@muxoai/platform 1.3.1 → 1.3.3

package/dist/server.js

@@ -6,7 +6,9 @@ import { getConfig, ROOT_DIR } from "./config.js";
 import { MuxoEngine } from "./engine.js";
 import { getMuxoMcpSkills, handleJsonRpcMcpRequest, MUXO_MCP_SERVER_INSTRUCTIONS, MUXO_MCP_TOOLS, } from "./mcp.js";
 import { MuxoStore } from "./store.js";
-import { renderConsoleHtml, renderLandingHtml } from "./ui/console-html.js";
+import { sanitizePolicyPatch } from "./policy.js";
+import { MUXO_VERSION } from "./version.js";
+import { isConsolePath, renderConsoleHtml, renderLandingHtml } from "./ui/console-html.js";
 function renderSkillMarkdown(baseUrl) {
     return `---
 name: muxo
@@ -170,7 +172,7 @@ export function createMuxoServer(customConfig) {
                     ok: true,
                     status: "ready",
                     service: "muxo-platform",
-                    version: "1.3.1",
+                    version: MUXO_VERSION,
                     environment: "production",
                     live_execution: true,
                     customer_billing: true,
@@ -464,7 +466,7 @@ export function createMuxoServer(customConfig) {
                     openapi: "3.1.0",
                     info: {
                         title: "Muxo Unified Agent Execution, Infrastructure, Memory & Governance API",
-                        version: "1.3.1",
+                        version: MUXO_VERSION,
                         description: "One governed boundary over Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Supermemory v5 Brain, and Microsoft Agent Governance Toolkit.",
                     },
                     servers: [{ url: config.baseUrl }],
@@ -634,12 +636,20 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
-            // Web Console UI (app.muxo.ai)
-            if ((pathname === "/" || pathname === "/console") && req.method === "GET") {
+            // Web Console UI (app.muxo.ai) & SPA deep-links
+            if (isConsolePath(pathname) && req.method === "GET") {
                 res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
                 res.end(renderConsoleHtml());
                 return;
             }
+            if (pathname === "/downloads/muxo-cli.zip" && req.method === "GET") {
+                res.writeHead(302, {
+                    Location: "https://muxo.ai/plugins/muxo-chatgpt-plugin.zip",
+                    "Cache-Control": "no-store",
+                });
+                res.end();
+                return;
+            }
             // Built-in Interactive Landing & Provider Canvas (muxo.ai)
             if (pathname === "/landing" && req.method === "GET") {
                 res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -683,7 +693,8 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
     <div class="badge">Ownership Bound</div>
     <h1>Workspace Claimed</h1>
     <p>Workspace <code>${redeemed.workspace.name}</code> (${redeemed.workspace.id}) claimed by <strong>${redeemed.targetEmail}</strong>.</p>
-    <a class="btn" href="/?claimed=${encodeURIComponent(redeemed.workspace.slug)}&api_key=${encodeURIComponent(claimConsoleKey)}">Open Muxo Console →</a>
+    <p>Console key: <code>${claimConsoleKey}</code><br />Choose “Use an API key instead” in the console and paste it.</p>
+    <a class="btn" href="/?claimed=${encodeURIComponent(redeemed.workspace.slug)}">Open Muxo Console →</a>
   </div>
 </body>
 </html>`);
@@ -753,8 +764,11 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
 </html>`);
                 return;
             }
-            // Autonomous Agent 2-Call Signup (agents.composio.dev pattern) — Public
-            if (pathname === "/api/v1/agents/signup" && req.method === "POST") {
+            // Autonomous Agent 2-Call Signup — Public
+            if ((pathname === "/api/v1/agents/signup" ||
+                pathname === "/api/v1/auth/signup" ||
+                pathname === "/api/signup") &&
+                req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const created = store.createAutonomousAgentSignup({
                     agentName: body.agentName ? String(body.agentName) : undefined,
@@ -805,7 +819,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     protocolVersion: "2025-06-18",
                     serverInfo: {
                         name: "muxo-mcp-server",
-                        version: "1.3.1",
+                        version: MUXO_VERSION,
                     },
                     instructions: MUXO_MCP_SERVER_INSTRUCTIONS,
                     toolsCount: MUXO_MCP_TOOLS.length,
@@ -845,6 +859,10 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 return;
             }
             // Auth Endpoints
+            if (pathname === "/api/v1/auth/config" && req.method === "GET") {
+                sendJson(res, 200, { ok: true, provider: "password", clerk: null, signInUrl: "/login" });
