@onride/agent 0.0.0-stage → 0.5.1-rc.0

package/dist/agent/adapter.js

@@ -0,0 +1,115 @@
+import { AgentError } from "./contracts.js";
+// Private, authenticated execution boundary. It holds Core S2S identity, never
+// signing secrets. Its responses are normalized; machine routes cannot confirm.
+export class BridgeAdapter {
+    url;
+    token;
+    constructor(url, token, privateHttpHost) {
+        this.url = url;
+        this.token = token;
+        const u = new URL(url);
+        const privateHttp = u.protocol === "http:" &&
+            u.hostname === privateHttpHost &&
+            /^[a-z0-9-]+\.railway\.internal$/.test(u.hostname);
+        if (u.protocol !== "https:" &&
+            !["127.0.0.1", "localhost"].includes(u.hostname) &&
+            !privateHttp)
+            throw new Error("Executor must use HTTPS, loopback or an explicitly configured private host");
+        if (u.username || u.password)
+            throw new Error("Executor URL must not contain credentials");
+        if (!token)
+            throw new Error("Missing executor service token");
+    }
+    async call(operation, input) {
+        let response;
+        try {
+            response = await fetch(new URL(`/internal/agent/${operation}`, this.url), {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${this.token}`,
+                },
+                body: JSON.stringify(input),
+                signal: AbortSignal.timeout(operation.startsWith("funding_") ? 90000 : 20000),
+                redirect: "error",
+            });
+        }
+        catch {
+            throw new AgentError("EXECUTOR_UNAVAILABLE", "Execution boundary did not respond; pending submissions remain unresolved.", true, 503);
+        }
+        const data = (await response.json());
+        if (!response.ok)
+            throw new AgentError(data.error?.code ?? "EXECUTOR_ERROR", data.error?.message ?? "Execution boundary rejected the request.", response.status >= 500, response.status);
+        return data;
+    }
+    depositOptions() {
+        return this.call("deposit_options", {});
+    }
+    depositAddress(user, input, portfolioId) {
+        return this.call("deposit_address", {
+            user_id: user,
+            input,
+            portfolio_id: portfolioId,
+        });
+    }
+    depositStatus(deposit, user) {
+        return this.call("deposit_status", { deposit, user_id: user });
+    }
+    fundingOperation(operation, user, input) {
+        return this.call(`funding_${operation}`, { user_id: user, ...input });
+    }
+    candidates(market) {
+        return this.call("candidates", market ? { market } : {});
+    }
+    sourceFills(trader, start, end) {
+        return this.call("source_fills", {
+            trader_id: trader.id,
+            market: trader.market,
+            start_at: start,
+            end_at: end,
+        });
+    }
+    notificationStatus(user) {
+        return this.call("notification_status", { user_id: user });
+    }
+    profile(id) {
+        return this.call("profile", { trader_id: id });
+    }
+    preflight(user, portfolio) {
+        return this.call("preflight", {
+            user_id: user,
+            portfolio,
+        });
+    }
+    bind(user, portfolio) {
+        return this.call("bind", { user_id: user, portfolio });
+    }
+    account(user, portfolio) {
+        return this.call("account", { user_id: user, portfolio });
+    }
+    source(trader) {
+        return this.call("source", { trader_id: trader.id });
+    }
+    submit(user, portfolio, execution) {
+        return this.call("submit", {
+            user_id: user,
+            portfolio,
+            execution,
+        });
+    }
+    execution(user, portfolio, execution) {
+        return this.call("execution", { user_id: user, portfolio, execution });
+    }
+    async fence(user, portfolio) {
+        await this.call("fence", { user_id: user, portfolio });
+    }
+    async release(user, portfolio) {
+        await this.call("release", { user_id: user, portfolio });
+    }
+    async cancelIncreasing(user, portfolio) {
+        await this.call("cancel_increasing", { user_id: user, portfolio });
+    }
+    async notify(user, event) {
+        await this.call("notify", { user_id: user, event });
+    }
+}

package/dist/agent/analytics.js

@@ -0,0 +1,174 @@
+import { D, cash, now, pnl, fresh, fingerprint, } from "./domain.js";
+export const configAt = (s) => ({
+    trader_id: s.trader.id,
+    amount_usdc: s.amount_usdc,
+    leverage_cap: s.leverage_cap,
+    ...(s.leverage_mode ? { leverage_mode: s.leverage_mode } : {}),
+    stop_loss_pct: s.stop_loss_pct,
+    copy_mode: s.copy_mode ?? "ride_recommends",
+    fixed_margin_usdc: s.fixed_margin_usdc ?? null,
+    proportional_multiplier: s.proportional_multiplier ?? 1,
+    loss_policy: s.loss_policy ?? "exit",
+    emergency_exit_pct: s.emergency_exit_pct ?? null,
+});
+export function recordConfigurations(p) {
+    const history = (p.configurations ??= []);
+    for (const s of p.sleeves)
+        history.push({ at: now(), copy_id: s.copy_id, config: configAt(s) });
+}
+export function recordPerformance(state, p) {
+    if (!p.snapshot || p.initial_equity == null)
+        return;
+    const stats = pnl(p);
+    const points = (state.performance ??= []);
+    const last = [...points].reverse().find((x) => x.portfolio_id === p.id);
+    const at = p.snapshot.observed_at;
+    // Store event changes as well as hourly marks; never recalculate past points.
