@assemblyline-agents/node 0.1.0

package/dist/index.js

@@ -0,0 +1,750 @@
+import { createServer } from "node:http";
+import { resolve } from "node:path";
+import { codexAgentHarness } from "@assemblyline-agents/codex";
+import { INTERNAL_ROUTE_PREFIX, LEGACY_INTERNAL_ROUTE_PREFIX, adapter, applyEnvAliases, mirrorEnvAliasesInPlace } from "@assemblyline-agents/core";
+import { OpenEveRuntime, RunCapacityError, loadRuntimeBundle, queryAgentRuns, retryAfterSeconds, validateEvalRunOptions } from "@assemblyline-agents/runtime";
+import { createBlobAdapter, createConnectionStores, createSandboxAdapter, createSelfImprovementStores, createStateAdapter, loadRunTimeline } from "./adapters.js";
+import { apiRunCreationEnabled, evalRunsEnabled, authorizeOrSend, logHttpRequest, numberBodyValue, numberQueryValue, rateLimitOrSend, stringBodyValue, validateRuntimeHttpSecurity } from "./auth.js";
+import { HttpRequestError, firstHeaderValue, maxRequestBodyBytes, normalizeHeaders, readBody, send, summarizeRun } from "./http-io.js";
+import { serveRunEventStream, serveStreamingRun } from "./run-stream-http.js";
+import { matchRoute, parseAgentControlRoute, parseRunResumeRoute, parseRunRoute } from "./route-match.js";
+import { resolveIngressRateLimit } from "./rate-limit.js";
+import { createNodeRuntimeHandle, installSignalHandlers } from "./lifecycle.js";
+import { DIRECT_CHANNEL, conversationBelongsToAgent, decodeConversationCursor, decodeMessageCursor, directAgentScope, directConversationPatch, directTurnFromBody, encodeConversationCursor, encodeMessageCursor, parseConversationHttpRoute } from "./direct-conversations-http.js";
+import { usageHttpResult, usageReconciliationHttpResult } from "./usage-http.js";
+export { resolveProvider } from "./provider-resolver.js";
+export { createMemoryRateLimiterStore, parseRateLimitSpec, resolveIngressRateLimit } from "./rate-limit.js";
+export { createNodeRuntimeHandle, installSignalHandlers } from "./lifecycle.js";
+export function nodeAdapter(options = {}) {
+    return {
+        ...adapter("node", options),
+        kind: "node",
+        capabilities: ["http-runtime", "hosted-container-runtime", "local-server"]
+    };
+}
+/** Install Node-hosted model harnesses without changing Pi's provider defaults. */
+export function withNodeModelHarnesses(options) {
+    return {
+        ...options,
+        modelHarnesses: {
+            "openai-codex": codexAgentHarness(),
+            ...(options.modelHarnesses ?? {})
+        }
+    };
+}
+export async function createProductionRuntimeOptions(options) {
+    const artifactRoot = resolve(options.artifactRoot);
+    const env = options.env ?? process.env;
+    const runtimeOptions = loadRuntimeBundle(artifactRoot);
+    runtimeOptions.devMode = options.devMode ?? false;
+    const state = await createStateAdapter(runtimeOptions, artifactRoot, env);
+    const blob = await createBlobAdapter(runtimeOptions, artifactRoot, env);
+    const connectionStores = createConnectionStores(runtimeOptions, artifactRoot, env, state, options.devMode ?? false);
+    const selfImprovementStores = createSelfImprovementStores(artifactRoot, env, state);
+    const sandbox = await createSandboxAdapter(runtimeOptions, artifactRoot, env);
+    const out = {
+        ...runtimeOptions,
+        state,
+        blob,
+        sandbox,
+        connectionGrantStore: connectionStores.grantStore,
+        connectionAuthorizationSessionStore: connectionStores.authorizationSessionStore,
+        skillStore: selfImprovementStores.skillStore,
+        scheduleStore: selfImprovementStores.scheduleStore,
+        connectionDefinitionStore: selfImprovementStores.connectionDefinitionStore,
+        env,
+        devMode: options.devMode ?? false
+    };
+    const callbackBaseUrl = env.OPENEVE_CONNECTION_CALLBACK_BASE_URL ?? env.OPENEVE_PUBLIC_URL;
+    if (callbackBaseUrl)
+        out.connectionCallbackBaseUrl = callbackBaseUrl;
+    // Production default: bound run concurrency unless the operator chose a limit.
