@decibelsystems/tools 2.0.2 → 2.1.1

package/dist/httpServer.js

@@ -31,17 +31,20 @@ import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { log } from './config.js';
-import { isSupabaseConfigured } from './lib/supabase.js';
+import { isSupabaseConfigured, getSupabaseServiceClient } from './lib/supabase.js';
+import { shouldQueueForAgent, parseToolCall } from './httpQueueDetection.js';
 import { getLicenseValidator } from './license.js';
 import { listProjects } from './projectRegistry.js';
 import { listEpics, listRepoIssues, isProjectResolutionError, } from './tools/sentinel.js';
 import { voiceInboxAdd, } from './tools/voice.js';
 import { generateImage, getImageStatus, meshyGenerate, getMeshyStatus, meshyDownload, tripoGenerate, getTripoStatus, tripoDownload, klingGenerateVideo, klingGenerateTextVideo, klingGenerateAvatar, getKlingStatus, listTasks, } from './tools/studio/index.js';
-// Module-level kernel reference — set by startHttpServer()
+// Module-level references — set by startHttpServer()
 let kernel;
 let landingPageHtml = '';
 let startedAt = 0;
 let sseConnectionCount = 0;
+let agentRegistry;
+let daemonConfig;
 // ============================================================================
 // Security: Body Size Limit
 // ============================================================================
@@ -52,19 +55,26 @@ const MAX_BODY_BYTES = 1_048_576; // 1MB
 class RateLimiter {
     windows = new Map();
     maxRpm;
+    agentLimits = new Map();
     constructor(maxRpm) {
         this.maxRpm = maxRpm;
     }
-    /** Returns true if the request should be allowed */
-    check(ip) {
+    /** Returns true if the request should be allowed. Uses agent-scoped key when agentId is provided. */
+    check(ip, agentId) {
+        const key = agentId ? `agent:${agentId}` : `ip:${ip}`;
+        const limit = agentId ? (this.agentLimits.get(agentId) ?? this.maxRpm) : this.maxRpm;
         const now = Date.now();
-        const entry = this.windows.get(ip);
+        const entry = this.windows.get(key);
         if (!entry || now - entry.start > 60_000) {
-            this.windows.set(ip, { count: 1, start: now });
+            this.windows.set(key, { count: 1, start: now });
             return true;
         }
         entry.count++;
-        return entry.count <= this.maxRpm;
+        return entry.count <= limit;
+    }
+    /** Set a per-agent RPM override */
+    setAgentLimit(agentId, rpm) {
+        this.agentLimits.set(agentId, rpm);
     }
     /** Update the max RPM (e.g. on config reload) */
     setMaxRpm(rpm) {
@@ -73,9 +83,9 @@ class RateLimiter {
     /** Periodic cleanup of expired windows */
     cleanup() {
         const now = Date.now();
-        for (const [ip, entry] of this.windows) {
+        for (const [key, entry] of this.windows) {
             if (now - entry.start > 60_000) {
-                this.windows.delete(ip);
+                this.windows.delete(key);
             }
         }
     }
@@ -116,91 +126,18 @@ const PKG = getVersion();
 /**
  * Generate landing page HTML from facade definitions.
