@agent-e/server 1.6.10 → 1.6.12

package/dist/cli.js

@@ -28,6 +28,7 @@ var http = __toESM(require("http"));
 var import_core3 = require("@agent-e/core");
 
 // src/routes.ts
+var import_node_crypto = require("crypto");
 var import_core = require("@agent-e/core");
 
 // src/dashboard.ts
@@ -974,8 +975,17 @@ function setSecurityHeaders(res) {
 }
 function setCorsHeaders(res, allowedOrigin, requestOrigin) {
   setSecurityHeaders(res);
-  const origin = allowedOrigin === "*" ? "*" : requestOrigin === allowedOrigin ? allowedOrigin : allowedOrigin;
-  res.setHeader("Access-Control-Allow-Origin", origin);
+  let origin;
+  if (allowedOrigin === "*") {
+    origin = "*";
+  } else if (requestOrigin === void 0) {
+    origin = allowedOrigin;
+  } else {
+    origin = requestOrigin.toLowerCase() === allowedOrigin.toLowerCase() ? requestOrigin : "";
+  }
+  if (origin) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+  }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
   res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
 }
@@ -992,7 +1002,10 @@ function sanitizeJson(obj) {
 function checkAuth(req, apiKey) {
   if (!apiKey) return true;
   const header = req.headers["authorization"];
-  return header === `Bearer ${apiKey}`;
+  if (typeof header !== "string") return false;
+  const expected = `Bearer ${apiKey}`;
+  if (header.length !== expected.length) return false;
+  return (0, import_node_crypto.timingSafeEqual)(Buffer.from(header), Buffer.from(expected));
 }
 function json(res, status, data, origin, reqOrigin) {
   setCorsHeaders(res, origin, reqOrigin);
@@ -1024,8 +1037,10 @@ function createRouteHandler(server2) {
     const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
     const path = url.pathname;
     const method = req.method?.toUpperCase() ?? "GET";
+    const reqOrigin = req.headers["origin"];
+    const respond = (status, data) => json(res, status, data, cors, reqOrigin);
     if (method === "OPTIONS") {
-      setCorsHeaders(res, cors);
+      setCorsHeaders(res, cors, reqOrigin);
       res.writeHead(204);
       res.end();
       return;
@@ -1033,7 +1048,7 @@ function createRouteHandler(server2) {
     try {
       if (path === "/tick" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1041,11 +1056,11 @@ function createRouteHandler(server2) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         if (!parsed || typeof parsed !== "object") {
-          json(res, 400, { error: "Body must be a JSON object" }, cors);
+          respond(400, { error: "Body must be a JSON object" });
           return;
         }
         const payload = parsed;
@@ -1053,10 +1068,10 @@ function createRouteHandler(server2) {
         const events = payload["events"];
         const validation = server2.validateState ? (0, import_core.validateEconomyState)(state) : null;
         if (validation && !validation.valid) {
-          json(res, 400, {
+          respond(400, {
             error: "invalid_state",
             validationErrors: validation.errors
-          }, cors);
+          });
           return;
         }
         const result = await server2.processTick(
@@ -1064,7 +1079,7 @@ function createRouteHandler(server2) {
           Array.isArray(events) ? events : void 0
         );
         const warnings = validation?.warnings ?? [];
-        json(res, 200, {
+        respond(200, {
           adjustments: result.adjustments,
           alerts: result.alerts.map((a) => ({
             principleId: a.principle.id,
@@ -1076,18 +1091,18 @@ function createRouteHandler(server2) {
           health: result.health,
           tick: result.tick,
           ...warnings.length > 0 ? { validationWarnings: warnings } : {}
-        }, cors);
+        });
         return;
       }
       if (path === "/health" && method === "GET") {
         const agentE = server2.getAgentE();
-        json(res, 200, {
+        respond(200, {
           health: agentE.getHealth(),
           tick: agentE.metrics.latest()?.tick ?? 0,
           mode: agentE.getMode(),
           activePlans: agentE.getActivePlans().length,
           uptime: server2.getUptime()
-        }, cors);
+        });
         return;
       }
       if (path === "/decisions" && method === "GET") {
@@ -1099,19 +1114,19 @@ function createRouteHandler(server2) {
         if (sinceParam) {
           const since = parseInt(sinceParam, 10);
           if (Number.isNaN(since)) {
-            json(res, 400, { error: 'Invalid "since" parameter \u2014 must be a number' }, cors);
+            respond(400, { error: 'Invalid "since" parameter \u2014 must be a number' });
