@intent-systems/nexus 2026.1.5-3

package/dist/infra/bridge/server.js

@@ -0,0 +1,564 @@
+import { randomUUID } from "node:crypto";
+import net from "node:net";
+import os from "node:os";
+import { resolveCanvasHostUrl } from "../canvas-host-url.js";
+import { getPairedNode, listNodePairing, requestNodePairing, updatePairedNodeMetadata, verifyNodeToken, } from "../node-pairing.js";
+function isTestEnv() {
+    return process.env.NODE_ENV === "test" || Boolean(process.env.VITEST);
+}
+function encodeLine(frame) {
+    return `${JSON.stringify(frame)}\n`;
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function startNodeBridgeServer(opts) {
+    if (isTestEnv() &&
+        process.env.NEXUS_ENABLE_BRIDGE_IN_TESTS !== "1" &&
+        process.env.NEXUS_ENABLE_BRIDGE_IN_TESTS !== "1") {
+        return {
+            port: 0,
+            close: async () => { },
+            invoke: async () => {
+                throw new Error("bridge disabled in tests");
+            },
+            sendEvent: () => { },
+            listConnected: () => [],
+            listeners: [],
+        };
+    }
+    const serverName = typeof opts.serverName === "string" && opts.serverName.trim()
+        ? opts.serverName.trim()
+        : os.hostname();
+    const buildCanvasHostUrl = (socket) => {
+        return resolveCanvasHostUrl({
+            canvasPort: opts.canvasHostPort,
+            hostOverride: opts.canvasHostHost,
+            localAddress: socket.localAddress,
+            scheme: "http",
+        });
+    };
+    const connections = new Map();
+    const shouldAlsoListenOnLoopback = (host) => {
+        const h = String(host ?? "")
+            .trim()
+            .toLowerCase();
+        if (!h)
+            return false; // default listen() already includes loopback
+        if (h === "0.0.0.0" || h === "::")
+            return false; // already includes loopback
+        if (h === "localhost")
+            return false;
+        if (h === "127.0.0.1" || h.startsWith("127."))
+            return false;
+        if (h === "::1")
+            return false;
+        return true;
+    };
+    const loopbackHost = "127.0.0.1";
+    const onConnection = (socket) => {
+        socket.setNoDelay(true);
+        let buffer = "";
+        let isAuthenticated = false;
+        let nodeId = null;
+        let nodeInfo = null;
+        const invokeWaiters = new Map();
+        const abort = new AbortController();
+        const stop = () => {
+            if (!abort.signal.aborted)
+                abort.abort();
+            for (const [, waiter] of invokeWaiters) {
+                clearTimeout(waiter.timer);
+                waiter.reject(new Error("bridge connection closed"));
+            }
+            invokeWaiters.clear();
+            if (nodeId) {
+                const existing = connections.get(nodeId);
+                if (existing?.socket === socket)
+                    connections.delete(nodeId);
+            }
+        };
+        const send = (frame) => {
+            try {
+                socket.write(encodeLine(frame));
+            }
+            catch {
+                // ignore
+            }
+        };
+        const sendError = (code, message) => {
+            send({ type: "error", code, message });
+        };
+        const remoteAddress = (() => {
+            const addr = socket.remoteAddress?.trim();
+            return addr && addr.length > 0 ? addr : undefined;
+        })();
+        const handleHello = async (hello) => {
+            nodeId = String(hello.nodeId ?? "").trim();
+            if (!nodeId) {
+                sendError("INVALID_REQUEST", "nodeId required");
+                return;
+            }
+            const token = typeof hello.token === "string" ? hello.token.trim() : "";
+            if (!token) {
+                const paired = await getPairedNode(nodeId, opts.pairingBaseDir);
+                sendError(paired ? "UNAUTHORIZED" : "NOT_PAIRED", "pairing required");
+                return;
+            }
+            const verified = await verifyNodeToken(nodeId, token, opts.pairingBaseDir);
+            if (!verified.ok || !verified.node) {
+                sendError("UNAUTHORIZED", "invalid token");
+                return;
+            }
+            const inferCaps = (frame) => {
+                const platform = String(frame.platform ?? "")
+                    .trim()
+                    .toLowerCase();
+                const family = String(frame.deviceFamily ?? "")
+                    .trim()
+                    .toLowerCase();
+                if (platform.includes("ios") || platform.includes("ipados")) {
+                    return ["canvas", "camera"];
+                }
+                if (platform.includes("android")) {
+                    return ["canvas", "camera"];
+                }
+                if (family === "ipad" || family === "iphone" || family === "ios") {
+                    return ["canvas", "camera"];
+                }
+                if (family === "android") {
+                    return ["canvas", "camera"];
+                }
+                return undefined;
+            };
+            const normalizePermissions = (raw) => {
+                if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                    return undefined;
+                const entries = Object.entries(raw)
+                    .map(([key, value]) => [String(key).trim(), value === true])
+                    .filter(([key]) => key.length > 0);
+                if (entries.length === 0)
+                    return undefined;
+                return Object.fromEntries(entries);
+            };
+            const caps = (Array.isArray(hello.caps)
+                ? hello.caps.map((c) => String(c)).filter(Boolean)
+                : undefined) ??
+                verified.node.caps ??
+                inferCaps(hello);
+            const commands = Array.isArray(hello.commands) && hello.commands.length > 0
+                ? hello.commands.map((c) => String(c)).filter(Boolean)
+                : verified.node.commands;
+            const helloPermissions = normalizePermissions(hello.permissions);
+            const basePermissions = verified.node.permissions ?? {};
+            const permissions = helloPermissions
+                ? { ...basePermissions, ...helloPermissions }
+                : verified.node.permissions;
+            isAuthenticated = true;
+            const existing = connections.get(nodeId);
+            if (existing?.socket && existing.socket !== socket) {
+                try {
+                    existing.socket.destroy();
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+            nodeInfo = {
+                nodeId,
+                displayName: verified.node.displayName ?? hello.displayName,
+                platform: verified.node.platform ?? hello.platform,
+                version: verified.node.version ?? hello.version,
+                deviceFamily: verified.node.deviceFamily ?? hello.deviceFamily,
+                modelIdentifier: verified.node.modelIdentifier ?? hello.modelIdentifier,
+                caps,
+                commands,
+                permissions,
+                remoteIp: remoteAddress,
+            };
+            await updatePairedNodeMetadata(nodeId, {
+                displayName: nodeInfo.displayName,
+                platform: nodeInfo.platform,
+                version: nodeInfo.version,
+                deviceFamily: nodeInfo.deviceFamily,
+                modelIdentifier: nodeInfo.modelIdentifier,
+                remoteIp: nodeInfo.remoteIp,
+                caps: nodeInfo.caps,
+                commands: nodeInfo.commands,
+                permissions: nodeInfo.permissions,
+            }, opts.pairingBaseDir);
+            connections.set(nodeId, { socket, nodeInfo, invokeWaiters });
+            send({
+                type: "hello-ok",
+                serverName,
+                canvasHostUrl: buildCanvasHostUrl(socket),
+            });
+            await opts.onAuthenticated?.(nodeInfo);
+        };
+        const waitForApproval = async (request) => {
+            const deadline = Date.now() + 5 * 60 * 1000;
+            while (!abort.signal.aborted && Date.now() < deadline) {
+                const list = await listNodePairing(opts.pairingBaseDir);
+                const stillPending = list.pending.some((p) => p.requestId === request.requestId);
+                if (stillPending) {
+                    await sleep(250);
+                    continue;
+                }
+                const paired = await getPairedNode(request.nodeId, opts.pairingBaseDir);
+                if (!paired)
+                    return { ok: false, reason: "pairing rejected" };
+                // For a repair, ensure this approval happened after the request was created.
