pi-roundtable-webchat 0.9.2 → 0.9.5

package/CHANGELOG.md

@@ -5,6 +5,22 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.5] - 2026-10-10
+
+- Release in lockstep with pi-roundtable 0.9.5; no package-specific behavior changes. 0.9.4 was tagged but never published.
+
+## [0.9.3] - 2026-10-10
+
+### Fixed
+
+- Uploads that arrive together can no longer pass `unsentUploadBytesPerPrincipal`: the room an upload may fill is reserved per person before its body is read (its declared `Content-Length`, or the room left when none is declared), so ten slow uploads against a 64 MiB allowance take at most 64 MiB, and their request buffers are bounded by it. A body longer than its declared length is cut off and refused (413).
+- A file name loses line and paragraph separators and bidi controls too (they become underscores), and a request `Content-Type` that is not a plain `type/subtype` is refused (415) even under a `/*` entry of `attachmentTypes`, so neither can add to the model's prompt.
+- Long non-ASCII file names no longer fail on Linux (see pi-roundtable 0.9.3).
+
+### Added
+
+- The limit `usedAttachmentBytesPerPrincipal` (1 GiB): what one person's messages may keep across all their conversations. A `send` that would pass it is refused whole with the error code `attachment_quota` (REST 429), and its files stay waiting. Deleting a conversation through the core gives its bytes back. It is enforced by the core of pi-roundtable 0.9.3; with 0.9.2 the limit is ignored.
+
 ## [0.9.2] - 2026-10-10
 
 ### Added

package/README.md

@@ -218,7 +218,7 @@ The TypeScript types are `ClientFrame` and `ServerFrame`.
 | `{ type: "reauth", expiresAt }` | Your token expires soon: send `auth` with a fresh one. |
 | `{ type: "error", code, ref? }` | A frame was refused. `ref` is the `send` id or prompt id it was about. |
 
-Error codes: `bad_frame` (it does not parse, its text is blank or too long, or an answer the question does not allow), `unknown_conversation`, `forbidden` (someone else's conversation or prompt, or an approval above your tier), `unknown_persona` (none of that kind you may open), `unknown_prompt`, `too_many_conversations` (you hold `unusedConversationsPerPrincipal` conversations you have not written in, or opened `newConversationsPerHour` in the last hour), `unknown_attachment` (a `send` named a file that is not waiting for you in that conversation: never uploaded, uploaded to another conversation, already used by a message, or deleted after its time; the whole message is refused and nothing is run), and `busy` (you have `turnsPerPrincipal` turns running or queued, or the conversation already has a turn queued behind its running one; the message was not taken, so send it again once a turn ends).
+Error codes: `bad_frame` (it does not parse, its text is blank or too long, or an answer the question does not allow), `unknown_conversation`, `forbidden` (someone else's conversation or prompt, or an approval above your tier), `unknown_persona` (none of that kind you may open), `unknown_prompt`, `too_many_conversations` (you hold `unusedConversationsPerPrincipal` conversations you have not written in, or opened `newConversationsPerHour` in the last hour), `unknown_attachment` (a `send` named a file that is not waiting for you in that conversation: never uploaded, uploaded to another conversation, already used by a message, or deleted after its time; the whole message is refused and nothing is run), `attachment_quota` (the files would take what your messages keep past `usedAttachmentBytesPerPrincipal`; the whole message is refused and the files stay waiting), and `busy` (you have `turnsPerPrincipal` turns running or queued, or the conversation already has a turn queued behind its running one; the message was not taken, so send it again once a turn ends).
 
