@0xmaxma/claude-gateway 2.0.9 → 2.0.11

package/dist/api/jev-router.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JEV_EVALUATE_PATH = void 0;
+exports.jsonExceptJevEvaluate = jsonExceptJevEvaluate;
+exports.createJevRouter = createJevRouter;
+const express_1 = __importStar(require("express"));
+const crypto_1 = require("crypto");
+const auth_1 = require("./auth");
+const jev_gateway_1 = require("../orchestration/jev-gateway");
+const types_1 = require("../jev/types");
+exports.JEV_EVALUATE_PATH = '/api/v1/jev/evaluate';
+// The global JSON parser stops at 100kB; maxInputBytes may be configured up to
+// 1 MiB, plus room for agentId/requestId and JSON framing.
+const JEV_BODY_LIMIT = 1048576 + 8192;
+const jevJson = express_1.default.json({ limit: JEV_BODY_LIMIT });
+/** Parses the evaluation body after authentication; parse failures keep the Jev error shape. */
+function jevBody(req, res, next) {
+    jevJson(req, res, (error) => {
+        if (!error) {
+            next();
+            return;
+        }
+        const tooLarge = error.type === 'entity.too.large';
+        res.status(tooLarge ? 413 : 400).json({ error: { code: 'JEV_INVALID_REQUEST', message: tooLarge ? 'Jev request body exceeds the gateway limit.' : 'Jev request body is not valid JSON.' } });
+    });
+}
+/** The gateway-wide JSON parser, leaving the Jev evaluation body to jevBody. */
+function jsonExceptJevEvaluate() {
+    const json = express_1.default.json();
+    return (req, res, next) => req.method === 'POST' && req.path === exports.JEV_EVALUATE_PATH ? next() : json(req, res, next);
+}
+/** Evaluation is a paid action. An API key must have write access to its agent. */
+function createJevRouter(config, agents) {
+    const router = (0, express_1.Router)();
+    router.use('/v1/jev', (req, res, next) => (0, auth_1.createApiAuthMiddleware)(config.gateway.api?.keys ?? [])(req, res, next));
+    const allowed = (req, agentId, write) => {
+        const key = req.apiKey;
+        const current = key && config.gateway.api?.keys.find(k => k.key === key.key);
+        return Boolean(current && (write ? (0, auth_1.canWriteAgent)(current, agentId) : (0, auth_1.canAccessAgent)(current, agentId)));
+    };
+    router.post('/v1/jev/evaluate', jevBody, async (req, res) => {
+        const body = req.body;
+        const agent = typeof body?.agentId === 'string' ? agents.get(body.agentId) : undefined;
+        if (!agent || !allowed(req, agent.id, true)) {
+            res.status(403).json({ error: 'ACCESS_DENIED' });
+            return;
+        }
+        if (!body || Object.keys(body).some(key => !['agentId', 'state', 'questions', 'requestId'].includes(key))) {
+            res.status(400).json({ error: 'INVALID_REQUEST' });
+            return;
+        }
+        const controller = new AbortController();
+        const onClose = () => { if (!res.writableFinished)
+            controller.abort(); };
+        res.once('close', onClose);
+        try {
+            const principalId = (0, crypto_1.createHash)('sha256').update(req.apiKey.key).digest('hex');
+            // Validate the caller's own ID before deriving the internal one from it.
