@a5c-ai/krate 5.0.1-staging.660d2b90f → 5.0.1-staging.69cb593ea

package/src/gitea-service.js

@@ -0,0 +1,173 @@
+import { createGiteaBackend } from './gitea-backend.js';
+
+/**
+ * Gitea service layer that wraps gitea-backend.js for repo code-browsing operations.
+ *
+ * Returns null when Gitea is not configured so call-sites can fall back to mock data.
+ *
+ * @param {{ giteaUrl?: string, token?: string, fetchImpl?: Function }} [options]
+ * @returns {GiteaService|null}
+ */
+export function createGiteaService(options = {}) {
+  const giteaUrl = options.giteaUrl || process.env.KRATE_GITEA_HTTP_URL;
+  if (!giteaUrl) return null; // Gitea not configured — callers must fall back
+
+  const backend = createGiteaBackend({
+    baseUrl: giteaUrl,
+    token: options.token || process.env.KRATE_GITEA_TOKEN,
+    fetchImpl: options.fetchImpl || globalThis.fetch,
+  });
+
+  // Low-level fetch helper that bypasses the backend's opinionated error handling
+  // so service methods can gracefully return null on 404 rather than throwing.
+  const root = giteaUrl.replace(/\/$/, '');
+  const fetchImpl = options.fetchImpl || globalThis.fetch;
+  const token = options.token || process.env.KRATE_GITEA_TOKEN;
+
+  async function rawRequest(path) {
+    if (!fetchImpl) throw new Error('Gitea service requires a fetch implementation');
+    const response = await fetchImpl(`${root}/api/v1${path}`, {
+      method: 'GET',
+      headers: {
+        Accept: 'application/json',
+        ...(token ? { Authorization: `token ${token}` } : {}),
+      },
+    });
+    if (response.status === 404) return null;
+    if (!response.ok) {
+      throw new Error(`Gitea GET ${path} failed with ${response.status}`);
+    }
+    return response.json();
+  }
+
+  async function rawRawRequest(path) {
+    if (!fetchImpl) throw new Error('Gitea service requires a fetch implementation');
+    const response = await fetchImpl(`${root}/api/v1${path}`, {
+      method: 'GET',
+      headers: {
+        Accept: 'text/plain',
+        ...(token ? { Authorization: `token ${token}` } : {}),
+      },
+    });
+    if (response.status === 404) return null;
+    if (!response.ok) {
+      throw new Error(`Gitea GET ${path} failed with ${response.status}`);
+    }
+    return response.text();
+  }
+
+  return {
+    available: true,
+    baseUrl: root,
+
+    /**
+     * List tree entries for a repository path at a given ref.
+     * Uses GET /api/v1/repos/{owner}/{repo}/contents/{path}?ref={ref}
+     *
+     * @param {string} org
+     * @param {string} repo
+     * @param {string} ref  — branch name, tag, or commit SHA
+     * @param {string} [path='']
+     * @returns {Promise<Array<{path:string,type:'blob'|'tree',size:number}>|null>}
+     */
+    async listTree(org, repo, ref, path = '') {
+      const encodedPath = path ? encodeURIComponent(path).replace(/%2F/g, '/') : '';
+      const apiPath = `/repos/${encodeURIComponent(org)}/${encodeURIComponent(repo)}/contents/${encodedPath}?ref=${encodeURIComponent(ref)}`;
+      const data = await rawRequest(apiPath);
+      if (data === null) return null;
+
+      // Gitea returns an array for directories, an object for files
+      const entries = Array.isArray(data) ? data : [data];
+      return entries.map((entry) => ({
+        path: entry.path || entry.name,
+        type: entry.type === 'dir' ? 'tree' : 'blob',
+        size: entry.size || 0,
+        sha: entry.sha,
+        name: entry.name,
+      }));
+    },
+
+    /**
+     * Get the raw text content of a file.
+     * Uses GET /api/v1/repos/{owner}/{repo}/raw/{filepath}?ref={ref}
+     *
+     * @param {string} org
+     * @param {string} repo
+     * @param {string} ref
+     * @param {string} path
+     * @returns {Promise<string|null>}
+     */
+    async getBlob(org, repo, ref, path) {
+      const encodedPath = path ? encodeURIComponent(path).replace(/%2F/g, '/') : '';
+      const apiPath = `/repos/${encodeURIComponent(org)}/${encodeURIComponent(repo)}/raw/${encodedPath}?ref=${encodeURIComponent(ref)}`;
+      return rawRawRequest(apiPath);
+    },
+
+    /**
+     * List branches for a repository.
