@agent-native/dispatch 0.0.0-beta-20260819155526

package/dist/server/lib/workspace-app-chat-proxy.js

@@ -0,0 +1,306 @@
+/**
+ * Server-side agent-chat proxy for an app opened inside Dispatch.
+ *
+ * The Desktop app already solves this by pointing the rail's `apiUrl` at a
+ * loopback relay onto the target app's `/_agent-native/agent-chat`, so parity
+ * with the app's native chat holds structurally instead of by copying tools and
+ * instructions into Dispatch's agent. This is the web equivalent: Dispatch
+ * forwards the whole agent-chat subtree to the app's own server.
+ *
+ * Credential: the app's OWN embed session, minted through the existing paths in
+ * `mcp-gateway.ts` — the same credential the app pane's iframe already runs on.
+ * Dispatch consumes the one-time ticket server-side and reuses the resulting
+ * short-lived embed token as a bearer, which is an authentication path the
+ * framework already accepts (`resolveEmbedSessionFromRequest`). No new auth
+ * scheme, and no token gains scope it did not already have.
+ *
+ * A dedicated Nitro route rather than an action: agent-chat streams (SSE for
+ * `/runs/:id/events`, a token stream for the turn itself) and returns non-JSON
+ * bodies, which is the documented exception in CLAUDE.md to the
+ * actions-over-routes rule.
+ */
+import { getOrgContext } from "@agent-native/core/org";
+import { getSession, runWithRequestContext } from "@agent-native/core/server";
+import { EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, } from "@agent-native/core/shared";
+import { parseWorkspaceAppChatProxyPath } from "../../shared/workspace-app-chat.js";
+import { createGrantedDispatchMcpEmbedSession, createWorkspaceSsoEmbedSession, } from "./mcp-gateway.js";
+const TARGET_CHAT_PATH = "/_agent-native/agent-chat";
+/**
+ * `X-Agent-Native-Embed-Target` names the path a bearer embed token was minted
+ * for. Without it the target only honours the token on requests whose own path
+ * matches, which an agent-chat call never does. Duplicated from
+ * `@agent-native/core/shared/embed-auth` because that constant is not part of
+ * the package's public export surface.
+ */
+const EMBED_TARGET_HEADER = "x-agent-native-embed-target";
+const CSRF_MARKER_HEADER = "x-agent-native-csrf";
+/** Re-mint this far before the token's own expiry so a long turn cannot age out mid-stream. */
+const SESSION_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/** Headers Dispatch owns on the upstream call, or that must not cross origins. */
+const DROPPED_REQUEST_HEADERS = new Set([
+    "accept-encoding",
+    "authorization",
+    "content-length",
+    "cookie",
+    "host",
+    "origin",
+    "referer",
+    EMBED_TARGET_HEADER,
+]);
+/**
+ * `set-cookie` would land on Dispatch's origin, and the encoding/length headers
+ * describe the upstream wire body, which `fetch` has already decoded.
+ */
+const DROPPED_RESPONSE_HEADERS = new Set([
+    "content-encoding",
+    "content-length",
+    "set-cookie",
+    "transfer-encoding",
+]);
+const sessionCache = new Map();
+function sessionCacheKey(input) {
+    return [input.userEmail, input.orgId ?? "", input.appId].join("\u0000");
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error ?? "");
+}
+/**
+ * Read the embed token's own `exp` claim. Guessing a TTL here would silently
+ * produce a session that the target has already rejected, so a token we cannot
+ * read an expiry from is an error rather than a default.
+ */
+export function embedSessionTokenExpiry(token) {
+    const payload = token.split(".")[0];
+    if (!payload)
+        throw new Error("Embed session token is malformed.");
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new Error("Embed session token payload could not be decoded.");
+    }
+    const exp = claims?.exp;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) {
+        throw new Error("Embed session token has no usable expiry.");
+    }
+    return exp * 1000;
+}
+async function mintEmbedStartUrl(appId) {
+    const input = { app: appId, path: "/", chrome: "minimal" };
+    // Mirrors `WorkspaceAppFrame`: the workspace-sign-in mint when the rollout
+    // covers this app, the Dispatch MCP grant mint otherwise. Both return the
+    // target app's own embed session — neither is a fallback onto Dispatch's
+    // agent, which this proxy must never do.
