@bpmnkit/proxy 0.0.17 → 0.0.21

package/README.md

@@ -6,6 +6,8 @@
   [![npm](https://img.shields.io/npm/v/@bpmnkit/proxy?style=flat-square&color=6244d7)](https://www.npmjs.com/package/@bpmnkit/proxy)
   [![license](https://img.shields.io/npm/l/@bpmnkit/proxy?style=flat-square)](https://github.com/bpmnkit/monorepo/blob/main/LICENSE)
   [![typescript](https://img.shields.io/badge/TypeScript-strict-6244d7?style=flat-square&logo=typescript&logoColor=white)](https://github.com/bpmnkit/monorepo)
+  [![ai-assisted](https://img.shields.io/badge/AI--assisted-claude-8b5cf6?style=flat-square)](https://github.com/bpmnkit/monorepo)
+  [![experimental](https://img.shields.io/badge/status-experimental-f59e0b?style=flat-square)](https://github.com/bpmnkit/monorepo)
 
   [Website](https://bpmnkit.com) · [Documentation](https://docs.bpmnkit.com) · [GitHub](https://github.com/bpmnkit/monorepo) · [Changelog](https://github.com/bpmnkit/monorepo/blob/main/apps/proxy/CHANGELOG.md)
 </div>

package/dist/adapters/copilot.js

@@ -16,7 +16,7 @@ export async function stream(messages, systemPrompt, mcpConfigFile, onToken) {
     const prompt = `${systemPrompt}\n\nUser: ${lastUser?.content ?? "help"}`;
     const args = ["-p", prompt, "--yolo"];
     if (mcpConfigFile) {
-        args.push("--additional-mcp-config", mcpConfigFile);
+        args.push("--additional-mcp-config", `@${mcpConfigFile}`);
         args.push("--allow-all-tools");
     }
     console.log(`[copilot] spawning with MCP: ${mcpConfigFile !== null}`);

package/dist/adapters/gemini.js

@@ -15,7 +15,7 @@ export async function available() {
 export async function stream(messages, systemPrompt, _mcpConfigFile, onToken) {
     const lastUser = [...messages].reverse().find((m) => m.role === "user");
     const prompt = `${systemPrompt}\n\nUser: ${lastUser?.content ?? "help"}`;
-    const args = ["--prompt", prompt, "--yolo"];
+    const args = ["--prompt", prompt];
     console.log("[gemini] spawning (no MCP support — using system prompt fallback)");
     await new Promise((resolve, reject) => {
         const proc = spawn("gemini", args, {