+     * Uses GET /api/v1/repos/{owner}/{repo}/branches
+     *
+     * @param {string} org
+     * @param {string} repo
+     * @returns {Promise<Array<{name:string,sha:string,protected:boolean}>|null>}
+     */
+    async listBranches(org, repo) {
+      const data = await rawRequest(`/repos/${encodeURIComponent(org)}/${encodeURIComponent(repo)}/branches`);
+      if (data === null) return null;
+      return data.map((b) => ({
+        name: b.name,
+        sha: b.commit?.id || b.commit?.sha || '',
+        protected: b.protected || false,
+      }));
+    },
+
+    /**
+     * Get file metadata + base64-decoded content for a path.
+     * Uses GET /api/v1/repos/{owner}/{repo}/contents/{path}?ref={ref}
+     *
+     * @param {string} org
+     * @param {string} repo
+     * @param {string} ref
+     * @param {string} path
+     * @returns {Promise<{path:string,content:string,size:number,sha:string,encoding:string}|null>}
+     */
+    async getFileContent(org, repo, ref, path) {
+      const encodedPath = path ? encodeURIComponent(path).replace(/%2F/g, '/') : '';
+      const apiPath = `/repos/${encodeURIComponent(org)}/${encodeURIComponent(repo)}/contents/${encodedPath}?ref=${encodeURIComponent(ref)}`;
+      const data = await rawRequest(apiPath);
+      if (data === null || Array.isArray(data)) return null; // null = not found, array = directory
+
+      // Gitea returns content as base64 — decode it
+      const rawContent = data.content
+        ? Buffer.from(data.content.replace(/\n/g, ''), 'base64').toString('utf8')
+        : '';
+
+      return {
+        path: data.path || path,
+        content: rawContent,
+        size: data.size || Buffer.byteLength(rawContent, 'utf8'),
+        sha: data.sha,
+        encoding: 'utf-8',
+        lastCommit: data.last_commit_sha || null,
+      };
+    },
+
+    /**
+     * Create a repository inside an org.
+     * Delegates to the underlying gitea-backend.
+     *
+     * @param {string} org
+     * @param {string} name
+     * @param {{ private?: boolean, defaultBranch?: string, description?: string }} [repoOptions]
+     */
+    async createRepository(org, name, repoOptions = {}) {
+      return backend.createRepository({
+        owner: org,
+        name,
+        private: repoOptions.private ?? true,
+        defaultBranch: repoOptions.defaultBranch || 'main',
+        description: repoOptions.description || '',
+      });
+    },
+  };
+}

package/src/http-server.js

@@ -4,6 +4,7 @@ import { createControllerUiModel } from './controller-ui.js';
 import { createKrateApiController } from './api-controller.js';
 import { createKubernetesResourceGateway } from './kubernetes-resource-gateway.js';
 import { orgNamespaceName } from './kubernetes-controller.js';
+import { globalEventBus } from './event-bus.js';
 
 const jsonHeaders = { 'content-type': 'application/json; charset=utf-8' };
 
@@ -99,6 +100,50 @@ export function createKrateHttpHandler({ runtime = createKrateRuntime(), control
           : await scopedController.denyAgentAction(input);
         return send(response, result.error ? 400 : 200, result);
       }
+      // Agent webhook ingress
+      const webhookIngestMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/webhooks\/ingest$/);
+      if (request.method === 'POST' && webhookIngestMatch) {
+        const org = webhookIngestMatch[1];
+        const body = await readJson(request);
+        const event = normalizeWebhookEvent(body, org);
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.processWebhookEvent({ event, organizationRef: org, namespace: orgNamespaceName(org) });
+        return send(response, 200, result);
+      }
+
+      // Pipeline failure event
+      const pipelineFailMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/events\/pipeline-failure$/);
+      if (request.method === 'POST' && pipelineFailMatch) {
+        const org = pipelineFailMatch[1];
+        const body = await readJson(request);
+        const event = { type: 'ci-failure', source: { kind: 'Pipeline', name: body.name || 'unknown', namespace: body.namespace }, repository: body.repository || '', ref: body.ref || 'main', actor: body.actor || 'system', payload: body };
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.processWebhookEvent({ event, organizationRef: org, namespace: orgNamespaceName(org) });
+        return send(response, 200, result);
+      }
+
+      // Comment event
+      const commentMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/events\/comment$/);
+      if (request.method === 'POST' && commentMatch) {
