@hyperdrive.bot/fleet-server 0.3.148 → 0.3.150

package/dist/server/server/agent/tools/paseo-tools.d.ts

@@ -8,6 +8,7 @@ import type { TerminalManager } from "../../../terminal/terminal-manager.js";
 import type { CreatePaseoWorktreeWorkflowFn } from "../../worktree-session.js";
 import type { JudgeRelayGate } from "../judge-relay-gate.js";
 import type { ScheduleService } from "../../schedule/service.js";
+import type { SubscriptionReader } from "../../ingestion/subscriptions/reader.js";
 import type { ProviderSnapshotManager } from "../provider-snapshot-manager.js";
 import type { GitHubService } from "../../../services/github-service.js";
 import type { WorkspaceGitService } from "../../workspace-git-service.js";
@@ -20,6 +21,14 @@ export interface PaseoToolHostDependencies {
     terminalManager?: TerminalManager | null;
     getDaemonTcpPort?: () => number | null;
     scheduleService?: ScheduleService | null;
+    /**
+     * Read access to session subscriptions and the items they have announced.
+     *
+     * Supplied as two narrow stores rather than a service: these tools only ever
+     * READ, and handing the catalog something that could arm or notify would put
+     * the delivery policy inside a model's reach.
+     */
+    subscriptionReader?: SubscriptionReader | null;
     providerSnapshotManager: ProviderSnapshotManager;
     github?: GitHubService;
     workspaceGitService?: Pick<WorkspaceGitService, "getSnapshot" | "listWorktrees" | "resolveRepoRoot">;

package/dist/server/server/agent/tools/paseo-tools.js

@@ -257,7 +257,7 @@ function resolveTerminalKeyToken(key, literal) {
     }
 }
 export function createPaseoToolCatalog(options) {
-    const { agentManager, agentStorage, terminalManager, scheduleService, providerSnapshotManager, callerAgentId, resolveSpeakHandler, resolveCallerContext, logger, } = options;
+    const { agentManager, agentStorage, terminalManager, scheduleService, subscriptionReader, providerSnapshotManager, callerAgentId, resolveSpeakHandler, resolveCallerContext, logger, } = options;
     const childLogger = logger.child({ module: "agent", component: "paseo-tool-catalog" });
     const waitTracker = new WaitForAgentTracker(logger);
     const callerContext = callerAgentId ? (resolveCallerContext?.(callerAgentId) ?? null) : null;
@@ -2060,6 +2060,81 @@ export function createPaseoToolCatalog(options) {
             structuredContent: ensureValidJson(schedule),
         };
     });
+    registerTool("list_subscriptions", {
+        title: "List subscriptions",
+        description: "List this daemon's source subscriptions: which filter each one listens to, which agent it notifies, and when it last did.",
+        inputSchema: {},
+        outputSchema: {
+            subscriptions: z.array(z.object({
+                id: z.string(),
+                filterId: z.string(),
+                agentId: z.string(),
+                label: z.string().nullable(),
+                status: z.string(),
+                debounceMs: z.number(),
+                lastNotifiedAt: z.string().nullable(),
+            })),
+        },
+    }, async () => {
+        if (!subscriptionReader) {
+            throw new Error("Subscriptions are not configured on this daemon");
+        }
+        const subscriptions = (await subscriptionReader.list(callerAgentId)).map((subscription) => ({
+            id: subscription.id,
+            filterId: subscription.filterId,
+            agentId: subscription.agentId,
+            label: subscription.label,
+            status: subscription.status,
+            debounceMs: subscription.debounceMs,
+            lastNotifiedAt: subscription.lastNotifiedAt,
+        }));
+        return { content: [], structuredContent: ensureValidJson({ subscriptions }) };
+    });
+    registerTool("get_subscription_items", {
+        title: "Get subscription items",
+        description: "Full content of items a subscription notification announced. Pass the subscription id and the item keys from the notice. Keys that are no longer held come back absent rather than as an error.",
+        inputSchema: {
+            subscriptionId: z.string().min(1),
+            itemKeys: z.array(z.string().min(1)).min(1).max(50),
+        },
+        outputSchema: {
+            items: z.array(z.object({
+                itemKey: z.string(),
+                contentHash: z.string(),
+                title: z.string(),
+                subtitle: z.string(),
+                timestampMs: z.number(),
+                notifiedAt: z.string().nullable(),
+                payload: z.unknown(),
+            })),
+            missingKeys: z.array(z.string()),
+        },
+    }, async (input) => {
+        if (!subscriptionReader) {
+            throw new Error("Subscriptions are not configured on this daemon");
+        }
+        const items = await subscriptionReader.resolveItems(input.subscriptionId, input.itemKeys, callerAgentId);
+        const found = new Set(items.map((item) => item.itemKey));
+        // Named, not silent. A key that is gone is an ordinary consequence of the
+        // TTL sweep, and saying which ones went is what stops a caller reading a
+        // short list as the whole answer.
+        const missingKeys = input.itemKeys.filter((key) => !found.has(key));
+        return {
+            content: [],
+            structuredContent: ensureValidJson({
+                items: items.map((item) => ({
+                    itemKey: item.itemKey,
+                    contentHash: item.contentHash,
+                    title: item.title,
+                    subtitle: item.subtitle,
+                    timestampMs: item.timestampMs,
+                    notifiedAt: item.notifiedAt,
+                    payload: item.payload,
+                })),
+                missingKeys,
+            }),
+        };
+    });
     registerTool("list_schedules", {
         title: "List schedules",
         description: "List all schedules managed by the daemon.",