+    const point = {
+        portfolio_id: p.id,
+        at,
+        revision: p.revision,
+        state: p.state,
+        account_value_usdc: p.snapshot.account_value_usdc,
+        external_flows_usdc: stats.external_flows_usdc,
+        net_profit_usdc: stats.net_usdc,
+        reconciliation: p.reconciliation,
+        ledger_version: fingerprint([
+            p.seen_fills.length,
+            p.seen_funding.length,
+            p.seen_flows.length,
+        ]),
+        sleeves: p.sleeves.map((s) => ({
+            copy_id: s.copy_id,
+            trader_id: s.trader.id,
+            handle: s.trader.handle,
+            state: s.state,
+            net_profit_usdc: stats.sleeves.find((x) => x.copy_id === s.copy_id)?.net_usdc ?? null,
+        })),
+    };
+    if (!last ||
+        (at >= last.at &&
+            (at - last.at >= 3600_000 ||
+                fingerprint([
+                    point.revision,
+                    point.state,
+                    point.reconciliation,
+                    point.ledger_version,
+                    point.sleeves.map((s) => s.state),
+                ]) !==
+                    fingerprint([
+                        last.revision,
+                        last.state,
+                        last.reconciliation,
+                        last.ledger_version,
+                        last.sleeves.map((s) => s.state),
+                    ]))))
+        points.push(point);
+}
+export function performanceView(state, p, period) {
+    const end = p.snapshot?.observed_at ?? now();
+    const start = period === "inception"
+        ? (p.ledger_started_at ?? p.created_at)
+        : end - (period === "daily" ? 1 : 7) * 86400_000;
+    const all = (state.performance ?? [])
+        .filter((x) => x.portfolio_id === p.id)
+        .sort((a, b) => a.at - b.at);
+    const baseline = [...all].reverse().find((x) => x.at <= start);
+    const points = all.filter((x) => x.at >= start && x.at <= end);
+    const last = [...all].reverse().find((x) => x.at <= end);
+    const continuous = baseline &&
+        last &&
+        last.at - end >= -3600_000 &&
+        baseline.at >= start - 3600_000 &&
+        [baseline, ...points].every((x, i, a) => x.net_profit_usdc != null &&
+            (i === 0 || x.at - a[i - 1].at <= 2 * 3600_000));
+    const covered = !!continuous && !!p.snapshot && fresh(p.snapshot.observed_at);
+    return {
+        portfolio_id: p.id,
+        period,
+        requested_window: { start_at: start, end_at: end },
+        observed_window: baseline && last ? { start_at: baseline.at, end_at: last.at } : null,
+        coverage: covered ? "complete" : "incomplete",
+        net_profit_usdc: covered
+            ? cash(D(last.net_profit_usdc).minus(baseline.net_profit_usdc))
+            : null,
+        inception_net_profit_usdc: pnl(p).net_usdc,
+        recent_fills: (p.receipts ?? [])
+            .filter((r) => r.fill.at >= start && r.fill.at < end)
+            .slice(-40)
+            .map((r) => ({
+            copy_id: r.copy_id,
+            trader: p.sleeves.find((s) => s.copy_id === r.copy_id)?.trader.handle ?? null,
+            at: r.fill.at,
+            asset: r.fill.key,
+            quantity: r.quantity,
+            price: r.fill.price,
+            fee_usdc: r.fee_usdc,
+            realized_usdc: r.realized_usdc,
+        })),
+        points: [
+            ...new Map(points.map((x) => [new Date(x.at).toISOString().slice(0, 10), x])).values(),
+        ].slice(-366),
+        series_interval: "daily_UTC",
+        full_snapshot_count: points.length,
+        series_truncated: new Set(points.map((x) => new Date(x.at).toISOString().slice(0, 10)))
+            .size > 366,
+        missing_reason: covered
+            ? null
+            : "Verified accounting snapshots do not cover the entire requested window.",
+    };
+}
+export function recordReceipt(p, fill, before) {
+    const receipts = (p.receipts ??= []);
+    for (const s of p.sleeves) {
+        const old = before.find((x) => x.copy_id === s.copy_id);
+        const quantity = D(s.lots[fill.key]?.quantity ?? 0).minus(old.lots[fill.key]?.quantity ?? 0);
+        if (quantity.isZero())
+            continue;
