@agent-e/server 1.6.10 → 1.6.12

package/dist/index.js

@@ -979,8 +979,17 @@ function setSecurityHeaders(res) {
 }
 function setCorsHeaders(res, allowedOrigin, requestOrigin) {
   setSecurityHeaders(res);
-  const origin = allowedOrigin === "*" ? "*" : requestOrigin === allowedOrigin ? allowedOrigin : allowedOrigin;
-  res.setHeader("Access-Control-Allow-Origin", origin);
+  let origin;
+  if (allowedOrigin === "*") {
+    origin = "*";
+  } else if (requestOrigin === void 0) {
+    origin = allowedOrigin;
+  } else {
+    origin = requestOrigin.toLowerCase() === allowedOrigin.toLowerCase() ? requestOrigin : "";
+  }
+  if (origin) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+  }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
   res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
 }
@@ -997,7 +1006,10 @@ function sanitizeJson(obj) {
 function checkAuth(req, apiKey) {
   if (!apiKey) return true;
   const header = req.headers["authorization"];
-  return header === `Bearer ${apiKey}`;
+  if (typeof header !== "string") return false;
+  const expected = `Bearer ${apiKey}`;
+  if (header.length !== expected.length) return false;
+  return (0, import_node_crypto.timingSafeEqual)(Buffer.from(header), Buffer.from(expected));
 }
 function json(res, status, data, origin, reqOrigin) {
   setCorsHeaders(res, origin, reqOrigin);
@@ -1028,8 +1040,10 @@ function createRouteHandler(server) {
     const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
     const path = url.pathname;
     const method = req.method?.toUpperCase() ?? "GET";
+    const reqOrigin = req.headers["origin"];
+    const respond = (status, data) => json(res, status, data, cors, reqOrigin);
     if (method === "OPTIONS") {
-      setCorsHeaders(res, cors);
+      setCorsHeaders(res, cors, reqOrigin);
       res.writeHead(204);
       res.end();
       return;
@@ -1037,7 +1051,7 @@ function createRouteHandler(server) {
     try {
       if (path === "/tick" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1045,11 +1059,11 @@ function createRouteHandler(server) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         if (!parsed || typeof parsed !== "object") {
-          json(res, 400, { error: "Body must be a JSON object" }, cors);
+          respond(400, { error: "Body must be a JSON object" });
           return;
         }
         const payload = parsed;
@@ -1057,10 +1071,10 @@ function createRouteHandler(server) {
         const events = payload["events"];
         const validation = server.validateState ? (0, import_core.validateEconomyState)(state) : null;
         if (validation && !validation.valid) {
-          json(res, 400, {
+          respond(400, {
             error: "invalid_state",
             validationErrors: validation.errors
-          }, cors);
+          });
           return;
         }
         const result = await server.processTick(
@@ -1068,7 +1082,7 @@ function createRouteHandler(server) {
           Array.isArray(events) ? events : void 0
         );
         const warnings = validation?.warnings ?? [];
-        json(res, 200, {
+        respond(200, {
           adjustments: result.adjustments,
           alerts: result.alerts.map((a) => ({
             principleId: a.principle.id,
@@ -1080,18 +1094,18 @@ function createRouteHandler(server) {
           health: result.health,
           tick: result.tick,
           ...warnings.length > 0 ? { validationWarnings: warnings } : {}
-        }, cors);
+        });
         return;
       }
       if (path === "/health" && method === "GET") {
         const agentE = server.getAgentE();
-        json(res, 200, {
+        respond(200, {
           health: agentE.getHealth(),
           tick: agentE.metrics.latest()?.tick ?? 0,
           mode: agentE.getMode(),
           activePlans: agentE.getActivePlans().length,
           uptime: server.getUptime()
-        }, cors);
+        });
         return;
       }
       if (path === "/decisions" && method === "GET") {
@@ -1103,19 +1117,19 @@ function createRouteHandler(server) {
         if (sinceParam) {
           const since = parseInt(sinceParam, 10);
           if (Number.isNaN(since)) {
-            json(res, 400, { error: 'Invalid "since" parameter \u2014 must be a number' }, cors);
+            respond(400, { error: 'Invalid "since" parameter \u2014 must be a number' });
             return;
           }
           decisions = agentE.getDecisions({ since });
         } else {
           decisions = agentE.log.latest(limit);
         }
-        json(res, 200, { decisions }, cors);
+        respond(200, { decisions });
         return;
