fix(markdown): secure browser document bindings [4/5]

ts/packages/agents/markdown/src/agent/documentPathPolicy.ts

@@ -84,17 +84,21 @@ export function resolveExistingFileWithinRoot(
     root: string,
     requestedPath: string,
 ): string | undefined {
+    const relativePath = normalizeRelativeDocumentPath(requestedPath);
+    if (relativePath === undefined) {
+        return undefined;
+    }
     const rootPaths = resolveRootPaths(root);
-    const candidate = path.resolve(rootPaths.resolvedRoot, requestedPath);
+    const candidate = path.resolve(rootPaths.resolvedRoot, relativePath);
     if (!isPathWithinRoot(rootPaths.resolvedRoot, candidate)) {
         return undefined;
     }
     try {
         const canonicalFile = fs.realpathSync(candidate);
-        return isPathWithinRoot(rootPaths.canonicalRoot, canonicalFile) &&
-            fs.statSync(canonicalFile).isFile()
-            ? canonicalFile
-            : undefined;
+        if (!canonicalFile.startsWith(rootPaths.canonicalRoot + path.sep)) {
+            return undefined;
+        }
+        return fs.statSync(canonicalFile).isFile() ? canonicalFile : undefined;
     } catch (error) {
         if (isFileNotFoundError(error)) {
             return undefined;
@@ -135,7 +139,10 @@ function ensureDirectoryWithinRoot(
         }
 
         const canonicalDirectory = fs.realpathSync(nextDirectory);
-        if (!isPathWithinRoot(root.canonicalRoot, canonicalDirectory)) {
+        if (
+            canonicalDirectory !== root.canonicalRoot &&
+            !canonicalDirectory.startsWith(root.canonicalRoot + path.sep)
+        ) {
             return undefined;
         }
         currentDirectory = canonicalDirectory;
@@ -147,8 +154,12 @@ export function resolveWritableFileWithinRoot(
     root: string,
     requestedPath: string,
 ): string | undefined {
+    const relativePath = normalizeRelativeDocumentPath(requestedPath);
+    if (relativePath === undefined) {
+        return undefined;
+    }
     const rootPaths = resolveRootPaths(root);
-    const candidate = path.resolve(rootPaths.resolvedRoot, requestedPath);
+    const candidate = path.resolve(rootPaths.resolvedRoot, relativePath);
     if (!isPathWithinRoot(rootPaths.resolvedRoot, candidate)) {
         return undefined;
     }
@@ -172,7 +183,7 @@ export function resolveWritableFileWithinRoot(
             return undefined;
         }
         const canonicalFile = fs.realpathSync(writablePath);
-        return isPathWithinRoot(rootPaths.canonicalRoot, canonicalFile)
+        return canonicalFile.startsWith(rootPaths.canonicalRoot + path.sep)
             ? canonicalFile
             : undefined;
     } catch (error) {

ts/packages/agents/markdown/src/agent/documentUpdatePersistence.ts

@@ -131,6 +131,9 @@ export function persistDocumentOperations(
 ) {
     validateIdentity(binding, expected);
     let filePath = resolveBoundFile(binding);
+    if (!filePath.startsWith(binding.root + path.sep)) {
+        throw new Error("Document binding path changed");
+    }
     const currentContent = fs.readFileSync(filePath, "utf-8");
     const currentRevision = computeContentRevision(currentContent);
     if (expected.updatedRevision === currentRevision) {
@@ -158,6 +161,9 @@ export function persistDocumentOperations(
 
     validateIdentity(binding, expected);
     filePath = resolveBoundFile(binding);
+    if (!filePath.startsWith(binding.root + path.sep)) {
+        throw new Error("Document binding path changed");
+    }
     if (
         computeContentRevision(fs.readFileSync(filePath, "utf-8")) !==
         currentRevision

ts/packages/agents/markdown/src/agent/ipcTypes.ts

@@ -3,6 +3,20 @@
 
 // IPC Message Types for TypeAgent Communication
 
+export interface SetFileMessage {
+    type: "setFile";
+    workspaceRoot?: string;
+    relativePath?: string;
+}
+
+export interface BindingUpdatedMessage {
+    type: "bindingUpdated";
+    bindingToken: string | null;
+    boundFilePath: string | null;
+    boundRoot: string | null;
+    boundRelativePath: string | null;
+}
+
 // Agent ← View: UI command requests
 export interface UICommandMessage {
     type: "uiCommand";
@@ -46,14 +60,15 @@ export interface DocumentContentMessage {
     type: "documentContent";
     requestId: string;
     content: string;
-    source?: "file" | "error";
+    source?: "client-serializer" | "yjs-fallback" | "file-fallback" | "error";
     error?: string;
     timestamp: number;
     bindingToken: string | null;
     boundFilePath: string | null;
     boundRoot: string | null;
     boundRelativePath: string | null;
     revision: string | null;
+    readToken?: string;
     identityMismatch?: boolean;
 }
 
