@pixelbyte-software/pixcode 1.54.10 → 1.54.11

package/server/middleware/rate-limiter.js

@@ -1,87 +1,87 @@
-import { securityLog, getClientIp } from '../utils/security-log.js';
-
-function createRateLimiter(options = {}) {
-    const {
-        windowMs = 15 * 60 * 1000,
-        max = 100,
-        keyGenerator = (req) => getClientIp(req),
-        message = 'Too many requests from this IP, please try again later.',
-        statusCode = 429,
-        skip = (_req) => false,
-    } = options;
-
-    const hits = new Map();
-
-    function cleanupExpired() {
-        const now = Date.now();
-        for (const [key, entry] of hits.entries()) {
-            if (entry.resetTime <= now) {
-                hits.delete(key);
-            }
-        }
-    }
-
-    const cleanupInterval = setInterval(cleanupExpired, windowMs);
-    cleanupInterval.unref();
-
-    return (req, res, next) => {
-        if (skip(req)) {
-            return next();
-        }
-
-        const key = keyGenerator(req);
-        const now = Date.now();
-
-        let entry = hits.get(key);
-        if (!entry || entry.resetTime <= now) {
-            entry = {
-                count: 0,
-                resetTime: now + windowMs,
-            };
-            hits.set(key, entry);
-        }
-
-        entry.count += 1;
-
-        res.setHeader('X-RateLimit-Limit', String(max));
-        res.setHeader('X-RateLimit-Remaining', String(Math.max(0, max - entry.count)));
-        res.setHeader('X-RateLimit-Reset', String(Math.ceil(entry.resetTime / 1000)));
-
-        if (entry.count > max) {
-            securityLog('rate_limit_exceeded', {
-                ip: getClientIp(req),
-                endpoint: req.path,
-                method: req.method,
-                userAgent: req.headers['user-agent'],
-            });
-            return res.status(statusCode).json({
-                success: false,
-                error: {
-                    code: 'RATE_LIMIT_EXCEEDED',
-                    message,
-                },
-            });
-        }
-
-        next();
-    };
-}
-
-export const authRateLimiter = createRateLimiter({
-    windowMs: 15 * 60 * 1000,
-    max: 10,
-    message: 'Too many authentication attempts. Please try again in 15 minutes.',
-});
-
-// API rate limiter: only limits state-changing operations (POST/PUT/DELETE/PATCH).
-// GET requests (polling, fetching sessions, file trees, update-state, etc.) are
-// exempt — the frontend polls several endpoints frequently and 120/min was
-// too low, causing false "rate limit" errors on active sessions.
-export const apiRateLimiter = createRateLimiter({
-    windowMs: 60 * 1000,
-    max: 300,
-    message: 'Too many API requests. Please slow down.',
-    skip: (req) => req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS',
-});
-
-export { createRateLimiter };
+import { securityLog, getClientIp } from '../utils/security-log.js';
+
+function createRateLimiter(options = {}) {
+    const {
+        windowMs = 15 * 60 * 1000,
+        max = 100,
+        keyGenerator = (req) => getClientIp(req),
+        message = 'Too many requests from this IP, please try again later.',
+        statusCode = 429,
+        skip = (_req) => false,
+    } = options;
+
+    const hits = new Map();
+
+    function cleanupExpired() {
+        const now = Date.now();
+        for (const [key, entry] of hits.entries()) {
+            if (entry.resetTime <= now) {
+                hits.delete(key);
+            }
+        }
+    }
+
+    const cleanupInterval = setInterval(cleanupExpired, windowMs);
+    cleanupInterval.unref();
+
+    return (req, res, next) => {
+        if (skip(req)) {
+            return next();
+        }
+
+        const key = keyGenerator(req);
+        const now = Date.now();
+
+        let entry = hits.get(key);
+        if (!entry || entry.resetTime <= now) {
+            entry = {
+                count: 0,
+                resetTime: now + windowMs,
+            };
+            hits.set(key, entry);
+        }
+
+        entry.count += 1;
+
+        res.setHeader('X-RateLimit-Limit', String(max));
+        res.setHeader('X-RateLimit-Remaining', String(Math.max(0, max - entry.count)));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(entry.resetTime / 1000)));
+
+        if (entry.count > max) {
+            securityLog('rate_limit_exceeded', {
+                ip: getClientIp(req),
+                endpoint: req.path,
+                method: req.method,
+                userAgent: req.headers['user-agent'],
+            });
+            return res.status(statusCode).json({
+                success: false,
+                error: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    message,
+                },
+            });
+        }
+
+        next();
+    };
+}
+
+export const authRateLimiter = createRateLimiter({
+    windowMs: 15 * 60 * 1000,
+    max: 10,
+    message: 'Too many authentication attempts. Please try again in 15 minutes.',
+});
+
+// API rate limiter: only limits state-changing operations (POST/PUT/DELETE/PATCH).
