@ossy/platform 3.18.0 → 3.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.18.0",
+  "version": "3.20.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -30,7 +30,8 @@
     "./verify-sign-in-session": "./src/verify-sign-in-session.js",
     "./storage-keys": "./src/storage/storage-keys.js",
     "./mcp": "./src/mcp/mount-platform-mcp.js",
-    "./metering": "./src/metering/index.js"
+    "./metering": "./src/metering/index.js",
+    "./vector/vector-store": "./src/vector/vector-store.js"
   },
   "scripts": {
     "start": "PORT=3003 node -e \"import('./src/server.js').then(m => m.startServer())\"",
@@ -47,17 +48,17 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/event-store": "^3.18.0",
+    "@ossy/event-store": "^3.20.0",
     "@ossy/locale": "^3.4.0",
-    "@ossy/manifest": "^3.18.0",
+    "@ossy/manifest": "^3.20.0",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
     "@ossy/router": "^3.0.9",
-    "@ossy/schema": "^3.18.0",
-    "@ossy/sdk": "^3.18.0",
+    "@ossy/schema": "^3.20.0",
+    "@ossy/sdk": "^3.20.0",
     "@ossy/tokens": "^3.11.1",
-    "@ossy/users": "^3.18.0",
-    "@ossy/workspaces": "^3.18.0",
+    "@ossy/users": "^3.20.0",
+    "@ossy/workspaces": "^3.20.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -78,5 +79,5 @@
     "Dockerfile",
     "docker-healthcheck.js"
   ],
-  "gitHead": "8ceef98795a01c3b3486034db1d3b72b4350ccf1"
+  "gitHead": "edab6a966f41c07a68bdd86f3864cc2ad02e3406"
 }

package/src/audit/task-run-list.aggregate.js

@@ -55,6 +55,7 @@ export class TaskRunListProjection {
         startedAt: event.created,
         completedAt: event.created,
         durationMs: event.payload.durationMs,
+        triggeredBy: event.payload.triggeredBy ?? null,
         ...(event.payload.inputs ? { inputs: event.payload.inputs } : {}),
       })
       return { workspaceId, runs: runs.slice(0, 200) }
@@ -68,6 +69,7 @@ export class TaskRunListProjection {
       durationMs: event.payload.durationMs,
       error: event.event === 'Failed' ? event.payload.error : undefined,
       resultSummary: event.event === 'Completed' ? event.payload.resultSummary : undefined,
+      triggeredBy: runs[idx].triggeredBy ?? event.payload.triggeredBy ?? null,
       ...(event.payload.inputs ? { inputs: event.payload.inputs } : {}),
     }
 

package/src/audit/task-run-service.js

@@ -108,6 +108,7 @@ export const TaskRunService = {
         durationMs,
         resultSummary: summarizeResult(result),
         inputs: summarizeInputs(context.inputs),
+        triggeredBy,
       })
       recordTaskMetrics(taskId, durationMs)
       const usage = extractUsage(result)
@@ -136,6 +137,7 @@ export const TaskRunService = {
         durationMs,
         error: summarizeError(error),
         inputs: summarizeInputs(context.inputs),
+        triggeredBy,
       })
       recordTaskMetrics(taskId, durationMs)
       await MeteringService.record({
@@ -199,7 +201,7 @@ export const TaskRunService = {
     }
   },
 
-  async _appendCompleted ({ runId, taskId, workspaceId, actorId, durationMs, resultSummary, inputs }) {
+  async _appendCompleted ({ runId, taskId, workspaceId, actorId, durationMs, resultSummary, inputs, triggeredBy }) {
     try {
       await Aggregate.Of(TaskRun, runId)
         .then(Aggregate.Add({
@@ -209,6 +211,7 @@ export const TaskRunService = {
             durationMs,
             resultSummary,
             ...(inputs ? { inputs } : {}),
+            ...(triggeredBy ? { triggeredBy } : {}),
             ...taskRunScopePayload({ taskId, workspaceId }),
           },
         }))
@@ -217,7 +220,7 @@ export const TaskRunService = {
     }
   },
 
