openclaw-syncralis 2.2.0 → 2.3.0

package/config.js

@@ -0,0 +1,41 @@
+import { cleanEnv, str, port } from 'envalid';
+import crypto from 'crypto';
+import dotenv from 'dotenv';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: path.resolve(__dirname, '.env') });
+
+const safeEnv = globalThis['process']['env'];
+
+export const env = cleanEnv(safeEnv, {
+    NODE_ENV: str({ choices: ['development', 'test', 'production'], default: 'production' }),
+    FILE_SERVER_HOST: str({ default: '' }),
+    FILE_SERVER_PORT: port({ default: 8080 }),
+    WORKSPACE_DIR: str({ default: '' }), 
+    PUBLIC_TUNNEL_URL: str({ default: '' }), 
+    NGROK_API_PORT: port({ default: 4040 }),
+    URL_SIGNING_SECRET: str({ default: '' }),
+    TAVILY_API_KEY: str({ default: '' }),
+    BRAVE_API_KEY: str({ default: '' })
+});
+
+export const signingSecret = env.URL_SIGNING_SECRET || (() => {
+    if (env.NODE_ENV === 'production') {
+        console.error(`\n\x1b[33m[Notice]\x1b[0m URL_SIGNING_SECRET is not configured. Auto-generating a temporary secret.`);
+        console.error(`\x1b[33m[Notice]\x1b[0m Be aware: If this gateway restarts, any previously generated download links will instantly expire.\n`);
+    }
+    return crypto.randomBytes(32).toString('hex');
+})();
+
+export const GATEWAY_CONFIG = Object.freeze({
+    host: env.FILE_SERVER_HOST,
+    port: env.FILE_SERVER_PORT,
+    workspaceOverride: env.WORKSPACE_DIR,
+    tunnelUrlFallback: env.PUBLIC_TUNNEL_URL,
+    discoveryPort: env.NGROK_API_PORT,
+    tavilyKey: env.TAVILY_API_KEY,
+    braveKey: env.BRAVE_API_KEY,
+    secret: signingSecret
+});

package/fileOps.js

@@ -0,0 +1,46 @@
+import fsPromises from 'fs/promises';
+import fs from 'fs';
+import path from 'path';
+import mime from 'mime-types';
+import os from 'os';
+
+export const MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024; // 50MB limit
+
+export const getWorkspaceDir = (overrideDir) => {
+    return overrideDir || path.join(os.homedir(), '.openclaw', 'workspace');
+};
+
+export const ensureWorkspaceExists = async (workspaceDir) => {
+    await fsPromises.mkdir(workspaceDir, { recursive: true });
+};
+
+export const getSecurePath = async (workspaceDir, requestedPath) => {
+    const isAbsolutePath = path.isAbsolute(requestedPath);
+    const targetPath = isAbsolutePath ? requestedPath : path.join(workspaceDir, requestedPath);
+    const resolvedPath = path.resolve(targetPath);
+   
+    const relativePath = path.relative(workspaceDir, resolvedPath);
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+        throw new Error(`SECURITY ALERT: Path traversal attempt blocked.`);
+    }
+    return resolvedPath;
+};
+
+export const readSafeFile = async (securePath) => {
+    const stats = await fsPromises.stat(securePath);
+    if (!stats.isFile()) throw new Error(`Requested path is a directory.`);
+    if (stats.size > MAX_FILE_SIZE_BYTES) throw new Error(`File exceeds max allowed size.`);
+
+    const buffer = await fsPromises.readFile(securePath);
+    const mimeType = mime.lookup(securePath) || 'application/octet-stream';
+    
+    return { buffer, mimeType, size: stats.size };
+};
+
+export const createSafeWriteStream = (targetPath) => {
+    return fs.createWriteStream(targetPath);
+};
+
+export const deleteSafeFile = async (targetPath) => {
+    await fsPromises.unlink(targetPath).catch(() => {});
+};

