@chatroomcp/chatroom 0.1.3

package/dist/infrastructure/http/http-server.js

@@ -0,0 +1,166 @@
+/** Express/HTTP transport host for REST, OAuth, MCP, plugins, and the built WebUI. */
+import { createServer } from "node:http";
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import express from "express";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { createApiRouter } from "../../plugins/web/http/api-router.js";
+import { createOAuthRouter } from "../../presentation/http/oauth-router.js";
+import { errorMiddleware } from "../../presentation/http/http-utils.js";
+import { IngressPolicy } from "../../auth/ingress-policy.js";
+import { CHATROOM_VERSION } from "../../core/runtime/identity.js";
+const WEB_UI_RESERVED_PREFIXES = [
+    "/api",
+    "/mcp",
+    "/oauth",
+    "/.well-known",
+    "/assets",
+];
+export class HttpServer {
+    config;
+    application;
+    eventBus;
+    auth;
+    passkeys;
+    mcp;
+    cloud;
+    server = null;
+    ingress;
+    startedAt = Date.now();
+    mcpRequestCount = 0;
+    constructor(config, application, eventBus, auth, passkeys, mcp, externalAccess, cloud) {
+        this.config = config;
+        this.application = application;
+        this.eventBus = eventBus;
+        this.auth = auth;
+        this.passkeys = passkeys;
+        this.mcp = mcp;
+        this.cloud = cloud;
+        this.ingress = new IngressPolicy(config, externalAccess);
+    }
+    async start() {
+        const app = express();
+        app.disable("x-powered-by");
+        app.set("trust proxy", false);
+        app.use(hostValidation(this.ingress));
+        app.use(express.json({ limit: "2mb" }));
+        app.use(express.urlencoded({ extended: false, limit: "64kb" }));
+        app.use(createOAuthRouter(this.auth, this.ingress));
+        app.use("/api", webMutationOrigin(this.ingress));
+        app.use("/api", createApiRouter(this.application, this.eventBus, this.auth, this.passkeys, this.ingress, this.cloud, () => ({
+            version: CHATROOM_VERSION,
+            mcpRequests: this.mcpRequestCount,
+            uptimeMinutes: Math.floor((Date.now() - this.startedAt) / 60000),
+        })));
+        const nodeMcp = toNodeHandler(this.mcp, {
+            onerror: (error) => console.error("[mcp]", error),
+        });
+        app.all("/mcp", (_req, _res, next) => {
+            this.mcpRequestCount += 1;
+            next();
+        }, mcpAuthentication(this.auth, this.ingress), (req, res) => {
+            void nodeMcp(req, res, req.body);
+        });
+        const webRoot = fileURLToPath(new URL("../../web/", import.meta.url));
+        const webIndexPath = path.join(webRoot, "index.html");
+        if (existsSync(webIndexPath)) {
+            const webIndex = readFileSync(webIndexPath, "utf8");
+            app.use("/assets", express.static(path.join(webRoot, "assets"), {
+                index: false,
+                maxAge: "1y",
+                immutable: true,
+            }));
+            app.use((req, res, next) => {
+                const isReserved = WEB_UI_RESERVED_PREFIXES.some((prefix) => req.path === prefix || req.path.startsWith(`${prefix}/`));
+                if (req.method !== "GET" || isReserved || !req.accepts("html")) {
+                    next();
+                    return;
+                }
+                res.setHeader("Cache-Control", "no-cache");
+                res.status(200).type("html").send(webIndex);
+            });
+        }
+        app.use(errorMiddleware);
+        this.server = createServer(app);
+        await new Promise((resolve, reject) => {
+            this.server.once("error", reject);
+            this.server.listen(this.config.server.port, this.config.server.host, () => {
+                this.server.off("error", reject);
+                resolve();
+            });
+        });
+    }
+    address() {
+        const value = this.server?.address();
+        return value && typeof value === "object" ? value : null;
+    }
+    async close() {
+        const server = this.server;
+        if (!server)
+            return;
+        const closed = new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+        await this.mcp.close();
+        server.closeAllConnections();
+        await closed;
+        this.server = null;
+    }
+}
+function webMutationOrigin(ingress) {
+    return (req, res, next) => {
+        if (req.method === "GET" ||
+            req.method === "HEAD" ||
+            req.method === "OPTIONS") {
+            next();
+            return;
+        }
+        const expectedOrigin = ingress.expectedWebOrigin(req);
+        if (!expectedOrigin) {
+            next();
+            return;
+        }
+        if (req.headers.origin !== expectedOrigin) {
+            res.status(403).json({
+                error: {
+                    code: "FORBIDDEN",
+                    message: "Request origin is not allowed",
+                },
+            });
+            return;
+        }
+        next();
+    };
+}
+function hostValidation(ingress) {
+    return (req, res, next) => {
+        const hostname = req.hostname;
+        if (!hostname || !ingress.allowedHosts().has(hostname)) {
+            res.status(403).json({
+                error: { code: "FORBIDDEN", message: "Host header is not allowed" },
+            });
+            return;
+        }
+        next();
+    };
+}
+function mcpAuthentication(auth, ingress) {
+    return (req, res, next) => {
+        if (!ingress.requiresMcpAuth(req)) {
+            next();
+            return;
+        }
+        const header = req.headers.authorization;
+        const token = typeof header === "string" && header.startsWith("Bearer ")
+            ? header.slice(7)
+            : null;
+        const info = token ? auth.verifyMcpToken(token) : null;
+        if (!info) {
+            const base = ingress.mcpBaseUrl(req);
+            res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"`);
+            res.status(401).json({ error: "invalid_token" });
+            return;
+        }
+        req.auth = info;
+        next();
+    };
+}