+                return;
+            }
             if (pathname === "/api/v1/auth/register" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const created = store.registerUser({
@@ -853,7 +871,16 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     password: String(body.password || ""),
                     workspaceName: body.workspaceName ? String(body.workspaceName) : undefined,
                 });
-                sendJson(res, 201, { ok: true, ...created });
+                const initialKey = store.createApiKey({
+                    workspaceId: created.workspace.id,
+                    name: "Default Live Key",
+                    environment: "live",
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    ...created,
+                    apiKey: initialKey.secretKey,
+                });
                 return;
             }
             if (pathname === "/api/v1/auth/login" && req.method === "POST") {
@@ -917,11 +944,49 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             // Microsoft Agent Governance Status & Audit Verification
             if (pathname === "/api/v1/governance" && req.method === "GET") {
+                const ws = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+                const fullReport = engine.governance.getGovernanceStatus(ws);
                 sendJson(res, 200, {
                     ok: true,
-                    governance: engine.governance.getStatus(),
-                    workspacePolicy: ctx.workspace.policy,
+                    governance: {
+                        ...engine.governance.getStatus(ws),
+                        modules: fullReport.modules,
+                        trustScore: fullReport.trustScore,
+                        killSwitch: fullReport.killSwitch,
+                        contextPoisoning: fullReport.contextPoisoning,
+                        auditChain: fullReport.auditChain,
+                    },
+                    workspacePolicy: ws.policy,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/governance/kill-switch" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const action = String(body.action || "quarantine").toLowerCase();
+                if (action === "resume" || body.active === false) {
+                    const out = engine.resumeWorkspaceKillSwitch(ctx);
+                    sendJson(res, 200, { ok: true, ...out });
+                    return;
+                }
+                const out = await engine.activateWorkspaceKillSwitch(ctx, {
+                    reason: String(body.reason || "Emergency kill-switch activated by workspace operator"),
+                    action: action === "terminate" || action === "suspend"
+                        ? action
+                        : "quarantine",
+                });
+                sendJson(res, 200, { ok: true, ...out });
+                return;
+            }
+            if (pathname === "/api/v1/governance/scan-context" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const scan = engine.governance.scanMemoryContent({
+                    workspaceId: ctx.workspace.id,
+                    sessionId: String(body.sessionId || "default"),
+                    role: body.role || "user",
+                    content: String(body.content || ""),
+                    recordInDetector: Boolean(body.recordInDetector),
                 });
+                sendJson(res, 200, { ok: true, scan });
                 return;
             }
             // Supermemory v5 Workspace Brain Endpoints
@@ -933,6 +998,37 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, { ok: true, ...overview });
                 return;
             }
+            if (pathname === "/api/v1/memory/facts" && req.method === "GET") {
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    undefined;
+                const includeHistorical = url.searchParams.get("historical") !== "false";
+                const facts = store.listTemporalFacts(ctx.workspace.id, {
+                    includeHistorical,
+                    subject: url.searchParams.get("subject") || undefined,
+                    predicate: url.searchParams.get("predicate") || undefined,
+                    query,
+                    limit: Number(url.searchParams.get("limit") || 50),
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    activeFacts: facts.filter((f) => f.validTo === null),
+                    historicalFacts: facts.filter((f) => f.validTo !== null),
+                    facts,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/memory/forget" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const query = String(body.query || body.q || "").trim();
+                if (!query) {
+                    sendJson(res, 400, { ok: false, error: "query is required to forget matching memories" });
+                    return;
+                }