+    try {
+        return (await createWorkspaceSsoEmbedSession(input)).startUrl;
+    }
+    catch (ssoError) {
+        try {
+            return (await createGrantedDispatchMcpEmbedSession(input)).startUrl;
+        }
+        catch (grantError) {
+            throw new Error(`Could not create an app session for "${appId}". ` +
+                `Workspace sign-in: ${errorMessage(ssoError)}. ` +
+                `Dispatch app grant: ${errorMessage(grantError)}.`);
+        }
+    }
+}
+/**
+ * Exchange the one-time embed ticket for the reusable short-lived token. The
+ * target's embed-start route answers a redirect whose location carries both the
+ * token and the path the token is bound to.
+ */
+export async function exchangeEmbedStartUrl(startUrl, fetchImpl = fetch) {
+    const start = new URL(startUrl);
+    const startIndex = start.pathname.lastIndexOf(EMBED_START_PATH);
+    if (startIndex < 0) {
+        throw new Error("App session start URL is not an embed start route.");
+    }
+    const appBaseUrl = `${start.origin}${start.pathname.slice(0, startIndex)}`;
+    const response = await fetchImpl(start.toString(), { redirect: "manual" });
+    await response.body?.cancel().catch(() => undefined);
+    const location = response.headers.get("location");
+    if (response.status < 300 || response.status >= 400 || !location) {
+        throw new Error(`App session exchange failed with status ${response.status}.`);
+    }
+    const resolved = new URL(location, start);
+    const token = resolved.searchParams.get(EMBED_TOKEN_QUERY_PARAM);
+    if (!token) {
+        throw new Error("App session exchange returned no embed token.");
+    }
+    return {
+        appBaseUrl,
+        token,
+        embedTarget: resolved.pathname,
+        expiresAt: embedSessionTokenExpiry(token),
+    };
+}
+async function resolveWorkspaceAppChatSession(input) {
+    const key = sessionCacheKey(input);
+    const cached = sessionCache.get(key);
+    if (cached) {
+        try {
+            const session = await cached;
+            if (session.expiresAt - Date.now() > SESSION_REFRESH_MARGIN_MS) {
+                return session;
+            }
+            // coercion-ok: a mint that already failed is retried below, and that fresh
+            // attempt reports its own error rather than replaying a stale one.
+        }
+        catch {
+            void 0;
+        }
+        sessionCache.delete(key);
+    }
+    const pending = Promise.resolve(runWithRequestContext({
+        userEmail: input.userEmail,
+        ...(input.orgId ? { orgId: input.orgId } : {}),
+    }, async () => exchangeEmbedStartUrl(await mintEmbedStartUrl(input.appId), input.fetchImpl)));
+    sessionCache.set(key, pending);
+    try {
+        return await pending;
+    }
+    catch (error) {
+        sessionCache.delete(key);
+        throw error;
+    }
+}
+/** Test seam: drop cached app sessions so a spec starts from a cold proxy. */
+export function clearWorkspaceAppChatSessions() {
+    sessionCache.clear();
+}
+function upstreamRequestHeaders(request, session) {
+    const headers = new Headers();
+    for (const [name, value] of request.headers) {
+        const lower = name.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(lower) || DROPPED_REQUEST_HEADERS.has(lower)) {
+            continue;
+        }
+        headers.set(name, value);
+    }
+    headers.set("authorization", `Bearer ${session.token}`);
+    headers.set(EMBED_TARGET_HEADER, session.embedTarget);
+    // Documented same-origin marker (see packages/core/src/server/csrf.ts). The
+    // proxy sends no cookies, but stating first-party intent keeps the contract
+    // explicit rather than relying on the no-cookie shortcut.
+    headers.set(CSRF_MARKER_HEADER, "1");
+    return headers;
+}
+function proxyErrorResponse(status, message) {
+    // An unavailable proxy is a visible failure. Dispatch must never answer an
+    // app-scoped chat request with its own agent: that would look like it worked
+    // while silently supplying the wrong tools and instructions.
