@aopslabs/aops-server 0.2.15 → 0.2.17

package/scripts/community-agent-wake-endpoint.mjs

@@ -0,0 +1,329 @@
+import { randomBytes } from 'node:crypto'
+import {
+  AGENT_RUNTIME_WAKE_MAX_PROMPT_BYTES,
+  resolveAgentWakeTarget,
+} from '@aopslabs/aops-agent-runtime'
+
+export const COMMUNITY_AGENT_WAKE_CAPABILITY_PATH = '/_aops/agent-wake/capability'
+export const COMMUNITY_AGENT_WAKE_ACTION_PATH = '/_aops/agent-wake'
+export const COMMUNITY_AGENT_WAKE_GRANT_HEADER = 'x-aops-agent-wake-grant'
+
+const MAX_BODY_BYTES = AGENT_RUNTIME_WAKE_MAX_PROMPT_BYTES + 16_384
+export const COMMUNITY_AGENT_WAKE_PROBE_TIMEOUT_MS = 1_500
+export const COMMUNITY_AGENT_WAKE_GRANT_TTL_MS = 30_000
+const MAX_LIVE_GRANTS = 256
+
+function jsonResponse(res, status, payload, securityHeaders = {}) {
+  res.writeHead(status, {
+    ...securityHeaders,
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  res.end(`${JSON.stringify(payload)}\n`)
+}
+
+function token() {
+  return randomBytes(32).toString('base64url')
+}
+
+export function createCommunityAgentWakeContext({
+  wake,
+  verifyAdmission,
+  registryPath,
+  securityHeaders = {},
+  now = Date.now,
+  grantTtlMs = COMMUNITY_AGENT_WAKE_GRANT_TTL_MS,
+}) {
+  if (typeof wake !== 'function') throw new Error('community_agent_wake_adapter_required')
+  if (typeof verifyAdmission !== 'function') throw new Error('community_agent_wake_admission_verifier_required')
+  if (typeof now !== 'function') throw new Error('community_agent_wake_clock_required')
+  if (!Number.isInteger(grantTtlMs) || grantTtlMs < 1 || grantTtlMs > 60_000) {
+    throw new Error('community_agent_wake_grant_ttl_invalid')
+  }
+  return Object.freeze({
+    wake,
+    verifyAdmission,
+    registryPath,
+    securityHeaders,
+    now,
+    grantTtlMs,
+    grants: new Map(),
+  })
+}
+
+function admissionFrom(input) {
+  return {
+    channelId: typeof input.channelId === 'string' ? input.channelId.trim() : '',
+    memberId: typeof input.memberId === 'string' ? input.memberId.trim() : '',
+    handle: typeof input.handle === 'string' ? input.handle.trim() : '',
+    actorKind: typeof input.actorKind === 'string' ? input.actorKind.trim().toLowerCase() : '',
+    status: typeof input.status === 'string' ? input.status.trim().toLowerCase() : '',
+  }
+}
+
+async function inspectCapability(admission, context) {
+  if (admission.actorKind !== 'agent') return { enabled: false, reason: 'not_agent', hostMatched: false }
+  if (admission.status !== 'active') return { enabled: false, reason: 'member_inactive', hostMatched: false }
+  let resolved
+  try {
+    resolved = resolveAgentWakeTarget(admission.channelId, admission.memberId, context.registryPath)
+  } catch (error) {
+    const code = error instanceof Error ? error.message : String(error)
+    return { enabled: false, reason: code.startsWith('agent_wake_registry_') ? code : 'invalid_target', hostMatched: false }
+  }
+  if (!resolved.entry) return { enabled: false, reason: 'not_registered', hostMatched: false }
+  if (resolved.entry.handle && resolved.entry.handle !== admission.handle) {
+    return { enabled: false, reason: 'identity_mismatch', hostMatched: resolved.hostMatched }
+  }
+  if (!resolved.hostMatched) {
+    return {
+      enabled: false,
+      reason: 'host_mismatch',
+      hostMatched: false,
+      runtime: resolved.entry.runtime,
+      targetSessionIdHash: resolved.entry.targetSessionIdHash,
+      lastVerifiedAt: resolved.entry.lastVerifiedAt,
+    }
+  }
+  const probe = await context.wake({
+    runtime: resolved.entry.runtime,
+    transport: 'desktop-ipc',
+    sessionId: resolved.entry.targetSessionId,
+    prompt: '',
+    dryRun: true,
+    handshakeTimeoutMs: COMMUNITY_AGENT_WAKE_PROBE_TIMEOUT_MS,
+  })
+  if (!probe?.envelope?.ok) {
+    return {
+      enabled: false,
+      reason: `dry_run_failed:${probe?.envelope?.code ?? 'unknown'}`,
+      hostMatched: true,
+      runtime: resolved.entry.runtime,
+      targetSessionIdHash: resolved.entry.targetSessionIdHash,
+      lastVerifiedAt: resolved.entry.lastVerifiedAt,
+    }
+  }
