@evomap/evolver 1.89.4 → 1.89.5

package/src/proxy/mailbox/store.js

@@ -7,6 +7,24 @@ const crypto = require('crypto');
 const DEFAULT_CHANNEL = 'evomap-hub';
 const SCHEMA_VERSION = 1;
 const PROXY_PROTOCOL_VERSION = '0.1.0';
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+
+function bestEffortChmod(filePath, mode) {
+  try { fs.chmodSync(filePath, mode); } catch { /* best effort; no-op on Windows */ }
+}
+
+function ensurePrivateDir(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: PRIVATE_DIR_MODE });
+  }
+  bestEffortChmod(dir, PRIVATE_DIR_MODE);
+}
+
+function writePrivateFile(filePath, content) {
+  fs.writeFileSync(filePath, content, { encoding: 'utf8', mode: PRIVATE_FILE_MODE });
+  bestEffortChmod(filePath, PRIVATE_FILE_MODE);
+}
 
 // Merge `fields` into `target` while stripping keys that can mutate the
 // prototype chain. Mailbox rows are persisted as JSONL and rebuilt on
@@ -90,8 +108,8 @@ function safeParse(payload) {
 // regular files that POSIX local filesystems do, so the removal above is
 // equally valid on Windows. No platform-specific code is needed here.
 function appendLine(filePath, obj) {
-  fs.appendFileSync(filePath, JSON.stringify(obj) + '\n', 'utf8');
-  try { fs.chmodSync(filePath, 0o600); } catch { /* best effort */ }
+  fs.appendFileSync(filePath, JSON.stringify(obj) + '\n', { encoding: 'utf8', mode: PRIVATE_FILE_MODE });
+  bestEffortChmod(filePath, PRIVATE_FILE_MODE);
 }
 
 function readLines(filePath) {
@@ -112,11 +130,13 @@ function readLines(filePath) {
 class MailboxStore {
   constructor(dataDir) {
     if (!dataDir) throw new Error('dataDir is required');
-    if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true });
+    ensurePrivateDir(dataDir);
     this.dataDir = dataDir;
 
     this._messagesFile = path.join(dataDir, 'messages.jsonl');
     this._stateFile = path.join(dataDir, 'state.json');
+    bestEffortChmod(this._messagesFile, PRIVATE_FILE_MODE);
+    bestEffortChmod(this._stateFile, PRIVATE_FILE_MODE);
 
     // in-memory indexes
     this._messages = new Map();          // id -> message object
@@ -156,7 +176,7 @@ class MailboxStore {
 
   _persistState() {
     const dir = path.dirname(this._stateFile);
-    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    ensurePrivateDir(dir);
     // Round-7 (§20.5): per-PID tmp path. Two evolver processes (daemon +
     // ad-hoc CLI / proxy + loop) writing to the same `${stateFile}.tmp`
     // would otherwise interleave: process B's writeFileSync truncates
@@ -167,7 +187,7 @@ class MailboxStore {
     // for 30 min..4 h" symptom this branch targets. Matches the
     // precedent set by _persistNodeSecret in src/gep/a2aProtocol.js.
     const tmp = `${this._stateFile}.${process.pid}.tmp`;
-    fs.writeFileSync(tmp, JSON.stringify(this._state, null, 2) + '\n', 'utf8');
+    writePrivateFile(tmp, JSON.stringify(this._state, null, 2) + '\n');
     // Windows: fs.renameSync throws EPERM when the destination file already
     // exists, unlike POSIX where rename(2) atomically replaces the target.
     // Remove the destination first so the rename succeeds on all platforms.
@@ -179,6 +199,7 @@ class MailboxStore {
       }
     }
     fs.renameSync(tmp, this._stateFile);
+    bestEffortChmod(this._stateFile, PRIVATE_FILE_MODE);
   }
 
   _rebuildIndex() {
@@ -436,11 +457,12 @@ class MailboxStore {
     }
     entries.sort((a, b) => a.created_at - b.created_at);
 