package/dist/mcp/server/create-mcp-server.d.ts

@@ -0,0 +1,3 @@
+import { type McpHttpHandler } from "@modelcontextprotocol/server";
+import type { PluginManager } from "../../plugins/plugin-manager.js";
+export declare function createChatRoomMcpHandler(plugins: PluginManager): McpHttpHandler;

package/dist/mcp/server/create-mcp-server.js

@@ -0,0 +1,16 @@
+import { createMcpHandler, McpServer, } from "@modelcontextprotocol/server";
+import { CHATROOM_NAME, CHATROOM_VERSION, } from "../../core/runtime/identity.js";
+export function createChatRoomMcpHandler(plugins) {
+    return createMcpHandler(() => createServer(plugins), {
+        legacy: "stateless",
+        responseMode: "auto",
+    });
+}
+function createServer(plugins) {
+    const server = new McpServer({ name: CHATROOM_NAME, version: CHATROOM_VERSION }, {
+        instructions: "Workspace lifecycle is independent from MCP connections. " +
+            "Use WorkspaceId only with workspace tools and ProcessId only with process tools.",
+    });
+    plugins.registerMcp(server);
+    return server;
+}

package/dist/mcp/server/tool-support.d.ts

@@ -0,0 +1,105 @@
+import { type CallToolResult } from "@modelcontextprotocol/server";
+import { z } from "zod";
+export declare const closedRead: {
+    readOnlyHint: true;
+    destructiveHint: false;
+    idempotentHint: true;
+    openWorldHint: false;
+};
+export declare const localWrite: {
+    readOnlyHint: false;
+    destructiveHint: true;
+    idempotentHint: true;
+    openWorldHint: false;
+};
+export declare const localMutation: {
+    readOnlyHint: false;
+    destructiveHint: false;
+    idempotentHint: false;
+    openWorldHint: false;
+};
+export declare const destructiveLocalMutation: {
+    readOnlyHint: false;
+    destructiveHint: true;
+    idempotentHint: false;
+    openWorldHint: false;
+};
+export declare const openWorldMutation: {
+    readOnlyHint: false;
+    destructiveHint: true;
+    idempotentHint: false;
+    openWorldHint: true;
+};
+export declare const workspaceOutputSchema: z.ZodObject<{
+    id: z.ZodString;
+    root: z.ZodString;
+    sourceRoot: z.ZodString;
+    mode: z.ZodEnum<{
+        worktree: "worktree";
+        checkout: "checkout";
+    }>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodString;
+    instructions: z.ZodArray<z.ZodString>;
+    skills: z.ZodArray<z.ZodString>;
+    capabilities: z.ZodObject<{
+        filesystem: z.ZodLiteral<"read-write">;
+        git: z.ZodBoolean;
+        skills: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const fileReadOutputSchema: z.ZodObject<{
+    content: z.ZodString;
+    bytes: z.ZodNumber;
+    truncated: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const fileWriteOutputSchema: z.ZodObject<{
+    path: z.ZodString;
+    bytes: z.ZodNumber;
+}, z.core.$strip>;
+export declare const fileInfoSchema: z.ZodObject<{
+    path: z.ZodString;
+    type: z.ZodEnum<{
+        file: "file";
+        directory: "directory";
+        symlink: "symlink";
+    }>;
+    size: z.ZodNumber;
+    modifiedAt: z.ZodString;
+}, z.core.$strip>;
+export declare const searchMatchSchema: z.ZodObject<{
+    path: z.ZodString;
+    line: z.ZodNumber;
+    column: z.ZodNumber;
+    preview: z.ZodString;
+}, z.core.$strip>;
+export declare const changeSetSchema: z.ZodObject<{
+    files: z.ZodArray<z.ZodString>;
+    replacements: z.ZodNumber;
+    bytesBefore: z.ZodNumber;
+    bytesAfter: z.ZodNumber;
+}, z.core.$strip>;
+export declare const processSnapshotSchema: z.ZodObject<{
+    processId: z.ZodString;
+    command: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    cwd: z.ZodString;
+    pid: z.ZodNullable<z.ZodNumber>;
+    state: z.ZodEnum<{
+        running: "running";
+        exited: "exited";
+        killed: "killed";
+        failed: "failed";
