@interactive-inc/claude-funnel 0.7.1 → 0.8.1

package/lib/gateway/gateway-server.ts

@@ -0,0 +1,414 @@
+import { existsSync, mkdirSync } from "node:fs"
+import { join } from "node:path"
+import type { Server, ServerWebSocket } from "bun"
+import type { Hono } from "hono"
+import type { FunnelChannels } from "@/engine/channels/channels"
+import { constantTimeEqual, requireBearerToken } from "@/gateway/auth-middleware"
+import { type Env, factory } from "@/gateway/factory"
+import { FunnelBroadcaster } from "@/gateway/broadcaster"
+import { FunnelEventStore } from "@/gateway/funnel-event-store"
+import { FunnelListenerSupervisor } from "@/gateway/listener-supervisor"
+import { killCompetingSlackGateways } from "@/gateway/kill-competing-slack-gateways"
+import { gatewayRoutes } from "@/gateway/routes"
+import { FunnelLogger } from "@/engine/logger/logger"
+import { NodeFunnelLogger } from "@/engine/logger/node-logger"
+import type { FunnelProcessRunner } from "@/engine/process/process-runner"
+import type { FunnelSettingsReader } from "@/engine/settings/settings-reader"
+import type { FunnelClock } from "@/engine/time/clock"
+
+const DEFAULT_PORT = 9742
+const DEFAULT_LOG_DIR = "/tmp/funnel/events"
+const DB_FILENAME = "events.db"
+
+type Deps = {
+  channels: FunnelChannels
+  settings: FunnelSettingsReader
+  port?: number
+  /** Directory holding the SQLite event store. The DB file lives at `<logDir>/events.db`. */
+  logDir?: string
+  process?: FunnelProcessRunner
+  clock?: FunnelClock
+  logger?: FunnelLogger
+  selfPid?: number
+  killCompetingSlack?: boolean
+  /** Bearer token required for `/listeners*`, `/status`, and `/ws`. Empty string disables auth (tests only). */
+  token?: string
+}
+
+type WsData = {
+  /** Stable channel id (uuid) the client subscribed to. "" for tap-all clients. */
+  channel: string
+  /** Resolved channel name (for log readability). null for tap-all or unknown. */
+  channelName: string | null
+  /** Connector names belonging to that channel; used by tap-all replay filtering. */
+  connectors: string[]
+  tapAll?: boolean
+  /** Routing mode for this channel; resolved at upgrade time from settings. */
+  delivery: "fanout" | "exclusive"
+  /** Replay any events with offset strictly greater than this on open, then resume the live stream. */
+  since?: number
+}
+
+const defaultLogger = new NodeFunnelLogger()
+
+/**
+ * In-process gateway: runs `Bun.serve` (HTTP + WebSocket /ws), boots connector
+ * listeners through `FunnelListenerSupervisor`, fans events out via
+ * `FunnelBroadcaster`, and persists them via `FunnelEventStore` (SQLite).
+ * System events (gateway lifecycle, connect/disconnect) flow to `FunnelLogger`
+ * instead — keeping the SQLite seq space exclusive to broadcaster traffic so
+ * the broadcaster's offset counter and `getMaxSeq()` stay aligned without
+ * per-event coordination. Exposes `/listeners` HTTP for runtime
+ * start/stop/restart of individual connectors.
+ */
+export class FunnelGatewayServer {
+  private readonly channels: FunnelChannels
+  private readonly settings: FunnelSettingsReader
+  private readonly port: number
+  private readonly logDir: string
+  private readonly process?: FunnelProcessRunner
+  private readonly logger: FunnelLogger
+  private readonly selfPid: number
+  private readonly killCompetingSlack: boolean
+  private readonly token: string
+  private readonly broadcaster: FunnelBroadcaster
+  private readonly eventStore: FunnelEventStore
+  private readonly supervisor: FunnelListenerSupervisor
+  private readonly nowMs: () => number
+  private startedAt: number | null = null
+  private server: Server<WsData> | null = null
+
+  constructor(deps: Deps) {
+    this.channels = deps.channels
+    this.settings = deps.settings
+    this.port = deps.port ?? DEFAULT_PORT
+    this.logDir = deps.logDir ?? DEFAULT_LOG_DIR
+    this.process = deps.process
+    this.logger = deps.logger ?? defaultLogger
+    this.selfPid = deps.selfPid ?? globalThis.process.pid
+    this.killCompetingSlack = deps.killCompetingSlack ?? true
+    this.token = deps.token ?? ""
+    const clock = deps.clock
+    this.nowMs = clock ? () => clock.millis() : () => Date.now()
+    if (!existsSync(this.logDir)) mkdirSync(this.logDir, { recursive: true })
+    this.eventStore = new FunnelEventStore({
+      path: join(this.logDir, DB_FILENAME),
+      now: this.nowMs,
+    })
+    this.broadcaster = new FunnelBroadcaster({
+      logger: this.logger,
+      now: this.nowMs,
+      persistentReplay: this.eventStore,
+    })
+    this.broadcaster.seedLatestOffset(this.eventStore.findMaxOffset())
+    this.supervisor = new FunnelListenerSupervisor({
+      channels: this.channels,
+      logger: this.logger,