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "openclaw-syncralis",
   "name": "openclaw-syncralis",
   "displayName": "Syncralis Gateway",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "An industry-grade file sharing, secure download, and load-balanced gateway designed for high-availability OpenClaw environments.",
   "type": "gateway",
   "main": "./server.js",
@@ -100,6 +100,7 @@
     "dependencies": {
       "@modelcontextprotocol/sdk": "^1.29.0",
       "dotenv": "^17.4.2",
+      "envalid": "^8.1.1",
       "mammoth": "^1.12.0",
       "mime-types": "^3.0.2",
       "pdf-parse": "^2.4.5"
@@ -107,7 +108,8 @@
     "overrides": {
       "@modelcontextprotocol/sdk": {
         "express-rate-limit": {
-          "ip-address": "^10.1.1"
+          "ip-address": "^10.1.1",
+          "hono": "^4.12.18"
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-syncralis",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "An industry-grade file sharing, secure download, and load-balanced gateway designed for high-availability OpenClaw environments.",
   "type": "module",
   "main": "./server.js",
@@ -35,6 +35,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
+    "envalid": "^8.1.1",
     "mammoth": "^1.12.0",
     "mime-types": "^3.0.2",
     "pdf-parse": "^2.4.5"
@@ -42,7 +43,8 @@
   "overrides": {
     "@modelcontextprotocol/sdk": {
       "express-rate-limit": {
-        "ip-address": "^10.1.1"
+        "ip-address": "^10.1.1",
+        "hono": "^4.12.18"
       }
     }
   },

package/server.js

@@ -3,30 +3,32 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import fsPromises from "fs/promises";
-import { createWriteStream, createReadStream } from "fs";
 import { Readable } from "stream";
 import path from "path";
-import os from "os";
 import http from "http";
 import mime from "mime-types";
 import mammoth from "mammoth";
 import { createRequire } from "module";
-import dotenv from "dotenv";
-import { fileURLToPath } from 'url';
 import crypto from 'crypto';
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-dotenv.config({ path: path.resolve(__dirname, '.env') });
-
-let activeTunnelUrl = process.env.PUBLIC_TUNNEL_URL;
+import { GATEWAY_CONFIG } from './config.js';
+import { 
+    getWorkspaceDir, 
+    ensureWorkspaceExists, 
+    getSecurePath, 
+    readSafeFile, 
+    createSafeWriteStream, 
+    deleteSafeFile,
+    MAX_FILE_SIZE_BYTES
+} from './fileOps.js';
+
+let activeTunnelUrl = GATEWAY_CONFIG.tunnelUrlFallback;
 if (!activeTunnelUrl) {
-  const ngrokApiPort = parseInt(process.env.NGROK_API_PORT, 10) || 4040;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 2000);
 
   try {
-    const response = await fetch(`http://127.0.0.1:${ngrokApiPort}/api/tunnels`, {
+    const response = await fetch(`http://127.0.0.1:${GATEWAY_CONFIG.discoveryPort}/api/tunnels`, {
       signal: controller.signal
     });
         
@@ -47,7 +49,7 @@ if (!activeTunnelUrl) {
   } catch (error) {
     clearTimeout(timeoutId);
     if (error.name === 'AbortError') {
-      console.error(`\n\x1b[33m[Warning]\x1b[0m Ngrok auto-discovery timed out on port ${ngrokApiPort}.`);
+      console.error(`\n\x1b[33m[Warning]\x1b[0m Ngrok auto-discovery timed out on port ${GATEWAY_CONFIG.discoveryPort}.`);
     } else {
       console.error(`\n\x1b[33m[Warning]\x1b[0m PUBLIC_TUNNEL_URL is empty and local Ngrok was not detected.`);
     }
@@ -55,17 +57,6 @@ if (!activeTunnelUrl) {
   }
 }
 
