blun-king-cli 9.1.468 → 9.1.469

package/bin/agent-api-private-http-server.mjs

@@ -0,0 +1,268 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+
+const DEFAULT_HOST = '127.0.0.1';
+const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
+const INTERNAL_SECRET_HEADER = 'x-blun-agent-secret';
+const PRINCIPAL_HEADER = 'x-blun-principal-id';
+const PRINCIPAL_PATTERN = /^[A-Za-z0-9._:-]{1,256}$/u;
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1']);
+
+class AgentApiPrivateHttpServerError extends Error {
+  constructor(code, message, status) {
+    super(message);
+    this.name = 'AgentApiPrivateHttpServerError';
+    this.code = code;
+    this.status = status;
+  }
+}
+
+function serverError(code, message, status) {
+  return new AgentApiPrivateHttpServerError(code, message, status);
+}
+
+function validateAdapter(adapter) {
+  if (adapter === null || typeof adapter !== 'object'
+    || typeof adapter.handleRequest !== 'function') {
+    throw new TypeError('adapter.handleRequest is required');
+  }
+  return adapter;
+}
+
+function validateSecret(secret) {
+  if (typeof secret !== 'string' || Buffer.byteLength(secret, 'utf8') < 32) {
+    throw new TypeError('internalSecret must contain at least 32 bytes');
+  }
+  return secret;
+}
+
+function validateMaxBodyBytes(value) {
+  if (!Number.isSafeInteger(value) || value < 1024) {
+    throw new TypeError('maxBodyBytes must be an integer of at least 1024');
+  }
+  return value;
+}
+
+function singleHeader(headers, name) {
+  const value = headers[name];
+  return typeof value === 'string' ? value : undefined;
+}
+
+function secretMatches(actual, expected) {
+  if (typeof actual !== 'string') return false;
+  const actualHash = createHash('sha256').update(actual, 'utf8').digest();
+  const expectedHash = createHash('sha256').update(expected, 'utf8').digest();
+  return timingSafeEqual(actualHash, expectedHash);
+}
+
+function requirePrincipal(headers) {
+  const principalId = singleHeader(headers, PRINCIPAL_HEADER);
+  if (principalId === undefined || !PRINCIPAL_PATTERN.test(principalId)) {
+    throw serverError(
+      'AGENT_API_UNAUTHENTICATED',
+      'Trusted Agent API principal is required.',
+      401,
+    );
+  }
+  return principalId;
+}
+
+function declaredLength(headers) {
+  const raw = singleHeader(headers, 'content-length');
+  if (raw === undefined) return undefined;
+  if (!/^\d+$/u.test(raw)) {
+    throw serverError('AGENT_API_INVALID_BODY', 'Request body length is invalid.', 400);
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value)) {
+    throw serverError('AGENT_API_INVALID_BODY', 'Request body length is invalid.', 400);
+  }
+  return value;
+}
+
+function collectBody(request, maxBodyBytes) {
+  const length = declaredLength(request.headers);
+  if (length !== undefined && length > maxBodyBytes) {
+    request.resume();
+    throw serverError('AGENT_API_BODY_TOO_LARGE', 'Agent API request is too large.', 413);
+  }
+
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+
+    request.on('data', (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      if (size > maxBodyBytes) {
+        settled = true;
+        chunks.length = 0;
+        request.resume();
+        reject(serverError(
+          'AGENT_API_BODY_TOO_LARGE',
+          'Agent API request is too large.',
+          413,
+        ));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on('end', () => {
+      if (settled) return;
+      settled = true;
+      resolve(Buffer.concat(chunks, size));
+    });
+    request.on('aborted', () => {
+      if (settled) return;
+      settled = true;
+      reject(serverError('AGENT_API_INVALID_BODY', 'Agent API request was aborted.', 400));
+    });
+    request.on('error', (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    });
+  });
+}
+
+async function readJsonBody(request, maxBodyBytes) {
+  const buffer = await collectBody(request, maxBodyBytes);
+  if (buffer.length === 0) return {};
+  const contentType = singleHeader(request.headers, 'content-type');
+  if (contentType === undefined || !/^application\/json(?:\s*;|\s*$)/iu.test(contentType)) {