+    if (!(options.devMode ?? false) && env.OPENEVE_MAX_CONCURRENT_RUNS === undefined) {
+        out.maxConcurrentRuns = 16;
+    }
+    return withNodeModelHarnesses(out);
+}
+export function createNodeRuntimeServer(options) {
+    const runtime = options.runtime ?? new OpenEveRuntime(withNodeModelHarnesses(options));
+    runtime.boot();
+    validateRuntimeHttpSecurity(runtime, options);
+    return createNodeRuntimeServerForRuntime(runtime, options);
+}
+function createNodeRuntimeServerForRuntime(runtime, options, drain = { draining: false }) {
+    const rateLimit = resolveIngressRateLimit(options.rateLimit, options.env ?? runtime.env ?? process.env);
+    return createServer(async (request, response) => {
+        const startedAt = Date.now();
+        let channel;
+        response.on("finish", () => {
+            logHttpRequest(runtime, request, response, startedAt, channel);
+        });
+        try {
+            if (!request.url) {
+                send(response, 400, { error: "Missing URL." });
+                return;
+            }
+            const url = new URL(request.url, "http://localhost");
+            // Rename compatibility: /assembly-line/* aliases the legacy /openeve/*
+            // internal route family. Normalizing before dispatch gives every branch
+            // identical auth/rate-limit behavior and one shared rate-limit bucket.
+            if (url.pathname === INTERNAL_ROUTE_PREFIX || url.pathname.startsWith(`${INTERNAL_ROUTE_PREFIX}/`)) {
+                url.pathname = LEGACY_INTERNAL_ROUTE_PREFIX + url.pathname.slice(INTERNAL_ROUTE_PREFIX.length);
+            }
+            if (request.method === "GET" && url.pathname === "/health") {
+                if (!await authorizeOrSend(request, response, runtime, options, "public-health", url.pathname))
+                    return;
+                send(response, 200, { ok: true, agentRevision: options.manifest.agentRevision });
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/healthz") {
+                if (!await authorizeOrSend(request, response, runtime, options, "public-health", url.pathname))
+                    return;
+                send(response, 200, {
+                    ok: true,
+                    agentRevision: options.manifest.agentRevision,
+                    capabilities: evalRunsEnabled(runtime, options) ? ["eval-runs"] : []
+                });
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/readyz") {
+                // Readiness (vs /health liveness): 503 while draining so load
+                // balancers stop routing new traffic during graceful shutdown.
