;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      logger?.error?.("web", `${route.toolName} ${safePathname(req)}: ${message}`);
-      sendText(res, 500, "internal server error\n");
-      return undefined;
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-
-  return {
-    dispatch,
-    registerCoreRoute
-  };
-}

package/test/process-ids.test.js

@@ -1,14 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { parseProcessIds } from "../src/runtime/process-ids.js";
-
-test("ignores empty PID command output", () => {
-  assert.deepEqual(parseProcessIds(""), []);
-  assert.deepEqual(parseProcessIds("   \n\t"), []);
-});
-
-test("parses only positive integer PID tokens", () => {
-  assert.deepEqual(parseProcessIds("123\n456"), [123, 456]);
-  assert.deepEqual(parseProcessIds("11970/tcp: 1234"), [1234]);
-  assert.deepEqual(parseProcessIds("0 nope -12 42"), [42]);
-});

package/test/route-validation.test.js

@@ -1,88 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtemp } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import {
-  isReservedPath,
-  validateToolWebRoutes
-} from "../src/runtime/web/route-validation.js";
-
-async function tempToolDir(name) {
-  const root = await mkdtemp(path.join(os.tmpdir(), "arisa-route-validation-"));
-  return path.join(root, name);
-}
-
-test("loads valid tool web routes", async () => {
-  const toolDir = await tempToolDir("alpha");
-  const claimedPaths = new Map();
-  const manifest = {
-    name: "alpha",
-    web: {
-      routes: [
-        { path: "/alpha", handler: "web/index.js" }
-      ]
-    }
-  };
-
-  const { routes, errors } = validateToolWebRoutes(manifest, toolDir, claimedPaths);
-
-  assert.deepEqual(errors, []);
-  assert.equal(routes.length, 1);
-  assert.equal(routes[0].toolName, "alpha");
-  assert.equal(routes[0].path, "/alpha");
-  assert.deepEqual(routes[0].methods, ["GET"]);
-  assert.equal(routes[0].public, false);
-  assert.equal(routes[0].handlerPath, path.join(toolDir, "web", "index.js"));
-});
-
-test("rejects invalid and reserved route paths", async () => {
-  const toolDir = await tempToolDir("bad");
-  const invalidPaths = ["/", "/health", "/api", "/api/tools", "/telegram-secret", "/has/../dotdot", "relative"];
-
-  for (const routePath of invalidPaths) {
-    const { routes, errors } = validateToolWebRoutes({
-      name: "bad",
-      web: { routes: [{ path: routePath, handler: "web/index.js" }] }
-    }, toolDir, new Map());
-
-    assert.equal(routes.length, 0, routePath);
-    assert.equal(errors.length, 1, routePath);
-  }
-
-  assert.equal(isReservedPath("/telegram-token"), true);
-  assert.equal(isReservedPath("/custom"), false);
-});
-
-test("rejects route collisions between tools", async () => {
-  const firstToolDir = await tempToolDir("first");
-  const secondToolDir = await tempToolDir("second");
-  const claimedPaths = new Map();
-
-  const first = validateToolWebRoutes({
-    name: "first",
-    web: { routes: [{ path: "/shared", handler: "web/index.js" }] }
-  }, firstToolDir, claimedPaths);
-
-  const second = validateToolWebRoutes({
-    name: "second",
-    web: { routes: [{ path: "/shared", handler: "web/index.js" }] }
-  }, secondToolDir, claimedPaths);
-
-  assert.equal(first.routes.length, 1);
-  assert.equal(second.routes.length, 0);
-  assert.match(second.errors[0].error, /collides with tool first/);
-});
-
-test("rejects handlers outside the tool directory", async () => {
-  const toolDir = await tempToolDir("escape");
-
-  const { routes, errors } = validateToolWebRoutes({
-    name: "escape",
-    web: { routes: [{ path: "/escape", handler: "../outside.js" }] }
-  }, toolDir, new Map());
-
-  assert.equal(routes.length, 0);
-  assert.equal(errors.length, 1);
-  assert.match(errors[0].error, /handler must not contain \.\./);
-});