+    throw serverError(
+      'AGENT_API_UNSUPPORTED_MEDIA_TYPE',
+      'Agent API requests must use application/json.',
+      415,
+    );
+  }
+  try {
+    return JSON.parse(buffer.toString('utf8'));
+  } catch {
+    throw serverError('AGENT_API_INVALID_JSON', 'Request body is not valid JSON.', 400);
+  }
+}
+
+function publicError(error) {
+  if (error instanceof AgentApiPrivateHttpServerError) {
+    return {
+      status: error.status,
+      body: {
+        error: {
+          type: 'invalid_request_error',
+          code: error.code,
+          message: error.message,
+        },
+      },
+    };
+  }
+  return {
+    status: 500,
+    body: {
+      error: {
+        type: 'internal_error',
+        code: 'AGENT_API_INTERNAL',
+        message: 'Agent request failed.',
+      },
+    },
+  };
+}
+
+function writeJson(response, status, body, headers = {}) {
+  if (response.headersSent || response.destroyed) return;
+  response.writeHead(status, {
+    ...headers,
+    'cache-control': 'no-store',
+    'content-type': 'application/json',
+    'x-content-type-options': 'nosniff',
+  });
+  response.end(JSON.stringify(body));
+}
+
+function createAgentApiPrivateHttpServer(options = {}) {
+  const adapter = validateAdapter(options.adapter);
+  const internalSecret = validateSecret(options.internalSecret);
+  const maxBodyBytes = validateMaxBodyBytes(
+    options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+  );
+
+  async function handle(request, response) {
+    try {
+      if (!secretMatches(singleHeader(request.headers, INTERNAL_SECRET_HEADER), internalSecret)) {
+        request.resume();
+        throw serverError('AGENT_API_UNAUTHENTICATED', 'Agent API authentication failed.', 401);
+      }
+      const principalId = requirePrincipal(request.headers);
+      const body = await readJsonBody(request, maxBodyBytes);
+      const result = await adapter.handleRequest({
+        method: request.method,
+        path: request.url,
+        principalId,
+        body,
+      });
+      if (result === null) {
+        writeJson(response, 404, {
+          error: {
+            type: 'invalid_request_error',
+            code: 'AGENT_API_ROUTE_NOT_FOUND',
+            message: 'Agent API route not found.',
+          },
+        });
+        return;
+      }
+      writeJson(response, result.status, result.body, result.headers);
+    } catch (error) {
+      const result = publicError(error);
+      writeJson(response, result.status, result.body);
+    }
+  }
+
+  const server = createServer((request, response) => {
+    void handle(request, response);
+  });
+  server.maxHeadersCount = 64;
+  server.headersTimeout = 10_000;
+  server.requestTimeout = 30_000;
+  server.keepAliveTimeout = 5_000;
+
+  function listen(input = {}) {
+    const host = input.host ?? DEFAULT_HOST;
+    const port = input.port ?? 0;
+    if (!LOOPBACK_HOSTS.has(host)) {
+      throw new TypeError('Agent API private server may listen on loopback only');
+    }
+    if (!Number.isInteger(port) || port < 0 || port > 65_535) {
+      throw new TypeError('port must be an integer from 0 through 65535');
+    }
+    return new Promise((resolve, reject) => {
+      const onError = (error) => reject(error);
+      server.once('error', onError);
+      server.listen({ host, port, exclusive: true }, () => {
+        server.off('error', onError);
+        resolve(server.address());
+      });
+    });
+  }
+
+  function close() {
+    if (!server.listening) return Promise.resolve();
+    return new Promise((resolve, reject) => {
+      server.close((error) => {
+        if (error) reject(error);
+        else resolve();
+      });
+    });
+  }
+
+  return Object.freeze({ close, listen, server });
+}
+
+export {
+  AgentApiPrivateHttpServerError,
+  DEFAULT_HOST,
+  DEFAULT_MAX_BODY_BYTES,
+  INTERNAL_SECRET_HEADER,
+  PRINCIPAL_HEADER,
+  createAgentApiPrivateHttpServer,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.468",
+  "version": "9.1.469",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {