@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/start/adapters.js

@@ -18,6 +18,7 @@ const mcp_2 = require("../services/escalation-strategy/mcp");
 const features_1 = require("../modules/features");
 const search_1 = require("../modules/search");
 const branding_1 = require("../modules/branding");
+const display_1 = require("../modules/display");
 const socket_auth_1 = require("./socket-auth");
 /**
  * Register all adapters (logging, telemetry, events, maintenance,
@@ -28,6 +29,7 @@ function registerAdapters(startConfig) {
     (0, features_1.configureFeatureFlags)(startConfig.features);
     (0, search_1.configureSearch)(startConfig.search);
     (0, branding_1.configureBranding)(startConfig.branding);
+    (0, display_1.configureDisplay)(startConfig.display);
     // Logging (register first so subsequent log calls use it)
     if (startConfig.logging?.adapter) {
         logger_1.loggerRegistry.register(startConfig.logging.adapter);

package/build/start/config.js

@@ -100,6 +100,13 @@ async function applyServerAuthConfig(startConfig) {
             baseUrl: startConfig.auth.oauth.baseUrl,
         });
     }
+    const oauthServer = startConfig.auth?.oauthServer
+        ?? (config_1.config.LT_OAUTH_ISSUER ? { issuer: config_1.config.LT_OAUTH_ISSUER } : undefined);
+    if (oauthServer) {
+        const { setOAuthServerConfig } = await Promise.resolve().then(() => __importStar(require('../modules/oauth-server')));
+        setOAuthServerConfig(oauthServer);
+        logger_1.loggerRegistry.info(`[long-tail] OAuth authorization server enabled — issuer ${oauthServer.issuer}`);
+    }
     // SSO — store config for requireAuth fallback and /api/auth/sso exchange
     if (startConfig.auth?.sso) {
         const { setSSOConfig } = await Promise.resolve().then(() => __importStar(require('../modules/sso')));

package/build/start/index.js

@@ -13,10 +13,8 @@ const config_1 = require("./config");
 const adapters_1 = require("./adapters");
 const workers_1 = require("./workers");
 const server_1 = require("./server");
-const socketio_1 = require("../lib/events/socketio");
+const express_1 = require("../adapters/express");
 const system_events_1 = require("../lib/events/system-events");
-const nats_1 = require("../lib/events/nats");
-const nats_ws_proxy_1 = require("../lib/events/nats-ws-proxy");
 /**
  * Start Long Tail with a declarative configuration.
  *
@@ -75,25 +73,9 @@ async function start(startConfig) {
     const serverEnabled = startConfig.server?.enabled !== false;
     let httpServer = null;
     if (serverEnabled) {
-        httpServer = (0, server_1.startServer)();
-        // Attach socket.io adapter to the HTTP server (if registered)
-        const socketAdapter = events_1.eventRegistry.getAdapter(socketio_1.SocketIOEventAdapter);
-        if (socketAdapter && httpServer) {
-            socketAdapter.attachServer(httpServer);
-            await socketAdapter.connect();
-        }
-        // Attach NATS WebSocket proxy (if configured)
-        const natsAdapter = events_1.eventRegistry.getAdapter(nats_1.NatsEventAdapter);
-        if (natsAdapter?.wsProxyTarget && httpServer) {
-            (0, nats_ws_proxy_1.attachNatsWsProxy)(httpServer, natsAdapter.wsProxyTarget, {
-                onWsUrlDerived: (url) => {
-                    // Auto-set wsUrl if not explicitly configured
-                    if (!natsAdapter.wsUrl) {
-                        natsAdapter.setWsUrl(url);
-                    }
-                },
-            });
-        }
+        const adapter = new express_1.LTExpressAdapter();
+        httpServer = (0, server_1.startServer)(adapter);
+        await adapter.attachServer(httpServer);
     }
     // 7. Return instance
     const connection = (0, workers_1.buildConnection)();

