@gokulvenkatareddy/cortex 0.1.7

package/apps/octogent/apps/api/src/createApiServer/monitorParsers.ts

@@ -0,0 +1,137 @@
+import type { MonitorConfigPatchInput } from "../monitor";
+
+export const parseMonitorConfigPatch = (
+  payload: unknown,
+): { patch: MonitorConfigPatchInput | null; error: string | null } => {
+  if (payload === null || payload === undefined || typeof payload !== "object") {
+    return {
+      patch: null,
+      error: "Expected a JSON object body.",
+    };
+  }
+
+  const record = payload as Record<string, unknown>;
+  const patch: MonitorConfigPatchInput = {};
+
+  if (record.providerId !== undefined) {
+    if (record.providerId !== "x") {
+      return {
+        patch: null,
+        error: "providerId must be 'x'.",
+      };
+    }
+
+    patch.providerId = "x";
+  }
+
+  if (record.queryTerms !== undefined) {
+    if (!Array.isArray(record.queryTerms)) {
+      return {
+        patch: null,
+        error: "queryTerms must be an array of strings.",
+      };
+    }
+
+    const queryTerms = record.queryTerms.filter((term): term is string => typeof term === "string");
+    if (queryTerms.length !== record.queryTerms.length) {
+      return {
+        patch: null,
+        error: "queryTerms must be an array of strings.",
+      };
+    }
+
+    patch.queryTerms = queryTerms;
+  }
+
+  if (record.refreshPolicy !== undefined) {
+    if (
+      record.refreshPolicy === null ||
+      typeof record.refreshPolicy !== "object" ||
+      Array.isArray(record.refreshPolicy)
+    ) {
+      return {
+        patch: null,
+        error: "refreshPolicy must be an object.",
+      };
+    }
+
+    const refreshPolicyRecord = record.refreshPolicy as Record<string, unknown>;
+    if (
+      refreshPolicyRecord.maxCacheAgeMs !== undefined &&
+      (typeof refreshPolicyRecord.maxCacheAgeMs !== "number" ||
+        !Number.isFinite(refreshPolicyRecord.maxCacheAgeMs) ||
+        refreshPolicyRecord.maxCacheAgeMs <= 0)
+    ) {
+      return {
+        patch: null,
+        error: "refreshPolicy.maxCacheAgeMs must be a positive number.",
+      };
+    }
+
+    if (
+      refreshPolicyRecord.maxPosts !== undefined &&
+      (typeof refreshPolicyRecord.maxPosts !== "number" ||
+        !Number.isFinite(refreshPolicyRecord.maxPosts) ||
+        refreshPolicyRecord.maxPosts <= 0)
+    ) {
+      return {
+        patch: null,
+        error: "refreshPolicy.maxPosts must be a positive number.",
+      };
+    }
+
+    if (
+      refreshPolicyRecord.searchWindowDays !== undefined &&
+      (typeof refreshPolicyRecord.searchWindowDays !== "number" ||
+        !Number.isFinite(refreshPolicyRecord.searchWindowDays) ||
+        ![1, 3, 7].includes(Math.floor(refreshPolicyRecord.searchWindowDays)))
+    ) {
+      return {
+        patch: null,
+        error: "refreshPolicy.searchWindowDays must be one of: 1, 3, 7.",
+      };
+    }
+
+    patch.refreshPolicy = {};
+    if (refreshPolicyRecord.maxCacheAgeMs !== undefined) {
+      patch.refreshPolicy.maxCacheAgeMs = refreshPolicyRecord.maxCacheAgeMs;
+    }
+    if (refreshPolicyRecord.maxPosts !== undefined) {
+      patch.refreshPolicy.maxPosts = refreshPolicyRecord.maxPosts;
+    }
+    if (refreshPolicyRecord.searchWindowDays !== undefined) {
+      patch.refreshPolicy.searchWindowDays = Math.floor(refreshPolicyRecord.searchWindowDays) as
+        | 1
+        | 3
+        | 7;
+    }
+  }
+
+  if (record.credentials !== undefined) {
+    if (
+      record.credentials === null ||
