@m6d/cortex-server 1.8.0 → 2.0.1

package/src/lib/routes/files.ts

@@ -1,107 +1,129 @@
+import {
+    ATTACHMENT_MAX_BYTES,
+    MAX_ATTACHMENTS_PER_MESSAGE,
+    checkAttachmentPolicy,
+} from "@cortex/contracts/wire";
 import { Hono } from "hono";
-import { zValidator } from "@hono/zod-validator";
-import z from "zod";
+import { bodyLimit } from "hono/body-limit";
 import { HTTPException } from "hono/http-exception";
-import { safeValidateUIMessages, type ToolUIPart, type UIMessage } from "ai";
-import type { CortexAppEnv } from "../types.ts";
-import { requireAuth } from "../auth/middleware.ts";
+import { toAttachmentSummary, type CortexAppEnv } from "@/types";
+import { requireAuth } from "@/auth/middleware";
+import type { ResolvedCortexAgentConfig } from "@/config";
+import { requireOwnedThread } from "./owned-thread";
 
 export function createFileRoutes() {
     const app = new Hono<CortexAppEnv>();
 
+    app.post(
+        "/threads/:threadId/files",
+        requireAuth,
+        bodyLimit({ maxSize: ATTACHMENT_MAX_BYTES + 64 * 1024 }),
+        async function (c) {
+            const config = c.get("agentConfig");
+            const storage = requireStorage(config);
+
+            const threadId = c.req.param("threadId");
+            const userId = c.get("user").id;
+            await requireOwnedThread(c, threadId);
+
+            const file = (await c.req.parseBody())["file"];
+            if (!(file instanceof File)) {
+                throw new HTTPException(400, { message: "File is required" });
+            }
+
+            const policy = checkAttachmentPolicy(file.type, file.size);
+            if (policy !== "ok") {
+                throw new HTTPException(422, { message: `Attachment rejected: ${policy}` });
+            }
+
+            const storageKey = `attachments/${crypto.randomUUID()}`;
+            const bytes = Buffer.from(await file.arrayBuffer()).toString("base64");
+            if (!(await storage.put(storageKey, bytes))) {
+                throw new HTTPException(500, { message: "File upload failed" });
+            }
+
+            const attachment = await config.db.attachments
+                .createPending(
+                    {
+                        threadId,
+                        userId,
+                        messageId: null,
+                        filename: file.name,
+                        contentType: file.type,
+                        sizeBytes: file.size,
+                        storageKey,
+                        status: "pending",
+                    },
+                    MAX_ATTACHMENTS_PER_MESSAGE,
+                )
+                .catch(async function (error: unknown) {
+                    await storage.delete([storageKey]);
+                    throw error;
+                });
+            if (!attachment) {
+                await storage.delete([storageKey]);
+                throw new HTTPException(422, { message: "Attachment limit reached" });
+            }
+
+            return c.json(toAttachmentSummary(attachment));
+        },
+    );
+
     app.get("/files/:id", requireAuth, async function (c) {
         const config = c.get("agentConfig");
-        const id = c.req.param("id");
-        const { id: userId } = c.get("user");
-        const file = await config.db.capturedFiles.getById(id, userId);
+        const storage = requireStorage(config);
 
-        if (!file) {
+        const attachment = await config.db.attachments.getById(c.req.param("id"), c.get("user").id);
+        if (!attachment) {
             throw new HTTPException(404, { message: "File not found" });
         }
+        await requireOwnedThread(c, attachment.threadId);
 
-        const fileStream = await config.storage.stream(`captured_files/${id}`);
-        return new Response(fileStream, {
+        const filename = attachment.filename
+            .replace(/[\r\n"\\]/g, "")
+            .replace(/[^\u0020-\u007e]/g, "_");
+
+        return new Response(await storage.stream(attachment.storageKey), {
             headers: {
-                "Content-Type": "application/octet-stream",
-                "Content-Disposition": `attachment; filename="${file.name}"`,
+                "Content-Type": attachment.contentType,
+                "Content-Disposition": `attachment; filename="${filename}"; filename*=UTF-8''${encodeURIComponent(attachment.filename)}`,
+                "X-Content-Type-Options": "nosniff",
             },
         });
     });
 