-  async _appendFailed ({ runId, taskId, workspaceId, actorId, durationMs, error, inputs }) {
+  async _appendFailed ({ runId, taskId, workspaceId, actorId, durationMs, error, inputs, triggeredBy }) {
     try {
       await Aggregate.Of(TaskRun, runId)
         .then(Aggregate.Add({
@@ -227,6 +230,7 @@ export const TaskRunService = {
             durationMs,
             error,
             ...(inputs ? { inputs } : {}),
+            ...(triggeredBy ? { triggeredBy } : {}),
             ...taskRunScopePayload({ taskId, workspaceId }),
           },
         }))

package/src/audit/task-run.aggregate.js

@@ -20,7 +20,7 @@ export class TaskRun {
             moduleId: event.payload.moduleId,
             status: 'in progress',
             trigger: event.payload.trigger,
-            triggeredBy: event.payload.triggeredBy ?? {},
+            triggeredBy: event.payload.triggeredBy ?? null,
             actionInvocationId: event.payload.actionInvocationId ?? null,
             actorId: event.payload.actorId ?? event.createdBy ?? null,
             workspaceId: event.payload.belongsTo ?? null,
@@ -36,6 +36,7 @@ export class TaskRun {
             completedAt: event.created,
             durationMs: event.payload.durationMs,
             resultSummary: event.payload.resultSummary ?? null,
+            triggeredBy: run.triggeredBy ?? event.payload.triggeredBy ?? null,
             ...(event.payload.inputs ? { inputs: event.payload.inputs } : {}),
           }
 
@@ -46,6 +47,7 @@ export class TaskRun {
             completedAt: event.created,
             durationMs: event.payload.durationMs,
             error: event.payload.error ?? null,
+            triggeredBy: run.triggeredBy ?? event.payload.triggeredBy ?? null,
             ...(event.payload.inputs ? { inputs: event.payload.inputs } : {}),
           }
 

package/src/mcp/mount-ossy-mcp.js

@@ -54,19 +54,24 @@ export function mountOssyMcp ({ app, capabilities, invokeAction, requireAuth, cu
 
   app.post(path, handleMcpPost)
 
-  app.get(path, (_req, res) => {
-    res.status(405).json({
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Method not allowed.' },
-      id: null,
+  // GET /mcp — Streamable HTTP clients (e.g. Cursor) open this for the
+  // server→client SSE channel after initialize. We don't send server-initiated
+  // messages, so keep the stream idle until the client closes it.
+  // Returning 405 here blocks tool discovery entirely.
+  app.get(path, (req, res) => {
+    if (requireAuth && !requireAuth(req, res)) return
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive',
     })
+    res.write('\n')
+    req.on('close', () => res.end())
   })
 
-  app.delete(path, (_req, res) => {
-    res.status(405).json({
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Method not allowed.' },
-      id: null,
-    })
+  // DELETE /mcp — session teardown; stateless server has nothing to clean up.
+  app.delete(path, (req, res) => {
+    if (requireAuth && !requireAuth(req, res)) return
+    res.status(200).end()
   })
 }