+// GET requests (polling, fetching sessions, file trees, update-state, etc.) are
+// exempt — the frontend polls several endpoints frequently and 120/min was
+// too low, causing false "rate limit" errors on active sessions.
+export const apiRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000,
+    max: 300,
+    message: 'Too many API requests. Please slow down.',
+    skip: (req) => req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS',
+});
+
+export { createRateLimiter };

package/server/modules/orchestration/a2a/adapter-registry.ts

@@ -1,108 +1,108 @@
-// server/modules/orchestration/a2a/adapter-registry.ts
-// In-process registry mapping adapter ids to AbstractA2AAdapter
-// instances. Resolution supports three id forms:
-//   - "claude-code"        explicit
-//   - "skill:<skillId>"    first REGISTERED adapter advertising that skill
-//                          (Map iteration is insertion-ordered per ES spec).
-//   - "auto"               first registered adapter (deterministic fallback
-//                          until smarter routing arrives in a later plan)
-
-import type { AbstractA2AAdapter } from '@/modules/orchestration/a2a/adapters/abstract-a2a.adapter.js';
-import type { AgentCard } from '@/modules/orchestration/a2a/types.js';
-
-interface ResolveAdapterOptions {
-  preferredAdapterId?: string;
-  preferredProvider?: string;
-  preferredSkillId?: string;
-}
-
-class AdapterRegistry {
-  // Map iteration order is insertion-ordered (ES spec); auto and skill: resolution depend on this.
-  private readonly byId = new Map<string, AbstractA2AAdapter>();
-
-  register(adapter: AbstractA2AAdapter): void {
-    if (this.byId.has(adapter.id)) {
-      throw new Error(`A2A adapter already registered: ${adapter.id}`);
-    }
-    this.byId.set(adapter.id, adapter);
-  }
-
-  get(id: string): AbstractA2AAdapter | undefined {
-    return this.byId.get(id);
-  }
-
-  resolve(idOrSelector: string, options: ResolveAdapterOptions = {}): AbstractA2AAdapter | undefined {
-    const normalizedSelector = idOrSelector.trim();
-    if (!normalizedSelector) {
-      return undefined;
-    }
-
-    if (normalizedSelector === 'auto') {
-      return this.pickPreferred(this.list(), options);
-    }
-
-    if (normalizedSelector.startsWith('skill:')) {
-      const skill = normalizedSelector.slice('skill:'.length);
-      const matches = this.list().filter((adapter) =>
-        adapter.agentCard.skills.some((s) => s.id === skill),
-      );
-      if (matches.length === 0) {
-        return undefined;
-      }
-      return this.pickPreferred(matches, {
-        ...options,
-        preferredSkillId: options.preferredSkillId ?? skill,
-      });
-    }
-
-    return this.byId.get(normalizedSelector);
-  }
-
-  list(): AbstractA2AAdapter[] {
-    return [...this.byId.values()];
-  }
-
-  agentCards(): AgentCard[] {
-    return this.list().map((a) => a.agentCard);
-  }
-
-  private pickPreferred(
-    adapters: AbstractA2AAdapter[],
-    options: ResolveAdapterOptions,
-  ): AbstractA2AAdapter | undefined {
-    const {
-      preferredAdapterId,
-      preferredProvider,
-      preferredSkillId,
-    } = options;
-
-    if (preferredAdapterId) {
-      const byAdapterId = adapters.find((adapter) => adapter.id === preferredAdapterId);
-      if (byAdapterId) {
-        return byAdapterId;
-      }
-    }
-
-    if (preferredProvider) {
-      const normalizedProvider = preferredProvider.trim().toLowerCase();
-      const byProvider = adapters.find((adapter) => adapter.id === normalizedProvider);
-      if (byProvider) {
-        return byProvider;
-      }
-    }
-
-    if (preferredSkillId) {
-      const bySkill = adapters.find((adapter) =>
-        adapter.agentCard.skills.some((skill) => skill.id === preferredSkillId),
-      );
-      if (bySkill) {
-        return bySkill;
-      }
-    }
-
-    return adapters[0];
-  }
-}
-
-export const adapterRegistry = new AdapterRegistry();
-export type { AdapterRegistry, ResolveAdapterOptions };
+// server/modules/orchestration/a2a/adapter-registry.ts
+// In-process registry mapping adapter ids to AbstractA2AAdapter
+// instances. Resolution supports three id forms:
+//   - "claude-code"        explicit
+//   - "skill:<skillId>"    first REGISTERED adapter advertising that skill
+//                          (Map iteration is insertion-ordered per ES spec).
