kiku-agent 1.3.1 → 1.3.3

package/server/web-chat/core/futureEventGuard.js

@@ -40,7 +40,11 @@ export function findFutureDates(text, now = new Date()) {
 }
 
 function hasLiveVerification(tools = []) {
-  return tools.some(tool => /^(?:web_search|web_extract|fetch_webpage|verify_claim)$/.test(tool?.name || ''));
+  return tools.some(tool => {
+    const name = tool?.name || tool?.function?.name || '';
+    if (tool?.capabilities?.includes('live_verification') || tool?.capabilities?.includes('catalog_verification')) return true;
+    return /^(?:web_search|web_extract|fetch_webpage|verify_claim|search_news|search_chinese_web|search_bilibili|search_encyclopedia|search_works|get_work_detail|get_career_timeline|global_search)$/.test(name);
+  });
 }
 
 function redactUnverifiedFutureDates(text, now) {

package/server/web-chat/core/musicControlAction.js

@@ -0,0 +1,70 @@
+const MUSIC_CONTROL_ACTIONS = new Map([
+  ['play_music', 'play'],
+  ['pause_music', 'pause'],
+  ['resume_music', 'resume'],
+  ['stop_music', 'stop'],
+  ['next_track', 'next'],
+  ['prev_track', 'prev'],
+  ['set_volume', 'set_volume'],
+  ['mute_music', 'mute'],
+  ['unmute_music', 'unmute'],
+  ['seek_music', 'seek'],
+  ['set_repeat_mode', 'set_repeat'],
+  ['set_shuffle_mode', 'set_shuffle'],
+  ['toggle_video_mode', 'toggle_video'],
+]);
+
+function text(value, maxLength = 500) {
+  return typeof value === 'string' ? value.slice(0, maxLength) : undefined;
+}
+
+function normalizeSong(song) {
+  if (!song || typeof song !== 'object') return undefined;
+  const youtubeId = text(song.youtubeId, 32);
+  return {
+    id: text(song.id, 200),
+    title: text(song.title),
+    titleTh: text(song.titleTh),
+    titleCn: text(song.titleCn),
+    titleEn: text(song.titleEn),
+    youtubeId: youtubeId && /^[a-zA-Z0-9_-]{11}$/.test(youtubeId) ? youtubeId : undefined,
+    duration: text(song.duration, 32),
+    category: text(song.category, 100),
+    dramaName: text(song.dramaName),
+  };
+}
+
+export function createMusicControlAction(toolName, result) {
+  const fallbackAction = MUSIC_CONTROL_ACTIONS.get(toolName);
+  if (!fallbackAction || !result || typeof result !== 'object') return null;
+
+  const action = fallbackAction;
+  const event = {
+    type: 'ui_action',
+    target: 'music_player',
+    tool: toolName,
+    action,
+  };
+
+  if (result.status === 'error') return event;
+
+  const playing = text(result.playing);
+  const currentTrack = text(result.currentTrack);
+  const song = normalizeSong(result.song);
+  if (playing !== undefined) event.playing = playing;
+  if (currentTrack !== undefined) event.currentTrack = currentTrack;
+  if (song !== undefined) event.song = song;
+  if (action === 'set_volume') event.volume = Math.max(0, Math.min(100, Number(result.volume) || 0));
+  if (action === 'seek') event.seconds = Math.max(0, Number(result.seconds) || 0);
+  if (action === 'set_repeat') event.mode = ['off', 'one', 'all'].includes(result.mode) ? result.mode : 'off';
+  if (action === 'set_shuffle') event.enabled = Boolean(result.enabled);
+  if (action === 'toggle_video') event.isVideoOpen = Boolean(result.isVideoOpen);
+
+  return event;
+}
+
+export function collectMusicControlActions(tools = []) {
+  return tools
+    .map((tool) => createMusicControlAction(tool?.name, tool?.result))
+    .filter(Boolean);
+}