+            if (body.requestId !== undefined && (typeof body.requestId !== 'string' || !/^[\x21-\x7e]{1,256}$/.test(body.requestId)))
+                throw new types_1.JevError('INVALID_REQUEST', 'Invalid request ID.');
+            const requestId = typeof body.requestId === 'string' ? (0, crypto_1.createHash)('sha256').update(JSON.stringify([principalId, agent.id, body.requestId])).digest('hex') : undefined;
+            const result = await (0, jev_gateway_1.gatewayJev)(config).service.evaluate({ state: body.state, questions: body.questions, ...(requestId ? { requestId } : {}) }, {
+                principalId, agentId: agent.id, consumer: 'api', signal: controller.signal,
+                authorize: () => allowed(req, agent.id, true) && agents.has(agent.id) && (0, jev_gateway_1.jevAllowed)(config, agents.get(agent.id))
+            });
+            if (!controller.signal.aborted)
+                res.json(result);
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                return;
+            const e = error instanceof types_1.JevError ? error : new types_1.JevError('PROVIDER_UNAVAILABLE', 'Jev evaluation unavailable.');
+            res.status(e.code === 'ACCESS_DENIED' ? 403 : e.code === 'AUTHENTICATION_FAILED' ? 502 : e.code === 'INVALID_REQUEST' ? 400 : e.code === 'REQUEST_CONFLICT' ? 409 : e.code === 'QUOTA_EXCEEDED' ? 402 : e.code === 'RATE_LIMITED' || e.code === 'QUEUE_FULL' ? 429 : e.code === 'DEADLINE_EXCEEDED' ? 504 : 503).json({ error: { code: `JEV_${e.code}`, message: e.message, ...e.metadata } });
+        }
+        finally {
+            res.off('close', onClose);
+        }
+    });
+    router.get('/v1/jev/usage', (req, res) => {
+        const agentId = typeof req.query.agentId === 'string' ? req.query.agentId : '';
+        if (!agents.has(agentId) || !allowed(req, agentId, false)) {
+            res.status(403).json({ error: 'ACCESS_DENIED' });
+            return;
+        }
+        const limit = req.query.limit === undefined ? 50 : Number(req.query.limit), offset = req.query.offset === undefined ? 0 : Number(req.query.offset);
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100 || !Number.isSafeInteger(offset) || offset < 0) {
+            res.status(400).json({ error: 'INVALID_PAGE' });
+            return;
+        }
+        res.setHeader('Cache-Control', 'no-store');
+        res.json((0, jev_gateway_1.gatewayJev)(config).history(agentId, limit, offset));
+    });
+    return router;
+}
+//# sourceMappingURL=jev-router.js.map

package/dist/api/jev-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jev-router.js","sourceRoot":"","sources":["../../src/api/jev-router.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,sDAGC;AAED,0CAuCC;AAjED,mDAA2F;AAC3F,mCAAoC;AAEpC,iCAAgF;AAChF,8DAAsE;AACtE,wCAAoD;AAEvC,QAAA,iBAAiB,GAAC,sBAAsB,CAAC;AACtD,+EAA+E;AAC/E,2DAA2D;AAC3D,MAAM,cAAc,GAAC,OAAO,GAAC,IAAI,CAAC;AAClC,MAAM,OAAO,GAAC,iBAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,cAAc,EAAC,CAAC,CAAC;AACnD,gGAAgG;AAChG,SAAS,OAAO,CAAC,GAAW,EAAC,GAAY,EAAC,IAAiB;IACzD,OAAO,CAAC,GAAG,EAAC,GAAG,EAAC,CAAC,KAAc,EAAC,EAAE;QAChC,IAAG,CAAC,KAAK,EAAC,CAAC;YAAA,IAAI,EAAE,CAAC;YAAA,OAAO;QAAA,CAAC;QAC1B,MAAM,QAAQ,GAAE,KAAwB,CAAC,IAAI,KAAG,kBAAkB,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,qBAAqB,EAAC,OAAO,EAAC,QAAQ,CAAA,CAAC,CAAA,6CAA6C,CAAA,CAAC,CAAA,qCAAqC,EAAC,EAAC,CAAC,CAAC;IAC/K,CAAC,CAAC,CAAC;AACL,CAAC;AACD,gFAAgF;AAChF,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAC,iBAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,CAAC,GAAG,EAAC,GAAG,EAAC,IAAI,EAAC,EAAE,CAAA,GAAG,CAAC,MAAM,KAAG,MAAM,IAAE,GAAG,CAAC,IAAI,KAAG,yBAAiB,CAAA,CAAC,CAAA,IAAI,EAAE,CAAA,CAAC,CAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,IAAI,CAAC,CAAC;AACrG,CAAC;AACD,mFAAmF;AACnF,SAAgB,eAAe,CAAC,MAAqB,EAAE,MAAgC;IACrF,MAAM,MAAM,GAAC,IAAA,gBAAM,GAAE,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAC,GAAG,EAAC,IAAI,EAAC,EAAE,CAAA,IAAA,8BAAuB,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,EAAC,GAAG,EAAC,IAAI,CAAC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAC,CAAC,GAAW,EAAC,OAAc,EAAC,KAAa,EAAE,EAAE;QACzD,MAAM,GAAG,GAAE,GAAmC,CAAC,MAAM,CAAC;QACtD,MAAM,OAAO,GAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,GAAG,KAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAA,CAAC,CAAA,IAAA,oBAAa,EAAC,OAAO,EAAC,OAAO,CAAC,CAAA,CAAC,CAAA,IAAA,qBAAc,EAAC,OAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAC,GAAG,EAAC,GAAG,EAAC,EAAE;QACvD,MAAM,IAAI,GAAC,GAAG,CAAC,IAAI,CAAC;QACpB,MAAM,KAAK,GAAC,OAAO,IAAI,EAAE,OAAO,KAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAC,KAAK,CAAC,EAAE,EAAC,IAAI,CAAC,EAAC,CAAC;YAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAChG,IAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,EAAC,OAAO,EAAC,WAAW,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAC,CAAC;YAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,iBAAiB,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAC7J,MAAM,UAAU,GAAC,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,OAAO,GAAC,GAAE,EAAE,GAAC,IAAG,CAAC,GAAG,CAAC,gBAAgB;YAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAA,CAAC,CAAC;QAAA,GAAG,CAAC,IAAI,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,WAAW,GAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAE,GAAkC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5G,yEAAyE;YACzE,IAAG,IAAI,CAAC,SAAS,KAAG,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAG,QAAQ,IAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAQ,CAAC,iBAAiB,EAAC,qBAAqB,CAAC,CAAC;YAC/K,MAAM,SAAS,GAAC,OAAO,IAAI,CAAC,SAAS,KAAG,QAAQ,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAC,KAAK,CAAC,EAAE,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChK,MAAM,MAAM,GAAC,MAAM,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,KAAK,EAAC,IAAI,CAAC,KAAK,EAAC,SAAS,EAAC,IAAI,CAAC,SAAS,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAe,EAAE;gBAClJ,WAAW,EAAC,OAAO,EAAC,KAAK,CAAC,EAAE,EAAC,QAAQ,EAAC,KAAK,EAAC,MAAM,EAAC,UAAU,CAAC,MAAM;gBACpE,SAAS,EAAC,GAAE,EAAE,CAAA,OAAO,CAAC,GAAG,EAAC,KAAK,CAAC,EAAE,EAAC,IAAI,CAAC,IAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAE,IAAA,wBAAU,EAAC,MAAM,EAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,CAAC;aACzG,CAAC,CAAC;YACH,IAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,OAAM,KAAK,EAAC,CAAC;YACb,IAAG,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAC,OAAO;YACpC,MAAM,CAAC,GAAC,KAAK,YAAY,gBAAQ,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,IAAI,gBAAQ,CAAC,sBAAsB,EAAC,6BAA6B,CAAC,CAAC;YAC3G,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAG,eAAe,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,CAAC,CAAC,IAAI,KAAG,uBAAuB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,CAAC,CAAC,IAAI,KAAG,iBAAiB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,CAAC,CAAC,IAAI,KAAG,kBAAkB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,CAAC,CAAC,IAAI,KAAG,gBAAgB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,CAAC,CAAC,IAAI,KAAG,cAAc,IAAE,CAAC,CAAC,IAAI,KAAG,YAAY,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,CAAC,CAAC,IAAI,KAAG,mBAAmB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,EAAC,GAAG,CAAC,CAAC,QAAQ,EAAC,EAAC,CAAC,CAAC;QAC1U,CAAC;gBAAS,CAAC;YAAA,GAAG,CAAC,GAAG,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC;QAAA,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAC,CAAC,GAAG,EAAC,GAAG,EAAC,EAAE;QACpC,MAAM,OAAO,GAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,KAAG,QAAQ,CAAA,CAAC,CAAA,GAAG,CAAC,KAAK,CAAC,OAAO,CAAA,CAAC,CAAA,EAAE,CAAC;QACvE,IAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAE,CAAC,OAAO,CAAC,GAAG,EAAC,OAAO,EAAC,KAAK,CAAC,EAAC,CAAC;YAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAC5G,MAAM,KAAK,GAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAC,MAAM,GAAC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAG,SAAS,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClI,IAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,KAAK,GAAC,CAAC,IAAE,KAAK,GAAC,GAAG,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAE,MAAM,GAAC,CAAC,EAAC,CAAC;YAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,cAAc,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAC/I,GAAG,CAAC,SAAS,CAAC,eAAe,EAAC,UAAU,CAAC,CAAC;QAAA,GAAG,CAAC,IAAI,CAAC,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAC,KAAK,EAAC,MAAM,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAe,WAAW,EAAe,MAAM,UAAU,CAAC;AAoFtF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAExD;AAMD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAEtD;AAuED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CA4CjD;AAmUD,wBAAgB,eAAe,CAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,WAAW,EAAE,GAAG,SAAS,CAAC,GACzD,MAAM,CAi4IR"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAC;AASpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAe,WAAW,EAAe,MAAM,UAAU,CAAC;AA0FtF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAExD;AAMD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAEtD;AAuED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CA4CjD;AAmUD,wBAAgB,eAAe,CAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,WAAW,EAAE,GAAG,SAAS,CAAC,GACzD,MAAM,CAs5IR"}

