@naisys/hub 3.0.0-beta.10

package/bin/naisys-hub

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import "../dist/naisysHub.js";

package/dist/handlers/hubAccessKeyService.js

@@ -0,0 +1,28 @@
+import { HubEvents, RotateAccessKeyRequestSchema } from "@naisys/hub-protocol";
+import { rotateAccessKey } from "../services/accessKeyService.js";
+/**
+ * Handles hub access key rotation requests from the supervisor.
+ * Rotates the key, updates auth, and disconnects all clients.
+ * The new key is returned only to the requesting supervisor via ack;
+ * all other clients must be manually given the new key.
+ */
+export function createHubAccessKeyService(naisysServer, logService) {
+    naisysServer.registerEvent(HubEvents.ROTATE_ACCESS_KEY, (_hostId, _data, ack) => {
+        try {
+            const newAccessKey = rotateAccessKey();
+            // Update the hub's auth middleware to accept the new key
+            naisysServer.updateHubAccessKey(newAccessKey);
+            logService.log(`[Hub:AccessKey] Access key rotated successfully`);
+            // Respond to the requesting supervisor before disconnecting
+            ack({ success: true, newAccessKey });
+            // Disconnect all clients — they'll need the new key to reconnect
+            logService.log(`[Hub:AccessKey] Disconnecting all clients after key rotation`);
+            naisysServer.disconnectAllClients();
+        }
+        catch (error) {
+            logService.error(`[Hub:AccessKey] Failed to rotate access key: ${error}`);
+            ack({ success: false, error: String(error) });
+        }
+    }, RotateAccessKeyRequestSchema);
+}
+//# sourceMappingURL=hubAccessKeyService.js.map

