@oar-sh/oar 0.9.9 → 0.9.11

package/server/routes/preview-routes.mjs

@@ -95,7 +95,15 @@ export function registerPreviewRoutes(app, deps) {
     // Probe immediately so the card does not sit badge-less until the next
     // scheduled sweep — and so a typo'd port shows as offline right away.
     previewHealthProbe?.probeNow?.(created.preview.token);
-    res.json({ ok: true, preview: created.preview, url: created.preview.url, basePath: created.preview.basePath });
+    // `existing`: this conversation already had a preview of the same target,
+    // and this is it (same token, same link, label unchanged).
+    res.json({
+      ok: true,
+      existing: created.existing === true,
+      preview: created.preview,
+      url: created.preview.url,
+      basePath: created.preview.basePath,
+    });
   });
 
   // DELETE /api/previews/:token — the link stops resolving immediately. The dev

package/server/routes/relay-event-routes.mjs

@@ -0,0 +1,157 @@
+'use strict';
+
+// Relay event subscriptions, for the browser: the active subscriptions (the
+// "watching" chip and the "watched" badges) and Unsubscribe. Agents use the
+// remote_relay tool instead; a request from another relay's agent is
+// refused here, so only this relay's user ends a subscription from outside
+// its conversation.
+//
+// And for paired relays: their agents subscribe to this relay's sessions
+// (POST /api/relay-events/remote/subscribe) and their relay fetches the
+// events (POST /api/relay-events/remote/pull, relay-event-link-service.mjs on
+// the other side). Only another relay's request is taken there, under the
+// inbound switch like a prompt; its subscriptions are filed under the relay
+// id it states, which never names a conversation here.
+
+import { REMOTE_RELAY_ERROR_CODES } from '../../shared/remote-relay-contract.mjs';
+import { admitRemoteRelayRequest, readRemoteRelayRequest } from '../services/remote-relay-inbound.mjs';
+import { RelayEventError, cleanSubscriberRelayId } from '../services/relay-event-service.mjs';
+
+const RELAY_EVENT_ERROR_STATUS = Object.freeze({
+  invalid: [400, REMOTE_RELAY_ERROR_CODES.invalidInput],
+  notFound: [404, REMOTE_RELAY_ERROR_CODES.notFound],
+  ownSession: [400, REMOTE_RELAY_ERROR_CODES.ownSession],
+  limit: [409, REMOTE_RELAY_ERROR_CODES.subscriptionLimit],
+  unavailable: [503, REMOTE_RELAY_ERROR_CODES.unsupported],
+});
+
+function sendRelayEventError(res, error, what) {
+  if (error instanceof RelayEventError) {
+    const [status, code] = RELAY_EVENT_ERROR_STATUS[error.code] || [400, REMOTE_RELAY_ERROR_CODES.invalidInput];
+    return res.status(status).json({ error: error.message, code, ...(error.extra && typeof error.extra === 'object' ? error.extra : {}) });
+  }
+  return res.status(500).json({ error: `${what} failed: ${String(error?.message || error)}`, code: REMOTE_RELAY_ERROR_CODES.internal });
+}
+
+function asObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+export function registerRelayEventRoutes(app, deps) {
+  const {
+    auth,
+    relayEventService = null,
+    remoteRelayInbound = null,
+  } = deps;
+
+  function refuseRemote(req, res) {
+    const request = readRemoteRelayRequest(req, remoteRelayInbound || {});
+    if (!request.remote) return false;
+    res.status(403).json({ error: 'Relay event subscriptions are managed by this relay\'s user and its own agents only.' });
+    return true;
+  }
+
+  // GET /api/relay-events/subscriptions — every active subscription.
+  app.get('/api/relay-events/subscriptions', auth, (req, res) => {
+    if (refuseRemote(req, res)) return;
+    if (!relayEventService?.isAvailable?.()) return res.json({ available: false, subscriptions: [] });
+    res.json({ available: true, subscriptions: relayEventService.listActive() });
+  });
+
+  /**
+   * The paired relay a request comes from: its stated relay id, or null
+   * after answering. Refused: this relay's own agents and the browser (they
+   * have the tool and the routes above), any request while the inbound
+   * switch is off, and one that names no relay.
+   */
+  function admitPairedRelay(req, res) {
+    const request = admitRemoteRelayRequest(req, res, remoteRelayInbound);
+    if (!request) return null;
+    if (!request.remote || request.local) {
+      res.status(403).json({
+        error: 'Only another relay subscribes to sessions here this way; this relay\'s own agents use the remote_relay tool.',
+        code: REMOTE_RELAY_ERROR_CODES.forbidden,
+      });
+      return null;
+    }
+    const subscriber = cleanSubscriberRelayId(request.origin?.relayId);
+    if (!subscriber) {
+      res.status(400).json({ error: 'The calling relay sent no relay id.', code: REMOTE_RELAY_ERROR_CODES.invalidInput });
+      return null;
+    }
+    if (!relayEventService?.isCrossRelayAvailable?.()) {
+      res.status(503).json({
+        error: 'Event subscriptions across relays are not available on this relay right now (see its server log).',
+        code: REMOTE_RELAY_ERROR_CODES.unsupported,
+      });
+      return null;
+    }
+    return subscriber;
+  }
+
+  // POST /api/relay-events/remote/subscribe — a paired relay's agent
+  // subscribes: `{ watcher: { conversationId, title }, subscriber: { name },
+  // scope, sessions, events, once, match, stalled_minutes, heartbeat_minutes,
+  // dry_run }`. A dry run checks everything and stores nothing.
+  app.post('/api/relay-events/remote/subscribe', auth, (req, res) => {
+    const subscriber = admitPairedRelay(req, res);
+    if (!subscriber) return;
+    const body = asObject(req.body);
+    const watcher = asObject(body.watcher);
+    try {
+      const subscription = relayEventService.subscribeServed({
+        subscriberRelayId: subscriber,
+        subscriberRelayName: String(asObject(body.subscriber).name || ''),
+        watcherId: String(watcher.conversationId || ''),
+        watcherTitle: String(watcher.title || ''),
+        scope: body.scope === 'all' ? 'all' : 'sessions',
+        sessionIds: Array.isArray(body.sessions) ? body.sessions.map((id) => String(id ?? '')) : [],
+        events: Array.isArray(body.events) ? body.events.map((type) => String(type ?? '')) : null,
+        once: body.once === true,
+        match: typeof body.match === 'string' ? body.match : '',
+        stalledMinutes: body.stalled_minutes ?? null,
+        heartbeatMinutes: body.heartbeat_minutes ?? null,
+        dryRun: body.dry_run === true,
+      });
+      res.json({ ok: true, ...(body.dry_run === true ? { dryRun: true } : {}), subscription });
+    } catch (error) {
+      sendRelayEventError(res, error, 'Subscribe');
+    }
+  });
+
+  // POST /api/relay-events/remote/pull — a paired relay fetches its events:
+  // `{ after, subscriptions: [{ id, watcher }], ended: [ids] }`.
+  app.post('/api/relay-events/remote/pull', auth, (req, res) => {
+    const subscriber = admitPairedRelay(req, res);
+    if (!subscriber) return;
+    const body = asObject(req.body);
+    try {
+      res.json({
+        ok: true,
+        ...relayEventService.pullServed({
+          subscriberRelayId: subscriber,
+          after: body.after,
+          subscriptions: Array.isArray(body.subscriptions) ? body.subscriptions : [],
+          ended: Array.isArray(body.ended) ? body.ended : [],
+        }),
+      });
+    } catch (error) {
+      sendRelayEventError(res, error, 'The event fetch');
+    }
+  });
+
+  // DELETE /api/relay-events/subscriptions/:id — the user's Unsubscribe.
+  app.delete('/api/relay-events/subscriptions/:id', auth, (req, res) => {
+    if (refuseRemote(req, res)) return;
+    if (!relayEventService?.isAvailable?.()) return res.status(503).json({ error: 'Relay event subscriptions are not available' });
+    try {
+      const ended = relayEventService.unsubscribe({ subscriptionId: String(req.params.id || '').trim(), reason: 'unsubscribed-by-user' });
+      res.json({ ok: true, ended });
+    } catch (error) {
+      if (error instanceof RelayEventError) {
+        return res.status(error.code === 'notFound' ? 404 : 400).json({ error: error.message, code: error.code });
+      }
+      res.status(500).json({ error: `Unsubscribe failed: ${String(error?.message || error)}` });
+    }
+  });
+}

