@axiom-lattice/gateway 2.1.116 → 3.0.0

package/src/controllers/local-a2a.ts

@@ -0,0 +1,149 @@
+import { FastifyReply, FastifyRequest } from "fastify";
+import { getStoreLattice } from "@axiom-lattice/core";
+import { localA2AService } from "../services/local-a2a";
+import {
+  AgentType,
+  type Assistant,
+  type A2ARemoteAgentConfig,
+} from "@axiom-lattice/protocols";
+
+function getTenantId(request: FastifyRequest): string {
+  const userTenantId = (request as any).user?.tenantId;
+  if (userTenantId) return userTenantId;
+  return (request.headers["x-tenant-id"] as string) || "default";
+}
+
+function getLocalRuntime(assistant: Assistant): A2ARemoteAgentConfig["localRuntime"] | undefined {
+  const graphDefinition = assistant.graphDefinition;
+  if (!graphDefinition || typeof graphDefinition !== "object") return undefined;
+  if ((graphDefinition as { type?: unknown }).type !== AgentType.A2A_REMOTE) return undefined;
+  return (graphDefinition as A2ARemoteAgentConfig).localRuntime;
+}
+
+async function getLocalA2AAssistants(
+  tenantId: string,
+): Promise<Array<{ assistant: Assistant; localRuntime: NonNullable<A2ARemoteAgentConfig["localRuntime"]> }>> {
+  const storeLattice = getStoreLattice("default", "assistant");
+  const assistants = await storeLattice.store.getAllAssistants(tenantId);
+  const results: Array<{
+    assistant: Assistant;
+    localRuntime: NonNullable<A2ARemoteAgentConfig["localRuntime"]>;
+  }> = [];
+
+  for (const assistant of assistants) {
+    const runtime = getLocalRuntime(assistant);
+    if (runtime) {
+      results.push({ assistant, localRuntime: runtime });
+    }
+  }
+
+  return results;
+}
+
+async function getLocalA2AAssistant(
+  tenantId: string,
+  assistantId: string,
+): Promise<{
+  assistant: Assistant;
+  localRuntime: NonNullable<A2ARemoteAgentConfig["localRuntime"]>;
+} | null> {
+  const storeLattice = getStoreLattice("default", "assistant");
+  const assistant = await storeLattice.store.getAssistantById(tenantId, assistantId);
+  if (!assistant) return null;
+
+  const runtime = getLocalRuntime(assistant);
+  if (!runtime) return null;
+
+  return { assistant, localRuntime: runtime };
+}
+
+async function requireManagedAssistant(
+  request: FastifyRequest<{ Params: { assistantId: string } }>,
+  reply: FastifyReply,
+): Promise<{
+  assistantId: string;
+  localRuntime: NonNullable<A2ARemoteAgentConfig["localRuntime"]>;
+} | null> {
+  const assistantId = request.params.assistantId;
+  if (!assistantId) {
+    reply.status(400).send({ success: false, error: "assistantId is required" });
+    return null;
+  }
+
+  const registered = await getLocalA2AAssistant(getTenantId(request), assistantId);
+  if (!registered) {
+    reply.status(404).send({
+      success: false,
+      error: `Assistant ${assistantId} is not a local managed A2A assistant`,
+    });
+    return null;
+  }
+
+  return { assistantId, localRuntime: registered.localRuntime };
+}
+
+export async function getLocalA2AStatus(
+  request: FastifyRequest,
+  reply: FastifyReply,
+): Promise<void> {
+  const tenantId = getTenantId(request);
+  const managed = await getLocalA2AAssistants(tenantId);
+  const states = await Promise.all(
+    managed.map(({ assistant, localRuntime }) =>
+      localA2AService.getRegisteredState(assistant.id, localRuntime),
+    ),
+  );
+  reply.send({ success: true, data: { records: states, total: states.length } });
+}
+
+export async function getLocalA2AProvider(
+  request: FastifyRequest<{ Params: { assistantId: string } }>,
+  reply: FastifyReply,
+): Promise<void> {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+  const state = await localA2AService.getRegisteredState(
+    registered.assistantId,
+    registered.localRuntime,
+  );
+  reply.send({ success: true, data: state });
+}
+
+export async function startLocalA2AProvider(
+  request: FastifyRequest<{ Params: { assistantId: string } }>,
+  reply: FastifyReply,
+): Promise<void> {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+
+  const state = await localA2AService.startProvider(
+    registered.assistantId,
+    registered.localRuntime,
+  );
+  reply.send({ success: true, data: state });
+}
+
+export async function stopLocalA2AProvider(
+  request: FastifyRequest<{ Params: { assistantId: string } }>,
+  reply: FastifyReply,
+): Promise<void> {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+
+  const state = await localA2AService.stopProvider(registered.assistantId);
+  reply.send({ success: true, data: state });
+}
+
+export async function restartLocalA2AProvider(
+  request: FastifyRequest<{ Params: { assistantId: string } }>,
+  reply: FastifyReply,
+): Promise<void> {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+
+  const state = await localA2AService.restartProvider(
+    registered.assistantId,
+    registered.localRuntime,
+  );
+  reply.send({ success: true, data: state });
+}

