@galaxyproject/orbit 0.0.0 → 0.9.0

package/extensions/orbit/profiles.ts

@@ -0,0 +1,270 @@
+/**
+ * Galaxy server profile management
+ *
+ * Stores named profiles in the `galaxy` section of ~/.orbit/config.json.
+ * Each profile holds a URL + API key. The active profile reaches the Galaxy
+ * MCP server through GALAXY_URL/GALAXY_API_KEY in the process env, which
+ * mcp-servers.ts references when it registers the server.
+ */
+
+import { loadConfig, saveConfig } from "./config";
+import { galaxyCredentials } from "./galaxy-api";
+import { normalizeGalaxyUrl } from "../../shared/galaxy-url.js";
+
+export { normalizeGalaxyUrl };
+
+export interface GalaxyProfile {
+  url: string;
+  /** Plaintext API key. Orbit migrates this to apiKeyEncrypted on next startup. */
+  apiKey?: string;
+  /** Base64 ciphertext produced by Electron safeStorage (Orbit-only). */
+  apiKeyEncrypted?: string;
+}
+
+/**
+ * Thrown when the brain process is asked to use a profile that only has
+ * `apiKeyEncrypted` set. The brain runs without Electron's safeStorage,
+ * so it cannot decrypt the key itself -- the shell must inject the
+ * decrypted value as `GALAXY_API_KEY` in the brain's env (Orbit does
+ * this in `app/src/main/agent.ts:buildSecretEnv`). When the env
+ * injection is also missing, callers see this error instead of a
+ * silent fallback that would 401 against Galaxy.
+ */
+export class EncryptedProfileUnavailableError extends Error {
+  constructor(public profileName: string) {
+    super(
+      `Profile "${profileName}" has only an encrypted API key; this process can't decrypt it. ` +
+        `Run from Orbit (auto-injects the key) or export GALAXY_URL and GALAXY_API_KEY explicitly.`,
+    );
+    this.name = "EncryptedProfileUnavailableError";
+  }
+}
+
+export interface GalaxyProfiles {
+  active: string | null;
+  profiles: Record<string, GalaxyProfile>;
+}
+
+export function loadProfiles(): GalaxyProfiles {
+  const config = loadConfig();
+  if (config.galaxy) {
+    return {
+      active: config.galaxy.active ?? null,
+      profiles: config.galaxy.profiles ?? {},
+    };
+  }
+  return { active: null, profiles: {} };
+}
+
+function writeProfiles(profiles: GalaxyProfiles): void {
+  const config = loadConfig();
+  config.galaxy = {
+    active: profiles.active,
+    profiles: profiles.profiles,
+  };
+  saveConfig(config);
+}
+
+/**
+ * Derive a short profile name from a Galaxy server URL.
+ * https://test.galaxyproject.org/ → "test-galaxyproject"
+ * https://usegalaxy.org/ → "usegalaxy-org"
+ * http://localhost:8080/ → "localhost-8080"
+ */
+export function profileNameFromUrl(url: string): string {
+  try {
+    const parsed = new URL(url);
+    let host = parsed.hostname;
+    // Include port for non-standard ports
+    if (parsed.port) {
+      host += `-${parsed.port}`;
+    }
+    // Replace dots with hyphens, drop trailing TLD-only segments for cleaner names
+    return host.replace(/\./g, "-").replace(/-+$/, "");
+  } catch {
+    // Fallback: slugify the whole string
+    return url
+      .replace(/[^a-zA-Z0-9]+/g, "-")
+      .replace(/^-|-$/g, "")
+      .toLowerCase();
+  }
+}
+
+/**
+ * Validate a candidate Galaxy server URL. The API key is sent as
+ * `x-api-key` on every request; if the URL is `http://` (or otherwise
+ * malformed), the key would be exposed in cleartext or land at the
+ * wrong host. Reject bad URLs at save time so the user sees the
+ * mistake instead of silently exfiltrating credentials.
+ *
+ * Hosts outside `*.galaxyproject.org` and `localhost`/`127.*` are
+ * accepted but with a warning to the console — institutions run
+ * private Galaxy mirrors, so an allowlist would be too narrow.
+ */
+/**
+ * True for an IPv4 loopback (127.0.0.0/8), localhost, or IPv6 ::1. A bare
+ * `startsWith("127.")` would wrongly accept a resolvable hostname like
+ * `127.evil.example`, which over http would leak the API key in cleartext.
+ */
+function isLoopbackHost(host: string): boolean {
+  return host === "localhost" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) || host === "::1";
+}
+
+export function validateGalaxyUrl(url: string): { ok: true } | { ok: false; reason: string } {
+  let parsed: URL;
+  try {
+    parsed = new URL(url.trim());
+  } catch {
+    return { ok: false, reason: "Not a valid URL." };
+  }
+  if (parsed.protocol === "http:") {
+    const host = parsed.hostname.toLowerCase();
+    if (isLoopbackHost(host)) {
+      // Loopback HTTP is fine for local Galaxy installs.