package/dist/server/server/agent/tools/read-only-surface.d.ts

@@ -45,6 +45,13 @@
  * - `run_schedule_once`      fires a schedule now, which starts or prompts an agent.
  * - `rename_workspace`       mutates.
  * - `speak`                  an outward side effect, and voice is out of v1 scope.
+ * - `get_subscription_items`  a FETCHER, not a passive read: it pulls fresh
+ *                            untrusted bytes (raw aggregator event bodies) into
+ *                            the judge's context on demand, widening the very
+ *                            input surface this allowlist bounds. The judge is
+ *                            also the one identity holding an outbound relay
+ *                            channel, and read-only stops mutation, not
+ *                            exfiltration through a channel granted on purpose.
  * - `wait_for_agent`         not mutating, but it BLOCKS. An event-woken judge
  *                            that blocks holds its run open indefinitely.
  */

package/dist/server/server/agent/tools/read-only-surface.js

@@ -45,6 +45,13 @@
  * - `run_schedule_once`      fires a schedule now, which starts or prompts an agent.
  * - `rename_workspace`       mutates.
  * - `speak`                  an outward side effect, and voice is out of v1 scope.
+ * - `get_subscription_items`  a FETCHER, not a passive read: it pulls fresh
+ *                            untrusted bytes (raw aggregator event bodies) into
+ *                            the judge's context on demand, widening the very
+ *                            input surface this allowlist bounds. The judge is
+ *                            also the one identity holding an outbound relay
+ *                            channel, and read-only stops mutation, not
+ *                            exfiltration through a channel granted on purpose.
  * - `wait_for_agent`         not mutating, but it BLOCKS. An event-woken judge
  *                            that blocks holds its run open indefinitely.
  */
@@ -59,6 +66,7 @@ export const READ_ONLY_PASEO_TOOLS = new Set([
     "list_pending_permissions",
     "list_providers",
     "list_schedules",
+    "list_subscriptions",
     "list_terminals",
     "list_worktrees",
     "schedule_logs",