+        const org = commentMatch[1];
+        const body = await readJson(request);
+        const event = { type: 'comment', source: { kind: body.kind || 'Issue', name: body.name || 'unknown' }, repository: body.repository || '', ref: body.ref || 'main', actor: body.actor || 'system', payload: { body: body.body || '' } };
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.processWebhookEvent({ event, organizationRef: org, namespace: orgNamespaceName(org) });
+        return send(response, 200, result);
+      }
+
+      // Label event
+      const labelMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/events\/label$/);
+      if (request.method === 'POST' && labelMatch) {
+        const org = labelMatch[1];
+        const body = await readJson(request);
+        const event = { type: 'label-added', source: { kind: body.kind || 'Issue', name: body.name || 'unknown' }, repository: body.repository || '', ref: body.ref || 'main', actor: body.actor || 'system', payload: { label: body.label || '' } };
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.processWebhookEvent({ event, organizationRef: org, namespace: orgNamespaceName(org) });
+        return send(response, 200, result);
+      }
+
       const agentTriggerProcessMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/triggers\/process$/);
       if (request.method === 'POST' && agentTriggerProcessMatch) {
         const org = agentTriggerProcessMatch[1];
@@ -107,6 +152,162 @@ export function createKrateHttpHandler({ runtime = createKrateRuntime(), control
         const result = await scopedController.processWebhookEvent({ ...body, organizationRef: org });
         return send(response, 200, result);
       }
+      const memoryQueryMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/memory\/query$/);
+      if (request.method === 'POST' && memoryQueryMatch) {
+        const org = memoryQueryMatch[1];
+        const body = await readJson(request);
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.queryAgentMemory({ ...body, organizationRef: org });
+        return send(response, 200, result);
+      }
+      // --- Secrets management routes ---
+      const orgSecretsMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/secrets$/);
+      if (orgSecretsMatch) {
+        const org = orgSecretsMatch[1];
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        if (request.method === 'GET') {
+          const result = await scopedController.listResourceForOrg(org, 'AgentSecretGrant');
+          const items = Array.isArray(result?.items) ? result.items : [];
+          return send(response, 200, {
+            secrets: items.map((item) => ({
+              name: item.spec?.secretName || item.spec?.secretRef || item.metadata?.name,
+              type: item.spec?.type || 'Opaque',
+              createdAt: item.status?.createdAt || item.metadata?.creationTimestamp || null,
+              namespace: orgNamespaceName(org),
+              grants: []
+            }))
+          });
+        }
+        if (request.method === 'POST') {
+          const body = await readJson(request);
+          const secretResource = {
+            apiVersion: 'krate.a5c.ai/v1alpha1',
+            kind: 'AgentSecretGrant',
+            metadata: { name: body.name, namespace: orgNamespaceName(org) },
+            spec: {
+              organizationRef: org,
+              secretName: body.name,
+              secretRef: body.name,
+              grantedTo: body.grantedTo || 'system',
+              subject: body.grantedTo || 'system',
+              permissions: body.permissions || ['read'],
+              purpose: 'read',
+              data: body.data || {}
+            }
+          };
+          const result = await scopedController.applyResourceForOrg(org, secretResource);
+          return send(response, 201, result);
+        }
+      }
+
+      const orgSecretMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/secrets\/([^/]+)$/);
+      if (orgSecretMatch) {
+        const org = orgSecretMatch[1];
+        const secretName = orgSecretMatch[2];
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        if (request.method === 'DELETE') {
+          const result = await scopedController.deleteResourceForOrg(org, 'AgentSecretGrant', secretName);
+          return send(response, 200, result);
+        }
+      }
+
+      const orgSecretGrantsMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/secret-grants$/);
+      if (orgSecretGrantsMatch) {
+        const org = orgSecretGrantsMatch[1];
