@akira-tl/forgerelay 0.6.0 → 0.6.2

package/dist/remote-workspace-relay.js

@@ -0,0 +1,473 @@
+import { randomBytes } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import { isRemoteMcpUnauthorized, refreshRemoteAuthentication, withRemoteMcpClient, } from "./remote-auth.js";
+import { withRemoteServiceEndpoint } from "./remote-transport.js";
+import { loadForgeRelayFiles, writeForgeRelayRemote, } from "./user-config.js";
+const ROUTE_LOCK_RETRY_MS = 10;
+const ROUTE_LOCK_TIMEOUT_MS = 5_000;
+const ROUTE_LOCK_STALE_MS = 30_000;
+const ROUTE_LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+export class RemoteWorkspaceRelay {
+    routes = new Map();
+    turnRoutes = new Map();
+    authEnv;
+    routeStateDir;
+    routeStatePath;
+    constructor(configDir, stateDir) {
+        this.authEnv = { FORGERELAY_CONFIG_DIR: configDir };
+        this.routeStateDir = stateDir;
+        this.routeStatePath = join(stateDir, "remote-workspace-routes.json");
+        this.loadRoutes();
+    }
+    has(workspaceId) {
+        if (this.routes.has(workspaceId))
+            return true;
+        this.loadRoutes();
+        return this.routes.has(workspaceId);
+    }
+    async openWorkspace(alias, input, conversationScopeId) {
+        const resolved = this.remoteByAlias(alias);
+        let result;
+        try {
+            result = await this.callRemoteTool(resolved.alias, resolved.remote, "open_workspace", {
+                path: input.path,
+                ...(input.mode ? { mode: input.mode } : {}),
+                ...(input.baseRef ? { baseRef: input.baseRef } : {}),
+                ...(input.newWorktree !== undefined ? { newWorktree: input.newWorktree } : {}),
+                ...(input.newWorkspace !== undefined ? { newWorkspace: input.newWorkspace } : {}),
+                ...(input.context !== undefined ? { context: input.context } : {}),
+            }, conversationScopeId);
+            assertRemoteToolSucceeded(alias, "open_workspace", result);
+        }
+        catch (error) {
+            throw sanitizedRemoteError(error);
+        }
+        const structured = result.structuredContent;
+        const remoteWorkspaceId = stringField(structured, "workspaceId", "Remote open_workspace response");
+        const root = stringField(structured, "root", "Remote open_workspace response");
+        const mode = structured?.mode;
+        if (mode !== "checkout" && mode !== "worktree") {
+            throw new Error("Remote open_workspace response did not include a valid workspace mode.");
+        }
+        const gatewayWorkspaceId = this.allocateGatewayWorkspaceId();
+        const sourceRoot = typeof structured?.sourceRoot === "string" ? structured.sourceRoot : undefined;
+        const route = {
+            gatewayWorkspaceId,
+            remoteInstanceId: resolved.remote.instanceId,
+            remoteWorkspaceId,
+            root,
+            mode,
+            ...(sourceRoot ? { sourceRoot } : {}),
+        };
+        this.routes.set(gatewayWorkspaceId, route);
+        this.persistRoute(route);
+        const remapContext = (value) => replaceExactWorkspaceId(value, remoteWorkspaceId, gatewayWorkspaceId);
+        const remoteInstruction = typeof structured?.instruction === "string"
+            ? String(remapContext(structured.instruction))
+            : `Use workspaceId ${gatewayWorkspaceId} for subsequent calls.`;
+        return {
+            workspaceId: gatewayWorkspaceId,
+            root,
+            mode,
+            ...(sourceRoot ? { sourceRoot } : {}),
+            ...(structured?.contextFingerprint !== undefined
+                ? { contextFingerprint: remapContext(structured.contextFingerprint) }
+                : {}),
+            ...(structured?.capabilityFingerprint !== undefined
+                ? { capabilityFingerprint: remapContext(structured.capabilityFingerprint) }
+                : {}),
+            ...(structured?.capabilityCatalog !== undefined
+                ? { capabilityCatalog: remapContext(structured.capabilityCatalog) }
+                : {}),
+            ...(structured?.capabilityGuides !== undefined
+                ? { capabilityGuides: remapContext(structured.capabilityGuides) }
+                : {}),
