@0xmaxma/claude-gateway 1.0.0

package/mcp/tools/cron/module.ts

@@ -0,0 +1,158 @@
+/**
+ * Cron tool module — implements ToolModule interface.
+ * Provides cron job management tools via the gateway REST API.
+ * Not a chat channel — tool-only module with "all-configured" visibility.
+ */
+
+import * as path from 'path';
+import type {
+  ToolModule,
+  McpToolDefinition,
+  McpToolResult,
+  ToolVisibility,
+} from '../../types';
+import { CronClient } from './client';
+
+export class CronModule implements ToolModule {
+  id = 'cron';
+  toolVisibility: ToolVisibility = 'all-configured';
+  skillsDir = path.join(__dirname, 'skills');
+
+  private client: CronClient | null = null;
+
+  isEnabled(): boolean {
+    return Boolean(process.env.GATEWAY_API_URL && process.env.GATEWAY_AGENT_ID);
+  }
+
+  private getClient(): CronClient {
+    if (!this.client) {
+      const apiUrl = process.env.GATEWAY_API_URL!;
+      const agentId = process.env.GATEWAY_AGENT_ID!;
+      const apiKey = process.env.GATEWAY_API_KEY;
+      this.client = new CronClient(apiUrl, agentId, apiKey);
+    }
+    return this.client;
+  }
+
+  getTools(): McpToolDefinition[] {
+    return [
+      {
+        name: 'cron_list',
+        description: 'List scheduled cron jobs for this agent',
+        inputSchema: {
+          type: 'object',
+          properties: {},
+          additionalProperties: false,
+        },
+      },
+      {
+        name: 'cron_create',
+        description: 'Create a new cron job',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            name: { type: 'string', description: 'Job name' },
+            schedule: { type: 'string', description: '5-field cron expression' },
+            type: { type: 'string', enum: ['command', 'agent'], description: 'Job type' },
+            command: { type: 'string', description: 'Shell command (type=command)' },
+            prompt: { type: 'string', description: 'Agent prompt (type=agent)' },
+            telegram: { type: 'string', description: 'Telegram chat_id for response' },
+            discord: { type: 'string', description: 'Discord channel_id for agent response delivery' },
+            timeout_ms: { type: 'number', description: 'Timeout in milliseconds' },
+            scheduleKind: {
+              type: 'string',
+              enum: ['cron', 'at'],
+              description: 'Schedule type: "cron" for recurring (default), "at" for one-shot at a specific ISO datetime',
+            },
+            scheduleAt: {
+              type: 'string',
+              description: 'ISO 8601 datetime for one-shot execution (required when scheduleKind=at)',
+            },
+            deleteAfterRun: {
+              type: 'boolean',
+              description: 'Delete the job after it runs once. Defaults to true for scheduleKind=at, false for cron',
+            },
+          },
+          required: ['name', 'type'],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: 'cron_delete',
+        description: 'Delete a cron job by ID',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            job_id: { type: 'string', description: 'Job ID to delete' },
+          },
+          required: ['job_id'],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: 'cron_run',
+        description: 'Run a cron job immediately',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            job_id: { type: 'string', description: 'Job ID to run' },
+          },
+          required: ['job_id'],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: 'cron_get_runs',
+        description: 'Get run history for a cron job',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            job_id: { type: 'string', description: 'Job ID' },
+          },
+          required: ['job_id'],
+          additionalProperties: false,
+        },
+      },
+    ];
+  }
+
+  async handleTool(name: string, args: Record<string, unknown>): Promise<McpToolResult> {
+    const client = this.getClient();
+
+    try {
+      switch (name) {
+        case 'cron_list': {
+          const jobs = await client.list();
+          return { content: [{ type: 'text', text: JSON.stringify(jobs, null, 2) }] };
+        }
+        case 'cron_create': {
+          // Fix 3: Default deleteAfterRun=true for at-type one-shot jobs so they are
+          // automatically cleaned up after firing, preventing re-fire on gateway restart.
+          const scheduleKind = (args.scheduleKind as string | undefined) ?? 'cron';
+          const deleteAfterRun = args.deleteAfterRun !== undefined
+            ? args.deleteAfterRun
+            : scheduleKind === 'at';
+          const job = await client.create({ ...args, scheduleKind, deleteAfterRun });
+          return { content: [{ type: 'text', text: JSON.stringify(job, null, 2) }] };
+        }
+        case 'cron_delete': {
+          await client.delete(args.job_id as string);
+          return { content: [{ type: 'text', text: `deleted job ${args.job_id}` }] };
+        }
+        case 'cron_run': {
+          const run = await client.run(args.job_id as string);
+          return { content: [{ type: 'text', text: JSON.stringify(run, null, 2) }] };
+        }
+        case 'cron_get_runs': {
+          const runs = await client.getRuns(args.job_id as string);
+          return { content: [{ type: 'text', text: JSON.stringify(runs, null, 2) }] };
+        }
+        default:
+          return { content: [{ type: 'text', text: `unknown tool: ${name}` }], isError: true };
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { content: [{ type: 'text', text: `${name} failed: ${msg}` }], isError: true };
+    }
+  }
+}