+  return {
+    enabled: true,
+    reason: 'ready',
+    hostMatched: true,
+    runtime: resolved.entry.runtime,
+    targetSessionIdHash: resolved.entry.targetSessionIdHash,
+    lastVerifiedAt: resolved.entry.lastVerifiedAt,
+    entry: resolved.entry,
+  }
+}
+
+async function readJsonBody(req) {
+  const contentType = String(req.headers['content-type'] ?? '').split(';', 1)[0].trim().toLowerCase()
+  if (contentType !== 'application/json') throw new Error('content_type_json_required')
+  const contentLength = Number(req.headers['content-length'] ?? 0)
+  if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) throw new Error('request_body_too_large')
+  const chunks = []
+  let bytes = 0
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    bytes += buffer.length
+    if (bytes > MAX_BODY_BYTES) throw new Error('request_body_too_large')
+    chunks.push(buffer)
+  }
+  const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('request_body_invalid')
+  return parsed
+}
+
+function publicCapability(capability) {
+  const { entry: _entry, ...safe } = capability
+  return safe
+}
+
+function admissionKey(admission) {
+  return [
+    admission.channelId,
+    admission.memberId,
+    admission.handle,
+    admission.actorKind,
+    admission.status,
+  ].join('\u0000')
+}
+
+function cleanupExpiredGrants(context) {
+  const now = context.now()
+  for (const [grantToken, grant] of context.grants) {
+    if (grant.expiresAt <= now) context.grants.delete(grantToken)
+  }
+  while (context.grants.size >= MAX_LIVE_GRANTS) {
+    const oldest = context.grants.keys().next().value
+    if (!oldest) break
+    context.grants.delete(oldest)
+  }
+}
+
+function issueGrant(admission, verifiedCaller, context) {
+  cleanupExpiredGrants(context)
+  const value = token()
+  const expiresAt = context.now() + context.grantTtlMs
+  context.grants.set(value, {
+    principalId: verifiedCaller.principalId,
+    callerMemberId: verifiedCaller.callerMemberId,
+    callerChannelId: verifiedCaller.callerChannelId,
+    admissionKey: admissionKey(admission),
+    expiresAt,
+  })
+  return { value, expiresAt }
+}
+
+function consumeGrant(req, admission, verifiedCaller, context) {
+  const value = req.headers[COMMUNITY_AGENT_WAKE_GRANT_HEADER]
+  if (typeof value !== 'string' || !value) return 'agent_wake_grant_invalid'
+  const grant = context.grants.get(value)
+  if (!grant) return 'agent_wake_grant_invalid'
+  context.grants.delete(value)
+  if (grant.expiresAt <= context.now()) return 'agent_wake_grant_expired'
+  if (grant.principalId !== verifiedCaller.principalId) return 'agent_wake_grant_principal_mismatch'
+  if (
+    grant.callerMemberId !== verifiedCaller.callerMemberId
+    || grant.callerChannelId !== verifiedCaller.callerChannelId
+  ) return 'agent_wake_grant_caller_mismatch'
+  if (grant.admissionKey !== admissionKey(admission)) return 'agent_wake_grant_scope_mismatch'
+  return null
+}
+
+const SAFE_ADMISSION_ERRORS = new Set([
+  'agent_wake_member_token_required',
+  'agent_wake_member_token_invalid_format',
+  'agent_wake_member_token_unknown',
+  'agent_wake_member_token_mismatch',
+  'agent_wake_member_not_active',
+  'agent_wake_member_cross_channel',
+  'agent_wake_target_not_active',
+  'agent_wake_admission_required',
+])
+
+function verifiedTargetAdmission(selector, verified) {
+  const member = verified?.targetMember
+  const memberId = typeof member?.id === 'string' ? member.id.trim() : ''
+  const channelId = typeof member?.channelId === 'string' ? member.channelId.trim() : ''
+  if (!memberId || memberId !== selector.memberId || channelId !== selector.channelId) {
+    throw new Error('agent_wake_target_not_active')
+  }
+  return admissionFrom({
+    channelId,
+    memberId,
+    handle: member.handle,
+    actorKind: member.actorKind,
+    status: member.status,
+  })
+}
+
+async function verifiedMemberAdmission(req, browser, selector, context) {
+  if (!browser.browserOriginPresent) return { error: 'same_origin_required' }
+  try {
+    const verified = await context.verifyAdmission(req, {