       }
       if (path === "/config" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1123,7 +1137,7 @@ function createRouteHandler(server) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const config = parsed;
@@ -1143,11 +1157,11 @@ function createRouteHandler(server) {
             if (c && typeof c === "object" && typeof c["param"] === "string" && typeof c["min"] === "number" && typeof c["max"] === "number") {
               const constraint = c;
               if (!Number.isFinite(constraint.min) || !Number.isFinite(constraint.max)) {
-                json(res, 400, { error: "Constraint bounds must be finite numbers" }, cors);
+                respond(400, { error: "Constraint bounds must be finite numbers" });
                 return;
               }
               if (constraint.min > constraint.max) {
-                json(res, 400, { error: "Constraint min cannot exceed max" }, cors);
+                respond(400, { error: "Constraint min cannot exceed max" });
                 return;
               }
               validated.push(constraint);
@@ -1160,12 +1174,12 @@ function createRouteHandler(server) {
         if (config["mode"] === "autonomous" || config["mode"] === "advisor") {
           server.setMode(config["mode"]);
         }
-        json(res, 200, { ok: true }, cors);
+        respond(200, { ok: true });
         return;
       }
       if (path === "/principles" && method === "GET") {
         const principles = server.getAgentE().getPrinciples();
-        json(res, 200, {
+        respond(200, {
           count: principles.length,
           principles: principles.map((p) => ({
             id: p.id,
@@ -1173,12 +1187,12 @@ function createRouteHandler(server) {
             category: p.category,
             description: p.description
           }))
-        }, cors);
+        });
         return;
       }
       if (path === "/diagnose" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1186,7 +1200,7 @@ function createRouteHandler(server) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const payload = parsed;
@@ -1194,12 +1208,12 @@ function createRouteHandler(server) {
         if (server.validateState) {
           const validation = (0, import_core.validateEconomyState)(state);
           if (!validation.valid) {
-            json(res, 400, { error: "invalid_state", validationErrors: validation.errors }, cors);
+            respond(400, { error: "invalid_state", validationErrors: validation.errors });
             return;
           }
         }
         const result = server.diagnoseOnly(state);
-        json(res, 200, {
+        respond(200, {
           health: result.health,
           diagnoses: result.diagnoses.map((d) => ({
             principleId: d.principle.id,
@@ -1208,11 +1222,11 @@ function createRouteHandler(server) {
             evidence: d.violation.evidence,
             suggestedAction: d.violation.suggestedAction
           }))
-        }, cors);
+        });
         return;
       }
       if (path === "/" && method === "GET" && server.serveDashboard) {
-        setCorsHeaders(res, cors);
+        setCorsHeaders(res, cors, reqOrigin);
         res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self' ws: wss:; img-src 'self' data:");
         res.setHeader("Cache-Control", "public, max-age=60");
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -1223,7 +1237,7 @@ function createRouteHandler(server) {
         const agentE = server.getAgentE();
         const latest = agentE.store.latest();
         const history = agentE.store.recentHistory(100);
-        json(res, 200, { latest, history }, cors);
+        respond(200, { latest, history });
         return;
       }
       if (path === "/metrics/personas" && method === "GET") {
@@ -1231,12 +1245,12 @@ function createRouteHandler(server) {
         const latest = agentE.store.latest();
         const dist = latest.personaDistribution || {};
         const total = Object.values(dist).reduce((s, v) => s + v, 0);
-        json(res, 200, { distribution: dist, total }, cors);
+        respond(200, { distribution: dist, total });
         return;
       }
       if (path === "/approve" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1244,42 +1258,42 @@ function createRouteHandler(server) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const payload = parsed;
         const decisionId = payload["decisionId"];
         if (!decisionId) {
-          json(res, 400, { error: "missing_decision_id" }, cors);
+          respond(400, { error: "missing_decision_id" });
           return;
         }
         const agentE = server.getAgentE();