-    app.post(
-        "/files",
-        requireAuth,
-        zValidator(
-            "json",
-            z.object({
-                toolCallId: z.string(),
-                message: z.unknown().transform(async (message, ctx) => {
-                    const result = await safeValidateUIMessages({
-                        messages: [message],
-                    });
-                    if (!result.success) {
-                        ctx.addIssue({
-                            code: "custom",
-                            path: ["message"],
-                            message: "Invalid message format",
-                        });
-                        return z.NEVER;
-                    }
-
-                    return result.data[0]!;
-                }),
-                files: z.array(
-                    z.object({
-                        id: z.string(),
-                        file: z.object({
-                            name: z.string(),
-                            bytes: z.string(),
-                        }),
-                    }),
-                ),
-            }),
-        ),
-        async function (c) {
-            const config = c.get("agentConfig");
-            const { message, toolCallId, files } = c.req.valid("json");
-            const { id: userId } = c.get("user");
-
-            function isTool(value: UIMessage["parts"][number]): value is ToolUIPart {
-                return value.type.startsWith("tool-");
-            }
+    app.delete("/files/:id", requireAuth, async function (c) {
+        const config = c.get("agentConfig");
+        const storage = requireStorage(config);
 
-            const toolPart = message.parts.filter(isTool).find((x) => x.toolCallId === toolCallId);
+        const id = c.req.param("id");
+        const userId = c.get("user").id;
+        const attachment = await config.db.attachments.getById(id, userId);
+        if (!attachment) {
+            throw new HTTPException(404, { message: "File not found" });
+        }
+        await requireOwnedThread(c, attachment.threadId);
+        if (attachment.messageId !== null) {
+            throw new HTTPException(409, { message: "File is attached to a message" });
+        }
 
-            if (!toolPart) {
-                throw new HTTPException(423, {
-                    message: "Invalid tool call id",
-                });
-            }
+        if (!(await storage.delete([attachment.storageKey]))) {
+            throw new HTTPException(502, { message: "File deletion failed" });
+        }
 
-            const result = await config.db.capturedFiles.create(
-                userId,
-                message.id,
-                toolPart,
-                files,
-            );
-
-            // Store file bytes
-            const uploadResults = await Promise.all(
-                result.map(async (r, i) => {
-                    return await config.storage.put(
-                        `captured_files/${r.uploadId}`,
-                        files[i]!.file.bytes,
-                    );
-                }),
-            );
-
-            if (uploadResults.some((x) => !x)) {
-                throw new HTTPException(400, { message: "Some or all files failed to upload" });
-            }
+        if (!(await config.db.attachments.remove(id, userId))) {
+            throw new HTTPException(404, { message: "File not found" });
+        }
 
-            return c.json(result);
-        },
-    );
+        return c.body(null, 204);
+    });
 
     return app;
 }
+
+function requireStorage(config: ResolvedCortexAgentConfig) {
+    if (!config.storage) {
+        throw new HTTPException(503, { message: "File storage is not configured" });
+    }
+    return config.storage;
+}

package/src/lib/routes/owned-thread.ts

@@ -0,0 +1,17 @@
+import type { Context } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { CortexAppEnv } from "@/types";
+
+/**
+ * Loads a thread and asserts it belongs to both the caller and the agent in the
+ * path. A thread owned by another agent 404s rather than 403 on purpose — a 403
+ * would confirm the thread exists, making cross-agent ids probeable.
+ */
+export async function requireOwnedThread(c: Context<CortexAppEnv>, threadId: string) {
+    const thread = await c.get("agentConfig").db.threads.getById(c.get("user").id, threadId);
+    if (!thread || thread.agentId !== c.get("agentId")) {
+        throw new HTTPException(404, { message: "Not found" });
+    }
+
+    return thread;
+}

package/src/lib/routes/threads.ts

@@ -1,12 +1,12 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import z from "zod";
-import type { CortexAppEnv } from "../types.ts";
-import { requireAuth } from "../auth/middleware.ts";
-import { generateTitle } from "../ai/index.ts";
-import { abortStream, isStreamRunning } from "../ai/active-streams.ts";
-import { notify } from "../ws/index.ts";
-import { toThreadSummary } from "../types.ts";
+import type { CortexAppEnv } from "@/types";
+import { requireAuth } from "@/auth/middleware";
+import { abortRun, runningThreadIds } from "@/ai/active-runs";
+import { notify } from "@/ws/connections";
+import { requireOwnedThread } from "./owned-thread";
+import { toThreadSummary } from "@/types";
 
