@luckydraw/cumulus 0.31.66 → 1.0.1

package/dist/gateway/server.js

@@ -23,16 +23,17 @@ import * as path from 'path';
 import { loadThreadConfig, saveThreadConfig, setConfigThreadsDir } from '../lib/config.js';
 import { loadEmbeddings, generateMissingEmbeddings } from '../lib/embeddings.js';
 import { sendMessage, getOrCreateThread, clearThreadCache, getActiveSubprocessCount, setGatewayThreadsDir, } from '../lib/gateway.js';
+import { verifyLicense, majorOf, LICENSE_CONTACT } from '../lib/license.js';
 import { getPromptsDirForThreadPath, isValidCaptureId, readPromptCapture, } from '../lib/prompt-capture.js';
 import { catchUpSegmentation, loadSegmentBoundaries, saveSegmentBoundaries, } from '../lib/segments.js';
 import { listTemplates, scaffoldFromTemplate } from '../lib/templates.js';
-import { checkForUpdate, performUpdate, readChangelog } from '../lib/version-check.js';
+import { checkForUpdate, getCurrentVersion, performUpdate, readChangelog, } from '../lib/version-check.js';
 import { serveStaticFile, getMediaDir } from './adapters/webchat.js';
 import { authenticate, getPresentedKey } from './auth.js';
 import { BridgeGateway } from './bridge/gateway.js';
 import { applyConfigPatch, maskedConfigView } from './config.js';
 import { handleEmailHook, handleFormHook, handleGenericWebhook, } from './hooks.js';
-import { allNamespaceKeys, extraMcpServersForThread, namespaceForKey, namespaceForThread, resolveExecutorProxy, threadAccessibleToScope, threadVisibleToScope, } from './namespaces.js';
+import { allNamespaceKeys, demoMintDenial, extraMcpServersForThread, licenseBannerLines, namespaceForKey, namespaceForThread, resolveExecutorProxy, threadAccessibleToScope, threadVisibleToScope, } from './namespaces.js';
 import { configureVapid, sendNotification, subscribe as pushSubscribe, unsubscribe as pushUnsubscribe, } from './push.js';
 import { validateTranscriptFlush, ingestTranscriptFlush } from './transcript-ingest.js';
 const threadQueues = new Map();
@@ -379,6 +380,39 @@ function denyOutOfNamespace(res, threadName, scope) {
     jsonResponse(res, 403, { error: 'Thread not in your namespace' });
     return true;
 }
+/** Thread names that currently exist on disk (one `.jsonl` per thread). */
+export function listExistingThreadNames() {
+    if (!fs.existsSync(THREADS_DIR))
+        return [];
+    return fs
+        .readdirSync(THREADS_DIR)
+        .filter(f => f.endsWith('.jsonl'))
+        .map(f => f.replace(/\.jsonl$/, ''));
+}
+/** The 402 body for a demo-cap refusal. Exported so tests assert one string. */
+export function demoCapMessage(d) {
+    return (`Demo mode: namespace "${d.namespace}" has reached its limit of ${d.cap} visitor threads ` +
+        `(${d.count} in use). Existing threads keep working. ` +
+        `Commercial and production use requires a licence — contact ${LICENSE_CONTACT}.`);
+}
+/**
+ * 402s and returns true when the request would MINT a new thread in an
+ * unlicensed namespace that is already at the demo cap (task 127). Non-namespaced
+ * threads, already-existing threads and licensed namespaces all pass through.
+ */
+function denyOverDemoCap(res, threadName, scope) {
+    const denial = demoMintDenial(threadName, scope.namespaces, listExistingThreadNames(), scope.license);
+    if (!denial)
+        return false;
+    jsonResponse(res, 402, {
+        error: demoCapMessage(denial),
+        demoMode: true,
+        namespace: denial.namespace,
+        cap: denial.cap,
+        contact: LICENSE_CONTACT,
+    });
+    return true;
+}
 async function handleAgentInject(req, res, pipelineOpts, scope) {
     let body;
     try {
@@ -420,6 +454,23 @@ async function handleAgentInject(req, res, pipelineOpts, scope) {
         jsonResponse(res, 403, { error: `Thread not in your namespace: ${denied.join(', ')}` });
         return;
     }
+    // Task 127: injecting into a thread that doesn't exist yet mints it. Checked
+    // once against a single inventory read so a multi-target inject can't slip
+    // extra threads past the cap.