+            ...(structured?.agentsFiles !== undefined
+                ? { agentsFiles: remapContext(structured.agentsFiles) }
+                : {}),
+            ...(structured?.availableAgentsFiles !== undefined
+                ? { availableAgentsFiles: remapContext(structured.availableAgentsFiles) }
+                : {}),
+            ...(structured?.skills !== undefined ? { skills: remapContext(structured.skills) } : {}),
+            ...(structured?.agentProviders !== undefined
+                ? { agentProviders: remapContext(structured.agentProviders) }
+                : {}),
+            ...(structured?.agents !== undefined ? { agents: remapContext(structured.agents) } : {}),
+            ...(structured?.skillDiagnostics !== undefined
+                ? { skillDiagnostics: remapContext(structured.skillDiagnostics) }
+                : {}),
+            instruction: `${remoteInstruction}\nThis workspace executes on remote ${alias}.`,
+        };
+    }
+    async resumeWorkspace(gatewayWorkspaceId, context = "auto", conversationScopeId) {
+        const result = await this.callWorkspaceTool(gatewayWorkspaceId, "open_workspace", { context }, conversationScopeId);
+        if (result.isError === true) {
+            throw new Error(`Remote open_workspace failed: ${toolResultText(result)}`);
+        }
+        return result;
+    }
+    async read(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "read", input, conversationScopeId);
+    }
+    async write(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "write", input, conversationScopeId);
+    }
+    async edit(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "edit", input, conversationScopeId);
+    }
+    async rename(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "rename", input, conversationScopeId);
+    }
+    async delete(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "delete", input, conversationScopeId);
+    }
+    async bash(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "bash", input, conversationScopeId);
+    }
+    async execCommand(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "exec_command", input, conversationScopeId);
+    }
+    async writeStdin(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "write_stdin", input, conversationScopeId);
+    }
+    async applyPatch(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "apply_patch", input, conversationScopeId);
+    }
+    async capability(gatewayWorkspaceId, input, conversationScopeId) {
+        return this.callWorkspaceTool(gatewayWorkspaceId, "capability", input, conversationScopeId);
+    }
+    async activityPanel(gatewayWorkspaceId, conversationScopeId) {
+        const result = await this.callWorkspaceTool(gatewayWorkspaceId, "activity_panel", {}, conversationScopeId);
+        if (result.isError === true) {
+            throw new Error(`Remote activity_panel failed: ${toolResultText(result)}`);
+        }
+        const turnId = stringField(result.structuredContent, "turnId", "Remote activity_panel response");
+        this.turnRoutes.set(turnId, gatewayWorkspaceId);
+        return result;
+    }
+    async activitySnapshot(input, conversationScopeId) {
+        const gatewayWorkspaceId = input.workspaceId && this.has(input.workspaceId)
+            ? input.workspaceId
+            : input.turnId
+                ? this.turnRoutes.get(input.turnId)
+                : undefined;
+        if (!gatewayWorkspaceId)
+            return undefined;
+        const route = this.requireRoute(gatewayWorkspaceId);
+        const resolved = this.remoteByInstance(route.remoteInstanceId);
+        try {
+            const result = await this.callRemoteTool(resolved.alias, resolved.remote, "activity_snapshot", {
+                ...(input.turnId !== undefined ? { turnId: input.turnId } : {}),
+                ...(input.workspaceId !== undefined ? { workspaceId: route.remoteWorkspaceId } : {}),
+                ...(input.knownRevision !== undefined ? { knownRevision: input.knownRevision } : {}),
+            }, conversationScopeId);
+            const remapped = remapToolResultWorkspaceId(result, route.remoteWorkspaceId, gatewayWorkspaceId);
+            const turnId = stringField(remapped.structuredContent, "turnId", "Remote activity_snapshot response");
