@anteros/core 0.0.40 → 0.0.42

package/server/flags.ts

@@ -0,0 +1,136 @@
+/**
+ * What a process actually runs.
+ *
+ * `api: false` disables everything the HTTP server carries — routes, services,
+ * MCP tools, middlewares, websockets — and the scripts that run alongside it.
+ */
+export type BootCapabilities = {
+    /** HTTP server: routes, services, MCP tools, middlewares, `/health` */
+    api: boolean
+    /** Replication engine: schedule, tombstones, `_replication_` state */
+    replication: boolean
+    /** `runScripts()` shortly after boot */
+    scripts: boolean
+    /** Socket.IO handlers and the `/socket.io/` endpoint */
+    sockets: boolean
+}
+
+/**
+ * Named boot modes (configurable through `server.mode`, overridable by flags).
+ *
+ * - `full` (default): everything.
+ * - `replication-only`: replication engine only — no API at all.
+ * - `no-replication`: full server that never starts the replication engine.
+ * - `api-only`: the HTTP API and nothing around it (no replication, no scripts, no sockets).
+ */
+export type BootMode = 'full' | 'replication-only' | 'no-replication' | 'api-only'
+
+export type BootFlags = {
+    /** `--replication-only` — replication engine only, no API */
+    replicationOnly: boolean
+    /** `--no-replication` — full server, replication engine not started */
+    noReplication: boolean
+    /** `--api-only` — the HTTP API and nothing around it */
+    apiOnly: boolean
+    /** `--no-scripts` — never run the tenant scripts (`*.run.ts` under `scripts/`) */
+    noScripts: boolean
+    /** `--no-sockets` — no Socket.IO handlers, no `/socket.io/` endpoint */
+    noSockets: boolean
+}
+
+export const FULL_CAPABILITIES: BootCapabilities = {
+    api: true,
+    replication: true,
+    scripts: true,
+    sockets: true,
+}
+
+const REPLICATION_ONLY: BootCapabilities = {
+    api: false,
+    replication: true,
+    scripts: false,
+    sockets: false,
+}
+
+const API_ONLY: BootCapabilities = {
+    api: true,
+    replication: false,
+    scripts: false,
+    sockets: false,
+}
+
+function bootModeCapabilities(mode?: BootMode): BootCapabilities {
+    switch (mode) {
+        case 'replication-only': return { ...REPLICATION_ONLY }
+        case 'api-only': return { ...API_ONLY }
+        case 'no-replication': return { ...FULL_CAPABILITIES, replication: false }
+        default: return { ...FULL_CAPABILITIES }
+    }
+}
+
+/**
+ * Read the boot flags from the command line (camelCase spellings accepted).
+ *
+ * @example bun index.ts --replication-only
+ * @example bun index.ts --api-only
+ * @example bun index.ts --no-scripts --no-sockets
+ */
+function parseBootFlags(argv: string[] = process.argv): BootFlags {
+    const has = (...names: string[]) => names.some((name) => argv.includes(name))
+    return {
+        replicationOnly: has('--replication-only', '--replicationOnly'),
+        noReplication: has('--no-replication', '--noReplication'),
+        apiOnly: has('--api-only', '--apiOnly'),
+        noScripts: has('--no-scripts', '--noScripts'),
+        noSockets: has('--no-sockets', '--noSockets'),
+    }
+}
+
+/** True when the flags ask for contradictory things — worth warning the operator */
+function conflictingBootFlags(flags: BootFlags): boolean {
+    return flags.replicationOnly && (flags.noReplication || flags.apiOnly)
+}
+
+/**
+ * What the process will run: `server.mode` first, then the flags, which win.
+ * `--api-only` is the preset "API and nothing around it".
+ */
+function resolveCapabilities(flags: BootFlags, configured?: BootMode): BootCapabilities {
+    // A flag always wins over the configured mode
+    if (flags.replicationOnly) return { ...REPLICATION_ONLY }
+    if (flags.apiOnly) return { ...API_ONLY }
+
+    const caps = bootModeCapabilities(configured)
+    if (flags.noReplication) caps.replication = false
+    if (flags.noScripts) caps.scripts = false
+    if (flags.noSockets) caps.sockets = false
+
+    // Scripts and sockets belong to the API process
+    if (!caps.api) {
+        caps.scripts = false
+        caps.sockets = false
+    }
+
+    return caps
+}
+
+/** Disabled capabilities, for the banner and logs — e.g. `['scripts', 'sockets']` */
+function offCapabilities(caps: BootCapabilities): (keyof BootCapabilities)[] {
+    return (Object.keys(caps) as (keyof BootCapabilities)[]).filter((key) => !caps[key])
+}
+
+/** Closest named mode, used by the banner — all flags off is simply `full` */
+function capabilitiesLabel(caps: BootCapabilities): BootMode {
+    if (!caps.api && caps.replication) return 'replication-only'
+    if (caps.api && !caps.replication && !caps.scripts && !caps.sockets) return 'api-only'
+    // `--no-scripts` / `--no-sockets` alone stay in `full`: the banner lists what is off
+    return 'full'
+}
+
+export {
+    parseBootFlags,
+    conflictingBootFlags,
+    resolveCapabilities,
+    offCapabilities,
+    capabilitiesLabel,
+}

package/server/hono.ts

@@ -11,8 +11,10 @@ import { Redis } from "ioredis"
 import { cfg } from "./config"
 import { rateLimit, createRedisStore, createMemoryStore, type RateLimitStore } from "./security"
 import { initializeRoutes } from "./routes";
+import { patterns } from "../lib/endpoints";
 import { asyncContextStorage, requestCtxStorage } from "../lib/asyncContextStorage";
 import { initializeApi } from "./api";
+import { initializeAgents } from "./agents";
 import { initializeMcp } from "./mcp";
 import { getGlobalMiddlewares } from "../lib/middleware";
 import { jwt } from "../utils/func";
@@ -326,8 +328,8 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             keyGenerator: keyByClientIp(''),
         }));
 
-        // stricter limit for login endpoints
-        app.use('/api/*/login', rateLimit({
+        // stricter limit for login endpoints — the login is a collection action
+        app.use(patterns.login, rateLimit({
             windowMs: cfg.server.rateLimit?.login?.windowMs ?? 60_000,
             max: cfg.server.rateLimit?.login?.max ?? 10,
             store,
@@ -345,7 +347,7 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
 
 
             const requestCtx: Record<string, string> = c.req.header();
-            // Faille 1: never log sensitive headers (JWT, cookies)
+            // Flaw 1: never log sensitive headers (JWT, cookies)
             delete requestCtx.authorization;
             delete requestCtx.cookie;
             requestCtxStorage.set('meta', {
@@ -399,7 +401,10 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     // initialize api
     initializeApi(app);
 
-    // initialize MCP (tools served at /mcp/:tenant_id)
+    // initialize the agents API (/api/:tenant_id/agents/:agent/:action)
+    initializeAgents(app);
+
+    // initialize MCP (tools served at /api/:tenant_id/mcp)
     initializeMcp(app);
 
 

package/server/mcp.ts

@@ -10,72 +10,18 @@ import {
     ErrorCode,
 } from "@modelcontextprotocol/sdk/types.js";
 import { StreamableHTTPTransport } from "@hono/mcp";
-import type Joi from "joi";
 import { cfg } from "./config";
 import { useRest } from "../database/rest";
+import { createAgents } from "../lib/agents";
+import { createApi } from "../lib/api";
 import { logger } from "../utils/logger";
 import type { McpTool, McpResource } from "../types/mcp";
 import type { HonoVariables } from "./env";
+import { joiToJsonSchema } from "../lib/jsonSchema";
+import { patterns } from "../lib/endpoints";
 
-// ─── Joi → JSON Schema (for the MCP protocol) ────────────────────────────
-
-function joiTypeToJson(type: string): string {
-    switch (type) {
-        case 'number': return 'number';
-        case 'integer': return 'integer';
-        case 'boolean': return 'boolean';
-        case 'date': return 'string';
-        default: return 'string';
-    }
-}
-
-/** Minimal Joi → JSON Schema converter (covers the common field types). */
-function joiToJsonSchema(schema: Joi.Schema, describe = schema.describe() as any): any {
-    const node: any = {};
-    const type = describe?.type;
-
-    switch (type) {
-        case 'object': {
-            node.type = 'object';
-            const properties: Record<string, any> = {};
-            const required: string[] = [];
-            for (const [key, child] of Object.entries(describe.keys ?? {})) {
-                properties[key] = joiToJsonSchema(child as any, child);
-                if ((child as any)?.flags?.presence === 'required') required.push(key);
-            }
-            node.properties = properties;
-            if (required.length) node.required = required;
-            break;
-        }
-        case 'array': {
-            node.type = 'array';
-            if (describe.items?.length) node.items = joiToJsonSchema(describe.items[0], describe.items[0]);
-            break;
-        }
-        default: {
-            node.type = joiTypeToJson(type);
-            if (type === 'date') node.format = 'date-time';
-            if (type === 'string') {
-                for (const rule of describe.rules ?? []) {
-                    if (['email', 'uri', 'uuid', 'isoDate', 'ip'].includes(rule.name)) {
-                        node.format = rule.name;
-                    }
-                    if (rule.name === 'pattern' && rule.args?.regex) {
-                        node.pattern = String(rule.args.regex).replace(/^\/|\/[gimsuy]*$/g, '');
-                    }
-                }
-            }
-            if (describe.valids?.length && describe.valids.length <= 50) {
-                node.enum = describe.valids;
-            }
-            break;
-        }
-    }
-
-    if (describe?.flags?.presence === 'required') node.description = node.description ?? 'required';
-    if (describe?.flags?.description) node.description = describe.flags.description;
-    return node;
-}
+// The Joi → JSON Schema converter is shared with the agent runtime — a tool
+// must look identical whether it is exposed over MCP or to a model.
 