+      channelId: selector.channelId,
+      targetMemberId: selector.memberId,
+    })
+    const principalId = typeof verified?.principalId === 'string' ? verified.principalId.trim() : ''
+    const callerMemberId = typeof verified?.callerMemberId === 'string' ? verified.callerMemberId.trim() : ''
+    const callerChannelId = typeof verified?.callerChannelId === 'string' ? verified.callerChannelId.trim() : ''
+    if (!principalId || !callerMemberId || !callerChannelId) return { error: 'agent_wake_admission_required' }
+    if (callerChannelId !== selector.channelId) return { error: 'agent_wake_member_cross_channel' }
+    return {
+      principalId,
+      callerMemberId,
+      callerChannelId,
+      targetAdmission: verifiedTargetAdmission(selector, verified),
+    }
+  } catch (error) {
+    const code = error instanceof Error ? error.message : ''
+    return { error: SAFE_ADMISSION_ERRORS.has(code) ? code : 'agent_wake_admission_required' }
+  }
+}
+
+export async function handleCommunityAgentWakeRequest(req, res, url, browser, context) {
+  if (url.pathname !== COMMUNITY_AGENT_WAKE_CAPABILITY_PATH && url.pathname !== COMMUNITY_AGENT_WAKE_ACTION_PATH) return false
+  if (url.pathname === COMMUNITY_AGENT_WAKE_CAPABILITY_PATH) {
+    if (req.method !== 'POST') {
+      res.writeHead(405, { allow: 'POST' })
+      res.end()
+      return true
+    }
+    let body
+    try {
+      body = await readJsonBody(req)
+    } catch (error) {
+      jsonResponse(res, 400, { ok: false, code: error instanceof Error ? error.message : 'request_body_invalid' }, context.securityHeaders)
+      return true
+    }
+    const selector = admissionFrom(body)
+    const verified = await verifiedMemberAdmission(req, browser, selector, context)
+    if (verified.error) {
+      jsonResponse(res, 403, { ok: false, code: verified.error }, context.securityHeaders)
+      return true
+    }
+    const admission = verified.targetAdmission
+    const capability = await inspectCapability(admission, context)
+    jsonResponse(res, 200, {
+      ok: true,
+      capability: publicCapability(capability),
+      grant: capability.enabled ? issueGrant(admission, verified, context) : null,
+    }, context.securityHeaders)
+    return true
+  }
+  if (req.method !== 'POST') {
+    res.writeHead(405, { allow: 'POST' })
+    res.end()
+    return true
+  }
+  let body
+  try {
+    body = await readJsonBody(req)
+  } catch (error) {
+    jsonResponse(res, 400, { ok: false, code: error instanceof Error ? error.message : 'request_body_invalid' }, context.securityHeaders)
+    return true
+  }
+  const prompt = typeof body.prompt === 'string' ? body.prompt : ''
+  if (!prompt.trim() || Buffer.byteLength(prompt, 'utf8') > AGENT_RUNTIME_WAKE_MAX_PROMPT_BYTES) {
+    jsonResponse(res, 400, { ok: false, code: 'invalid_prompt' }, context.securityHeaders)
+    return true
+  }
+  const selector = admissionFrom(body)
+  const verified = await verifiedMemberAdmission(req, browser, selector, context)
+  if (verified.error) {
+    jsonResponse(res, 403, { ok: false, code: verified.error }, context.securityHeaders)
+    return true
+  }
+  const admission = verified.targetAdmission
+  const grantError = consumeGrant(req, admission, verified, context)
+  if (grantError) {
+    jsonResponse(res, 403, { ok: false, code: grantError }, context.securityHeaders)
+    return true
+  }
+  const capability = await inspectCapability(admission, context)
+  if (!capability.enabled || !capability.entry) {
+    jsonResponse(res, 409, { ok: false, code: capability.reason, capability: publicCapability(capability) }, context.securityHeaders)
+    return true
+  }
+  const result = await context.wake({
+    runtime: capability.entry.runtime,
+    transport: 'desktop-ipc',
+    sessionId: capability.entry.targetSessionId,
+    prompt,
+  })
+  if (!result?.envelope?.ok) {
+    jsonResponse(res, result?.envelope?.retryable ? 503 : 409, {
+      ok: false,
+      code: result?.envelope?.code ?? 'wake_failed',
+      targetSessionIdHash: capability.entry.targetSessionIdHash,
+    }, context.securityHeaders)