+    }>;
+    startedAt: z.ZodString;
+    finishedAt: z.ZodNullable<z.ZodString>;
+    durationMs: z.ZodNumber;
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    signal: z.ZodNullable<z.ZodString>;
+    stdout: z.ZodString;
+    stderr: z.ZodString;
+    outputTruncated: z.ZodBoolean;
+    timedOut: z.ZodBoolean;
+    operationId: z.ZodString;
+}, z.core.$strip>;
+export declare function mcpTool<T>(operation: (input: T) => Promise<unknown> | unknown): (input: T) => Promise<CallToolResult>;

package/dist/mcp/server/tool-support.js

@@ -0,0 +1,124 @@
+import { z } from "zod";
+import { asChatRoomError } from "../../core/errors/chatroom-error.js";
+export const closedRead = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+};
+export const localWrite = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false,
+};
+export const localMutation = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false,
+};
+export const destructiveLocalMutation = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false,
+};
+export const openWorldMutation = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+export const workspaceOutputSchema = z.object({
+    id: z.string(),
+    root: z.string(),
+    sourceRoot: z.string(),
+    mode: z.enum(["checkout", "worktree"]),
+    createdAt: z.string(),
+    lastUsedAt: z.string(),
+    instructions: z.array(z.string()),
+    skills: z.array(z.string()),
+    capabilities: z.object({
+        filesystem: z.literal("read-write"),
+        git: z.boolean(),
+        skills: z.boolean(),
+    }),
+});
+export const fileReadOutputSchema = z.object({
+    content: z.string(),
+    bytes: z.number().int().nonnegative(),
+    truncated: z.boolean(),
+});
+export const fileWriteOutputSchema = z.object({
+    path: z.string(),
+    bytes: z.number().int().nonnegative(),
+});
+export const fileInfoSchema = z.object({
+    path: z.string(),
+    type: z.enum(["file", "directory", "symlink"]),
+    size: z.number().int().nonnegative(),
+    modifiedAt: z.string(),
+});
+export const searchMatchSchema = z.object({
+    path: z.string(),
+    line: z.number().int().positive(),
+    column: z.number().int().positive(),
+    preview: z.string(),
+});
+export const changeSetSchema = z.object({
+    files: z.array(z.string()),
+    replacements: z.number().int().nonnegative(),
+    bytesBefore: z.number().int().nonnegative(),
+    bytesAfter: z.number().int().nonnegative(),
+});
+export const processSnapshotSchema = z.object({
+    processId: z.string(),
+    command: z.string(),
+    args: z.array(z.string()),
+    cwd: z.string(),
+    pid: z.number().int().nullable(),
+    state: z.enum(["running", "exited", "killed", "failed"]),
+    startedAt: z.string(),
+    finishedAt: z.string().nullable(),
+    durationMs: z.number().nonnegative(),
+    exitCode: z.number().int().nullable(),
+    signal: z.string().nullable(),
+    stdout: z.string(),
+    stderr: z.string(),
+    outputTruncated: z.boolean(),
+    timedOut: z.boolean(),
+    operationId: z.string(),
+});
+export function mcpTool(operation) {
+    return async (input) => {
+        try {
+            const value = await operation(input);
+            return {
+                content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
+                structuredContent: asRecord(value),
+            };
+        }
+        catch (error) {
+            const normalized = asChatRoomError(error);
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            code: normalized.code,
+                            message: normalized.message,
+                            details: normalized.details ?? null,
+                        }),
+                    },
+                ],
+            };
+        }
+    };
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : { value };
+}