package/src/mcp/mount-ossy-mcp.spec.js

@@ -0,0 +1,81 @@
+import { afterEach, describe, expect, it } from '@jest/globals'
+import express from 'express'
+import { mountOssyMcp } from './mount-ossy-mcp.js'
+
+function mountTestApp () {
+  const app = express()
+  app.use(express.json({ type: ['application/json', 'application/*+json'] }))
+  mountOssyMcp({
+    app,
+    capabilities: { tools: [], tasks: [], graph: { edges: [] } },
+    invokeAction: async () => ({ ok: true }),
+  })
+  return app
+}
+
+async function listen (app) {
+  const server = await new Promise((resolve) => {
+    const s = app.listen(0, '127.0.0.1', () => resolve(s))
+  })
+  return {
+    server,
+    baseUrl: `http://127.0.0.1:${server.address().port}`,
+  }
+}
+
+describe('mountOssyMcp', () => {
+  let server
+
+  afterEach(async () => {
+    if (server) {
+      await new Promise((resolve) => server.close(resolve))
+      server = undefined
+    }
+  })
+
+  it('GET /mcp returns 200 text/event-stream (not 405)', async () => {
+    ;({ server, baseUrl } = await listen(mountTestApp()))
+
+    const controller = new AbortController()
+    const res = await fetch(`${baseUrl}/mcp`, {
+      method: 'GET',
+      headers: { accept: 'text/event-stream' },
+      signal: controller.signal,
+    })
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('content-type')).toMatch(/text\/event-stream/)
+    controller.abort()
+  })
+
+  it('DELETE /mcp returns 200', async () => {
+    ;({ server, baseUrl } = await listen(mountTestApp()))
+
+    const res = await fetch(`${baseUrl}/mcp`, { method: 'DELETE' })
+    expect(res.status).toBe(200)
+  })
+
+  it('POST /mcp initialize returns 200', async () => {
+    ;({ server, baseUrl } = await listen(mountTestApp()))
+
+    const res = await fetch(`${baseUrl}/mcp`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: '2025-03-26',
+          capabilities: {},
+          clientInfo: { name: 'test', version: '0.0.0' },
+        },
+      }),
+    })
+
+    expect(res.status).toBe(200)
+  })
+})

package/src/server.js

@@ -8,6 +8,7 @@ import cookieParser from 'cookie-parser'
 import { ProxyInternal } from './proxy-internal.js'
 import { SDK, resolveActionId } from '@ossy/sdk'
 import { AggregateRebuild, ensureEventStoreIndexes, Mongo, resolveMongoUrl } from '@ossy/event-store'
+import { ensureEmbeddingIndexes } from './vector/vector-store.js'
 import { TaskService } from './tasks/task-service.js'
 import { ChangeStream } from './tasks/change-stream.js'
 import { buildManifestSummary } from '@ossy/manifest/build-manifest-summary'
@@ -300,6 +301,9 @@ export async function startServer (options = {}) {
     await ensureEventStoreIndexes().catch((err) => {
       log.error('Failed to ensure MongoDB indexes — aggregate reads may be very slow', undefined, err)
     })
+    ensureEmbeddingIndexes().catch((err) => {
+      log.error('Failed to ensure vector embedding indexes', undefined, err)
+    })
     ChangeStream.start(resolveMongoUrl(process.env.DB_URL))
   }
 
@@ -384,6 +388,20 @@ export async function startServer (options = {}) {
 
     const payload = req.body?.payload ?? {}
 
+    // Fall back to reading the workspace from the session cookie when the
+    // client did not send the workspaceId header (e.g. SDK workspaceId was
+    // not initialised from SSR props).
+    if (!req.workspaceId) {
+      const cookieWorkspaceId = readWorkspaceIdFromCookies(req)
+      if (cookieWorkspaceId) req.workspaceId = cookieWorkspaceId
+    }
+    // Last resort: accept workspaceId from the request payload itself.
+    // This is no less secure than a header — actual workspace membership is
+    // enforced inside the action handler.
+    if (!req.workspaceId && typeof payload.workspaceId === 'string' && payload.workspaceId) {
+      req.workspaceId = payload.workspaceId
+    }
+
     const action = ActionService.get(actionId)
     if (!action) return res.status(404).json({ error: 'Action not found' })
 

package/src/storage/s3-storage.client.js

@@ -83,6 +83,20 @@ export function createS3StorageClient ({
       return s3Client.send(new HeadObjectCommand({ Bucket: bucket, Key: toS3Key(normalizeLogicalKey({ Key })) }))
     },
 