+    return new Response(JSON.stringify({ error: message }), {
+        status,
+        headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+export function createWorkspaceAppChatProxyHandler(options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (event) => {
+        const url = event.url;
+        const parsed = parseWorkspaceAppChatProxyPath(url.pathname);
+        if (!parsed) {
+            return proxyErrorResponse(404, "Workspace app chat route not found.");
+        }
+        // "Not signed in" and "the session store did not answer" are different
+        // failures. Telling a signed-in user to sign in during an outage is the
+        // confidently-wrong report this proxy must not produce.
+        let session;
+        let orgId;
+        try {
+            session = await getSession(event);
+            orgId = (await getOrgContext(event)).orgId ?? undefined;
+        }
+        catch (error) {
+            return proxyErrorResponse(503, `Dispatch could not read your workspace session: ${errorMessage(error)}`);
+        }
+        if (!session?.email) {
+            return proxyErrorResponse(401, "Sign in to Dispatch to use app chat.");
+        }
+        let appSession;
+        try {
+            appSession = await resolveWorkspaceAppChatSession({
+                appId: parsed.appId,
+                userEmail: session.email,
+                orgId,
+                fetchImpl,
+            });
+        }
+        catch (error) {
+            console.warn("[dispatch] workspace app chat proxy could not connect", {
+                app: parsed.appId,
+                error: errorMessage(error),
+            });
+            return proxyErrorResponse(502, `${parsed.appId} chat is unavailable: ${errorMessage(error)}`);
+        }
+        const request = event.req;
+        const target = new URL(`${appSession.appBaseUrl}${TARGET_CHAT_PATH}${parsed.targetSubPath}`);
+        target.search = url.search;
+        const method = request.method.toUpperCase();
+        // The turn body is a small JSON payload, so buffering the REQUEST costs
+        // nothing and avoids half-duplex streaming support varying by runtime. The
+        // RESPONSE is the streaming half and is piped through untouched below.
+        const body = method === "GET" || method === "HEAD"
+            ? undefined
+            : await request.arrayBuffer();
+        let upstream;
+        try {
+            upstream = await fetchImpl(target.toString(), {
+                method,
+                headers: upstreamRequestHeaders(request, appSession),
+                ...(body === undefined ? {} : { body }),
+                redirect: "manual",
+            });
+        }
+        catch (error) {
+            console.warn("[dispatch] workspace app chat proxy request failed", {
+                app: parsed.appId,
+                targetPath: target.pathname,
+                error: errorMessage(error),
+            });
+            return proxyErrorResponse(502, `${parsed.appId} chat did not respond: ${errorMessage(error)}`);
+        }
+        // A rejected embed session is not a transport failure: drop the cached
+        // credential so the next request re-mints instead of looping on a token the
+        // app has already stopped honouring.
+        if (upstream.status === 401 || upstream.status === 403) {
+            sessionCache.delete(sessionCacheKey({
+                appId: parsed.appId,
+                userEmail: session.email,
+                orgId,
+            }));
+        }
+        const headers = new Headers();
+        for (const [name, value] of upstream.headers) {
+            const lower = name.toLowerCase();
+            if (HOP_BY_HOP_HEADERS.has(lower) ||
+                DROPPED_RESPONSE_HEADERS.has(lower)) {
+                continue;
+            }
+            headers.set(name, value);
+        }
+        // `upstream.body` is the live stream: SSE run events and the turn's token
+        // stream reach the browser as the app emits them, never buffered here.