+                if (!await authorizeOrSend(request, response, runtime, options, "public-health", url.pathname))
+                    return;
+                if (drain.draining) {
+                    send(response, 503, { ok: false, draining: true });
+                    return;
+                }
+                send(response, 200, { ok: true, agentRevision: options.manifest.agentRevision });
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/manifest") {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                send(response, 200, options.manifest);
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/routes") {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                send(response, 200, options.manifest.routeTable);
+                return;
+            }
+            const agentControlRoute = parseAgentControlRoute(url.pathname);
+            if (agentControlRoute && request.method === "GET" && agentControlRoute.kind === "control") {
+                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
+                    return;
+                send(response, 200, await runtime.getAgentControl());
+                return;
+            }
+            if (agentControlRoute && request.method === "POST" && agentControlRoute.kind !== "control") {
+                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "agent-control", url.pathname))
+                    return;
+                const requestId = firstHeaderValue(request.headers["x-request-id"] ?? request.headers["x-railway-request-id"]);
+                const metadata = {
+                    source: "http",
+                    path: url.pathname,
+                    ...(requestId ? { requestId } : {})
+                };
+                const result = agentControlRoute.kind === "quiesce" || agentControlRoute.kind === "resume"
+                    ? await runtime.setAgentMaintenance(agentControlRoute.kind === "quiesce", metadata)
+                    : await runtime.setAgentEnabled(agentControlRoute.kind === "enable", metadata);
+                send(response, 200, result);
+                return;
+            }
+            const conversationRoute = parseConversationHttpRoute(url.pathname);
+            if (conversationRoute?.kind === "collection" && request.method === "GET") {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                if (!runtime.state.listConversations) {
+                    send(response, 501, { error: "The configured state adapter does not support conversation listing." });
+                    return;
+                }
+                const cursorValue = url.searchParams.get("cursor");
+                const before = decodeConversationCursor(cursorValue);
+                if (cursorValue && !before) {
+                    send(response, 400, { error: "Invalid conversation cursor." });
+                    return;
+                }
+                const limitParam = Number(url.searchParams.get("limit"));
+                const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(Math.floor(limitParam), 100) : 40;
+                const archivedValue = url.searchParams.get("archived");
+                const archived = archivedValue === "true" ? true : archivedValue === "all" ? undefined : false;
+                const listed = await runtime.state.listConversations({
+                    agentScope: directAgentScope(options.manifest),
+                    channel: url.searchParams.get("channel") || DIRECT_CHANNEL,
+                    ...(url.searchParams.get("subject") ? { subject: url.searchParams.get("subject") } : {}),
+                    ...(archived !== undefined ? { archived } : {}),
+                    ...(before ? { before } : {}),
+                    limit: limit + 1
+                });
+                const hasMore = listed.length > limit;
+                const conversations = listed.slice(0, limit);
+                send(response, 200, {
+                    conversations,
+                    nextCursor: hasMore && conversations.length > 0
+                        ? encodeConversationCursor(conversations[conversations.length - 1])
+                        : null
+                });
+                return;
+            }
+            if (conversationRoute?.kind === "messages" && request.method === "GET") {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                const conversation = await runtime.state.getConversation(conversationRoute.conversationId);
+                if (!conversation || !conversationBelongsToAgent(conversation, directAgentScope(options.manifest))) {
+                    send(response, 404, { error: "Conversation not found." });
+                    return;
+                }
+                const cursorValue = url.searchParams.get("before");
+                const before = decodeMessageCursor(cursorValue);
+                if (cursorValue && !before) {
+                    send(response, 400, { error: "Invalid message cursor." });
+                    return;
+                }
+                const limitParam = Number(url.searchParams.get("limit"));
+                const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(Math.floor(limitParam), 100) : 50;
+                const listed = runtime.state.listMessages
+                    ? await runtime.state.listMessages({
+                        conversationId: conversation.id,
+                        ...(before ? { before } : {}),
+                        limit: limit + 1
+                    })
+                    : before
+                        ? []
+                        : await runtime.state.listRecentMessages(conversation.id, limit + 1);
+                if (before && !runtime.state.listMessages) {