 export function createThreadRoutes() {
     const app = new Hono<CortexAppEnv>();
@@ -14,21 +14,19 @@ export function createThreadRoutes() {
     app.get("/threads", requireAuth, async function (c) {
         const config = c.get("agentConfig");
         const agentId = c.get("agentId");
-        const threads = await config.db.threads
-            .list(c.get("user").id, agentId)
-            .then((x) => x.map((y) => toThreadSummary(y, isStreamRunning(y.id))));
-        return c.json(threads);
+        const threads = await config.db.threads.list(c.get("user").id, agentId);
+        const running = await runningThreadIds(threads.map((thread) => thread.id));
+        return c.json(threads.map((thread) => toThreadSummary(thread, running.has(thread.id))));
     });
 
     app.post(
         "/threads",
         requireAuth,
-        zValidator("json", z.object({ prompt: z.string() })),
+        zValidator("json", z.object({ prompt: z.string().optional() })),
         async function (c) {
             const config = c.get("agentConfig");
             const agentId = c.get("agentId");
             const userId = c.get("user").id;
-            const { prompt } = c.req.valid("json");
             const thread = await config.db.threads.create(userId, agentId);
 
             notify(userId, agentId, {
@@ -36,8 +34,6 @@ export function createThreadRoutes() {
                 payload: { thread: toThreadSummary(thread, false) },
             });
 
-            generateTitle(thread.id, prompt, userId, config);
-
             return c.json(toThreadSummary(thread, false));
         },
     );
@@ -48,12 +44,9 @@ export function createThreadRoutes() {
         const userId = c.get("user").id;
         const threadId = c.req.param("threadId");
 
-        const thread = await config.db.threads.getById(userId, threadId);
-        if (!thread || thread.agentId !== agentId) {
-            return c.body(null, 404);
-        }
+        await requireOwnedThread(c, threadId);
 
-        abortStream(threadId);
+        await abortRun(threadId);
         await config.db.threads.delete(userId, threadId);
 
         notify(userId, agentId, {
@@ -66,13 +59,9 @@ export function createThreadRoutes() {
 
     app.get("/threads/:threadId/messages", requireAuth, async function (c) {
         const config = c.get("agentConfig");
-        const agentId = c.get("agentId");
         const userId = c.get("user").id;
         const threadId = c.req.param("threadId");
-        const thread = await config.db.threads.getById(userId, threadId);
-        if (!thread || thread.agentId !== agentId) {
-            return c.body(null, 404);
-        }
+        await requireOwnedThread(c, threadId);
 
         const messages = await config.db.messages
             .list(userId, threadId)
@@ -93,14 +82,9 @@ export function createThreadRoutes() {
         zValidator("json", z.object({ session: z.record(z.string(), z.unknown()) })),
         async function (c) {
             const config = c.get("agentConfig");
-            const agentId = c.get("agentId");
-            const userId = c.get("user").id;
             const threadId = c.req.param("threadId");
             const { session } = c.req.valid("json");
-            const thread = await config.db.threads.getById(userId, threadId);
-            if (!thread || thread.agentId !== agentId) {
-                return c.body(null, 404);
-            }
+            await requireOwnedThread(c, threadId);
 
             await config.db.threads.updateSession(threadId, session);
             return c.body(null, 204);

package/src/lib/routes/ws.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { upgradeWebSocket } from "hono/bun";
-import type { AppEnv } from "../types.ts";
-import { addConnection, removeConnection } from "../ws/index.ts";
+import type { AppEnv } from "@/types";
+import { addConnection, removeConnection } from "@/ws/connections";
 
 type WsRouteOptions = {
     useAgentParam?: boolean;
@@ -10,7 +10,9 @@ type WsRouteOptions = {
 export function createWsRoute(options?: WsRouteOptions) {
     const app = new Hono<AppEnv>();
     const handleUpgrade = upgradeWebSocket(function (c) {
-        const userId = c.get("user")?.id;
+        // upgradeWebSocket erases the app's env generic, so the context reads as any.
+        const user = c.get("user") as AppEnv["Variables"]["user"];
+        const userId = user?.id;
         const agentId =
             options?.useAgentParam === true ? c.req.param("agentId") : c.req.query("agentId");
 