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        if (request.method === 'GET') {
+          return send(response, 200, await scopedController.listResourceForOrg(org, 'AgentSecretGrant'));
+        }
+        if (request.method === 'POST') {
+          const body = await readJson(request);
+          const grant = {
+            apiVersion: 'krate.a5c.ai/v1alpha1',
+            kind: 'AgentSecretGrant',
+            metadata: { name: body.name || `grant-${Date.now()}`, namespace: orgNamespaceName(org) },
+            spec: {
+              organizationRef: org,
+              secretName: body.secretName,
+              secretRef: body.secretName,
+              grantedTo: body.grantedTo,
+              subject: body.grantedTo,
+              permissions: body.permissions || ['read'],
+              purpose: (body.permissions || ['read']).join(',')
+            }
+          };
+          return send(response, 201, await scopedController.applyResourceForOrg(org, grant));
+        }
+      }
+
+      // --- External integration routes ---
+      const externalSyncMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/external\/sync$/);
+      if (request.method === 'POST' && externalSyncMatch) {
+        const org = externalSyncMatch[1];
+        const body = await readJson(request);
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const bindingName = body.bindingName || '';
+        const result = await scopedController.syncExternalBinding(bindingName, {
+          kind: body.kind,
+          localName: body.localName,
+          namespace: orgNamespaceName(org),
+          spec: body.spec || {},
+          externalEnvelope: body.externalEnvelope || { nativeId: '', url: '', etag: '', providerRef: '' },
+          watermark: body.watermark
+        });
+        return send(response, 200, result);
+      }
+
+      const externalConflictResolveMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/external\/conflicts\/([^/]+)\/resolve$/);
+      if (request.method === 'POST' && externalConflictResolveMatch) {
+        const org = externalConflictResolveMatch[1];
+        const conflictName = externalConflictResolveMatch[2];
+        const body = await readJson(request);
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.resolveExternalConflict({ conflictName, strategy: body.strategy, resolvedValue: body.resolvedValue, resources: body.resources || {} });
+        return send(response, 200, result);
+      }
+
+      const externalWriteIntentApproveMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/external\/write-intents\/([^/]+)\/approve$/);
+      if (request.method === 'POST' && externalWriteIntentApproveMatch) {
+        const org = externalWriteIntentApproveMatch[1];
+        const intentName = externalWriteIntentApproveMatch[2];
+        const body = await readJson(request);
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.approveExternalWriteIntent({ intentName, approvedBy: body.approvedBy || 'unknown', resources: body.resources || {} });
+        return send(response, 200, result);
+      }
+
+      const externalWriteIntentCancelMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/external\/write-intents\/([^/]+)\/cancel$/);
+      if (request.method === 'POST' && externalWriteIntentCancelMatch) {
+        const org = externalWriteIntentCancelMatch[1];
+        const intentName = externalWriteIntentCancelMatch[2];
+        const body = await readJson(request);
+        const scopedController = createKrateApiController({ namespace: orgNamespaceName(org) });
+        const result = await scopedController.cancelExternalWriteIntent({ intentName, cancelledBy: body.cancelledBy || 'unknown', resources: body.resources || {} });
+        return send(response, 200, result);
+      }
+
+      const sseMatch = url.pathname.match(/^\/api\/orgs\/([^/]+)\/agents\/events\/stream$/);
+      if (request.method === 'GET' && sseMatch) {
+        response.writeHead(200, {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          'Connection': 'keep-alive',
+          'X-Accel-Buffering': 'no',
+        });
+        response.write('data: {"type":"connected"}\n\n');
+        const writer = (event) => {
+          response.write(`data: ${JSON.stringify(event)}\n\n`);
+        };
+        globalEventBus.subscribe(writer);
+        const interval = setInterval(() => {
+          response.write('data: {"type":"heartbeat"}\n\n');
+        }, 30000);
+        request.on('close', () => {
+          clearInterval(interval);
+          globalEventBus.unsubscribe(writer);
+        });
+        return;
+      }
