@mcoda/mswarm 0.1.81 → 0.1.86

package/dist/runtime.js

@@ -3,8 +3,10 @@ import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { cpus, freemem, hostname, homedir, loadavg, platform, totalmem, userInfo } from "node:os";
 import { spawn } from "node:child_process";
 import { createHash, createHmac, randomUUID } from "node:crypto";
+import { isIP } from "node:net";
+import { GlobalRepository } from "@mcoda/db";
 import { MswarmCodaliExecutor } from "./codali-executor.js";
-import { MSWARM_CAPABILITY_SCHEMA_VERSION, assertMswarmSafeRelativePath, validateMswarmArchiveEntry, buildMswarmCapabilityNames, buildMswarmPrivateCapabilityCatalogEntry, buildMswarmLocalArtifactUri, buildMswarmSandboxProfile, defaultMswarmArtifactAccessPolicy, defaultMswarmArtifactRetentionPolicy, projectMswarmPublicCapabilities, validateMswarmGenericJobRequest } from "@mcoda/shared";
+import { MSWARM_CAPABILITY_SCHEMA_VERSION, CryptoHelper, assertMswarmSafeRelativePath, validateMswarmArchiveEntry, buildMswarmCapabilityNames, buildMswarmPrivateCapabilityCatalogEntry, buildMswarmLocalArtifactUri, buildMswarmSandboxProfile, defaultMswarmArtifactAccessPolicy, defaultMswarmArtifactRetentionPolicy, projectMswarmPublicCapabilities, validateMswarmGenericJobRequest } from "@mcoda/shared";
 const DEFAULT_GATEWAY_BASE_URL = "http://127.0.0.1:8080";
 const DEFAULT_SETUP_GATEWAY_BASE_URL = "https://api.mswarm.org";
 const DEFAULT_OLLAMA_BASE_URL = "http://127.0.0.1:11434";
@@ -25,7 +27,7 @@ const DEFAULT_MCODA_BIN = "mcoda";
 const DEFAULT_MCODA_LIST_ARGS = ["agent", "list", "--json", "--refresh-health"];
 const DEFAULT_COMMAND_MAX_BUFFER = 16 * 1024 * 1024;
 const DEFAULT_LOCAL_ARTIFACT_MAX_BYTES = 512 * 1024 * 1024;
-const DEFAULT_JOB_POLL_WAIT_MS = 25000;
+const DEFAULT_JOB_POLL_WAIT_MS = 2000;
 const DEFAULT_SELF_HOSTED_JOBS_POLL_PATH = "/v1/swarm/self-hosted/node/jobs/poll";
 const DEFAULT_SELF_HOSTED_JOBS_START_PATH_TEMPLATE = "/v1/swarm/self-hosted/node/jobs/:jobId/start";
 const DEFAULT_SELF_HOSTED_JOBS_EVENTS_PATH_TEMPLATE = "/v1/swarm/self-hosted/node/jobs/:jobId/events";
@@ -354,6 +356,90 @@ function parseList(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const DOMAIN_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function normalizeSelfHostedDomainClient(value) {
+    const normalized = value.trim().toLowerCase().replace(/\.+$/g, "");
+    if (!normalized || normalized.length > 253 || normalized.includes("..")) {
+        return null;
+    }
+    const labels = normalized.split(".");
+    if (!labels.every((label) => DOMAIN_LABEL_PATTERN.test(label))) {
+        return null;
+    }
+    return normalized;
+}
+export function normalizeSelfHostedNodeClientIdentity(value) {
+    if (isRecord(value)) {
+        const kind = optionalText(value.kind)?.toLowerCase();
+        const rawValue = optionalText(value.value);
+        const normalized = normalizeSelfHostedNodeClientIdentity(rawValue);
+        if (!normalized) {
+            return null;
+        }
+        if (kind && kind !== normalized.kind) {
+            return null;
+        }
+        const addedAt = optionalText(value.added_at);
+        return addedAt ? { ...normalized, added_at: addedAt } : normalized;
+    }
+    const raw = optionalText(value);
+    if (!raw) {
+        return null;
+    }
+    const trimmed = raw.trim();
+    if (isIP(trimmed) !== 0) {
+        return { kind: "ip", value: trimmed.toLowerCase() };
+    }
+    if (UUID_PATTERN.test(trimmed)) {
+        return { kind: "uuid", value: trimmed.toLowerCase() };
+    }
+    const domain = normalizeSelfHostedDomainClient(trimmed);
+    if (domain) {
+        return { kind: "domain", value: domain };
+    }
+    return null;
+}
+export function normalizeSelfHostedNodeClientAllowlist(value) {
+    const entries = Array.isArray(value)
+        ? value
+        : typeof value === "string"
+            ? parseList(value)
+            : value == null || value === false
+                ? []
+                : [value];
+    const byKey = new Map();
+    for (const entry of entries) {
+        const identity = normalizeSelfHostedNodeClientIdentity(entry);
+        if (!identity) {
+            throw new Error(typeof entry === "string"
+                ? `Invalid mswarm node client identifier: ${entry}`
+                : "Invalid mswarm node client identifier");
+        }
+        byKey.set(`${identity.kind}:${identity.value}`, identity);