+//   - "auto"               first registered adapter (deterministic fallback
+//                          until smarter routing arrives in a later plan)
+
+import type { AbstractA2AAdapter } from '@/modules/orchestration/a2a/adapters/abstract-a2a.adapter.js';
+import type { AgentCard } from '@/modules/orchestration/a2a/types.js';
+
+interface ResolveAdapterOptions {
+  preferredAdapterId?: string;
+  preferredProvider?: string;
+  preferredSkillId?: string;
+}
+
+class AdapterRegistry {
+  // Map iteration order is insertion-ordered (ES spec); auto and skill: resolution depend on this.
+  private readonly byId = new Map<string, AbstractA2AAdapter>();
+
+  register(adapter: AbstractA2AAdapter): void {
+    if (this.byId.has(adapter.id)) {
+      throw new Error(`A2A adapter already registered: ${adapter.id}`);
+    }
+    this.byId.set(adapter.id, adapter);
+  }
+
+  get(id: string): AbstractA2AAdapter | undefined {
+    return this.byId.get(id);
+  }
+
+  resolve(idOrSelector: string, options: ResolveAdapterOptions = {}): AbstractA2AAdapter | undefined {
+    const normalizedSelector = idOrSelector.trim();
+    if (!normalizedSelector) {
+      return undefined;
+    }
+
+    if (normalizedSelector === 'auto') {
+      return this.pickPreferred(this.list(), options);
+    }
+
+    if (normalizedSelector.startsWith('skill:')) {
+      const skill = normalizedSelector.slice('skill:'.length);
+      const matches = this.list().filter((adapter) =>
+        adapter.agentCard.skills.some((s) => s.id === skill),
+      );
+      if (matches.length === 0) {
+        return undefined;
+      }
+      return this.pickPreferred(matches, {
+        ...options,
+        preferredSkillId: options.preferredSkillId ?? skill,
+      });
+    }
+
+    return this.byId.get(normalizedSelector);
+  }
+
+  list(): AbstractA2AAdapter[] {
+    return [...this.byId.values()];
+  }
+
+  agentCards(): AgentCard[] {
+    return this.list().map((a) => a.agentCard);
+  }
+
+  private pickPreferred(
+    adapters: AbstractA2AAdapter[],
+    options: ResolveAdapterOptions,
+  ): AbstractA2AAdapter | undefined {
+    const {
+      preferredAdapterId,
+      preferredProvider,
+      preferredSkillId,
+    } = options;
+
+    if (preferredAdapterId) {
+      const byAdapterId = adapters.find((adapter) => adapter.id === preferredAdapterId);
+      if (byAdapterId) {
+        return byAdapterId;
+      }
+    }
+
+    if (preferredProvider) {
+      const normalizedProvider = preferredProvider.trim().toLowerCase();
+      const byProvider = adapters.find((adapter) => adapter.id === normalizedProvider);
+      if (byProvider) {
+        return byProvider;
+      }
+    }
+
+    if (preferredSkillId) {
+      const bySkill = adapters.find((adapter) =>
+        adapter.agentCard.skills.some((skill) => skill.id === preferredSkillId),
+      );
+      if (bySkill) {
+        return bySkill;
+      }
+    }
+
+    return adapters[0];
+  }
+}
+
+export const adapterRegistry = new AdapterRegistry();
+export type { AdapterRegistry, ResolveAdapterOptions };

package/server/modules/orchestration/a2a/adapters/abstract-a2a.adapter.ts

@@ -1,63 +1,63 @@
-// server/modules/orchestration/a2a/adapters/abstract-a2a.adapter.ts
-// Base class every CLI adapter extends. Adapters wrap the
-// existing per-CLI runtime files (claude-sdk.js, openai-codex.js, ...)
-// and translate between A2A messages and the CLI's native I/O.