 Close codes: `4401` when the token expired without a fresh `auth`, or a fresh one was refused; `4403` when the person is no longer admitted, or a fresh token names someone else.
 The host's own limits close with `1008` (too many frames), `1009` (a frame too big), and `1006` (a client that stopped reading).
@@ -267,7 +267,7 @@ const { file: id } = await response.json();
 socket.send(JSON.stringify({ type: "send", id: "2", conversation, text: "Why did this fail?", attachments: [id] }));
 ```
 
-What the server checks, in this order: the conversation is the caller's (403, 404); the file name is present and at most 255 characters, with control characters replaced and quotes made apostrophes so a name cannot add lines to the model's prompt (400); the `Content-Type` is one of `limits.attachmentTypes` (415); the person has not made `uploadsPerHour` uploads in the last hour (429); the file is within `attachmentBytes`, by `Content-Length` and again while the body streams, so a body that lies about its length is cut off (413); the person's uploads waiting for a message stay within `unsentUploadBytesPerPrincipal` (429); and for PNG, JPEG, GIF, WebP and PDF the first bytes match the type (415), whatever the file name says.
+What the server checks, in this order: the conversation is the caller's (403, 404); the file name is present and at most 255 characters, with control characters, line and paragraph separators and bidi controls replaced and quotes made apostrophes so a name cannot add lines to the model's prompt (400); the `Content-Type` is a plain `type/subtype` and one of `limits.attachmentTypes` (415); the person has not made `uploadsPerHour` uploads in the last hour (429); the file is within `attachmentBytes`, by `Content-Length` and again while the body streams, so a body that lies about its length is cut off (413); the person's uploads waiting for a message stay within `unsentUploadBytesPerPrincipal` (429), the bytes of uploads still arriving counted too, so a person who starts many at once cannot pass it (an upload declares its `Content-Length` to keep the room it needs small); and for PNG, JPEG, GIF, WebP and PDF the first bytes match the type (415), whatever the file name says.
 JSON, plain text and other types have no such check, since any bytes may be labelled so.
 The default types are `image/png`, `image/jpeg`, `image/webp`, `image/gif`, `application/json`, `text/plain` and `application/pdf`; an entry ending in `/*` admits every type under it.
 An rrweb recording is an ordinary `application/json` file.
@@ -275,10 +275,11 @@ An rrweb recording is an ordinary `application/json` file.
 A `send` that names files runs the turn with them: the core moves each file into the conversation's attachment directory, shows up to four images to the model, lists every file under `## Attachments` in the turn's prompt, and lets the model read text, JSON and PDF files with `read_attachment`.
 A plugin's tool passes a file on with `turn.attachment(file)`, which returns the bytes (see the core's [plugin guide](https://github.com/wayne930242/pi-roundtable/blob/master/docs/plugins.md)).
 A message may name at most `attachmentsPerMessage` files, a file belongs to one message, and a message that names a file that is not waiting for the person is refused whole with `unknown_attachment`.
+A message that would take the files its person's messages keep, across all their conversations, past `usedAttachmentBytesPerPrincipal` is refused whole with `attachment_quota` and its files stay waiting.
 
 An upload no message used is deleted after `unsentUploadTtlMs` (24 hours): the plugin sweeps every ten minutes, and once when the host starts.
-Files a message used stay with their conversation, in the host's data directory, as long as the conversation does.
-This plugin has no way to delete a conversation, so none of its files go with it.
+Files a message used stay with their conversation, in the host's data directory, as long as the conversation does: when the conversation is deleted, the core removes them, the uploads waiting for it, and their share of the person's allowance.
+This plugin has no way to delete a conversation itself; a host surface that deletes one does it through the core.
 
 Uploads are as private as the transcript: files sit in the host's data directory under the private conversation, where the owner and the operator can read them, as they can the transcript.
 Only the person who uploaded a file can use it, and only in the conversation it was uploaded to; a shared conversation (one recorded for no one in particular) takes no uploads.
@@ -325,7 +326,8 @@ Only the person who uploaded a file can use it, and only in the conversation it
 | `attachmentBytes` | 10 MiB per uploaded file; never above the core's 25 MiB |
 | `attachmentsPerMessage` | 8 files named by one message |
 | `uploadsPerHour` | 60 uploads per person in any hour |
-| `unsentUploadBytesPerPrincipal` | 64 MiB per person uploaded and not yet used by a message |
+| `unsentUploadBytesPerPrincipal` | 64 MiB per person uploaded and not yet used by a message; uploads arriving together are counted per web chat plugin instance, so two web chats on one host each hold a person to it separately |
