@0xmaxma/claude-gateway 2.0.10 → 2.0.11

package/dist/api/router.js

@@ -42,6 +42,7 @@ const response_errors_1 = require("../orchestration/response-errors");
 const voice_settings_router_1 = require("./voice-settings-router");
 const express_1 = require("express");
 const identity_1 = require("../orchestration/identity");
+const types_1 = require("../orchestration/types");
 const crypto_1 = require("crypto");
 const fs = __importStar(require("fs"));
 const fsp = __importStar(require("fs/promises"));
@@ -56,7 +57,7 @@ const config_write_lock_1 = require("../config/config-write-lock");
 const auth_1 = require("./auth");
 const media_store_1 = require("../history/media-store");
 const db_1 = require("../history/db");
-const types_1 = require("../history/types");
+const types_2 = require("../history/types");
 const wizard_state_1 = require("./wizard-state");
 const pending_senders_1 = require("./pending-senders");
 const create_agent_prompts_1 = require("../agent/create-agent-prompts");
@@ -117,6 +118,12 @@ const SAFE_FILENAME_RE = /^[a-zA-Z0-9._\-() ]+$/;
 // escape the agent's directory. Clients may pass custom (non-UUID) session ids, so
 // this preserves that while blocking path traversal.
 const SESSION_ID_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+// Task and command ids are server/client-generated UUIDs; controlByUser rejects anything else.
+const TASK_CONTROL_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TASK_CONTROL_ERROR_STATUS = {
+    INVALID_INPUT: 400, EXECUTION_DENIED: 403, AUTOMATION_SESSION_CLOSED: 410, COMMAND_QUEUE_FULL: 429,
+    REVISION_CONFLICT: 409, STATE_CONFLICT: 409, NOTHING_TO_RESUME: 409, IDEMPOTENCY_CONFLICT: 409, ORCHESTRATION_DISABLED: 409,
+};
 function isValidSessionId(v) {
     return typeof v === 'string' && SESSION_ID_RE.test(v);
 }
@@ -623,6 +630,11 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const clientMessageId = client_message_id;
+        if (body.execution_task_id !== undefined && !isValidSessionId(body.execution_task_id)) {
+            res.status(400).json({ error: 'Invalid execution task' });
+            return;
+        }
+        const executionTaskId = body.execution_task_id;
         if (message !== undefined && typeof message !== 'string') {
             res.status(400).json({ error: 'message must be a string if provided' });
             return;
@@ -811,7 +823,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                 const inputId = await runner.acceptApiMessage(sessionId, chatIdStr, trimmedMessage, {
                     timeoutMs, allowTools: agentConfigs.get(agentId)?.allow_tools ?? !!apiKey.allow_tools, mediaFiles: validatedMediaFiles, model: modelStr,
                     imageParams: validatedImageParams, videoParams: validatedVideoParams,
-                    requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId,
+                    requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId, executionTaskId,
                 });
                 res.status(202).json({ status: 'accepted', input_id: inputId, session_id: sessionId, client_message_id: clientMessageId });
             }
@@ -849,7 +861,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                 openSseStream(res);
                 const agentCfg = agentConfigs.get(agentId);
                 const allowTools = agentCfg.allow_tools ?? !!apiKey.allow_tools;
-                onClientDisconnect = await runner.sendApiMessageStream(sessionId, chatIdStr, trimmedMessage, sseCallbacks, { timeoutMs, allowTools, mediaFiles: validatedMediaFiles, model: modelStr, skipUserMessage, imageParams: validatedImageParams, videoParams: validatedVideoParams, requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId });
+                onClientDisconnect = await runner.sendApiMessageStream(sessionId, chatIdStr, trimmedMessage, sseCallbacks, { timeoutMs, allowTools, mediaFiles: validatedMediaFiles, model: modelStr, skipUserMessage, imageParams: validatedImageParams, videoParams: validatedVideoParams, requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId, executionTaskId });
                 // Client disconnect — detaches this connection's sink. The turn keeps
                 // running and keeps buffering, so the client can resume it on a new
                 // connection via GET …/sessions/:sessionId/stream?after_seq= (#421).