-const GATEWAY_CONFIG = {
-  host: process.env.FILE_SERVER_HOST || '127.0.0.1',
-  port: parseInt(process.env.FILE_SERVER_PORT, 10) || 8080,
-  //workspace: path.join(os.homedir(), '.openclaw', 'workspace'),
-  tavilyKey: process.env.TAVILY_API_KEY,
-  braveKey: process.env.BRAVE_API_KEY,
-  tunnelUrl: activeTunnelUrl,
-  //ngrokToken: process.env.NGROK_AUTHTOKEN,
-  signingSecret: process.env.URL_SIGNING_SECRET || crypto.randomBytes(32).toString('hex')
-};
-
 const TIMEOUT_MS = 10000;
 const MAX_QUERY_LENGTH = 2000;
 let requestCount = 0;
@@ -80,42 +71,28 @@ if (process.argv.includes('--version') || process.argv.includes('-v')) {
   process.exit(0);
 }
 
-const WORKSPACE_DIR = process.env.WORKSPACE_DIR || path.join(os.homedir(), '.openclaw', 'workspace');
-const MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
+const WORKSPACE_DIR = getWorkspaceDir(GATEWAY_CONFIG.workspaceOverride);
 
 function generateSignedUrl(filename, expirationMinutes = 60) {
-    if (!GATEWAY_CONFIG.tunnelUrl) {
+    if (!activeTunnelUrl) {
       throw new Error("PUBLIC_TUNNEL_URL is not configured.");
     }
     
     const safeFilename = path.basename(filename);
     const safeUrlName = encodeURIComponent(safeFilename);
-    const baseUrl = GATEWAY_CONFIG.tunnelUrl.replace(/\/$/, "");
+    const baseUrl = activeTunnelUrl.replace(/\/$/, "");
     const expires = Date.now() + (expirationMinutes * 60 * 1000);
     const dataToSign = `${safeFilename}:${expires}`;
     
-    const signature = crypto.createHmac('sha256', GATEWAY_CONFIG.signingSecret)
+    const signature = crypto.createHmac('sha256', GATEWAY_CONFIG.secret)
                             .update(dataToSign)
                             .digest('hex');
                             
     return `${baseUrl}/${safeUrlName}?expires=${expires}&sig=${signature}`;
 }
 
-async function getSecurePath(requestedPath) {
-    const isAbsolutePath = path.isAbsolute(requestedPath);
-    const targetPath = isAbsolutePath ? requestedPath : path.join(WORKSPACE_DIR, requestedPath);
-    const resolvedPath = path.resolve(targetPath);
-    
-    // Mathematical boundary check to prevent partial directory matching traversal
-    const relativePath = path.relative(WORKSPACE_DIR, resolvedPath);
-    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
-        throw new Error(`SECURITY ALERT: Path traversal attempt blocked.`);
-    }
-    return resolvedPath;
-}
-
 const server = new Server(
-    { name: "openclaw-syncralis", version: "2.2.0" },
+    { name: "openclaw-syncralis", version: pkg.version },
     { capabilities: { tools: {} } }
 );
 
@@ -187,15 +164,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     if (name === "share_files") {
         try {
             const { filePath, action = "read" } = args;
-            const securePath = await getSecurePath(filePath);
+            const securePath = await getSecurePath(WORKSPACE_DIR, filePath);
             const fileName = path.basename(securePath);
 
-            const stats = await fsPromises.stat(securePath);
-            if (!stats.isFile()) throw new Error(`Requested path is a directory.`);
-            if (stats.size > MAX_FILE_SIZE_BYTES) throw new Error(`File exceeds max allowed size.`);
-
-            const mimeType = mime.lookup(securePath) || 'application/octet-stream';
-
             if (action === "download") {
                 const signedLink = generateSignedUrl(fileName);
                 return {
@@ -206,20 +177,20 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
 
-            const fileBuffer = await fsPromises.readFile(securePath);
+            const { buffer, mimeType } = await readSafeFile(securePath);
             if (mimeType.startsWith('image/')) {
-                return { content: [{ type: "image", data: fileBuffer.toString('base64'), mimeType: mimeType }] };
+                return { content: [{ type: "image", data: buffer.toString('base64'), mimeType }] };
             }
             if (mimeType === 'application/pdf') {
-                const pdfData = await pdf(fileBuffer);
+                const pdfData = await pdf(buffer);
                 return { content: [{ type: "text", text: pdfData.text }] };
             }
             if (mimeType === 'application/vnd.openxmlformats-officedocument.wordprocessingml.document') {
-                const docxData = await mammoth.extractRawText({ buffer: fileBuffer });
+                const docxData = await mammoth.extractRawText({ buffer: buffer });
                 return { content: [{ type: "text", text: docxData.value }] };
             }
 