+        return new Response(upstream.body, {
+            status: upstream.status,
+            statusText: upstream.statusText,
+            headers,
+        });
+    };
+}
+//# sourceMappingURL=workspace-app-chat-proxy.js.map

package/dist/server/lib/workspace-app-chat-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-app-chat-proxy.js","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-chat-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EACL,oCAAoC,EACpC,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,+FAA+F;AAC/F,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAC;AAUH,MAAM,YAAY,GAAG,IAAI,GAAG,EAA4C,CAAC;AAEzE,SAAS,eAAe,CAAC,KAIxB;IACC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAI,MAAmC,EAAE,GAAG,CAAC;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,yCAAyC;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,KAAK;gBAChD,sBAAsB,YAAY,CAAC,QAAQ,CAAC,IAAI;gBAChD,uBAAuB,YAAY,CAAC,UAAU,CAAC,GAAG,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,SAAS,GAAiB,KAAK;IAE/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAChE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,UAAU;QACV,KAAK;QACL,WAAW,EAAE,QAAQ,CAAC,QAAQ;QAC9B,SAAS,EAAE,uBAAuB,CAAC,KAAK,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;YAC7B,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,2EAA2E;YAC3E,mEAAmE;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,CAAC;QACT,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAC7B,qBAAqB,CACnB;QACE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,EACD,KAAK,IAAI,EAAE,CACT,qBAAqB,CACnB,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,SAAS,CAChB,CACJ,CACF,CAAC;IACF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B;IAC3C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,4EAA4E;IAC5E,4EAA4E;IAC5E,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,OAAe;IACzD,2EAA2E;IAC3E,6EAA6E;IAC7E,6DAA6D;IAC7D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;QACtD,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAiC,EAAE;IAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,OAAO,KAAK,EAAE,KAAiC,EAAqB,EAAE;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,kBAAkB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,OAA+C,CAAC;QACpD,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,KAAc,CAAC,CAAC;YAC3C,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,KAAc,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,kBAAkB,CACvB,GAAG,EACH,mDAAmD,YAAY,CAAC,KAAK,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,OAAO,kBAAkB,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,UAAmC,CAAC;QACxC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,8BAA8B,CAAC;gBAChD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,KAAK;gBACL,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBACpE,GAAG,EAAE,MAAM,CAAC,KAAK;gBACjB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO,kBAAkB,CACvB,GAAG,EACH,GAAG,MAAM,CAAC,KAAK,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,GAAG,UAAU,CAAC,UAAU,GAAG,gBAAgB,GAAG,MAAM,CAAC,aAAa,EAAE,CACrE,CAAC;QACF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,IAAI,GACR,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAElC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;gBAC5C,MAAM;gBACN,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC;gBACpD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBACjE,GAAG,EAAE,MAAM,CAAC,KAAK;gBACjB,UAAU,EAAE,MAAM,CAAC,QAAQ;gBAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO,kBAAkB,CACvB,GAAG,EACH,GAAG,MAAM,CAAC,KAAK,0BAA0B,YAAY,CAAC,KAAK,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,4EAA4E;QAC5E,qCAAqC;QACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,YAAY,CAAC,MAAM,CACjB,eAAe,CAAC;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,KAAK;aACN,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IACE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC7B,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,EACnC,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Server-side agent-chat proxy for an app opened inside Dispatch.\n *\n * The Desktop app already solves this by pointing the rail's `apiUrl` at a\n * loopback relay onto the target app's `/_agent-native/agent-chat`, so parity\n * with the app's native chat holds structurally instead of by copying tools and\n * instructions into Dispatch's agent. This is the web equivalent: Dispatch\n * forwards the whole agent-chat subtree to the app's own server.