@@ -896,7 +908,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                         videoParams: validatedVideoParams,
                         requestId,
                         principalId: (0, identity_1.apiPrincipal)(apiKey),
-                        clientMessageId,
+                        clientMessageId, executionTaskId,
                     }));
                 }
                 const syncResult = {
@@ -4153,7 +4165,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const { source, rawChatId } = parseHistoryChatId(chatId);
-        if (!(0, types_1.isChatChannel)(source)) {
+        if (!(0, types_2.isChatChannel)(source)) {
             res.status(400).json({ error: 'Sessions endpoint only supports telegram/discord/line/slack/whatsapp/whatsapp_cloud chats' });
             return;
         }
@@ -4339,7 +4351,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const { source, rawChatId } = parseHistoryChatId(chatId);
-        if (!(0, types_1.isChatChannel)(source)) {
+        if (!(0, types_2.isChatChannel)(source)) {
             res.status(400).json({ error: 'Cross-channel messaging only supported for telegram/discord/line/slack/whatsapp/whatsapp_cloud chats' });
             return;
         }
@@ -5188,6 +5200,41 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             res.status(403).json({ error: 'Question unavailable for this principal or already answered' });
         }
     });
+    router.post('/v1/agents/:agentId/sessions/:sessionId/tasks/:taskId/control', auth, async (req, res) => {
+        const { agentId, sessionId, taskId } = req.params;
+        const key = req.apiKey, runner = agentRunners.get(agentId);
+        if (!(0, auth_1.canAccessAgent)(key, agentId) || !runner) {
+            res.status(403).json({ error: 'ACCESS_DENIED' });
+            return;
+        }
+        if (!isValidSessionId(sessionId) || !TASK_CONTROL_UUID_RE.test(taskId)) {
+            res.status(400).json({ error: 'INVALID_INPUT' });
+            return;
+        }
+        if (!(runner.getAgentConfig().allow_tools ?? Boolean(key.allow_tools))) {
+            res.status(403).json({ error: 'EXECUTION_DENIED' });
+            return;
+        }
+        const b = req.body;
+        if (!b || Object.keys(b).some(k => !['id', 'action', 'expectedRevision', 'text'].includes(k)) || typeof b.id !== 'string' || !TASK_CONTROL_UUID_RE.test(b.id) || !['pause', 'revise', 'resume', 'agent', 'user'].includes(b.action) || !Number.isSafeInteger(b.expectedRevision) || b.expectedRevision < 1 || (b.action === 'revise' ? (typeof b.text !== 'string' || !b.text.trim() || b.text.length > 4000) : b.text !== undefined)) {
+            res.status(400).json({ error: 'INVALID_INPUT' });
+            return;
+        }
+        try {
+            res.status(202).json({ task: await runner.controlApiTask(sessionId, (0, identity_1.apiPrincipal)(key), taskId, b) });
+        }
+        catch (e) {
+            // Map by code: OrchestrationError messages may carry human-readable detail.
+            const code = e instanceof types_1.OrchestrationError ? e.code : e instanceof Error ? e.message : '';
+            const status = TASK_CONTROL_ERROR_STATUS[code];
+            if (status) {
+                res.status(status).json({ error: code });
+                return;
+            }
+            // Unknown codes (e.g. TASK_NOT_FOUND) stay ACCESS_DENIED so task existence is not revealed.
+            res.status(403).json({ error: 'ACCESS_DENIED' });
+        }
+    });
     router.post('/v1/agents/:agentId/sessions/:sessionId/tasks/:taskId/cancel', auth, async (req, res) => {
         const { agentId, sessionId, taskId } = req.params;
         const key = req.apiKey, runner = agentRunners.get(agentId);