-    const fd = fs.openSync(tmpFile, 'w');
+    const fd = fs.openSync(tmpFile, 'w', PRIVATE_FILE_MODE);
     for (const msg of entries) {
       fs.writeSync(fd, JSON.stringify(msg) + '\n');
     }
     fs.closeSync(fd);
+    bestEffortChmod(tmpFile, PRIVATE_FILE_MODE);
     // Windows: renameSync throws EPERM when the destination already exists.
     // Remove it first so the swap succeeds on all platforms.
     if (process.platform === 'win32') {
@@ -449,6 +471,7 @@ class MailboxStore {
       }
     }
     fs.renameSync(tmpFile, this._messagesFile);
+    bestEffortChmod(this._messagesFile, PRIVATE_FILE_MODE);
     this._rebuildIndex();
   }
 

package/src/proxy/router/responses_route.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const { createProxyTrace } = require('../trace/extractor');
+
+const OPENAI_RESPONSE_HEADER_ALLOWLIST = new Set([
+  'openai-processing-ms',
+  'openai-version',
+  'retry-after',
+  'x-request-id',
+]);
+
+function hasOpenAIUpstreamCredential() {
+  if (process.env.EVOMAP_OPENAI_API_KEY || process.env.OPENAI_API_KEY) return true;
+  return false;
+}
+
+function upstreamStatus(err, fallback = 502) {
+  const status = Number(err && err.statusCode);
+  return Number.isFinite(status) ? status : fallback;
+}
+
+function safeOpenAIConfigDiagnostic(err) {
+  const message = err && typeof err.message === 'string' ? err.message : '';
+  if (message.startsWith('[proxy] EVOMAP_OPENAI_BASE_URL ')) return message;
+  return '';
+}
+
+function asUpstreamError(err, fallback = 502) {
+  if (err && err.statusCode && /^openai upstream /.test(err.message || '')) return err;
+  const diagnostic = safeOpenAIConfigDiagnostic(err);
+  const message = diagnostic
+    ? `openai upstream request failed: ${diagnostic}`
+    : 'openai upstream request failed';
+  const out = new Error(message);
+  out.statusCode = upstreamStatus(err, fallback);
+  out.cause = err;
+  return out;
+}
+
+function responseToBody(raw, status, headers, log) {
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    log.warn?.(JSON.stringify({
+      event: 'openai_responses_fallback',
+      reason: 'upstream_non_json',
+      upstream_status: status,
+      content_type: headers && headers['content-type'] || '',
+      response_bytes: Buffer.byteLength(raw),
+    }));
+    return { error: raw };
+  }
+}
+
+function copyOpenAIResponseHeaders(headers = {}) {
+  const out = {};
+  for (const [name, value] of Object.entries(headers || {})) {
+    const lower = String(name || '').toLowerCase();
+    if (!OPENAI_RESPONSE_HEADER_ALLOWLIST.has(lower) && !lower.startsWith('x-ratelimit-')) continue;
+    if (value === undefined || value === null) continue;
+    const headerValue = Array.isArray(value) ? value.join(', ') : String(value);
+    if (/[\r\n]/.test(headerValue)) continue;
+    out[lower] = headerValue;
+  }
+  return out;
+}
+
+function buildResponsesHandler({ openAIProxy, logger, traceStore, onTraceQueued } = {}) {
+  if (typeof openAIProxy !== 'function') {
+    throw new Error('buildResponsesHandler requires openAIProxy(path, body, opts)');
+  }
+  const log = logger || console;
+
+  return async ({ body, headers }) => {
+    const inboundHeaders = headers || {};
+    if (!hasOpenAIUpstreamCredential()) {
+      throw Object.assign(new Error('openai api key required'), { statusCode: 401 });
+    }
+
+    const originalModel = body && typeof body.model === 'string' ? body.model : null;
+    let trace = null;
+    try {
+      trace = createProxyTrace({
+        route: 'POST /v1/responses',
+        headers: inboundHeaders,
+        body,
+        upstreamMode: 'openai',
+        originalModel,
+        chosenModel: originalModel,
+        store: traceStore,
+        logger: traceStore ? log : null,
+        onTraceQueued,
+      });
+    } catch (_) { /* best-effort trace; never break the request */ }
+
+    let upstream;
+    try {
+      upstream = await openAIProxy('/responses', body, {
+        inboundHeaders,
+        upstreamMode: 'openai',
+      });
+    } catch (err) {
+      const wrapped = asUpstreamError(err, upstreamStatus(err));
+      trace?.record({ status: wrapped.statusCode, error: wrapped, upstreamMode: 'openai', model: originalModel });
+      throw wrapped;
+    }
+
+    if (upstream.stream) {
+      const forwardHeaders = copyOpenAIResponseHeaders(upstream.headers);
+      const ct = upstream.headers && upstream.headers['content-type'];
+      if (ct) forwardHeaders['Content-Type'] = ct;
+      trace?.recordStreamStart({
+        status: upstream.status,
+        upstreamMode: 'openai',
+        model: originalModel,
+        headers: forwardHeaders,
+      });
+      return {
+        status: upstream.status,
+        stream: upstream.stream,
+        headers: forwardHeaders,
+      };
+    }
+
+    let raw = '';
+    if (upstream.text) {
+      try {
+        raw = await upstream.text();
+      } catch (err) {
+        const wrapped = asUpstreamError(err, upstreamStatus(err));
+        trace?.record({ status: wrapped.statusCode, error: wrapped, upstreamMode: 'openai', model: originalModel });
+        throw wrapped;
+      }
+    }
+    const respBody = responseToBody(raw, upstream.status, upstream.headers, log);
+    trace?.record({
+      status: upstream.status,
+      responseBody: respBody,
+      upstreamMode: 'openai',
+      model: originalModel,
+      headers: upstream.headers,
+    });
+    return {
+      status: upstream.status,
+      body: respBody,
+      headers: copyOpenAIResponseHeaders(upstream.headers),
+    };
+  };
+}
+
+module.exports = {
+  buildResponsesHandler,
+  copyOpenAIResponseHeaders,
+  hasOpenAIUpstreamCredential,
+  responseToBody,
+};