+      typeof record.credentials !== "object" ||
+      Array.isArray(record.credentials)
+    ) {
+      return {
+        patch: null,
+        error: "credentials must be an object.",
+      };
+    }
+
+    patch.credentials = record.credentials;
+  }
+
+  if (record.validateCredentials !== undefined) {
+    if (typeof record.validateCredentials !== "boolean") {
+      return {
+        patch: null,
+        error: "validateCredentials must be a boolean.",
+      };
+    }
+
+    patch.validateCredentials = record.validateCredentials;
+  }
+
+  return { patch, error: null };
+};

package/apps/octogent/apps/api/src/createApiServer/monitorRoutes.ts

@@ -0,0 +1,95 @@
+import { MonitorInputError } from "../monitor";
+import { parseMonitorConfigPatch } from "./monitorParsers";
+import type { ApiRouteHandler } from "./routeHelpers";
+import { readJsonBodyOrWriteError, writeJson, writeMethodNotAllowed } from "./routeHelpers";
+
+export const handleMonitorConfigRoute: ApiRouteHandler = async (
+  { request, response, requestUrl, corsOrigin },
+  { monitorService },
+) => {
+  if (requestUrl.pathname !== "/api/monitor/config") {
+    return false;
+  }
+
+  if (request.method === "GET") {
+    const payload = await monitorService.readConfig();
+    writeJson(response, 200, payload, corsOrigin);
+    return true;
+  }
+
+  if (request.method !== "PATCH") {
+    writeMethodNotAllowed(response, corsOrigin);
+    return true;
+  }
+
+  const bodyReadResult = await readJsonBodyOrWriteError(request, response, corsOrigin);
+  if (!bodyReadResult.ok) {
+    return true;
+  }
+
+  const patchResult = parseMonitorConfigPatch(bodyReadResult.payload);
+  if (patchResult.error || !patchResult.patch) {
+    writeJson(
+      response,
+      400,
+      { error: patchResult.error ?? "Invalid monitor config patch." },
+      corsOrigin,
+    );
+    return true;
+  }
+
+  try {
+    const payload = await monitorService.patchConfig(patchResult.patch);
+    writeJson(response, 200, payload, corsOrigin);
+    return true;
+  } catch (error) {
+    if (error instanceof MonitorInputError) {
+      writeJson(response, 400, { error: error.message }, corsOrigin);
+      return true;
+    }
+
+    throw error;
+  }
+};
+
+export const handleMonitorFeedRoute: ApiRouteHandler = async (
+  { request, response, requestUrl, corsOrigin },
+  { monitorService },
+) => {
+  if (requestUrl.pathname !== "/api/monitor/feed") {
+    return false;
+  }
+
+  if (request.method !== "GET") {
+    writeMethodNotAllowed(response, corsOrigin);
+    return true;
+  }
+
+  const payload = await monitorService.readFeed({
+    forceRefresh: false,
+    refreshIfStale: true,
+  });
+  writeJson(response, 200, payload, corsOrigin);
+  return true;
+};
+
+export const handleMonitorRefreshRoute: ApiRouteHandler = async (
+  { request, response, requestUrl, corsOrigin },
+  { monitorService },
+) => {
+  if (requestUrl.pathname !== "/api/monitor/refresh") {
+    return false;
+  }
+
+  if (request.method !== "POST") {
+    writeMethodNotAllowed(response, corsOrigin);
+    return true;
+  }
+
+  const payload = await monitorService.readFeed({
+    forceRefresh: true,
+    refreshIfStale: true,
+  });
+  writeJson(response, 200, payload, corsOrigin);
+  return true;
+};

package/apps/octogent/apps/api/src/createApiServer/requestHandler.ts

@@ -0,0 +1,311 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { extname, join } from "node:path";
+
+import type { UsageChartResponse } from "../claudeSessionScanner";