package/dist/handlers/hubAgentService.js

@@ -0,0 +1,238 @@
+import { AgentPeekRequestSchema, AgentStartRequestSchema, AgentStopRequestSchema, HubEvents, } from "@naisys/hub-protocol";
+/** Handles agent_start requests by routing them to the least-loaded eligible host */
+export function createHubAgentService(naisysServer, { hubDb }, logService, heartbeatService, sendMailService, hostRegistrar) {
+    /** Find the least-loaded eligible host for a given user */
+    async function findBestHost(startUserId) {
+        // Look up which hosts this user is assigned to
+        const userHosts = await hubDb.user_hosts.findMany({
+            where: { user_id: startUserId },
+            select: { host_id: true },
+        });
+        const assignedHostIds = userHosts.map((uh) => uh.host_id);
+        // Determine eligible hosts: assigned hosts, or all connected (non-restricted) if unassigned
+        let eligibleHostIds;
+        if (assignedHostIds.length > 0) {
+            eligibleHostIds = assignedHostIds;
+        }
+        else {
+            const restrictedHostIds = new Set(hostRegistrar
+                .getAllHosts()
+                .filter((h) => h.restricted)
+                .map((h) => h.hostId));
+            eligibleHostIds = naisysServer
+                .getConnectedClients()
+                .map((c) => c.getHostId())
+                .filter((hid) => !restrictedHostIds.has(hid));
+        }
+        // Filter to connected hosts that can run agents
+        const connectedEligible = eligibleHostIds.filter((hid) => {
+            const conn = naisysServer.getConnectionByHostId(hid);
+            return conn && conn.getHostType() === "naisys";
+        });
+        if (connectedEligible.length === 0) {
+            return null;
+        }
+        // Pick the host with the fewest active agents
+        let bestHostId = connectedEligible[0];
+        let bestCount = heartbeatService.getHostActiveAgentCount(bestHostId);
+        for (const hid of connectedEligible.slice(1)) {
+            const count = heartbeatService.getHostActiveAgentCount(hid);
+            if (count < bestCount) {
+                bestHostId = hid;
+                bestCount = count;
+            }
+        }
+        return bestHostId;
+    }
+    /** Check if a user is enabled (not disabled or archived) */
+    async function isAgentEnabled(userId) {
+        const user = await hubDb.users.findUnique({
+            where: { id: userId },
+            select: { enabled: true, archived: true },
+        });
+        return !!user?.enabled && !user?.archived;
+    }
+    /** Try to start an agent on the best available host (fire-and-forget) */
+    async function tryStartAgent(startUserId) {
+        try {
+            if (!(await isAgentEnabled(startUserId))) {
+                logService.log(`[Hub:Agents] Auto-start: agent ${startUserId} is disabled or archived`);
+                return false;
+            }
+            const bestHostId = await findBestHost(startUserId);
+            if (bestHostId === null) {
+                logService.log(`[Hub:Agents] Auto-start: no eligible host for user ${startUserId}`);
+                return false;
+            }
+            const sent = naisysServer.sendMessage(bestHostId, HubEvents.AGENT_START, {
+                startUserId,
+            }, (response) => {
+                if (response.success) {
+                    heartbeatService.addStartedAgent(bestHostId, startUserId);
+                }
+                else {
+                    logService.error(`[Hub:Agents] Auto-start failed for user ${startUserId}: ${response.error}`);
+                }
+            });
+            if (sent) {
+                logService.log(`[Hub:Agents] Auto-start: sent start for user ${startUserId} to host ${bestHostId}`);
+            }
+            return sent;
+        }
+        catch (error) {
+            logService.error(`[Hub:Agents] Auto-start error: ${error}`);
+            return false;
+        }
+    }
+    naisysServer.registerEvent(HubEvents.AGENT_START, async (hostId, data, ack) => {
+        try {
+            const parsed = AgentStartRequestSchema.parse(data);
+            const requesterUserId = parsed.requesterUserId;
+            if (!(await isAgentEnabled(parsed.startUserId))) {
+                ack({
+                    success: false,
+                    error: `Agent ${parsed.startUserId} is disabled`,
+                });
+                return;
+            }
+            const bestHostId = await findBestHost(parsed.startUserId);
+            if (bestHostId === null) {
+                ack({
+                    success: false,
+                    error: `No eligible hosts are online for user ${parsed.startUserId}`,
+                });
+                return;
+            }
+            if (!requesterUserId) {
+                ack({
+                    success: false,
+                    error: `Missing requesterUserId in agent_start request for user ${parsed.startUserId}`,
+                });
+                return;
+            }
+            // Forward the start request to the selected host
+            const sent = naisysServer.sendMessage(bestHostId, HubEvents.AGENT_START, {
