@jungjaehoon/mama-os 0.20.0 → 0.21.0

package/dist/api/graph-api.js

@@ -16,6 +16,7 @@ exports.mapDecisionRowToGraphNode = mapDecisionRowToGraphNode;
 exports.parseGraphLimit = parseGraphLimit;
 exports.buildGraphMeta = buildGraphMeta;
 exports.validateConfigUpdate = validateConfigUpdate;
+exports.migrateLegacyManagedBackends = migrateLegacyManagedBackends;
 exports.getAllNodes = getAllNodes;
 exports.getAllEdges = getAllEdges;
 exports.getAllCheckpoints = getAllCheckpoints;
@@ -75,6 +76,43 @@ const SW_JS_PATH = path_1.default.join(VIEWER_DIR, 'sw.js');
 const MANIFEST_JSON_PATH = path_1.default.join(VIEWER_DIR, 'manifest.json');
 const VIEWER_ICON_DIR = path_1.default.join(VIEWER_DIR, 'icons');
 const VIEWER_FAVICON_PATH = path_1.default.join(VIEWER_DIR, '..', 'favicon.ico');
+// Operator viewer SPA (built from ui/ into public/ui/). Resolved per request so
+// the MAMA_UI_DIR override works for tests without module-load ordering games.
+function getUiDirectory() {
+    if (process.env.MAMA_UI_DIR) {
+        // resolve() drops trailing slashes; without it the `uiRoot + path.sep`
+        // traversal guard below would 404 every request for '/foo/bar/'-style values.
+        return path_1.default.resolve(process.env.MAMA_UI_DIR);
+    }
+    const candidateDirs = [
+        path_1.default.join(process.cwd(), 'public', 'ui'),
+        path_1.default.join(PACKAGE_ROOT_DIR, 'public', 'ui'),
+        path_1.default.join(__dirname, '../../public/ui'),
+        path_1.default.join(__dirname, '../../../public/ui'),
+        path_1.default.join(process.cwd(), 'packages', 'standalone', 'public', 'ui'),
+    ];
+    for (const candidate of candidateDirs) {
+        if (fs_1.default.existsSync(candidate) && fs_1.default.statSync(candidate).isDirectory()) {
+            return candidate;
+        }
+    }
+    return path_1.default.join(process.cwd(), 'public', 'ui');
+}
+// serveStaticFile requires an explicit content type and only reads bytes (not
+// utf-8) for image/* or octet-stream -- fonts map to octet-stream for integrity.
+const UI_STATIC_MIME = {
+    '.html': 'text/html',
+    '.js': 'text/javascript',
+    '.css': 'text/css',
+    '.json': 'application/json',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+    '.woff2': 'application/octet-stream',
+};
+// Agent-authored slot HTML renders inside this SPA. Two independent XSS layers:
+// DOMPurify at render (ui/src/api/report.ts) + this CSP on the document.
+const UI_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'";
 const DEFAULT_GRAPH_LIMIT = 300;
 exports.DEFAULT_GRAPH_LIMIT = DEFAULT_GRAPH_LIMIT;
 const MAX_GRAPH_LIMIT = 2000;
@@ -87,7 +125,7 @@ const codeActRateBuckets = new Map();
 // Model pattern helpers (used in multiple validation functions)
 const isClaudeModel = (model) => /^claude-/i.test(model);
 const isCodexModel = (model) => /^(gpt-|o\d|codex)/i.test(model);
-const supportedManagedBackends = ['claude', 'codex', 'codex-mcp', 'gemini'];
+const supportedManagedBackends = ['claude', 'codex', 'codex-mcp'];
 const isCodexFamilyBackend = (backend) => backend === 'codex' || backend === 'codex-mcp';
 const VALIDATION_TRIGGER_TYPES = new Set([
     'agent_test',
@@ -97,6 +135,80 @@ const VALIDATION_TRIGGER_TYPES = new Set([
 ]);
 const isOpus46Model = (model) => /^claude-opus-4-6(?:$|-)/i.test(model) || model.toLowerCase() === 'claude-opus-4-latest';
 const VALID_EFFORT_LEVELS = new Set(['low', 'medium', 'high', 'max']);
+function normalizeLegacyManagedBackend(backend, configPath) {
+    if (typeof backend === 'string' && backend.toLowerCase() === 'gemini') {
+        console.warn(`[GraphAPI] Deprecated backend "gemini" at ${configPath}; using "claude" for compatibility.`);
+        return 'claude';
+    }
+    return backend;
+}
+function normalizeLegacyManagedModel(agent, configPath) {
+    if (typeof agent.model === 'string' && !isClaudeModel(agent.model)) {
+        console.warn(`[GraphAPI] Deprecated Gemini model at ${configPath}; using "claude-sonnet-4-6" for compatibility.`);
+        agent.model = 'claude-sonnet-4-6';