  */
-function buildLandingPageHtml(facades) {
-    const escHtml = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-    const totalActions = facades.reduce((sum, f) => sum + f.actions.length, 0);
-    const toolSections = facades
-        .sort((a, b) => a.name.localeCompare(b.name))
-        .map(f => {
-        const rows = f.actions
-            .sort()
-            .map(action => {
-            return `        <tr><td class="tool-name">${escHtml(f.name)}(${escHtml(action)})</td><td class="tool-desc"></td></tr>`;
-        })
-            .join('\n');
-        return `      <div class="module-section">
-        <h3>${escHtml(f.name)} <span class="tool-count">${f.actions.length} actions</span></h3>
-        <p style="color:#888;font-size:0.85rem;margin-bottom:0.75rem">${escHtml(f.description.split('.')[0])}</p>
-        <table>${rows}</table>
-      </div>`;
-    }).join('\n');
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Decibel Tools - ${facades.length} Facades</title>
-  <style>
-    * { box-sizing: border-box; margin: 0; padding: 0; }
-    body {
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
-      background: #0a0a0a;
-      color: #e5e5e5;
-      min-height: 100vh;
-      display: flex;
-      flex-direction: column;
-      align-items: center;
-      padding: 2rem;
+function buildLandingPageHtml(_facades) {
+    // Load full API docs from template (uses module-level __dirname)
+    const templatePath = join(__dirname, '..', 'templates', 'docs.html');
+    try {
+        return readFileSync(templatePath, 'utf-8')
+            .replace(/\{\{VERSION\}\}/g, PKG.version)
+            .replace(/\{\{FACADE_COUNT\}\}/g, String(_facades.length))
+            .replace(/\{\{TOOL_COUNT\}\}/g, String(_facades.reduce((s, f) => s + f.actions.length, 0)));
     }
-    .container { max-width: 900px; width: 100%; }
-    h1 {
-      font-size: 2.5rem;
-      font-weight: 700;
-      margin-bottom: 0.5rem;
-      background: linear-gradient(135deg, #fff 0%, #888 100%);
-      -webkit-background-clip: text;
-      -webkit-text-fill-color: transparent;
+    catch {
+        return `<html><body><h1>Decibel Tools v${PKG.version}</h1><p>Docs template not found.</p></body></html>`;
     }
-    .tagline { font-size: 1.25rem; color: #888; margin-bottom: 0.5rem; }
-    .tool-total { font-size: 0.9rem; color: #555; margin-bottom: 2rem; }
-    .features { display: grid; grid-template-columns: repeat(2, 1fr); gap: 1rem; margin-bottom: 2rem; }
-    .feature { background: #111; border: 1px solid #222; border-radius: 8px; padding: 1.25rem; }
-    .feature h3 { font-size: 0.9rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }
-    .feature p { font-size: 0.85rem; color: #888; line-height: 1.5; }
-    .module-section { background: #111; border: 1px solid #222; border-radius: 8px; padding: 1.25rem; margin-bottom: 1rem; }
-    .module-section h3 { font-size: 0.95rem; font-weight: 600; margin-bottom: 0.75rem; color: #fff; text-transform: capitalize; }
-    .tool-count { font-size: 0.75rem; color: #555; font-weight: 400; margin-left: 0.5rem; }
-    table { width: 100%; border-collapse: collapse; }
-    tr { border-bottom: 1px solid #1a1a1a; }
-    tr:last-child { border-bottom: none; }
-    td { padding: 0.4rem 0; vertical-align: top; font-size: 0.8rem; }
-    .tool-name { color: #ccc; font-family: 'SF Mono', Monaco, 'Cascadia Code', monospace; white-space: nowrap; padding-right: 1rem; width: 1%; }
-    .tool-desc { color: #666; }
-    footer { margin-top: 2rem; padding-top: 2rem; font-size: 0.8rem; color: #444; }
-    footer a { color: #666; text-decoration: none; }
-    footer a:hover { color: #888; }
-    @media (max-width: 600px) { .features { grid-template-columns: 1fr; } }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>Decibel Tools</h1>
-    <p class="tagline">Project intelligence for AI coding agents</p>
-    <p class="tool-total">${facades.length} facades, ${totalActions} actions &middot; v${PKG.version}</p>
-    <div class="features">
-      <div class="feature"><h3>Sentinel</h3><p>Track epics, issues, and incidents. Your agent knows what's in flight.</p></div>
-      <div class="feature"><h3>Architect</h3><p>Record ADRs and decisions. Context persists across sessions.</p></div>
-      <div class="feature"><h3>Dojo</h3><p>Incubate ideas with wishes, proposals, and experiments.</p></div>