+                if (paired.approvedAtMs < request.ts) {
+                    return { ok: false, reason: "pairing rejected" };
+                }
+                return { ok: true, token: paired.token };
+            }
+            return {
+                ok: false,
+                reason: abort.signal.aborted ? "disconnected" : "pairing expired",
+            };
+        };
+        const handlePairRequest = async (req) => {
+            nodeId = String(req.nodeId ?? "").trim();
+            if (!nodeId) {
+                sendError("INVALID_REQUEST", "nodeId required");
+                return;
+            }
+            const result = await requestNodePairing({
+                nodeId,
+                displayName: req.displayName,
+                platform: req.platform,
+                version: req.version,
+                deviceFamily: req.deviceFamily,
+                modelIdentifier: req.modelIdentifier,
+                caps: Array.isArray(req.caps)
+                    ? req.caps.map((c) => String(c)).filter(Boolean)
+                    : undefined,
+                commands: Array.isArray(req.commands)
+                    ? req.commands.map((c) => String(c)).filter(Boolean)
+                    : undefined,
+                permissions: req.permissions && typeof req.permissions === "object"
+                    ? req.permissions
+                    : undefined,
+                remoteIp: remoteAddress,
+                silent: req.silent === true ? true : undefined,
+            }, opts.pairingBaseDir);
+            if (result.created) {
+                await opts.onPairRequested?.(result.request);
+            }
+            const wait = await waitForApproval(result.request);
+            if (!wait.ok) {
+                sendError("UNAUTHORIZED", wait.reason);
+                return;
+            }
+            isAuthenticated = true;
+            const existing = connections.get(nodeId);
+            if (existing?.socket && existing.socket !== socket) {
+                try {
+                    existing.socket.destroy();
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+            nodeInfo = {
+                nodeId,
+                displayName: req.displayName,
+                platform: req.platform,
+                version: req.version,
+                deviceFamily: req.deviceFamily,
+                modelIdentifier: req.modelIdentifier,
+                caps: Array.isArray(req.caps)
+                    ? req.caps.map((c) => String(c)).filter(Boolean)
+                    : undefined,
+                commands: Array.isArray(req.commands)
+                    ? req.commands.map((c) => String(c)).filter(Boolean)
+                    : undefined,
+                permissions: req.permissions && typeof req.permissions === "object"
+                    ? req.permissions
+                    : undefined,
+                remoteIp: remoteAddress,
+            };
+            connections.set(nodeId, { socket, nodeInfo, invokeWaiters });
+            send({ type: "pair-ok", token: wait.token });
+            send({
+                type: "hello-ok",
+                serverName,
+                canvasHostUrl: buildCanvasHostUrl(socket),
+            });
+            await opts.onAuthenticated?.(nodeInfo);
+        };
+        const handleEvent = async (evt) => {
+            if (!isAuthenticated || !nodeId) {
+                sendError("UNAUTHORIZED", "not authenticated");
+                return;
+            }
+            await opts.onEvent?.(nodeId, evt);
+        };
+        const handleRequest = async (req) => {
+            if (!isAuthenticated || !nodeId) {
+                send({
+                    type: "res",
+                    id: String(req.id ?? ""),
+                    ok: false,
+                    error: { code: "UNAUTHORIZED", message: "not authenticated" },
+                });
+                return;
+            }
+            if (!opts.onRequest) {
+                send({
+                    type: "res",
+                    id: String(req.id ?? ""),
+                    ok: false,
+                    error: { code: "UNAVAILABLE", message: "RPC not supported" },
+                });
+                return;
+            }
+            const id = String(req.id ?? "");
+            const method = String(req.method ?? "");
+            if (!id || !method) {
+                send({
+                    type: "res",
+                    id: id || "invalid",
+                    ok: false,
+                    error: { code: "INVALID_REQUEST", message: "id and method required" },
+                });
+                return;
+            }
+            try {
+                const result = await opts.onRequest(nodeId, {
+                    type: "req",
+                    id,
+                    method,
+                    paramsJSON: req.paramsJSON ?? null,
+                });
+                if (result.ok) {
+                    send({
+                        type: "res",
+                        id,