package/dist/server/server/bootstrap.js

@@ -119,6 +119,12 @@ import { ScheduleService } from "./schedule/service.js";
 import { IngestionService } from "./ingestion/service.js";
 import { FilterStore, filtersDir } from "./ingestion/filters/store.js";
 import { SourceStore } from "./ingestion/sources/store.js";
+import { formatSystemNotificationPrompt, sendPromptToAgent } from "./agent/agent-prompt.js";
+import { SubscriptionStore } from "./ingestion/subscriptions/store.js";
+import { PendingItemStore } from "./ingestion/subscriptions/pending-store.js";
+import { SubscriptionNotifier } from "./ingestion/subscriptions/notifier.js";
+import { SubscriptionPoller } from "./ingestion/subscriptions/poller.js";
+import { createSubscriptionReader } from "./ingestion/subscriptions/reader.js";
 import { resolveSourceGateway } from "./ingestion/adapters.js";
 import { CapLimiter } from "./ingestion/cap-limiter.js";
 import { IngestionLedger } from "./ingestion/ledger.js";
@@ -443,6 +449,11 @@ function buildIngestionCollaborators(config, ingestionLedger) {
     const ingestionFilterStore = new FilterStore(filtersDir(config.paseoHome));
     const ingestionSourceStore = new SourceStore(path.join(config.paseoHome, "sources"));
     const ingestionGatewayResolver = resolveIngestionGatewayResolver(config, ingestionConfig);
+    // Session subscriptions. Declared beside the other ingestion stores so the
+    // schedule service below can be handed a live filter resolver rather than the
+    // thrower it has been defaulting to since the source cadence was added.
+    const ingestionSubscriptionStore = new SubscriptionStore(path.join(config.paseoHome, "subscriptions"));
+    const ingestionPendingStore = new PendingItemStore(path.join(config.paseoHome, "subscription-items"));
     return {
         capLimiter,
         ingestionCohortStore,
@@ -450,6 +461,8 @@ function buildIngestionCollaborators(config, ingestionLedger) {
         ingestionFilterStore,
         ingestionSourceStore,
         ingestionGatewayResolver,
+        ingestionSubscriptionStore,
+        ingestionPendingStore,
     };
 }
 export async function createPaseoDaemon(config, rootLogger) {
@@ -936,7 +949,7 @@ export async function createPaseoDaemon(config, rootLogger) {
     // from being true (someone caches `used` in a field to save a query). Two
     // guards, one of which fails loudly.
     //
-    const { capLimiter, ingestionCohortStore, ingestionCohorts, ingestionFilterStore, ingestionSourceStore, ingestionGatewayResolver, } = buildIngestionCollaborators(config, ingestionLedger);
+    const { capLimiter, ingestionCohortStore, ingestionCohorts, ingestionFilterStore, ingestionSourceStore, ingestionGatewayResolver, ingestionSubscriptionStore, ingestionPendingStore, } = buildIngestionCollaborators(config, ingestionLedger);
     // Explicit annotation breaks the inference cycle: this options object passes
     // `schedule: () => scheduleService`, so inferring the type from the initializer
     // is circular (TS7022/TS7023). The lazy closure itself is correct and intended.
@@ -992,6 +1005,62 @@ export async function createPaseoDaemon(config, rootLogger) {
     });
     await ingestionService.start();
     logger.info({ elapsed: elapsed() }, "Ingestion service initialized");
+    // Session subscriptions: source change -> thin notice -> one specific session.
+    //
+    // It owns its own timer and never touches the schedule engine. A subscription
+    // has to survive its target being archived, and `sweepOrphanedSchedules`
+    // completes an agent-target schedule terminally at the next boot, which is the
+    // exact opposite of the rule here: sending to a dead session revives it.
+    const subscriptionNotifier = new SubscriptionNotifier({
+        subscriptions: ingestionSubscriptionStore,
+        pending: ingestionPendingStore,
+        agentManager,
+        filterResolver: (filterId) => ingestionFilterStore.get(filterId),
+        // `sendPromptToAgent` is the one entry point where unarchive, reload and
+        // detached-runtime recycling already live, which is what makes "the session
+        // revives" true rather than aspirational. The `route` it returns is READ
+        // here on purpose: the websocket handler discards it and answers
+        // `accepted: true` even for `no-route`, and a subscription that believed
+        // that would mark items announced that nobody ever saw.
+        send: async ({ agentId, body }) => {
+            const result = await sendPromptToAgent({
+                agentManager,
+                agentStorage,
+                agentId,
+                prompt: formatSystemNotificationPrompt(body),
+                // A notice must not resurrect a session the user deliberately archived.
+                unarchive: false,
+                logger,
+            });
+            // Fail CLOSED on a missing route. `sendPromptToAgent` types `route` as
+            // optional and omits it on exactly one branch: an archived agent when
+            // `unarchive` is false (`agent-prompt.ts:291-295`), which is the branch
+            // this caller always takes. Coalescing that to "live" would mark every
+            // waiting item announced, advance `lastNotifiedAt` and log a delivery,
+            // for a prompt that was never written anywhere.
+            return { route: result.route ?? "no-route" };
+        },
+        logger,
+    });
+    const subscriptionPoller = new SubscriptionPoller({
+        subscriptions: ingestionSubscriptionStore,
+        pending: ingestionPendingStore,
+        notifier: subscriptionNotifier,
+        sourceStore: ingestionSourceStore,
+        filterResolver: (filterId) => ingestionFilterStore.get(filterId),
+        gatewayResolver: ingestionGatewayResolver,
+        logger,
+    });
+    const subscriptionReader = createSubscriptionReader({
+        subscriptions: ingestionSubscriptionStore,
+        pending: ingestionPendingStore,
+    });
+    // The retention half of storing payloads at rest. At boot, beside the other
+    // sweeps, rather than on a timer of its own.
+    await subscriptionPoller.sweep().catch((error) => {
+        logger.warn({ err: error }, "Subscription payload sweep failed");
+    });
+    subscriptionPoller.start();
     // The read-only ingestion PREVIEW collaborators (Story 5.1).
     //
     // Wired beside IngestionService rather than through it, because that service
@@ -1164,6 +1233,7 @@ export async function createPaseoDaemon(config, rootLogger) {
         terminalManager,
         getDaemonTcpPort: () => (boundListenTarget?.type === "tcp" ? boundListenTarget.port : null),
         scheduleService,
+        subscriptionReader,
         providerSnapshotManager,
         github,
         workspaceGitService,