package/build/start/server.d.ts

@@ -1,6 +1,8 @@
-import express from 'express';
+import type { Server } from 'http';
+import { LTExpressAdapter } from '../adapters/express';
 /**
- * Create and start the embedded Express server with health check,
- * API routes, and optional dashboard static assets.
+ * Create and start the standalone server. It owns its app and mounts the
+ * same router an embedding host mounts, at the root, so standalone and
+ * embedded deployments serve one surface.
  */
-export declare function startServer(): ReturnType<typeof express.application.listen>;
+export declare function startServer(adapter: LTExpressAdapter): Server;

package/build/start/server.js

@@ -1,52 +1,28 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startServer = startServer;
-const fs_1 = require("fs");
-const path_1 = __importDefault(require("path"));
-const express_1 = __importDefault(require("express"));
+const http_1 = require("../lib/http");
 const config_1 = require("../modules/config");
 const logger_1 = require("../lib/logger");
-const routes_1 = __importDefault(require("../routes"));
-const mcp_endpoint_1 = __importDefault(require("../routes/mcp-endpoint"));
 /**
- * Create and start the embedded Express server with health check,
- * API routes, and optional dashboard static assets.
+ * Create and start the standalone server. It owns its app and mounts the
+ * same router an embedding host mounts, at the root, so standalone and
+ * embedded deployments serve one surface.
  */
-function startServer() {
-    const app = (0, express_1.default)();
+function startServer(adapter) {
+    const app = (0, http_1.createApp)();
     if (process.env.NODE_ENV !== 'production') {
         app.disable('etag');
     }
-    app.use(express_1.default.json());
-    app.get('/health', (_req, res) => {
-        res.json({ status: 'ok', timestamp: new Date().toISOString() });
-    });
-    app.use('/api', routes_1.default);
-    app.use('/mcp', mcp_endpoint_1.default);
-    // Serve dashboard static assets
-    // Resolves correctly in both dev (ts-node from root) and prod (node build/)
-    const devDist = path_1.default.join(__dirname, '..', 'dashboard', 'dist');
-    const prodDist = path_1.default.join(__dirname, '..', '..', 'dashboard', 'dist');
-    const dashboardDist = (0, fs_1.existsSync)(devDist) ? devDist : prodDist;
-    if ((0, fs_1.existsSync)(dashboardDist)) {
-        app.use(express_1.default.static(dashboardDist, { index: false }));
-        // SPA fallback — inject <base href="/"> so relative asset paths
-        // resolve from root regardless of route depth (e.g. /admin/users).
-        // Read on each request so dashboard rebuilds take effect without restart.
-        const indexPath = path_1.default.join(dashboardDist, 'index.html');
-        app.get('/{*splat}', (_req, res) => {
-            const html = (0, fs_1.readFileSync)(indexPath, 'utf-8').replace('<head>', '<head><base href="/">');
-            res.type('html').send(html);
-        });
-        logger_1.loggerRegistry.info(`[long-tail] Dashboard: http://localhost:${config_1.config.PORT}/`);
-    }
+    app.use(adapter.getWellKnownRouter());
+    app.use(adapter.getRouter());
     const httpServer = app.listen(config_1.config.PORT, () => {
         logger_1.loggerRegistry.info(`[long-tail] server running on port ${config_1.config.PORT}`);
         logger_1.loggerRegistry.info(`[long-tail] API: http://localhost:${config_1.config.PORT}/api`);
         logger_1.loggerRegistry.info(`[long-tail] Health: http://localhost:${config_1.config.PORT}/health`);
+        if (adapter.hasDashboard()) {
+            logger_1.loggerRegistry.info(`[long-tail] Dashboard: http://localhost:${config_1.config.PORT}/`);
+        }
     });
     return httpServer;
 }

package/build/start/socket-auth.js

@@ -23,7 +23,8 @@ function createSocketIOAuthenticator(startConfig) {
     return (token) => {
         try {
             const payload = jsonwebtoken_1.default.verify(token, secret);
-            return !!(payload && typeof payload === 'object' && payload.userId);
+            const userId = payload && typeof payload === 'object' ? payload.userId : undefined;
+            return typeof userId === 'string' && userId ? { userId } : false;
         }
         catch {
             return false;