+    const existing = listExistingThreadNames();
+    for (const t of targetNames) {
+        const capDenial = demoMintDenial(t, scope.namespaces, existing, scope.license);
+        if (capDenial) {
+            jsonResponse(res, 402, {
+                error: demoCapMessage(capDenial),
+                demoMode: true,
+                namespace: capDenial.namespace,
+                cap: capDenial.cap,
+                contact: LICENSE_CONTACT,
+            });
+            return;
+        }
+    }
     const results = [];
     for (const targetName of targetNames) {
         const type = messageType || 'direct';
@@ -1084,9 +1135,12 @@ async function handleIngestTranscript(req, res, scope) {
         jsonResponse(res, 400, { error: parsed.error });
         return;
     }
-    // P7: the target thread arrives in the body, so gate it here.
+    // P7: the target thread arrives in the body, so gate it here. Task 127's demo
+    // cap rides the same spot for the same reason.
     if (denyOutOfNamespace(res, parsed.flush.targetThread, scope))
         return;
+    if (denyOverDemoCap(res, parsed.flush.targetThread, scope))
+        return;
     try {
         const result = await ingestTranscriptFlush(parsed.flush);
         jsonResponse(res, 200, result);
@@ -1364,6 +1418,8 @@ async function handleMigrate(req, res, opts, scope) {
     // P7: the thread arrives in the body — gate before creating/cloning anything.
     if (denyOutOfNamespace(res, threadName, scope))
         return;
+    if (denyOverDemoCap(res, threadName, scope))
+        return;
     const result = {
         threadName,
         synced: 0,
@@ -1674,6 +1730,34 @@ export async function startGatewayServer(options) {
     // them into the valid-key set. The namespace→key mapping stays in
     // `namespaces` for scope resolution.
     const namespaces = options.namespaces ?? [];
+    // Licence verification (task 127). Offline, once at startup — SIGHUP config
+    // reload is a full process restart, so this re-runs there too. Pasting a key
+    // therefore requires a reload, which is the right cadence for a rare act.
+    const licenseStatus = verifyLicense(options.licenseKey, majorOf(getCurrentVersion()));
+    // Task 129: the licence key is editable in Settings but NEVER live-applied —
+    // enforcement stays `licenseStatus` above, verified once at startup (127's
+    // reload cadence). This tracks the on-disk value only, so GET /api/config can
+    // render masked state and a truthful pendingReload flag after a PUT.
+    let storedLicenseKey = options.licenseKey;
+    const licenseView = () => ({
+        licensed: licenseStatus.licensed,
+        ...(licenseStatus.licensed
+            ? { licensee: licenseStatus.licensee }
+            : { reason: licenseStatus.reason }),
+        pendingReload: (storedLicenseKey ?? '') !== (options.licenseKey ?? ''),
+    });
+    const emitLicenseBanner = () => {
+        for (const line of licenseBannerLines(licenseStatus, namespaces, listExistingThreadNames())) {
+            console.log(line);
+        }
+    };
+    emitLicenseBanner();
+    // Periodic repeat while unlicensed, so a long-running demo deployment keeps
+    // saying so. `unref` keeps it from holding the process open.
+    const licenseBannerTimer = licenseStatus.licensed
+        ? undefined
+        : setInterval(emitLicenseBanner, 60 * 60 * 1000);
+    licenseBannerTimer?.unref?.();
     const nsKeys = allNamespaceKeys(namespaces);
     let currentApiKeys = Array.from(new Set([...options.apiKeys, ...nsKeys]));
     let scheduler;
@@ -1783,6 +1867,13 @@ export async function startGatewayServer(options) {
             jsonResponse(res, 403, { error: 'Thread not in your namespace' });
             return;
         }
+        // Demo capacity gate (task 127) — rides the same choke point, one notch
+        // later: access says WHO may touch a thread, this says whether a NEW one may
+        // be minted. Ordered after the 403 so an out-of-namespace caller never learns
+        // a namespace's occupancy from the status code.