package/src/controllers/tasks.ts

@@ -25,16 +25,15 @@ export async function listTasks(
 ): Promise<{ success: boolean; data?: TaskItem[]; count?: number; error?: string }> {
   try {
     const tenantId = getTenantId(request);
-    const userId = getUserId(request);
     const query = request.query as Record<string, string>;
 
     const store = getStore();
     const tasks = await store.list({
       tenantId,
-      ownerId: query.ownerId || userId,
       status: query.status,
       priority: query.priority,
-      ownerType: query.ownerType as 'user' | 'agent' | undefined,
+      ...(query.ownerId && { ownerId: query.ownerId }),
+      ...(query.ownerType && { ownerType: query.ownerType as 'user' | 'agent' }),
       metadata: query.metadata ? JSON.parse(query.metadata) : undefined,
       projectId: query.projectId,
       limit: query.limit ? parseInt(query.limit) : undefined,

package/src/controllers/workspace.ts

@@ -8,11 +8,18 @@
 import { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
 import * as fs from "fs/promises";
 import * as path from "path";
+import { constants as fsConstants } from "fs";
+import * as os from "os";
 import { getStoreLattice } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager } from "@axiom-lattice/core";
 import { v4 as uuidv4 } from "uuid";
 import { getContentTypeFromFilename, getFilenameFromPath } from "../utils/mime";
+import {
+  isPathWithinRoot,
+  PathOutsideRootError,
+  resolvePathWithinRoot,
+} from "../utils/path-containment";
 import type {
   CreateWorkspaceRequest,
   UpdateWorkspaceRequest,
@@ -291,15 +298,30 @@ export class WorkspaceController {
           sandboxInstance: sandbox,
         }), workspace
       };
-    } else {
-      console.log(`[getBackend] using FilesystemBackend rootDir=/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`);
-      return {
-        backend: new FilesystemBackend({
-          rootDir: `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`,
-          virtualMode: true,
-        }), workspace
-      };
     }
+
+    // Filesystem storage: use default /lattice_store path
+    const rootDir = await this.getFilesystemRootDirectory(
+      tenantId,
+      workspaceId,
+      projectId,
+    );
+
+    console.log(`[getBackend] using FilesystemBackend rootDir=${rootDir}`);
+    return {
+      backend: new FilesystemBackend({
+        rootDir,
+        virtualMode: true,
+      }), workspace
+    };
+  }
+
+  private async getFilesystemRootDirectory(
+    tenantId: string,
+    workspaceId: string,
+    projectId: string,
+  ): Promise<string> {
+    return `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;
   }
 
   private isBinaryContentType(filename: string): boolean {
@@ -572,7 +594,7 @@ export class WorkspaceController {
    * - `path`: optional directory path relative to project root (e.g., "docs", "src/utils")
    * - `assistantId`: optional query parameter for sandbox identity matching
    * For sandbox storage, delegates to the sandbox upload API.
-   * For filesystem storage, writes directly under /lattice_store/workspaces/{workspaceId}/{projectId}.
+   * For filesystem storage, writes under the same project root used by the file backend.
    */
   async uploadFile(
     request: FastifyRequest<{
@@ -661,16 +683,46 @@ export class WorkspaceController {
         return reply.status(200).send({ success: true, data: result });
       }
 