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import http from "node:http";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, extname, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Bpmn, applyOperations, compactify, expand, optimize } from "@bpmnkit/core";
 import { createClientFromProfile } from "@bpmnkit/profiles";
@@ -11,6 +11,10 @@ import * as claude from "./adapters/claude.js";
 import * as copilot from "./adapters/copilot.js";
 import * as gemini from "./adapters/gemini.js";
 import { buildImproveSystemPrompt, buildImproveUserMessage, buildIncidentSystemPrompt, buildIncidentUserMessage, buildMcpExplainPrompt, buildMcpImprovePrompt, buildMcpSystemPrompt, buildOperateChatSystemPrompt, buildSearchSystemPrompt, buildSystemPrompt, } from "./prompt.js";
+import { handleDeleteRunHistory, handleGetRunHistory, handleGetRunHistoryDetail, handleRerunHistory, matchRerunHistoryRoute, matchRunHistoryRoute, } from "./routes/run-history.js";
+import { handleWebhook, matchWebhookRoute, startTriggers } from "./triggers/index.js";
+import { WORKER_TEMPLATES } from "./worker-templates.js";
+import { startWorkerDaemon, workerState } from "./worker.js";
 const PORT = process.env.AI_SERVER_PORT ? Number(process.env.AI_SERVER_PORT) : 3033;
 // Resolve the compiled mcp-server entry point relative to this file.
 // When bundled as bundle.cjs, import.meta.url ends with .cjs → use mcp-server.cjs.
@@ -80,9 +84,114 @@ function extractOperations(text) {
     }
     return null;
 }
+// ── File System helpers ───────────────────────────────────────────────────────
+const SUPPORTED_EXTS = new Set([".bpmn", ".dmn", ".form", ".md"]);
+/** Expand a leading `~` to the user's home directory. */
+function expandHome(p) {
+    if (p === "~" || p.startsWith("~/"))
+        return homedir() + p.slice(1);
+    return p;
+}
+/** Reject any path that escapes the root via `..` or is outside it. */
+function fsValidate(root, target) {
+    const normRoot = root.endsWith(sep) ? root : root + sep;
+    const normTarget = target + (statSync(target, { throwIfNoEntry: false })?.isDirectory() ? sep : "");
+    return (!target.includes("..") &&
+        (target === root || target.startsWith(normRoot) || normTarget.startsWith(normRoot)));
+}
+function sidecarPath(filePath) {
+    return join(dirname(filePath), ".bpmnkit", `${basename(filePath)}.meta.json`);
+}
+function readMeta(filePath) {
+    const sp = sidecarPath(filePath);
+    try {
+        if (!existsSync(sp))
+            return null;
+        return JSON.parse(readFileSync(sp, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeMeta(filePath, meta) {
+    const sp = sidecarPath(filePath);
+    const dir = dirname(sp);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    writeFileSync(sp, JSON.stringify(meta, null, 2), "utf8");
+}
+function buildTree(root, dir) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    }
+    catch {
+        return [];
+    }
+    const result = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        const abs = join(dir, entry.name);
+        const rel = relative(root, abs);
+        if (entry.isDirectory()) {
+            result.push({
+                name: entry.name,
+                relativePath: rel,
+                type: "dir",
+                children: buildTree(root, abs),
+            });
+        }
+        else if (entry.isFile()) {
+            const ext = extname(entry.name).toLowerCase();
+            if (!SUPPORTED_EXTS.has(ext))
+                continue;
+            const fileType = ext.slice(1);
+            result.push({ name: entry.name, relativePath: rel, type: "file", fileType });
+        }
+    }
+    return result;
+}
+function collectFiles(root, dir) {
+    const results = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        const abs = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            results.push(...collectFiles(root, abs));
+        }
+        else if (entry.isFile()) {
+            const ext = extname(entry.name).toLowerCase();
+            if (!SUPPORTED_EXTS.has(ext))
+                continue;
+            const rel = relative(root, abs);
+            const fileType = ext.slice(1);
+            let content = "";
+            try {
+                content = readFileSync(abs, "utf8");
+            }
+            catch {
+                /* skip unreadable files */
+            }
+            const meta = readMeta(abs);
+            const nameNoExt = basename(entry.name, extname(entry.name));
+            results.push({ relativePath: rel, name: nameNoExt, absPath: abs, fileType, content, meta });
+        }
+    }
+    return results;
+}
+// ─────────────────────────────────────────────────────────────────────────────
 const server = http.createServer(async (req, res) => {
     res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
     res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-Profile");
     if (req.method === "OPTIONS") {
         res.writeHead(204);
@@ -96,7 +205,48 @@ const server = http.createServer(async (req, res) => {
         const names = available.map((a) => a.name);
         console.log(`[server] /status → available: [${names.join(", ")}]`);
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ready: available.length > 0, backend: names[0] ?? null, available: names }));
+        res.end(JSON.stringify({
+            ready: available.length > 0,
+            backend: names[0] ?? null,
+            available: names,
+            workers: {
+                active: workerState.active,
+                jobTypes: workerState.jobTypes,
+                pollCount: workerState.pollCount,
+                lastError: workerState.lastError,