+    async save (key, body, { ContentType } = {}) {
+      const logicalKey = normalizeLogicalKey(key)
+      const Key = toS3Key(logicalKey)
+      const s3Client = createAwsClient()
+      const Body = Buffer.isBuffer(body) ? body : Buffer.from(body)
+      log.info('[S3Storage][save] Putting object', { key: logicalKey, bytes: Body.length })
+      await s3Client.send(new PutObjectCommand({
+        Bucket: bucket,
+        Key,
+        Body,
+        ...(ContentType ? { ContentType } : {}),
+      }))
+    },
+
     async load (keyOrShape) {
       const Key = toS3Key(normalizeLogicalKey(keyOrShape))
       const s3Client = createAwsClient()

package/src/storage/s3-storage.client.spec.js

@@ -0,0 +1,72 @@
+import { describe, expect, it, jest, beforeEach } from '@jest/globals'
+
+const send = jest.fn()
+
+jest.unstable_mockModule('@aws-sdk/client-s3', () => ({
+  S3: jest.fn().mockImplementation(() => ({ send })),
+  PutObjectCommand: jest.fn().mockImplementation((input) => ({ input, _type: 'PutObject' })),
+  GetObjectCommand: jest.fn().mockImplementation((input) => ({ input, _type: 'GetObject' })),
+  HeadObjectCommand: jest.fn().mockImplementation((input) => ({ input, _type: 'HeadObject' })),
+}))
+
+jest.unstable_mockModule('@aws-sdk/s3-request-presigner', () => ({
+  S3RequestPresigner: jest.fn(),
+}))
+
+jest.unstable_mockModule('@aws-sdk/util-create-request', () => ({
+  createRequest: jest.fn(),
+}))
+
+jest.unstable_mockModule('@aws-sdk/util-format-url', () => ({
+  formatUrl: jest.fn(),
+}))
+
+const { createS3StorageClient } = await import('./s3-storage.client.js')
+const { PutObjectCommand } = await import('@aws-sdk/client-s3')
+
+describe('createS3StorageClient.save', () => {
+  beforeEach(() => {
+    send.mockReset()
+    send.mockResolvedValue({})
+    PutObjectCommand.mockClear()
+  })
+
+  it('exposes save and puts objects under the media/ prefix', async () => {
+    const client = createS3StorageClient({
+      bucket: 'media-bucket',
+      accessKeyId: 'ak',
+      secretAccessKey: 'sk',
+    })
+
+    expect(typeof client.save).toBe('function')
+
+    const body = Buffer.from('{"ok":true}')
+    await client.save('abc123:task-extract-colors-palette', body, {
+      ContentType: 'application/json',
+    })
+
+    expect(PutObjectCommand).toHaveBeenCalledWith({
+      Bucket: 'media-bucket',
+      Key: 'media/abc123:task-extract-colors-palette',
+      Body: body,
+      ContentType: 'application/json',
+    })
+    expect(send).toHaveBeenCalledTimes(1)
+  })
+
+  it('accepts string bodies without ContentType', async () => {
+    const client = createS3StorageClient({
+      bucket: 'media-bucket',
+      accessKeyId: 'ak',
+      secretAccessKey: 'sk',
+    })
+
+    await client.save('file-id', 'hello')
+
+    expect(PutObjectCommand).toHaveBeenCalledWith({
+      Bucket: 'media-bucket',
+      Key: 'media/file-id',
+      Body: Buffer.from('hello'),
+    })
+  })
+})

package/src/tasks/cron.js

@@ -76,10 +76,15 @@ export function matchesCron(expression, date = new Date()) {
   const month  = date.getMonth() + 1     // 1–12
   const dow    = date.getDay()           // 0–6 (0=Sunday)
 
+  // Special: L in dom field means last day of the month
+  const domMatches = domF === 'L'
+    ? dom === new Date(date.getFullYear(), date.getMonth() + 1, 0).getDate()
+    : matchField(domF, dom, 1, 31)
+
   return (
     matchField(minuteF, minute, 0, 59) &&
     matchField(hourF,   hour,   0, 23) &&
-    matchField(domF,    dom,    1, 31) &&
+    domMatches &&
     matchField(monthF,  month,  1, 12) &&
     matchField(dowF,    dow,    0, 6)
   )