+      notify: (channelName, connectorName, content, meta) =>
+        this.notify(channelName, connectorName, content, meta),
+      now: this.nowMs,
+    })
+  }
+
+  async start(): Promise<Server<WsData>> {
+    if (this.server) return this.server
+
+    const app = this.buildApp()
+
+    this.startedAt = this.nowMs()
+    this.server = Bun.serve<WsData>({
+      port: this.port,
+      development: false,
+      fetch: (request, server) => this.handleFetch(request, server, app),
+      websocket: {
+        open: (ws) => this.handleWsOpen(ws),
+        close: (ws) => this.handleWsClose(ws),
+        message() {
+          // required by Bun's websocket interface; no client → gateway messages today
+        },
+      },
+    })
+
+    this.logServerStarted()
+    await this.bootListeners()
+
+    return this.server
+  }
+
+  async stop(): Promise<void> {
+    await this.supervisor.stopAll()
+
+    if (this.server) {
+      this.server.stop()
+      this.server = null
+    }
+  }
+
+  getStatus(): { clients: number; channels: { channel: string; connectors: string[] }[] } {
+    return {
+      clients: this.broadcaster.getClientCount(),
+      channels: this.broadcaster.listChannels(),
+    }
+  }
+
+  getBroadcaster(): FunnelBroadcaster {
+    return this.broadcaster
+  }
+
+  getSupervisor(): FunnelListenerSupervisor {
+    return this.supervisor
+  }
+
+  getEventStore(): FunnelEventStore {
+    return this.eventStore
+  }
+
+  private handleFetch(
+    request: Request,
+    server: Server<WsData>,
+    app: Hono<Env>,
+  ): Response | Promise<Response> | undefined {
+    const url = new URL(request.url)
+
+    if (url.pathname === "/ws" && request.headers.get("upgrade") === "websocket") {
+      if (this.token && !this.tokenMatchesUpgrade(request)) {
+        return new Response("unauthorized", { status: 401 })
+      }
+
+      const tapAll = url.searchParams.get("tap") === "all"
+      const requestedChannel = tapAll ? "" : (url.searchParams.get("channel") ?? "")
+      const channel = !tapAll && requestedChannel ? this.resolveChannel(requestedChannel) : null
+      const channelId = tapAll ? "" : (channel?.id ?? requestedChannel)
+      const channelName = tapAll ? null : (channel?.name ?? null)
+      const connectors = channel?.connectors ?? []
+      const delivery = channel?.delivery ?? "fanout"
+      const sinceRaw = url.searchParams.get("since")
+      const sinceParsed = sinceRaw === null ? Number.NaN : Number.parseInt(sinceRaw, 10)
+      const since = Number.isFinite(sinceParsed) && sinceParsed >= 0 ? sinceParsed : undefined
+      const upgraded = server.upgrade(request, {
+        data: {
+          channel: channelId,
+          channelName,
+          connectors,
+          tapAll,
+          delivery,
+          since,
+        },
+      })
+
+      if (upgraded) return undefined
+
+      return new Response("WebSocket upgrade failed", { status: 400 })
+    }
+
+    return app.fetch(request)
+  }
+
+  private handleWsOpen(ws: ServerWebSocket<WsData>): void {
+    if (typeof ws.data.since === "number") {
+      const replay = this.broadcaster.replaySince(ws.data.since, ws.data)
+
+      for (const event of replay) ws.send(JSON.stringify(event))
+    }
+
+    this.broadcaster.addClient(ws, ws.data)
+
+    if (ws.data.channelName) {
+      const meta: Record<string, string> = {
+        event_type: "system",
+        action: "channel_connect",
+        channel: ws.data.channelName,
+        channelId: ws.data.channel,
+        connectors: ws.data.connectors.join(","),
+        total: String(this.broadcaster.getClientCount()),
+      }
+
+      this.logger.info("channel connected", meta)
+    } else {
+      this.logger.info("tap-all client connected", {
+        event_type: "system",
+        action: "tap_connect",
+        total: String(this.broadcaster.getClientCount()),
+      })
+    }
+  }
+
+  private handleWsClose(ws: ServerWebSocket<WsData>): void {
+    this.broadcaster.removeClient(ws)
+
+    if (ws.data.channelName) {
+      this.logger.info("channel disconnected", {
+        event_type: "system",
+        action: "channel_disconnect",
+        channel: ws.data.channelName,
+        channelId: ws.data.channel,
+        total: String(this.broadcaster.getClientCount()),
+      })
+    } else {
+      this.logger.info("tap-all client disconnected", {
+        event_type: "system",
+        action: "tap_disconnect",
+        total: String(this.broadcaster.getClientCount()),
+      })
+    }
+  }
+
+  private logServerStarted(): void {
+    this.logger.info("gateway started", {
+      event_type: "system",
+      action: "gateway_start",
+      port: String(this.port),
+      pid: String(this.selfPid),
+    })
+