-            return { content: [{ type: "text", text: fileBuffer.toString('utf-8') }] };
+            return { content: [{ type: "text", text: buffer.toString('utf-8') }] };
 
         } catch (error) {
             return { isError: true, content: [{ type: "text", text: `Read Error: ${error.message}` }] };
@@ -231,7 +202,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         try {
             const { url, fileName, headers = {} } = args;
             const safeFileName = path.basename(fileName);
-            targetPath = path.join(WORKSPACE_DIR, safeFileName);
+            targetPath = await getSecurePath(WORKSPACE_DIR, safeFileName);
             
             const response = await fetch(url, { method: 'GET', headers: headers });
             if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
@@ -246,9 +217,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 }
             }
 
-            await fsPromises.mkdir(WORKSPACE_DIR, { recursive: true });
-
-            const fileStream = createWriteStream(targetPath);
+            await ensureWorkspaceExists(WORKSPACE_DIR);
+            
+            const fileStream = createSafeWriteStream(targetPath);
             const webStream = Readable.fromWeb(response.body);
             let downloadedBytes = 0;
 
@@ -275,7 +246,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 }]
             };
         } catch (error) {
-            if (targetPath) await fsPromises.unlink(targetPath).catch(() => {});
+            if (targetPath) await deleteSafeFile(targetPath);
             return { isError: true, content: [{ type: "text", text: `Fetch Error: ${error.message}` }] };
         }
     } 
@@ -393,7 +364,7 @@ async function fetchBrave(query, apiKey, signal) {
 
 function startSecureFileServer() {
     const PORT = GATEWAY_CONFIG.port;
-    const HOST = GATEWAY_CONFIG.host; 
+    const HOST = GATEWAY_CONFIG.host || '127.0.0.1';
     
     const fileServer = http.createServer(async (req, res) => {
         try {
@@ -424,7 +395,7 @@ function startSecureFileServer() {
 
             const safeFilename = path.basename(requestedFile); 
             const dataToVerify = `${safeFilename}:${expires}`;
-            const expectedSig = crypto.createHmac('sha256', GATEWAY_CONFIG.signingSecret)
+            const expectedSig = crypto.createHmac('sha256', GATEWAY_CONFIG.secret)
                                       .update(dataToVerify)
                                       .digest('hex');
 
@@ -435,20 +406,15 @@ function startSecureFileServer() {
                 throw new Error("Cryptographic signature mismatch.");
             }
 
-            const securePath = await getSecurePath(requestedFile);
-            
-            const stats = await fsPromises.stat(securePath);
-            if (!stats.isFile()) throw new Error("Requested path is not a valid file");
-
-            const mimeType = mime.lookup(securePath) || 'application/octet-stream';
+            const securePath = await getSecurePath(WORKSPACE_DIR, requestedFile);
+            const { buffer, mimeType, size } = await readSafeFile(securePath);
             
             res.writeHead(200, {
                 'Content-Type': mimeType,
-                'Content-Length': stats.size,
+                'Content-Length': size,
                 'Content-Disposition': `attachment; filename="${path.basename(securePath)}"` 
             });
-
-            createReadStream(securePath).pipe(res);
+            res.end(buffer);
 
         } catch (error) {
             console.error(`[File Server Security Alert] Blocked access attempt: ${error.message}`);
@@ -464,6 +430,7 @@ function startSecureFileServer() {
 
 async function main() {
     try {
+        await ensureWorkspaceExists(WORKSPACE_DIR);
         startSecureFileServer();
         const transport = new StdioServerTransport();
         await server.connect(transport);