+            },
+        }));
+        return;
+    }
+    // ── GET /worker-templates — built-in element templates for Studio ────────
+    if (url.pathname === "/worker-templates" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(WORKER_TEMPLATES));
+        return;
+    }
+    // ── Run history routes ────────────────────────────────────────────────────
+    if (url.pathname === "/run-history" && req.method === "GET") {
+        handleGetRunHistory(req, res);
+        return;
+    }
+    if (url.pathname === "/run-history" && req.method === "DELETE") {
+        handleDeleteRunHistory(req, res);
+        return;
+    }
+    const rerunMatch = matchRerunHistoryRoute(req);
+    if (rerunMatch) {
+        await handleRerunHistory(req, res, rerunMatch.id);
+        return;
+    }
+    const runHistoryMatch = matchRunHistoryRoute(req);
+    if (runHistoryMatch && req.method === "GET") {
+        handleGetRunHistoryDetail(req, res, runHistoryMatch.id);
+        return;
+    }
+    // ── POST /webhooks/:processId — webhook trigger ───────────────────────────
+    const webhookMatch = matchWebhookRoute(req);
+    if (webhookMatch) {
+        await handleWebhook(req, res, webhookMatch.processId);
         return;
     }
     if (url.pathname === "/chat" && req.method === "POST") {
@@ -915,6 +1065,245 @@ const server = http.createServer(async (req, res) => {
         res.end();
         return;
     }
+    // ── File System API (/fs/*) ───────────────────────────────────────────────
+    if (url.pathname.startsWith("/fs/")) {
+        const fsPath = url.pathname.slice("/fs".length); // e.g. "/tree", "/list", "/read"
+        // GET /fs/tree?root=<abs> — lightweight directory tree
+        if (fsPath === "/tree" && req.method === "GET") {
+            const rawRoot = url.searchParams.get("root") ?? "";
+            const root = expandHome(rawRoot);
+            const rootExists = root !== "" && existsSync(root);
+            console.log(`[fs/tree] raw param: ${JSON.stringify(rawRoot)}`);
+            console.log(`[fs/tree] expanded:  ${JSON.stringify(root)}`);
+            console.log(`[fs/tree] existsSync: ${rootExists}`);
+            if (!rootExists) {
+                console.log("[fs/tree] → 404 not found");
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Project root not found" }));
+                return;
+            }
+            const tree = buildTree(root, root);
+            console.log(`[fs/tree] → 200 ok, ${tree.length} entries`);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(tree));
+            return;
+        }
+        // GET /fs/list?root=<abs> — all files with content + metadata
+        if (fsPath === "/list" && req.method === "GET") {
+            const root = expandHome(url.searchParams.get("root") ?? "");
+            if (!root || !existsSync(root)) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Project root not found" }));
+                return;
+            }
+            const files = collectFiles(root, root);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(files));
+            return;
+        }
+        // GET /fs/read?path=<abs> — read single file content
+        if (fsPath === "/read" && req.method === "GET") {
+            const filePath = expandHome(url.searchParams.get("path") ?? "");
+            if (!filePath || !existsSync(filePath)) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "File not found" }));
+                return;
+            }
+            let content;
+            try {
+                content = readFileSync(filePath, "utf8");
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ content }));
+            return;
+        }
+        // POST /fs/write — write file (creates parent directories)
+        if (fsPath === "/write" && req.method === "POST") {
+            const body = await readBody(req);
+            let filePath;
+            let content;
+            try {
+                const parsed = JSON.parse(body);
+                filePath = expandHome(parsed.path);
+                content = parsed.content;
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!filePath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            try {
+                const dir = dirname(filePath);
+                if (!existsSync(dir))
+                    mkdirSync(dir, { recursive: true });
+                writeFileSync(filePath, content, "utf8");
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // DELETE /fs/file?path=<abs> — delete file and its sidecar
+        if (fsPath === "/file" && req.method === "DELETE") {
+            const filePath = expandHome(url.searchParams.get("path") ?? "");
+            if (!filePath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            try {
+                if (existsSync(filePath))
+                    unlinkSync(filePath);
+                const sp = sidecarPath(filePath);
+                if (existsSync(sp))
+                    unlinkSync(sp);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // POST /fs/move — rename/move file and its sidecar
+        if (fsPath === "/move" && req.method === "POST") {
+            const body = await readBody(req);
+            let from;
+            let to;
+            try {
+                const parsed = JSON.parse(body);
+                from = expandHome(parsed.from);
+                to = expandHome(parsed.to);
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!from || !to) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing from/to" }));
+                return;
+            }
+            try {
+                const toDir = dirname(to);
+                if (!existsSync(toDir))