@@ -40,6 +42,10 @@ export function createWsRoute(options?: WsRouteOptions) {
             return c.json({ error: "agentId is required" }, 400);
         }
 
+        // upgradeWebSocket types as a void middleware while tsc requires the route
+        // to produce a Response; the lint checker resolves the generics differently
+        // and would auto-strip the bridge cast, so pin it.
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
         return handleUpgrade(c, next) as unknown as Response;
     });
 

package/src/lib/types.ts

@@ -1,47 +1,31 @@
+import type { MessagePart } from "@tanstack/ai";
 import type { ResolvedCortexAgentConfig } from "./config";
 import type { InferSelectModel } from "drizzle-orm";
-import type { messages, threads } from "./db/schema";
+import type { attachments, messages, threads } from "./db/schema.mssql";
 
-export type Thread = InferSelectModel<typeof threads>;
+export type {
+    CortexMessage,
+    MessageMetadata,
+    ThreadSummary,
+    TokenUsage,
+} from "@cortex/contracts/wire";
 
-export type StoredMessage = InferSelectModel<typeof messages>;
+import type { AttachmentSummary, CortexMessage, ThreadSummary } from "@cortex/contracts/wire";
 
-export type ThreadSummary = {
-    id: string;
-    title?: string;
-    createdAt: Date;
-    updatedAt: Date;
-    isRunning: boolean;
-};
+/** A message as cortex persists and serves it: SDK parts plus cortex's envelope. */
+export type ChatMessage = CortexMessage<MessagePart>;
 
-export type TokenUsage = {
-    input: {
-        noCache: number;
-        cacheRead: number;
-        cacheWrite: number;
-        total: number;
-    };
-    output: {
-        reasoning: number;
-        text: number;
-        total: number;
-    };
-    total: number;
-};
+export type Thread = InferSelectModel<typeof threads>;
 
-export type MessageMetadata = {
-    modelId: string;
-    providerMetadata: unknown;
-    isAborted?: boolean;
-    tokenUsage?: TokenUsage;
-};
+export type StoredMessage = InferSelectModel<typeof messages>;
 
-export type CapturedFileInput = {
-    id: string;
-    file: { name: string; bytes: string };
-};
+export type Attachment = InferSelectModel<typeof attachments>;
+
+export type NewAttachment = typeof attachments.$inferInsert;
 
 export type AppEnv = {
+    // Hono's env generics only stay assignable across helpers with the {} idiom.
+    // eslint-disable-next-line @typescript-eslint/no-empty-object-type
     Bindings: {};
     Variables: {
         user: { id: string; token: string } | undefined;
@@ -49,6 +33,8 @@ export type AppEnv = {
 };
 
 export type AuthedAppEnv = {
+    // Hono's env generics only stay assignable across helpers with the {} idiom.
+    // eslint-disable-next-line @typescript-eslint/no-empty-object-type
     Bindings: {};
     Variables: {
         user: { id: string; token: string };
@@ -56,6 +42,8 @@ export type AuthedAppEnv = {
 };
 
 export type CortexAppEnv = {
+    // Hono's env generics only stay assignable across helpers with the {} idiom.
+    // eslint-disable-next-line @typescript-eslint/no-empty-object-type
     Bindings: {};
     Variables: {
         user: { id: string; token: string };
@@ -64,12 +52,25 @@ export type CortexAppEnv = {
     };
 };
 