+import type { ClaudeUsageSnapshot } from "../claudeUsage";
+import type { CodeIntelStore } from "../codeIntelStore";
+import type { CodexUsageSnapshot } from "../codexUsage";
+import type { GitHubRepoSummarySnapshot } from "../githubRepoSummary";
+import { logVerbose } from "../logging";
+import type { MonitorService } from "../monitor";
+import { handleCodeIntelEventsRoute } from "./codeIntelRoutes";
+import {
+  handleConversationExportRoute,
+  handleConversationItemRoute,
+  handleConversationSearchRoute,
+  handleConversationsCollectionRoute,
+} from "./conversationRoutes";
+import {
+  handleDeckSkillsRoute,
+  handleDeckTentacleItemRoute,
+  handleDeckTentacleSkillsRoute,
+  handleDeckTentacleSwarmRoute,
+  handleDeckTentaclesRoute,
+  handleDeckTodoAddRoute,
+  handleDeckTodoDeleteRoute,
+  handleDeckTodoEditRoute,
+  handleDeckTodoSolveRoute,
+  handleDeckTodoToggleRoute,
+  handleDeckVaultFileRoute,
+} from "./deckRoutes";
+import { handleTentacleGitPullRequestRoute, handleTentacleGitRoute } from "./gitRoutes";
+import {
+  handleChannelMessagesRoute,
+  handleHookRoute,
+  handlePromptItemRoute,
+  handlePromptsCollectionRoute,
+  handleUiStateRoute,
+  handleWorkspaceSetupRoute,
+} from "./miscRoutes";
+import {
+  handleMonitorConfigRoute,
+  handleMonitorFeedRoute,
+  handleMonitorRefreshRoute,
+} from "./monitorRoutes";
+import type {
+  ApiRouteHandler,
+  RouteHandlerContext,
+  RouteHandlerDependencies,
+  TerminalRuntime,
+} from "./routeHelpers";
+import { writeJson, writeNoContent } from "./routeHelpers";
+import {
+  getRequestCorsOrigin,
+  isAllowedHostHeader,
+  isAllowedOriginHeader,
+  readHeaderValue,
+} from "./security";
+import {
+  handleTerminalItemRoute,
+  handleTerminalSnapshotsRoute,
+  handleTerminalsCollectionRoute,
+} from "./terminalRoutes";
+import {
+  handleClaudeUsageRoute,
+  handleCodexUsageRoute,
+  handleGithubSummaryRoute,
+  handleUsageHeatmapRoute,
+} from "./usageRoutes";
+
+const MIME_TYPES: Record<string, string> = {
+  ".html": "text/html",
+  ".js": "application/javascript",
+  ".css": "text/css",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+};
+
+type CreateApiRequestHandlerOptions = {
+  runtime: TerminalRuntime;
+  workspaceCwd: string;
+  projectStateDir: string;
+  promptsDir: string;
+  userPromptsDir: string;
+  webDistDir?: string | undefined;
+  getApiBaseUrl: () => string;
+  getApiPort: () => string;
+  readClaudeUsageSnapshot: () => Promise<ClaudeUsageSnapshot>;
+  readClaudeOauthUsageSnapshot: () => Promise<ClaudeUsageSnapshot>;
+  readClaudeCliUsageSnapshot: () => Promise<ClaudeUsageSnapshot>;
+  readCodexUsageSnapshot: () => Promise<CodexUsageSnapshot>;
+  readGithubRepoSummary: () => Promise<GitHubRepoSummarySnapshot>;
+  scanUsageHeatmap: (scope: "all" | "project") => Promise<UsageChartResponse>;
+  monitorService: MonitorService;
+  invalidateClaudeUsageCache: () => void;
+  codeIntelStore: CodeIntelStore;
+  allowRemoteAccess: boolean;
+};
+
+const API_ROUTE_MAP: ReadonlyMap<string, readonly ApiRouteHandler[]> = new Map([
+  ["channels", [handleChannelMessagesRoute]],
+  ["hooks", [handleHookRoute]],
+  ["prompts", [handlePromptsCollectionRoute, handlePromptItemRoute]],
+  [
+    "deck",
+    [
+      handleDeckSkillsRoute,
+      handleDeckTentaclesRoute,
+      handleDeckTentacleItemRoute,
+      handleDeckTentacleSkillsRoute,
+      handleDeckTodoSolveRoute,
+      handleDeckTentacleSwarmRoute,
+      handleDeckTodoToggleRoute,