+                startUserId: parsed.startUserId,
+                taskDescription: parsed.taskDescription,
+                sourceHostId: hostId,
+            }, (response) => {
+                if (response.success) {
+                    heartbeatService.addStartedAgent(bestHostId, parsed.startUserId);
+                }
+                // Reverse-ack with the response from the host (including success status and any error message) back to the original requester
+                ack(response);
+                // Send task description mail after successful start to avoid
+                // orphaned mails from failed start attempts
+                if (response.success && parsed.taskDescription) {
+                    void sendTaskMail(parsed.startUserId, requesterUserId, parsed.taskDescription);
+                }
+            });
+            if (!sent) {
+                ack({
+                    success: false,
+                    error: `Failed to send to host ${bestHostId}`,
+                });
+            }
+        }
+        catch (error) {
+            logService.error(`[Hub:Agents] agent_start error from host ${hostId}: ${error}`);
+            ack({ success: false, error: String(error) });
+        }
+    });
+    async function sendTaskMail(startUserId, requesterUserId, taskDescription) {
+        try {
+            await sendMailService.sendMail({
+                fromUserId: requesterUserId,
+                recipientUserIds: [startUserId],
+                subject: "Agent Start", // Agent will send a 'Session Completed' mail when session is completed
+                body: taskDescription,
+                kind: "mail",
+            });
+        }
+        catch (err) {
+            logService.error(`[Hub:Agents] Failed to send task mail: ${err}`);
+        }
+    }
+    naisysServer.registerEvent(HubEvents.AGENT_STOP, (hostId, data, ack) => {
+        try {
+            const parsed = AgentStopRequestSchema.parse(data);
+            // Find which hosts the agent is currently running on
+            const targetHostIds = heartbeatService.findHostsForAgent(parsed.userId);
+            if (targetHostIds.length === 0) {
+                ack({
+                    success: false,
+                    error: `Agent ${parsed.userId} is not running on any known host`,
+                });
+                return;
+            }
+            // Forward the stop request to all hosts running this agent
+            let acked = false;
+            let sendFailures = 0;
+            for (const targetHostId of targetHostIds) {
+                const sent = naisysServer.sendMessage(targetHostId, HubEvents.AGENT_STOP, {
+                    userId: parsed.userId,
+                    reason: parsed.reason,
+                    sourceHostId: hostId,
+                }, (response) => {
+                    if (response.success) {
+                        heartbeatService.removeStoppedAgent(targetHostId, parsed.userId);
+                    }
+                    // Ack with the first response
+                    if (!acked) {
+                        acked = true;
+                        ack(response);
+                    }
+                });
+                if (!sent) {
+                    sendFailures++;
+                }
+            }
+            if (sendFailures === targetHostIds.length && !acked) {
+                ack({
+                    success: false,
+                    error: `No target hosts are connected`,
+                });
+            }
+        }
+        catch (error) {
+            logService.error(`[Hub:Agents] agent_stop error from host ${hostId}: ${error}`);
+            ack({ success: false, error: String(error) });
+        }
+    });
+    naisysServer.registerEvent(HubEvents.AGENT_PEEK, (hostId, data, ack) => {
+        try {
+            const parsed = AgentPeekRequestSchema.parse(data);
+            // Find which host the agent is running on
+            const targetHostIds = heartbeatService.findHostsForAgent(parsed.userId);
+            if (targetHostIds.length === 0) {
+                ack({
+                    success: false,
+                    error: `Agent ${parsed.userId} is not running on any known host`,
+                });
+                return;
+            }
+            // Forward peek request to the first host (only need one response)
+            const targetHostId = targetHostIds[0];
+            const sent = naisysServer.sendMessage(targetHostId, HubEvents.AGENT_PEEK, {
+                userId: parsed.userId,
+                skip: parsed.skip,
+                take: parsed.take,
+                sourceHostId: hostId,
+            }, (response) => {
+                ack(response);
+            });
+            if (!sent) {
+                ack({
+                    success: false,
+                    error: `Failed to send to host ${targetHostId}`,
+                });
+            }
+        }
+        catch (error) {
+            logService.error(`[Hub:Agents] agent_peek error from host ${hostId}: ${error}`);
+            ack({ success: false, error: String(error) });
+        }
+    });
+    return { tryStartAgent };
+}
+//# sourceMappingURL=hubAgentService.js.map