package/src/tasks/task-service.js

@@ -221,9 +221,12 @@ export class TaskService {
     }
 
     const entry = { metadata, handler }
-    TaskService._tasks.push(entry)
-    if (TaskService._tasksById.has(metadata.id)) {
+    const existingIdx = TaskService._tasks.findIndex((t) => t.metadata.id === metadata.id)
+    if (existingIdx >= 0) {
       _serviceLog.warn(`Task "${metadata.id}" already registered — overwriting`)
+      TaskService._tasks[existingIdx] = entry
+    } else {
+      TaskService._tasks.push(entry)
     }
     TaskService._tasksById.set(metadata.id, entry)
     _serviceLog.info(
@@ -271,8 +274,9 @@ export class TaskService {
         context: invokeContext,
         trigger: 'invoke',
         triggeredBy: {
-          channel: context.req ? undefined : 'api',
+          ...(context.req ? {} : { channel: 'api' }),
           actionInvocationId: context.actionInvocationId ?? null,
+          ...(context.inputs?.resourceId ? { resourceId: context.inputs.resourceId } : {}),
         },
         executionEnv: 'ossy_server',
         audit,

package/src/tasks/task-service.spec.js

@@ -253,6 +253,36 @@ describe('TaskRunList projection', () => {
     expect(state.runs[0].inputs).toEqual({ model: 'google/gemini-2.5-flash-lite' })
   })
 
+  it('keeps triggeredBy when Failed arrives without a prior Started in the list', () => {
+    let state = TaskRunListProjection.initialState('ws1')
+    state = TaskRunListProjection.Apply({
+      resourceId: 'run-orphan',
+      type: '@ossy/platform/schema/task-run',
+      event: 'Failed',
+      created: 3000,
+      payload: {
+        durationMs: 800,
+        error: { message: 'storage backend missing method "save"' },
+        belongsTo: 'ws1',
+        taskId: '@ossy/media-tasks/tasks/resize-common-web',
+        moduleId: 'media-tasks',
+        triggeredBy: {
+          resourceId: 'file-xyz',
+          type: '@ossy/platform/schema/file',
+          event: 'Created',
+        },
+      },
+    }, state)
+
+    expect(state.runs).toHaveLength(1)
+    expect(state.runs[0].status).toBe('failed')
+    expect(state.runs[0].triggeredBy).toEqual({
+      resourceId: 'file-xyz',
+      type: '@ossy/platform/schema/file',
+      event: 'Created',
+    })
+  })
+
   it('scopes Completed/Failed from payload.belongsTo (changestream dispatch)', () => {
     expect(TaskRunListProjection.scopeFromEvent({
       payload: { durationMs: 10 },