+                const pruned = await engine.forgetWorkspaceMemoryMatching(ctx, query);
+                sendJson(res, 200, { ok: true, ...pruned });
+                return;
+            }
             if (pathname === "/api/v1/memory" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const record = await engine.addWorkspaceMemory(ctx, {
@@ -940,6 +1036,9 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     content: String(body.content || ""),
                     kind: body.kind || "fact",
                     metadata: body.metadata || {},
+                    subject: body.subject ? String(body.subject) : undefined,
+                    predicate: body.predicate ? String(body.predicate) : undefined,
+                    object: body.object ? String(body.object) : undefined,
                 });
                 sendJson(res, 201, { ok: true, memory: record });
                 return;
@@ -961,6 +1060,15 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 201, { ok: true, ...created });
                 return;
             }
+            if (pathname.startsWith("/api/v1/api-keys/") && req.method === "DELETE") {
+                const keyId = decodeURIComponent(pathname.slice("/api/v1/api-keys/".length));
+                if (!store.revokeApiKey(ctx.workspace.id, keyId)) {
+                    sendJson(res, 404, { ok: false, error: "API key not found" });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, revoked: keyId });
+                return;
+            }
             // Profile & Organization (v1 and api/v1)
             if ((pathname === "/api/v1/profile" || pathname === "/v1/profile") && req.method === "GET") {
                 sendJson(res, 200, { ok: true, ...engine.getProfile(ctx) });
@@ -1060,7 +1168,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             // Governance Policy
             if (pathname === "/api/v1/policy" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
-                const updated = store.updateWorkspacePolicy(ctx.workspace.id, body);
+                const updated = store.updateWorkspacePolicy(ctx.workspace.id, sanitizePolicyPatch(body));
                 sendJson(res, 200, { ok: true, workspace: updated });
                 return;
             }
@@ -1074,10 +1182,17 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/api/v1/plans" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
+                const rawFunding = body.fundingMode || body.funding_mode;
+                const fundingMode = rawFunding === "byok" || rawFunding === "customer_funded"
+                    ? "byok"
+                    : rawFunding === "muxo_funded"
+                        ? "muxo_funded"
+                        : undefined;
                 const planned = await engine.planAction(ctx, {
                     toolSlug: String(body.toolSlug || body.tool_slug || ""),
                     input: body.input || {},
                     reason: body.reason ? String(body.reason) : undefined,
+                    fundingMode,
                 });
                 sendJson(res, 201, { ok: true, ...planned });
                 return;
@@ -1101,6 +1216,13 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
+            const planGetMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)$/);
+            if (planGetMatch && req.method === "GET") {
+                const planId = decodeURIComponent(planGetMatch[1]);
+                const plan = engine.getPlan(ctx, planId);
+                sendJson(res, 200, { ok: true, plan });
+                return;
+            }
             // Runs & Receipts
             if (pathname === "/api/v1/runs" && req.method === "GET") {
                 sendJson(res, 200, {
@@ -1109,6 +1231,21 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
+            const runCancelMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)\/cancel$/);
+            if (runCancelMatch && req.method === "POST") {
+                const runId = decodeURIComponent(runCancelMatch[1]);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const cancelled = engine.cancelRun(ctx, runId, body.reason ? String(body.reason) : undefined);
+                sendJson(res, 200, { ok: true, ...cancelled });
+                return;
+            }
+            const runGetMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)$/);
+            if (runGetMatch && req.method === "GET") {
+                const runId = decodeURIComponent(runGetMatch[1]);
+                const run = engine.getRun(ctx, runId);
+                sendJson(res, 200, { ok: true, run });
+                return;
+            }
             if (pathname.startsWith("/api/v1/receipts/") && req.method === "GET") {
                 const receiptId = decodeURIComponent(pathname.slice("/api/v1/receipts/".length));
                 const verified = engine.getReceipt(ctx, receiptId);