+/** Maps a stored row to the wire shape. Dates become ISO strings — the same bytes
+ * `JSON.stringify` would have produced, but now the type says so. */
 export function toThreadSummary(thread: Thread, isRunning: boolean) {
     return {
         id: thread.id,
         title: thread.title ?? undefined,
-        createdAt: thread.createdAt,
-        updatedAt: thread.updatedAt,
+        createdAt: thread.createdAt.toISOString(),
+        updatedAt: thread.updatedAt.toISOString(),
         isRunning,
     } satisfies ThreadSummary;
 }
+
+export function toAttachmentSummary(attachment: Attachment) {
+    return {
+        id: attachment.id,
+        filename: attachment.filename,
+        contentType: attachment.contentType,
+        sizeBytes: attachment.sizeBytes,
+        status: attachment.status,
+        description: attachment.description ?? undefined,
+    } satisfies AttachmentSummary;
+}

package/src/lib/ws/connections.ts

@@ -1,4 +1,5 @@
 import type { WSContext } from "hono/ws";
+import type { WsEvent } from "@cortex/contracts/wire";
 
 const connections = new Map<string, WSContext[]>();
 
@@ -24,6 +25,13 @@ export function removeConnection(userId: string, agentId: string, ws: WSContext)
     }
 }
 
-export function getConnections(userId: string, agentId: string) {
+function getConnections(userId: string, agentId: string) {
     return connections.get(getConnectionKey(userId, agentId)) ?? [];
 }
+
+export function notify(userId: string, agentId: string, event: WsEvent) {
+    const message = JSON.stringify(event);
+    for (const ws of getConnections(userId, agentId)) {
+        ws.send(message);
+    }
+}

package/tsconfig.json

@@ -0,0 +1,48 @@
+{
+    "compilerOptions": {
+        // Environment setup & latest features
+        "lib": ["ESNext"],
+        // Named explicitly: auto-inclusion of @types/* is an editor-dependent
+        // heuristic, and the `Bun` global comes from here.
+        "types": ["bun"],
+        "target": "ESNext",
+        "module": "Preserve",
+        "moduleDetection": "force",
+        "jsx": "react-jsx",
+        "allowJs": true,
+        "baseUrl": ".",
+
+        // Bundler mode
+        "moduleResolution": "bundler",
+        "verbatimModuleSyntax": true,
+        "noEmit": true,
+        "paths": {
+            "@m6d/cortex-server": ["./index.ts"],
+            // The API contracts live in internal/contracts, a private workspace
+            // package that never publishes; this package ships raw source, so
+            // `vendor` copies them into ./contracts for build and pack. The first
+            // candidate exists only then (and in the published tarball) — inside
+            // the repo resolution falls through to the workspace source.
+            "@cortex/contracts/*": ["./contracts/*", "../../internal/contracts/*"],
+            // Internal-only. tsc does not rewrite aliases on emit, so `build` runs
+            // tsc-alias to turn these back into relative paths in dist/**/*.d.ts —
+            // a consumer's tsc knows nothing about our `@/`. The published raw src
+            // keeps `@/`, which resolves because Bun reads this file (hence its
+            // presence in package.json `files`).
+            "@/*": ["./src/lib/*"]
+        },
+
+        // Best practices
+        "strict": true,
+        "skipLibCheck": true,
+        "noFallthroughCasesInSwitch": true,
+        "noUncheckedIndexedAccess": true,
+        "noImplicitOverride": true,
+
+        // Some stricter flags (disabled by default)
+        "noUnusedLocals": false,
+        "noUnusedParameters": false,
+        "noPropertyAccessFromIndexSignature": false
+    },
+    "include": ["src/lib/**/*.ts", "scripts/**/*.ts", "index.ts"]
+}