+            this.turnRoutes.set(turnId, gatewayWorkspaceId);
+            return remapped;
+        }
+        catch (error) {
+            throw sanitizedRemoteError(error, route.remoteWorkspaceId, gatewayWorkspaceId);
+        }
+    }
+    async activityDetail(turnId, activityId, conversationScopeId) {
+        return this.callTurnTool(turnId, "activity_detail", { turnId, activityId }, conversationScopeId);
+    }
+    async activityOutput(turnId, outputId, conversationScopeId) {
+        return this.callTurnTool(turnId, "activity_output", { turnId, outputId }, conversationScopeId);
+    }
+    async callTurnTool(turnId, name, args, conversationScopeId) {
+        const gatewayWorkspaceId = this.turnRoutes.get(turnId);
+        if (!gatewayWorkspaceId)
+            return undefined;
+        const route = this.requireRoute(gatewayWorkspaceId);
+        const resolved = this.remoteByInstance(route.remoteInstanceId);
+        try {
+            const result = await this.callRemoteTool(resolved.alias, resolved.remote, name, args, conversationScopeId);
+            return remapToolResultWorkspaceId(result, route.remoteWorkspaceId, gatewayWorkspaceId);
+        }
+        catch (error) {
+            throw sanitizedRemoteError(error, route.remoteWorkspaceId, gatewayWorkspaceId);
+        }
+    }
+    async callWorkspaceTool(gatewayWorkspaceId, name, args, conversationScopeId) {
+        const route = this.requireRoute(gatewayWorkspaceId);
+        const resolved = this.remoteByInstance(route.remoteInstanceId);
+        try {
+            const result = await this.callRemoteTool(resolved.alias, resolved.remote, name, {
+                ...args,
+                workspaceId: route.remoteWorkspaceId,
+            }, conversationScopeId);
+            return remapToolResultWorkspaceId(result, route.remoteWorkspaceId, gatewayWorkspaceId);
+        }
+        catch (error) {
+            throw sanitizedRemoteError(error, route.remoteWorkspaceId, gatewayWorkspaceId);
+        }
+    }
+    async closeWorkspace(gatewayWorkspaceId, commitMessage, conversationScopeId) {
+        const route = this.requireRoute(gatewayWorkspaceId);
+        const resolved = this.remoteByInstance(route.remoteInstanceId);
+        let result;
+        try {
+            result = await this.callRemoteTool(resolved.alias, resolved.remote, "close_workspace", {
+                workspaceId: route.remoteWorkspaceId,
+                ...(commitMessage !== undefined ? { commitMessage } : {}),
+            }, conversationScopeId);
+            assertRemoteToolSucceeded(resolved.alias, "close_workspace", result);
+        }
+        catch (error) {
+            throw sanitizedRemoteError(error, route.remoteWorkspaceId, gatewayWorkspaceId);
+        }
+        const remoteStructured = result.structuredContent;
+        this.routes.delete(gatewayWorkspaceId);
+        this.deletePersistedRoute(gatewayWorkspaceId);
+        for (const [turnId, routedWorkspaceId] of this.turnRoutes) {
+            if (routedWorkspaceId === gatewayWorkspaceId)
+                this.turnRoutes.delete(turnId);
+        }
+        const text = route.mode === "worktree"
+            ? `Closed relayed worktree workspace ${gatewayWorkspaceId} on remote ${resolved.alias}.`
+            : `Closed relayed checkout workspace ${gatewayWorkspaceId} on remote ${resolved.alias}.`;
+        const structuredContent = {
+            result: text,
+            workspaceId: gatewayWorkspaceId,
+            mode: route.mode,
+        };
+        for (const field of [
+            "sourceRoot",
+            "branch",
+            "targetBranch",
+            "commitSha",
+            "mergedSha",
+            "committed",
+            "cleanupWarning",
+        ]) {
+            const value = remoteStructured?.[field];
+            if (value !== undefined) {
+                structuredContent[field] = replaceExactWorkspaceId(value, route.remoteWorkspaceId, gatewayWorkspaceId);
+            }
+        }
+        return {
+            content: [{ type: "text", text }],
+            _meta: {
+                tool: "close_workspace",
+                card: {
+                    workspaceId: gatewayWorkspaceId,
+                    mode: route.mode,