package/dist/server/server/config.js

@@ -233,6 +233,10 @@ function resolveIngestionConfig(input) {
         composio: {
             apiKey: env.PASEO_COMPOSIO_API_KEY?.trim() || undefined,
         },
+        selfHosted: {
+            url: env.PASEO_SELF_HOSTED_URL?.trim() || undefined,
+            token: env.PASEO_SELF_HOSTED_TOKEN?.trim() || undefined,
+        },
     };
 }
 function parseTrustedProxiesEnv(value) {

package/dist/server/server/exports.d.ts

@@ -1,6 +1,8 @@
 export { createPaseoDaemon, type PaseoDaemon, type PaseoDaemonConfig } from "./bootstrap.js";
 export { loadConfig, type CliConfigOverrides } from "./config.js";
 export { resolvePaseoHome } from "./paseo-home.js";
+export { SubscriptionStore } from "./ingestion/subscriptions/store.js";
+export { PendingItemStore } from "./ingestion/subscriptions/pending-store.js";
 export { getOrCreateServerId } from "./server-id.js";
 export { createRootLogger, type LogLevel, type LogFormat } from "./logger.js";
 export { loadPersistedConfig, savePersistedConfig, type PersistedConfig, } from "./persisted-config.js";

package/dist/server/server/exports.js

@@ -2,6 +2,12 @@
 export { createPaseoDaemon } from "./bootstrap.js";
 export { loadConfig } from "./config.js";
 export { resolvePaseoHome } from "./paseo-home.js";
+// Session subscriptions. Exported for the CLI, which writes the store DIRECTLY
+// rather than through the daemon: both stores re-read from disk on every call
+// and cache nothing, so a file written here is picked up by the poller's next
+// tick with no RPC and no restart.
+export { SubscriptionStore } from "./ingestion/subscriptions/store.js";
+export { PendingItemStore } from "./ingestion/subscriptions/pending-store.js";
 export { getOrCreateServerId } from "./server-id.js";
 export { createRootLogger } from "./logger.js";
 export { loadPersistedConfig, savePersistedConfig, } from "./persisted-config.js";

package/dist/server/server/ingestion/adapters.js

@@ -1,5 +1,6 @@
 import { createComposioGateway } from "./composio/gateway.js";
 import { createPipedreamGateway } from "./pipedream/gateway.js";
+import { createSelfHostedGateway } from "./self-hosted/gateway.js";
 /**
  * The adapter factory for every source kind.
  *
@@ -16,6 +17,7 @@ import { createPipedreamGateway } from "./pipedream/gateway.js";
 export const SOURCE_ADAPTERS = {
     pipedream: (deps) => createPipedreamGateway(deps.config.pipedream),
     composio: (deps) => createComposioGateway(deps.config.composio),
+    "self-hosted": (deps) => createSelfHostedGateway(deps.config.selfHosted),
 };
 /**
  * The gateway for one kind. Total by construction: SOURCE_ADAPTERS covers every