+      return { ok: true };
+    }
+    return {
+      ok: false,
+      reason: "Galaxy URL must use https:// (the API key is sent on every request).",
+    };
+  }
+  if (parsed.protocol !== "https:") {
+    return { ok: false, reason: `Unsupported URL scheme: ${parsed.protocol}` };
+  }
+  return { ok: true };
+}
+
+/**
+ * Save a profile (insert or update) and mark it active.
+ *
+ * The brain process can't encrypt (no Electron safeStorage), so the
+ * plaintext key lands on disk briefly. Orbit's main process watches
+ * `~/.orbit/config.json` and re-encrypts on change, closing the plaintext
+ * window to milliseconds. CLI users without safeStorage get plaintext
+ * persistence -- there's no other option, but they're warned at load time.
+ */
+export function saveProfile(name: string, url: string, apiKey: string): void {
+  const v = validateGalaxyUrl(url);
+  if (!v.ok) throw new Error(v.reason);
+  const host = new URL(url).hostname.toLowerCase();
+  const trusted =
+    isLoopbackHost(host) || host === "galaxyproject.org" || host.endsWith(".galaxyproject.org");
+  if (!trusted) {
+    console.warn(
+      `[galaxy] Profile "${name}" points at ${host} (not a galaxyproject.org subdomain).`,
+    );
+  }
+  const profiles = loadProfiles();
+  profiles.profiles[name] = { url, apiKey };
+  profiles.active = name;
+  writeProfiles(profiles);
+}
+
+/**
+ * Resolve a profile's plaintext API key for in-process use (Galaxy HTTP
+ * calls inside the brain). Returns the plaintext value when available,
+ * or throws `EncryptedProfileUnavailableError` for encrypted-only
+ * profiles -- callers must surface that to the user rather than firing
+ * the wrong key at the server.
+ */
+export function resolveProfileApiKey(name: string, profile: GalaxyProfile): string {
+  if (profile.apiKey) return profile.apiKey;
+  if (profile.apiKeyEncrypted) {
+    throw new EncryptedProfileUnavailableError(name);
+  }
+  throw new Error(`Profile "${name}" has no API key configured.`);
+}
+
+export type ActiveGalaxyStatus = "usable" | "configured-unusable" | "none";
+
+/**
+ * Usability of the active Galaxy profile for THIS process. The startup greeting
+ * reads this so its message can't contradict the actual credential state.
+ *
+ * - `usable`: GALAXY_URL + GALAXY_API_KEY are both in env (however they got
+ *   there -- plaintext profile, explicit export, or Orbit's decrypt-inject).
+ * - `configured-unusable`: no usable env key, but the active profile carries an
+ *   encrypted key this process can't decrypt (Orbit-only safeStorage). Galaxy
+ *   calls would 401; the fix is to run from Orbit or export GALAXY_URL and
+ *   GALAXY_API_KEY together.
+ * - `none`: no usable active profile to speak of.
+ *
+ * Pure given (profiles, env); without `env` it reads the live credentials, which
+ * is what `activeGalaxyStatus()`, the thin live wrapper, does.
+ */
+export function getActiveGalaxyStatus(
+  profiles: GalaxyProfiles,
+  env?: NodeJS.ProcessEnv,
+): ActiveGalaxyStatus {
+  const { url, apiKey } = galaxyCredentials(env);
+  if (url && apiKey) return "usable";
+  const active = profiles.active;
+  if (!active) return "none";
+  const profile = profiles.profiles[active];
+  if (profile && !profile.apiKey && !apiKey && profile.apiKeyEncrypted) {
+    return "configured-unusable";
+  }
+  return "none";
+}
+
+export function activeGalaxyStatus(): ActiveGalaxyStatus {
+  return getActiveGalaxyStatus(loadProfiles());
+}
+
+/**
+ * Switch to an existing profile. Updates the active marker and sets process.env so the current session picks it up immediately.
+ *
+ * Two paths for the API key:
+ *   1) plaintext `apiKey` -> set env to it.
+ *   2) encrypted-only -> CLEAR `process.env.GALAXY_API_KEY`. The brain
+ *      can't decrypt to verify whether any value already in env matches
+ *      *this* profile's ciphertext (the env was injected for whatever
+ *      profile was active at brain spawn). Better to fail loud than to
+ *      silently send the previous profile's key to the new URL. The
+ *      shell will re-inject on the next brain restart from the now-active
+ *      encrypted profile.
+ */
+export function switchProfile(name: string): boolean {
+  const profiles = loadProfiles();
+  const profile = profiles.profiles[name];
+  if (!profile) return false;
+
+  profiles.active = name;
+  writeProfiles(profiles);
+
+  // Saved before /api was stripped, or hand-edited -- either way the env is what
+  // every Galaxy client reads.
+  process.env.GALAXY_URL = normalizeGalaxyUrl(profile.url);
+  if (profile.apiKey) {
+    process.env.GALAXY_API_KEY = profile.apiKey;
+  } else if (profile.apiKeyEncrypted) {
+    // Always invalidate; let the shell restart re-inject the right value.