-      <div class="feature"><h3>Oracle</h3><p>Get AI-powered recommendations on what to work on next.</p></div>
-    </div>
-${toolSections}
-    <footer>
-      <a href="https://github.com/decibelsystems/decibel-tools-beta">GitHub</a> &middot;
-      <a href="https://modelcontextprotocol.io">MCP Protocol</a>
-    </footer>
-  </div>
-</body>
-</html>`;
 }
 // ============================================================================
 // Response Helpers
@@ -277,8 +214,30 @@ async function parseBody(req) {
 async function executeTool(tool, args, req, tierOverride) {
     try {
         // Extract agent context from HTTP headers
+        const headerAgentId = req?.headers['x-agent-id'];
+        // Queue detection: if this is a write call from a remote agent, queue instead of execute
+        if (headerAgentId && shouldQueueForAgent(tool, args, headerAgentId)) {
+            const parsed = parseToolCall(tool, args);
+            const { action: _action, ...queueArgs } = args;
+            return await queueForAgent(parsed.facade, parsed.action, queueArgs, headerAgentId, args.projectId || 'default');
+        }
+        // Resolve allowedFacades: header > agent registry > agent config > none
+        let allowedFacades;
+        const facadesHeader = req?.headers['x-allowed-facades'];
+        if (facadesHeader) {
+            allowedFacades = facadesHeader.split(',').map(s => s.trim()).filter(Boolean);
+        }
+        else if (headerAgentId && agentRegistry) {
+            const registeredAgent = agentRegistry.get(headerAgentId);
+            if (registeredAgent?.allowedFacades) {
+                allowedFacades = registeredAgent.allowedFacades;
+            }
+        }
+        if (!allowedFacades && headerAgentId && daemonConfig?.agents?.[headerAgentId]?.allowed_facades) {
+            allowedFacades = daemonConfig.agents[headerAgentId].allowed_facades;
+        }
         const context = req ? {
-            agentId: req.headers['x-agent-id'],
+            agentId: headerAgentId,
             runId: req.headers['x-run-id'],
             parentCallId: req.headers['x-parent-call-id'],
             scope: req.headers['x-scope'],
@@ -286,6 +245,7 @@ async function executeTool(tool, args, req, tierOverride) {
             userKey: req.headers['x-user-key'],
             requestId: req.headers['x-request-id'],
             tier: tierOverride,
+            allowedFacades,
         } : tierOverride ? { tier: tierOverride } : undefined;
         const toolResult = await kernel.dispatch(tool, args, context);
         const text = toolResult.content[0]?.text;
@@ -321,6 +281,35 @@ async function executeTool(tool, args, req, tierOverride) {
         return wrapError(message, 'EXECUTION_ERROR');
     }
 }
+/**
+ * Queue a write operation for later local sync instead of executing immediately.
+ * Used when a remote agent calls a queueable write action.
+ */
+async function queueForAgent(facade, action, args, agentId, projectId) {
+    if (!isSupabaseConfigured()) {
+        return wrapError('Agent queue requires Supabase configuration', 'QUEUE_UNAVAILABLE');
+    }
+    const supabase = getSupabaseServiceClient();
+    const { data, error } = await supabase
+        .from('agent_queue')
+        .insert({
+        project_id: projectId,
+        facade,
+        action,
+        arguments: args,
+        created_by: agentId,
+    })
+        .select('id')
+        .single();
+    if (error) {
+        return wrapError(`Failed to queue: ${error.message}`, 'QUEUE_ERROR');
+    }
+    return {
+        status: 'queued',
+        queue_id: data.id,
+        message: 'Queued for local sync. Use agentic queue_status to check result.',
+    };
+}
 /**
  * Get list of available facades — public API for tool discovery
  */
@@ -384,14 +373,24 @@ export async function startHttpServer(server, kernelInstance, options) {
     timeoutMs = 120000, // 2 minute default timeout
     retryIntervalMs = 3000, // 3s retry for SSE clients
     rateLimitRpm = 100, // 100 req/min per IP default
-    isDaemon = false, configLicenseKey, } = options;
+    isDaemon = false, configLicenseKey, agentRegistry: optAgentRegistry, daemonConfig: optDaemonConfig, } = options;
     // Set module-level references
     kernel = kernelInstance;