package/mcp/tools/cron/skills/cron/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: cron
+description: Manage scheduled cron jobs for this agent — list, create, delete, run, and view run history. Use when the user asks to schedule tasks, set up recurring jobs, or check cron status.
+user-invocable: true
+allowed-tools:
+  - cron_list
+  - cron_create
+  - cron_delete
+  - cron_run
+  - cron_get_runs
+---
+
+# /cron — Cron Job Management
+
+Manage scheduled jobs for this agent via the gateway cron API.
+
+Arguments passed: `$ARGUMENTS`
+
+---
+
+## Available commands
+
+### No args or "list" — List all cron jobs
+
+Use `cron_list` to show all scheduled jobs. Format the output as a table.
+
+### "create" — Create a new cron job
+
+Use `cron_create` with the required parameters:
+- `name`: descriptive job name
+- `schedule`: 5-field cron expression (e.g. `0 9 * * *` for daily at 9am)
+- `type`: `command` (shell) or `agent` (Claude prompt)
+- For `command` type: provide `command` parameter
+- For `agent` type: provide `prompt` parameter, optionally `telegram` (chat_id for response)
+
+### "delete <job_id>" — Delete a cron job
+
+Use `cron_delete` with `job_id`.
+
+### "run <job_id>" — Run a job immediately
+
+Use `cron_run` with `job_id`.
+
+### "runs <job_id>" — View run history
+
+Use `cron_get_runs` with `job_id`. Format as a table showing status, duration, and timestamps.