package/test/web-router.test.js

@@ -1,267 +0,0 @@
-import assert from "node:assert/strict";
-import { createServer } from "node:http";
-import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { createWebRouter } from "../src/runtime/web/web-router.js";
-
-async function createHandlerFiles() {
-  const root = await mkdtemp(path.join(os.tmpdir(), "arisa-web-router-"));
-  await mkdir(root, { recursive: true });
-  const okHandler = path.join(root, "ok.js");
-  const errorHandler = path.join(root, "error.js");
-
-  await writeFile(okHandler, `export async function handleWebRequest(_req, res, context) {
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ toolName: context.toolName, chatId: context.chatId }));
-}
-`, "utf8");
-
-  await writeFile(errorHandler, `export async function handleWebRequest() {
-  throw new Error("secret stack marker");
-}
-`, "utf8");
-
-  return { okHandler, errorHandler };
-}
-
-function buildRouter({ routes, token = "secret-token", limits, logger } = {}) {
-  return createWebRouter({
-    getRoutes: () => routes,
-    getToken: () => token,
-    logger,
-    limits,
-    buildContext: ({ toolName, chatId }) => ({ toolName, chatId })
-  });
-}
-
-async function startRouterServer(router) {
-  const server = createServer((req, res) => {
-    router.dispatch(req, res);
-  });
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-  const address = server.address();
-  const baseUrl = `http://127.0.0.1:${address.port}`;
-  return {
-    baseUrl,
-    close: () => new Promise((resolve, reject) => {
-      server.close((error) => error ? reject(error) : resolve());
-    })
-  };
-}
-
-test("protected routes require the shared bearer token", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const routes = [
-    { toolName: "private-tool", path: "/private", methods: ["GET"], public: false, handlerPath: okHandler }
-  ];
-  const router = createWebRouter({
-    getRoutes: () => routes,
-    getToken: () => "secret-token",
-    buildContext: ({ toolName, chatId }) => ({ toolName, chatId })
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const rejected = await fetch(`${server.baseUrl}/private`);
-    assert.equal(rejected.status, 401);
-
-    const accepted = await fetch(`${server.baseUrl}/private?chatId=123`, {
-      headers: { Authorization: "Bearer secret-token" }
-    });
-    assert.equal(accepted.status, 200);
-    assert.deepEqual(await accepted.json(), { toolName: "private-tool", chatId: 123 });
-  } finally {
-    await server.close();
-  }
-});
-
-test("public routes do not require a token", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const routes = [
-    { toolName: "public-tool", path: "/public", methods: ["GET"], public: true, handlerPath: okHandler }
-  ];
-  const router = createWebRouter({
-    getRoutes: () => routes,
-    getToken: () => "secret-token",
-    buildContext: ({ toolName, chatId }) => ({ toolName, chatId })
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/public`);
-    assert.equal(response.status, 200);
-    assert.deepEqual(await response.json(), { toolName: "public-tool", chatId: null });
-  } finally {
-    await server.close();
-  }
-});
-
-test("disallows undeclared HTTP methods", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const routes = [
-    { toolName: "public-tool", path: "/public", methods: ["GET"], public: true, handlerPath: okHandler }
-  ];
-  const router = createWebRouter({
-    getRoutes: () => routes,
-    getToken: () => "secret-token",
-    buildContext: ({ toolName, chatId }) => ({ toolName, chatId })
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/public`, { method: "POST" });
-    assert.equal(response.status, 405);
-    assert.equal(response.headers.get("allow"), "GET");
-  } finally {
-    await server.close();
-  }
-});
-
-test("handler errors do not expose stack traces to clients", async () => {
-  const { errorHandler } = await createHandlerFiles();
-  const logs = [];
-  const routes = [
-    { toolName: "error-tool", path: "/error", methods: ["GET"], public: true, handlerPath: errorHandler }
-  ];
-  const router = createWebRouter({
-    getRoutes: () => routes,