     startedAt = Date.now();
+    agentRegistry = optAgentRegistry;
+    daemonConfig = optDaemonConfig;
     log(`HTTP: Using kernel with ${kernel.toolCount} tools`);
     // Rate limiter (clean up stale entries every 60s)
     const rateLimiter = new RateLimiter(rateLimitRpm);
     const rateLimiterCleanup = setInterval(() => rateLimiter.cleanup(), 60_000);
+    // Apply per-agent rate limits from daemon config
+    if (daemonConfig?.agents) {
+        for (const [agentId, agentCfg] of Object.entries(daemonConfig.agents)) {
+            if (agentCfg.rate_limit_rpm) {
+                rateLimiter.setAgentLimit(agentId, agentCfg.rate_limit_rpm);
+            }
+        }
+    }
     // Build landing page from actual tool list
     landingPageHtml = buildLandingPageHtml(getAvailableTools());
     // Create transport in STATELESS mode (better for ChatGPT compatibility)
@@ -450,7 +449,7 @@ export async function startHttpServer(server, kernelInstance, options) {
             }
         }
         res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Mcp-Session-Id, Accept');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Mcp-Session-Id, Accept, X-Agent-Id, X-Run-Id, X-License-Key, X-Allowed-Facades, X-Scope, X-Request-Id, X-Parent-Call-Id, X-Engagement-Mode, X-User-Key');
         res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
         // (a) Handle preflight OPTIONS requests
         if (req.method === 'OPTIONS') {
@@ -460,11 +459,16 @@ export async function startHttpServer(server, kernelInstance, options) {
         }
         // Rate limiting (check before auth to prevent brute force)
         const clientIp = (req.socket.remoteAddress || '127.0.0.1').replace('::ffff:', '');
-        if (!rateLimiter.check(clientIp)) {
-            log(`HTTP: Rate limited ${clientIp}`);
+        const reqAgentId = req.headers['x-agent-id'];
+        if (!rateLimiter.check(clientIp, reqAgentId)) {
+            log(`HTTP: Rate limited ${reqAgentId || clientIp}`);
             sendJson(res, 429, wrapError('Too many requests (rate limit exceeded)', 'RATE_LIMITED'));
             return;
         }
+        // Implicit heartbeat: any authenticated request with X-Agent-Id keeps the agent alive
+        if (reqAgentId && agentRegistry) {
+            agentRegistry.heartbeat(reqAgentId);
+        }
         // Track in-flight request
         activeRequests.add(req);
         res.on('finish', () => activeRequests.delete(req));
@@ -503,6 +507,8 @@ export async function startHttpServer(server, kernelInstance, options) {
                 internal_tool_count: kernel.toolCount,
                 connected_clients: activeSseConnections.size,
                 active_requests: activeRequests.size,
+                connected_agents: agentRegistry?.count ?? 0,
+                agents: agentRegistry?.toJSON() ?? [],
                 pro: licenseTier !== 'core',
                 license_tier: licenseTier,
                 supabase_configured: isSupabaseConfigured(),
@@ -629,6 +635,127 @@ export async function startHttpServer(server, kernelInstance, options) {
             }));
             return;
         }
+        // ========================================================================
+        // Multi-Agent Endpoints (ISS-0052)
+        // ========================================================================
+        // POST /connect — Agent handshake with daemon
+        if (path === '/connect' && req.method === 'POST') {
+            if (!agentRegistry) {
+                sendJson(res, 503, wrapError('Agent registry not available (not in daemon mode)', 'NOT_DAEMON'));
+                return;
+            }
+            try {
+                const body = await parseBody(req);
+                const agentId = body.agent_id;
+                if (!agentId) {
+                    sendJson(res, 400, wrapError('Missing "agent_id" field', 'MISSING_AGENT_ID'));
+                    return;
+                }
+                // Look up per-agent config
+                const agentCfg = daemonConfig?.agents?.[agentId];
+                const agent = agentRegistry.register({
+                    id: agentId,
+                    capabilities: body.capabilities || [],
+                    allowedFacades: agentCfg?.allowed_facades,
+                    tier: agentCfg?.tier,
