@roj-ai/sdk 0.0.2

package/src/transport/http/routes/files.ts

@@ -0,0 +1,274 @@
+/**
+ * File Proxy Routes
+ *
+ * Serves session files (e.g. screenshots from tools) via HTTP.
+ * Used by the debug UI to display images from LLM call logs.
+ */
+
+import { Hono } from 'hono'
+import { extname, resolve } from 'node:path'
+import { SessionId } from '~/core/sessions/schema.js'
+import { type AppContext, type AppEnv, getServices } from '../app.js'
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+/** Known MIME types for specific extensions. */
+const MIME_TYPES: Record<string, string> = {
+	// Images
+	'.jpg': 'image/jpeg',
+	'.jpeg': 'image/jpeg',
+	'.png': 'image/png',
+	'.gif': 'image/gif',
+	'.webp': 'image/webp',
+	'.svg': 'image/svg+xml',
+	'.ico': 'image/x-icon',
+	'.bmp': 'image/bmp',
+	'.avif': 'image/avif',
+	// Video
+	'.mp4': 'video/mp4',
+	'.webm': 'video/webm',
+	'.mov': 'video/quicktime',
+	// Audio
+	'.mp3': 'audio/mpeg',
+	'.wav': 'audio/wav',
+	'.ogg': 'audio/ogg',
+	// Documents
+	'.pdf': 'application/pdf',
+	// Data/markup
+	'.json': 'application/json',
+	'.html': 'text/html',
+	'.css': 'text/css',
+	'.js': 'application/javascript',
+	'.mjs': 'application/javascript',
+	'.xml': 'text/xml',
+	'.yaml': 'text/yaml',
+	'.yml': 'text/yaml',
+	'.md': 'text/markdown',
+	// Archives
+	'.zip': 'application/zip',
+	'.tar': 'application/x-tar',
+	'.gz': 'application/gzip',
+	// Fonts
+	'.woff': 'font/woff',
+	'.woff2': 'font/woff2',
+	'.ttf': 'font/ttf',
+	'.otf': 'font/otf',
+	// Binary
+	'.wasm': 'application/wasm',
+}
+
+/** Extensions known to be binary — files that cannot be displayed as text. */
+const BINARY_EXTENSIONS = new Set([
+	// Images
+	'.jpg',
+	'.jpeg',
+	'.png',
+	'.gif',
+	'.webp',
+	'.bmp',
+	'.ico',
+	'.tiff',
+	'.tif',
+	'.avif',
+	// Video
+	'.mp4',
+	'.webm',
+	'.avi',
+	'.mov',
+	'.mkv',
+	'.flv',
+	'.wmv',
+	// Audio
+	'.mp3',
+	'.wav',
+	'.ogg',
+	'.flac',
+	'.aac',
+	'.wma',
+	'.m4a',
+	// Archives
+	'.zip',
+	'.tar',
+	'.gz',
+	'.bz2',
+	'.xz',
+	'.7z',
+	'.rar',
+	'.zst',
+	// Documents (binary)
+	'.pdf',
+	'.doc',
+	'.docx',
+	'.xls',
+	'.xlsx',
+	'.ppt',
+	'.pptx',
+	'.odt',
+	// Fonts
+	'.woff',
+	'.woff2',
+	'.ttf',
+	'.otf',
+	'.eot',
+	// Compiled/binary
+	'.wasm',
+	'.exe',
+	'.dll',
+	'.so',
+	'.dylib',
+	'.o',
+	'.a',
+	'.class',
+	'.pyc',
+	'.pyo',
+	// Database
+	'.sqlite',
+	'.db',
+	'.sqlite3',
+	// Other
+	'.bin',
+	'.dat',
+])
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+/**
+ * Determine MIME type for a file.
+ * Known extensions get their specific MIME type, known binary extensions
+ * get `application/octet-stream`, everything else defaults to `text/plain`
+ * so that code/config files (.astro, .vue, .svelte, .go, .rs, etc.)
+ * are previewable as text.
+ */
+function getMimeType(filePath: string): string {
+	const ext = extname(filePath).toLowerCase()
+	if (MIME_TYPES[ext]) return MIME_TYPES[ext]
+	if (BINARY_EXTENSIONS.has(ext)) return 'application/octet-stream'
+	return 'text/plain'
+}
+
+/**
+ * Extract the wildcard path suffix from a request.
