@mcoda/mswarm 0.1.107 → 0.1.109

package/dist/vendor/codali/api/CodaliServer.d.ts

@@ -0,0 +1,42 @@
+import { type Server } from "node:http";
+import { runCodali } from "./CodaliApi.js";
+import type { RunContext, RunContextTenant } from "../runcontext/RunContextResolver.js";
+/**
+ * Local HTTP surface for Codali.
+ *
+ * Exposes the same result contract the CLI produces, so a product integrating
+ * over HTTP and an engineer debugging on a terminal are exercising one
+ * implementation.
+ *
+ * ## Tenant identity
+ *
+ * Tenant is derived from the **authenticated caller**, never read from a
+ * request body or a client-supplied header. A tenant id in a body field is an
+ * assertion by an untrusted party; honouring it would let any caller read
+ * another tenant's tools and credentials by editing one JSON value.
+ */
+export interface CodaliServerPrincipal {
+    tenant: RunContextTenant;
+    /** Tools, credentials and limits this principal's tenant may use. */
+    runContext?: RunContext;
+    requesterId?: string;
+}
+export interface CodaliServerOptions {
+    port?: number;
+    host?: string;
+    /**
+     * Resolves an API key to a principal. Returning undefined rejects the
+     * request. There is no anonymous mode: an unauthenticated caller has no
+     * tenant, and a run without a tenant scope has no business reaching
+     * connectors.
+     */
+    authenticate: (apiKey: string | undefined) => Promise<CodaliServerPrincipal | undefined>;
+    workspaceRoot?: string;
+    run?: typeof runCodali;
+}
+export declare const createCodaliServer: (options: CodaliServerOptions) => Server;
+export declare const startCodaliServer: (options: CodaliServerOptions) => Promise<{
+    server: Server;
+    port: number;
+}>;
+//# sourceMappingURL=CodaliServer.d.ts.map

package/dist/vendor/codali/api/CodaliServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CodaliServer.d.ts","sourceRoot":"","sources":["../../src/api/CodaliServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,SAAS,EAAsB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,qEAAqE;IACrE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,SAAS,CAAC;CACxB;AAuDD,eAAO,MAAM,kBAAkB,GAAI,SAAS,mBAAmB,KAAG,MAyEjE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,mBAAmB,KAC3B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAW1C,CAAC"}

package/dist/vendor/codali/api/CodaliServer.js

@@ -0,0 +1,118 @@
+import { createServer } from "node:http";
+import { handleChatCompletion } from "./ChatCompletionsAdapter.js";
+import { runCodali } from "./CodaliApi.js";
+const readBody = async (request) => {
+    const chunks = [];
+    for await (const chunk of request)
+        chunks.push(chunk);
+    if (chunks.length === 0)
+        return undefined;
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+};
+const send = (response, status, payload) => {
+    const body = JSON.stringify(payload);
+    response.writeHead(status, {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body),
+    });
+    response.end(body);
+};
+const readApiKey = (request) => {
+    const header = request.headers.authorization;
+    if (typeof header === "string" && header.toLowerCase().startsWith("bearer ")) {
+        return header.slice(7).trim();
+    }
+    const apiKey = request.headers["x-api-key"];
+    return typeof apiKey === "string" ? apiKey.trim() : undefined;
+};
+const isRecord = (value) => Boolean(value && typeof value === "object" && !Array.isArray(value));
+/**
+ * Strips any caller-supplied tenant or run context and substitutes what the
+ * authenticated principal is actually entitled to. This is the single point
+ * where cross-tenant access is prevented, so it is deliberately unconditional
+ * rather than a validation the caller could satisfy.
+ */
+const applyPrincipalScope = (payload, principal) => ({
+    ...payload,
+    runContext: {
+        ...(principal.runContext ?? {}),
+        tenant: principal.tenant,
+    },
+});
+export const createCodaliServer = (options) => {
+    const run = options.run ?? runCodali;
+    return createServer(async (request, response) => {
+        const url = new URL(request.url ?? "/", "http://localhost");
+        if (request.method === "GET" && url.pathname === "/healthz") {
+            send(response, 200, { ok: true });
+            return;
+        }
+        if (request.method !== "POST") {
+            send(response, 405, { error: { code: "method_not_allowed" } });
+            return;
+        }
+        const principal = await options.authenticate(readApiKey(request));
+        if (!principal) {
+            send(response, 401, { error: { code: "unauthorized" } });
+            return;
+        }
+        const body = await readBody(request);
+        if (!isRecord(body)) {
+            send(response, 400, { error: { code: "invalid_request_body" } });
+            return;
+        }
+        try {
+            if (url.pathname === "/v1/chat/completions") {
+                const chatRequest = body;
+                const scoped = {
+                    ...chatRequest,
+                    codali: {
+                        ...(chatRequest.codali ?? {}),
+                        // Caller-supplied context is discarded, not merged.
+                        runContext: {
+                            ...(principal.runContext ?? {}),
+                            tenant: principal.tenant,
+                        },
+                        workspaceRoot: options.workspaceRoot ?? chatRequest.codali?.workspaceRoot,
+                    },
+                };
+                send(response, 200, await handleChatCompletion(scoped, { run }));
+                return;
+            }
+            if (url.pathname === "/v1/codali/run") {
+                const codaliRequest = applyPrincipalScope(body, principal);
+                send(response, 200, await run({
+                    ...codaliRequest,
+                    workspaceRoot: options.workspaceRoot ?? codaliRequest.workspaceRoot,
+                }));
+                return;
+            }
+            send(response, 404, { error: { code: "not_found" } });
+        }
+        catch (error) {
+            send(response, 500, {
+                error: {
+                    code: "internal_error",
+                    message: error instanceof Error ? error.message : String(error),
+                },
+            });
+        }
+    });
+};
+export const startCodaliServer = async (options) => {
+    const server = createCodaliServer(options);
+    const port = options.port ?? 8787;
+    await new Promise((resolve) => {
+        server.listen(port, options.host ?? "127.0.0.1", resolve);
+    });
+    const address = server.address();
+    return {
+        server,
+        port: typeof address === "object" && address ? address.port : port,
+    };
+};

