nolo-cli 0.82.0-alpha.5 → 0.82.0

package/{chunk-QCZX4FTW.js → chunk-SH43IESU.js}

@@ -6,19 +6,146 @@ import {
 } from "./chunk-KUG52IAP.js";
 
 // packages/desktop-chrome-connector/chromeConnector.ts
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// packages/desktop-chrome-connector/uploadSecurity.mjs
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+var DEFAULT_MAX_FILE_BYTES = 25 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+var UploadSecurityError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "UploadSecurityError";
+    this.code = code;
+  }
+};
+function createUploadSecurityError(code, message) {
+  return new UploadSecurityError(code, message);
+}
+function isSubpath(parent, child) {
+  const rel = relative(parent, child);
+  return !rel.startsWith("..") && !isAbsolute(rel);
+}
+function parseAllowedRoots(env = process.env) {
+  const raw = env?.NOLO_CHROME_UPLOAD_ROOTS;
+  if (!raw || typeof raw !== "string") {
+    return [];
+  }
+  return raw.split(",").map((entry) => entry.trim()).filter(Boolean).filter((entry) => isAbsolute(entry)).map((entry) => {
+    const resolved = resolve(entry);
+    if (existsSync(resolved)) {
+      try {
+        return realpathSync(resolved);
+      } catch {
+        return resolved;
+      }
+    }
+    return resolved;
+  });
+}
+function validateUploadFiles(options = {}) {
+  const {
+    files,
+    env = process.env,
+    maxFiles = DEFAULT_MAX_FILES,
+    maxFileBytes = DEFAULT_MAX_FILE_BYTES
+  } = options;
+  if (!Array.isArray(files) || files.length === 0) {
+    throw createUploadSecurityError("no_files", "Provide at least one file to upload.");
+  }
+  if (files.length > maxFiles) {
+    throw createUploadSecurityError(
+      "too_many_files",
+      `Too many files: ${files.length} provided, maximum allowed is ${maxFiles}.`
+    );
+  }
+  const allowedRoots = parseAllowedRoots(env);
+  if (allowedRoots.length === 0) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      "Upload roots not configured in NOLO_CHROME_UPLOAD_ROOTS; all uploads are refused."
+    );
+  }
+  const fileStats = [];
+  const canonicalFiles = [];
+  let totalBytes = 0;
+  for (const rawFile of files) {
+    if (typeof rawFile !== "string" || !rawFile.trim()) {
+      throw createUploadSecurityError("path_not_allowed", "File path must be a non-empty string.");
+    }
+    const trimmed = rawFile.trim();
+    const resolvedCandidate = resolve(trimmed);
+    if (!existsSync(resolvedCandidate)) {
+      throw createUploadSecurityError("path_not_allowed", `File not found or inaccessible: ${rawFile}`);
+    }
+    let real;
+    try {
+      real = realpathSync(resolvedCandidate);
+    } catch {
+      throw createUploadSecurityError("path_not_allowed", `Could not resolve canonical path for: ${rawFile}`);
+    }
+    let st;
+    try {
+      st = statSync(real);
+    } catch {
+      throw createUploadSecurityError("path_not_allowed", `Could not stat file: ${rawFile}`);
+    }
+    if (!st.isFile()) {
+      throw createUploadSecurityError("path_not_allowed", `Target path is not a regular file: ${rawFile}`);
+    }
+    if (st.size > maxFileBytes) {
+      throw createUploadSecurityError(
+        "too_large",
+        `File size ${st.size} bytes exceeds maximum allowed limit of ${maxFileBytes} bytes: ${rawFile}`
+      );
+    }
+    const realInside = allowedRoots.some((root) => isSubpath(root, real));
+    if (!realInside) {
+      throw createUploadSecurityError(
+        "path_not_allowed",
+        `Path '${rawFile}' (resolved: '${real}') is not within allowed upload roots.`
+      );
+    }
+    canonicalFiles.push(real);
+    fileStats.push({ path: real, bytes: st.size });
+    totalBytes += st.size;
+  }
+  return {
+    ok: true,
+    files: canonicalFiles,
+    fileStats,
+    totalBytes
+  };
+}
+function formatUploadAuditLog(entry = {}) {
+  const ts = entry.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+  const safeTabId = String(entry.tabId ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
+  const safeTarget = String(entry.target ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
+  const files = Array.isArray(entry.files) ? entry.files : [];
+  const totalBytes = files.reduce((sum, f) => sum + (Number(f.bytes) || 0), 0);
+  const fileDetails = files.map((f) => `${String(f.path || "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ")}(${f.bytes || 0}B)`).join(", ");
+  return `[chrome-upload] ${ts} tabId=${safeTabId} target=${safeTarget} files=[${fileDetails}] totalBytes=${totalBytes}`;