+        return true;
+    }
+    return false;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function migrateLegacyManagedBackends(config) {
+    let migrated = false;
+    const next = { ...config };
+    const originalAgent = isRecord(config.agent) ? config.agent : undefined;
+    const originalAgentBackend = originalAgent?.backend;
+    if (isRecord(next.agent)) {
+        const agent = { ...next.agent };
+        const backend = normalizeLegacyManagedBackend(agent.backend, 'agent.backend');
+        if (backend !== agent.backend) {
+            agent.backend = backend;
+            normalizeLegacyManagedModel(agent, 'agent.model');
+            next.agent = agent;
+            migrated = true;
+        }
+    }
+    if (isRecord(next.multi_agent)) {
+        const multiAgent = { ...next.multi_agent };
+        const originalMultiAgent = isRecord(config.multi_agent) ? config.multi_agent : {};
+        const originalMultiAgentBackend = originalMultiAgent.backend;
+        const normalizedMultiAgentBackend = normalizeLegacyManagedBackend(originalMultiAgentBackend, 'multi_agent.backend');
+        if (normalizedMultiAgentBackend !== originalMultiAgentBackend) {
+            multiAgent.backend = normalizedMultiAgentBackend;
+            migrated = true;
+        }
+        const inheritedBackend = originalMultiAgentBackend ?? originalAgentBackend;
+        const normalizedInheritedBackend = normalizeLegacyManagedBackend(inheritedBackend, originalMultiAgentBackend !== undefined ? 'multi_agent.backend' : 'agent.backend');
+        if (isRecord(multiAgent.agents)) {
+            const agents = { ...multiAgent.agents };
+            let agentsMigrated = false;
+            for (const [agentId, agentConfig] of Object.entries(agents)) {
+                if (!isRecord(agentConfig)) {
+                    continue;
+                }
+                const agent = { ...agentConfig };
+                const hasExplicitBackend = Object.prototype.hasOwnProperty.call(agent, 'backend');
+                const priorEffectiveBackend = hasExplicitBackend ? agent.backend : inheritedBackend;
+                const normalizedBackend = normalizeLegacyManagedBackend(priorEffectiveBackend, `multi_agent.agents.${agentId}.backend`);
+                const inheritedBackendWasNormalized = !hasExplicitBackend && normalizedInheritedBackend !== inheritedBackend;
+                if (normalizedBackend !== priorEffectiveBackend || inheritedBackendWasNormalized) {
+                    agent.backend = normalizedBackend;
+                    normalizeLegacyManagedModel(agent, `multi_agent.agents.${agentId}.model`);
+                    agents[agentId] = agent;
+                    agentsMigrated = true;
+                    migrated = true;
+                }
+            }
+            if (agentsMigrated) {
+                multiAgent.agents = agents;
+            }
+        }
+        if (migrated) {
+            next.multi_agent = multiAgent;
+        }
+    }
+    return (migrated ? next : config);
+}
 function getCodeActRateLimitMax() {
     const raw = process.env.MAMA_CODE_ACT_RATE_LIMIT_PER_MINUTE;
     if (!raw) {
@@ -333,7 +445,7 @@ function filterEdgesByNodes(edges, nodes) {
     const nodeIds = new Set(nodes.map((n) => n.id));
     return edges.filter((e) => nodeIds.has(e.from) || nodeIds.has(e.to));
 }
-function serveStaticFile(res, filePath, contentType) {
+function serveStaticFile(res, filePath, contentType, extraHeaders = {}) {
     try {
         const stats = fs_1.default.statSync(filePath);
         if (!stats.isFile()) {
@@ -349,6 +461,7 @@ function serveStaticFile(res, filePath, contentType) {
             Pragma: 'no-cache',
             Expires: '0',
             ETag: etag,
+            ...extraHeaders,
         });
         res.end(content);
     }
@@ -578,7 +691,7 @@ async function getSimilarityEdges() {
     for (const decision of decisions.slice(0, 50)) {
         try {
             const query = `${decision.topic} ${decision.decision}`;
-            const embedding = await generateEmbedding(query);