+    delete process.env.GALAXY_API_KEY;
+    console.warn(
+      `[galaxy] Profile "${name}" has only an encrypted API key. Cleared ` +
+        `GALAXY_API_KEY in this session; restart the shell so Orbit can ` +
+        `re-inject the decrypted key for this profile.`,
+    );
+  } else {
+    // A keyless profile (hand-edited config) must not inherit the previous
+    // profile's key against its own URL.
+    delete process.env.GALAXY_API_KEY;
+  }
+  return true;
+}
+
+/**
+ * Remove a profile. If it was active, clears the active marker.
+ */
+export function deleteProfile(name: string): boolean {
+  const profiles = loadProfiles();
+  if (!profiles.profiles[name]) return false;
+
+  delete profiles.profiles[name];
+  if (profiles.active === name) {
+    const remaining = Object.keys(profiles.profiles);
+    profiles.active = remaining.length > 0 ? remaining[0] : null;
+  }
+  writeProfiles(profiles);
+  return true;
+}

package/extensions/orbit/progress-updates.ts

@@ -0,0 +1,95 @@
+/** User-visible heartbeats from observed events; never invoke the model. */
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { galaxyCall } from "./galaxy-recovery";
+import type { GalaxyToolFamily } from "../../shared/galaxy-tool-family.js";
+
+export const PROGRESS_INTERVAL_MS = 60_000;
+
+function describeTool(
+  name: string,
+  input: Record<string, unknown>,
+  family: GalaxyToolFamily,
+): string {
+  // Orbit's own galaxy_* tools (upload, job/invocation records) count as Galaxy work too.
+  const galaxy =
+    galaxyCall(name, input, family)?.name ?? (name.startsWith("galaxy_") ? name : undefined);
+  if (galaxy) {
+    if (/get_(dataset|job|history|invocation)/.test(galaxy))
+      return "checking Galaxy data and job status";
+    if (/search_|get_tool/.test(galaxy)) return "inspecting available Galaxy tools";
+    if (/run_|invoke_/.test(galaxy)) return "submitting work to Galaxy";
+    if (/upload_/.test(galaxy)) return "uploading analysis inputs to Galaxy";
+    return "working with Galaxy";
+  }
+  if (name === "bash") return "executing a local command";
+  if (/^(read|grep|glob|ls|find)$/.test(name)) return "examining project files";
+  if (/^(write|edit)$/.test(name)) return "updating project files";
+  if (name === "mcp_read_output") return "inspecting saved tool output";
+  return "executing an analysis tool";
+}
+
+export function registerProgressUpdates(pi: ExtensionAPI, family: GalaxyToolFamily): void {
+  let ctx: ExtensionContext | undefined;
+  let timer: ReturnType<typeof setInterval> | undefined;
+  let startedAt = 0;
+  let lastVisibleAt = 0;
+  let completed = 0;
+  let errors = 0;
+  const active = new Map<string, string>();
+
+  const stop = () => {
+    if (timer) clearInterval(timer);
+    timer = undefined;
+    ctx = undefined;
+    active.clear();
+  };
+  const notify = (text: string) => {
+    try {
+      if (ctx?.hasUI) ctx.ui.notify(text, "info");
+    } catch {
+      stop(); // A stale session must not emit into a replacement conversation.
+    }
+    lastVisibleAt = Date.now();
+  };
+  pi.on("agent_start", (_event, context) => {
+    stop();
+    ctx = context;
+    startedAt = lastVisibleAt = Date.now();
+    completed = errors = 0;
+    timer = setInterval(() => {
+      if (Date.now() - lastVisibleAt < PROGRESS_INTERVAL_MS) return;
+      const minutes = Math.max(1, Math.floor((Date.now() - startedAt) / 60_000));
+      const current = active.values().next().value;
+      const state = current
+        ? `Currently ${current}.`
+        : "Waiting for the assistant's next response.";
+      notify(
+        `Progress (${minutes} min): ${state} ${completed} tool call${completed === 1 ? " has" : "s have"} returned${errors ? `, including ${errors} error${errors === 1 ? "" : "s"}` : ""}. Analysis results still require verification.`,
+      );
+    }, PROGRESS_INTERVAL_MS);
+    timer.unref?.();
+  });
+  pi.on("tool_execution_start", (event) => {
+    if (!timer) return;
+    const description = describeTool(event.toolName, event.args, family);
+    if (!active.size && completed === 0) notify(`Progress: ${description}.`);
+    active.set(event.toolCallId, description);
+  });
+  pi.on("tool_execution_end", (event) => {
+    if (!timer) return;
+    active.delete(event.toolCallId);
+    completed++;
+    if (event.isError) errors++;
+  });
+  pi.on("message_end", (event) => {
+    const message = event.message;
+    if (
+      message.role === "assistant" &&
+      message.content.some((c) => c.type === "text" && c.text.trim())
+    )
+      lastVisibleAt = Date.now();
+  });
+  pi.on("agent_end", stop);
+  pi.on("session_start", stop);
+  pi.on("session_shutdown", stop);
+}