+}
+function logUploadAudit(entry, logFn = console.warn) {
+  const line = formatUploadAuditLog(entry);
+  logFn(line);
+  return line;
+}
+
+// packages/desktop-chrome-connector/chromeConnector.ts
 var NOLO_CHROME_CONNECTOR_EXTENSION_ID = "ahpdoopadkamnglhlacfjdfnonpjdplg";
 var NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION = "2";
 function defaultTokenPath() {
-  return resolve(
+  return resolve2(
     process.env.HOME || "",
     "Library/Application Support/Nolo/ChromeConnector/token"
   );
 }
 function readConnectorToken(tokenPath = defaultTokenPath()) {
   if (process.env.NOLO_CHROME_CONNECTOR_TOKEN) return process.env.NOLO_CHROME_CONNECTOR_TOKEN;
-  if (!existsSync(tokenPath)) return "";
+  if (!existsSync2(tokenPath)) return "";
   return readFileSync(tokenPath, "utf8").trim();
 }
 var CHROME_TOOL_ACTIONS = {
@@ -32,7 +159,10 @@ var CHROME_TOOL_ACTIONS = {
   chrome_scroll: "scroll",
   chrome_screenshot: "screenshot",
   chrome_read_console: "read_console",
-  chrome_read_network: "read_network"
+  chrome_read_network: "read_network",
+  chrome_set_files: "set_files",
+  chrome_upload_file: "set_files",
+  chrome_upload: "set_files"
 };
 function createConnectorError(code, message, details) {
   const error = new Error(message);
@@ -59,8 +189,8 @@ function errorPayload(error) {
     ...error?.details !== void 0 ? { details: error.details } : {}
   };
 }
-var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type"]);
-var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach"]);
+var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type", "set_files"]);
+var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach", "set_files"]);
 function validateChromeConnectorPayload(action, payload) {
   if (TAB_ID_REQUIRED_ACTIONS.has(action)) {
     const raw = payload.tabId;
@@ -71,16 +201,42 @@ function validateChromeConnectorPayload(action, payload) {
         `Provide the tabId from chrome_list_tabs before calling ${action}.`
       );
     }
-    return;
+    if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
   }
   if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
-  const elementRef = typeof payload.elementRef === "string" ? payload.elementRef.trim() : "";
+  const rawRef = typeof payload.elementRef === "string" ? payload.elementRef : typeof payload.ref === "string" ? payload.ref : "";
+  const elementRef = rawRef.trim();
   const selector = typeof payload.selector === "string" ? payload.selector.trim() : "";
-  if (elementRef || selector) return;
-  throw createConnectorError(
-    "ELEMENT_TARGET_REQUIRED",
-    "Provide elementRef from chrome_read_page or a CSS selector."
-  );
+  if (!elementRef && !selector) {
+    throw createConnectorError(
+      "ELEMENT_TARGET_REQUIRED",
+      "Provide elementRef from chrome_read_page or a CSS selector."
+    );
+  }
+  if (action === "set_files") {
+    if (!Array.isArray(payload.files) || payload.files.length === 0) {
+      throw createConnectorError(
+        "no_files",
+        "Provide at least one file path in files array."
+      );
+    }
+    try {
+      const validated = validateUploadFiles({
+        files: payload.files,
+        env: process.env
+      });
+      payload.files = validated.files;
+      const targetStr = elementRef ? `ref:${elementRef}` : `selector:${selector}`;
+      logUploadAudit({
+        tabId: String(payload.tabId),
+        target: targetStr,
+        files: validated.fileStats
+      });
+    } catch (err) {
+      const code = err?.code ?? "path_not_allowed";
+      throw createConnectorError(code, toErrorMessage(err));
+    }
+  }
 }
 function createChromeConnectorClient(args) {
   if (args?.request) return { request: args.request };
@@ -90,6 +246,7 @@ function createChromeConnectorClient(args) {
   const token = args?.token ?? readConnectorToken(args?.tokenPath);
   return {
     async request(action, payload) {
+      validateChromeConnectorPayload(action, payload);
       let response;
       try {
         response = await fetchImpl(endpoint, {
@@ -131,7 +288,8 @@ var REQUIRED_CHROME_CONNECTOR_FEATURES = {
   screenshot: ["browser_debug"],
   read_console: ["browser_debug"],
   read_network: ["browser_debug"],
-  detach: ["browser_debug"]
+  detach: ["browser_debug"],
+  set_files: ["compact_observation_v2", "file_upload"]
 };
 function requiredFeaturesForConnectorAction(action) {
   return [...REQUIRED_CHROME_CONNECTOR_FEATURES[action] ?? []];