             return;
           }
           decisions = agentE.getDecisions({ since });
         } else {
           decisions = agentE.log.latest(limit);
         }
-        json(res, 200, { decisions }, cors);
+        respond(200, { decisions });
         return;
       }
       if (path === "/config" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1119,7 +1134,7 @@ function createRouteHandler(server2) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const config = parsed;
@@ -1139,11 +1154,11 @@ function createRouteHandler(server2) {
             if (c && typeof c === "object" && typeof c["param"] === "string" && typeof c["min"] === "number" && typeof c["max"] === "number") {
               const constraint = c;
               if (!Number.isFinite(constraint.min) || !Number.isFinite(constraint.max)) {
-                json(res, 400, { error: "Constraint bounds must be finite numbers" }, cors);
+                respond(400, { error: "Constraint bounds must be finite numbers" });
                 return;
               }
               if (constraint.min > constraint.max) {
-                json(res, 400, { error: "Constraint min cannot exceed max" }, cors);
+                respond(400, { error: "Constraint min cannot exceed max" });
                 return;
               }
               validated.push(constraint);
@@ -1156,12 +1171,12 @@ function createRouteHandler(server2) {
         if (config["mode"] === "autonomous" || config["mode"] === "advisor") {
           server2.setMode(config["mode"]);
         }
-        json(res, 200, { ok: true }, cors);
+        respond(200, { ok: true });
         return;
       }
       if (path === "/principles" && method === "GET") {
         const principles = server2.getAgentE().getPrinciples();
-        json(res, 200, {
+        respond(200, {
           count: principles.length,
           principles: principles.map((p) => ({
             id: p.id,
@@ -1169,12 +1184,12 @@ function createRouteHandler(server2) {
             category: p.category,
             description: p.description
           }))
-        }, cors);
+        });
         return;
       }
       if (path === "/diagnose" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1182,7 +1197,7 @@ function createRouteHandler(server2) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const payload = parsed;
@@ -1190,12 +1205,12 @@ function createRouteHandler(server2) {
         if (server2.validateState) {
           const validation = (0, import_core.validateEconomyState)(state);
           if (!validation.valid) {
-            json(res, 400, { error: "invalid_state", validationErrors: validation.errors }, cors);
+            respond(400, { error: "invalid_state", validationErrors: validation.errors });
             return;
           }
         }
         const result = server2.diagnoseOnly(state);
-        json(res, 200, {
+        respond(200, {
           health: result.health,
           diagnoses: result.diagnoses.map((d) => ({
             principleId: d.principle.id,
@@ -1204,11 +1219,11 @@ function createRouteHandler(server2) {
             evidence: d.violation.evidence,
             suggestedAction: d.violation.suggestedAction
           }))
-        }, cors);
+        });
         return;
       }
       if (path === "/" && method === "GET" && server2.serveDashboard) {
-        setCorsHeaders(res, cors);
+        setCorsHeaders(res, cors, reqOrigin);
         res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self' ws: wss:; img-src 'self' data:");
         res.setHeader("Cache-Control", "public, max-age=60");
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -1219,7 +1234,7 @@ function createRouteHandler(server2) {
         const agentE = server2.getAgentE();
         const latest = agentE.store.latest();
         const history = agentE.store.recentHistory(100);
-        json(res, 200, { latest, history }, cors);
+        respond(200, { latest, history });
         return;
       }
       if (path === "/metrics/personas" && method === "GET") {
@@ -1227,12 +1242,12 @@ function createRouteHandler(server2) {
         const latest = agentE.store.latest();
         const dist = latest.personaDistribution || {};
         const total = Object.values(dist).reduce((s, v) => s + v, 0);
-        json(res, 200, { distribution: dist, total }, cors);
+        respond(200, { distribution: dist, total });
         return;
       }
       if (path === "/approve" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1240,42 +1255,42 @@ function createRouteHandler(server2) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const payload = parsed;