-
-import { a2aBus } from '@/modules/orchestration/a2a/bus.js';
-import type {
-  AgentCard,
-  Artifact,
-  Message,
-  Task,
-  TaskError,
-  TaskState,
-} from '@/modules/orchestration/a2a/types.js';
-import type { WorkspaceHandle } from '@/modules/orchestration/workspace/types.js';
-import type {
-  PermissionPolicy,
-  PermissionPolicyContext,
-} from '@/modules/orchestration/security/permission-policy.js';
-
-export interface AdapterContext {
-  /** Isolated execution workspace for the task. */
-  workspace: WorkspaceHandle;
-  /** Compatibility alias while legacy adapters still accept cwd directly. */
-  cwd: string;
-  /** pixcode permission mode passed through to the underlying CLI. */
-  permissionMode?: string;
-  /** Provider-independent permission/sandbox policy evaluated before runtime tool use. */
-  permissionPolicy?: PermissionPolicy;
-  /** Run context preserved when the policy needs a human approval. */
-  permissionPolicyContext?: PermissionPolicyContext;
-  /** Provider model selected by the user in Pixcode. */
-  model?: string;
-  /** Provider-specific tool / permission settings from Pixcode Settings. */
-  toolsSettings?: Record<string, unknown>;
-  /** Optional parent task id when this adapter is invoked inside a workflow. */
-  parentTaskId?: string;
-}
-
-export interface TaskHandle {
-  cancel(): Promise<void>;
-  finished: Promise<void>;
-}
-
-export abstract class AbstractA2AAdapter {
-  abstract readonly id: string;
-  abstract readonly agentCard: AgentCard;
-
-  abstract submitTask(task: Task, ctx: AdapterContext): Promise<TaskHandle>;
-  abstract cancelTask(taskId: string): Promise<void>;
-
-  protected emitState(taskId: string, state: TaskState, error?: TaskError): void {
-    a2aBus.publish({ kind: 'task-state', taskId, state, error });
-  }
-
-  protected emitMessage(taskId: string, message: Message): void {
-    a2aBus.publish({ kind: 'message', taskId, message });
-  }
-
-  protected emitArtifact(taskId: string, artifact: Artifact): void {
-    a2aBus.publish({ kind: 'artifact', taskId, artifact });
-  }
-}
+// server/modules/orchestration/a2a/adapters/abstract-a2a.adapter.ts
+// Base class every CLI adapter extends. Adapters wrap the
+// existing per-CLI runtime files (claude-sdk.js, openai-codex.js, ...)
+// and translate between A2A messages and the CLI's native I/O.
+
+import { a2aBus } from '@/modules/orchestration/a2a/bus.js';
+import type {
+  AgentCard,
+  Artifact,
+  Message,
+  Task,
+  TaskError,
+  TaskState,
+} from '@/modules/orchestration/a2a/types.js';
+import type { WorkspaceHandle } from '@/modules/orchestration/workspace/types.js';
+import type {
+  PermissionPolicy,
+  PermissionPolicyContext,
+} from '@/modules/orchestration/security/permission-policy.js';
+
+export interface AdapterContext {
+  /** Isolated execution workspace for the task. */
+  workspace: WorkspaceHandle;
+  /** Compatibility alias while legacy adapters still accept cwd directly. */
+  cwd: string;
+  /** pixcode permission mode passed through to the underlying CLI. */
+  permissionMode?: string;
+  /** Provider-independent permission/sandbox policy evaluated before runtime tool use. */
+  permissionPolicy?: PermissionPolicy;
+  /** Run context preserved when the policy needs a human approval. */
+  permissionPolicyContext?: PermissionPolicyContext;
+  /** Provider model selected by the user in Pixcode. */
+  model?: string;
+  /** Provider-specific tool / permission settings from Pixcode Settings. */
+  toolsSettings?: Record<string, unknown>;
+  /** Optional parent task id when this adapter is invoked inside a workflow. */
+  parentTaskId?: string;
+}
+
+export interface TaskHandle {
+  cancel(): Promise<void>;
+  finished: Promise<void>;
+}
+
+export abstract class AbstractA2AAdapter {
+  abstract readonly id: string;
+  abstract readonly agentCard: AgentCard;
+
+  abstract submitTask(task: Task, ctx: AdapterContext): Promise<TaskHandle>;
+  abstract cancelTask(taskId: string): Promise<void>;
+
+  protected emitState(taskId: string, state: TaskState, error?: TaskError): void {
+    a2aBus.publish({ kind: 'task-state', taskId, state, error });
+  }
+
+  protected emitMessage(taskId: string, message: Message): void {
+    a2aBus.publish({ kind: 'message', taskId, message });
+  }
+
+  protected emitArtifact(taskId: string, artifact: Artifact): void {
+    a2aBus.publish({ kind: 'artifact', taskId, artifact });
+  }
+}