package/src/proxy/server/http.js

@@ -64,12 +64,21 @@ function parseBody(req, opts) {
   });
 }
 
-function sendJson(res, status, body) {
+function sendJson(res, status, body, extraHeaders = {}) {
   const payload = JSON.stringify(body);
-  res.writeHead(status, {
+  const headers = {
     'Content-Type': 'application/json',
     'Content-Length': Buffer.byteLength(payload),
-  });
+  };
+  for (const [name, value] of Object.entries(extraHeaders || {})) {
+    if (value === undefined || value === null) continue;
+    const lower = String(name).toLowerCase();
+    if (lower === 'content-length' || lower === 'transfer-encoding' || lower === 'connection') continue;
+    const headerValue = Array.isArray(value) ? value.join(', ') : String(value);
+    if (/[\r\n]/.test(headerValue)) continue;
+    headers[name] = headerValue;
+  }
+  res.writeHead(status, headers);
   res.end(payload);
 }
 
@@ -196,7 +205,7 @@ class ProxyHttpServer {
       if (result && result.stream) {
         await this._streamResponse(res, result);
       } else {
-        sendJson(res, result.status || 200, result.body || result);
+        sendJson(res, result.status || 200, result.body || result, result.headers);
       }
     } catch (err) {
       this.logger.error(`[proxy] ${routeKey} error:`, err.message);

package/src/proxy/server/routes.js

@@ -3,7 +3,14 @@
 const { PROXY_PROTOCOL_VERSION, SCHEMA_VERSION } = require('../mailbox/store');
 
 function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
-  const { dmHandler, skillUpdater, getHubMailboxStatus, sessionHandler, messagesHandler } = extensions || {};
+  const {
+    dmHandler,
+    skillUpdater,
+    getHubMailboxStatus,
+    sessionHandler,
+    messagesHandler,
+    responsesHandler,
+  } = extensions || {};
   const routes = {
     // -- Mailbox --
     'POST /mailbox/send': async ({ body }) => {
@@ -466,6 +473,9 @@ function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
   if (messagesHandler) {
     routes['POST /v1/messages'] = messagesHandler;
   }
+  if (responsesHandler) {
+    routes['POST /v1/responses'] = responsesHandler;
+  }
 
   return routes;
 }

package/src/proxy/sync/engine.js

@@ -8,13 +8,14 @@ const DEFAULT_OUTBOUND_INTERVAL = 5_000;
 const IDLE_THRESHOLD = 5 * 60_000;
 