@@ -1158,7 +1295,13 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             if ((pathname === "/api/v1/do" || pathname === "/v1/do") &&
                 req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
-                const prompt = String(body.prompt || body.instruction || body.query || body.command || "").trim();
+                const prompt = String(body.prompt ||
+                    body.instruction ||
+                    body.query ||
+                    body.command ||
+                    body.toolSlug ||
+                    body.tool ||
+                    "").trim();
                 if (!prompt) {
                     sendJson(res, 400, {
                         ok: false,
@@ -1166,19 +1309,37 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     });
                     return;
                 }
+                const dryRun = body.dryRun === true ||
+                    body.dry_run === true ||
+                    body.planOnly === true ||
+                    body.autoExecute === false ||
+                    body.auto_execute === false;
+                const autoApprove = body.autoApprove !== false &&
+                    body.auto_approve !== false &&
+                    body.approveRisky !== false &&
+                    body.approve_risky !== false;
+                const rawFunding = body.fundingMode || body.funding_mode;
+                const fundingMode = rawFunding === "byok" || rawFunding === "customer_funded"
+                    ? "byok"
+                    : rawFunding === "muxo_funded"
+                        ? "muxo_funded"
+                        : undefined;
                 const result = await engine.doNaturalLanguage(ctx, {
                     prompt,
                     input: body.input && typeof body.input === "object"
                         ? body.input
                         : undefined,
-                    autoApprove: body.autoApprove !== false,
-                    dryRun: body.dryRun === true,
+                    autoApprove,
+                    dryRun,
+                    planOnly: dryRun,
+                    fundingMode,
                 });
                 sendJson(res, 200, result);
                 return;
             }
             // Live Stripe Billing, Credit Top-Up & Supplier Settlement Ledger
-            if (pathname === "/api/v1/billing/status" && req.method === "GET") {
+            if ((pathname === "/api/v1/billing/status" || pathname === "/api/v1/billing") &&
+                req.method === "GET") {
                 const ws = store.getWorkspace(ctx.workspace.id);
                 const settlementSummary = store.getSupplierSettlementSummary(ctx.workspace.id);
                 const byokKeys = store.listByokKeys(ctx.workspace.id);

package/dist/store.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseSync } from "node:sqlite";
-import type { ActionPlan, ApiKeyRecord, ByokKeyRecord, ConnectionRecord, ExecutionReceipt, ExecutionRun, GovernanceDecisionRecord, GovernancePolicy, LedgerEntry, MemoryContextSummary, ProviderLane, ProvisionedResource, RiskLevel, SupplierSettlement, SupplierSettlementSummary, User, Workspace, WorkspaceMemoryRecord } from "./types.js";
+import type { ActionPlan, ApiKeyRecord, ByokKeyRecord, ConnectionRecord, ExecutionReceipt, ExecutionRun, GovernanceDecisionRecord, GovernancePolicy, LedgerEntry, MemoryContextSummary, ProviderLane, ProvisionedResource, RiskLevel, SupplierSettlement, SupplierSettlementSummary, TemporalGraphFact, User, Workspace, WorkspaceMemoryRecord } from "./types.js";
 export declare const BYOK_PROVIDER_CATALOG: Record<string, {
     category: "llm" | "supplier";
     envVarName: string;
@@ -173,6 +173,30 @@ export declare class MuxoStore {
     }): WorkspaceMemoryRecord;
     listMemoryRecords(workspaceId: string, limit?: number): WorkspaceMemoryRecord[];
     deleteMemoryRecord(workspaceId: string, idOrDocId: string): WorkspaceMemoryRecord | null;
+    upsertTemporalFact(params: {
+        workspaceId: string;
+        subject: string;
+        predicate: string;
+        object: string;
+        summary: string;
+        confidence?: number;
+        sourceKind?: TemporalGraphFact["sourceKind"];
+        sourceReferenceId?: string | null;
+        metadata?: Record<string, unknown>;
+        supersedeExisting?: boolean;
+    }): TemporalGraphFact;
+    listTemporalFacts(workspaceId: string, opts?: {
+        includeHistorical?: boolean;
+        subject?: string;
+        predicate?: string;
+        query?: string;
+        limit?: number;
+    }): TemporalGraphFact[];
+    forgetMatchingMemoryRecords(workspaceId: string, query: string): {
+        deletedMemories: WorkspaceMemoryRecord[];
+        invalidatedFacts: TemporalGraphFact[];
+    };
+    private mapTemporalFact;
     createAutonomousAgentSignup(params?: {
         agentName?: string;
         harness?: string;