package/dist/operations/operation-log.d.ts

@@ -0,0 +1,23 @@
+import type { Operation, OperationStart, OperationStatus } from "../core/operations/types.js";
+import type { OperationQuery, OperationRepository } from "../core/operations/repository.js";
+import type { RuntimeEventBus } from "../app/event-bus.js";
+/** Persists redacted, bounded operations produced by ChatRoom plugins. */
+export declare class OperationLog {
+    private readonly repository;
+    private readonly eventBus;
+    private readonly maxPayloadBytes;
+    private readonly redactor;
+    constructor(repository: OperationRepository, eventBus: RuntimeEventBus, maxPayloadBytes: number);
+    start(request: OperationStart): Operation;
+    finish(operationId: string, status: Exclude<OperationStatus, "running">, output?: unknown, error?: unknown): Operation;
+    updateRunning(operationId: string, output: unknown): Operation;
+    run<T>(request: OperationStart, action: () => Promise<T>): Promise<T>;
+    list(query?: OperationQuery): Operation[];
+    get(operationId: string): Operation | null;
+    clearHistory(): {
+        deleted: number;
+        preserved: number;
+    };
+    reconcileInterrupted(): number;
+    private require;
+}

package/dist/operations/operation-log.js

@@ -0,0 +1,103 @@
+import { randomUUID } from "node:crypto";
+import { boundJson } from "../core/operations/bounded-value.js";
+import { SecretRedactor } from "../core/operations/redactor.js";
+import { asChatRoomError, ChatRoomError, } from "../core/errors/chatroom-error.js";
+/** Persists redacted, bounded operations produced by ChatRoom plugins. */
+export class OperationLog {
+    repository;
+    eventBus;
+    maxPayloadBytes;
+    redactor = new SecretRedactor();
+    constructor(repository, eventBus, maxPayloadBytes) {
+        this.repository = repository;
+        this.eventBus = eventBus;
+        this.maxPayloadBytes = maxPayloadBytes;
+    }
+    start(request) {
+        const input = boundJson(this.redactor.redact(request.input ?? null), this.maxPayloadBytes);
+        const operation = {
+            operationId: randomUUID(),
+            pluginId: request.pluginId,
+            source: request.source,
+            action: request.action,
+            status: "running",
+            workspaceId: request.workspaceId ?? null,
+            processId: request.processId ?? null,
+            input: input.value,
+            output: null,
+            error: null,
+            inputTruncated: input.truncated,
+            outputTruncated: false,
+            startedAt: new Date().toISOString(),
+            finishedAt: null,
+            durationMs: null,
+        };
+        this.repository.insert(operation);
+        this.eventBus.emit({ type: "operation", operation });
+        return operation;
+    }
+    finish(operationId, status, output, error) {
+        const operation = this.require(operationId);
+        const finishedAt = new Date();
+        const bounded = boundJson(this.redactor.redact(output ?? null), this.maxPayloadBytes);
+        operation.status = status;
+        operation.output = bounded.value;
+        operation.outputTruncated = bounded.truncated;
+        operation.error = error
+            ? boundJson(this.redactor.redact(error), this.maxPayloadBytes).value
+            : null;
+        operation.finishedAt = finishedAt.toISOString();
+        operation.durationMs = Math.max(0, finishedAt.getTime() - new Date(operation.startedAt).getTime());
+        this.repository.update(operation);
+        this.eventBus.emit({ type: "operation", operation });
+        return operation;
+    }
+    updateRunning(operationId, output) {
+        const operation = this.require(operationId);
+        if (operation.status !== "running")
+            return operation;
+        const bounded = boundJson(this.redactor.redact(output), this.maxPayloadBytes);
+        operation.output = bounded.value;
+        operation.outputTruncated = bounded.truncated;
+        this.repository.update(operation);
+        this.eventBus.emit({ type: "operation", operation });
+        return operation;
+    }
+    async run(request, action) {
+        const operation = this.start(request);
+        try {
+            const result = await action();
+            this.finish(operation.operationId, "success", result);
+            return result;
+        }
+        catch (error) {
+            const normalized = asChatRoomError(error);
+            this.finish(operation.operationId, "error", null, {
+                code: normalized.code,
+                message: normalized.message,
+                details: normalized.details,
+            });
+            throw error;
+        }
+    }
+    list(query) {
+        return this.repository.list(query);
+    }
+    get(operationId) {
+        return this.repository.get(operationId);
+    }
+    clearHistory() {
+        const result = this.repository.clearHistory();
+        this.eventBus.emit({ type: "operations-cleared", ...result });
+        return result;
+    }
+    reconcileInterrupted() {
+        return this.repository.reconcileRunning(new Date().toISOString());
+    }
+    require(operationId) {
+        const operation = this.repository.get(operationId);
+        if (!operation)
+            throw new ChatRoomError("NOT_FOUND", `Operation not found: ${operationId}`);
+        return operation;
+    }
+}