+        const scope = { ns: scopeNs, namespaces, license: licenseStatus };
+        if (pathThread && denyOverDemoCap(res, pathThread, scope))
+            return;
         try {
             // POST /bridge/call — route a tool call to the connected app tab (task
             // 097). Body: { thread, command, params?, confirm?, summary? }. Commands
@@ -1812,6 +1903,8 @@ export async function startGatewayServer(options) {
                     jsonResponse(res, 403, { error: 'Thread not in your namespace' });
                     return;
                 }
+                if (denyOverDemoCap(res, thread, scope))
+                    return;
                 const callParams = body.params ?? {};
                 const manifestEntry = bridgeGateway.manifest(thread)?.find(c => c.name === command);
                 const needsConfirm = Boolean(body.confirm) || manifestEntry?.risk === 'export';
@@ -1929,7 +2022,7 @@ export async function startGatewayServer(options) {
             }
             // POST /api/ingest-transcript — store-only transcript ingestion (task 096)
             if (routePath === '/api/ingest-transcript' && req.method === 'POST') {
-                await handleIngestTranscript(req, res, { ns: scopeNs, namespaces });
+                await handleIngestTranscript(req, res, scope);
                 return;
             }
             // GET /api/thread/:name/history
@@ -2022,15 +2115,12 @@ export async function startGatewayServer(options) {
             // PUT /api/config reassigns pipelineOpts.* in place, so this is the single
             // authoritative in-memory source (task 104).
             if (routePath === '/api/models' && req.method === 'GET') {
-                // Build models list with global default marked
-                let models = (pipelineOpts.models || []).map(m => ({ ...m }));
-                if (models.length === 0) {
-                    // Fallback: just Claude
-                    models = [
-                        { id: 'claude', label: 'Claude (CLI)', provider: 'claude-cli', default: true },
-                    ];
-                }
-                else {
+                // Serve the configured catalog truthfully — task 129 deleted the
+                // hardcoded fallbacks (a lone Claude entry / the Opus-Sonnet pair).
+                // An unconfigured gateway gets empty arrays; setup seeds a catalog,
+                // and the Settings gear (topbar, task 128) is the recovery path.
+                const models = (pipelineOpts.models || []).map(m => ({ ...m }));
+                if (models.length > 0) {
                     // Clear all defaults, then set the global default (or first if none specified)
                     const globalDefault = pipelineOpts.model || models[0].id;
                     for (const m of models) {
@@ -2038,31 +2128,39 @@ export async function startGatewayServer(options) {
                     }
                 }
                 // Claude CLI model variants (Opus/Sonnet/...) for the sub-model picker.
-                // Config-driven; fall back to the historical Opus/Sonnet pair when unset.
-                let claudeModels = (pipelineOpts.claudeModels || []).map(m => ({ ...m }));
-                if (claudeModels.length === 0) {
-                    claudeModels = [
-                        { id: 'claude-opus-5[1m]', label: 'Opus 5', default: true },
-                        { id: 'claude-sonnet-5[1m]', label: 'Sonnet 5' },
-                    ];
-                }
-                else if (!claudeModels.some(m => m.default)) {
+                // First-is-default is a normalization rule for a configured list, not
+                // model knowledge — it stays.
+                const claudeModels = (pipelineOpts.claudeModels || []).map(m => ({ ...m }));
+                if (claudeModels.length > 0 && !claudeModels.some(m => m.default)) {
                     claudeModels[0].default = true;
                 }
                 jsonResponse(res, 200, { models, claudeModels });
                 return;
             }
+            // GET/PUT /api/config — gateway-level settings are ADMIN-ONLY (task 128).
+            // Task 104 opened these to "any valid key", which predated scoped app keys
+            // becoming a public surface (097 P4 ships one to every app visitor's
+            // browser); a scoped key must not read or rewrite the gateway's model
+            // catalog, default model, or provider credentials.
+            if (routePath === '/api/config' && scopeNs) {
+                jsonResponse(res, 403, { error: 'Gateway settings require an admin key' });
+                return;
+            }
             // GET /api/config — live-mutable config subset (task 104), credentials
-            // MASKED. Any valid gateway key (Karl's poll). Lets the in-app editor
-            // render current state without ever exposing a full provider key.