+    }
+    return [...byKey.values()];
+}
+export function addSelfHostedNodeClients(current, additions, now = new Date().toISOString()) {
+    const byKey = new Map();
+    for (const entry of current) {
+        const normalized = normalizeSelfHostedNodeClientIdentity(entry);
+        if (normalized) {
+            byKey.set(`${normalized.kind}:${normalized.value}`, normalized);
+        }
+    }
+    for (const entry of additions) {
+        byKey.set(`${entry.kind}:${entry.value}`, { ...entry, added_at: entry.added_at || now });
+    }
+    return [...byKey.values()];
+}
+export function removeSelfHostedNodeClients(current, removals) {
+    const removeKeys = new Set(removals.map((entry) => `${entry.kind}:${entry.value}`));
+    return current
+        .map((entry) => normalizeSelfHostedNodeClientIdentity(entry))
+        .filter((entry) => Boolean(entry))
+        .filter((entry) => !removeKeys.has(`${entry.kind}:${entry.value}`));
+}
 function parseArgs(value, fallback) {
     const parsed = parseList(value);
     return parsed.length > 0 ? parsed : fallback;
@@ -679,6 +765,13 @@ class HttpStatusError extends Error {
 function isHttpStatusError(error, status) {
     return error instanceof HttpStatusError && (status === undefined || error.status === status);
 }
+const RELAY_RESULT_POST_RETRY_DELAYS_MS = [250, 1000, 2500];
+function runtimeErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function fetchJson(fetchImpl, url, init, timeoutMs) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -1266,7 +1359,10 @@ export async function readSelfHostedNodeConfig(env = process.env) {
         hardwareTelemetryEnabled: parseBoolean(env.MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY_ENABLED ?? env.MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY, state.hardware_telemetry_enabled === true),
         exposeAllModels: resolveDaemonExposeAllModels(env, state),
         modelAllowlist: parseList(env.MSWARM_SELF_HOSTED_MODEL_ALLOWLIST || state.model_allowlist),
-        modelBlocklist: parseList(env.MSWARM_SELF_HOSTED_MODEL_BLOCKLIST || state.model_blocklist)
+        modelBlocklist: parseList(env.MSWARM_SELF_HOSTED_MODEL_BLOCKLIST || state.model_blocklist),
+        clientAllowlist: normalizeSelfHostedNodeClientAllowlist(env.MSWARM_SELF_HOSTED_CLIENT_ALLOWLIST ||
+            env.MSWARM_SELF_HOSTED_CLIENTS ||
+            state.client_allowlist)
     };
 }
 export async function readOwnerSetupConfig(argv = process.argv.slice(3), env = process.env) {
@@ -1293,6 +1389,10 @@ export async function readOwnerSetupConfig(argv = process.argv.slice(3), env = p
         DEFAULT_OLLAMA_BASE_URL;
     const allowlist = parseList(options.allow || env.MSWARM_SELF_HOSTED_MODEL_ALLOWLIST);
     const blocklist = parseList(options.block || env.MSWARM_SELF_HOSTED_MODEL_BLOCKLIST);
+    const clientAllowlist = normalizeSelfHostedNodeClientAllowlist(options.clients ||
+        options.client ||
+        env.MSWARM_SELF_HOSTED_CLIENT_ALLOWLIST ||
+        env.MSWARM_SELF_HOSTED_CLIENTS);
     const packageNodeVersion = await readPackageNodeVersion();
     const maxConcurrentJobs = parsePositiveInteger(options["max-concurrent-jobs"] || env.MSWARM_SELF_HOSTED_MAX_CONCURRENT_JOBS, 1);
     const maxConcurrentLlmJobs = parsePositiveInteger(options["max-concurrent-llm-jobs"] || env.MSWARM_SELF_HOSTED_MAX_CONCURRENT_LLM_JOBS, maxConcurrentJobs);
@@ -1332,6 +1432,7 @@ export async function readOwnerSetupConfig(argv = process.argv.slice(3), env = p
         exposeAllModels: resolveOwnerSetupExposeAllModels(options, env),
         modelAllowlist: allowlist,
         modelBlocklist: blocklist,
+        clientAllowlist,
         start: options.start === true
     };
 }
@@ -1668,6 +1769,20 @@ function configText(config, ...keys) {
     }
     return undefined;
 }
+async function defaultMcodaAgentAuthResolver(agent) {
+    const agentId = optionalText(agent.id);
+    if (!agentId) {
+        return undefined;
+    }
+    const repo = await GlobalRepository.create();
+    try {
+        const secret = await repo.getAgentAuthSecret(agentId);
+        return secret?.encryptedSecret ? CryptoHelper.decryptSecret(secret.encryptedSecret) : undefined;
+    }
+    finally {
+        await repo.close();
+    }
+}
 function mcodaAgentDefaultModel(agent) {
     return (optionalText(agent.defaultModel) ||
         optionalText(agent.default_model) ||
