@axiom-lattice/gateway 4.1.2 → 4.1.4

package/dist/index.mjs

@@ -8750,6 +8750,16 @@ function verifySignedConsoleSession(authHeader, secret) {
   }
 }
 var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
+function isStaleConsoleSessionCredential(authHeader) {
+  if (!authHeader?.startsWith("Bearer ")) return false;
+  const parts = authHeader.substring(7).split(".");
+  if (parts.length !== 2 || !/^[A-Za-z0-9_-]{43}$/.test(parts[1])) return false;
+  try {
+    return isConsoleSessionPayload(JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8")));
+  } catch {
+    return false;
+  }
+}
 function bypassesConsoleAuth(request) {
   const path4 = request.url.split("?")[0];
   const method = request.method;
@@ -8769,7 +8779,15 @@ function registerConsoleAuthHook(app2, options) {
     }
     if (bypassesConsoleAuth(request)) return;
     if (session) return;
-    if (!options.authRequired || request.method === "OPTIONS") return;
+    if (!options.authRequired || request.method === "OPTIONS") {
+      if (!PUBLIC_ROUTES.some((route) => request.url === route) && !request.url.startsWith("/s/") && isStaleConsoleSessionCredential(request.headers.authorization)) {
+        await reply.status(401).send({
+          success: false,
+          error: "Unauthorized - Session token is invalid or expired. Please sign in again."
+        });
+      }
+      return;
+    }
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
     const path4 = request.url.split("?")[0];
@@ -10948,14 +10966,6 @@ function header(request, name) {
   if (typeof value !== "string" || !value) throw new HttpTaskError(400, "INVALID_TASK_INPUT");
   return value;
 }
-function assertHeaderScope(request, projectId, workspaceId) {
-  const requestedProject = header(request, "x-project-id");
-  const requestedWorkspace = header(request, "x-workspace-id");
-  const canonicalProject = projectId && projectId !== "default" ? projectId : void 0;
-  if (requestedProject && requestedProject !== "default" && requestedProject !== canonicalProject || requestedWorkspace !== void 0 && requestedWorkspace !== workspaceId) {
-    throw new HttpTaskError(409, "PROJECT_TASK_SCOPE_CONFLICT");
-  }
-}
 function integer(value, minimum = 0) {
   if (value === void 0) return void 0;
   const parsed = typeof value === "number" ? value : typeof value === "string" && value ? Number(value) : NaN;
@@ -11210,27 +11220,50 @@ function createTaskController(deps) {
     }
     const metadata = query.metadata === void 0 ? void 0 : parseMetadata(query.metadata);
     if (!projectId || projectId === "default") {
-      assertHeaderScope(request);
-      const rows2 = await deps.tasks.list({
+      const requestedWorkspace = header(request, "x-workspace-id");
+      const status = typeof query.status === "string" ? query.status : void 0;
+      const priority = typeof query.priority === "string" ? query.priority : void 0;
+      const parentId = typeof query.parentId === "string" ? query.parentId : void 0;
+      const ownerType = query.ownerType === "user" || query.ownerType === "agent" ? query.ownerType : void 0;
+      const ownerId = typeof query.ownerId === "string" ? query.ownerId : void 0;
+      const effectiveLimit = limit ?? 50;
+      const effectiveOffset = offset ?? 0;
+      const perQueryLimit = effectiveLimit + effectiveOffset;
+      const queries = [{
         tenantId,
         ownerType: "user",
         ownerId: userId,
         projectId: null,
-        status: typeof query.status === "string" ? query.status : void 0,
-        priority: typeof query.priority === "string" ? query.priority : void 0,
-        parentId: typeof query.parentId === "string" ? query.parentId : void 0,
+        status,
+        priority,
+        parentId,
         metadata,
-        limit,
-        offset
-      });
+        limit: perQueryLimit,
+        offset: 0
+      }];
+      if (requestedWorkspace && deps.readableProjects) {
+        const readable = await deps.readableProjects({ tenantId, userId, workspaceId: requestedWorkspace });
+        for (const project2 of readable) {
+          queries.push({
+            tenantId,
+            workspaceId: project2.workspaceId,
+            projectId: project2.id,
+            status,
+            priority,
+            parentId,
+            metadata,
+            ownerType,
+            ownerId,
+            limit: perQueryLimit,
+            offset: 0
+          });
+        }
+      }
+      const merged = (await Promise.all(queries.map((q) => deps.tasks.list(q)))).flat().sort((left, right) => right.createdAt.getTime() - left.createdAt.getTime());
+      const rows2 = merged.slice(effectiveOffset, effectiveOffset + effectiveLimit);
       return { success: true, data: rows2, count: rows2.length };
     }
-    const requestedProject = header(request, "x-project-id");
-    if (requestedProject && requestedProject !== "default" && requestedProject !== projectId) {
-      throw new HttpTaskError(409, "PROJECT_TASK_SCOPE_CONFLICT");
-    }
     const { project } = await authorize(request, projectId, "read");
-    assertHeaderScope(request, project.id, project.workspaceId);
     const rows = await deps.tasks.list({
       tenantId,
       workspaceId: project.workspaceId,
@@ -11250,11 +11283,6 @@ function createTaskController(deps) {
     await preauthorizeExplicitProject(request, authorize);
     const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
-    try {
-      assertHeaderScope(request, current.projectId, current.workspaceId);
-    } catch {
-      throw notFound();
-    }
     await authorizeRead(request, current, authorize);
     return { success: true, data: current };
   });
@@ -11262,8 +11290,6 @@ function createTaskController(deps) {
     const body = snapshotCreate(request.body);
     const tenantId = getTenantId16(request);
     const userId = getUserId4(request);
-    const requestedProject = header(request, "x-project-id");