package/mcp/tools/discord/access.ts

@@ -0,0 +1,197 @@
+/**
+ * Discord access control — openclaw pattern from allow-list.ts + dm-command-auth.ts.
+ * Pure logic, no discord.js dependency.
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomBytes } from 'crypto';
+import type { DiscordAccessConfig, DiscordMessageContext, DiscordAccess, DiscordGateResult } from './types';
+export type { DiscordAccessConfig, DiscordAccess } from './types';
+
+export type AccessResult = { allowed: boolean; reason?: string };
+
+// ---------------------------------------------------------------------------
+// File-based access (new — pairing flow)
+// ---------------------------------------------------------------------------
+
+export function defaultAccess(): DiscordAccess {
+  return {
+    dmPolicy: 'pairing',
+    allowFrom: [],
+    guildAllowlist: [],
+    channelAllowlist: [],
+    roleAllowlist: [],
+    pending: {},
+  };
+}
+
+export function loadAccess(stateDir: string): DiscordAccess {
+  const accessFile = path.join(stateDir, 'access.json');
+  try {
+    const raw = fs.readFileSync(accessFile, 'utf8');
+    const parsed = JSON.parse(raw) as Partial<DiscordAccess>;
+    return {
+      dmPolicy: parsed.dmPolicy ?? 'pairing',
+      allowFrom: parsed.allowFrom ?? [],
+      guildAllowlist: parsed.guildAllowlist ?? [],
+      channelAllowlist: parsed.channelAllowlist ?? [],
+      roleAllowlist: parsed.roleAllowlist ?? [],
+      pending: parsed.pending ?? {},
+    };
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+      // Seed from env vars for backward compat
+      return {
+        dmPolicy: (process.env.DISCORD_DM_POLICY as DiscordAccess['dmPolicy']) ?? 'pairing',
+        allowFrom: process.env.DISCORD_DM_ALLOWLIST
+          ? process.env.DISCORD_DM_ALLOWLIST.split(',').filter(Boolean)
+          : [],
+        guildAllowlist: process.env.DISCORD_GUILD_ALLOWLIST
+          ? process.env.DISCORD_GUILD_ALLOWLIST.split(',').filter(Boolean)
+          : [],
+        channelAllowlist: process.env.DISCORD_CHANNEL_ALLOWLIST
+          ? process.env.DISCORD_CHANNEL_ALLOWLIST.split(',').filter(Boolean)
+          : [],
+        roleAllowlist: process.env.DISCORD_ROLE_ALLOWLIST
+          ? process.env.DISCORD_ROLE_ALLOWLIST.split(',').filter(Boolean)
+          : [],
+        pending: {},
+      };
+    }
+    try {
+      fs.renameSync(accessFile, `${accessFile}.corrupt-${Date.now()}`);
+    } catch {}
+    return defaultAccess();
+  }
+}
+
+export function saveAccess(stateDir: string, access: DiscordAccess): void {
+  fs.mkdirSync(stateDir, { recursive: true });
+  const accessFile = path.join(stateDir, 'access.json');
+  const tmp = accessFile + '.tmp';
+  fs.writeFileSync(tmp, JSON.stringify(access, null, 2) + '\n', { mode: 0o600 });
+  fs.renameSync(tmp, accessFile);
+}
+
+export function pruneExpired(access: DiscordAccess, now?: number): boolean {
+  const ts = now ?? Date.now();
+  let changed = false;
+  for (const [code, p] of Object.entries(access.pending)) {
+    if (p.expiresAt < ts) {
+      delete access.pending[code];
+      changed = true;
+    }
+  }
+  return changed;
+}
+
+export function gate(
+  access: DiscordAccess,
+  context: DiscordMessageContext,
+  saveAccessFn: (a: DiscordAccess) => void,
+  generateCode: () => string = () => randomBytes(3).toString('hex'),
+  now?: number,
+): DiscordGateResult {
+  const ts = now ?? Date.now();
+  const pruned = pruneExpired(access, ts);
+  if (pruned) saveAccessFn(access);
+
+  const { isDM, userId, guildId, channelId } = context;
+
+  if (!isDM) {
+    if (access.guildAllowlist.length > 0 && guildId) {
+      if (!access.guildAllowlist.includes(guildId)) return { action: 'drop' };
+    }
+    if (access.channelAllowlist.length > 0) {
+      if (!access.channelAllowlist.includes(channelId)) return { action: 'drop' };
+    }
+    return { action: 'deliver' };
+  }
+
+  // DM message
+  if (access.dmPolicy === 'disabled') return { action: 'drop' };
+
+  if (access.allowFrom.includes(userId)) return { action: 'deliver' };
+  if (access.dmPolicy === 'allowlist') return { action: 'drop' };
+
+  // pairing mode
+  for (const [code, p] of Object.entries(access.pending)) {
+    if (p.senderId === userId) {
+      if (p.replies >= 2) return { action: 'drop' };
+      p.replies++;
+      saveAccessFn(access);
+      return { action: 'pair', code, isResend: true };
+    }
+  }
+  if (Object.keys(access.pending).length >= 3) return { action: 'drop' };
+
+  const code = generateCode();
+  access.pending[code] = {
+    senderId: userId,
+    channelId,
+    createdAt: ts,
+    expiresAt: ts + 60 * 60 * 1000,
+    replies: 1,
+  };
+  saveAccessFn(access);
+  return { action: 'pair', code, isResend: false };
+}
+
+// ---------------------------------------------------------------------------
+// Env-var based access (backward compat)
+// ---------------------------------------------------------------------------
+
+export function checkAccess(
+  config: DiscordAccessConfig,
+  context: DiscordMessageContext,
+  memberRoles?: string[],
+): AccessResult {
+  if (context.isDM) {
+    if (config.dmPolicy === 'disabled') return { allowed: false, reason: 'DM disabled' };
+    if (config.dmPolicy === 'allowlist') {
+      if (
+        !config.dmAllowlist.includes(context.userId) &&
+        !config.dmAllowlist.includes('*')
+      ) {
+        return { allowed: false, reason: 'user not in DM allowlist' };
+      }
+    }
+    return { allowed: true };
+  }
+
+  if (config.guildAllowlist.length && context.guildId) {
+    if (!config.guildAllowlist.includes(context.guildId)) {
+      return { allowed: false, reason: 'guild not allowed' };
+    }
+  }
+
+  if (config.channelAllowlist.length) {
+    if (!config.channelAllowlist.includes(context.channelId)) {
+      return { allowed: false, reason: 'channel not allowed' };
+    }
+  }
+
+  if (config.roleAllowlist.length && memberRoles) {
+    const hasRole = memberRoles.some(r => config.roleAllowlist.includes(r));
+    if (!hasRole) return { allowed: false, reason: 'missing required role' };
+  }
+
+  return { allowed: true };
+}
+
+export function buildAccessConfig(env: NodeJS.ProcessEnv = process.env): DiscordAccessConfig {
+  return {
+    dmPolicy: (env.DISCORD_DM_POLICY as DiscordAccessConfig['dmPolicy']) ?? 'disabled',
+    dmAllowlist: env.DISCORD_DM_ALLOWLIST ? env.DISCORD_DM_ALLOWLIST.split(',').filter(Boolean) : [],
+    guildAllowlist: env.DISCORD_GUILD_ALLOWLIST
+      ? env.DISCORD_GUILD_ALLOWLIST.split(',').filter(Boolean)
+      : [],
+    channelAllowlist: env.DISCORD_CHANNEL_ALLOWLIST
+      ? env.DISCORD_CHANNEL_ALLOWLIST.split(',').filter(Boolean)
+      : [],
+    roleAllowlist: env.DISCORD_ROLE_ALLOWLIST
+      ? env.DISCORD_ROLE_ALLOWLIST.split(',').filter(Boolean)
+      : [],
+  };
+}