+ *
+ * Hono's c.req.param('*') doesn't work in sub-routers mounted via app.route(),
+ * so we extract it from c.req.path by finding the marker segment and taking everything after it.
+ */
+function extractWildcardPath(c: AppContext, marker: string): string {
+	const idx = c.req.path.indexOf(`/${marker}/`)
+	if (idx === -1) return ''
+	return c.req.path.slice(idx + marker.length + 2)
+}
+
+function preventTraversal(baseDir: string, requestedPath: string): string | null {
+	const resolved = resolve(baseDir, requestedPath)
+	if (!resolved.startsWith(baseDir + '/') && resolved !== baseDir) {
+		return null
+	}
+	return resolved
+}
+
+async function serveFile(c: AppContext, filePath: string): Promise<Response> {
+	const { platform } = getServices(c)
+	let data: Buffer
+	try {
+		data = await platform.fs.readFile(filePath)
+	} catch {
+		return c.json(
+			{ error: { type: 'not_found', message: 'File not found' } },
+			404,
+		)
+	}
+
+	const contentType = getMimeType(filePath)
+
+	return new Response(data, {
+		headers: {
+			'Content-Type': contentType,
+			'Content-Length': data.length.toString(),
+			'Cache-Control': 'public, max-age=3600',
+		},
+	})
+}
+
+async function resolveWorkspaceDir(c: AppContext, sessionId: string): Promise<string | null> {
+	const { sessionRuntime } = getServices(c)
+	const result = await sessionRuntime.getSession(SessionId(sessionId))
+	if (!result.ok) return null
+	return result.value.state.workspaceDir ?? null
+}
+
+// ============================================================================
+// Routes
+// ============================================================================
+
+/**
+ * Creates file proxy routes.
+ *
+ * GET /:sessionId/files/*path              - Serve session file
+ * GET /:sessionId/workspace/*path          - Serve workspace file
+ */
+export function createFileRoutes(): Hono<AppEnv> {
+	const app = new Hono<AppEnv>()
+
+	// --- Serve session file ---
+	app.get('/:sessionId/files/*', async (c: AppContext) => {
+		const { config } = getServices(c)
+		const sessionId = c.req.param('sessionId')!
+		const filePath = extractWildcardPath(c, 'files')
+
+		if (!filePath) {
+			return c.json(
+				{ error: { type: 'validation_error', message: 'File path is required' } },
+				400,
+			)
+		}
+
+		const sessionDir = resolve(config.dataPath, 'sessions', sessionId)
+		const resolvedPath = preventTraversal(sessionDir, filePath)
+
+		if (!resolvedPath) {
+			return c.json(
+				{ error: { type: 'forbidden', message: 'Path traversal not allowed' } },
+				403,
+			)
+		}
+
+		return serveFile(c, resolvedPath)
+	})
+
+	// --- Serve workspace file ---
+	app.get('/:sessionId/workspace/*', async (c: AppContext) => {
+		const sessionId = c.req.param('sessionId')!
+		const filePath = extractWildcardPath(c, 'workspace')
+
+		if (!filePath) {
+			return c.json(
+				{ error: { type: 'validation_error', message: 'File path is required' } },
+				400,
+			)
+		}
+
+		const workspaceDir = await resolveWorkspaceDir(c, sessionId)
+		if (!workspaceDir) {
+			return c.json(
+				{ error: { type: 'not_found', message: 'No workspace configured for this session' } },
+				404,
+			)
+		}
+
+		const resolvedPath = preventTraversal(resolve(workspaceDir), filePath)
+		if (!resolvedPath) {
+			return c.json(
+				{ error: { type: 'forbidden', message: 'Path traversal not allowed' } },
+				403,
+			)
+		}
+
+		return serveFile(c, resolvedPath)
+	})
+
+	return app
+}

package/src/transport/http/routes/resources.ts

@@ -0,0 +1,115 @@
+/**
+ * Resource injection routes.
+ *
+ * POST /sessions/:sessionId/inject-resource
+ * Downloads a file from a URL and injects it directly into the session workspace
+ * (ZIP files are extracted, other files are copied). Used by the worker to inject
+ * organization resources into sessions, bypassing the uploads/attachment pipeline.
