[Init] Initial commit - NetMesh terminal manager

scripts/prepare-ai-research-input.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+input_path="${1:?input path is required}"
+research_dir="${2:?research directory is required}"
+attachment_urls_path="$research_dir/attachment-urls.json"
+
+node -e '
+  const fs = require("node:fs");
+  const auto = require(process.env.RUNNER_TEMP + "/ai-automation.cjs");
+  const input = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+  const urls = auto.extractGithubUserAttachmentAssetUrls(input);
+  fs.writeFileSync(process.argv[2], JSON.stringify(urls) + "\n");
+' "$input_path" "$attachment_urls_path"
+
+attachment_count="$(node -p 'require(process.argv[1]).length' "$attachment_urls_path")"
+if (( attachment_count > 4 )); then
+  echo "Too many GitHub image attachments for bounded research: ${attachment_count}" >&2
+  exit 1
+fi
+if (( attachment_count == 0 )); then
+  cp "$input_path" "$research_dir/input.json"
+  exit 0
+fi
+
+mkdir -p "$research_dir/attachments"
+attachment_kinds_path="$research_dir/attachment-kinds.txt"
+: > "$attachment_kinds_path"
+image_count=0
+for (( index=0; index<attachment_count; index++ )); do
+  source_url="$(node -e '
+    process.stdout.write(require(process.argv[1])[Number(process.argv[2])]);
+  ' "$attachment_urls_path" "$index")"
+  headers_path="$(mktemp "${RUNNER_TEMP}/ai-attachment-headers.XXXXXX")"
+  curl --proto '=https' --tlsv1.2 --retry 3 --retry-all-errors \
+    --connect-timeout 3 --max-time 20 --max-redirs 0 -fsS \
+    -D "$headers_path" -o /dev/null "$source_url"
+  kind="$(node -e '
+    const fs = require("node:fs");
+    const auto = require(process.env.RUNNER_TEMP + "/ai-automation.cjs");
+    process.stdout.write(auto.classifyGithubUserAttachmentRedirect(
+      fs.readFileSync(process.argv[1], "utf8"),
+    ));
+  ' "$headers_path")"
+  rm -f "$headers_path"
+  if [[ "$kind" != "image" && "$kind" != "unsupported_media" ]]; then
+    echo "GitHub attachment did not provide a trusted image/video/audio redirect." >&2
+    exit 1
+  fi
+  printf '%s\n' "$kind" >> "$attachment_kinds_path"
+  if [[ "$kind" == "image" ]]; then
+    image_count=$((image_count + 1))
+  fi
+done
+
+container_name="ai-research-imgproxy-${GITHUB_RUN_ID}-${GITHUB_JOB}"
+if (( image_count > 0 )); then
+  docker run -d --rm --name "$container_name" \
+    --cap-drop=ALL --security-opt=no-new-privileges --read-only \
+    --memory=512m --cpus=1 --pids-limit=128 \
+    --tmpfs /tmp:rw,noexec,nosuid,size=64m \
+    -p 127.0.0.1:18081:8080 \
+    -e IMGPROXY_ALLOWED_SOURCES=https://github.com/user-attachments/assets/ \
+    -e IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES=false \
+    -e IMGPROXY_ALLOW_LINK_LOCAL_SOURCE_ADDRESSES=false \
+    -e IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false \
+    -e IMGPROXY_MAX_SRC_FILE_SIZE=10485760 \
+    -e IMGPROXY_MAX_SRC_RESOLUTION=50 \
+    -e IMGPROXY_MAX_RESULT_DIMENSION=4096 \
+    -e IMGPROXY_MAX_REDIRECTS=2 \
+    -e IMGPROXY_MAX_ANIMATION_FRAMES=1 \
+    -e IMGPROXY_ALWAYS_RASTERIZE_SVG=true \
+    -e IMGPROXY_ALLOW_SECURITY_OPTIONS=false \
+    -e IMGPROXY_COOKIE_PASSTHROUGH=false \
+    -e IMGPROXY_COOKIE_PASSTHROUGH_ALL=false \
+    "$AI_RESEARCH_IMGPROXY_IMAGE" >/dev/null
+fi
+stop_imgproxy() {
+  if (( image_count > 0 )); then
+    docker stop "$container_name" >/dev/null 2>&1 || true
+  fi
+}
+trap stop_imgproxy EXIT
+
+for (( index=0; index<attachment_count; index++ )); do
+  kind="$(sed -n "$((index + 1))p" "$attachment_kinds_path")"
+  if [[ "$kind" != "image" ]]; then
+    continue
+  fi
+  source_url="$(node -e '
+    process.stdout.write(require(process.argv[1])[Number(process.argv[2])]);
+  ' "$attachment_urls_path" "$index")"
+  encoded_source="$(node -e '
+    process.stdout.write(Buffer.from(process.argv[1]).toString("base64url"));
+  ' "$source_url")"
+  output_path="$research_dir/attachments/issue-image-$((index + 1)).png"
+  curl --retry 8 --retry-all-errors --retry-delay 1 --retry-max-time 45 \
+    --connect-timeout 3 --max-time 30 -fsS \
+    "http://127.0.0.1:18081/unsafe/${encoded_source}.png" \
+    -o "$output_path"
+  node -e '
+    const fs = require("node:fs");
+    const expected = Buffer.from("89504e470d0a1a0a", "hex");
+    const actual = fs.readFileSync(process.argv[1]).subarray(0, expected.length);
+    if (!actual.equals(expected)) throw new Error("imgproxy did not produce PNG output");
+  ' "$output_path"
+done
+
+stop_imgproxy
+trap - EXIT
+# The single-quoted program intentionally contains JavaScript template syntax.
+# shellcheck disable=SC2016
+node -e '
+  const fs = require("node:fs");
+  const auto = require(process.env.RUNNER_TEMP + "/ai-automation.cjs");
+  const input = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+  const urls = require(process.argv[2]);
+  const kinds = fs.readFileSync(process.argv[3], "utf8").trim().split("\n");
+  const attachments = urls.map((sourceUrl, index) => ({
+    sourceUrl,
+    kind: kinds[index],
+    ...(kinds[index] === "image"
+      ? { relativePath: `attachments/issue-image-${index + 1}.png` }
+      : {}),
+  }));
+  fs.writeFileSync(
+    process.argv[4],
+    JSON.stringify(auto.rewriteExternalResearchInputAttachments(input, attachments), null, 2) + "\n",
+  );
+' "$input_path" "$attachment_urls_path" "$attachment_kinds_path" "$research_dir/input.json"
+rm -f "$attachment_urls_path" "$attachment_kinds_path"