+| `usedAttachmentBytesPerPrincipal` | 1 GiB per person kept by their messages across all conversations until a conversation is deleted; needs pi-roundtable 0.9.3 to be enforced |
 | `attachmentTypes` | `image/png`, `image/jpeg`, `image/webp`, `image/gif`, `application/json`, `text/plain`, `application/pdf` |
 | `unsentUploadTtlMs` | 24 hours before an unused upload is deleted |
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-webchat",
-	"version": "0.9.2",
+	"version": "0.9.5",
 	"description": "A WebSocket chat adapter for pi-roundtable: private web conversations for people an OpenID Connect provider signs in, with live progress and approval cards",
 	"type": "module",
 	"license": "MIT",
@@ -43,7 +43,7 @@
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.9.2",
+		"pi-roundtable": "0.9.5",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/chat.ts

@@ -579,6 +579,9 @@ export class WebChat {
 						channelKey(this.#deps.surface, conversation),
 						speaker.principalId,
 						files,
+						{
+							usedBytesLimit: this.#deps.limits.usedAttachmentBytesPerPrincipal,
+						},
 					);
 			} catch (error) {
 				// The refused message holds no place and opens no conversation.
@@ -586,7 +589,11 @@ export class WebChat {
 				if (!frame.conversation) this.#minted.delete(conversation);
 				if (!(error instanceof AttachmentRefusal)) throw error;
 				throw new Refusal(
-					error.code === "unknown_file" ? "unknown_attachment" : "forbidden",
+					error.code === "unknown_file"
+						? "unknown_attachment"
+						: error.code === "quota_exceeded"
+							? "attachment_quota"
+							: "forbidden",
 				);
 			}
 		}

package/src/plugin.ts

@@ -73,6 +73,7 @@ const DEFAULT_LIMITS: WebChatLimits & WebChatRouteLimits = {
 	attachmentsPerMessage: 8,
 	uploadsPerHour: 60,
 	unsentUploadBytesPerPrincipal: 64 * 1024 * 1024,
+	usedAttachmentBytesPerPrincipal: 1024 * 1024 * 1024,
 	attachmentTypes: DEFAULT_ATTACHMENT_TYPES,
 	unsentUploadTtlMs: 24 * 60 * 60_000,
 	maxConnections: 256,
@@ -119,6 +120,7 @@ function checkAttachmentLimits(limits: WebChatLimits): void {
 		"attachmentsPerMessage",
 		"uploadsPerHour",
 		"unsentUploadBytesPerPrincipal",
+		"usedAttachmentBytesPerPrincipal",
 		"unsentUploadTtlMs",
 	] as const)
 		if (!Number.isInteger(limits[key]) || limits[key] < 1)

package/src/protocol.ts

@@ -67,7 +67,9 @@ export type ErrorCode =
 	| "too_many_conversations"
 	| "busy"
 	/** A `send` named a file that is not waiting for this person in this conversation; the whole message is refused. */
-	| "unknown_attachment";
+	| "unknown_attachment"
+	/** A `send` would take the person past `usedAttachmentBytesPerPrincipal`; the whole message is refused and its files stay waiting. */
+	| "attachment_quota";
 
 /** What a client sends: one JSON object per WebSocket text message. */
 export type ClientFrame =

package/src/rest.ts

@@ -64,6 +64,7 @@ const STATUS: Record<string, number> = {
 	unknown_persona: 404,
 	too_many_conversations: 429,
 	unknown_attachment: 400,
+	attachment_quota: 429,
 };
 
 /**

package/src/uploads.ts

@@ -23,6 +23,11 @@ export interface UploadLimits {
 	uploadsPerHour: number;
 	/** The bytes one person may have uploaded and not yet sent in a message; default 64 MiB. */
 	unsentUploadBytesPerPrincipal: number;
+	/**
+	 * The bytes one person's messages may keep in all their conversations, until a conversation is
+	 * deleted and gives its bytes back; default 1 GiB.
+	 */
+	usedAttachmentBytesPerPrincipal: number;
 	/** The content types accepted, such as `image/png`; an entry ending in `/*` admits every type under it. */
 	attachmentTypes: readonly string[];
 	/** How long an upload no message referenced is kept before it is deleted; default 24 hours. */
@@ -66,13 +71,20 @@ const HOUR_MS = 60 * 60_000;
 /** The longest file name accepted, in characters. */
 const NAME_CHARS = 255;
 
+/** Control characters, line and paragraph separators, and bidi controls: none reaches a prompt or a screen as it is. */
+const UNSAFE_NAME_CHARS =
+	/[\p{Cc}\p{Zl}\p{Zp}\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/gu;
+/** A plain type/subtype, the grammar a configured `attachmentTypes` entry has too. */
+const PLAIN_TYPE = /^[a-z0-9.+-]+\/[a-z0-9.+-]+$/;
+
 /**
- * A name the model can read in its prompt: control characters become underscores and quotes
- * become apostrophes, so a name cannot add lines or close the quotes around it.
+ * A name the model can read in its prompt: control and bidi characters and line separators become
+ * underscores and quotes become apostrophes, so a name cannot add lines or close the quotes
+ * around it.
  */
 function safeName(name: string | null): string {
 	const cleaned = (name ?? "")
-		.replace(/\p{Cc}/gu, "_")
+		.replace(UNSAFE_NAME_CHARS, "_")
 		.replaceAll('"', "'")
 		.trim();
 	if (cleaned === "" || cleaned.length > NAME_CHARS)
@@ -121,6 +133,10 @@ async function readLimited(
 export class Uploads {
 	readonly #deps: UploadsDeps;
 	readonly #rate: RateWindow;