package/src/vector/vector-store.js

@@ -0,0 +1,176 @@
+/**
+ * Vector embedding store backed by MongoDB.
+ *
+ * Collection: `resource_embeddings`
+ * Schema: { resourceId, workspaceId, model, dimensions, vector, textSource, textLength, updatedAt }
+ *
+ * Search strategy:
+ * - If Atlas Vector Search index `resource_embedding_vector` is present → $vectorSearch
+ * - Otherwise → in-memory cosine similarity (works fine for <10k resources per workspace)
+ *
+ * Atlas Vector Search index definition (create via Atlas UI or Admin API):
+ * ```json
+ * {
+ *   "mappings": {
+ *     "dynamic": false,
+ *     "fields": {
+ *       "vector": { "type": "knnVector", "dimensions": 1536, "similarity": "cosine" }
+ *     }
+ *   }
+ * }
+ * ```
+ */
+
+import { createLogger } from '@ossy/observability'
+import { Mongo } from '@ossy/event-store'
+
+const log = createLogger('resources')
+
+const COLLECTION = 'resource_embeddings'
+const ATLAS_INDEX = 'resource_embedding_vector'
+
+/**
+ * Cosine similarity between two equal-length float arrays.
+ *
+ * @param {number[]} a
+ * @param {number[]} b
+ * @returns {number}
+ */
+export function cosineSimilarity (a, b) {
+  let dot = 0
+  let magA = 0
+  let magB = 0
+  for (let i = 0; i < a.length; i++) {
+    dot += a[i] * b[i]
+    magA += a[i] * a[i]
+    magB += b[i] * b[i]
+  }
+  const denom = Math.sqrt(magA) * Math.sqrt(magB)
+  return denom === 0 ? 0 : dot / denom
+}
+
+/**
+ * @returns {import('mongodb').Collection}
+ */
+function col () {
+  return Mongo.db.collection(COLLECTION)
+}
+
+/**
+ * Upsert a resource embedding.
+ *
+ * @param {{
+ *   resourceId: string,
+ *   workspaceId: string,
+ *   model: string,
+ *   dimensions: number,
+ *   vector: number[],
+ *   textSource: string,
+ *   textLength: number,
+ * }} doc
+ */
+export async function upsertEmbedding (doc) {
+  await col().updateOne(
+    { resourceId: doc.resourceId },
+    {
+      $set: {
+        ...doc,
+        updatedAt: new Date(),
+      },
+    },
+    { upsert: true },
+  )
+}
+
+/**
+ * Delete the embedding for a resource (e.g. when the resource is removed).
+ *
+ * @param {string} resourceId
+ */
+export async function deleteEmbedding (resourceId) {
+  await col().deleteOne({ resourceId })
+}
+
+/**
+ * Semantic search within a workspace using cosine similarity.
+ * Tries Atlas $vectorSearch first; falls back to in-memory similarity.
+ *
+ * @param {{
+ *   workspaceId: string,
+ *   queryVector: number[],
+ *   limit?: number,
+ *   threshold?: number,
+ * }} opts
+ * @returns {Promise<Array<{ resourceId: string, score: number }>>}
+ */
+export async function searchEmbeddings ({ workspaceId, queryVector, limit = 20, threshold = 0 }) {
+  // Try Atlas Vector Search (requires index on Atlas M10+).
+  try {
+    const pipeline = [
+      {
+        $vectorSearch: {
+          index: ATLAS_INDEX,
+          path: 'vector',
+          queryVector,
+          numCandidates: limit * 10,
+          limit,
+          filter: { workspaceId },
+        },
+      },
+      {
+        $project: {
+          _id: 0,
+          resourceId: 1,
+          score: { $meta: 'vectorSearchScore' },
+        },
+      },
+    ]
+    const results = await col().aggregate(pipeline).toArray()
+    if (results.length > 0) {
+      return results.filter((r) => r.score >= threshold)
+    }
+  } catch {
+    // Atlas Vector Search not available — fall through to cosine similarity.
+  }
+
+  // In-memory cosine similarity fallback.
+  log.debug('[VectorStore] Atlas $vectorSearch unavailable — using in-memory cosine similarity')
+  const docs = await col()
+    .find({ workspaceId })
+    .project({ resourceId: 1, vector: 1 })
+    .toArray()
+
+  return docs
+    .map((doc) => ({
+      resourceId: doc.resourceId,
+      score: cosineSimilarity(queryVector, doc.vector),
+    }))
+    .filter((r) => r.score >= threshold)
+    .sort((a, b) => b.score - a.score)
+    .slice(0, limit)
+}
+
+/**
+ * Load all embeddings for a workspace (for clustering).
+ *
+ * @param {string} workspaceId
+ * @returns {Promise<Array<{ resourceId: string, vector: number[] }>>}
+ */
+export async function loadWorkspaceEmbeddings (workspaceId) {
+  return col()
+    .find({ workspaceId })
+    .project({ resourceId: 1, vector: 1, _id: 0 })
+    .toArray()
+}
+
+/**
+ * Ensure MongoDB indexes for the resource_embeddings collection.
+ * Call once at server startup alongside ensureEventStoreIndexes().
+ */
+export async function ensureEmbeddingIndexes () {
+  const c = col()
+  await c.createIndex({ resourceId: 1 }, { name: 'resourceId', unique: true, background: true })
+  await c.createIndex({ workspaceId: 1 }, { name: 'workspaceId', background: true })
+  await c.createIndex({ workspaceId: 1, updatedAt: -1 }, { name: 'workspaceId_updatedAt', background: true })
+  log.info('[VectorStore] resource_embeddings indexes ensured')
+}