+                    send(response, 501, { error: "The configured state adapter does not support message pagination." });
+                    return;
+                }
+                const hasMore = listed.length > limit;
+                const messages = hasMore ? listed.slice(1) : listed;
+                send(response, 200, {
+                    messages,
+                    nextCursor: hasMore && messages.length > 0 ? encodeMessageCursor(messages[0]) : null
+                });
+                return;
+            }
+            if (conversationRoute?.kind === "record" && request.method === "PATCH") {
+                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
+                    return;
+                if (!runtime.state.updateConversation) {
+                    send(response, 501, { error: "The configured state adapter does not support conversation updates." });
+                    return;
+                }
+                const existing = await runtime.state.getConversation(conversationRoute.conversationId);
+                if (!existing || !conversationBelongsToAgent(existing, directAgentScope(options.manifest))) {
+                    send(response, 404, { error: "Conversation not found." });
+                    return;
+                }
+                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                const patch = directConversationPatch(body);
+                if (Object.keys(patch).length === 0) {
+                    send(response, 400, { error: "Provide a title, archived flag, or metadata patch." });
+                    return;
+                }
+                send(response, 200, await runtime.state.updateConversation(existing.id, patch));
+                return;
+            }
+            if (conversationRoute?.kind === "turns" && request.method === "POST") {
+                channel = DIRECT_CHANNEL;
+                if (!apiRunCreationEnabled(runtime, options)) {
+                    send(response, 403, { error: "API run creation is disabled." });
+                    return;
+                }
+                if (!await authorizeOrSend(request, response, runtime, options, "run-create", url.pathname))
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname, DIRECT_CHANNEL))
+                    return;
+                const existing = await runtime.state.getConversation(conversationRoute.conversationId);
+                if (existing && !conversationBelongsToAgent(existing, directAgentScope(options.manifest))) {
+                    send(response, 404, { error: "Conversation not found." });
+                    return;
+                }
+                if (existing?.channel && existing.channel !== DIRECT_CHANNEL) {
+                    send(response, 409, { error: `Conversation belongs to channel ${existing.channel}.` });
+                    return;
+                }
+                if (existing?.archivedAt) {
+                    send(response, 409, { error: "Archived conversations cannot accept new turns." });
+                    return;
+                }
+                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                const idempotencyKey = firstHeaderValue(request.headers["idempotency-key"]);
+                const direct = directTurnFromBody({
+                    conversationId: conversationRoute.conversationId,
+                    body,
+                    ...(idempotencyKey ? { idempotencyKey } : {})
+                });
+                if (!direct.turn.message && !(direct.turn.attachments?.length)) {
+                    send(response, 400, { error: "A message or attachment is required." });
+                    return;
+                }
+                const runOptions = {
+                    message: direct.turn.message,
+                    channel: DIRECT_CHANNEL,
+                    approve: direct.approve,
+                    turn: direct.turn
+                };
+                if (direct.turn.model)
+                    Object.assign(runOptions, { model: direct.turn.model });
+                try {
+                    if (direct.stream) {
+                        await serveStreamingRun(runtime, response, (onRunCreated) => runtime.run({ ...runOptions, onRunCreated }), (result) => summarizeRun(result));
+                        return;
+                    }
+                    const result = await runtime.run(runOptions);
+                    send(response, 200, summarizeRun(result));
+                }
+                catch (error) {
+                    if (error instanceof RunCapacityError) {
+                        send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
+                            "retry-after": String(retryAfterSeconds(error.retryAfterMs))
+                        });
+                        return;
+                    }
+                    throw error;
+                }
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/runs") {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                // Light list: no per-run detail (avoids the 1+4N fan-out that hangs on
+                // busy agents). Bounded to the most recent runs; ?limit overrides.
+                const limitParam = Number(url.searchParams.get("limit"));
+                const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(limitParam, 1000) : 200;
+                send(response, 200, await queryAgentRuns(runtime.state, options.manifest, { includeDetails: false, limit }));
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/usage") {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                try {
+                    send(response, 200, await usageHttpResult(runtime.state, url));