 // ─── URI template matching (users://{id} → params) ───────────────────────
 
@@ -148,7 +94,13 @@ function buildServer(tenantId: string, tools: McpTool[], resources: McpResource[
 
         const rest = new useRest({ tenant_id: tenantId });
         try {
-            const result = await tool.exec({ c: undefined as any, rest, args: value });
+            const result = await tool.exec({
+                c: undefined as any,
+                rest,
+                args: value,
+                agents: createAgents(tenantId, rest),
+                api: createApi(rest),
+            });
             const isError = !!(result as any)?.isError;
             logger[isError ? 'warn' : 'info']('MCP tools/call', { method: 'tools/call', tenant: tenantId, tool: req.params.name, args: value, isError, duration: ms(start) });
             if (result && Array.isArray(result.content)) return result;
@@ -205,6 +157,8 @@ function buildServer(tenantId: string, tools: McpTool[], resources: McpResource[
             const result = await matched.resource.read({
                 c: undefined as any,
                 rest,
+                agents: createAgents(tenantId, rest),
+                api: createApi(rest),
                 params: matched.params,
                 uri,
             });
@@ -221,7 +175,7 @@ function buildServer(tenantId: string, tools: McpTool[], resources: McpResource[
 
 /**
  * Expose each tenant's MCP tools & resources over the Model Context Protocol
- * at `GET/POST /mcp/:tenant_id` (Streamable HTTP transport — works with
+ * at `GET/POST /api/:tenant_id/mcp` (Streamable HTTP transport — works with
  * Claude, Cursor, VS Code, and any MCP client).
  */
 export function initializeMcp(app: Hono<{ Variables: HonoVariables }>) {
@@ -238,7 +192,7 @@ export function initializeMcp(app: Hono<{ Variables: HonoVariables }>) {
         resourcesByTenant.set(resource._tenant_ ?? '', list);
     }
 
-    app.all('/mcp/:tenant_id', async (c: Context<{ Variables: HonoVariables }>) => {
+    app.all(patterns.mcp, async (c: Context<{ Variables: HonoVariables }>) => {
         const tenantId = c.req.param('tenant_id') ?? '';
         const tools = toolsByTenant.get(tenantId) ?? [];
         const resources = resourcesByTenant.get(tenantId) ?? [];

package/server/routes.ts

@@ -3,10 +3,26 @@ import { cfg } from "./config";
 import path from "path";
 import { jwt } from "../utils/func";
 import { useRest } from "../database/rest";
+import { createAgents } from "../lib/agents";
+import { createApi } from "../lib/api";
 import { io } from "./io";
 import { requestCtxStorage } from "../lib/asyncContextStorage";
 import type { HonoVariables } from "./env";
 
+/** The context of a route handler — `rest` and `agents` share the same tenant. */
+function routeContext(c: any, tenantId: string) {
+    const rest = new useRest({ tenant_id: tenantId });
+    return {
+        c,
+        rest,
+        // Tenant-scoped LLM registry, bound to this request's `rest`
+        agents: createAgents(tenantId, rest),
+        api: createApi(rest),
+        jwt: jwt,
+        io: io,
+    };
+}
+
 function initializeRoutes(app: Hono<{ Variables: HonoVariables }>) {
     for (let route of cfg.routes ?? []) {
         if (route._prefix_) {
@@ -24,42 +40,21 @@ function initializeRoutes(app: Hono<{ Variables: HonoVariables }>) {
             if (route.method == "GET") {
                 app.get(routePath, async (c) => { //
                     resolveTenant();
-                    return route.handler({
-                        c,
-                        rest: new useRest({
-                            tenant_id: route._tenant_,
-                        }),
-                        jwt: jwt,
-                        io: io,
-                    });
+                    return route.handler(routeContext(c, route._tenant_!));
                 });
             }
 
             if (route.method == 'POST') {
                 app.post(routePath, async (c) => {
                     resolveTenant();
-                    return route.handler({
-                        c,
-                        rest: new useRest({
-                            tenant_id: route._tenant_,
-                        }),
-                        jwt: jwt,
-                        io: io,
-                    });
+                    return route.handler(routeContext(c, route._tenant_!));
                 });
             }
 
             if (route.method == "PUT") {
                 app.put(routePath, async (c) => { //
                     resolveTenant();
-                    return route.handler({
-                        c,
-                        rest: new useRest({
-                            tenant_id: route._tenant_,
-                        }),
-                        jwt: jwt,
-                        io: io,
-                    });
+                    return route.handler(routeContext(c, route._tenant_!));
                 });
             }
         }