+                    payload: { content: [{ type: "text", text }] },
+                },
+            },
+            structuredContent,
+        };
+    }
+    requireRoute(workspaceId) {
+        let route = this.routes.get(workspaceId);
+        if (!route) {
+            this.loadRoutes();
+            route = this.routes.get(workspaceId);
+        }
+        if (!route)
+            throw new Error(`Unknown relayed workspace: ${workspaceId}`);
+        return route;
+    }
+    loadRoutes() {
+        for (const [workspaceId, route] of this.readRoutesFromDisk()) {
+            this.routes.set(workspaceId, route);
+        }
+    }
+    persistRoute(route) {
+        this.updatePersistedRoutes((routes) => {
+            routes.set(route.gatewayWorkspaceId, route);
+        });
+    }
+    deletePersistedRoute(workspaceId) {
+        this.updatePersistedRoutes((routes) => {
+            routes.delete(workspaceId);
+        });
+    }
+    updatePersistedRoutes(update) {
+        mkdirSync(this.routeStateDir, { recursive: true });
+        this.withRouteFileLock(() => {
+            const routes = this.readRoutesFromDisk();
+            update(routes);
+            this.writeRoutesToDisk(routes);
+        });
+    }
+    readRoutesFromDisk() {
+        const routes = new Map();
+        if (!existsSync(this.routeStatePath))
+            return routes;
+        const parsed = JSON.parse(readFileSync(this.routeStatePath, "utf8"));
+        if (!Array.isArray(parsed)) {
+            throw new Error(`Invalid relayed workspace route state: ${this.routeStatePath}`);
+        }
+        for (const route of parsed) {
+            if (!route || typeof route.gatewayWorkspaceId !== "string" ||
+                typeof route.remoteInstanceId !== "string" || typeof route.remoteWorkspaceId !== "string" ||
+                typeof route.root !== "string" || (route.mode !== "checkout" && route.mode !== "worktree")) {
+                throw new Error(`Invalid relayed workspace route state: ${this.routeStatePath}`);
+            }
+            routes.set(route.gatewayWorkspaceId, route);
+        }
+        return routes;
+    }
+    writeRoutesToDisk(routes) {
+        const tempPath = `${this.routeStatePath}.${process.pid}.${randomBytes(5).toString("hex")}.tmp`;
+        try {
+            writeFileSync(tempPath, JSON.stringify([...routes.values()], null, 2) + "\n", { mode: 0o600 });
+            renameSync(tempPath, this.routeStatePath);
+        }
+        finally {
+            rmSync(tempPath, { force: true });
+        }
+    }
+    withRouteFileLock(operation) {
+        const lockPath = `${this.routeStatePath}.lock`;
+        const deadline = Date.now() + ROUTE_LOCK_TIMEOUT_MS;
+        for (;;) {
+            try {
+                const fd = openSync(lockPath, "wx", 0o600);
+                closeSync(fd);
+                break;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== "EEXIST")
+                    throw error;
+                try {
+                    if (Date.now() - statSync(lockPath).mtimeMs > ROUTE_LOCK_STALE_MS) {
+                        rmSync(lockPath, { force: true });
+                        continue;
+                    }
+                }
+                catch (statError) {
+                    if (statError.code === "ENOENT")
+                        continue;
+                    throw statError;
+                }
+                if (Date.now() >= deadline) {
+                    throw new Error(`Timed out waiting for relayed workspace route lock: ${lockPath}`);
+                }
+                Atomics.wait(ROUTE_LOCK_SLEEP, 0, 0, ROUTE_LOCK_RETRY_MS);
+            }
+        }
+        try {
+            return operation();
+        }
+        finally {
+            rmSync(lockPath, { force: true });
+        }
+    }
+    remoteByAlias(aliasInput) {
+        const alias = aliasInput.trim();
+        if (!alias)
+            throw new Error("Remote relay alias must not be empty.");
+        const remote = loadForgeRelayFiles(this.authEnv).auth.remotes?.[alias];
+        if (!remote)
+            throw new Error(`Unknown remote relay alias: ${alias}`);
+        return { alias, remote };
+    }
+    remoteByInstance(instanceId) {