package/dist/vendor/codali/cli/AskCommand.d.ts

@@ -0,0 +1,66 @@
+import { getAgentInventory } from "../agents/AgentInventory.js";
+import { attachMcpTools } from "../connectors/mcp/McpToolSource.js";
+import { createProviderForAssignment } from "../gateway/LocalGatewayProvider.js";
+import { GatewayTracer } from "../gateway/GatewayTracer.js";
+import { ToolRegistry } from "../tools/ToolRegistry.js";
+import type { RunContext } from "../runcontext/RunContextResolver.js";
+import type { CodaliGatewayMode, CodaliGatewayResult } from "../gateway/CodaliGatewayTypes.js";
+import type { Provider } from "../providers/ProviderTypes.js";
+/**
+ * `codali ask` — the terminal entry point to the orchestration gateway.
+ *
+ * Until this existed the gateway had exactly one caller (mswarm's cloud job
+ * path) and could not be exercised locally at all, which made every other
+ * improvement unverifiable.
+ */
+/**
+ * Default budgets. Deliberately small: an orchestrator that can quietly spend
+ * fifty tool calls on one question is not one you can put in front of users.
+ */
+export declare const DEFAULT_MAX_ROUNDS = 3;
+export declare const DEFAULT_MAX_TOOL_CALLS = 20;
+export declare const DEFAULT_MAX_MODEL_CALLS = 12;
+/**
+ * Wall-clock budget. Generous because CLI-backed agents (codex, claude,
+ * gemini) commonly take 30-90s per call, and several tasks run per question.
+ */
+export declare const DEFAULT_DEADLINE_MS = 600000;
+/**
+ * Independent worker tasks executed concurrently. Bounded rather than
+ * unlimited: each task holds a model call, and a tenant's connectors have their
+ * own rate limits.
+ */
+export declare const DEFAULT_MAX_PARALLEL_WORKERS = 3;
+export interface AskOptions {
+    query: string;
+    workspaceRoot: string;
+    mode: CodaliGatewayMode;
+    trace: boolean;
+    json: boolean;
+    maxRounds: number;
+    maxToolCalls: number;
+    deadlineMs: number;
+    docdexBaseUrl?: string;
+    responseSchemaPath?: string;
+    responseFormat?: "text" | "json";
+    noTools: boolean;
+}
+export declare const parseAskArgs: (argv: string[]) => AskOptions;
+export interface AskDependencies {
+    loadInventory?: typeof getAgentInventory;
+    resolveRunContext?: (workspaceRoot: string) => Promise<RunContext>;
+    buildRegistry?: (options: AskOptions, context: RunContext) => ToolRegistry;
+    createProvider?: (assignment: Parameters<typeof createProviderForAssignment>[0]) => Provider;
+    attachMcp?: typeof attachMcpTools;
+    write?: (line: string) => void;
+}
+export interface AskOutcome {
+    result?: CodaliGatewayResult;
+    tracer: GatewayTracer;
+    exitCode: number;
+}
+export declare const runAsk: (argv: string[], deps?: AskDependencies) => Promise<AskOutcome>;
+export declare const AskCommand: {
+    run(argv: string[]): Promise<void>;
+};
+//# sourceMappingURL=AskCommand.d.ts.map

package/dist/vendor/codali/cli/AskCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AskCommand.d.ts","sourceRoot":"","sources":["../../src/cli/AskCommand.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGvF,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIpE,OAAO,EACL,2BAA2B,EAE5B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAE9D;;;;;;GAMG;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAe9C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;CAClB;AA+BD,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,KAAG,UAuE7C,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,KAAK,YAAY,CAAC;IAC3E,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,KAC1D,QAAQ,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AA6BD,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,MAAM,GACjB,MAAM,MAAM,EAAE,EACd,OAAM,eAAoB,KACzB,OAAO,CAAC,UAAU,CAwXpB,CAAC;AAEF,eAAO,MAAM,UAAU;cACL,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMzC,CAAC"}