         if (agentE.getMode() !== "advisor") {
-          json(res, 400, { error: "not_in_advisor_mode" }, cors);
+          respond(400, { error: "not_in_advisor_mode" });
           return;
         }
         const entry = agentE.log.getById(decisionId);
         if (!entry) {
-          json(res, 404, { error: "decision_not_found" }, cors);
+          respond(404, { error: "decision_not_found" });
           return;
         }
         if (entry.result !== "skipped_override") {
-          json(res, 409, { error: "decision_not_pending", currentResult: entry.result }, cors);
+          respond(409, { error: "decision_not_pending", currentResult: entry.result });
           return;
         }
         await agentE.apply(entry.plan);
         agentE.log.updateResult(decisionId, "applied");
         server.broadcast({ type: "advisor_action", action: "approved", decisionId });
-        json(res, 200, {
+        respond(200, {
           ok: true,
           parameter: entry.plan.parameter,
           value: entry.plan.targetValue
-        }, cors);
+        });
         return;
       }
       if (path === "/reject" && method === "POST") {
         if (!checkAuth(req, apiKey)) {
-          json(res, 401, { error: "Unauthorized" }, cors);
+          respond(401, { error: "Unauthorized" });
           return;
         }
         const body = await readBody(req);
@@ -1287,56 +1301,57 @@ function createRouteHandler(server) {
         try {
           parsed = sanitizeJson(JSON.parse(body));
         } catch {
-          json(res, 400, { error: "Invalid JSON" }, cors);
+          respond(400, { error: "Invalid JSON" });
           return;
         }
         const payload = parsed;
         const decisionId = payload["decisionId"];
         const reason = payload["reason"] || void 0;
         if (!decisionId) {
-          json(res, 400, { error: "missing_decision_id" }, cors);
+          respond(400, { error: "missing_decision_id" });
           return;
         }
         const agentE = server.getAgentE();
         if (agentE.getMode() !== "advisor") {
-          json(res, 400, { error: "not_in_advisor_mode" }, cors);
+          respond(400, { error: "not_in_advisor_mode" });
           return;
         }
         const entry = agentE.log.getById(decisionId);
         if (!entry) {
-          json(res, 404, { error: "decision_not_found" }, cors);
+          respond(404, { error: "decision_not_found" });
           return;
         }
         if (entry.result !== "skipped_override") {
-          json(res, 409, { error: "decision_not_pending", currentResult: entry.result }, cors);
+          respond(409, { error: "decision_not_pending", currentResult: entry.result });
           return;
         }
         agentE.log.updateResult(decisionId, "rejected", reason);
         server.broadcast({ type: "advisor_action", action: "rejected", decisionId, reason });
-        json(res, 200, { ok: true, decisionId }, cors);
+        respond(200, { ok: true, decisionId });
         return;
       }
       if (path === "/pending" && method === "GET") {
         const agentE = server.getAgentE();
         const pending = agentE.log.query({ result: "skipped_override" });
-        json(res, 200, {
+        respond(200, {
           mode: agentE.getMode(),
           pending,
           count: pending.length
-        }, cors);
+        });
         return;
       }
-      json(res, 404, { error: "Not found" }, cors);
+      respond(404, { error: "Not found" });
     } catch (err) {
       console.error("[AgentE Server] Unhandled route error:", err);
-      json(res, 500, { error: "Internal server error" }, cors);
+      respond(500, { error: "Internal server error" });
     }
   };
 }
-var import_core, MAX_BODY_BYTES;
+var import_node_crypto, import_core, MAX_BODY_BYTES;
 var init_routes = __esm({
   "src/routes.ts"() {
     "use strict";
+    import_node_crypto = require("crypto");
     import_core = require("@agent-e/core");
     init_dashboard();
     MAX_BODY_BYTES = 1048576;
@@ -1379,6 +1394,13 @@ function createWebSocketHandler(httpServer, server) {
       ws.close(1013, "Server at capacity");
       return;
     }
+    const wsOrigin = req.headers["origin"];
+    if (wsOrigin && server.corsOrigin !== "*") {
+      if (wsOrigin.toLowerCase() !== server.corsOrigin.toLowerCase()) {
+        ws.close(1008, "Origin not allowed");
+        return;
+      }
+    }
     if (server.apiKey) {
       const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
       const token = url.searchParams.get("token") ?? req.headers["authorization"]?.replace("Bearer ", "");