 class SyncEngine {
-  constructor({ store, hubUrl, getHeaders, logger, onInboundReceived, onAuthError }) {
+  constructor({ store, hubUrl, getHeaders, logger, onInboundReceived, onAuthError, onOutboundFlushed }) {
     this.store = store;
     this.hubUrl = hubUrl;
     this.logger = logger || console;
     this.getHeaders = getHeaders;
     this.onInboundReceived = onInboundReceived || null;
     this.onAuthError = onAuthError || null;
+    this.onOutboundFlushed = onOutboundFlushed || null;
 
     this.outbound = new OutboundSync({ store, hubUrl, getHeaders, logger });
     this.inbound = new InboundSync({ store, hubUrl, getHeaders, logger });
@@ -82,6 +83,11 @@ class SyncEngine {
         try {
           const result = await this.outbound.flush();
           if (result.sent > 0) this._lastActivity = Date.now();
+          if ((result.sent > 0 || result.dropped > 0) && typeof this.onOutboundFlushed === 'function') {
+            try { this.onOutboundFlushed(result); } catch (e) {
+              this.logger.warn?.('[sync] onOutboundFlushed callback failed:', e.message);
+            }
+          }
         } catch (err) {
           if (err instanceof AuthError) {
             await this._handleAuthError('outbound');

package/src/proxy/sync/outbound.js

@@ -2,6 +2,7 @@
 
 const { PROXY_PROTOCOL_VERSION } = require('../mailbox/store');
 const { AuthError } = require('../lifecycle/manager');
+const { isProxyTraceUploadPayloadAllowed, resolveTraceMode } = require('../trace/extractor');
 const { hubFetch } = require('../../gep/hubFetch');
 
 const MAX_BATCH = 50;
@@ -16,8 +17,31 @@ class OutboundSync {
   }
 
   async flush(channel = 'evomap-hub') {
-    const pending = this.store.pollOutbound({ channel, limit: MAX_BATCH });
-    if (pending.length === 0) return { sent: 0 };
+    const pendingBatch = this.store.pollOutbound({ channel, limit: MAX_BATCH });
+    if (pendingBatch.length === 0) return { sent: 0 };
+
+    let pending = pendingBatch;
+    const rejectedTraceUploads = [];
+    const traceUploadEnabled = resolveTraceMode(process.env, { store: this.store });
+    for (const m of pendingBatch) {
+      if (m.type !== 'proxy_trace') continue;
+      if (!traceUploadEnabled) {
+        rejectedTraceUploads.push({ id: m.id, error: 'proxy trace upload disabled' });
+      } else if (!isProxyTraceUploadPayloadAllowed(m.payload, process.env)) {
+        rejectedTraceUploads.push({ id: m.id, error: 'proxy trace payload rejected' });
+      }
+    }
+    if (rejectedTraceUploads.length > 0) {
+      this.store.updateStatusBatch(rejectedTraceUploads.map(m => ({
+        id: m.id,
+        status: 'rejected',
+        error: m.error,
+      })));
+      const rejectedIds = new Set(rejectedTraceUploads.map(m => m.id));
+      pending = pendingBatch.filter(m => !rejectedIds.has(m.id));
+      if (pending.length === 0) return { sent: 0, dropped: rejectedTraceUploads.length };
+    }
+    const dropped = rejectedTraceUploads.length;
 
     const endpoint = `${this.hubUrl}/a2a/mailbox/outbound`;
 
@@ -83,14 +107,18 @@ class OutboundSync {
       if (inboundMessages.length > 0) this.store.writeInboundBatch(inboundMessages);
 
       this.store.setState('last_sync_at', new Date().toISOString());
-      return { sent: pending.length, synced: updates.length, responses: inboundMessages.length };
+      const result = { sent: pending.length, synced: updates.length, responses: inboundMessages.length };
+      if (dropped > 0) result.dropped = dropped;
+      return result;
     } catch (err) {
       if (err instanceof AuthError) throw err;
       this.logger.error(`[outbound] flush failed: ${err.message}`);
       for (const m of pending) {
         this.store.incrementRetry(m.id, err.message);
       }
-      return { sent: 0, error: err.message };
+      const result = { sent: 0, error: err.message };
+      if (dropped > 0) result.dropped = dropped;
+      return result;
     }
   }
 }