@@ -68,6 +83,7 @@ export interface LLMOperationsMessage {
     expectedRelativePath?: string;
     expectedRevision: string;
     expectedUpdatedRevision?: string;
+    expectedReadToken?: string;
 }
 
 export interface OperationsAppliedMessage {
@@ -100,6 +116,24 @@ export interface OperationsAppliedEvent {
     operationCount: number;
 }
 
+export interface DocumentSnapshotEvent {
+    type: "documentSnapshot";
+    bindingToken: string;
+    markdown: string;
+    revision: string;
+    timestamp: number;
+}
+
+export interface BindingBootstrapEvent {
+    type: "bindingBootstrap";
+    bindingToken: string | null;
+    documentId: string | null;
+    documentName: string | null;
+    boundRelativePath: string | null;
+    revision: string | null;
+    timestamp: number;
+}
+
 // Client ← View: Markdown content requests
 export interface RequestMarkdownMessage {
     type: "requestMarkdown";

ts/packages/agents/markdown/src/agent/markdownActionHandler.ts

@@ -448,6 +448,7 @@ async function handleStreamingMarkdownAction(
         content: markdownContent,
         binding,
         revision,
+        readToken,
     } = await readCurrentDocumentContent(actionContext);
 
     try {
@@ -510,6 +511,7 @@ async function handleStreamingMarkdownAction(
                         binding,
                         revision,
                         computeContentRevision(updatedContent),
+                        readToken,
                     );
                 }
 
@@ -912,6 +914,7 @@ async function readCurrentDocumentContent(
     content: string;
     binding: CurrentDocumentBinding;
     revision: string;
+    readToken?: string;
 }> {
     const agentContext = actionContext.sessionContext.agentContext;
     const storage = actionContext.sessionContext.sessionStorage;
@@ -953,6 +956,7 @@ async function readCurrentDocumentContent(
             token: agentContext.currentBindingToken,
         },
         revision: response.revision ?? computeContentRevision(response.content),
+        ...(response.readToken ? { readToken: response.readToken } : {}),
     };
 }
 
@@ -962,6 +966,7 @@ async function applyOperationsForCurrentDocument(
     binding: CurrentDocumentBinding,
     revision: string,
     expectedUpdatedRevision?: string,
+    expectedReadToken?: string,
 ): Promise<void> {
     const agentContext = actionContext.sessionContext.agentContext;
     const storage = actionContext.sessionContext.sessionStorage;
@@ -1016,6 +1021,7 @@ async function applyOperationsForCurrentDocument(
         expectedRelativePath: binding.relativePath,
         expectedRevision: revision,
         expectedUpdatedRevision,
+        ...(expectedReadToken ? { expectedReadToken } : {}),
     };
     const viewProcess = getCurrentDocumentViewProcess(agentContext);
     if (!viewProcess) {
@@ -1073,7 +1079,7 @@ async function updateCurrentDocument(
     actionContext: ActionContext<MarkdownActionContext>,
     agent: Awaited<ReturnType<typeof createMarkdownAgent>>,
 ): Promise<ActionResult> {
-    const { content, binding, revision } =
+    const { content, binding, revision, readToken } =
         await readCurrentDocumentContent(actionContext);
     const response = await agent.updateDocument(
         content,
@@ -1094,6 +1100,8 @@ async function updateCurrentDocument(
             response.data.operations,
             binding,
             revision,
+            undefined,
+            readToken,
         );
     }
     return createActionResult(
@@ -1155,6 +1163,7 @@ type ApplyExpectations = {
     expectedRelativePath: string;
     expectedRevision: string;
     expectedUpdatedRevision: string | undefined;
+    expectedReadToken?: string;
 };
 
 type ApplyResult = {
@@ -1189,7 +1198,7 @@ export async function sendOperationsToView(
                 revisionMismatch: false,
                 error: "View process operation timeout",
             });
-        }, 15000);
+        }, 60_000);
 
         const responseHandler = (message: Record<string, unknown>) => {
             if (
@@ -1226,6 +1235,7 @@ type ViewDocumentContentResponse = {
     content: string;
     bindingToken: string | null;
     revision: string | null;
+    readToken: string | undefined;
     identityMismatch: boolean;
     error: string | undefined;
 };
@@ -1269,6 +1279,10 @@ export async function getDocumentContentFromView(
                     typeof message.revision === "string"
                         ? message.revision
                         : null,
+                readToken:
+                    typeof message.readToken === "string"
+                        ? message.readToken
+                        : undefined,
                 identityMismatch: message.identityMismatch === true,
                 error:
                     typeof message.error === "string"

ts/packages/agents/markdown/src/view/route/collaborationManager.ts

@@ -44,6 +44,13 @@ export class CollaborationManager {
             `Using existing Y.js document: ${documentId} ${filePath ? `(${filePath})` : "(memory-only)"}`,
         );
     }
+
+    forgetDocument(documentId: string): void {
+        this.documents.delete(documentId);
+        this.documentPaths.delete(documentId);
+        debug(`Forgot document: ${documentId}`);
+    }
+
     getStats(): any {
         return {
             documents: this.documents.size,