-    if (requestedProject && requestedProject !== "default" && requestedProject !== body.projectId) throw new HttpTaskError(409, "PROJECT_TASK_SCOPE_CONFLICT");
     const governed = governedCreate(body);
     if (governed) return reply.code(409).send({ success: false, code: governed });
     if (!body.projectId || body.projectId === "default") {
@@ -11273,11 +11299,8 @@ function createTaskController(deps) {
     }
     const capability2 = body.ownerType === "agent" ? "manage" : "send";
     const { project } = await authorize(request, body.projectId, capability2);
-    const requestedWorkspace = header(request, "x-workspace-id");
-    if (body.workspaceId !== void 0 && body.workspaceId !== project.workspaceId || requestedWorkspace !== void 0 && requestedWorkspace !== project.workspaceId) throw new HttpTaskError(409, "PROJECT_TASK_SCOPE_CONFLICT");
     return mutationMutex.runExclusive({ tenantId, projectId: project.id }, async () => {
       const lockedAccess = await authorize(request, project.id, capability2);
-      if (lockedAccess.project.workspaceId !== project.workspaceId) throw new HttpTaskError(409, "PROJECT_TASK_SCOPE_CONFLICT");
       const candidate = {
         id: body.id ?? "__new_task__",
         tenantId,
@@ -11295,13 +11318,8 @@ function createTaskController(deps) {
       let ownerType = "user";
       let ownerId = userId;
       if (body.ownerType === "agent") {
-        const target = await deps.bots.findByAssistant(tenantId, project.id, body.ownerId ?? "");
-        const room = await deps.rooms.getMainRoom(tenantId, project.id);
-        if (!target || !room || target.status !== "active" || target.workspaceId !== project.workspaceId || target.roomId !== room.id) {
-          return reply.code(409).send({ success: false, code: "PROJECT_TASK_OWNER_INACTIVE" });
-        }
         ownerType = "agent";
-        ownerId = target.assistantId;
+        ownerId = body.ownerId ?? "";
       }
       const created = await deps.tasks.create({
         ...body,
@@ -11325,11 +11343,6 @@ function createTaskController(deps) {
     await preauthorizeExplicitProject(request, authorize);
     const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
-    try {
-      assertHeaderScope(request, current.projectId, current.workspaceId);
-    } catch {
-      throw notFound();
-    }
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
       const governed = governedUpdate(locked, body);
@@ -11348,11 +11361,6 @@ function createTaskController(deps) {
     await preauthorizeExplicitProject(request, authorize);
     const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
-    try {
-      assertHeaderScope(request, current.projectId, current.workspaceId);
-    } catch {
-      throw notFound();
-    }
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
       if (locked.ownerType === "agent") return reply.code(403).send({ success: false, code: "AGENT_RUNTIME_REQUIRED" });
@@ -11367,11 +11375,6 @@ function createTaskController(deps) {
     await preauthorizeExplicitProject(request, authorize);
     const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
-    try {
-      assertHeaderScope(request, current.projectId, current.workspaceId);
-    } catch {
-      throw notFound();
-    }
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
       if (locked.ownerType === "agent") return reply.code(403).send({ success: false, code: "AGENT_RUNTIME_REQUIRED" });
@@ -11389,11 +11392,6 @@ function createTaskController(deps) {
     await preauthorizeExplicitProject(request, authorize);
     const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
-    try {
-      assertHeaderScope(request, current.projectId, current.workspaceId);
-    } catch {
-      throw notFound();
-    }
     await authorizeRead(request, current, authorize);
     const query = exactObject(request.query, ["action", "limit", "offset"]);
     const rows = await deps.workItems.list({
@@ -11411,8 +11409,6 @@ function createTaskController(deps) {
   const reassign = withErrors(async (request, reply) => {
     const body = snapshotReassign(request.body);
     const pathProject = request.params.projectId;
-    const requestedProject = header(request, "x-project-id");
-    if (requestedProject && requestedProject !== "default" && requestedProject !== pathProject) throw new HttpTaskError(409, "PROJECT_TASK_SCOPE_CONFLICT");
     const access = await authorize(request, pathProject, "manage");
     const snapshot = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!snapshot || snapshot.projectId !== access.project.id || snapshot.workspaceId !== access.project.workspaceId || snapshot.ownerType !== "agent") throw notFound();
@@ -15471,6 +15467,7 @@ import {
 } from "@axiom-lattice/core";
 var SYSTEM_ACTOR2 = "system";
 var TERMINAL_ACTIONS = ["completed", "failed", "interrupted", "cancelled"];
+var MAX_LEARNING_ROUND_ANCESTORS = 8;
 var ProjectTaskObserver = class {
   /** @param deps Durable stores and Project Task runtime services. @param options Positive bounded scan limits. */
   constructor(deps, options) {
@@ -15628,6 +15625,7 @@ var ProjectTaskObserver = class {
     signal ?? (signal = this.deps.signal);
     if (signal?.aborted || this.disposed) return;
     if (!isProjectLifecycleTask4(task) || task.ownerType !== "agent") return;
+    if (await this.belongsToLearningRound(task)) return;
     if (task.status === "pending") {
       if (await this.isReady(task) && !signal?.aborted && !this.disposed) await this.runStart(task, signal);
       return;
@@ -15640,6 +15638,22 @@ var ProjectTaskObserver = class {
       await this.resumeIfReady(task, signal);
     }
   }
+  // SCOPE-COMPAT: learning rounds (metadata.trainingRound) and their subtrees execute in the
+  // architect's builder thread (canvas CopilotPanel), not the Project Room runtime. Exempting
+  // them here keeps admission hints, startup reconciliation, and dependent re-evaluation from
+  // claiming these tasks — no roster warnings, no restart noise, and no double execution if
+  // the architect later joins the room roster.