+    this.logger.info("funnel gateway listening", {
+      url: `http://localhost:${this.port}`,
+      websocket: `ws://localhost:${this.port}/ws`,
+      health: `http://localhost:${this.port}/health`,
+    })
+  }
+
+  private buildApp(): Hono<Env> {
+    const base = factory.createApp()
+
+    base.use((c, next) => {
+      c.set("deps", {
+        selfPid: this.selfPid,
+        broadcaster: this.broadcaster,
+        supervisor: this.supervisor,
+        channels: this.channels,
+        uptimeMs: () => (this.startedAt ? this.nowMs() - this.startedAt : 0),
+      })
+
+      return next()
+    })
+
+    if (this.token) {
+      base.use("/listeners/*", requireBearerToken({ expected: this.token }))
+      base.use("/status", requireBearerToken({ expected: this.token }))
+      base.use("/channels/*", requireBearerToken({ expected: this.token }))
+    }
+
+    return base.route("/", gatewayRoutes)
+  }
+
+  /**
+   * Reads the bearer token from the WebSocket upgrade request. Accepts:
+   *   - `Sec-WebSocket-Protocol: funnel.token.<value>` (preferred — header, never logged in URLs)
+   *   - `Authorization: Bearer <value>` (also header-based)
+   * Returns true on a constant-time match against the daemon token.
+   */
+  private tokenMatchesUpgrade(request: Request): boolean {
+    const protocols = (request.headers.get("sec-websocket-protocol") ?? "")
+      .split(",")
+      .map((p) => p.trim())
+      .filter((p) => p.length > 0)
+
+    for (const proto of protocols) {
+      if (
+        proto.startsWith("funnel.token.") &&
+        constantTimeEqual(proto.slice("funnel.token.".length), this.token)
+      ) {
+        return true
+      }
+    }
+
+    const auth = request.headers.get("authorization") ?? ""
+    const match = auth.match(/^Bearer\s+(.+)$/i)
+
+    if (match && constantTimeEqual(match[1] ?? "", this.token)) return true
+
+    return false
+  }
+
+  private resolveChannel(
+    requested: string,
+  ): { id: string; name: string; connectors: string[]; delivery: "fanout" | "exclusive" } | null {
+    const settings = this.settings.read()
+    const channel = settings?.channels.find((c) => c.id === requested || c.name === requested)
+
+    if (!channel) return null
+
+    return {
+      id: channel.id,
+      name: channel.name,
+      connectors: channel.connectors.map((c) => c.name),
+      delivery: channel.delivery,
+    }
+  }
+
+  private async bootListeners(): Promise<void> {
+    const allConnectors = this.channels.listAllConnectors()
+
+    if (this.killCompetingSlack && allConnectors.some((c) => c.type === "slack")) {
+      const killed = await killCompetingSlackGateways({
+        selfPid: this.selfPid,
+        process: this.process,
+        logger: this.logger,
+      })
+
+      if (killed.length > 0) {
+        this.logger.info("killed competing Slack gateway processes", {
+          event_type: "system",
+          action: "kill_competing",
+          pids: killed.join(","),
+        })
+      }
+    }
+
+    await this.supervisor.startAll()
+
+    for (const entry of this.supervisor.list()) {
+      this.logger.info(`${entry.type} listener started: ${entry.name}`, {
+        event_type: "system",
+        action: `${entry.type}_connect`,
+        channel: entry.channelName,
+        connector: entry.name,
+      })
+    }
+
+    this.logger.info(`event store: ${join(this.logDir, DB_FILENAME)}`)
+    this.logger.info("funnel gateway running")
+  }
+
+  private async notify(
+    channelName: string,
+    connectorName: string,
+    content: string,
+    meta?: Record<string, string>,
+  ): Promise<void> {
+    const channelId = this.lookupChannelId(channelName)
+    const connectorId = channelId ? this.lookupConnectorId(channelId, connectorName) : null
+    const enriched: Record<string, string> = {
+      ...meta,
+      channel: channelName,
+      connector: connectorName,
+    }
+
+    if (channelId) enriched.channelId = channelId
+    if (connectorId) enriched.connectorId = connectorId
+
+    const event = this.broadcaster.broadcast(content, enriched)
+
+    this.eventStore.record({
+      content,
+      channelId: channelId ?? null,
+      connectorId: connectorId ?? null,
+      meta: enriched,
+      offset: event.offset,
+    })
+  }
+
+  private lookupChannelId(channelName: string): string | null {
+    const channel = this.settings.read().channels.find((c) => c.name === channelName)
+
+    return channel?.id ?? null
+  }
+
+  private lookupConnectorId(channelId: string, connectorName: string): string | null {
+    const channel = this.settings.read().channels.find((c) => c.id === channelId)
+    const connector = channel?.connectors.find((c) => c.name === connectorName)
+
+    return connector?.id ?? null
+  }
+}