+                }
+                catch (error) {
+                    send(response, 400, { error: error instanceof Error ? error.message : String(error) });
+                }
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/usage/reconcile") {
+                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
+                    return;
+                try {
+                    const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                    send(response, 200, await usageReconciliationHttpResult(runtime.state, runtime.env, body));
+                }
+                catch (error) {
+                    send(response, 400, { error: error instanceof Error ? error.message : String(error) });
+                }
+                return;
+            }
+            if ((request.method === "GET" || request.method === "POST")
+                && (url.pathname === "/openeve/automations/tick" || url.pathname === "/openeve/scheduler/tick")) {
+                if (!await authorizeOrSend(request, response, runtime, options, "scheduler", url.pathname))
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "scheduler", url.pathname))
+                    return;
+                const body = request.method === "POST" ? (await readBody(request, maxRequestBodyBytes(runtime, options))).body : {};
+                const nowValue = stringBodyValue(body.now) ?? url.searchParams.get("now") ?? undefined;
+                const lookbackValue = numberBodyValue(body.lookbackMs) ?? numberQueryValue(url.searchParams.get("lookbackMs"));
+                const tickOptions = {};
+                if (nowValue)
+                    tickOptions.now = new Date(nowValue);
+                if (lookbackValue !== undefined)
+                    tickOptions.lookbackMs = lookbackValue;
+                if (tickOptions.now && Number.isNaN(tickOptions.now.getTime())) {
+                    send(response, 400, { error: "Invalid scheduler now timestamp." });
+                    return;
+                }
+                const results = await runtime.runDueAutomations(tickOptions);
+                send(response, 200, { ok: true, results });
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/openeve/automations/events") {
+                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname))
+                    return;
+                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                const source = stringBodyValue(body.source);
+                const event = stringBodyValue(body.event);
+                const eventId = stringBodyValue(body.eventId);
+                const payload = body.payload;
+                if (!source || !event || !eventId || !payload || typeof payload !== "object" || Array.isArray(payload)) {
+                    send(response, 400, { error: "Automation events require source, event, eventId, and an object payload." });
+                    return;
+                }
+                const automationEvent = {
+                    source,
+                    event,
+                    eventId,
+                    payload: payload
+                };
+                const occurredAt = stringBodyValue(body.occurredAt);
+                const userId = stringBodyValue(body.userId);
+                const conversationId = stringBodyValue(body.conversationId);
+                const projectId = stringBodyValue(body.projectId);
+                if (occurredAt && Number.isNaN(new Date(occurredAt).getTime())) {
+                    send(response, 400, { error: "Automation event occurredAt must be a valid ISO timestamp." });
+                    return;
+                }
+                if (occurredAt)
+                    automationEvent.occurredAt = occurredAt;
+                if (userId)
+                    automationEvent.userId = userId;
+                if (conversationId)
+                    automationEvent.conversationId = conversationId;
+                if (projectId)
+                    automationEvent.projectId = projectId;
+                if (body.delivery && typeof body.delivery === "object" && !Array.isArray(body.delivery)) {
+                    automationEvent.delivery = body.delivery;
+                }
+                if (body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)) {
+                    automationEvent.metadata = body.metadata;
+                }
+                const results = await runtime.dispatchAutomationEvent(automationEvent);
+                send(response, 200, { ok: true, matched: results.length, results });
+                return;
+            }
+            if (request.method === "GET" && url.pathname.startsWith("/runs/")) {
+                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
+                    return;
+                const runRoute = parseRunRoute(url.pathname);
+                if (!runRoute) {
+                    send(response, 404, { error: "Not found." });
+                    return;
+                }
+                if (runRoute.kind === "stream") {
+                    if (!await runtime.state.getRun(runRoute.runId)) {
+                        send(response, 404, { error: `Run not found: ${runRoute.runId}` });
+                        return;
+                    }
+                    const lastEventId = firstHeaderValue(request.headers["last-event-id"]) ?? url.searchParams.get("lastEventId") ?? undefined;
+                    await serveRunEventStream(runtime, response, runRoute.runId, lastEventId);
+                    return;
+                }
+                const timeline = await loadRunTimeline(runtime, runRoute.runId);
+                if (!timeline) {