+  async belongsToLearningRound(task) {
+    let current = task;
+    for (let depth = 0; current && depth < MAX_LEARNING_ROUND_ANCESTORS; depth += 1) {
+      if (current.metadata?.trainingRound === true) return true;
+      if (!current.parentId) return false;
+      const parent = snapshotTaskItem(await this.deps.tasks.getById(current.tenantId, current.parentId));
+      if (!parent || parent.id !== current.parentId || parent.tenantId !== current.tenantId) return false;
+      current = parent;
+    }
+    return false;
+  }
   /** Collects every bounded dependent ID before re-reading or scheduling any dependent. */
   async reevaluateDependents(task) {
     const { ids } = await this.collectDependentIds(task);
@@ -15745,6 +15759,7 @@ var ProjectTaskObserver = class {
   }
   async wakeParent(child) {
     if (!child.parentId) return;
+    if (await this.belongsToLearningRound(child)) return;
     const parent = snapshotTaskItem(await this.deps.tasks.getById(child.tenantId, child.parentId));
     if (!parent || parent.id !== child.parentId || child.parentId !== parent.id || parent.ownerType !== "agent" || parent.workspaceId !== child.workspaceId || parent.projectId !== child.projectId || parent.status !== "interrupted" || !parent.dependencies?.includes(child.id)) return;
     const interruption = parseExternalDependency2(parent.context?.interruption);
@@ -16212,7 +16227,7 @@ var RoomProjectionService = class {
    * @returns Counts for inspected rows, projections, warnings, and bound truncation.
    */
   async repairProject(input) {
-    const result = { inspected: 0, projected: 0, warnings: 0, truncated: false };
+    const result = { inspected: 0, projected: 0, warnings: 0, skipped: 0, truncated: false };
     let before;
     for (let page = 0; page < input.maxPages; page += 1) {
       const rows = await this.deps.events.listProjectLifecycleEvents({
@@ -16238,10 +16253,15 @@ var RoomProjectionService = class {
           if (safeIdentity) await this.warning("INVALID_PROJECTABLE_EVENT", safeIdentity, input);
           continue;
         }
+        let stored;
+        try {
+          stored = await this.deps.tasks.getById(input.tenantId, row.taskId);
+        } catch {
+          stored = void 0;
+        }
         let task;
         try {
-          const stored = await this.deps.tasks.getById(input.tenantId, row.taskId);
-          task = stored === null ? void 0 : snapshotProjectTask(stored);
+          task = stored === null || stored === void 0 ? void 0 : snapshotTaskItem(stored);
         } catch {
           task = void 0;
         }
@@ -16250,6 +16270,10 @@ var RoomProjectionService = class {
           await this.warning("INVALID_PROJECTABLE_EVENT", { taskId: row.taskId, eventKey: row.eventKey }, input);
           continue;
         }
+        if (task.ownerType !== "agent" || !isProjectLifecycleTask5(task)) {
+          result.skipped += 1;
+          continue;
+        }
         const projected = await this.project({ task, room: input.room, workItem: row });
         if (projected.kind === "projected") result.projected += 1;
         else result.warnings += 1;
@@ -18052,6 +18076,18 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     projectMutationMutex: projectMutationMutex2,
     executionMutex: projectTaskComposition?.mutex ?? {
       runExclusive: (_scope, operation) => operation()
+    },
+    readableProjects: async ({ tenantId, userId, workspaceId }) => {
+      const projects = await projectStore.getProjectsByWorkspace(tenantId, workspaceId);
+      const readable = [];
+      for (const project of projects) {
+        try {
+          await accessService.requireExistingProjectAccess({ tenantId, userId, projectId: project.id, capability: "read" });
+          readable.push({ id: project.id, workspaceId: project.workspaceId });
+        } catch {
+        }
+      }
+      return readable;
     }
   }));
   app2.get(