+            const embedding = await generateEmbedding(query, 'query');
             const similar = (await vectorSearch(embedding, 3, 0.7));
             for (const s of similar) {
                 if (s.id !== decision.id && s.similarity > 0.7) {
@@ -919,10 +1032,11 @@ function createGraphHandler(options = {}) {
             res.end();
             return true;
         }
-        // Route: GET / - redirect to /viewer
+        // Route: GET / - redirect to the operator board (M7 phase 2: /ui is the
+        // default face; the legacy viewer stays reachable at /viewer)
         if (pathname === '/' && req.method === 'GET') {
-            console.log('[GraphHandler] Redirecting / to /viewer');
-            res.writeHead(302, { Location: '/viewer' });
+            console.log('[GraphHandler] Redirecting / to /ui');
+            res.writeHead(302, { Location: '/ui' });
             res.end();
             return true;
         }
@@ -958,6 +1072,29 @@ function createGraphHandler(options = {}) {
             serveStaticFile(res, VIEWER_FAVICON_PATH, 'image/x-icon');
             return true;
         }
+        // Route: GET/HEAD /ui/* - operator viewer SPA (public/ui, Vite build)
+        if ((pathname === '/ui' || pathname.startsWith('/ui/')) &&
+            (req.method === 'GET' || req.method === 'HEAD')) {
+            const uiRoot = getUiDirectory();
+            // '/ui' and '/ui/' both mean the SPA shell; slicing '/ui/' yields '' which
+            // resolves to uiRoot itself and would fail the traversal guard below.
+            const rel = pathname === '/ui' || pathname === '/ui/' ? 'index.html' : pathname.slice('/ui/'.length);
+            const resolved = path_1.default.resolve(uiRoot, rel);
+            if (!resolved.startsWith(uiRoot + path_1.default.sep)) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not found');
+                return true;
+            }
+            const isAsset = rel.startsWith('assets/');
+            const exists = fs_1.default.existsSync(resolved) && fs_1.default.statSync(resolved).isFile();
+            // Missing hashed assets must 404 (via serveStaticFile's ENOENT path) -- an
+            // index.html fallback would mask them as 200 text/html.
+            const target = exists || isAsset ? resolved : path_1.default.join(uiRoot, 'index.html');
+            const contentType = UI_STATIC_MIME[path_1.default.extname(target)] ?? 'application/octet-stream';
+            const extraHeaders = contentType === 'text/html' ? { 'Content-Security-Policy': UI_CSP } : {};
+            serveStaticFile(res, target, contentType, extraHeaders);
+            return true;
+        }
         // Route: GET/HEAD /viewer/icons/*.png - serve PWA icons
         if (pathname.startsWith('/viewer/icons/') &&
             pathname.endsWith('.png') &&
@@ -985,6 +1122,17 @@ function createGraphHandler(options = {}) {
             serveStaticFile(res, filePath, 'application/javascript');
             return true;
         }
+        // Route: GET/HEAD /viewer/js/*.js - serve first-party viewer entry modules
+        if (pathname.startsWith('/viewer/js/') &&
+            !pathname.includes('/modules/') &&
+            !pathname.includes('/utils/') &&
+            pathname.endsWith('.js') &&
+            (req.method === 'GET' || req.method === 'HEAD')) {
+            const fileName = pathname.split('/').pop();
+            const filePath = path_1.default.join(VIEWER_DIR, 'js', fileName);
+            serveStaticFile(res, filePath, 'application/javascript');
+            return true;
+        }
         // Route: GET/HEAD /viewer/js/modules/*.js - serve feature modules
         if (pathname.startsWith('/viewer/js/modules/') &&
             pathname.endsWith('.js') &&
@@ -2058,7 +2206,8 @@ function loadMAMAConfig() {
             return {};
         }
         const content = fs_1.default.readFileSync(MAMA_CONFIG_PATH, 'utf8');
-        return js_yaml_1.default.load(content) || {};
+        const config = js_yaml_1.default.load(content) || {};