package/dist/src/lib/adapters/database.d.ts

@@ -1,45 +0,0 @@
-import type { ToolUIPart, UIMessage } from "ai";
-import type { Thread, StoredMessage, CapturedFileInput, TokenUsage } from "../types";
-import type { ThreadContextMeta } from "../ai/context/types.ts";
-export type DatabaseAdapter = {
-    threads: {
-        list(userId: string, agentId: string): Promise<Thread[]>;
-        getById(userId: string, threadId: string): Promise<Thread | null>;
-        create(userId: string, agentId: string): Promise<Thread>;
-        delete(userId: string, threadId: string): Promise<void>;
-        touch(threadId: string): Promise<Thread>;
-        updateTitle(threadId: string, title: string): Promise<void>;
-        updateSession(threadId: string, session: Record<string, unknown>): Promise<void>;
-        updateContextMeta(threadId: string, meta: ThreadContextMeta): Promise<void>;
-    };
-    messages: {
-        list(userId: string, threadId: string, opts?: {
-            limit?: number;
-        }): Promise<StoredMessage[]>;
-        upsert(threadId: string, messages: UIMessage[]): Promise<void>;
-    };
-    llmRequests: {
-        insert(requests: {
-            messageId: string;
-            stepNumber: number;
-            prompt: string;
-            output: string | null;
-            tokenUsage: TokenUsage | null;
-        }[]): Promise<void>;
-        listByMessageId(messageId: string): Promise<{
-            id: string;
-            prompt: string;
-            output: string | null;
-            tokenUsage: TokenUsage | null;
-        }[]>;
-    };
-    capturedFiles: {
-        create(userId: string, messageId: string, toolPart: ToolUIPart, files: CapturedFileInput[]): Promise<{
-            id: string;
-            uploadId: string;
-        }[]>;
-        getById(id: string, userId: string): Promise<{
-            name: string;
-        } | null>;
-    };
-};

package/dist/src/lib/adapters/mssql.d.ts

@@ -1,3 +0,0 @@
-import type { DatabaseAdapter } from "./database";
-import type { StorageAdapter } from "./storage";
-export declare function createMssqlAdapter(connectionString: string, storage: StorageAdapter): DatabaseAdapter;

package/dist/src/lib/ai/active-streams.d.ts

@@ -1,14 +0,0 @@
-type ActiveStream = {
-    id: string;
-    abortController: AbortController;
-    buffer: string[];
-    subscribers: Set<ReadableStreamDefaultController<string>>;
-    isComplete: boolean;
-};
-export declare function registerStream(threadId: string, abortController: AbortController): ActiveStream;
-export declare function attachSseStream(threadId: string, sseStream: ReadableStream<string>): void;
-export declare function subscribe(threadId: string): ReadableStream<string> | null;
-export declare function abortStream(threadId: string): boolean;
-export declare function isStreamRunning(threadId: string): boolean;
-export declare function removeStream(threadId: string, streamId?: string): void;
-export {};

package/dist/src/lib/ai/context/index.d.ts

@@ -1,16 +0,0 @@
-export type { ContextConfig, ThreadContextMeta } from "./types.ts";
-export { DEFAULT_CONTEXT_CONFIG } from "./types.ts";
-export { CHARS_PER_TOKEN, estimateTokens, estimateMessageTokens, estimateMessagesTokens, } from "./token-estimator.ts";
-export { compressToolResults, smartStructuralCompress, summarizeValue } from "./compressor.ts";
-export { summarizeMessages } from "./summarizer.ts";
-export { buildContextMessages, trimMessagesToFit } from "./builder.ts";
-export { compressIntraTurnToolResults, estimateToolResultTokens, summarizeOldStepResults, } from "./intra-turn-compressor.ts";
-import type { UIMessage } from "ai";
-import type { ResolvedCortexAgentConfig } from "../../config.ts";
-import type { Thread } from "../../types.ts";
-/**
- * Post-response context optimization.
- * Called fire-and-forget from onFinish — summarizes older messages
- * when token usage exceeds the configured threshold.
- */
-export declare function optimizeThreadContext(thread: Thread, messages: UIMessage[], config: ResolvedCortexAgentConfig): Promise<void>;

package/dist/src/lib/ai/tools/capture-files.tool.d.ts

@@ -1,6 +0,0 @@
-export declare const captureFilesTool: import("ai").Tool<{
-    files: {
-        id: string;
-        label: string;
-    }[];
-}, never>;

package/dist/src/lib/cli/extract-endpoints.d.ts

@@ -1,6 +0,0 @@
-export type ExtractEndpointsOptions = {
-    swaggerUrl: string;
-    domainsDir: string;
-    write?: boolean;
-};
-export declare function extractEndpoints(options: ExtractEndpointsOptions): Promise<void>;

package/dist/src/lib/graph/expand-domains.d.ts

@@ -1,2 +0,0 @@
-import type { DomainDef } from "./types.ts";
-export declare function expandDomains(domains: Record<string, DomainDef>): Record<string, DomainDef>;