package/lib/gateway/gateway-token.ts

@@ -0,0 +1,79 @@
+import { homedir } from "node:os"
+import { dirname, join } from "node:path"
+import { FunnelFileSystem } from "@/engine/fs/file-system"
+import { NodeFunnelFileSystem } from "@/engine/fs/node-file-system"
+import { FUNNEL_DIR } from "@/engine/settings/settings-store"
+
+const TOKEN_FILE_NAME = "gateway.token"
+const TOKEN_BYTES = 32
+
+type Deps = {
+  fs?: FunnelFileSystem
+  dir?: string
+  generate?: () => string
+}
+
+const defaultFs = new NodeFunnelFileSystem()
+
+const defaultGenerate = (): string => {
+  const buf = new Uint8Array(TOKEN_BYTES)
+  crypto.getRandomValues(buf)
+
+  return [...buf].map((b) => b.toString(16).padStart(2, "0")).join("")
+}
+
+/**
+ * Reads / generates the gateway daemon token used to authenticate
+ * `/listeners*`, `/status`, and `/ws` connections.
+ *
+ * Token file: `<dir>/gateway.token` (default `~/.funnel/gateway.token`),
+ * written with mode 0600. Clients on the same machine as the daemon read
+ * the file directly; the token never leaves the user's home directory.
+ */
+export class FunnelGatewayToken {
+  private readonly fs: FunnelFileSystem
+  private readonly path: string
+  private readonly generate: () => string
+
+  constructor(deps: Deps = {}) {
+    this.fs = deps.fs ?? defaultFs
+    this.path = join(deps.dir ?? FUNNEL_DIR, TOKEN_FILE_NAME)
+    this.generate = deps.generate ?? defaultGenerate
+    Object.freeze(this)
+  }
+
+  read(): string | null {
+    if (!this.fs.existsSync(this.path)) return null
+
+    const value = this.fs.readFileSync(this.path).trim()
+
+    return value.length > 0 ? value : null
+  }
+
+  /**
+   * Returns the existing token or, if missing, generates one and writes it with mode 0600.
+   *
+   * NOTE: not atomic — two concurrent `ensure()` calls (e.g., `fnl gateway start` racing
+   * itself before the PID lock is acquired) could each generate independent tokens. The
+   * gateway PID file makes this practically a non-issue; if you need stronger guarantees,
+   * take a file lock around this call externally.
+   */
+  ensure(): string {
+    const existing = this.read()
+
+    if (existing) return existing
+
+    const token = this.generate()
+
+    this.fs.mkdirSync(dirname(this.path), { recursive: true })
+    this.fs.writeSecretFileSync(this.path, `${token}\n`)
+
+    return token
+  }
+
+  getPath(): string {
+    return this.path
+  }
+}
+
+export const DEFAULT_GATEWAY_TOKEN_PATH = join(homedir(), ".funnel", TOKEN_FILE_NAME)