+                    mkdirSync(toDir, { recursive: true });
+                renameSync(from, to);
+                // Move sidecar if it exists
+                const fromSidecar = sidecarPath(from);
+                const toSidecar = sidecarPath(to);
+                if (existsSync(fromSidecar)) {
+                    const toSidecarDir = dirname(toSidecar);
+                    if (!existsSync(toSidecarDir))
+                        mkdirSync(toSidecarDir, { recursive: true });
+                    renameSync(fromSidecar, toSidecar);
+                }
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // POST /fs/mkdir — create directory
+        if (fsPath === "/mkdir" && req.method === "POST") {
+            const body = await readBody(req);
+            let dirPath;
+            try {
+                const parsed = JSON.parse(body);
+                dirPath = expandHome(parsed.path);
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!dirPath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            try {
+                mkdirSync(dirPath, { recursive: true });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // GET /fs/meta?path=<abs> — read sidecar metadata
+        if (fsPath === "/meta" && req.method === "GET") {
+            const filePath = expandHome(url.searchParams.get("path") ?? "");
+            if (!filePath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            const meta = readMeta(filePath);
+            if (!meta) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "No metadata found" }));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(meta));
+            return;
+        }
+        // POST /fs/meta — write sidecar metadata
+        if (fsPath === "/meta" && req.method === "POST") {
+            const body = await readBody(req);
+            let filePath;
+            let meta;
+            try {
+                const parsed = JSON.parse(body);
+                filePath = expandHome(parsed.path);
+                meta = parsed.meta;
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!filePath || !meta) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path or meta" }));
+                return;
+            }
+            try {
+                writeMeta(filePath, meta);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        res.writeHead(404);
+        res.end("FS route not found");
+        return;
+    }
     // ── ALL /api/* — transparent Camunda API proxy ─────────────────────────────
     if (url.pathname.startsWith("/api/")) {
         const profileName = req.headers["x-profile"];
@@ -966,6 +1355,69 @@ const server = http.createServer(async (req, res) => {
         res.end(await upstream.text());
         return;
     }
+    // ── POST /secrets/check — bulk existence check for secret names ───────────
+    if (url.pathname === "/secrets/check" && req.method === "POST") {
+        const body = await readBody(req);
+        let names = [];
+        try {
+            names = (JSON.parse(body).names ?? []);
+        }
+        catch {
+            /* treat as empty list */
+        }
+        const result = {};
+        for (const name of names) {
+            result[name] = process.env[name] !== undefined;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(result));
+        return;
+    }
+    // ── POST /secrets/:name — resolve and encrypt a secret for the client ─────
+    if (url.pathname.startsWith("/secrets/") && req.method === "POST") {
+        const name = url.pathname.slice("/secrets/".length);
+        if (!name) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Secret name required" }));
+            return;
+        }
+        const secretValue = process.env[name];
+        if (secretValue === undefined) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: `Secret "${name}" is not configured` }));
+            return;
+        }
+        const body = await readBody(req);
+        let keyBase64;
+        try {
+            const parsed = JSON.parse(body);
+            if (typeof parsed.key !== "string" || !parsed.key)
+                throw new Error("missing key");
+            keyBase64 = parsed.key;
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Body must be { key: string } with a base64 AES-256 key" }));
+            return;
+        }
+        try {
+            const rawKey = Buffer.from(keyBase64, "base64");
+            const cryptoKey = await globalThis.crypto.subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["encrypt"]);
+            const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+            const encrypted = await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, cryptoKey, new TextEncoder().encode(secretValue));
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                encrypted: Buffer.from(encrypted).toString("base64"),
+                iv: Buffer.from(iv).toString("base64"),
+            }));
+        }
+        catch (err) {
+            console.error(`[secrets] encryption failed for "${name}":`, err);
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Encryption failed" }));
+        }
+        return;
+    }
     // ── POST /http-request — CORS bypass for wasm worker REST connectors ─────
     if (url.pathname === "/http-request" && req.method === "POST") {
         const body = await readBody(req);
@@ -1012,5 +1464,7 @@ const server = http.createServer(async (req, res) => {
 server.listen(PORT, () => {
     console.log(`BPMN Kit AI Server running at http://localhost:${PORT}`);
     console.log("Press Ctrl+C to stop");
+    startWorkerDaemon();
+    startTriggers();
 });
 //# sourceMappingURL=index.js.map