         const decisionId = payload["decisionId"];
         if (!decisionId) {
-          json(res, 400, { error: "missing_decision_id" }, cors);
+          respond(400, { error: "missing_decision_id" });
           return;
         }
         const agentE = server2.getAgentE();
         if (agentE.getMode() !== "advisor") {
-          json(res, 400, { error: "not_in_advisor_mode" }, cors);
+          respond(400, { error: "not_in_advisor_mode" });
           return;
         }
         const entry = agentE.log.getById(decisionId);
         if (!entry) {
-          json(res, 404, { error: "decision_not_found" }, cors);
+          respond(404, { error: "decision_not_found" });
           return;
         }
         if (entry.result !== "skipped_override") {
-          json(res, 409, { error: "decision_not_pending", currentResult: entry.result }, cors);
+          respond(409, { error: "decision_not_pending", currentResult: entry.result });
           return;
         }
         await agentE.apply(entry.plan);
         agentE.log.updateResult(decisionId, "applied");
         server2.broadcast({ type: "advisor_action", action: "approved", decisionId });
-        json(res, 200, {
+        respond(200, {
           ok: true,
           parameter: entry.plan.parameter,
           value: entry.plan.targetValue
-        }, cors);
+        });
         return;
       }
       if (path === "/reject" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1283,49 +1298,49 @@ function createRouteHandler(server2) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const payload = parsed;
         const decisionId = payload["decisionId"];
         const reason = payload["reason"] || void 0;
         if (!decisionId) {
-          json(res, 400, { error: "missing_decision_id" }, cors);
+          respond(400, { error: "missing_decision_id" });
           return;
         }
         const agentE = server2.getAgentE();
         if (agentE.getMode() !== "advisor") {
-          json(res, 400, { error: "not_in_advisor_mode" }, cors);
+          respond(400, { error: "not_in_advisor_mode" });
           return;
         }
         const entry = agentE.log.getById(decisionId);
         if (!entry) {
-          json(res, 404, { error: "decision_not_found" }, cors);
+          respond(404, { error: "decision_not_found" });
           return;
         }
         if (entry.result !== "skipped_override") {
-          json(res, 409, { error: "decision_not_pending", currentResult: entry.result }, cors);
+          respond(409, { error: "decision_not_pending", currentResult: entry.result });
           return;
         }
         agentE.log.updateResult(decisionId, "rejected", reason);
         server2.broadcast({ type: "advisor_action", action: "rejected", decisionId, reason });
-        json(res, 200, { ok: true, decisionId }, cors);
+        respond(200, { ok: true, decisionId });
         return;
       }
       if (path === "/pending" && method === "GET") {
         const agentE = server2.getAgentE();
         const pending = agentE.log.query({ result: "skipped_override" });
-        json(res, 200, {
+        respond(200, {
           mode: agentE.getMode(),
           pending,
           count: pending.length
-        }, cors);
+        });
         return;
       }
-      json(res, 404, { error: "Not found" }, cors);
+      respond(404, { error: "Not found" });
     } catch (err) {
       console.error("[AgentE Server] Unhandled route error:", err);
-      json(res, 500, { error: "Internal server error" }, cors);
+      respond(500, { error: "Internal server error" });
     }
   };
 }
@@ -1371,6 +1386,13 @@ function createWebSocketHandler(httpServer, server2) {
       ws.close(1013, "Server at capacity");
       return;
     }
+    const wsOrigin = req.headers["origin"];
+    if (wsOrigin && server2.corsOrigin !== "*") {
+      if (wsOrigin.toLowerCase() !== server2.corsOrigin.toLowerCase()) {
+        ws.close(1008, "Origin not allowed");
+        return;
+      }
+    }
     if (server2.apiKey) {
       const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
       const token = url.searchParams.get("token") ?? req.headers["authorization"]?.replace("Bearer ", "");
@@ -1682,7 +1704,7 @@ var AgentEServer = class {
 
 // src/cli.ts
 var port = parseInt(process.env["AGENTE_PORT"] ?? "3100", 10);
-var host = process.env["AGENTE_HOST"] ?? "0.0.0.0";
+var host = process.env["AGENTE_HOST"] ?? "127.0.0.1";
 var mode = process.env["AGENTE_MODE"] === "advisor" ? "advisor" : "autonomous";
 var server = new AgentEServer({
   port,