+            // MASKED. Lets the in-app editor render current state without ever
+            // exposing a full provider key.
             if (routePath === '/api/config' && req.method === 'GET') {
-                jsonResponse(res, 200, maskedConfigView({
-                    models: pipelineOpts.models,
-                    claudeModels: pipelineOpts.claudeModels,
-                    model: pipelineOpts.model,
-                    hfApiKey: pipelineOpts.hfApiKey,
-                    openaiApiKey: pipelineOpts.openaiApiKey,
-                }));
+                jsonResponse(res, 200, {
+                    ...maskedConfigView({
+                        models: pipelineOpts.models,
+                        claudeModels: pipelineOpts.claudeModels,
+                        model: pipelineOpts.model,
+                        hfApiKey: pipelineOpts.hfApiKey,
+                        openaiApiKey: pipelineOpts.openaiApiKey,
+                        licenseKey: storedLicenseKey,
+                    }),
+                    license: licenseView(),
+                });
                 return;
             }
             // PUT /api/config — live-apply the model catalog / default / provider
@@ -2070,7 +2168,7 @@ export async function startGatewayServer(options) {
             // in-memory options in place so /api/models and the per-turn spawn reflect
             // it with NO restart; onConfigApplied propagates to the other spawn-path
             // holders (webchat). PUT (not PATCH) so it rides the existing CORS
-            // allow-methods. Any valid gateway key.
+            // allow-methods. Admin (non-namespaced) keys only — gated above.
             if (routePath === '/api/config' && req.method === 'PUT') {
                 let patch;
                 try {
@@ -2094,15 +2192,24 @@ export async function startGatewayServer(options) {
                         pipelineOpts.hfApiKey = applied.hfApiKey;
                     if (patch.openaiApiKey !== undefined)
                         pipelineOpts.openaiApiKey = applied.openaiApiKey;
+                    // Task 129: licence key is persist-ONLY — track the stored value for
+                    // display, but never rewire enforcement (licenseStatus stays as
+                    // verified at startup; a reload is what applies it — task 127).
+                    if (patch.licenseKey !== undefined)
+                        storedLicenseKey = applied.licenseKey;
                     // Propagate to the daemon's OTHER holders (webchat pipelineOpts, etc.).
                     options.onConfigApplied?.(applied);
-                    jsonResponse(res, 200, maskedConfigView({
-                        models: pipelineOpts.models,
-                        claudeModels: pipelineOpts.claudeModels,
-                        model: pipelineOpts.model,
-                        hfApiKey: pipelineOpts.hfApiKey,
-                        openaiApiKey: pipelineOpts.openaiApiKey,
-                    }));
+                    jsonResponse(res, 200, {
+                        ...maskedConfigView({
+                            models: pipelineOpts.models,
+                            claudeModels: pipelineOpts.claudeModels,
+                            model: pipelineOpts.model,
+                            hfApiKey: pipelineOpts.hfApiKey,
+                            openaiApiKey: pipelineOpts.openaiApiKey,
+                            licenseKey: storedLicenseKey,
+                        }),
+                        license: licenseView(),
+                    });
                 }
                 catch (err) {
                     jsonResponse(res, 500, { error: String(err) });
@@ -2125,7 +2232,7 @@ export async function startGatewayServer(options) {
             }
             // POST /api/agents/inject — agent-to-agent messaging
             if (routePath === '/api/agents/inject' && req.method === 'POST') {
-                await handleAgentInject(req, res, pipelineOpts, { ns: scopeNs, namespaces });
+                await handleAgentInject(req, res, pipelineOpts, scope);
                 return;
             }
             // GET /api/federation/status — connected spokes and their threads (hub only)
@@ -2140,7 +2247,7 @@ export async function startGatewayServer(options) {
             }
             // POST /api/migrate — sync thread + clone repo + set projectDir
             if (routePath === '/api/migrate' && req.method === 'POST') {
-                await handleMigrate(req, res, pipelineOpts, { ns: scopeNs, namespaces });
+                await handleMigrate(req, res, pipelineOpts, scope);
                 return;
             }
             // POST /api/push/subscribe — register push subscription
@@ -2241,6 +2348,8 @@ export async function startGatewayServer(options) {
                     // Abort any in-flight message processing
                     threadQueues.clear();
                     threadBusy.clear();
+                    if (licenseBannerTimer)
+                        clearInterval(licenseBannerTimer);
                     return new Promise(resolveClose => {
                         server.close(() => {
                             clearThreadCache();