\n *\n * Credential: the app's OWN embed session, minted through the existing paths in\n * `mcp-gateway.ts` — the same credential the app pane's iframe already runs on.\n * Dispatch consumes the one-time ticket server-side and reuses the resulting\n * short-lived embed token as a bearer, which is an authentication path the\n * framework already accepts (`resolveEmbedSessionFromRequest`). No new auth\n * scheme, and no token gains scope it did not already have.\n *\n * A dedicated Nitro route rather than an action: agent-chat streams (SSE for\n * `/runs/:id/events`, a token stream for the turn itself) and returns non-JSON\n * bodies, which is the documented exception in CLAUDE.md to the\n * actions-over-routes rule.\n */\n\nimport { getOrgContext } from \"@agent-native/core/org\";\nimport { getSession, runWithRequestContext } from \"@agent-native/core/server\";\nimport {\n  EMBED_START_PATH,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"@agent-native/core/shared\";\n\nimport { parseWorkspaceAppChatProxyPath } from \"../../shared/workspace-app-chat.js\";\nimport {\n  createGrantedDispatchMcpEmbedSession,\n  createWorkspaceSsoEmbedSession,\n} from \"./mcp-gateway.js\";\n\nconst TARGET_CHAT_PATH = \"/_agent-native/agent-chat\";\n/**\n * `X-Agent-Native-Embed-Target` names the path a bearer embed token was minted\n * for. Without it the target only honours the token on requests whose own path\n * matches, which an agent-chat call never does. Duplicated from\n * `@agent-native/core/shared/embed-auth` because that constant is not part of\n * the package's public export surface.\n */\nconst EMBED_TARGET_HEADER = \"x-agent-native-embed-target\";\nconst CSRF_MARKER_HEADER = \"x-agent-native-csrf\";\n/** Re-mint this far before the token's own expiry so a long turn cannot age out mid-stream. */\nconst SESSION_REFRESH_MARGIN_MS = 5 * 60 * 1000;\n\nconst HOP_BY_HOP_HEADERS = new Set([\n  \"connection\",\n  \"keep-alive\",\n  \"proxy-authenticate\",\n  \"proxy-authorization\",\n  \"te\",\n  \"trailer\",\n  \"transfer-encoding\",\n  \"upgrade\",\n]);\n\n/** Headers Dispatch owns on the upstream call, or that must not cross origins. */\nconst DROPPED_REQUEST_HEADERS = new Set([\n  \"accept-encoding\",\n  \"authorization\",\n  \"content-length\",\n  \"cookie\",\n  \"host\",\n  \"origin\",\n  \"referer\",\n  EMBED_TARGET_HEADER,\n]);\n\n/**\n * `set-cookie` would land on Dispatch's origin, and the encoding/length headers\n * describe the upstream wire body, which `fetch` has already decoded.\n */\nconst DROPPED_RESPONSE_HEADERS = new Set([\n  \"content-encoding\",\n  \"content-length\",\n  \"set-cookie\",\n  \"transfer-encoding\",\n]);\n\nexport interface WorkspaceAppChatSession {\n  /** Target app root, including any configured base path. */\n  appBaseUrl: string;\n  token: string;\n  embedTarget: string;\n  expiresAt: number;\n}\n\nconst sessionCache = new Map<string, Promise<WorkspaceAppChatSession>>();\n\nfunction sessionCacheKey(input: {\n  appId: string;\n  userEmail: string;\n  orgId: string | undefined;\n}): string {\n  return [input.userEmail, input.orgId ?? \"\", input.appId].join(\"\\u0000\");\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error ?? \"\");\n}\n\n/**\n * Read the embed token's own `exp` claim. Guessing a TTL here would silently\n * produce a session that the target has already rejected, so a token we cannot\n * read an expiry from is an error rather than a default.\n */\nexport function embedSessionTokenExpiry(token: string): number {\n  const payload = token.split(\".\")[0];\n  if (!payload) throw new Error(\"Embed session token is malformed.\");\n  let claims: unknown;\n  try {\n    claims = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\"));\n  } catch {\n    throw new Error(\"Embed session token payload could not be decoded.\");\n  }\n  const exp = (claims as { exp?: unknown } | null)?.exp;\n  if (typeof exp !== \"number\" || !Number.isFinite(exp)) {\n    throw new Error(\"Embed session token has no usable expiry.\");\n  }\n  return exp * 1000;\n}\n\nasync function mintEmbedStartUrl(appId: string): Promise<string> {\n  const input = { app: appId, path: \"/\", chrome: \"minimal\" } as const;\n  // Mirrors `WorkspaceAppFrame`: the workspace-sign-in mint when the rollout\n  // covers this app, the Dispatch MCP grant mint otherwise. Both return the\n  // target app's own embed session — neither is a fallback onto Dispatch's\n  // agent, which this proxy must never do.