+                    send(response, 404, { error: `Run not found: ${runRoute.runId}` });
+                    return;
+                }
+                if (runRoute.kind === "events") {
+                    send(response, 200, { runId: runRoute.runId, events: timeline.events });
+                    return;
+                }
+                if (runRoute.kind === "timeline") {
+                    send(response, 200, timeline);
+                    return;
+                }
+                send(response, 200, timeline);
+                return;
+            }
+            if (request.method === "POST" && url.pathname.startsWith("/runs/")) {
+                const resumeRoute = parseRunResumeRoute(url.pathname);
+                if (resumeRoute) {
+                    const isHitlResume = resumeRoute.kind === "approve" || resumeRoute.kind === "answer";
+                    const routeClass = isHitlResume || resumeRoute.kind === "resume" ? "run-resume" : "run-control";
+                    if (!await authorizeOrSend(request, response, runtime, options, routeClass, url.pathname))
+                        return;
+                    if (!await rateLimitOrSend(request, response, rateLimit, routeClass, url.pathname))
+                        return;
+                    const run = await runtime.state.getRun(resumeRoute.runId);
+                    if (!run) {
+                        send(response, 404, { error: `Run not found: ${resumeRoute.runId}` });
+                        return;
+                    }
+                    const expected = resumeRoute.kind === "approve"
+                        ? "waiting_for_approval"
+                        : resumeRoute.kind === "answer"
+                            ? "waiting_for_input"
+                            : resumeRoute.kind === "suspend"
+                                ? "running"
+                                : resumeRoute.kind === "resume"
+                                    ? "suspended"
+                                    : undefined;
+                    if (expected && run.status !== expected) {
+                        send(response, 409, { error: `Run ${resumeRoute.runId} is not ${expected} (status: ${run.status}).` });
+                        return;
+                    }
+                    if (resumeRoute.kind === "cancel" && ["completed", "failed", "cancelled"].includes(run.status)) {
+                        send(response, 409, { error: `Run ${resumeRoute.runId} is already terminal (status: ${run.status}).` });
+                        return;
+                    }
+                    let answer = "";
+                    if (resumeRoute.kind === "answer") {
+                        const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                        answer = typeof body.answer === "string" ? body.answer : "";
+                        if (!answer) {
+                            send(response, 400, { error: "An 'answer' string is required to resume a waiting run." });
+                            return;
+                        }
+                    }
+                    try {
+                        if (resumeRoute.kind === "cancel" || resumeRoute.kind === "suspend") {
+                            const controlled = resumeRoute.kind === "cancel"
+                                ? await runtime.cancelRun(resumeRoute.runId)
+                                : await runtime.suspendRun(resumeRoute.runId);
+                            send(response, controlled.status === "running" ? 202 : 200, {
+                                runId: controlled.id,
+                                status: controlled.status,
+                                controlIntent: controlled.controlIntent ?? null
+                            });
+                            return;
+                        }
+                        const result = resumeRoute.kind === "approve"
+                            ? await runtime.resumeApproval(resumeRoute.runId)
+                            : resumeRoute.kind === "answer"
+                                ? await runtime.resumeInput(resumeRoute.runId, answer)
+                                : await runtime.resumeSuspended(resumeRoute.runId);
+                        send(response, 200, summarizeRun(result));
+                    }
+                    catch (error) {
+                        if (error instanceof RunCapacityError) {
+                            send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
+                                "retry-after": String(retryAfterSeconds(error.retryAfterMs))
+                            });
+                            return;
+                        }
+                        // The resume idempotency claim rejects a concurrent/replayed resume.
+                        const message = error instanceof Error ? error.message : String(error);
+                        if (/already in progress|not waiting|not suspended|not running|already terminal/i.test(message)) {
+                            send(response, 409, { error: message });
+                            return;
+                        }
+                        throw error;
+                    }
+                    return;
+                }
+                // Fall through: unknown POST /runs/... path.
+            }
+            if (request.method === "GET" && url.pathname === "/openeve/connections/authorize") {
+                // Authenticated JSON, not a public 302: the operator surface fetches
+                // the consent URL and opens the browser itself, so unauthenticated
+                // callers can neither trigger consent flows nor enumerate connection
+                // names. The provider's redirect lands on the public callback below.