+                        ok: true,
+                        payloadJSON: result.payloadJSON ?? null,
+                    });
+                }
+                else {
+                    send({
+                        type: "res",
+                        id,
+                        ok: false,
+                        error: result.error,
+                    });
+                }
+            }
+            catch (err) {
+                send({
+                    type: "res",
+                    id,
+                    ok: false,
+                    error: { code: "UNAVAILABLE", message: String(err) },
+                });
+            }
+        };
+        socket.on("data", (chunk) => {
+            buffer += chunk.toString("utf8");
+            while (true) {
+                const idx = buffer.indexOf("\n");
+                if (idx === -1)
+                    break;
+                const line = buffer.slice(0, idx);
+                buffer = buffer.slice(idx + 1);
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                void (async () => {
+                    let frame;
+                    try {
+                        frame = JSON.parse(trimmed);
+                    }
+                    catch (err) {
+                        sendError("INVALID_REQUEST", String(err));
+                        return;
+                    }
+                    const type = typeof frame.type === "string" ? frame.type : "";
+                    try {
+                        switch (type) {
+                            case "hello":
+                                await handleHello(frame);
+                                break;
+                            case "pair-request":
+                                await handlePairRequest(frame);
+                                break;
+                            case "event":
+                                await handleEvent(frame);
+                                break;
+                            case "req":
+                                await handleRequest(frame);
+                                break;
+                            case "ping": {
+                                if (!isAuthenticated) {
+                                    sendError("UNAUTHORIZED", "not authenticated");
+                                    break;
+                                }
+                                const ping = frame;
+                                send({
+                                    type: "pong",
+                                    id: String(ping.id ?? ""),
+                                });
+                                break;
+                            }
+                            case "invoke-res": {
+                                if (!isAuthenticated) {
+                                    sendError("UNAUTHORIZED", "not authenticated");
+                                    break;
+                                }
+                                const res = frame;
+                                const waiter = invokeWaiters.get(res.id);
+                                if (waiter) {
+                                    invokeWaiters.delete(res.id);
+                                    clearTimeout(waiter.timer);
+                                    waiter.resolve(res);
+                                }
+                                break;
+                            }
+                            case "invoke": {
+                                // Direction is gateway -> node only.
+                                sendError("INVALID_REQUEST", "invoke not allowed from node");
+                                break;
+                            }
+                            case "res":
+                                // Direction is node -> gateway only.
+                                sendError("INVALID_REQUEST", "res not allowed from node");
+                                break;
+                            case "pong":
+                                // ignore
+                                break;
+                            default:
+                                sendError("INVALID_REQUEST", "unknown type");
+                        }
+                    }
+                    catch (err) {
+                        sendError("INVALID_REQUEST", String(err));
+                    }
+                })();
+            }
+        });
+        socket.on("close", () => {
+            const info = nodeInfo;
+            stop();
+            if (info && isAuthenticated)
+                void opts.onDisconnected?.(info);
+        });
+        socket.on("error", () => {
+            // close handler will run after close
+        });
+    };
+    const listeners = [];
+    const primary = net.createServer(onConnection);
+    await new Promise((resolve, reject) => {
+        const onError = (err) => reject(err);
+        primary.once("error", onError);
+        primary.listen(opts.port, opts.host, () => {
+            primary.off("error", onError);