+                });
+                // Apply per-agent rate limit if configured
+                if (agentCfg?.rate_limit_rpm) {
+                    rateLimiter.setAgentLimit(agentId, agentCfg.rate_limit_rpm);
+                }
+                log(`HTTP: /connect agent=${agentId}`);
+                sendJson(res, 200, wrapSuccess({
+                    agent_id: agent.id,
+                    connected_at: agent.connectedAt,
+                    capabilities: agent.capabilities,
+                    allowed_facades: agent.allowedFacades || null,
+                    tier: agent.tier || null,
+                    rate_limit_rpm: agentCfg?.rate_limit_rpm || rateLimitRpm,
+                }));
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                sendJson(res, 400, wrapError(message, 'CONNECT_ERROR'));
+            }
+            return;
+        }
+        // POST /disconnect — Graceful agent disconnect
+        if (path === '/disconnect' && req.method === 'POST') {
+            if (!agentRegistry) {
+                sendJson(res, 503, wrapError('Agent registry not available (not in daemon mode)', 'NOT_DAEMON'));
+                return;
+            }
+            try {
+                const body = await parseBody(req);
+                const agentId = body.agent_id;
+                if (!agentId) {
+                    sendJson(res, 400, wrapError('Missing "agent_id" field', 'MISSING_AGENT_ID'));
+                    return;
+                }
+                const disconnected = agentRegistry.disconnect(agentId);
+                log(`HTTP: /disconnect agent=${agentId} (was_connected=${disconnected})`);
+                sendJson(res, 200, wrapSuccess({
+                    agent_id: agentId,
+                    disconnected,
+                }));
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                sendJson(res, 400, wrapError(message, 'DISCONNECT_ERROR'));
+            }
+            return;
+        }
+        // GET /agents — List connected agents
+        if (path === '/agents' && req.method === 'GET') {
+            if (!agentRegistry) {
+                sendJson(res, 200, wrapSuccess({ agents: [], count: 0 }));
+                return;
+            }
+            sendJson(res, 200, wrapSuccess({
+                agents: agentRegistry.toJSON(),
+                count: agentRegistry.count,
+            }));
+            return;
+        }
+        // GET /events/stream — SSE stream of real-time dispatch events
+        if (path === '/events/stream' && req.method === 'GET') {
+            // Filter params
+            const filterAgentId = url.searchParams.get('agent_id');
+            const filterFacade = url.searchParams.get('facade');
+            res.writeHead(200, {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                'Connection': 'keep-alive',
+            });
+            res.write(': connected\n\n');
+            const listener = (evt) => {
+                // Apply filters
+                if (filterAgentId && evt.agentId !== filterAgentId)
+                    return;
+                if (filterFacade && evt.facade !== filterFacade)
+                    return;
+                if (!res.writableEnded) {
+                    res.write(`data: ${JSON.stringify(evt)}\n\n`);
+                }
+            };
+            kernel.on('dispatch', listener);
+            kernel.on('result', listener);
+            kernel.on('error', listener);
+            // Track for keepalive
+            activeSseConnections.add(res);
+            log(`HTTP: /events/stream opened (${activeSseConnections.size} SSE connections)`);
+            // Cleanup on close
+            const cleanup = () => {
+                kernel.off('dispatch', listener);
+                kernel.off('result', listener);
+                kernel.off('error', listener);
+                activeSseConnections.delete(res);
+                log(`HTTP: /events/stream closed (${activeSseConnections.size} SSE connections)`);
+            };
+            res.on('close', cleanup);
+            res.on('error', cleanup);
+            return;
+        }
         // GET /facades - Facade registry for agent bootstrap
         if (path === '/facades' && req.method === 'GET') {
             const tier = (url.searchParams.get('tier') || 'full');