package/server/web-chat/core/security.js

@@ -43,10 +43,10 @@ export function applySecurityHeaders(req, res) {
     res.setHeader('X-Frame-Options', 'SAMEORIGIN');
     res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
     res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
-    res.setHeader('Permissions-Policy', 'camera=(), microphone=(self), geolocation=(), payment=(), usb=()');
+    res.setHeader('Permissions-Policy', 'camera=(), microphone=(self), geolocation=(self), payment=(), usb=()');
     res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
     res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
-    res.setHeader('Content-Security-Policy', "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://www.youtube.com https://www.youtube-nocookie.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; media-src 'self' blob: https:; frame-src https://www.youtube.com https://www.youtube-nocookie.com https://player.bilibili.com https://www.bilibili.com; connect-src 'self' http://localhost:* http://127.0.0.1:* https:;");
+    res.setHeader('Content-Security-Policy', "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://www.youtube.com https://www.youtube-nocookie.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net data:; img-src 'self' data: blob: https:; media-src 'self' blob: https:; frame-src https://www.youtube.com https://www.youtube-nocookie.com https://player.bilibili.com https://www.bilibili.com https://*.openstreetmap.org https://openstreetmap.org; connect-src 'self' http://localhost:* http://127.0.0.1:* https:;");
   }
   return !origin || Boolean(allowedOrigin);
 }
@@ -64,13 +64,23 @@ export function extractApiKey(req, urlObj = null) {
 }
 
 export function resolveClientIp(req) {
-  const directIp = req?.socket?.remoteAddress || '127.0.0.1';
+  const directIp = String(req?.socket?.remoteAddress || 'unknown');
   const trustProxy = process.env.VERCEL === '1' || process.env.KIKU_TRUST_PROXY === 'true';
-  if (!trustProxy) return String(directIp);
+  if (!trustProxy) return directIp;
   const forwarded = req?.headers?.['x-forwarded-for'];
-  return typeof forwarded === 'string' && forwarded.trim()
-    ? forwarded.split(',')[0].trim()
-    : String(directIp);
+  if (typeof forwarded === 'string' && forwarded.trim()) {
+    const parts = forwarded.split(',').map(s => s.trim()).filter(Boolean);
+    const candidate = parts[0] || directIp;
+    const isCandidateLoopback = candidate === '127.0.0.1' || candidate === '::1' || candidate === 'localhost' || candidate.startsWith('::ffff:127.');
+    const isDirectLoopback = directIp === '127.0.0.1' || directIp === '::1' || directIp === 'localhost' || directIp.startsWith('::ffff:127.');
+    
+    if (isCandidateLoopback && !isDirectLoopback) {
+      const nonLoopback = parts.find(p => p !== '127.0.0.1' && p !== '::1' && p !== 'localhost' && !p.startsWith('::ffff:127.'));
+      return nonLoopback || directIp;
+    }
+    return candidate;
+  }
+  return directIp;
 }
 
 function constantTimeEqual(left, right) {
@@ -80,41 +90,42 @@ function constantTimeEqual(left, right) {
 }
 
 export function isWebChatAdmin(req) {
-  // Explicit opt-in only: never infer test mode from NODE_ENV/--test flags,
-  // otherwise a stray NODE_ENV=test in production would disable admin auth.
+  
   if (process.env.WEBCHAT_ALLOW_TEST_ADMIN === 'true' && process.env.NODE_ENV !== 'production') return true;
   const expected = process.env.WEBCHAT_ADMIN_KEY || '';
   if (!expected) return false;
   return constantTimeEqual(extractApiKey(req), expected);
 }
 