package/dist/server/server/ingestion/errors.d.ts

@@ -13,6 +13,10 @@
  *   COMPOSIO_OFFLINE      | 502        | Composio unreachable
  *   COMPOSIO_AUTH         | 502        | Composio rejected our platform credential
  *   COMPOSIO_ERROR        | 502        | Composio answered non-ok for any other reason
+ *   SELF_HOSTED_OFF       | 422        | no bridge URL/token, or the URL is malformed
+ *   SELF_HOSTED_OFFLINE   | 502        | the user's bridge is unreachable or timed out
+ *   SELF_HOSTED_AUTH      | 502        | the bridge rejected this daemon's bearer
+ *   SELF_HOSTED_ERROR     | 502        | the bridge answered non-ok, non-JSON or incomplete
  *   SOURCE_GONE           | 502        | a resource we cached was deleted upstream
  *   SOURCE_ERROR          | 502        | any other non-ok aggregator response
  *   FILTER_MISSING        | 404        | no such filter on THIS daemon
@@ -37,7 +41,7 @@
  * tell the caller to re-authenticate, which cannot fix anything, and would
  * blame the wrong party for an operator's misconfiguration.
  */
-export declare const INGESTION_ERROR_CODES: readonly ["PIPEDREAM_OFF", "COMPOSIO_OFF", "COMPOSIO_NEEDS_SETUP", "PIPEDREAM_OFFLINE", "PIPEDREAM_AUTH", "COMPOSIO_OFFLINE", "COMPOSIO_AUTH", "COMPOSIO_ERROR", "SOURCE_GONE", "SOURCE_ERROR", "FILTER_MISSING", "SOURCE_MISSING"];
+export declare const INGESTION_ERROR_CODES: readonly ["PIPEDREAM_OFF", "COMPOSIO_OFF", "COMPOSIO_NEEDS_SETUP", "PIPEDREAM_OFFLINE", "PIPEDREAM_AUTH", "COMPOSIO_OFFLINE", "COMPOSIO_AUTH", "COMPOSIO_ERROR", "SELF_HOSTED_OFF", "SELF_HOSTED_OFFLINE", "SELF_HOSTED_AUTH", "SELF_HOSTED_ERROR", "SOURCE_GONE", "SOURCE_ERROR", "FILTER_MISSING", "SOURCE_MISSING"];
 export type IngestionErrorCode = (typeof INGESTION_ERROR_CODES)[number];
 /** A domain error from the ingestion seam, with a message ready for a client. */
 export declare class IngestionError extends Error {

package/dist/server/server/ingestion/errors.js

@@ -13,6 +13,10 @@
  *   COMPOSIO_OFFLINE      | 502        | Composio unreachable
  *   COMPOSIO_AUTH         | 502        | Composio rejected our platform credential
  *   COMPOSIO_ERROR        | 502        | Composio answered non-ok for any other reason
+ *   SELF_HOSTED_OFF       | 422        | no bridge URL/token, or the URL is malformed
+ *   SELF_HOSTED_OFFLINE   | 502        | the user's bridge is unreachable or timed out
+ *   SELF_HOSTED_AUTH      | 502        | the bridge rejected this daemon's bearer
+ *   SELF_HOSTED_ERROR     | 502        | the bridge answered non-ok, non-JSON or incomplete
  *   SOURCE_GONE           | 502        | a resource we cached was deleted upstream
  *   SOURCE_ERROR          | 502        | any other non-ok aggregator response
  *   FILTER_MISSING        | 404        | no such filter on THIS daemon
@@ -46,6 +50,10 @@ export const INGESTION_ERROR_CODES = [
     "COMPOSIO_OFFLINE",
     "COMPOSIO_AUTH",
     "COMPOSIO_ERROR",
+    "SELF_HOSTED_OFF",
+    "SELF_HOSTED_OFFLINE",
+    "SELF_HOSTED_AUTH",
+    "SELF_HOSTED_ERROR",
     "SOURCE_GONE",
     "SOURCE_ERROR",
     "FILTER_MISSING",