+            resolve();
+        });
+    });
+    listeners.push({
+        host: String(opts.host ?? "").trim() || "(default)",
+        server: primary,
+    });
+    const address = primary.address();
+    const port = typeof address === "object" && address ? address.port : opts.port;
+    if (shouldAlsoListenOnLoopback(opts.host)) {
+        const loopback = net.createServer(onConnection);
+        try {
+            await new Promise((resolve, reject) => {
+                const onError = (err) => reject(err);
+                loopback.once("error", onError);
+                loopback.listen(port, loopbackHost, () => {
+                    loopback.off("error", onError);
+                    resolve();
+                });
+            });
+            listeners.push({ host: loopbackHost, server: loopback });
+        }
+        catch {
+            try {
+                loopback.close();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    return {
+        port,
+        close: async () => {
+            for (const sock of connections.values()) {
+                try {
+                    sock.socket.destroy();
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+            connections.clear();
+            await Promise.all(listeners.map((l) => new Promise((resolve, reject) => l.server.close((err) => (err ? reject(err) : resolve())))));
+        },
+        listConnected: () => [...connections.values()].map((c) => c.nodeInfo),
+        listeners: listeners.map((l) => ({ host: l.host, port })),
+        sendEvent: ({ nodeId, event, payloadJSON }) => {
+            const normalizedNodeId = String(nodeId ?? "").trim();
+            const normalizedEvent = String(event ?? "").trim();
+            if (!normalizedNodeId || !normalizedEvent)
+                return;
+            const conn = connections.get(normalizedNodeId);
+            if (!conn)
+                return;
+            try {
+                conn.socket.write(encodeLine({
+                    type: "event",
+                    event: normalizedEvent,
+                    payloadJSON: payloadJSON ?? null,
+                }));
+            }
+            catch {
+                // ignore
+            }
+        },
+        invoke: async ({ nodeId, command, paramsJSON, timeoutMs }) => {
+            const normalizedNodeId = String(nodeId ?? "").trim();
+            const normalizedCommand = String(command ?? "").trim();
+            if (!normalizedNodeId) {
+                throw new Error("INVALID_REQUEST: nodeId required");
+            }
+            if (!normalizedCommand) {
+                throw new Error("INVALID_REQUEST: command required");
+            }
+            const conn = connections.get(normalizedNodeId);
+            if (!conn) {
+                throw new Error(`UNAVAILABLE: node not connected (${normalizedNodeId})`);
+            }
+            const id = randomUUID();
+            const timeout = Number.isFinite(timeoutMs) ? Number(timeoutMs) : 15_000;
+            return await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => {
+                    conn.invokeWaiters.delete(id);
+                    reject(new Error("UNAVAILABLE: invoke timeout"));
+                }, Math.max(0, timeout));
+                conn.invokeWaiters.set(id, { resolve, reject, timer });
+                try {
+                    conn.socket.write(encodeLine({
+                        type: "invoke",
+                        id,
+                        command: normalizedCommand,
+                        paramsJSON: paramsJSON ?? null,
+                    }));
+                }
+                catch (err) {
+                    conn.invokeWaiters.delete(id);
+                    clearTimeout(timer);
+                    reject(err instanceof Error ? err : new Error(String(err)));
+                }
+            });
+        },
+    };
+}

package/dist/infra/canvas-host-url.js

@@ -0,0 +1,54 @@
+const isLoopbackHost = (value) => {
+    const normalized = value.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    if (normalized === "localhost")
+        return true;
+    if (normalized === "::1")
+        return true;
+    if (normalized === "0.0.0.0" || normalized === "::")
+        return true;
+    return normalized.startsWith("127.");
+};
+const normalizeHost = (value, rejectLoopback) => {
+    if (!value)
+        return "";
+    const trimmed = value.trim();
+    if (!trimmed)
+        return "";
+    if (rejectLoopback && isLoopbackHost(trimmed))
+        return "";
+    return trimmed;
+};
+const parseHostHeader = (value) => {
+    if (!value)
+        return "";
+    try {
+        return new URL(`http://${String(value).trim()}`).hostname;
+    }
+    catch {
+        return "";
+    }
+};
+const parseForwardedProto = (value) => {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+};
+export function resolveCanvasHostUrl(params) {
+    const port = params.canvasPort;
+    if (!port)
+        return undefined;
+    const scheme = params.scheme ??