package/mcp/tools/discord/client.ts

@@ -0,0 +1,31 @@
+/**
+ * Discord.js client factory.
+ * Dynamic import keeps discord.js out of the module graph at load time.
+ */
+
+export async function createDiscordClient(token: string): Promise<any> {
+  // @ts-ignore — discord.js in mcp/node_modules
+  const { Client, GatewayIntentBits, Partials } = await import('discord.js');
+
+  const client = new Client({
+    intents: [
+      GatewayIntentBits.Guilds,
+      GatewayIntentBits.GuildMessages,
+      GatewayIntentBits.DirectMessages,
+      GatewayIntentBits.MessageContent,
+      GatewayIntentBits.GuildMessageReactions,
+    ],
+    partials: [
+      Partials.Channel,
+      Partials.Message,
+    ],
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    client.once('ready', () => resolve());
+    client.once('error', reject);
+    client.login(token).catch(reject);
+  });
+
+  return client;
+}

package/mcp/tools/discord/commands.ts

@@ -0,0 +1,48 @@
+/**
+ * Discord slash command definitions — openclaw pattern from native-command.ts.
+ * SLASH_COMMANDS is plain JSON; discord.js builders only used in registerCommands().
+ */
+
+import type { SlashCommandDef } from './types';
+
+export const SLASH_COMMANDS: SlashCommandDef[] = [
+  {
+    name: 'ask',
+    description: 'Ask the agent a question',
+    options: [{ name: 'question', description: 'Your question', required: true, type: 'STRING' }],
+  },
+  { name: 'session', description: 'Show current session info' },
+  {
+    name: 'new',
+    description: 'Start a new conversation',
+    options: [{ name: 'name', description: 'Session name', required: false, type: 'STRING' }],
+  },
+  {
+    name: 'model',
+    description: 'Show or switch AI model',
+    options: [{ name: 'name', description: 'Model name', required: false, type: 'STRING' }],
+  },
+];
+
+export async function registerCommands(
+  client: any,
+  token: string,
+): Promise<void> {
+  // @ts-ignore — discord.js in mcp/node_modules
+  const { REST, Routes, SlashCommandBuilder } = await import('discord.js');
+  const rest = new REST().setToken(token);
+
+  const bodies = SLASH_COMMANDS.map(cmd => {
+    const builder = new SlashCommandBuilder()
+      .setName(cmd.name)
+      .setDescription(cmd.description);
+    for (const opt of cmd.options ?? []) {
+      builder.addStringOption((o: any) =>
+        o.setName(opt.name).setDescription(opt.description).setRequired(opt.required),
+      );
+    }
+    return builder.toJSON();
+  });
+
+  await rest.put(Routes.applicationCommands(client.user!.id), { body: bodies });
+}

package/mcp/tools/discord/inbound.ts

@@ -0,0 +1,53 @@
+/**
+ * Discord inbound message handler — openclaw pattern from message-handler.ts.
+ * Preflight validation → context building → handler dispatch.
+ */
+
+import type { InboundMessage, InboundMessageHandler } from '../../types';
+import type { DiscordConfig, DiscordMessage, DiscordMessageContext } from './types';
+import type { DiscordAccessConfig } from './access';
+import { checkAccess } from './access';
+
+export function createMessageHandler(
+  agentId: string,
+  handler: InboundMessageHandler,
+  config: DiscordConfig,
+  accessConfig: DiscordAccessConfig,
+) {
+  return async (message: DiscordMessage): Promise<void> => {
+    if (message.author.bot) return;
+    if (message.system) return;
+
+    const isDM = !message.guild;
+    const isThread = message.channel.isThread();
+
+    const context: DiscordMessageContext = {
+      guildId: message.guildId,
+      channelId: message.channelId,
+      threadId: isThread ? message.channelId : null,
+      userId: message.author.id,
+      username: message.author.username,
+      messageId: message.id,
+      isDM,
+      isThread,
+    };
+
+    const result = checkAccess(accessConfig, context);
+    if (!result.allowed) return;
+
+    const inbound: InboundMessage = {
+      channel: 'discord',
+      accountId: message.client.user?.id ?? 'discord',
+      senderId: message.author.id,
+      chatId: isThread ? message.channelId : message.channelId,
+      chatType: isDM ? 'direct' : 'group',
+      text: message.content,
+      messageId: message.id,
+      threadId: isThread ? message.channelId : undefined,
+      attachmentFileId: message.attachments.first()?.url,
+      ts: message.createdTimestamp,
+    };
+
+    await handler(inbound);
+  };
+}