-export function checkChatRateLimit(clientIp) {
-  const ip = clientIp || 'unknown';
+export function checkRateLimit(clientIp, bucket = 'default', limit = MAX_CHAT_REQUESTS_PER_MINUTE) {
+  const ip = bucket + ':' + (clientIp || 'unknown');
   const now = Date.now();
   const entry = rateLimitStore.get(ip);
 
   if (!entry || now - entry.windowStart > RATE_LIMIT_WINDOW_MS) {
     rateLimitStore.set(ip, { count: 1, windowStart: now });
-    return { allowed: true, remaining: MAX_CHAT_REQUESTS_PER_MINUTE - 1 };
+    return { allowed: true, remaining: limit - 1 };
   }
 
   entry.count++;
-  if (entry.count > MAX_CHAT_REQUESTS_PER_MINUTE) {
+  if (entry.count > limit) {
     const retryAfter = Math.ceil((RATE_LIMIT_WINDOW_MS - (now - entry.windowStart)) / 1000);
     return { allowed: false, retryAfter };
   }
 
-  return { allowed: true, remaining: MAX_CHAT_REQUESTS_PER_MINUTE - entry.count };
+  return { allowed: true, remaining: limit - entry.count };
 }
 
-export async function checkChatRateLimitDistributed(clientIp) {
+export function checkChatRateLimit(ip) { return checkRateLimit(ip, 'chat', 60); }
+
+export async function checkChatRateLimitDistributed(clientIp, bucket = 'chat', limit = 60) {
   const redisUrl = process.env.UPSTASH_REDIS_REST_URL;
   const redisToken = process.env.UPSTASH_REDIS_REST_TOKEN;
-  if (!redisUrl || !redisToken) return checkChatRateLimit(clientIp);
+  if (!redisUrl || !redisToken) return checkRateLimit(clientIp, bucket, limit);
 
   const now = Date.now();
   const identity = createHash('sha256').update(String(clientIp || 'unknown')).digest('hex');
-  const key = `webchat-rate:${identity}:${Math.floor(now / RATE_LIMIT_WINDOW_MS)}`;
+  const key = `webchat-rate:${bucket}:${identity}:${Math.floor(now / RATE_LIMIT_WINDOW_MS)}`;
   try {
     const response = await fetch(`${redisUrl.replace(/\/$/, '')}/pipeline`, {
       method: 'POST',
@@ -126,13 +137,13 @@ export async function checkChatRateLimitDistributed(clientIp) {
       const result = await response.json();
       const count = Number(result?.[0]?.result) || 1;
       return {
-        allowed: count <= MAX_CHAT_REQUESTS_PER_MINUTE,
-        remaining: Math.max(0, MAX_CHAT_REQUESTS_PER_MINUTE - count),
-        retryAfter: count <= MAX_CHAT_REQUESTS_PER_MINUTE ? 0 : 60,
+        allowed: count <= limit,
+        remaining: Math.max(0, limit - count),
+        retryAfter: count <= limit ? 0 : 60,
       };
     }
   } catch {}
-  return checkChatRateLimit(clientIp);
+  return checkRateLimit(clientIp, bucket, limit);
 }
 
 

package/server/web-chat/core/toolInspector.js

@@ -13,19 +13,19 @@ export function makeInspectableToolPayload(value, options = {}) {
     if (typeof item === 'bigint') return String(item);
     if (typeof item === 'string') {
       return item.length > maxStringLength
-        ? item.slice(0, maxStringLength) + '\n… [ตัดข้อความที่ยาวเกินไป]'
+        ? item.slice(0, maxStringLength) + '\n… ตัดข้อความที่ยาวเกินไป · ย่อแล้ว'
         : item;
     }
-    if (typeof item === 'undefined') return '[undefined]';
+    if (typeof item === 'undefined') return '—';
     if (typeof item !== 'object') return String(item);
-    if (depth >= maxDepth) return '[ตัดข้อมูลที่ซ้อนลึกเกินไป]';
-    if (seen.has(item)) return '[อ้างอิงซ้ำ]';
+    if (depth >= maxDepth) return '… ข้อมูลซ้อนลึก · ย่อแล้ว';
+    if (seen.has(item)) return '○ อ้างอิงซ้ำ';
     seen.add(item);
 