-      // Filesystem storage: write under /lattice_store/tenants/{tenantId}/workspaces/{workspaceId}/{projectId} and expose as virtual path "/<filename>"
-      const rootDir = `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;
-      const targetDir = pathValue ? path.join(rootDir, pathValue) : rootDir;
-      const targetPath = path.join(targetDir, filename);
-      await fs.mkdir(path.dirname(targetPath), { recursive: true });
+      const rootDir = await this.getFilesystemRootDirectory(
+        tenantId,
+        workspaceId,
+        projectId,
+      );
+      await fs.mkdir(rootDir, { recursive: true });
+      const relativeDirectory = pathValue?.replace(/^[/\\]+/, "") || ".";
+      const targetDir = path.resolve(rootDir, relativeDirectory);
+      if (!isPathWithinRoot(path.resolve(rootDir), targetDir)) {
+        return reply.status(400).send({
+          success: false,
+          error: "Upload path must stay within the project directory",
+        });
+      }
+      await fs.mkdir(targetDir, { recursive: true });
+
+      const [resolvedRoot, resolvedTargetDir] = await Promise.all([
+        fs.realpath(rootDir),
+        fs.realpath(targetDir),
+      ]);
+      if (!isPathWithinRoot(resolvedRoot, resolvedTargetDir)) {
+        return reply.status(400).send({
+          success: false,
+          error: "Upload path must stay within the project directory",
+        });
+      }
+
+      const safeFilename = path.basename(filename);
+      if (safeFilename !== filename) {
+        return reply.status(400).send({
+          success: false,
+          error: "Invalid filename",
+        });
+      }
+      const targetPath = path.join(resolvedTargetDir, safeFilename);
       await fs.writeFile(targetPath, buffer);
       const stat = await fs.stat(targetPath);
 
       const result = {
-        path: pathValue ? `/${pathValue}/${filename}` : `/${filename}`,
+        path: path.posix.join("/", relativeDirectory, safeFilename),
         name: filename,
         is_dir: false,
         size: stat.size,
@@ -678,10 +730,79 @@ export class WorkspaceController {
       };
 
       return reply.status(200).send({ success: true, data: result });
-    } catch (error: any) {
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
       return reply.status(500).send({
         success: false,
-        error: `Upload handler error: ${error?.message || String(error)}`,
+        error: `Upload handler error: ${message}`,
+      });
+    }
+  }
+  /**
+   * Browse local filesystem directories for the folder picker.
+   *
+   * Security constraints:
+   * - Restricted to os.homedir()
+   * - Blacklists system directories
+   * - Returns only directory names, no file contents or hidden files
+   */
+  async browseFilesystem(
+    request: FastifyRequest<{
+      Querystring: { path?: string };
+    }>,
+    reply: FastifyReply
+  ) {
+    const homeDir = os.homedir();
+    const requestedPath = request.query.path || homeDir;
+
+    const SYSTEM_BLACKLIST = ["/etc", "/sys", "/proc", "/var", "/tmp", "/dev"];
+
+    try {
+      const resolved = await resolvePathWithinRoot(homeDir, requestedPath);
+      const normalized = resolved.targetPath;
+
+      for (const blacklisted of SYSTEM_BLACKLIST) {
+        if (isPathWithinRoot(blacklisted, normalized)) {
+          return reply.status(403).send({
+            success: false,
+            error: `Cannot browse system directory: ${blacklisted}`,
+          });
+        }
+      }
+
+      const entries = await fs.readdir(normalized, { withFileTypes: true });
+      const dirEntries = entries
+        .filter((entry) => !entry.name.startsWith(".") && entry.isDirectory())
+        .map((entry) => ({
+          name: entry.name,
+          path: path.join(normalized, entry.name),
+          isDirectory: true,
+        }));
+
+      const parentPath = path.dirname(normalized);
+      const hasParent =
+        parentPath !== normalized &&
+        isPathWithinRoot(resolved.rootPath, parentPath);
+
+      return {
+        success: true,
+        data: {
+          path: normalized,
+          parentPath: hasParent ? parentPath : undefined,
+          entries: dirEntries,
+        },
+      };
+    } catch (error: unknown) {
+      if (error instanceof PathOutsideRootError) {
+        return reply.status(403).send({
+          success: false,
+          error: "Browse restricted to home directory",
+        });
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      return reply.status(400).send({
+        success: false,
+        error: `Cannot read directory: ${message}`,
       });
     }
   }
@@ -749,4 +870,10 @@ export function registerWorkspaceRoutes(app: FastifyInstance) {
     "/api/workspaces/:workspaceId/projects/:projectId/viewfile",
     controller.viewFile.bind(controller)
   );
+
+  // Filesystem browsing for folder picker
+  app.get(
+    "/api/filesystem/browse",
+    controller.browseFilesystem.bind(controller)
+  );
 }