package/dist/api/router.js

@@ -42,6 +42,7 @@ const response_errors_1 = require("../orchestration/response-errors");
 const voice_settings_router_1 = require("./voice-settings-router");
 const express_1 = require("express");
 const identity_1 = require("../orchestration/identity");
+const types_1 = require("../orchestration/types");
 const crypto_1 = require("crypto");
 const fs = __importStar(require("fs"));
 const fsp = __importStar(require("fs/promises"));
@@ -56,7 +57,7 @@ const config_write_lock_1 = require("../config/config-write-lock");
 const auth_1 = require("./auth");
 const media_store_1 = require("../history/media-store");
 const db_1 = require("../history/db");
-const types_1 = require("../history/types");
+const types_2 = require("../history/types");
 const wizard_state_1 = require("./wizard-state");
 const pending_senders_1 = require("./pending-senders");
 const create_agent_prompts_1 = require("../agent/create-agent-prompts");
@@ -117,6 +118,12 @@ const SAFE_FILENAME_RE = /^[a-zA-Z0-9._\-() ]+$/;
 // escape the agent's directory. Clients may pass custom (non-UUID) session ids, so
 // this preserves that while blocking path traversal.
 const SESSION_ID_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+// Task and command ids are server/client-generated UUIDs; controlByUser rejects anything else.
+const TASK_CONTROL_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TASK_CONTROL_ERROR_STATUS = {
+    INVALID_INPUT: 400, EXECUTION_DENIED: 403, AUTOMATION_SESSION_CLOSED: 410, COMMAND_QUEUE_FULL: 429,
+    REVISION_CONFLICT: 409, STATE_CONFLICT: 409, NOTHING_TO_RESUME: 409, IDEMPOTENCY_CONFLICT: 409, ORCHESTRATION_DISABLED: 409,
+};
 function isValidSessionId(v) {
     return typeof v === 'string' && SESSION_ID_RE.test(v);
 }
@@ -623,6 +630,11 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const clientMessageId = client_message_id;
+        if (body.execution_task_id !== undefined && !isValidSessionId(body.execution_task_id)) {
+            res.status(400).json({ error: 'Invalid execution task' });
+            return;
+        }
+        const executionTaskId = body.execution_task_id;
         if (message !== undefined && typeof message !== 'string') {
             res.status(400).json({ error: 'message must be a string if provided' });
             return;
@@ -811,7 +823,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                 const inputId = await runner.acceptApiMessage(sessionId, chatIdStr, trimmedMessage, {
                     timeoutMs, allowTools: agentConfigs.get(agentId)?.allow_tools ?? !!apiKey.allow_tools, mediaFiles: validatedMediaFiles, model: modelStr,
                     imageParams: validatedImageParams, videoParams: validatedVideoParams,
-                    requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId,
+                    requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId, executionTaskId,
                 });
                 res.status(202).json({ status: 'accepted', input_id: inputId, session_id: sessionId, client_message_id: clientMessageId });
             }
@@ -849,7 +861,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                 openSseStream(res);
                 const agentCfg = agentConfigs.get(agentId);
                 const allowTools = agentCfg.allow_tools ?? !!apiKey.allow_tools;
-                onClientDisconnect = await runner.sendApiMessageStream(sessionId, chatIdStr, trimmedMessage, sseCallbacks, { timeoutMs, allowTools, mediaFiles: validatedMediaFiles, model: modelStr, skipUserMessage, imageParams: validatedImageParams, videoParams: validatedVideoParams, requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId });
+                onClientDisconnect = await runner.sendApiMessageStream(sessionId, chatIdStr, trimmedMessage, sseCallbacks, { timeoutMs, allowTools, mediaFiles: validatedMediaFiles, model: modelStr, skipUserMessage, imageParams: validatedImageParams, videoParams: validatedVideoParams, requestId, principalId: (0, identity_1.apiPrincipal)(apiKey), clientMessageId, executionTaskId });
                 // Client disconnect — detaches this connection's sink. The turn keeps
                 // running and keeps buffering, so the client can resume it on a new
                 // connection via GET …/sessions/:sessionId/stream?after_seq= (#421).