+        receipts.push({
+            copy_id: s.copy_id,
+            fill: structuredClone(fill),
+            quantity: quantity.toString(),
+            fee_usdc: D(s.lots[fill.key].fees)
+                .minus(old.lots[fill.key]?.fees ?? 0)
+                .toString(),
+            realized_usdc: D(s.lots[fill.key].realized)
+                .minus(old.lots[fill.key]?.realized ?? 0)
+                .toString(),
+            config: [...(p.configurations ?? [])]
+                .reverse()
+                .find((c) => c.copy_id === s.copy_id && c.at <= fill.at)?.config ??
+                null,
+        });
+    }
+}
+export function recordDecision(p, s, x, mark, target, reason) {
+    (p.decisions ??= []).push({
+        at: now(),
+        copy_id: s.copy_id,
+        key: x.key,
+        source_revision: x.source_revision,
+        source_quantity: x.raw_source_quantity ?? x.quantity,
+        target_quantity: target,
+        source_entry_price: x.source_entry_price,
+        follower_mark: mark,
+        reason,
+        config: configAt(s),
+    });
+}
+export function localDay(at, timezone) {
+    const parts = new Intl.DateTimeFormat("en-CA", {
+        timeZone: timezone,
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        hourCycle: "h23",
+    }).formatToParts(at);
+    const v = Object.fromEntries(parts.map((p) => [p.type, p.value]));
+    return {
+        day: `${v.year}-${v.month}-${v.day}`,
+        time: `${v.hour}:${v.minute}`,
+    };
+}

package/dist/agent/backend.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import "dotenv/config";
+import { VERSION } from "../version.js";
+import { z } from "zod";
+import { PgRepository, Cursor } from "./repository.js";
+import { BridgeAdapter } from "./adapter.js";
+import { AgentService } from "./service.js";
+import { AgentRunner } from "./runner.js";
+import { AgentError, failure, publicResult, TOOL_NAMES, mutationTools, stateTools, id, positiveMoney, output, } from "./contracts.js";
+import { createRideHttpApp, requestBodyErrorHandler, } from "../http_security.js";
+export async function validateCoreIdentity(token, graphqlUrl) {
+    const response = await fetch(graphqlUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token}`,
+        },
+        body: JSON.stringify({
+            query: "query AgentIdentity { copyTradeSummary { totalConfigs } me { id } }",
+        }),
+        signal: AbortSignal.timeout(12000),
+        redirect: "error",
+    });
+    const payload = (await response.json());
+    const user = payload.data?.me?.id;
+    if (!response.ok ||
+        payload.errors?.length ||
+        !payload.data?.copyTradeSummary ||
+        !user)
+        throw new AgentError("AUTH_REQUIRED", "A valid Ride session is required.", false, 401);
+    return user;
+}
+export function backendApp(service, identity, host = "127.0.0.1", readOnly = false) {
+    const app = createRideHttpApp(host);
+    app.get("/health", (_req, res) => res.json({
+        service: "ride-agent",
+        version: "3",
+        release: VERSION,
+        status: "ready",
+        read_only: readOnly,
+    }));
+    app.use(async (req, res, next) => {
+        try {
+            const header = req.headers.authorization;
+            if (!header?.startsWith("Bearer "))
+                throw new AgentError("AUTH_REQUIRED", "Ride authentication required.", false, 401);
+            res.locals.user = await identity(header.slice(7));
+            next();
+        }
+        catch (e) {
+            res.status(e instanceof AgentError ? e.httpStatus : 503).json(failure(e));
+        }
+    });
+    app.post("/agent/v1/:operation", async (req, res) => {
+        try {
+            const name = req.params.operation;
+            if (readOnly &&
+                (mutationTools.has(name) ||
+                    (stateTools.has(name) && name !== "recommend_traders") ||
+                    name === "proposal"))
+                throw new AgentError("READ_ONLY", "Trading is not enabled on this deployment.", false, 403);
+            if (name === "proposal") {
+                const arg = z.object({ proposal_id: id }).strict().parse(req.body);
+                res.json(publicResult(await service.proposal(res.locals.user, arg.proposal_id)));