-    getToken: () => "secret-token",
-    logger: { error: (scope, message) => logs.push({ scope, message }) },
-    buildContext: ({ toolName, chatId }) => ({ toolName, chatId })
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/error`);
-    const body = await response.text();
-    assert.equal(response.status, 500);
-    assert.equal(body.includes("secret stack marker"), false);
-    assert.equal(body.includes("Error:"), false);
-    assert.equal(logs[0].scope, "web");
-    assert.match(logs[0].message, /secret stack marker/);
-  } finally {
-    await server.close();
-  }
-});
-
-test("core routes take precedence over tool routes", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const router = buildRouter({
-    routes: [
-      { toolName: "tool", path: "/health", methods: ["GET"], public: true, handlerPath: okHandler }
-    ]
-  });
-  router.registerCoreRoute({
-    method: "GET",
-    path: "/health",
-    handler: (_req, res) => {
-      res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("core-health");
-    }
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/health`);
-    assert.equal(response.status, 200);
-    assert.equal(await response.text(), "core-health");
-  } finally {
-    await server.close();
-  }
-});
-
-test("unknown paths return a plain ok response", async () => {
-  const router = buildRouter({ routes: [] });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/does-not-exist`);
-    assert.equal(response.status, 200);
-    assert.equal(await response.text(), "ok");
-  } finally {
-    await server.close();
-  }
-});
-
-test("rejects request bodies over the configured limit", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const router = buildRouter({
-    routes: [
-      { toolName: "upload-tool", path: "/upload", methods: ["POST"], public: true, handlerPath: okHandler }
-    ],
-    limits: { bodyLimitBytes: 8 }
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/upload`, {
-      method: "POST",
-      body: "x".repeat(64)
-    });
-    assert.equal(response.status, 413);
-  } finally {
-    await server.close();
-  }
-});
-
-test("accepts the shared token from the query string", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const router = buildRouter({
-    routes: [
-      { toolName: "private-tool", path: "/private", methods: ["GET"], public: false, handlerPath: okHandler }
-    ]
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/private?token=secret-token`);
-    assert.equal(response.status, 200);
-  } finally {
-    await server.close();
-  }
-});
-
-test("rejects wrong tokens and locks down protected routes without a configured token", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const protectedRoute = { toolName: "private-tool", path: "/private", methods: ["GET"], public: false, handlerPath: okHandler };
-
-  const wrongTokenServer = await startRouterServer(buildRouter({ routes: [protectedRoute] }));
-  try {
-    const response = await fetch(`${wrongTokenServer.baseUrl}/private`, {
-      headers: { Authorization: "Bearer wrong-token" }
-    });
-    assert.equal(response.status, 401);
-  } finally {
-    await wrongTokenServer.close();
-  }
-
-  const noTokenServer = await startRouterServer(buildRouter({ routes: [protectedRoute], token: "" }));
-  try {
-    const response = await fetch(`${noTokenServer.baseUrl}/private`, {
-      headers: { Authorization: "Bearer anything" }
-    });
-    assert.equal(response.status, 401);
-  } finally {
-    await noTokenServer.close();
-  }
-});
-
-test("passes a non-numeric chatId through to the handler context", async () => {
-  const { okHandler } = await createHandlerFiles();
-  const router = buildRouter({
-    routes: [
-      { toolName: "public-tool", path: "/public", methods: ["GET"], public: true, handlerPath: okHandler }
-    ]
-  });
-  const server = await startRouterServer(router);
-
-  try {
-    const response = await fetch(`${server.baseUrl}/public?chatId=team-7`);
-    assert.equal(response.status, 200);
-    assert.deepEqual(await response.json(), { toolName: "public-tool", chatId: "team-7" });
-  } finally {
-    await server.close();
-  }
-});