package/dist/handlers/hubAttachmentService.js

@@ -0,0 +1,227 @@
+import { mimeFromFilename } from "@naisys/common";
+import { extractBearerToken } from "@naisys/common-node";
+import { createHash, randomBytes } from "crypto";
+import { createReadStream, createWriteStream, existsSync, mkdirSync, renameSync, statSync, unlinkSync, } from "fs";
+import { join } from "path";
+import { pipeline, Writable } from "stream";
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
+/**
+ * HTTP attachment upload/download service.
+ * Registers a `request` handler on the raw HTTPS server for `/attachments` paths.
+ * Non-matching paths are ignored so Socket.IO still works.
+ */
+export function createHubAttachmentService(httpServer, { hubDb }, logService) {
+    const naisysFolder = process.env.NAISYS_FOLDER || "";
+    httpServer.on("request", (req, res) => {
+        const url = new URL(req.url || "", `https://${req.headers.host || "localhost"}`);
+        const pathname = url.pathname;
+        if (pathname === "/hub/attachments" && req.method === "POST") {
+            handleUpload(url, req, res).catch((err) => {
+                logService.error(`[Hub:Attachment] Upload error: ${err}`);
+                if (!res.writableEnded) {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Internal server error" }));
+                }
+            });
+        }
+        else if (pathname.startsWith("/hub/attachments/") &&
+            pathname !== "/hub/attachments/" &&
+            req.method === "GET") {
+            handleDownload(pathname, req, res).catch((err) => {
+                logService.error(`[Hub:Attachment] Download error: ${err}`);
+                if (!res.writableEnded) {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Internal server error" }));
+                }
+            });
+        }
+        // Non-matching paths: do nothing — let Socket.IO handle them
+    });
+    async function resolveUserByApiKey(apiKey) {
+        const user = await hubDb.users.findUnique({ where: { api_key: apiKey } });
+        return user?.id ?? null;
+    }
+    async function handleUpload(url, req, res) {
+        const apiKey = extractBearerToken(req.headers.authorization);
+        const filename = url.searchParams.get("filename");
+        const fileSizeStr = url.searchParams.get("filesize");
+        const fileHash = url.searchParams.get("filehash");
+        const purpose = url.searchParams.get("purpose");
+        if (!apiKey) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Missing Authorization header" }));
+            return;
+        }
+        if (!filename || !fileSizeStr || !fileHash || !purpose) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: "Missing required query params: filename, filesize, filehash, purpose",
+            }));
+            return;
+        }
+        if (purpose !== "mail" && purpose !== "context") {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: 'Invalid purpose. Must be "mail" or "context"',
+            }));
+            return;
+        }
+        const fileSize = parseInt(fileSizeStr, 10);
+        if (isNaN(fileSize) || fileSize <= 0) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid filesize" }));
+            return;
+        }
+        if (fileSize > MAX_FILE_SIZE) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: `File too large. Max size: ${MAX_FILE_SIZE} bytes`,
+            }));
+            return;
+        }
+        const userId = await resolveUserByApiKey(apiKey);
+        if (userId == null) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid API key" }));
+            return;
+        }
+        // Stream to temp file, then move to content-addressable path
+        const tmpDir = join(naisysFolder, "attachments", "tmp");
+        mkdirSync(tmpDir, { recursive: true });
+        const tmpPath = join(tmpDir, `${Date.now()}_${userId}_${Math.random().toString(36).slice(2)}`);
+        const hash = createHash("sha256");
+        let bytesWritten = 0;
+        const fileStream = createWriteStream(tmpPath);
+        const success = await new Promise((resolve) => {
+            const sizeChecker = new Writable({
+                write(chunk, _encoding, callback) {
+                    bytesWritten += chunk.length;
+                    if (bytesWritten > MAX_FILE_SIZE) {
+                        callback(new Error("File exceeds size limit"));
+                        return;
+                    }
+                    hash.update(chunk);
+                    fileStream.write(chunk, callback);
+                },
+                final(callback) {
+                    fileStream.end(callback);
+                },
+            });
+            pipeline(req, sizeChecker, (err) => {
+                if (err) {
+                    fileStream.destroy();
+                    try {
+                        unlinkSync(tmpPath);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    resolve(false);
+                }
+                else {
+                    resolve(true);
+                }
+            });
+        });
+        if (!success) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "File exceeds size limit during upload" }));
+            return;
+        }
+        // Verify hash
+        const computedHash = hash.digest("hex");
+        if (computedHash !== fileHash) {
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch {
+                /* ignore */
+            }
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: `Hash mismatch. Expected: ${fileHash}, got: ${computedHash}`,
+            }));
+            return;
+        }
+        // Move to content-addressable path: attachments/hub/<first2>/<next2>/<fullhash>
+        const storageDir = join(naisysFolder, "attachments", "hub", computedHash.slice(0, 2), computedHash.slice(2, 4));
+        mkdirSync(storageDir, { recursive: true });
+        const storagePath = join(storageDir, computedHash);
+        if (existsSync(storagePath)) {
+            // Dedup: identical file already on disk, discard temp
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        else {
+            renameSync(tmpPath, storagePath);
+        }
+        // Create DB record
+        const record = await hubDb.attachments.create({
+            data: {
+                public_id: randomBytes(8).toString("base64url").slice(0, 10),
+                filepath: storagePath,
+                filename,
+                file_size: bytesWritten,
+                file_hash: computedHash,
+                purpose: purpose,
+                uploaded_by: userId,
+            },
+        });
+        const attachmentId = record.id;
+        logService.log(`[Hub:Attachment] Uploaded attachment ${attachmentId}: ${filename} (${bytesWritten} bytes) by user ${userId}`);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ id: attachmentId }));
+    }
+    async function handleDownload(pathname, req, res) {
+        const apiKey = extractBearerToken(req.headers.authorization);
+        if (!apiKey) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Missing Authorization header" }));
+            return;
+        }
+        const userId = await resolveUserByApiKey(apiKey);
+        if (userId == null) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid API key" }));
+            return;
+        }
+        // Parse public ID from /hub/attachments/<publicId> or /hub/attachments/<publicId>/<filename>
+        const segments = pathname.slice("/hub/attachments/".length).split("/");
+        const publicId = segments[0];
+        if (!publicId) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Missing attachment ID" }));
+            return;
+        }
+        const attachment = await hubDb.attachments.findUnique({
+            where: { public_id: publicId },
+        });
+        if (!attachment) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Attachment not found" }));
+            return;
+        }
+        if (!existsSync(attachment.filepath)) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Attachment file missing from disk" }));
+            return;
+        }
+        const stat = statSync(attachment.filepath);
+        const contentType = mimeFromFilename(attachment.filename);
+        const disposition = contentType.startsWith("image/")
+            ? "inline"
+            : "attachment";
+        res.writeHead(200, {
+            "Content-Type": contentType,
+            "Content-Disposition": `${disposition}; filename="${attachment.filename.replace(/"/g, '\\"')}"`,
+            "Content-Length": stat.size,
+        });
+        const readStream = createReadStream(attachment.filepath);
+        readStream.pipe(res);
+    }
+}
+//# sourceMappingURL=hubAttachmentService.js.map