+                return;
+            }
+            if (!TOOL_NAMES.includes(name))
+                throw new AgentError("NOT_FOUND", "Unknown operation.", false, 404);
+            res.json(publicResult(await service.tool(res.locals.user, name, req.body)));
+        }
+        catch (e) {
+            res.status(e instanceof AgentError ? e.httpStatus : 400).json(failure(e));
+        }
+    });
+    // Separate native Ride surface: MCP exposes none of these endpoints and its
+    // opaque access tokens do not pass Core JWT/session validation.
+    app.post("/agent/human/:operation", async (req, res) => {
+        try {
+            const user = res.locals.user;
+            if (readOnly &&
+                !["updates", "update", "portfolio"].includes(req.params.operation))
+                throw new AgentError("READ_ONLY", "Trading is not enabled on this deployment.", false, 403);
+            let value;
+            switch (req.params.operation) {
+                case "funding_prepare": {
+                    const a = z
+                        .object({ deposit_id: id, amount_usdc: positiveMoney })
+                        .strict()
+                        .parse(req.body);
+                    value = await service.funding.prepare(user, a.deposit_id, String(a.amount_usdc));
+                    break;
+                }
+                case "funding":
+                case "funding_activation_quote":
+                case "funding_status": {
+                    const a = z.object({ deposit_id: id }).strict().parse(req.body);
+                    value =
+                        req.params.operation === "funding"
+                            ? await service.funding.read(user, a.deposit_id)
+                            : req.params.operation === "funding_activation_quote"
+                                ? await service.funding.activationQuote(user, a.deposit_id)
+                                : await service.tool(user, "check_deposit_status", a);
+                    break;
+                }
+                case "funding_confirm":
+                case "funding_activate": {
+                    const a = z
+                        .object({
+                        deposit_id: id,
+                        preview_hash: z.string().regex(/^[a-f0-9]{64}$/),
+                        signature: z
+                            .string()
+                            .regex(/^0x[a-fA-F0-9]{130}$/)
+                            .optional(),
+                    })
+                        .strict()
+                        .parse(req.body);
+                    value =
+                        req.params.operation === "funding_confirm"
+                            ? await service.funding.confirm(user, a.deposit_id, a.preview_hash, a.signature)
+                            : await service.funding.activate(user, a.deposit_id, a.preview_hash, a.signature);
+                    break;
+                }
+                case "proposal": {
+                    const a = z.object({ proposal_id: id }).strict().parse(req.body);
+                    value = await service.proposal(user, a.proposal_id);
+                    break;
+                }
+                case "confirm": {
+                    const a = z
+                        .object({
+                        proposal_id: id,
+                        preview_hash: z.string().regex(/^[a-f0-9]{64}$/),
+                    })
+                        .strict()
+                        .parse(req.body);
+                    value = await service.confirm(user, a.proposal_id, a.preview_hash);
+                    break;
+                }
+                case "reject": {
+                    const a = z.object({ proposal_id: id }).strict().parse(req.body);
+                    value = await service.reject(user, a.proposal_id);
+                    break;
+                }
+                case "authorize": {
+                    const a = z
+                        .object({
+                        portfolio_id: id,
+                        total_usdc: positiveMoney,
+                        per_action_usdc: positiveMoney,
+                        daily_usdc: positiveMoney,