+        (parseForwardedProto(params.forwardedProto)?.trim() === "https"
+            ? "https"
+            : "http");
+    const override = normalizeHost(params.hostOverride, true);
+    const requestHost = normalizeHost(parseHostHeader(params.requestHost), !!override);
+    const localAddress = normalizeHost(params.localAddress, Boolean(override || requestHost));
+    const host = override || requestHost || localAddress;
+    if (!host)
+        return undefined;
+    const formatted = host.includes(":") ? `[${host}]` : host;
+    return `${scheme}://${formatted}:${port}`;
+}

package/dist/infra/channel-summary.js

@@ -0,0 +1,78 @@
+import chalk from "chalk";
+import { loadConfig } from "../config/config.js";
+import { resolveTelegramToken } from "../telegram/token.js";
+import { normalizeE164 } from "../utils.js";
+import { getWebAuthAgeMs, readWebSelfId, webAuthExists } from "../web/session.js";
+export async function buildChannelSummary(cfg) {
+    const effective = cfg ?? loadConfig();
+    const lines = [];
+    const webEnabled = effective.web?.enabled !== false;
+    if (!webEnabled) {
+        lines.push(chalk.cyan("WhatsApp: disabled"));
+    }
+    else {
+        const webLinked = await webAuthExists();
+        const authAgeMs = getWebAuthAgeMs();
+        const authAge = authAgeMs === null ? "unknown" : formatAge(authAgeMs);
+        const { e164 } = readWebSelfId();
+        lines.push(webLinked
+            ? chalk.green(`WhatsApp: linked${e164 ? ` as ${e164}` : ""} (auth ${authAge})`)
+            : chalk.red("WhatsApp: not linked"));
+    }
+    const telegramEnabled = effective.telegram?.enabled !== false;
+    if (!telegramEnabled) {
+        lines.push(chalk.cyan("Telegram: disabled"));
+    }
+    else {
+        const { token: telegramToken } = resolveTelegramToken(effective);
+        const telegramConfigured = Boolean(telegramToken?.trim());
+        lines.push(telegramConfigured
+            ? chalk.green("Telegram: configured")
+            : chalk.cyan("Telegram: not configured"));
+    }
+    const signalEnabled = effective.signal?.enabled !== false;
+    if (!signalEnabled) {
+        lines.push(chalk.cyan("Signal: disabled"));
+    }
+    else {
+        const signalConfigured = Boolean(effective.signal) &&
+            Boolean(effective.signal?.account?.trim() ||
+                effective.signal?.httpUrl?.trim() ||
+                effective.signal?.cliPath?.trim() ||
+                effective.signal?.httpHost?.trim() ||
+                typeof effective.signal?.httpPort === "number" ||
+                typeof effective.signal?.autoStart === "boolean");
+        lines.push(signalConfigured ? chalk.green("Signal: configured") : chalk.cyan("Signal: not configured"));
+    }
+    const imessageEnabled = effective.imessage?.enabled !== false;
+    if (!imessageEnabled) {
+        lines.push(chalk.cyan("iMessage: disabled"));
+    }
+    else {
+        const imessageConfigured = Boolean(effective.imessage);
+        lines.push(imessageConfigured
+            ? chalk.green("iMessage: configured")
+            : chalk.cyan("iMessage: not configured"));
+    }
+    const allowFrom = effective.whatsapp?.allowFrom?.length
+        ? effective.whatsapp.allowFrom.map(normalizeE164).filter(Boolean)
+        : [];
+    if (allowFrom.length) {
+        lines.push(chalk.cyan(`AllowFrom: ${allowFrom.join(", ")}`));
+    }
+    return lines;
+}
+export function formatAge(ms) {
+    if (ms < 0)
+        return "unknown";
+    const minutes = Math.round(ms / 60_000);
+    if (minutes < 1)
+        return "just now";
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 48)
+        return `${hours}h ago`;
+    const days = Math.round(hours / 24);
+    return `${days}d ago`;
+}