package/server/routes/remote-relay-routes.mjs

@@ -8,6 +8,9 @@
 // No response carries a stored token: the registry's public views drop it, and
 // the pairing service's answers never contain one.
 
+import { REMOTE_RELAY_ERROR_CODES } from '../../shared/remote-relay-contract.mjs';
+import { readRemoteRelayRequest } from '../services/remote-relay-inbound.mjs';
+
 function sendResult(res, result, fallbackStatus = 400) {
   const { status, ...payload } = result || {};
   const code = Number.isInteger(status) ? status : (payload.ok === false ? fallbackStatus : 200);
@@ -26,6 +29,9 @@ export function registerRemoteRelayRoutes(app, deps) {
     // WP2's dispatcher: `{ dispatch({ conversationId, action, args, req }) →
     // Promise<{ status, body }>, inflight(conversationId) → number }`.
     dispatcher = null,
+    // The inbound facts (remote-relay-inbound.mjs): which requests come from
+    // another relay.
+    remoteRelayInbound = null,
   } = deps;
 
   // Static paths first: Express would otherwise hand them to /:id.
@@ -85,6 +91,15 @@ export function registerRemoteRelayRoutes(app, deps) {
   // POST /api/remote-relays/tool — every provider adapter's remote_relay call.
   app.post('/api/remote-relays/tool', auth, async (req, res) => {
     if (!dispatcher) return res.status(503).json({ error: 'Remote relay dispatcher unavailable' });
+    // The tool acts for one of this relay's conversations: another relay
+    // never calls it (it would act, or subscribe, for a conversation it does
+    // not host). Its agents reach this relay through the routes it calls.
+    if (readRemoteRelayRequest(req, remoteRelayInbound).remote) {
+      return res.status(403).json({
+        error: 'The remote_relay tool of this relay is for its own sessions; another relay cannot call it.',
+        code: REMOTE_RELAY_ERROR_CODES.forbidden,
+      });
+    }
     // A worker that gives up on the call (turn stopped, worker gone) closes
     // the request: withdraw its approval card and stop waiting for the reply.
     const controller = new AbortController();