+                        expires_at: z.number().int().positive(),
+                        markets: z
+                            .array(z.enum(["perps", "prediction"]))
+                            .min(1)
+                            .max(2),
+                        assets: z
+                            .array(z.string().regex(/^[A-Z][A-Z0-9]{0,15}$/))
+                            .min(1)
+                            .max(20),
+                        leverage_cap: z.number().int().min(1).max(40),
+                    })
+                        .strict()
+                        .parse(req.body);
+                    value = await service.authorize(user, {
+                        ...a,
+                        total_usdc: String(a.total_usdc),
+                        per_action_usdc: String(a.per_action_usdc),
+                        daily_usdc: String(a.daily_usdc),
+                    });
+                    break;
+                }
+                case "revoke":
+                    value = await service.revoke(user);
+                    break;
+                case "updates":
+                    value = await service.tool(user, "get_updates", req.body);
+                    break;
+                case "update": {
+                    const a = z.object({ event_id: id }).strict().parse(req.body);
+                    value = await service.update(user, a.event_id);
+                    break;
+                }
+                case "portfolio":
+                    value = await service.tool(user, "get_portfolio", req.body);
+                    break;
+                default:
+                    throw new AgentError("NOT_FOUND", "Unknown human operation.", false, 404);
+            }
+            res
+                .set("Cache-Control", "no-store")
+                .json(req.params.operation.startsWith("funding")
+                ? output.parse(value)
+                : publicResult(value));
+        }
+        catch (e) {
+            res.status(e instanceof AgentError ? e.httpStatus : 400).json(failure(e));
+        }
+    });
+    app.use(requestBodyErrorHandler);
+    return app;
+}
+export async function startBackend() {
+    if (process.env.RIDE_AGENT_ENABLED !== "true")
+        throw new Error("Explicit Agent service activation is required");
+    const required = (key) => {
+        const v = process.env[key];
+        if (!v)
+            throw new Error(`${key} is required`);
+        return v;
+    };
+    const repository = new PgRepository(required("RIDE_AGENT_DATABASE_URL"));
+    await repository.migrate();
+    const service = new AgentService(repository, new BridgeAdapter(required("RIDE_AGENT_EXECUTOR_URL"), required("RIDE_AGENT_EXECUTOR_TOKEN"), process.env.RIDE_AGENT_PRIVATE_HTTP_HOST), required("PUBLIC_BASE_URL"), new Cursor(required("RIDE_AGENT_CURSOR_KEY")));
+    const app = backendApp(service, (token) => validateCoreIdentity(token, required("RIDE_GRAPHQL_URL")), process.env.HOST ?? "127.0.0.1", process.env.RIDE_AGENT_READ_ONLY === "true");
+    const controller = new AbortController(), runner = new AgentRunner(service);
+    const listener = app.listen(Number(process.env.PORT ?? 3344), process.env.HOST ?? "127.0.0.1");
+    process.once("SIGTERM", () => {
+        controller.abort();
+        listener.close();
+    });
+    process.once("SIGINT", () => {
+        controller.abort();
+        listener.close();
+    });
+    if (process.env.RIDE_AGENT_READ_ONLY === "true") {
+        await new Promise((resolve) => {
+            controller.signal.addEventListener("abort", () => resolve(), {
+                once: true,
+            });
+        });
+    }
+    else {
+        await runner.run(controller.signal);
+    }
+    await repository.close();
+}

package/dist/agent/card_hosts.js

@@ -0,0 +1,9 @@
+import { createHash } from "node:crypto";
+// MCP Apps defines this stable origin format for Claude. Use the same origin
+// in the resource metadata and in the trusted Ride frame's ancestor policy.
+export function claudeCardDomain(base) {
+    return `${createHash("sha256")
+        .update(new URL("/mcp", base).href)
+        .digest("hex")
+        .slice(0, 32)}.claudemcpcontent.com`;
+}