+        return migrateLegacyManagedBackends(config);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -2250,6 +2399,7 @@ async function handleGetConfigRequest(_req, res) {
                         allowedTools: [
                             'mama_search',
                             'mama_recall',
+                            'context_compile',
                             'mama_load_checkpoint',
                             'Read',
                             'discord_send',
@@ -2590,7 +2740,7 @@ function validateConfigUpdate(config) {
         }
         if (config.agent.backend &&
             !supportedManagedBackends.includes(String(config.agent.backend).toLowerCase())) {
-            errors.push('agent.backend must be "claude", "codex", "codex-mcp", or "gemini"');
+            errors.push('agent.backend must be "claude", "codex", or "codex-mcp"');
         }
         if (config.agent.backend && config.agent.model && typeof config.agent.model === 'string') {
             const backend = String(config.agent.backend).toLowerCase();
@@ -2624,7 +2774,7 @@ function validateConfigUpdate(config) {
             if (backendRaw !== undefined) {
                 const backend = String(backendRaw).toLowerCase();
                 if (!supportedManagedBackends.includes(backend)) {
-                    errors.push(`multi_agent.agents.${agentId}.backend must be "claude", "codex", "codex-mcp", or "gemini"`);
+                    errors.push(`multi_agent.agents.${agentId}.backend must be "claude", "codex", or "codex-mcp"`);
                     continue;
                 }
                 if (typeof modelRaw === 'string' && modelRaw.trim()) {
@@ -2940,7 +3090,7 @@ async function handleMultiAgentUpdateAgentRequest(req, res, pathname, options =
         if (body.backend !== undefined &&
             (typeof body.backend !== 'string' ||
                 !supportedManagedBackends.includes(String(body.backend).toLowerCase()))) {
-            validationErrors.push('backend must be "claude", "codex", "codex-mcp", or "gemini"');
+            validationErrors.push('backend must be "claude", "codex", or "codex-mcp"');
         }
         const nextBackend = (body.backend !== undefined ? String(body.backend).toLowerCase() : currentAgent.backend);
         const nextModel = (body.model !== undefined ? body.model : currentAgent.model);
@@ -3310,7 +3460,28 @@ async function handleCodeActRequest(req, res, options = {}) {
             res.end(JSON.stringify({ error: true, message: 'Missing required field: code (string)' }));
             return;
         }
-        const result = await options.executeCodeAct(code);
+        let agentId;
+        if (body.agent_id !== undefined) {
+            if (typeof body.agent_id !== 'string' || body.agent_id.trim().length === 0) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: true, message: 'agent_id must be a non-empty string.' }));
+                return;
+            }
+            agentId = body.agent_id.trim();
+        }
+        const allowedTools = normalizeCodeActToolList(body.allowed_tools, 'allowed_tools', res);
+        if (allowedTools === false) {
+            return;
+        }
+        const blockedTools = normalizeCodeActToolList(body.blocked_tools, 'blocked_tools', res);
+        if (blockedTools === false) {
+            return;
+        }
+        const result = await options.executeCodeAct(code, {
+            ...(agentId ? { agentId } : {}),
+            ...(allowedTools ? { allowedTools } : {}),
+            ...(blockedTools ? { blockedTools } : {}),
+        });
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(result));
     }
@@ -3321,4 +3492,15 @@ async function handleCodeActRequest(req, res, options = {}) {
         res.end(JSON.stringify({ error: true, message }));
     }
 }
+function normalizeCodeActToolList(value, field, res) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: true, message: `${field} must be an array of strings.` }));
+        return false;
+    }
+    return value.map((item) => item.trim()).filter((item) => item.length > 0);
+}
 //# sourceMappingURL=graph-api.js.map