min-agent 0.2.1 → 0.3.0

package/dist/sessions.js

@@ -1,41 +1,154 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, unlinkSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, unlinkSync, openSync, readSync, closeSync, statSync, } from "fs";
 import path from "path";
+import { randomUUID } from "crypto";
 import { getConfigDir } from "./config.js";
 import { generateTitle } from "./title-gen.js";
+import { isSyntheticMessage } from "./synthetic.js";
 function getSessionsDir() {
     return path.join(getConfigDir(), "sessions");
 }
+/** Session ids are UUIDs; a strict whitelist blocks path traversal via `/v1/sessions/..%2F..%2Fconfig`. */
+const SESSION_ID_RE = /^[a-zA-Z0-9_-]+$/;
 function sessionPath(id) {
+    if (!SESSION_ID_RE.test(id))
+        throw new Error(`invalid session id: ${id}`);
     return path.join(getSessionsDir(), `${id}.json`);
 }
+/** Session meta lives at the head of the JSON file, so only the first bytes are needed. */
+const META_READ_LIMIT = 64 * 1024;
+function readHead(file, limit) {
+    const fd = openSync(file, "r");
+    try {
+        const buf = Buffer.alloc(Math.min(statSync(file).size, limit));
+        if (buf.length === 0)
+            return "";
+        readSync(fd, buf, 0, buf.length, 0);
+        return buf.toString("utf-8");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Find the index of the `}` that closes the object opened at `start`, or -1. */
+function matchBrace(text, start) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "{")
+            depth++;
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/** Extract the meta object from a (possibly truncated) session JSON head. */
+function parseMetaFromHead(head) {
+    const key = head.indexOf('"meta"');
+    if (key < 0)
+        return null;
+    const brace = head.indexOf("{", key);
+    if (brace < 0)
+        return null;
+    const end = matchBrace(head, brace);
+    if (end < 0)
+        return null;
+    try {
+        return JSON.parse(head.slice(brace, end + 1));
+    }
+    catch {
+        return null;
+    }
+}
 function generateId() {
-    return Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
+    return randomUUID();
+}
+function textOfContent(content) {
+    if (typeof content === "string")
+        return content;
+    return content.map((p) => (p.type === "text" ? p.text : "")).join(" ").trim();
 }
 function deriveTitle(messages) {
     const first = messages.find((m) => m.role === "user");
     if (!first)
         return "Untitled";
-    const content = typeof first.content === "string" ? first.content : "";
-    return content.slice(0, 60) || "Untitled";
+    const text = textOfContent(first.content);
+    return text.slice(0, 60) || "Untitled";
 }
-export function saveSession(messages, existingId, title) {
+/** Convert binary image parts to data URLs so JSON serialization stays usable. */
+export function sanitizeForStorage(messages) {
+    return messages
+        .filter((msg) => !isSyntheticMessage(msg))
+        .map((msg) => {
+        if (!Array.isArray(msg.content))
+            return msg;
+        const content = msg.content.map((part) => {
+            if (part.type !== "image" || part.image == null || typeof part.image === "string")
+                return part;
+            let buf = null;
+            if (Buffer.isBuffer(part.image) || part.image instanceof Uint8Array) {
+                buf = Buffer.isBuffer(part.image) ? part.image : Buffer.from(part.image);
+            }
+            else if (typeof part.image === "object" && !(part.image instanceof URL)) {
+                const data = part.image.data;
+                if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
+                    buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                }
+            }
+            if (!buf)
+                return part;
+            const mime = part.mimeType ?? "image/png";
+            return { ...part, image: `data:${mime};base64,${buf.toString("base64")}` };
+        });
+        return { ...msg, content };
+    });
+}
+export function saveSession(messages, existingId, title, created) {
     const dir = getSessionsDir();
     mkdirSync(dir, { recursive: true });
-    const id = existingId ?? generateId();
+    const id = existingId && SESSION_ID_RE.test(existingId) ? existingId : generateId();
     const now = new Date().toISOString();
+    const existing = existingId ? readMeta(id) : null;
     const data = {
         meta: {
             id,
-            title: title ?? deriveTitle(messages),
-            created: existingId ? loadSession(id)?.meta.created ?? now : now,
+            title: title ?? existing?.title ?? deriveTitle(messages),
+            created: created ?? existing?.created ?? now,
             updated: now,
             messageCount: messages.length,
         },
-        messages,
+        messages: sanitizeForStorage(messages),
     };
     writeFileSync(sessionPath(id), JSON.stringify(data, null, 2), "utf-8");
     return id;
 }
+/** Read only the meta head to recover the original created/title. */
+function readMeta(id) {
+    const file = sessionPath(id);
+    if (!existsSync(file))
+        return null;
+    try {
+        return parseMetaFromHead(readHead(file, META_READ_LIMIT));
+    }
+    catch {
+        return null;
+    }
+}
 /** Save session with auto-generated title from LLM */
 export async function saveSessionWithTitle(messages, model, existingId) {
     let title = null;
@@ -46,6 +159,8 @@ export async function saveSessionWithTitle(messages, model, existingId) {
     return saveSession(messages, existingId, title ?? undefined);
 }
 export function loadSession(id) {
+    if (!SESSION_ID_RE.test(id))
+        return null;
     const file = sessionPath(id);
     if (!existsSync(file))
         return null;
@@ -64,8 +179,7 @@ export function listSessions() {
         .filter((f) => f.endsWith(".json"))
         .map((f) => {
         try {
-            const data = JSON.parse(readFileSync(path.join(dir, f), "utf-8"));
-            return data.meta;
+            return parseMetaFromHead(readHead(path.join(dir, f), META_READ_LIMIT));
         }
         catch {
             return null;
@@ -75,9 +189,33 @@ export function listSessions() {
         .sort((a, b) => b.updated.localeCompare(a.updated));
 }
 export function deleteSession(id) {
+    if (!SESSION_ID_RE.test(id))
+        return false;
+    const file = sessionPath(id);
+    if (!existsSync(file))
+        return false;
+    try {
+        unlinkSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function renameSession(id, title) {
+    if (!SESSION_ID_RE.test(id))
+        return false;
     const file = sessionPath(id);
     if (!existsSync(file))
         return false;
-    unlinkSync(file);
-    return true;
+    try {
+        const data = JSON.parse(readFileSync(file, "utf-8"));
+        data.meta.title = title;
+        data.meta.updated = new Date().toISOString();
+        writeFileSync(file, JSON.stringify(data, null, 2), "utf-8");
+        return true;
+    }
+    catch {
+        return false;
+    }
 }