\n  try {\n    return (await createWorkspaceSsoEmbedSession(input)).startUrl;\n  } catch (ssoError) {\n    try {\n      return (await createGrantedDispatchMcpEmbedSession(input)).startUrl;\n    } catch (grantError) {\n      throw new Error(\n        `Could not create an app session for \"${appId}\". ` +\n          `Workspace sign-in: ${errorMessage(ssoError)}. ` +\n          `Dispatch app grant: ${errorMessage(grantError)}.`,\n      );\n    }\n  }\n}\n\n/**\n * Exchange the one-time embed ticket for the reusable short-lived token. The\n * target's embed-start route answers a redirect whose location carries both the\n * token and the path the token is bound to.\n */\nexport async function exchangeEmbedStartUrl(\n  startUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<WorkspaceAppChatSession> {\n  const start = new URL(startUrl);\n  const startIndex = start.pathname.lastIndexOf(EMBED_START_PATH);\n  if (startIndex < 0) {\n    throw new Error(\"App session start URL is not an embed start route.\");\n  }\n  const appBaseUrl = `${start.origin}${start.pathname.slice(0, startIndex)}`;\n\n  const response = await fetchImpl(start.toString(), { redirect: \"manual\" });\n  await response.body?.cancel().catch(() => undefined);\n  const location = response.headers.get(\"location\");\n  if (response.status < 300 || response.status >= 400 || !location) {\n    throw new Error(\n      `App session exchange failed with status ${response.status}.`,\n    );\n  }\n\n  const resolved = new URL(location, start);\n  const token = resolved.searchParams.get(EMBED_TOKEN_QUERY_PARAM);\n  if (!token) {\n    throw new Error(\"App session exchange returned no embed token.\");\n  }\n  return {\n    appBaseUrl,\n    token,\n    embedTarget: resolved.pathname,\n    expiresAt: embedSessionTokenExpiry(token),\n  };\n}\n\nasync function resolveWorkspaceAppChatSession(input: {\n  appId: string;\n  userEmail: string;\n  orgId: string | undefined;\n  fetchImpl: typeof fetch;\n}): Promise<WorkspaceAppChatSession> {\n  const key = sessionCacheKey(input);\n  const cached = sessionCache.get(key);\n  if (cached) {\n    try {\n      const session = await cached;\n      if (session.expiresAt - Date.now() > SESSION_REFRESH_MARGIN_MS) {\n        return session;\n      }\n      // coercion-ok: a mint that already failed is retried below, and that fresh\n      // attempt reports its own error rather than replaying a stale one.\n    } catch {\n      void 0;\n    }\n    sessionCache.delete(key);\n  }\n\n  const pending = Promise.resolve(\n    runWithRequestContext(\n      {\n        userEmail: input.userEmail,\n        ...(input.orgId ? { orgId: input.orgId } : {}),\n      },\n      async () =>\n        exchangeEmbedStartUrl(\n          await mintEmbedStartUrl(input.appId),\n          input.fetchImpl,\n        ),\n    ),\n  );\n  sessionCache.set(key, pending);\n  try {\n    return await pending;\n  } catch (error) {\n    sessionCache.delete(key);\n    throw error;\n  }\n}\n\n/** Test seam: drop cached app sessions so a spec starts from a cold proxy. */\nexport function clearWorkspaceAppChatSessions(): void {\n  sessionCache.clear();\n}\n\nfunction upstreamRequestHeaders(\n  request: Request,\n  session: WorkspaceAppChatSession,\n): Headers {\n  const headers = new Headers();\n  for (const [name, value] of request.headers) {\n    const lower = name.toLowerCase();\n    if (HOP_BY_HOP_HEADERS.has(lower) || DROPPED_REQUEST_HEADERS.has(lower)) {\n      continue;\n    }\n    headers.set(name, value);\n  }\n  headers.set(\"authorization\", `Bearer ${session.token}`);\n  headers.set(EMBED_TARGET_HEADER, session.embedTarget);\n  // Documented same-origin marker (see packages/core/src/server/csrf.ts). The\n  // proxy sends no cookies, but stating first-party intent keeps the contract\n  // explicit rather than relying on the no-cookie shortcut.\n  headers.set(CSRF_MARKER_HEADER, \"1\");\n  return headers;\n}\n\nfunction proxyErrorResponse(status: number, message: string): Response {\n  // An unavailable proxy is a visible failure. Dispatch must never answer an\n  // app-scoped chat request with its own agent: that would look like it worked\n  // while silently supplying the wrong tools and instructions.