+	/** The bytes each person's uploads in flight may still write, counted against their allowance. */
+	readonly #reserved = new Map<string, number>();
+	/** The last admission queued for each person, which the next one waits for. */
+	readonly #admissions = new Map<string, Promise<void>>();
 
 	constructor(deps: UploadsDeps) {
 		this.#deps = deps;
@@ -145,6 +161,51 @@ export class Uploads {
 		};
 	}
 
+	/**
+	 * Reserves the bytes an upload may write against the person's allowance, one admission at a
+	 * time per person, so uploads in flight together count against it and not only the ones saved.
+	 * Returns the bytes reserved, and the most the body may be.
+	 */
+	#admit(
+		principalId: string,
+		declared: number | undefined,
+	): Promise<{ reserved: number; cap: number }> {
+		const { limits } = this.#deps;
+		const run = async () => {
+			const holding = this.#reserved.get(principalId) ?? 0;
+			const waiting = await this.#deps.attachments().pendingBytes(principalId);
+			const room = Math.max(
+				limits.unsentUploadBytesPerPrincipal - waiting - holding,
+				0,
+			);
+			const cap = Math.min(limits.attachmentBytes, room);
+			if (declared !== undefined && declared > room)
+				throw new UploadRefusal(429, "too_many_uploads");
+			const reserved = declared === undefined ? cap : Math.min(declared, cap);
+			this.#reserved.set(principalId, holding + reserved);
+			return { reserved, cap };
+		};
+		const result = (
+			this.#admissions.get(principalId) ?? Promise.resolve()
+		).then(run);
+		const tail = result.then(
+			() => undefined,
+			() => undefined,
+		);
+		this.#admissions.set(principalId, tail);
+		void tail.then(() => {
+			if (this.#admissions.get(principalId) === tail)
+				this.#admissions.delete(principalId);
+		});
+		return result;
+	}
+
+	#release(principalId: string, reserved: number): void {
+		const left = (this.#reserved.get(principalId) ?? 0) - reserved;
+		if (left > 0) this.#reserved.set(principalId, left);
+		else this.#reserved.delete(principalId);
+	}
+
 	/** Takes the request's body as a file for `principalId` in `channel`; throws an UploadRefusal. */
 	async receive(
 		request: Request,
@@ -155,37 +216,52 @@ export class Uploads {
 		const { limits } = this.#deps;
 		const fileName = safeName(name);
 		const type = baseType(request.headers.get("content-type"));
-		if (!type || !isAllowedType(limits.attachmentTypes, type))
+		if (
+			!type ||
+			!PLAIN_TYPE.test(type) ||
+			!isAllowedType(limits.attachmentTypes, type)
+		)
 			throw new UploadRefusal(415, "unsupported_media_type");
-		const declared = Number(request.headers.get("content-length"));
-		if (Number.isFinite(declared) && declared > limits.attachmentBytes)
+		const header = request.headers.get("content-length");
+		const length = header === null ? Number.NaN : Number(header);
+		// A header that is no length is no declaration; the body is held to the room left instead.
+		const declared =
+			Number.isFinite(length) && length >= 0 ? length : undefined;
+		if (declared !== undefined && declared > limits.attachmentBytes)
 			throw new UploadRefusal(413, "payload_too_large");
 		if (!this.#rate.take(principalId))
 			throw new UploadRefusal(429, "too_many_uploads");
-		const attachments = this.#deps.attachments();
-		const waiting = await attachments.pendingBytes(principalId);
-		const room = limits.unsentUploadBytesPerPrincipal - waiting;
-		const bytes = await readLimited(
-			request,
-			Math.min(limits.attachmentBytes, Math.max(room, 0)),
-		);
-		if (!bytes)
-			throw room < limits.attachmentBytes
-				? new UploadRefusal(429, "too_many_uploads")
-				: new UploadRefusal(413, "payload_too_large");
-		if (!bytesMatchType(type, bytes))
-			throw new UploadRefusal(415, "unsupported_media_type");
-		const stored = await attachments.save(channel, principalId, {
-			name: fileName,
-			contentType: type,
-			data: bytes,
-		});
-		return {
-			file: stored.file,
-			name: stored.name,
-			contentType: stored.contentType,
-			size: stored.size,
+		const { reserved, cap } = await this.#admit(principalId, declared);
+		let held = reserved;
+		const release = () => {
+			this.#release(principalId, held);
+			held = 0;
 		};
+		try {
+			const bytes = await readLimited(request, reserved);
+			if (!bytes)
+				// A body past its declared length lied; one past the room left is the allowance's.
+				throw declared === undefined && cap < limits.attachmentBytes
+					? new UploadRefusal(429, "too_many_uploads")
+					: new UploadRefusal(413, "payload_too_large");
+			if (!bytesMatchType(type, bytes))
+				throw new UploadRefusal(415, "unsupported_media_type");
+			const stored = await this.#deps.attachments().save(channel, principalId, {
+				name: fileName,
+				contentType: type,
+				data: bytes,
+			});
+			// The saved file counts as waiting from here on.
+			release();
+			return {
+				file: stored.file,
+				name: stored.name,
+				contentType: stored.contentType,
+				size: stored.size,
+			};
+		} finally {
+			release();
+		}
 	}
 
 	/** Deletes the uploads no message used within the time to live; returns how many. */