+      handleDeckTodoEditRoute,
+      handleDeckTodoAddRoute,
+      handleDeckTodoDeleteRoute,
+      handleDeckVaultFileRoute,
+    ],
+  ],
+  ["terminal-snapshots", [handleTerminalSnapshotsRoute]],
+  ["codex", [handleCodexUsageRoute]],
+  ["claude", [handleClaudeUsageRoute]],
+  ["analytics", [handleUsageHeatmapRoute]],
+  ["github", [handleGithubSummaryRoute]],
+  ["setup", [handleWorkspaceSetupRoute]],
+  ["ui-state", [handleUiStateRoute]],
+  ["monitor", [handleMonitorConfigRoute, handleMonitorFeedRoute, handleMonitorRefreshRoute]],
+  [
+    "conversations",
+    [
+      handleConversationsCollectionRoute,
+      handleConversationSearchRoute,
+      handleConversationExportRoute,
+      handleConversationItemRoute,
+    ],
+  ],
+  ["terminals", [handleTerminalsCollectionRoute, handleTerminalItemRoute]],
+  ["tentacles", [handleTentacleGitRoute, handleTentacleGitPullRequestRoute]],
+  ["code-intel", [handleCodeIntelEventsRoute]],
+]);
+
+const extractRoutePrefix = (pathname: string): string | null => {
+  const segments = pathname.split("/");
+  if (segments.length < 3 || segments[1] !== "api") {
+    return null;
+  }
+  return segments[2] ?? null;
+};
+
+const logRequest = (method: string, path: string, status: number, startTime: number) => {
+  logVerbose(`[API] ${method} ${path} ${status} ${Date.now() - startTime}ms`);
+};
+
+const serveStaticFile = async (
+  response: ServerResponse,
+  webDistDir: string,
+  pathname: string,
+): Promise<boolean> => {
+  // Prevent path traversal.
+  const safePath = pathname.replace(/\.\./g, "").replace(/\/+/g, "/");
+  const filePath = join(webDistDir, safePath === "/" ? "index.html" : safePath);
+
+  try {
+    const content = await readFile(filePath);
+    const ext = extname(filePath);
+    const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
+    response.writeHead(200, { "Content-Type": contentType });
+    response.end(content);
+    return true;
+  } catch (error) {
+    const code = typeof error === "object" && error && "code" in error ? String(error.code) : "";
+    if (code !== "ENOENT") {
+      console.error(
+        `[API] Static file error: ${filePath}`,
+        error instanceof Error ? error.message : error,
+      );
+    }
+    return false;
+  }
+};
+
+export const createApiRequestHandler = ({
+  runtime,
+  workspaceCwd,
+  projectStateDir,
+  promptsDir,
+  userPromptsDir,
+  webDistDir,
+  getApiBaseUrl,
+  getApiPort,
+  readClaudeUsageSnapshot,
+  readClaudeOauthUsageSnapshot,
+  readClaudeCliUsageSnapshot,
+  readCodexUsageSnapshot,
+  readGithubRepoSummary,
+  scanUsageHeatmap,
+  monitorService,
+  invalidateClaudeUsageCache,
+  codeIntelStore,
+  allowRemoteAccess,
+}: CreateApiRequestHandlerOptions) => {
+  const resolvedWebDistDir = webDistDir && existsSync(webDistDir) ? webDistDir : null;
+
+  const routeDependencies: RouteHandlerDependencies = {
+    runtime,
+    workspaceCwd,
+    projectStateDir,
+    promptsDir,
+    userPromptsDir,
+    getApiBaseUrl,
+    getApiPort,
+    readClaudeUsageSnapshot,
+    readClaudeOauthUsageSnapshot,
+    readClaudeCliUsageSnapshot,
+    readCodexUsageSnapshot,
+    readGithubRepoSummary,
+    scanUsageHeatmap,
+    monitorService,
+    invalidateClaudeUsageCache,
+    codeIntelStore,
+  };
+
+  return async (request: IncomingMessage, response: ServerResponse) => {
+    const startTime = Date.now();
+    let statusCode = 0;
+    const originalWriteHead = response.writeHead.bind(response);