package/src/index.ts

@@ -1,3 +1,4 @@
+import "dotenv/config";
 import fastify from "fastify";
 import cors from "@fastify/cors";
 import multipart from "@fastify/multipart";
@@ -42,8 +43,6 @@ import {
   PinoFileOptions,
   McpServerConfigStore,
 } from "@axiom-lattice/protocols";
-
-
 process.on("unhandledRejection", (reason, promise) => {
   console.error("未处理的Promise拒绝:", reason);
   // 可以在这里进行日志记录或其他处理
@@ -112,7 +111,7 @@ const getHeaderValue = (
 };
 
 // Routes that don't require authentication even when AUTH_REQUIRED=true
-const PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health"];
+const PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
 
 // Global auth preHandler: extract user from Authorization header
 // When AUTH_REQUIRED=true, reject unauthenticated requests (except public routes)
@@ -455,13 +454,6 @@ const start = async (config?: LatticeGatewayConfig) => {
     await app.listen({ port: target_port, host: "0.0.0.0" });
     logger.info(`Lattice Gateway is running on port: ${target_port}`);
 
-    // Initialize AgentLifecycleManager
-    try {
-      logger.info("AgentLifecycleManager initialized");
-    } catch (error) {
-      logger.warn("Failed to initialize AgentLifecycleManager", { error });
-    }
-
     // Configure queue service
     const queueServiceConfig = config?.queueServiceConfig;
     if (queueServiceConfig) {