package/lib/{modules/gateway/funnel-gateway.ts → gateway/gateway.ts}

@@ -1,14 +1,19 @@
-import { join, resolve } from "node:path"
-import { FunnelFileSystem } from "@/modules/fs/funnel-file-system"
-import { NodeFunnelFileSystem } from "@/modules/fs/node-funnel-file-system"
-import { FunnelProcessRunner } from "@/modules/process/funnel-process-runner"
-import { NodeFunnelProcessRunner } from "@/modules/process/node-funnel-process-runner"
-import { FUNNEL_DIR } from "@/modules/settings/funnel-settings-store"
-import { FunnelClock } from "@/modules/time/funnel-clock"
-import { NodeFunnelClock } from "@/modules/time/node-funnel-clock"
+import { join } from "node:path"
+import { FunnelFileSystem } from "@/engine/fs/file-system"
+import { resolveDaemonScript } from "@/gateway/resolve-daemon-script"
+import { NodeFunnelFileSystem } from "@/engine/fs/node-file-system"
+import { FunnelProcessRunner } from "@/engine/process/process-runner"
+import { NodeFunnelProcessRunner } from "@/engine/process/node-process-runner"
+import { FUNNEL_DIR } from "@/engine/settings/settings-store"
+import { FunnelClock } from "@/engine/time/clock"
+import { NodeFunnelClock } from "@/engine/time/node-clock"
 
 const DEFAULT_PORT = 9742
 const DEFAULT_TMP_DIR = "/tmp/funnel"
+const STARTUP_TIMEOUT_MS = 5000
+const SIGTERM_TIMEOUT_MS = 2000
+const POLL_INTERVAL_MS = 100
+const SIGKILL_GRACE_MS = 200
 
 type Deps = {
   process?: FunnelProcessRunner
@@ -78,12 +83,17 @@ export class FunnelGateway {
 
     this.fs.mkdirSync(this.tmpDir, { recursive: true })
 
-    const gatewayScript = resolve(import.meta.dir, "./daemon.ts")
+    const gatewayScript = resolveDaemonScript()
     const command = this.buildStartCommand(gatewayScript, options)
 
     this.process.detach(["bash", "-c", command])
 
-    await this.sleep(800)
+    const deadline = Date.now() + STARTUP_TIMEOUT_MS
+
+    while (Date.now() < deadline) {
+      if (this.isRunning()) return true
+      await this.sleep(POLL_INTERVAL_MS)
+    }
 
     return this.isRunning()
   }
@@ -111,7 +121,7 @@ export class FunnelGateway {
       return false
     }
 
-    const deadline = this.clock.millis() + 2000
+    const deadline = this.clock.millis() + SIGTERM_TIMEOUT_MS
 
     while (this.clock.millis() < deadline) {
       if (!this.isProcessAlive(pid)) {
@@ -119,7 +129,7 @@ export class FunnelGateway {
         return true
       }
 
-      await this.sleep(100)
+      await this.sleep(POLL_INTERVAL_MS)
     }
 
     try {
@@ -128,7 +138,7 @@ export class FunnelGateway {
       // ignore
     }
 
-    await this.sleep(200)
+    await this.sleep(SIGKILL_GRACE_MS)
     this.removePid()
 
     return !this.isProcessAlive(pid)
@@ -162,6 +172,10 @@ export class FunnelGateway {
     return this.gatewayLog
   }
 
+  getPort(): number {
+    return this.port
+  }
+
   private readPid(): number | null {
     if (!this.fs.existsSync(this.pidFile)) return null
 

package/lib/{modules/gateway → gateway}/kill-competing-slack-gateways.ts

@@ -1,7 +1,7 @@
-import { FunnelLogger } from "@/modules/logger/funnel-logger"
-import { NodeFunnelLogger } from "@/modules/logger/node-funnel-logger"
-import { FunnelProcessRunner } from "@/modules/process/funnel-process-runner"
-import { NodeFunnelProcessRunner } from "@/modules/process/node-funnel-process-runner"
+import { FunnelLogger } from "@/engine/logger/logger"
+import { NodeFunnelLogger } from "@/engine/logger/node-logger"
+import { FunnelProcessRunner } from "@/engine/process/process-runner"
+import { NodeFunnelProcessRunner } from "@/engine/process/node-process-runner"
 
 type Props = {
   selfPid: number