+    response.writeHead = ((...args: Parameters<typeof response.writeHead>) => {
+      statusCode = typeof args[0] === "number" ? args[0] : 0;
+      return originalWriteHead(...args);
+    }) as typeof response.writeHead;
+
+    const originHeader = readHeaderValue(request.headers.origin);
+    const hostHeader = readHeaderValue(request.headers.host);
+    const corsOrigin = getRequestCorsOrigin(originHeader, allowRemoteAccess);
+
+    if (!isAllowedHostHeader(hostHeader, allowRemoteAccess)) {
+      writeJson(response, 403, { error: "Host not allowed." }, null);
+      logRequest(request.method ?? "?", request.url ?? "/", 403, startTime);
+      return;
+    }
+
+    if (!isAllowedOriginHeader(originHeader, allowRemoteAccess)) {
+      writeJson(response, 403, { error: "Origin not allowed." }, null);
+      logRequest(request.method ?? "?", request.url ?? "/", 403, startTime);
+      return;
+    }
+
+    try {
+      const requestUrl = new URL(request.url ?? "/", "http://localhost");
+
+      if (request.method === "OPTIONS") {
+        writeNoContent(response, 204, corsOrigin);
+        logRequest(request.method ?? "OPTIONS", requestUrl.pathname, statusCode, startTime);
+        return;
+      }
+
+      const routeContext: RouteHandlerContext = {
+        request,
+        response,
+        requestUrl,
+        corsOrigin,
+      };
+
+      const prefix = extractRoutePrefix(requestUrl.pathname);
+      const handlers = prefix !== null ? API_ROUTE_MAP.get(prefix) : undefined;
+      if (handlers) {
+        for (const handleRoute of handlers) {
+          if (await handleRoute(routeContext, routeDependencies)) {
+            logRequest(request.method ?? "?", requestUrl.pathname, statusCode, startTime);
+            return;
+          }
+        }
+      }
+
+      // Serve static web frontend if available.
+      if (resolvedWebDistDir && request.method === "GET") {
+        const served =
+          (await serveStaticFile(response, resolvedWebDistDir, requestUrl.pathname)) ||
+          (await serveStaticFile(response, resolvedWebDistDir, "/"));
+        if (served) {
+          logRequest(request.method, requestUrl.pathname, 200, startTime);
+          return;
+        }
+      }
+
+      writeJson(response, 404, { error: "Not found" }, corsOrigin);
+      logRequest(request.method ?? "?", requestUrl.pathname, statusCode, startTime);
+    } catch (error) {
+      console.error(
+        `[API] Unhandled error: ${request.method ?? "?"} ${request.url ?? "/"}`,
+        error instanceof Error ? (error.stack ?? error.message) : error,
+      );
+      writeJson(
+        response,
+        500,
+        {
+          error: "Internal server error",
+        },
+        corsOrigin,
+      );
+      logRequest(request.method ?? "?", request.url ?? "/", statusCode, startTime);
+    }
+  };
+};

package/apps/octogent/apps/api/src/createApiServer/requestParsers.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage } from "node:http";
+
+const MAX_JSON_BODY_BYTES = 1024 * 1024;
+
+export class RequestBodyTooLargeError extends Error {}
+
+export const readJsonBody = async (request: IncomingMessage): Promise<unknown> => {
+  let totalBytes = 0;
+  const chunks: Buffer[] = [];
+  for await (const chunk of request) {
+    const nextChunk = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    totalBytes += nextChunk.length;
+    if (totalBytes > MAX_JSON_BODY_BYTES) {
+      throw new RequestBodyTooLargeError("Request body too large.");
+    }
+    chunks.push(nextChunk);
+  }
+