+        const entry = Object.entries(loadForgeRelayFiles(this.authEnv).auth.remotes ?? {})
+            .find(([, remote]) => remote.instanceId === instanceId);
+        if (!entry)
+            throw new Error(`Remote ForgeRelay instance ${instanceId} is no longer registered.`);
+        return { alias: entry[0], remote: entry[1] };
+    }
+    async callRemoteTool(alias, initialRemote, name, args, conversationScopeId) {
+        return withRemoteServiceEndpoint(initialRemote.target, initialRemote.sshRoute, async (endpoint) => {
+            let remote = initialRemote;
+            let refreshed = false;
+            if (remote.accessTokenExpiresAt <= Math.floor(Date.now() / 1000)) {
+                remote = await this.refreshRemote(alias, remote, endpoint);
+                refreshed = true;
+            }
+            const invoke = () => withRemoteMcpClient(remote, endpoint, async (client) => CallToolResultSchema.parse(await client.callTool({
+                name,
+                arguments: args,
+                ...(conversationScopeId
+                    ? { _meta: { "openai/session": conversationScopeId } }
+                    : {}),
+            })));
+            try {
+                return await invoke();
+            }
+            catch (error) {
+                if (!refreshed && isRemoteMcpUnauthorized(error)) {
+                    remote = await this.refreshRemote(alias, remote, endpoint);
+                    return invoke();
+                }
+                throw new Error(`Remote ForgeRelay ${alias} request failed: ${errorMessage(error)}`, { cause: error });
+            }
+        });
+    }
+    async refreshRemote(alias, remote, endpoint) {
+        const refreshed = await refreshRemoteAuthentication(remote, endpoint);
+        writeForgeRelayRemote(alias, refreshed, this.authEnv);
+        return refreshed;
+    }
+    allocateGatewayWorkspaceId() {
+        let workspaceId;
+        do {
+            workspaceId = `rws_${randomBytes(5).toString("hex")}`;
+        } while (this.routes.has(workspaceId));
+        return workspaceId;
+    }
+}
+function assertRemoteToolSucceeded(alias, tool, result) {
+    if (result.isError !== true)
+        return;
+    throw new Error(`Remote ForgeRelay ${alias} ${tool} failed: ${toolResultText(result)}`);
+}
+function stringField(structured, field, label) {
+    const value = structured?.[field];
+    if (typeof value !== "string" || !value) {
+        throw new Error(`${label} did not include ${field}.`);
+    }
+    return value;
+}
+function toolResultText(result) {
+    return (result.content ?? [])
+        .filter((entry) => entry.type === "text")
+        .map((entry) => entry.text)
+        .join("\n") || "remote tool returned an error";
+}
+function remapToolResultWorkspaceId(result, remoteWorkspaceId, gatewayWorkspaceId) {
+    return {
+        ...result,
+        content: (result.content ?? []).map((entry) => entry.type === "text"
+            ? { ...entry, text: entry.text.split(remoteWorkspaceId).join(gatewayWorkspaceId) }
+            : entry),
+        ...(result._meta
+            ? { _meta: replaceExactWorkspaceId(result._meta, remoteWorkspaceId, gatewayWorkspaceId) }
+            : {}),
+        ...(result.structuredContent
+            ? {
+                structuredContent: replaceExactWorkspaceId(result.structuredContent, remoteWorkspaceId, gatewayWorkspaceId),
+            }
+            : {}),
+    };
+}
+function replaceExactWorkspaceId(value, from, to) {
+    if (typeof value === "string")
+        return value.split(from).join(to);
+    if (Array.isArray(value))
+        return value.map((entry) => replaceExactWorkspaceId(entry, from, to));
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .map(([key, entry]) => [key, replaceExactWorkspaceId(entry, from, to)]));
+}
+function sanitizedRemoteError(error, remoteWorkspaceId, gatewayWorkspaceId) {
+    let message = errorMessage(error);
+    if (remoteWorkspaceId && gatewayWorkspaceId) {
+        message = message.split(remoteWorkspaceId).join(gatewayWorkspaceId);
+    }
+    message = message.replace(/(^|[^A-Za-z0-9_])ws_[0-9a-f]{10}(?=$|[^A-Za-z0-9_])/g, "$1[remote-workspace]");
+    return new Error(message, { cause: error });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}