package/dist/handlers/hubConfigService.js

@@ -0,0 +1,85 @@
+import { buildClientConfig } from "@naisys/common";
+import { HubEvents } from "@naisys/hub-protocol";
+import dotenv from "dotenv";
+/** Pushes the global config to NAISYS instances when they connect or when variables change */
+export async function createHubConfigService(naisysServer, { hubDb }, logService) {
+    let cachedConfig = {
+        success: false,
+        error: "Not yet loaded",
+    };
+    // Seed DB from .env on first run
+    const existing = await hubDb.variables.findMany();
+    if (existing.length > 0) {
+        logService.log("[Hub:Config] .env variables already seeded");
+    }
+    else {
+        // First run: seed from .env file only (not all of process.env)
+        const { parsed: dotenvVars } = dotenv.config({ quiet: true });
+        const fileConfig = buildClientConfig(dotenvVars ?? {});
+        const entries = Object.entries(fileConfig.variableMap);
+        if (entries.length > 0) {
+            await hubDb.variables.createMany({
+                data: entries.map(([key, value]) => ({
+                    key,
+                    value,
+                    created_by: "hub",
+                    updated_by: "hub",
+                })),
+            });
+        }
+        logService.log(`[Hub:Config] Seeded ${entries.length} variables from .env file into database`);
+    }
+    /** Read variables from DB and build a ConfigResponse */
+    async function buildConfigPayload() {
+        const rows = await hubDb.variables.findMany();
+        const variableMap = {};
+        const shellExportKeys = new Set();
+        for (const row of rows) {
+            variableMap[row.key] = row.value;
+            if (row.export_to_shell) {
+                shellExportKeys.add(row.key);
+            }
+        }
+        cachedConfig = {
+            success: true,
+            config: buildClientConfig(variableMap, shellExportKeys),
+        };
+        return cachedConfig;
+    }
+    /** Broadcast current config to all connected clients */
+    async function broadcastConfig() {
+        try {
+            const payload = await buildConfigPayload();
+            logService.log(`[Hub:Config] Broadcasting config to all clients`);
+            naisysServer.broadcastToAll(HubEvents.VARIABLES_UPDATED, payload);
+        }
+        catch (error) {
+            logService.error(`[Hub:Config] Error broadcasting config: ${error}`);
+        }
+    }
+    // Push config to newly connected clients
+    naisysServer.registerEvent(HubEvents.CLIENT_CONNECTED, async (hostId, connection) => {
+        try {
+            const payload = await buildConfigPayload();
+            logService.log(`[Hub:Config] Pushing config to instance ${hostId}`);
+            connection.sendMessage(HubEvents.VARIABLES_UPDATED, payload);
+        }
+        catch (error) {
+            logService.error(`[Hub:Config] Error sending config to instance ${hostId}: ${error}`);
+            connection.sendMessage(HubEvents.VARIABLES_UPDATED, {
+                success: false,
+                error: String(error),
+            });
+        }
+    });
+    // Broadcast config to all clients when variables change
+    naisysServer.registerEvent(HubEvents.VARIABLES_CHANGED, async () => {
+        await broadcastConfig();
+    });
+    // Build initial config so it's available immediately
+    await buildConfigPayload();
+    return {
+        getConfig: () => cachedConfig,
+    };
+}
+//# sourceMappingURL=hubConfigService.js.map