+    return true
+  }
+  jsonResponse(res, 200, {
+    ok: true,
+    code: 'wake_sent',
+    runtime: capability.entry.runtime,
+    targetSessionIdHash: capability.entry.targetSessionIdHash,
+    turnId: result.envelope.turnId ?? null,
+  }, context.securityHeaders)
+  return true
+}

package/scripts/community-host.mjs

@@ -12,6 +12,17 @@ import { createServer, request as httpRequest } from "node:http";
 import { isIP } from "node:net";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { wakeAgentSession as wakeLocalAgentSession } from "@aopslabs/aops-agent-runtime";
+import {
+  COMMUNITY_AGENT_WAKE_ACTION_PATH,
+  COMMUNITY_AGENT_WAKE_CAPABILITY_PATH,
+  createCommunityAgentWakeContext,
+  handleCommunityAgentWakeRequest,
+} from "./community-agent-wake-endpoint.mjs";
+
+// Imported by the host process (never from the browser bundle or CLI package).
+// S3 binds this runtime-keyed adapter to the authenticated loopback endpoint.
+export const communityHostAgentWakeAdapter = wakeLocalAgentSession;
 
 export const COMMUNITY_HOST_MODES = Object.freeze({
   native: "direct-loopback",
@@ -29,6 +40,8 @@ const DEFAULT_OCI_INTERNAL_PORT = "5901";
 const DEFAULT_COCKPIT_PORT = "5922";
 const TRUSTED_LOCAL_AUTH_PROVIDER = "trusted-local";
 const VALIDATED_PUBLIC_ORIGIN_HEADER = "x-aops-validated-public-origin";
+const AGENT_WAKE_ADMISSION_TIMEOUT_MS = 1_500;
+const AGENT_WAKE_ADMISSION_MAX_BYTES = 1024 * 1024;
 const PACKAGE_STATIC_ROOT = path.resolve(import.meta.dirname, "../cockpit");
 const CHECKOUT_STATIC_ROOT = path.resolve(import.meta.dirname, "../../aops-cockpit-v2/dist");
 const DEFAULT_PATHS = Object.freeze({
@@ -624,6 +637,144 @@ export function proxyCommunityRequest(req, res, config, browserOriginPresent) {
   req.pipe(upstream);
 }
 
+function requestCommunityAgentWakeAdmission(config, pathName, headers) {
+  return new Promise((resolve, reject) => {
+    const upstream = httpRequest({
+      hostname: config.internalHost,
+      port: config.internalPort,
+      method: "GET",
+      path: pathName,
+      headers,
+    }, (response) => {
+      const chunks = [];
+      let bytes = 0;
+      response.on("data", (chunk) => {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > AGENT_WAKE_ADMISSION_MAX_BYTES) {
+          upstream.destroy(new Error("community_agent_wake_admission_response_too_large"));
+          return;
+        }
+        chunks.push(buffer);
+      });
+      response.once("end", () => {
+        try {
+          const text = Buffer.concat(chunks).toString("utf8");
+          const payload = text ? JSON.parse(text) : null;
+          resolve({ status: response.statusCode ?? 500, payload });
+        } catch {
+          reject(new Error("community_agent_wake_admission_response_invalid"));
+        }
+      });
+      response.once("error", reject);
+    });
+    upstream.setTimeout(AGENT_WAKE_ADMISSION_TIMEOUT_MS, () => {
+      upstream.destroy(new Error("community_agent_wake_admission_timeout"));
+    });
+    upstream.once("error", reject);
+    upstream.end();
+  });
+}
+
+function memberAdmissionError(payload) {
+  const structuredReason = [
+    payload?.details?.memberAuthReason,
+    payload?.data?.details?.memberAuthReason,
+    payload?.error?.details?.memberAuthReason,
+    payload?.data?.error?.details?.memberAuthReason,
+  ].find((value) => typeof value === "string");
+  const structuredCodes = {
+    member_token_required: "agent_wake_member_token_required",
+    member_token_invalid_format: "agent_wake_member_token_invalid_format",
+    member_token_unknown: "agent_wake_member_token_unknown",
+    member_token_mismatch: "agent_wake_member_token_mismatch",
+    membership_inactive: "agent_wake_member_not_active",
+    membership_channel_mismatch: "agent_wake_member_cross_channel",
+  };
+  if (structuredReason && structuredCodes[structuredReason]) {
+    return structuredCodes[structuredReason];
+  }
+
+  // Mixed-version trusted-local fallback only. Current released ChatV3 hosts
+  // do not yet emit memberAuthReason; remove after the package uptake window.