+                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "agent-control", url.pathname))
+                    return;
+                const connectionName = url.searchParams.get("connection") ?? "";
+                if (!connectionName) {
+                    send(response, 400, { error: "A 'connection' query parameter is required." });
+                    return;
+                }
+                const session = {};
+                const sessionChannel = url.searchParams.get("channel");
+                const sessionUserId = url.searchParams.get("userId");
+                const sessionConversationId = url.searchParams.get("conversationId");
+                if (sessionChannel)
+                    session.channel = sessionChannel;
+                if (sessionUserId)
+                    session.userId = sessionUserId;
+                if (sessionConversationId)
+                    session.conversationId = sessionConversationId;
+                const result = await runtime.beginConnectionAuthorization(connectionName, session);
+                send(response, result.status === "unavailable" ? 409 : 200, result);
+                return;
+            }
+            if ((request.method === "GET" || request.method === "POST") && url.pathname === "/openeve/connections/callback") {
+                if (!await authorizeOrSend(request, response, runtime, options, "connection-callback", url.pathname))
+                    return;
+                const { rawBody, body } = request.method === "POST" ? await readBody(request, maxRequestBodyBytes(runtime, options)) : { rawBody: "", body: {} };
+                const params = Object.fromEntries(url.searchParams.entries());
+                if (Object.keys(body).length > 0) {
+                    for (const [key, value] of Object.entries(body)) {
+                        if (typeof value === "string")
+                            params[key] = value;
+                    }
+                }
+                const callbackInput = {
+                    params,
+                    method: request.method
+                };
+                if (rawBody)
+                    callbackInput.body = rawBody;
+                const result = await runtime.completeConnectionAuthorizationCallback(callbackInput);
+                send(response, result.status, result.body);
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/runs") {
+                if (!apiRunCreationEnabled(runtime, options)) {
+                    send(response, 403, { error: "API run creation is disabled." });
+                    return;
+                }
+                if (!await authorizeOrSend(request, response, runtime, options, "run-create", url.pathname))
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname))
+                    return;
+                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                const runOptions = {
+                    message: typeof body.message === "string" ? body.message : "",
+                    approve: body.approve === true,
+                    channel: typeof body.channel === "string" ? body.channel : "http"
+                };
+                if (typeof body.model === "string")
+                    Object.assign(runOptions, { model: body.model });
+                if (typeof body.toolName === "string")
+                    Object.assign(runOptions, { toolName: body.toolName });
+                if (body.input !== undefined)
+                    Object.assign(runOptions, { input: body.input });
+                if (body.eval !== undefined) {
+                    if (!evalRunsEnabled(runtime, options)) {
+                        send(response, 403, { error: "Eval run options are disabled. Set OPENEVE_ENABLE_EVAL_RUNS=true or allowEvalRuns." });
+                        return;
+                    }
+                    try {
+                        Object.assign(runOptions, { eval: validateEvalRunOptions(body.eval) });
+                    }
+                    catch (error) {
+                        send(response, 400, { error: error instanceof Error ? error.message : String(error) });
+                        return;
+                    }
+                }
+                try {
+                    if (body.stream === true) {
+                        await serveStreamingRun(runtime, response, (onRunCreated) => runtime.run({ ...runOptions, onRunCreated }), (result) => summarizeRun(result));
+                        return;
+                    }
+                    const result = await runtime.run(runOptions);
+                    send(response, 200, summarizeRun(result));
+                }
+                catch (error) {
+                    if (error instanceof RunCapacityError) {
+                        send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
+                            "retry-after": String(retryAfterSeconds(error.retryAfterMs))
+                        });
+                        return;
+                    }
+                    throw error;
+                }
+                return;
+            }
+            const requestMethod = request.method;
+            const routeMatch = requestMethod ? matchRoute(options.manifest.routeTable, requestMethod, url.pathname) : undefined;
+            if (routeMatch && requestMethod) {
+                channel = routeMatch.route.channel;
+                const authorization = await authorizeOrSend(request, response, runtime, options, "provider-channel", url.pathname, channel);
+                if (!authorization)
+                    return;
+                if (!await rateLimitOrSend(request, response, rateLimit, "provider-channel", url.pathname, channel))
+                    return;
+                const { rawBody, rawBodyBytes, body } = await readBody(request, maxRequestBodyBytes(runtime, options));
+                const result = await runtime.dispatchHttpChannel(routeMatch.route.channel, {
+                    method: requestMethod,
+                    url: request.url,
+                    path: url.pathname,
+                    params: routeMatch.params,
+                    headers: normalizeHeaders(request.headers),
+                    rawBody,
+                    rawBodyBytes,
+                    body,
+                    trusted: authorization.trusted === true
+                });
+                send(response, result.status, result.body, result.headers);
+                return;
+            }
+            send(response, 404, { error: "Not found." });
+        }
+        catch (error) {
+            if (error instanceof HttpRequestError) {
+                send(response, error.status, { error: error.message });
+                return;
+            }
+            // Log the real cause server-side but return a generic message: raw
+            // exception text (DB errors, file paths, driver internals) must not leak
+            // to callers.