+  const payload = Buffer.concat(chunks).toString("utf8").trim();
+  if (payload.length === 0) {
+    return null;
+  }
+
+  return JSON.parse(payload);
+};

package/apps/octogent/apps/api/src/createApiServer/routeHelpers.ts

@@ -0,0 +1,97 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+import type { UsageChartResponse } from "../claudeSessionScanner";
+import type { ClaudeUsageSnapshot } from "../claudeUsage";
+import type { CodeIntelStore } from "../codeIntelStore";
+import type { CodexUsageSnapshot } from "../codexUsage";
+import type { GitHubRepoSummarySnapshot } from "../githubRepoSummary";
+import type { MonitorService } from "../monitor";
+import { RequestBodyTooLargeError, readJsonBody } from "./requestParsers";
+import { withCors } from "./security";
+
+export type TerminalRuntime = ReturnType<typeof import("../terminalRuntime").createTerminalRuntime>;
+
+export type RouteHandlerDependencies = {
+  runtime: TerminalRuntime;
+  workspaceCwd: string;
+  projectStateDir: string;
+  promptsDir: string;
+  userPromptsDir: string;
+  getApiBaseUrl: () => string;
+  getApiPort: () => string;
+  readClaudeUsageSnapshot: () => Promise<ClaudeUsageSnapshot>;
+  readClaudeOauthUsageSnapshot: () => Promise<ClaudeUsageSnapshot>;
+  readClaudeCliUsageSnapshot: () => Promise<ClaudeUsageSnapshot>;
+  readCodexUsageSnapshot: () => Promise<CodexUsageSnapshot>;
+  readGithubRepoSummary: () => Promise<GitHubRepoSummarySnapshot>;
+  scanUsageHeatmap: (scope: "all" | "project") => Promise<UsageChartResponse>;
+  monitorService: MonitorService;
+  invalidateClaudeUsageCache: () => void;
+  codeIntelStore: CodeIntelStore;
+};
+
+export type RouteHandlerContext = {
+  request: IncomingMessage;
+  response: ServerResponse;
+  requestUrl: URL;
+  corsOrigin: string | null;
+};
+
+type JsonBodyReadResult = { ok: true; payload: unknown } | { ok: false };
+export type ApiRouteHandler = (
+  context: RouteHandlerContext,
+  dependencies: RouteHandlerDependencies,
+) => Promise<boolean>;
+
+export const writeJson = (
+  response: ServerResponse,
+  status: number,
+  payload: unknown,
+  corsOrigin: string | null,
+) => {
+  response.writeHead(status, withCors({ "Content-Type": "application/json" }, corsOrigin));
+  response.end(JSON.stringify(payload));
+};
+
+export const writeText = (
+  response: ServerResponse,
+  status: number,
+  payload: string,
+  contentType: string,
+  corsOrigin: string | null,
+) => {
+  response.writeHead(status, withCors({ "Content-Type": contentType }, corsOrigin));
+  response.end(payload);
+};
+
+export const writeNoContent = (
+  response: ServerResponse,
+  status: number,
+  corsOrigin: string | null,
+) => {
+  response.writeHead(status, withCors({}, corsOrigin));
+  response.end();
+};
+
+export const writeMethodNotAllowed = (response: ServerResponse, corsOrigin: string | null) => {
+  writeJson(response, 405, { error: "Method not allowed" }, corsOrigin);
+};
+
+export const readJsonBodyOrWriteError = async (
+  request: IncomingMessage,
+  response: ServerResponse,
+  corsOrigin: string | null,
+): Promise<JsonBodyReadResult> => {
+  try {
+    const payload = await readJsonBody(request);
+    return { ok: true, payload };
+  } catch (error) {
+    if (error instanceof RequestBodyTooLargeError) {
+      writeJson(response, 413, { error: "Request body too large." }, corsOrigin);
+      return { ok: false };
+    }
+
+    writeJson(response, 400, { error: "Invalid JSON body." }, corsOrigin);
+    return { ok: false };
+  }
+};