package/dist/plugins/cloud/api-client.d.ts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+import { type CloudEntitlement, type CloudLeaseState, type CloudServiceId } from "./types.js";
+declare const recoveryCredentialSchema: z.ZodObject<{
+    recoveryKey: z.ZodString;
+}, z.core.$strict>;
+declare const sessionSchema: z.ZodObject<{
+    purchaseToken: z.ZodString;
+    managementUrl: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+declare const restoreSchema: z.ZodObject<{
+    entitlements: z.ZodArray<z.ZodObject<{
+        service: z.ZodEnum<{
+            remote_mcp: "remote_mcp";
+            remote_web: "remote_web";
+        }>;
+        status: z.ZodLiteral<"active">;
+        sourceProvider: z.ZodString;
+        sourceId: z.ZodString;
+        validUntil: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    customer: z.ZodObject<{
+        id: z.ZodString;
+    }, z.core.$strict>;
+    publicPrefix: z.ZodNullable<z.ZodString>;
+    recoveryKey: z.ZodString;
+}, z.core.$strict>;
+declare const prefixSchema: z.ZodObject<{
+    publicPrefix: z.ZodString;
+    mcpUrl: z.ZodString;
+    webUrl: z.ZodString;
+}, z.core.$strict>;
+export declare class CloudApiClient {
+    private readonly baseUrl;
+    constructor(baseUrl: string);
+    createManagementSession(identity: DeviceIdentity): Promise<z.infer<typeof sessionSchema>>;
+    status(identity: DeviceIdentity, purchaseToken: string | null): Promise<{
+        managementSessionActive: boolean;
+        entitlements: CloudEntitlement[];
+        customer: {
+            id: string;
+        } | null;
+        publicPrefix: string | null;
+    }>;
+    restore(identity: DeviceIdentity, recoveryKey: string): Promise<z.infer<typeof restoreSchema>>;
+    replaceRecoveryKey(identity: DeviceIdentity): Promise<z.infer<typeof recoveryCredentialSchema>>;
+    setPrefix(identity: DeviceIdentity, prefix: string): Promise<z.infer<typeof prefixSchema>>;
+    lease(identity: DeviceIdentity, requestedServices: CloudServiceId[]): Promise<CloudLeaseState>;
+    private devicePost;
+}
+export interface DeviceIdentity {
+    installationId: string;
+    devicePublicKey: string;
+    devicePrivateKey: string;
+}
+export {};