       return send(response, 404, { error: 'not_found', method: request.method, path: url.pathname });
     } catch (error) {
       return send(response, 400, { error: 'bad_request', message: error.message });
@@ -149,3 +350,28 @@ function send(response, status, body) {
   response.writeHead(status, jsonHeaders);
   response.end(JSON.stringify(body, null, 2));
 }
+
+export function normalizeWebhookEvent(body, org) {
+  // GitHub/Gitea webhook normalization
+  if (body.action === 'completed' && body.workflow_run?.conclusion === 'failure') {
+    return { type: 'ci-failure', source: { kind: 'Pipeline', name: body.workflow_run?.name || 'unknown' }, repository: body.repository?.full_name || '', ref: body.workflow_run?.head_branch || 'main', actor: body.sender?.login || 'system', payload: body };
+  }
+  if (body.action === 'opened' && body.pull_request) {
+    return { type: 'pr-opened', source: { kind: 'PullRequest', name: String(body.pull_request.number) }, repository: body.repository?.full_name || '', ref: body.pull_request?.head?.ref || 'main', actor: body.sender?.login || 'system', payload: body };
+  }
+  if (body.action === 'created' && body.comment) {
+    const kind = body.issue?.pull_request ? 'PullRequest' : 'Issue';
+    return { type: 'comment', source: { kind, name: String(body.issue?.number || 'unknown') }, repository: body.repository?.full_name || '', ref: 'main', actor: body.sender?.login || body.comment?.user?.login || 'system', payload: { body: body.comment?.body || '' } };
+  }
+  if (body.action === 'labeled') {
+    return { type: 'label-added', source: { kind: body.pull_request ? 'PullRequest' : 'Issue', name: String(body.issue?.number || body.pull_request?.number || 'unknown') }, repository: body.repository?.full_name || '', ref: 'main', actor: body.sender?.login || 'system', payload: { label: body.label?.name || '' } };
+  }
+  if (body.action === 'opened' && body.issue && !body.pull_request) {
+    return { type: 'issue-created', source: { kind: 'Issue', name: String(body.issue.number) }, repository: body.repository?.full_name || '', ref: 'main', actor: body.sender?.login || 'system', payload: body };
+  }
+  if (body.ref && body.commits) {
+    return { type: 'push', source: { kind: 'Repository', name: body.repository?.full_name || '' }, repository: body.repository?.full_name || '', ref: body.ref?.replace('refs/heads/', '') || 'main', actor: body.sender?.login || body.pusher?.name || 'system', payload: body };
+  }
+  // Generic fallback
+  return { type: 'webhook', source: { kind: 'WebhookDelivery', name: 'unknown' }, repository: body.repository?.full_name || '', ref: 'main', actor: body.sender?.login || 'system', payload: body };
+}

package/src/index.js

@@ -20,6 +20,7 @@ export * from './api-controller.js';
 export * from './kubernetes-controller.js';
 export * from './kubernetes-resource-gateway.js';
 export * from './gitea-backend.js';
+export * from './gitea-service.js';
 export * from './argocd-gitops.js';
 export * from './agent-permission-review.js';
 export * from './agent-stack-controller.js';
@@ -28,3 +29,29 @@ export * from './agent-mux-client.js';
 export * from './agent-dispatch-controller.js';
 export * from './agent-approval-controller.js';
 export * from './agent-trigger-controller.js';
+export * from './agent-workspace-controller.js';
+export * from './agent-memory-controller.js';
+export * from './agent-memory-query.js';
+export * from './agent-memory-repository-source-controller.js';
+export * from './agent-adapter-controller.js';
+export * from './agent-transport-binding-controller.js';
+export * from './agent-provider-config-controller.js';
+export * from './agent-project-controller.js';
+export * from './agent-gateway-config-controller.js';
+export * from './agent-session-transcript-controller.js';
+export * from './agent-writeback-controller.js';
+export * from './agent-memory-import.js';
+export * from './agent-subagent-controller.js';
+export * from './external/provider-adapter.js';
+export * from './external/provider-resource-factory.js';
+export * from './external/github/index.js';
+export * from './external/webhook-controller.js';
+export * from './external/sync-controller.js';
+export * from './external/write-controller.js';
+export * from './external/conflict-controller.js';
+export * from './audit-controller.js';
+export * from './async-controller.js';
+export * from './event-bus.js';
+export * from './agent-secret-config-grant-controller.js';
+export * from './runner-controller.js';
+export * from './notification-controller.js';