package/dist/server/server/ingestion/health.js

@@ -22,6 +22,16 @@ const ERROR_CODE_STATUS = {
     COMPOSIO_OFFLINE: "degraded",
     COMPOSIO_AUTH: "revoked",
     COMPOSIO_ERROR: "degraded",
+    // Same split as the aggregators, for the same reason. OFF/OFFLINE/ERROR are
+    // states the next sweep may clear on its own; AUTH is not. For a vendor,
+    // AUTH means the user must re-authorize there; for a self-hosted bridge it
+    // means the bearer in this daemon's env no longer matches the one the bridge
+    // expects. Different cause, identical consequence: a human has to act, so
+    // reporting it as `degraded` would leave a dead source looking merely slow.
+    SELF_HOSTED_OFF: "degraded",
+    SELF_HOSTED_OFFLINE: "degraded",
+    SELF_HOSTED_AUTH: "revoked",
+    SELF_HOSTED_ERROR: "degraded",
     SOURCE_GONE: "revoked",
     SOURCE_ERROR: "degraded",
     // The 404 pair cannot arise from a health check: `checkSource` is only ever

package/dist/server/server/ingestion/self-hosted/gateway.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The self-hosted source gateway.
+ *
+ * Composio and Pipedream are aggregators someone else runs: paseo holds a
+ * platform credential and talks to a fixed base URL baked into the adapter.
+ * This adapter inverts that. The user runs the aggregator, tells paseo where it
+ * is, and paseo holds nothing but a bearer token for that one endpoint.
+ *
+ * That inversion is the whole point. Nothing in this file names an app, a
+ * vendor or a protocol beyond HTTP+JSON: the bridge on the other end decides
+ * what it fronts. WhatsApp-over-wacli is the first one, but a Matrix bridge, an
+ * IMAP box or a signal-cli would implement the same six routes and paseo would
+ * not learn a new word.
+ *
+ * WHAT THE BRIDGE OWES US (v1):
+ *
+ *   GET  {base}/v1/sources?query=&cursor=        -> SourcesResponse
+ *   POST {base}/v1/connect                       -> ConnectResponse
+ *   GET  {base}/v1/accounts?...                  -> AccountsResponse
+ *   GET  {base}/v1/items?...                     -> ItemsResponse
+ *   POST {base}/v1/mcp-target                    -> McpTargetResponse
+ *
+ * `listTriggerComponents` / `deployTrigger` are deliberately NOT implemented.
+ * They are optional on `SourceGateway`, and `service.ts` already answers
+ * `${kind} cannot deploy triggers` for a gateway that lacks them. A bridge that
+ * fronts a local daemon has nothing to deploy: it is already watching, or it is
+ * not running at all. Pretending otherwise would report a source as "watching"
+ * when nothing is.
+ *
+ * LEDGER IDENTITY IS OURS, NOT THE BRIDGE'S.
+ *
+ * The bridge returns `externalId` and a raw `payload`; `key` and `contentHash`
+ * are computed HERE with `fingerprint()`, byte-identically to the Composio
+ * adapter. A bridge that minted its own keys would be a second identity
+ * function for the same items, and an identity that disagrees with the ledger
+ * re-dispatches a backlog the user already cleared.
+ *
+ * Note what `key` deliberately does NOT include: `accountId`. Two accounts on
+ * the same underlying inbox (the read-only and read-write wacli pair, both
+ * linked to one WhatsApp number) see the SAME messages. Keying without the
+ * account makes that one ledger row handled once, which is the correct
+ * behaviour, and it also means re-pairing an account does not invalidate a
+ * backlog the user already worked through.
+ *
+ * CREDENTIALS.
+ *
+ * The bearer token never leaves this module, and `mcpTarget` results are per
+ * turn: they carry live headers minted by the bridge and are never persisted,
+ * cached or returned to a client. A `SourceItem` has no credential field and
+ * must never grow one - it is projected into `BackfillItem` and crosses the
+ * wire to the app.
+ */
+import type { SelfHostedConfig, SourceGateway } from "../types.js";
+export declare function createSelfHostedGateway(config?: SelfHostedConfig | undefined): SourceGateway;
+//# sourceMappingURL=gateway.d.ts.map