+ */
+
+import { Hono } from 'hono'
+import type { AppContext, AppEnv } from '../app.js'
+import { getServices } from '../app.js'
+import { SessionId } from '~/core/sessions/schema.js'
+
+export function createResourceRoutes(): Hono<AppEnv> {
+	const app = new Hono<AppEnv>()
+
+	app.post('/:sessionId/inject-resource', async (c: AppContext) => {
+		const { sessionRuntime, logger } = getServices(c)
+		const sessionId = SessionId(c.req.param('sessionId')!)
+
+		// 1. Verify session exists
+		const sessionResult = await sessionRuntime.getSession(sessionId)
+		if (!sessionResult.ok) {
+			return c.json(
+				{ error: { type: 'session_not_found', message: `Session not found: ${sessionId}` } },
+				404,
+			)
+		}
+
+		// 2. Parse JSON body
+		let body: { url: string; filename: string; mimeType: string; metadata?: { slug?: string; name?: string } }
+		try {
+			body = await c.req.json()
+		} catch {
+			return c.json(
+				{ error: { type: 'parse_error', message: 'Failed to parse JSON body' } },
+				400,
+			)
+		}
+
+		if (!body.url || !body.filename || !body.mimeType) {
+			return c.json(
+				{ error: { type: 'validation_error', message: 'Missing required fields: url, filename, mimeType' } },
+				400,
+			)
+		}
+
+		// 3. Fetch URL
+		const maxSize = 50 * 1024 * 1024 // 50MB
+		let response: Response
+		try {
+			response = await fetch(body.url, { signal: AbortSignal.timeout(120_000) })
+		} catch (err) {
+			return c.json(
+				{ error: { type: 'fetch_error', message: `Failed to fetch URL: ${err instanceof Error ? err.message : String(err)}` } },
+				400,
+			)
+		}
+
+		if (!response.ok) {
+			return c.json(
+				{ error: { type: 'fetch_error', message: `URL returned ${response.status}` } },
+				400,
+			)
+		}
+
+		// 4. Read response with size limit
+		const contentLength = response.headers.get('Content-Length')
+		if (contentLength && Number.parseInt(contentLength, 10) > maxSize) {
+			return c.json(
+				{ error: { type: 'validation_error', message: 'File too large (max 50MB)' } },
+				400,
+			)
+		}
+
+		const arrayBuffer = await response.arrayBuffer()
+		if (arrayBuffer.byteLength > maxSize) {
+			return c.json(
+				{ error: { type: 'validation_error', message: 'File too large (max 50MB)' } },
+				400,
+			)
+		}
+
+		const fileBuffer = Buffer.from(arrayBuffer)
+
+		// 5. Call resources plugin
+		const result = await sessionRuntime.callPluginMethod(sessionId, 'resources.inject', {
+			sessionId: String(sessionId),
+			filename: body.filename,
+			mimeType: body.mimeType,
+			size: fileBuffer.length,
+			fileBuffer,
+			metadata: body.metadata,
+		})
+
+		if (!result.ok) {
+			logger.error('Resource injection failed', undefined, { sessionId: String(sessionId), error: result.error })
+			return c.json(
+				{ error: { type: result.error.type, message: 'Resource injection failed' } },
+				400,
+			)
+		}
+
+		const injectResult = result.value as { resourceId: string; paths: string[] }
+
+		return c.json({
+			ok: true,
+			resourceId: injectResult.resourceId,
+			paths: injectResult.paths,
+		}, 201)
+	})
+
+	return app
+}

package/src/transport/http/routes/rpc.integration.test.ts

@@ -0,0 +1,243 @@
+/**
+ * RPC Integration Tests
+ *
+ * Tests for the RPC dispatch system using TestHarness + Hono.
+ * Covers batch calls, method dispatch, error handling.