+  const detail = [
+    payload?.message,
+    payload?.error,
+    payload?.detail,
+    payload?.data?.message,
+    payload?.data?.error,
+  ].filter((value) => typeof value === "string").join(" ").toLowerCase();
+  if (detail.includes("invalid member token format")) return "agent_wake_member_token_invalid_format";
+  if (detail.includes("unknown member token")) return "agent_wake_member_token_unknown";
+  if (detail.includes("member token mismatch")) return "agent_wake_member_token_mismatch";
+  if (detail.includes("membership is not active")) return "agent_wake_member_not_active";
+  if (detail.includes("not a member of this channel")) return "agent_wake_member_cross_channel";
+  return "agent_wake_admission_required";
+}
+
+function responseData(payload) {
+  if (payload?.ok === true && payload.data !== undefined) return payload.data;
+  if (payload?.result?.data !== undefined) return payload.result.data;
+  return payload;
+}
+
+function parseVerifiedMemberTokenId(memberToken) {
+  const match = /^cv3m_([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})_[A-Za-z0-9_-]{16,}$/i.exec(memberToken);
+  return match?.[1] ?? null;
+}
+
+export async function verifyCommunityAgentWakeAdmission(req, config, selector = {}) {
+  const headers = {
+    accept: "application/json",
+    host: config.upstreamAuthority,
+  };
+  const cookie = typeof req.headers.cookie === "string" ? req.headers.cookie.trim() : "";
+  if (cookie) headers.cookie = cookie;
+  if (typeof req.headers.origin === "string" && req.headers.origin.trim()) {
+    headers.origin = config.upstreamOrigin;
+  }
+  const auth = await requestCommunityAgentWakeAdmission(config, "/api/auth/me", headers);
+  if (auth.status !== 200) throw new Error("agent_wake_admission_required");
+  const principal = auth.payload?.ok === true ? auth.payload?.data?.principal : null;
+  const principalId = nonEmpty(principal?.id) || nonEmpty(principal?.userId);
+  if (!principalId) throw new Error("agent_wake_admission_required");
+
+  const memberTokenHeader = typeof req.headers["x-chatv3-member-token"] === "string"
+    ? req.headers["x-chatv3-member-token"].trim()
+    : "";
+  const memberToken = /^Bearer\s+/i.test(memberTokenHeader)
+    ? memberTokenHeader.replace(/^Bearer\s+/i, "").trim()
+    : memberTokenHeader;
+  if (!memberToken) throw new Error("agent_wake_member_token_required");
+  const channelId = nonEmpty(selector.channelId);
+  const targetMemberId = nonEmpty(selector.targetMemberId);
+  if (!channelId || !targetMemberId) throw new Error("agent_wake_target_not_active");
+  const roster = await requestCommunityAgentWakeAdmission(
+    config,
+    `/api/chatv3/v1/channels/${encodeURIComponent(channelId)}/members?status=active&limit=500`,
+    { ...headers, "x-chatv3-member-token": memberToken },
+  );
+  if (roster.status !== 200) throw new Error(memberAdmissionError(roster.payload));
+  const callerMemberId = parseVerifiedMemberTokenId(memberToken);
+  if (!callerMemberId) throw new Error("agent_wake_member_token_invalid_format");
+  const members = responseData(roster.payload);
+  if (!Array.isArray(members)) throw new Error("agent_wake_admission_required");
+  const callerMember = members.find((member) => member?.id === callerMemberId);
+  if (!callerMember || callerMember.channelId !== channelId || callerMember.status !== "active") {
+    throw new Error("agent_wake_member_not_active");
+  }
+  const targetMember = members.find((member) => member?.id === targetMemberId);