package/build/start/workers.js

@@ -315,7 +315,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         };
         // 1. Register all factories (runtime — always applied)
         for (const [name, entry] of Object.entries(allFactories)) {
-            registerBuiltinServer(name, entry.factory);
+            registerBuiltinServer(name, entry.factory, entry.config?.toolManifest);
         }
         logger_1.loggerRegistry.info(`[long-tail] ${Object.keys(allFactories).length} MCP server factories registered`);
         // Set exposure config for the /mcp endpoint

package/build/system/mcp-servers/admin/agent-subscriptions.js

@@ -35,7 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentSubscriptionTools = registerAgentSubscriptionTools;
 const api = __importStar(require("../../../api/agent-subscriptions"));
+const authority_1 = require("../../../services/agent/authority");
+const workflow_invocation_1 = require("../../../services/workflow-invocation");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused authority check; null when the call may go on. */
+async function refusal(check) {
+    try {
+        await check();
+        return null;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        return { content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }], isError: true };
+    }
+}
 function registerAgentSubscriptionTools(server) {
     // mirrors GET /api/agents/:agentId/subscriptions
     server.registerTool('list_agent_subscriptions', {
@@ -55,8 +70,16 @@ function registerAgentSubscriptionTools(server) {
         description: 'Create an event subscription for an agent. When events match the ' +
             'topic pattern, the configured reaction is triggered.',
         inputSchema: schemas_1.createAgentSubscriptionSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { agent_id, ...body } = args;
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller
+            ? await refusal(() => (0, authority_1.assertMayConfigureSubscription)(caller.userId, {
+                agentId: agent_id, reaction_type: body.reaction_type, execute_as: body.execute_as,
+            }))
+            : null;
+        if (refused)
+            return refused;
         const result = await api.createSubscription({ agentId: agent_id, ...body });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/agents.js

@@ -35,7 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentTools = registerAgentTools;
 const api = __importStar(require("../../../api/agents"));
+const authority_1 = require("../../../services/agent/authority");
+const workflow_invocation_1 = require("../../../services/workflow-invocation");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused authority check; null when the call may go on. */
+async function refusal(check) {
+    try {
+        await check();
+        return null;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        return { content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }], isError: true };
+    }
+}
 function registerAgentTools(server) {
     // mirrors GET /api/agents
     server.registerTool('list_agents', {
@@ -69,7 +84,11 @@ function registerAgentTools(server) {
         description: 'Create a new agent automation with identity, goals, rules, ' +
             'optional schedules, and event subscriptions.',
         inputSchema: schemas_1.createAgentSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? await refusal(() => (0, authority_1.assertMayConfigureAgent)(caller.userId, { ...args, id: undefined })) : null;
+        if (refused)
+            return refused;
         const result = await api.createAgent(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -81,7 +100,11 @@ function registerAgentTools(server) {
         title: 'Update Agent',
         description: 'Update an existing agent automation.',
         inputSchema: schemas_1.updateAgentSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? await refusal(() => (0, authority_1.assertMayConfigureAgent)(caller.userId, args)) : null;
+        if (refused)
+            return refused;
         const result = await api.updateAgent(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/announcements.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAnnouncementTools = registerAnnouncementTools;
 const zod_1 = require("zod");
 const api = __importStar(require("../../../api/announcements"));
+const caller_auth_1 = require("../caller-auth");
 const publishAnnouncementSchema = zod_1.z.object({
     body: zod_1.z.string().describe('Markdown body — the only required field.'),
     title: zod_1.z.string().optional().describe('Headline shown on the collapsed banner.'),
@@ -53,14 +54,14 @@ function registerAnnouncementTools(server) {
             '(default 24h) are optional. Bodies broadcast to all authenticated ' +
             'subscribers — never include secrets.',
         inputSchema: publishAnnouncementSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const result = await api.createAnnouncement({
             body: args.body,
             title: args.title,
             layout: args.layout,
             roles: args.roles,
             expiresAt: args.expires_at,
-        }, { userId: 'lt-system', role: 'superadmin' });
+        }, (0, caller_auth_1.externalCaller)(extra) ?? { userId: 'lt-system', role: 'superadmin' });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }

package/build/system/mcp-servers/admin/bot-accounts.js

@@ -35,7 +35,23 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerBotAccountTools = registerBotAccountTools;
 const api = __importStar(require("../../../api/bot-accounts"));
+const bot_api_key_1 = require("../../../services/auth/bot-api-key");
+const capabilities_1 = require("../../../modules/capabilities");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused decision; null when the call may go on. */
+function refusal(decision) {
+    if (decision.allowed)
+        return null;
+    return { content: [{ type: 'text', text: JSON.stringify({ error: decision.error }) }], isError: true };
+}
+/** For a /mcp caller, the account rule on `botId`; internal calls act as lt-system. */
+async function accountRefusal(extra, botId) {
+    const caller = (0, caller_auth_1.externalCaller)(extra);
+    if (!caller || !botId)
+        return null;
+    return refusal(await (0, capabilities_1.mayManageAccount)(caller.userId, botId));
+}
 function registerBotAccountTools(server) {
     // mirrors GET /api/bot-accounts
     server.registerTool('list_bot_accounts', {
@@ -67,7 +83,11 @@ function registerBotAccountTools(server) {
         description: 'Create a new bot (service) account with optional roles. ' +
             'Bot accounts can run workflows and hold API keys.',
         inputSchema: schemas_1.createBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? refusal(await (0, capabilities_1.mayGrantRoles)(caller.userId, args.roles)) : null;
+        if (refused)
+            return refused;
         const result = await api.createBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -79,7 +99,10 @@ function registerBotAccountTools(server) {
         title: 'Update Bot Account',
         description: 'Update a bot account (display name, description, status).',
         inputSchema: schemas_1.updateBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.updateBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -91,7 +114,10 @@ function registerBotAccountTools(server) {
         title: 'Delete Bot Account',
         description: 'Delete a bot account and all its API keys.',
         inputSchema: schemas_1.deleteBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.deleteBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -104,7 +130,10 @@ function registerBotAccountTools(server) {
         description: 'Generate a new API key for a bot account. Returns the raw key ' +
             'ONCE — it cannot be retrieved again.',
         inputSchema: schemas_1.createBotApiKeySchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.createBotKey(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -116,7 +145,10 @@ function registerBotAccountTools(server) {
         title: 'Revoke Bot API Key',
         description: 'Revoke (delete) an API key for a bot account.',
         inputSchema: schemas_1.revokeBotKeySchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = (0, caller_auth_1.externalCaller)(extra) ? await accountRefusal(extra, await (0, bot_api_key_1.getBotApiKeyOwner)(args.key_id)) : null;
+        if (refused)
+            return refused;
         const result = await api.revokeBotKey({ keyId: args.key_id });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/escalations.d.ts

@@ -1,11 +1,9 @@
 /**
  * Escalation tools — mirrors routes/escalations/
  *
- * Every tool runs as the `lt-system` bot. The escalation RBAC helpers
- * (getVisibleRoles / getUserRoles / hasGlobalEscalationAccess) query a uuid
- * column, so the bot's external_id string ('lt-system') would blow up with
- * `invalid input syntax for type uuid`. `systemAuth()` resolves the bot's real
- * UUID once and caches it; that UUID (a superadmin) is passed as the principal.
+ * A call that arrived at `/mcp` runs as its caller, so the escalation RBAC in
+ * api/ applies to them exactly as it does over REST. Internal calls from
+ * workflows and agents run as the `lt-system` bot.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function registerEscalationTools(server: McpServer): void;