@@ -896,7 +908,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                         videoParams: validatedVideoParams,
                         requestId,
                         principalId: (0, identity_1.apiPrincipal)(apiKey),
-                        clientMessageId,
+                        clientMessageId, executionTaskId,
                     }));
                 }
                 const syncResult = {
@@ -4153,7 +4165,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const { source, rawChatId } = parseHistoryChatId(chatId);
-        if (!(0, types_1.isChatChannel)(source)) {
+        if (!(0, types_2.isChatChannel)(source)) {
             res.status(400).json({ error: 'Sessions endpoint only supports telegram/discord/line/slack/whatsapp/whatsapp_cloud chats' });
             return;
         }
@@ -4339,7 +4351,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const { source, rawChatId } = parseHistoryChatId(chatId);
-        if (!(0, types_1.isChatChannel)(source)) {
+        if (!(0, types_2.isChatChannel)(source)) {
             res.status(400).json({ error: 'Cross-channel messaging only supported for telegram/discord/line/slack/whatsapp/whatsapp_cloud chats' });
             return;
         }
@@ -5188,6 +5200,41 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             res.status(403).json({ error: 'Question unavailable for this principal or already answered' });
         }
     });
+    router.post('/v1/agents/:agentId/sessions/:sessionId/tasks/:taskId/control', auth, async (req, res) => {
+        const { agentId, sessionId, taskId } = req.params;
+        const key = req.apiKey, runner = agentRunners.get(agentId);
+        if (!(0, auth_1.canAccessAgent)(key, agentId) || !runner) {
+            res.status(403).json({ error: 'ACCESS_DENIED' });
+            return;
+        }
+        if (!isValidSessionId(sessionId) || !TASK_CONTROL_UUID_RE.test(taskId)) {
+            res.status(400).json({ error: 'INVALID_INPUT' });
+            return;
+        }
+        if (!(runner.getAgentConfig().allow_tools ?? Boolean(key.allow_tools))) {
+            res.status(403).json({ error: 'EXECUTION_DENIED' });
+            return;
+        }
+        const b = req.body;
+        if (!b || Object.keys(b).some(k => !['id', 'action', 'expectedRevision', 'text'].includes(k)) || typeof b.id !== 'string' || !TASK_CONTROL_UUID_RE.test(b.id) || !['pause', 'revise', 'resume', 'agent', 'user'].includes(b.action) || !Number.isSafeInteger(b.expectedRevision) || b.expectedRevision < 1 || (b.action === 'revise' ? (typeof b.text !== 'string' || !b.text.trim() || b.text.length > 4000) : b.text !== undefined)) {
+            res.status(400).json({ error: 'INVALID_INPUT' });
+            return;
+        }
+        try {
+            res.status(202).json({ task: await runner.controlApiTask(sessionId, (0, identity_1.apiPrincipal)(key), taskId, b) });
+        }
+        catch (e) {
+            // Map by code: OrchestrationError messages may carry human-readable detail.
+            const code = e instanceof types_1.OrchestrationError ? e.code : e instanceof Error ? e.message : '';
+            const status = TASK_CONTROL_ERROR_STATUS[code];
+            if (status) {
+                res.status(status).json({ error: code });
+                return;
+            }
+            // Unknown codes (e.g. TASK_NOT_FOUND) stay ACCESS_DENIED so task existence is not revealed.
+            res.status(403).json({ error: 'ACCESS_DENIED' });
+        }
+    });
     router.post('/v1/agents/:agentId/sessions/:sessionId/tasks/:taskId/cancel', auth, async (req, res) => {
         const { agentId, sessionId, taskId } = req.params;
         const key = req.apiKey, runner = agentRunners.get(agentId);