+  if (!targetMember || targetMember.channelId !== channelId || targetMember.status !== "active") {
+    throw new Error("agent_wake_target_not_active");
+  }
+  return {
+    principalId,
+    callerMemberId,
+    callerChannelId: channelId,
+    targetMember,
+  };
+}
+
 function openStaticFile(filePath) {
   const flags = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0);
   const descriptor = openSync(filePath, flags);
@@ -719,7 +870,7 @@ async function loadHandler(handlerEntry) {
   return loaded.handler;
 }
 
-export async function runCommunityHost(options, env = process.env, hostPaths = DEFAULT_PATHS) {
+export async function runCommunityHost(options, env = process.env, hostPaths = DEFAULT_PATHS, hostRuntime = {}) {
   const config = resolveCommunityHostConfig(options, env);
   const cockpitOnly = config.mode === COMMUNITY_HOST_MODES.cockpit;
   if (!cockpitOnly && env !== process.env) throw new Error("community_host_process_env_required");
@@ -734,6 +885,20 @@ export async function runCommunityHost(options, env = process.env, hostPaths = D
     process.env.ORIGIN = config.handlerOrigin ?? config.publicOrigin;
   }
   const handler = cockpitOnly ? null : await loadHandler(paths.handlerEntry);
+  const agentWakeContext = cockpitOnly
+    ? createCommunityAgentWakeContext({
+        wake: hostRuntime.wakeAgentSession ?? communityHostAgentWakeAdapter,
+        verifyAdmission: (req, selector) => (
+          hostRuntime.verifyAgentWakeAdmission
+            ? hostRuntime.verifyAgentWakeAdmission(req, config, selector)
+            : verifyCommunityAgentWakeAdmission(req, config, selector)
+        ),
+        registryPath: nonEmpty(env.AOPS_AGENT_WAKE_REGISTRY_PATH) || undefined,
+        securityHeaders: STATIC_SECURITY_HEADERS,
+        now: hostRuntime.agentWakeNow ?? Date.now,
+        grantTtlMs: hostRuntime.agentWakeGrantTtlMs,
+      })
+    : null;
   let innerServer;
   let innerSockets = new Set();
   let edgeServer;
@@ -802,6 +967,25 @@ export async function runCommunityHost(options, env = process.env, hostPaths = D
         res.end(req.method === "HEAD" ? undefined : '{"status":"healthy","service":"aops-cockpit"}');
         return;
       }
+      if (
+        cockpitOnly &&
+        agentWakeContext &&
+        (url.pathname === COMMUNITY_AGENT_WAKE_CAPABILITY_PATH || url.pathname === COMMUNITY_AGENT_WAKE_ACTION_PATH)
+      ) {
+        void handleCommunityAgentWakeRequest(req, res, url, browser, agentWakeContext).catch(() => {
+          if (!res.headersSent) {
+            res.writeHead(500, {
+              ...STATIC_SECURITY_HEADERS,
+              "content-type": "application/json; charset=utf-8",
+              "cache-control": "no-store",
+            });
+            res.end('{"ok":false,"code":"agent_wake_internal_error"}');
+          } else {
+            res.destroy();
+          }
+        });
+        return;
+      }
       if (
         !shouldHandleApiPath(url.pathname) &&
         (config.mode === COMMUNITY_HOST_MODES.oci || cockpitOnly)

package/scripts/community-migration-policy-package-v1.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "id": "aops-community-strict-migration-v5",
+  "id": "aops-community-strict-migration-v6",
   "inventorySha256": "3ca2e22e8af86db2be8e7eccb868d5d5858b75d67f53080ddf52496853de9c40",
   "sourceArtifacts": {
     "convergenceFileSha256": "0e4e54109ec57f03e278751e29850ebd17fa5e9cc9df6ce8de6c767769714979",
@@ -85,9 +85,10 @@
       "migrationsDir": "migrations/docman",