+            runtime.logger.error("unhandled runtime http error", {
+                error: error instanceof Error ? error.message : String(error),
+                ...(error instanceof Error && error.stack ? { stack: error.stack } : {})
+            });
+            send(response, 500, { error: "Internal server error." });
+        }
+    });
+}
+export async function listenNodeRuntime(rawOptions) {
+    // Rename compatibility: make every branded env var readable under both its
+    // ASSEMBLY_LINE_* and OPENEVE_* spellings for all downstream readers.
+    const options = rawOptions.env
+        ? { ...rawOptions, env: applyEnvAliases(rawOptions.env).env }
+        : rawOptions;
+    if (!rawOptions.env)
+        mirrorEnvAliasesInPlace(process.env);
+    const runtime = new OpenEveRuntime(withNodeModelHarnesses(options));
+    runtime.boot();
+    validateRuntimeHttpSecurity(runtime, options);
+    const drain = { draining: false };
+    const server = createNodeRuntimeServerForRuntime(runtime, options, drain);
+    const port = options.port ?? 0;
+    const host = options.host ?? "127.0.0.1";
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => resolve());
+    });
+    const address = server.address();
+    const boundPort = typeof address === "object" && address ? address.port : port;
+    const scheduler = await runtime.startSchedulerLoop();
+    const stopScheduler = once(() => scheduler?.stop());
+    if (scheduler)
+        server.once("close", stopScheduler);
+    const env = options.env ?? runtime.env ?? process.env;
+    if (env.OPENEVE_RUN_RECOVERY !== "false" && env.OPENEVE_RUN_RECOVERY !== "0") {
+        // Repair runs orphaned by a previous process before accepting new traffic.
+        await runtime.recoverIncompleteRuns().catch((error) => {
+            runtime.logger.warn("boot run recovery failed", {
+                error: error instanceof Error ? error.message : String(error)
+            });
+        });
+    }
+    const ingress = await runtime.startChannelIngress();
+    const stopIngress = onceAsync(async () => {
+        await ingress?.stop();
+    });
+    if (ingress)
+        server.once("close", () => void stopIngress());
+    const workers = runtime.startBackgroundWorkers();
+    const stopWorkers = once(() => workers.stop());
+    server.once("close", stopWorkers);
+    const handleInput = {
+        server,
+        url: `http://${host}:${boundPort}`,
+        runtime,
+        drain,
+        env,
+        stopIngress,
+        stopScheduler,
+        stopWorkers
+    };
+    if (scheduler)
+        handleInput.scheduler = scheduler;
+    if (ingress)
+        handleInput.ingress = ingress;
+    const handle = createNodeRuntimeHandle(handleInput);
+    // Hosts like Railway send SIGTERM on every redeploy/restart. With no handler
+    // installed, Node terminates immediately and the graceful drain never runs, so
+    // in-flight runs are orphaned. Install the handlers by default (opt-out via
+    // option or OPENEVE_SIGNAL_HANDLERS) so redeploys drain instead of hard-kill.
+    if (options.installSignalHandlers !== false &&
+        env.OPENEVE_SIGNAL_HANDLERS !== "false" &&
+        env.OPENEVE_SIGNAL_HANDLERS !== "0") {
+        installSignalHandlers(handle);
+    }
+    return handle;
+}
+function once(fn) {
+    let done = false;
+    return () => {
+        if (done)
+            return;
+        done = true;
+        fn();
+    };
+}
+function onceAsync(fn) {
+    let pending;
+    return () => (pending ??= fn());
+}
+//# sourceMappingURL=index.js.map