@@ -1683,18 +1798,35 @@ function resolveCodaliProviderForAgent(agent) {
     if (["ollama-remote", "ollama-cli", "ollama", "local-model"].includes(adapter || "")) {
         return "ollama-remote";
     }
-    if (adapter === "openai" || adapter === "openai-compatible" || adapter === "openai-cli") {
+    if (adapter === "openai" ||
+        adapter === "openai-api" ||
+        adapter === "openai-compatible" ||
+        adapter === "openai-cli") {
         return "openai-compatible";
     }
     if (adapter === "codex-cli")
         return "codex-cli";
     return adapter || undefined;
 }
+function mcodaAgentRequiresApiKey(agent, mapped) {
+    if (mapped.provider !== "openai-compatible") {
+        return false;
+    }
+    if (mapped.localRunner) {
+        return mapped.authMode === "bearer";
+    }
+    const adapter = optionalText(agent.adapter) || "";
+    if (["openai", "openai-api", "openai-compatible"].includes(adapter)) {
+        return mapped.authMode !== "none";
+    }
+    return mapped.authMode === "bearer";
+}
 function mapMcodaAgentToCodaliAgent(agent, fallbackSlug) {
     const adapter = optionalText(agent.adapter) || "unknown";
     const model = mcodaAgentDefaultModel(agent) || fallbackSlug;
     const config = agent.config ?? null;
     const localRunner = normalizeMcodaLocalRunnerConfig(adapter, config);
+    const configAuthMode = normalizeLocalRunnerAuthMode(config?.authMode);
     const supportsTools = optionalBoolean(agent.supportsTools, agent.supports_tools, localRunner?.supportsTools) === true;
     return {
         slug: optionalText(agent.slug) || fallbackSlug,
@@ -1709,7 +1841,7 @@ function mapMcodaAgentToCodaliAgent(agent, fallbackSlug) {
             : configText(config, "apiKey", "api_key"),
         localRunner,
         runnerKind: localRunner?.runnerKind,
-        authMode: localRunner?.authMode,
+        authMode: localRunner?.authMode ?? configAuthMode,
         dummyBearerToken: localRunner?.dummyBearerToken,
         headers: localRunner?.headers,
         extraBody: localRunner?.extraBody,
@@ -1747,6 +1879,7 @@ const DOCDEX_JOB_ERROR_CODES = new Set([
 ]);
 const PRE_START_JOB_ERROR_CODES = new Set([
     "selected_agent_unavailable",
+    "selected_agent_auth_unavailable",
     "selected_agent_unhealthy",
     "validation_failed",
     "docdex_context_missing",
@@ -3436,6 +3569,7 @@ export class SelfHostedNodeRuntime {
                     args: config.mcodaListArgs,
                     timeoutMs: config.requestTimeoutMs
                 });
+        this.mcodaAgentAuthResolver = deps?.mcodaAgentAuthResolver || defaultMcodaAgentAuthResolver;
         this.mcodaExecutor =
             deps?.mcodaExecutor ||
                 new McodaLocalAgentExecutor({
@@ -3626,6 +3760,7 @@ export class SelfHostedNodeRuntime {
             expose_all_models: setupConfig.exposeAllModels,
             model_allowlist: setupConfig.modelAllowlist,
             model_blocklist: setupConfig.modelBlocklist,
+            client_allowlist: setupConfig.clientAllowlist,
             heartbeat_interval_seconds: setupConfig.heartbeatIntervalSeconds,
             max_concurrent_jobs: setupConfig.maxConcurrentJobs,
             max_concurrent_llm_jobs: setupConfig.maxConcurrentLlmJobs,
@@ -3687,7 +3822,8 @@ export class SelfHostedNodeRuntime {
             expose_all_models: setupConfig.exposeAllModels,
             exposure_policy: setupConfig.exposeAllModels ? "all" : "none",
             model_allowlist: setupConfig.modelAllowlist,
-            model_blocklist: setupConfig.modelBlocklist
+            model_blocklist: setupConfig.modelBlocklist,
+            client_allowlist: setupConfig.clientAllowlist
         };
         await writeSelfHostedNodeState(setupConfig.statePath, state);
         await writeSelfHostedRuntimeToken(setupConfig.runtimeTokenPath, runtimeToken);
@@ -3740,7 +3876,8 @@ export class SelfHostedNodeRuntime {
             hardwareTelemetryEnabled: setupConfig.hardwareTelemetryEnabled,
             exposeAllModels: setupConfig.exposeAllModels,
             modelAllowlist: setupConfig.modelAllowlist,
-            modelBlocklist: setupConfig.modelBlocklist
+            modelBlocklist: setupConfig.modelBlocklist,
+            clientAllowlist: setupConfig.clientAllowlist
         }, { ...deps, gateway: runtimeGateway });
         const once = await runtime.runOnce();
         return {