       "migrationTable": "docman_schema_migrations",
       "legacyHashColumn": false,
-      "journalSha256": "6c9efe998ae606a4a31f0e4f5ba7726acd066e0dd10795fbda7c2768328ebfb4",
+      "journalSha256": "eff4f39410b10be3ecf1b708a5f17d974f8d6fbbc102487e779d24f5ccbf9bcd",
       "journalSha256History": [
-        "6c9efe998ae606a4a31f0e4f5ba7726acd066e0dd10795fbda7c2768328ebfb4"
+        "6c9efe998ae606a4a31f0e4f5ba7726acd066e0dd10795fbda7c2768328ebfb4",
+        "eff4f39410b10be3ecf1b708a5f17d974f8d6fbbc102487e779d24f5ccbf9bcd"
       ],
       "migrations": [
         {
@@ -131,6 +132,12 @@
           "tag": "0006_document_version_current_invariant",
           "sha256": "96fcf7eed81e6f10a3986ed0881e98597747587b02ee8590f8bdcf2da0cd54a9",
           "risk": "additive"
+        },
+        {
+          "idx": 7,
+          "tag": "0007_text_file_profile",
+          "sha256": "b4e352063300e19576aa83a62b087e09cb1792b32163481ba0b86b76e27a2f84",
+          "risk": "additive"
         }
       ]
     },
@@ -372,6 +379,23 @@
       "policyId": "aops-community-strict-migration-v5",
       "inventorySha256": "3ca2e22e8af86db2be8e7eccb868d5d5858b75d67f53080ddf52496853de9c40",
       "convergenceSha256": "dcc49a31f8fecaba7d3f05c939a78f266ca7543d46da62ef9c3ac2176df024b2"
+    },
+    {
+      "id": "strict-v5",
+      "kind": "strict",
+      "relationCount": 86,
+      "schemaFingerprintSha256": "92909ca23489c9d4cefba3ff3c55c10afe9cd587ad7a6a244810c7508ddec07d",
+      "appliedCounts": [
+        6,
+        1,
+        8,
+        6,
+        8
+      ],
+      "postgresMajor": 16,
+      "policyId": "aops-community-strict-migration-v6",
+      "inventorySha256": "3ca2e22e8af86db2be8e7eccb868d5d5858b75d67f53080ddf52496853de9c40",
+      "convergenceSha256": "dcc49a31f8fecaba7d3f05c939a78f266ca7543d46da62ef9c3ac2176df024b2"
     }
   ],
   "lineageReconciliations": [
@@ -397,10 +421,10 @@
       ]
     }
   ],
-  "targetLineageId": "strict-v4",
+  "targetLineageId": "strict-v5",
   "semanticContract": {
     "schemaVersion": 1,
-    "migrationSetSha256": "6fcbcd576cd40c7175d101f8c29dcf0df498bd03eb0654689b6e27e559e362eb",
+    "migrationSetSha256": "443ce196a1954a73c01bcaff5092addae28b34b96c6ecf6e7bf4e77d2570d29a",
     "relations": [
       {
         "kind": "r",
@@ -1428,6 +1452,13 @@
         "table": "docman_page_versions",
         "type": "jsonb"
       },
+      {
+        "column": "contentMode",
+        "defaultExpression": "'structured'::text",
+        "notNull": true,
+        "table": "docman_document_versions",
+        "type": "text"
+      },
       {
         "column": "costUsd",
         "defaultExpression": null,
@@ -2961,6 +2992,13 @@
         "table": "docman_document_index_entries",
         "type": "text"
       },
+      {
+        "column": "fileExtension",
+        "defaultExpression": "'md'::text",
+        "notNull": true,
+        "table": "docman_document_versions",
+        "type": "text"
+      },
       {
         "column": "filename",
         "defaultExpression": null,
@@ -12008,6 +12046,6 @@
         "table": "workflow-step-runs"
       }
     ],
-    "fingerprintSha256": "aa7420f6d7a53f009a3d4a6280bc1660e043c9a5eeac02444b02c707f7361d01"
+    "fingerprintSha256": "167d61e2311d5d7d8e2bb192ec80daa38e8516440775bf56c21cbd1185348c48"
   }
 }

package/build/client/_app/immutable/entry/start.DBrQBcQx.js

@@ -1 +0,0 @@
-import{l as o,a as r}from"../chunks/DSpwhhgJ.js";export{o as load_css,r as start};