     if (Array.isArray(item)) {
       const output = item.slice(0, maxArrayItems).map(entry => visit(entry, depth + 1));
       if (item.length > maxArrayItems) {
-        output.push(`… [ตัดอีก ${item.length - maxArrayItems} รายการ]`);
+        output.push(`… ย่ออีก ${item.length - maxArrayItems} รายการ`);
       }
       return output;
     }
@@ -33,7 +33,7 @@ export function makeInspectableToolPayload(value, options = {}) {
     const output = {};
     const entries = Object.entries(item);
     entries.slice(0, maxObjectKeys).forEach(([key, entry]) => {
-      output[key] = SENSITIVE_TOOL_FIELD.test(key) ? '[redacted]' : visit(entry, depth + 1);
+      output[key] = SENSITIVE_TOOL_FIELD.test(key) ? '···' : visit(entry, depth + 1);
     });
     if (entries.length > maxObjectKeys) {
       output.__truncated__ = `ตัดอีก ${entries.length - maxObjectKeys} ฟิลด์`;

package/server/web-chat/core/urlGuard.js

@@ -0,0 +1,45 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { parseIPv4, isPrivateIPv4, isPrivateIPv6 } from '../../agent/websearch/security/ssrf.js';
+import { isWebChatAdmin, resolveClientIp } from './security.js';
+
+function ipv4Address(host) {
+  const mapped = host.match(/^::ffff:([a-f0-9]{1,4}):([a-f0-9]{1,4})$/i);
+  if (mapped) return parseIPv4(String(parseInt(mapped[1], 16) * 65536 + parseInt(mapped[2], 16)));
+  return parseIPv4(host.replace(/^::ffff:/i, ''));
+}
+
+export function isTrustedRequest(req) {
+  const ip = resolveClientIp(req).toLowerCase();
+  const v4 = ipv4Address(ip);
+  return ip === '::1' || Boolean(v4?.startsWith('127.')) || isWebChatAdmin(req);
+}
+
+export async function validateInferenceBaseUrl(rawUrl, { callerIsTrusted = false, trusted = callerIsTrusted, lookupHost = lookup } = {}) {
+  if (typeof rawUrl !== 'string' || !rawUrl.trim() || rawUrl.length > 2048) return { ok: false, reason: 'Invalid baseUrl length' };
+  let url;
+  try { url = new URL(rawUrl.trim()); } catch { return { ok: false, reason: 'Invalid baseUrl' }; }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) return { ok: false, reason: 'baseUrl must use HTTP(S), without credentials or fragment' };
+  const host = url.hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase();
+  if (host === 'metadata.google.internal' || host.endsWith('.metadata.google.internal')) return { ok: false, reason: 'Metadata endpoint is forbidden' };
+  let addresses;
+  try {
+    addresses = isIP(host) ? [{ address: host }] : await lookupHost(host, { all: true, verbatim: true });
+  } catch { return { ok: false, reason: 'Cannot resolve baseUrl hostname' }; }
+  if (!addresses.length) return { ok: false, reason: 'Cannot resolve baseUrl hostname' };
+  for (const { address } of addresses) {
+    const v4 = ipv4Address(address);
+    if (v4?.startsWith('169.254.') || /^fe[89ab]/i.test(address) || address.toLowerCase() === 'fd00:ec2::254') return { ok: false, reason: 'Metadata/link-local endpoint is forbidden' };
+    if (!trusted && (v4 ? isPrivateIPv4(v4) : isPrivateIPv6(address))) return { ok: false, reason: 'Private/loopback baseUrl requires a local or admin caller' };
+  }
+  return { ok: true, normalized: url.href.replace(/\/+$/, '') };
+}
+
+export function sanitizeInferenceError(error, trusted = false) {
+  if (!trusted) return 'Inference provider unavailable. Check provider settings or contact the administrator.';
+  return String(error?.message || error || 'Inference provider unavailable')
+    .replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]')
+    .replace(/(?:sk-|AIza)[A-Za-z0-9_-]+/g, '[redacted]')
+    .replace(/https?:\/\/[^\s]+/g, '[endpoint]')
+    .replace(/[\r\n\x00-\x1f]+/g, ' ').slice(0, 200);
+}