\n  return new Response(JSON.stringify({ error: message }), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n    },\n  });\n}\n\n/** h3 v2 request event: `url` is the parsed URL and `req` is the web Request. */\ninterface WorkspaceAppChatProxyEvent {\n  url: URL;\n  req: Request;\n}\n\nexport function createWorkspaceAppChatProxyHandler(\n  options: { fetchImpl?: typeof fetch } = {},\n) {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  return async (event: WorkspaceAppChatProxyEvent): Promise<Response> => {\n    const url = event.url;\n    const parsed = parseWorkspaceAppChatProxyPath(url.pathname);\n    if (!parsed) {\n      return proxyErrorResponse(404, \"Workspace app chat route not found.\");\n    }\n\n    // \"Not signed in\" and \"the session store did not answer\" are different\n    // failures. Telling a signed-in user to sign in during an outage is the\n    // confidently-wrong report this proxy must not produce.\n    let session: Awaited<ReturnType<typeof getSession>>;\n    let orgId: string | undefined;\n    try {\n      session = await getSession(event as never);\n      orgId = (await getOrgContext(event as never)).orgId ?? undefined;\n    } catch (error) {\n      return proxyErrorResponse(\n        503,\n        `Dispatch could not read your workspace session: ${errorMessage(error)}`,\n      );\n    }\n    if (!session?.email) {\n      return proxyErrorResponse(401, \"Sign in to Dispatch to use app chat.\");\n    }\n\n    let appSession: WorkspaceAppChatSession;\n    try {\n      appSession = await resolveWorkspaceAppChatSession({\n        appId: parsed.appId,\n        userEmail: session.email,\n        orgId,\n        fetchImpl,\n      });\n    } catch (error) {\n      console.warn(\"[dispatch] workspace app chat proxy could not connect\", {\n        app: parsed.appId,\n        error: errorMessage(error),\n      });\n      return proxyErrorResponse(\n        502,\n        `${parsed.appId} chat is unavailable: ${errorMessage(error)}`,\n      );\n    }\n\n    const request = event.req;\n    const target = new URL(\n      `${appSession.appBaseUrl}${TARGET_CHAT_PATH}${parsed.targetSubPath}`,\n    );\n    target.search = url.search;\n\n    const method = request.method.toUpperCase();\n    // The turn body is a small JSON payload, so buffering the REQUEST costs\n    // nothing and avoids half-duplex streaming support varying by runtime. The\n    // RESPONSE is the streaming half and is piped through untouched below.\n    const body =\n      method === \"GET\" || method === \"HEAD\"\n        ? undefined\n        : await request.arrayBuffer();\n\n    let upstream: Response;\n    try {\n      upstream = await fetchImpl(target.toString(), {\n        method,\n        headers: upstreamRequestHeaders(request, appSession),\n        ...(body === undefined ? {} : { body }),\n        redirect: \"manual\",\n      });\n    } catch (error) {\n      console.warn(\"[dispatch] workspace app chat proxy request failed\", {\n        app: parsed.appId,\n        targetPath: target.pathname,\n        error: errorMessage(error),\n      });\n      return proxyErrorResponse(\n        502,\n        `${parsed.appId} chat did not respond: ${errorMessage(error)}`,\n      );\n    }\n\n    // A rejected embed session is not a transport failure: drop the cached\n    // credential so the next request re-mints instead of looping on a token the\n    // app has already stopped honouring.\n    if (upstream.status === 401 || upstream.status === 403) {\n      sessionCache.delete(\n        sessionCacheKey({\n          appId: parsed.appId,\n          userEmail: session.email,\n          orgId,\n        }),\n      );\n    }\n\n    const headers = new Headers();\n    for (const [name, value] of upstream.headers) {\n      const lower = name.toLowerCase();\n      if (\n        HOP_BY_HOP_HEADERS.has(lower) ||\n        DROPPED_RESPONSE_HEADERS.has(lower)\n      ) {\n        continue;\n      }\n      headers.set(name, value);\n    }\n    // `upstream.body` is the live stream: SSE run events and the turn's token\n    // stream reach the browser as the app emits them, never buffered here.\n    return new Response(upstream.body, {\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers,\n    });\n  };\n}\n"]}