@@ -3869,7 +4006,8 @@ export class SelfHostedNodeRuntime {
             expose_all_models: this.config.exposeAllModels,
             exposure_policy: this.config.exposeAllModels ? "all" : "none",
             model_allowlist: this.config.modelAllowlist,
-            model_blocklist: this.config.modelBlocklist
+            model_blocklist: this.config.modelBlocklist,
+            client_allowlist: this.config.clientAllowlist
         };
         await writeSelfHostedNodeState(this.config.statePath, nextState);
         await writeSelfHostedRuntimeToken(this.config.runtimeTokenPath, runtimeToken);
@@ -3903,7 +4041,21 @@ export class SelfHostedNodeRuntime {
         if (mapped.health_status && mapped.health_status !== "healthy" && mapped.health_status !== "unknown") {
             throw new SelfHostedPreStartJobError("selected_agent_unhealthy", `selected local mcoda agent ${selected} is ${mapped.health_status}`);
         }
-        return mapMcodaAgentToCodaliAgent(agent, selected);
+        const codaliAgent = mapMcodaAgentToCodaliAgent(agent, selected);
+        if (!codaliAgent.apiKey && mcodaAgentRequiresApiKey(agent, codaliAgent)) {
+            let apiKey;
+            try {
+                apiKey = optionalText(await this.mcodaAgentAuthResolver(agent)) || undefined;
+            }
+            catch {
+                throw new SelfHostedPreStartJobError("selected_agent_auth_unavailable", `selected local mcoda agent ${selected} auth could not be loaded`);
+            }
+            if (!apiKey) {
+                throw new SelfHostedPreStartJobError("selected_agent_auth_unavailable", `selected local mcoda agent ${selected} requires an API key; run "mcoda agent auth set ${selected}" on this node`);
+            }
+            codaliAgent.apiKey = apiKey;
+        }
+        return codaliAgent;
     }
     async executeGenericJob(envelope, options = {}) {
         const startedAt = Date.now();
@@ -4416,6 +4568,7 @@ export class SelfHostedNodeRuntime {
                 model_count: models.length,
                 exposed_model_count: exposedModelCount
             },
+            client_allowlist: this.config.clientAllowlist,
             models,
             capabilities: capabilityPayload,
             ...(loadTelemetry.hardware_pressure ? { hardware_pressure: loadTelemetry.hardware_pressure } : {})
@@ -4576,10 +4729,28 @@ export class SelfHostedNodeRuntime {
                 }
                 : (({ stream_events: _streamEvents, ...rest }) => rest)(result)
             : result;
-        try {
-            await this.gateway.postJobResult(enrollment.runtimeToken, job.job_id, this.jobResultPayload(postedResult));
+        let resultPostError = null;
+        for (let attempt = 0; attempt <= RELAY_RESULT_POST_RETRY_DELAYS_MS.length; attempt += 1) {
+            try {
+                await this.gateway.postJobResult(enrollment.runtimeToken, job.job_id, this.jobResultPayload(postedResult));
+                resultPostError = null;
+                break;
+            }
+            catch (error) {
+                resultPostError = error;
+                const attemptNumber = attempt + 1;
+                const maxAttempts = RELAY_RESULT_POST_RETRY_DELAYS_MS.length + 1;
+                const retryDelayMs = RELAY_RESULT_POST_RETRY_DELAYS_MS[attempt];
+                if (retryDelayMs === undefined) {
+                    break;
+                }
+                console.warn(`[mswarm] self-hosted result post failed for ${job.job_id} ` +
+                    `(attempt ${attemptNumber}/${maxAttempts}): ${runtimeErrorMessage(error)}`);
+                await sleep(retryDelayMs);
+            }
         }
-        catch (error) {
+        if (resultPostError) {
+            const error = resultPostError;
             const mismatch = this.lifecycleProtocolMismatch("result", error);
             if (mismatch) {
                 await this.markLifecycleProtocolDegraded(mismatch);
@@ -4632,7 +4803,9 @@ export class SelfHostedNodeRuntime {
                 return;
             polling = true;
             void this.pollAndExecuteJob()
-                .catch(() => undefined)
+                .catch((error) => {
+                console.error(`[mswarm] self-hosted relay poll failed: ${runtimeErrorMessage(error)}`);
+            })
                 .finally(() => {
                 polling = false;
                 if (!stopped) {