package/src/routes/__tests__/a2a-test-connection.test.ts

@@ -0,0 +1,177 @@
+import fastify, { FastifyInstance } from "fastify";
+import type { LocalRuntimeConfig } from "@axiom-lattice/protocols";
+import { registerA2ATestConnectionRoute } from "../a2a-test-connection";
+
+const mockStartProvider = jest.fn();
+const mockRemoveState = jest.fn();
+
+jest.mock("../../services/local-a2a", () => ({
+  localA2AService: {
+    startProvider: (...args: unknown[]) => mockStartProvider(...args),
+    removeState: (...args: unknown[]) => mockRemoveState(...args),
+  },
+}));
+
+describe("A2A test connection route", () => {
+  let app: FastifyInstance;
+  const originalFetch = global.fetch;
+  const mockFetch = jest.fn<(...args: Parameters<typeof fetch>) => ReturnType<typeof fetch>>();
+
+  const localRuntime: LocalRuntimeConfig = {
+    label: "Local Test",
+    agentCardUrl: "http://old-host/.well-known/agent-card.json",
+    command: {
+      executable: "local-a2a",
+      args: ["--port", "4301"],
+    },
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    global.fetch = mockFetch as unknown as typeof fetch;
+    app = fastify();
+    registerA2ATestConnectionRoute(app);
+  });
+
+  afterEach(async () => {
+    await app.close();
+    global.fetch = originalFetch;
+  });
+
+  it("starts a temporary local runtime before fetching the local agent card", async () => {
+    mockStartProvider.mockResolvedValueOnce({
+      runtimeId: "test-runtime",
+      label: "Local Test",
+      status: "running",
+      enabled: true,
+    });
+    mockFetch.mockResolvedValueOnce(
+      new Response(JSON.stringify({ name: "Local Agent" }), { status: 200 }),
+    );
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/a2a/test-connection",
+      payload: {
+        agentCardUrl: "localhost:4301",
+        localRuntime,
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    const body = JSON.parse(response.body);
+    expect(body.data.reachable).toBe(true);
+    expect(body.data.agentName).toBe("Local Agent");
+
+    expect(mockStartProvider).toHaveBeenCalledTimes(1);
+    const [runtimeId, startedRuntime] = mockStartProvider.mock.calls[0] as [
+      string,
+      LocalRuntimeConfig,
+    ];
+    expect(runtimeId).toMatch(/^test-/);
+    expect(startedRuntime.agentCardUrl).toBe(
+      "http://localhost:4301/.well-known/agent-card.json",
+    );
+
+    expect(mockFetch).toHaveBeenCalledWith(
+      "http://localhost:4301/.well-known/agent-card.json",
+      expect.objectContaining({ headers: {} }),
+    );
+    expect(mockRemoveState).toHaveBeenCalledWith("test-runtime");
+  });
+
+  it("uses https by default for remote URL tests and does not start a local runtime", async () => {
+    mockFetch.mockResolvedValueOnce(
+      new Response(JSON.stringify({ name: "Remote Agent" }), { status: 200 }),
+    );
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/a2a/test-connection",
+      payload: {
+        agentCardUrl: "example.com/a2a",
+        apiKey: "secret",
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    const body = JSON.parse(response.body);
+    expect(body.data.reachable).toBe(true);
+    expect(body.data.agentName).toBe("Remote Agent");
+    expect(mockStartProvider).not.toHaveBeenCalled();
+    expect(mockRemoveState).not.toHaveBeenCalled();
+    expect(mockFetch).toHaveBeenCalledWith(
+      "https://example.com/a2a/.well-known/agent-card.json",
+      expect.objectContaining({
+        headers: { Authorization: "Bearer secret" },
+      }),
+    );
+  });
+
+  it("does not fetch the agent card when the local runtime fails to start", async () => {
+    mockStartProvider.mockResolvedValueOnce({
+      runtimeId: "test-failed",
+      label: "Local Test",
+      status: "failed",
+      enabled: true,
+      message: "Server did not become ready",
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/a2a/test-connection",
+      payload: {
+        agentCardUrl: "localhost:4301",
+        localRuntime,
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    const body = JSON.parse(response.body);
+    expect(body.data.reachable).toBe(false);
+    expect(body.data.error).toContain("Server did not become ready");
+    expect(mockFetch).not.toHaveBeenCalled();
+    expect(mockRemoveState).toHaveBeenCalledWith("test-failed");
+  });
+
+  it.each([
+    ["--port with next arg", ["--port", "4302"]],
+    ["--port inline", ["--port=4302"]],
+    ["-p with next arg", ["-p", "4302"]],
+    ["-p inline", ["-p=4302"]],
+  ])("does not start local runtime when %s mismatches the agent card URL port", async (_label, args) => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/a2a/test-connection",
+      payload: {
+        agentCardUrl: "http://localhost:4301/.well-known/agent-card.json",
+        localRuntime: {
+          ...localRuntime,
+          command: {
+            executable: "local-a2a",
+            args,
+          },
+        },
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    const body = JSON.parse(response.body);
+    expect(body.data.reachable).toBe(false);
+    expect(body.data.error).toContain("command port (4302) does not match agentCardUrl port (4301)");
+    expect(mockStartProvider).not.toHaveBeenCalled();
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 when agentCardUrl is missing", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/a2a/test-connection",
+      payload: {},
+    });
+
+    expect(response.statusCode).toBe(400);
+    expect(JSON.parse(response.body).error).toBe("agentCardUrl is required");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+});