+ */
+import { beforeEach, describe, expect, it } from 'bun:test'
+import { Hono } from 'hono'
+import { MockLLMProvider } from '~/core/llm/mock.js'
+import { createTestPreset, TestHarness } from '~/testing/index.js'
+import { bootstrapForTesting } from '../../../testing/bootstrap-for-testing.js'
+import type { AppEnv } from '../app.js'
+import { createRpcRoutes } from './rpc.js'
+
+interface RpcResponse<T = unknown> {
+	ok: boolean
+	value?: T
+	error?: { type: string; message: string }
+}
+
+interface BatchResponse {
+	results: RpcResponse[]
+}
+
+async function rpcCall(app: Hono<AppEnv>, method: string, input?: unknown): Promise<Response> {
+	return app.request('/rpc', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ method, input }),
+	})
+}
+
+async function rpcBatch(app: Hono<AppEnv>, calls: Array<{ method: string; input?: unknown }>): Promise<Response> {
+	return app.request('/rpc', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ batch: calls }),
+	})
+}
+
+describe('RPC integration', () => {
+	let app: Hono<AppEnv>
+	let harness: TestHarness
+
+	beforeEach(() => {
+		harness = new TestHarness({
+			presets: [createTestPreset()],
+			llmProvider: MockLLMProvider.withFixedResponse({ content: 'Ok', toolCalls: [] }),
+		})
+
+		const baseServices = bootstrapForTesting(undefined, [createTestPreset()])
+
+		app = new Hono<AppEnv>()
+		app.use('*', async (c, next) => {
+			c.set('services', {
+				...baseServices,
+				sessionRuntime: harness.sessionManager,
+			})
+			await next()
+		})
+		app.route('/rpc', createRpcRoutes())
+	})
+
+	// =========================================================================
+	// Batch RPC calls
+	// =========================================================================
+
+	describe('batch RPC calls', () => {
+		it('batch calls → all executed, results returned in order', async () => {
+			// First create a session
+			const createRes = await rpcCall(app, 'sessions.create', { presetId: 'test' })
+			const createJson: RpcResponse<{ sessionId: string }> = JSON.parse(await createRes.text())
+			expect(createJson.ok).toBe(true)
+			const sessionId = createJson.value!.sessionId
+
+			// Batch: get session + list presets
+			const res = await rpcBatch(app, [
+				{ method: 'sessions.get', input: { sessionId } },
+				{ method: 'presets.list', input: {} },
+			])
+
+			expect(res.status).toBe(200)
+			const json: BatchResponse = JSON.parse(await res.text())
+			expect(json.results).toHaveLength(2)
+
+			// First result: sessions.get
+			expect(json.results[0].ok).toBe(true)
+			expect(json.results[0].value).toHaveProperty('sessionId', sessionId)
+
+			// Second result: presets.list
+			expect(json.results[1].ok).toBe(true)
+			expect(json.results[1].value).toHaveProperty('presets', expect.any(Array))
+		})
+
+		it('batch stops on first error', async () => {
+			const res = await rpcBatch(app, [
+				{ method: 'sessions.create', input: { presetId: 'test' } },
+				{ method: 'sessions.get', input: { sessionId: 'nonexistent' } },
+				{ method: 'presets.list', input: {} },
+			])
+
+			expect(res.status).toBe(200)
+			const json: BatchResponse = JSON.parse(await res.text())
+
+			// First result succeeds
+			expect(json.results[0].ok).toBe(true)
+
+			// Second result fails (session not found)
+			expect(json.results[1].ok).toBe(false)
+			expect(json.results[1].error!.type).toBe('session_not_found')
+
+			// Third result should not be present (batch stops on first error)
+			expect(json.results).toHaveLength(2)
+		})
+	})
+
+	// =========================================================================
+	// Manager method dispatch
+	// =========================================================================
+
+	describe('manager method dispatch', () => {
+		it('sessions.create dispatches correctly', async () => {
+			const res = await rpcCall(app, 'sessions.create', { presetId: 'test' })
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse<{ sessionId: string }> = JSON.parse(await res.text())
+			expect(json.ok).toBe(true)
+			expect(json.value!.sessionId).toBeDefined()
+		})
+
+		it('sessions.list dispatches correctly', async () => {
+			// Create a session first
+			await rpcCall(app, 'sessions.create', { presetId: 'test' })
+
+			const res = await rpcCall(app, 'sessions.list', {})
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse<{ sessions: unknown[]; total: number }> = JSON.parse(await res.text())
+			expect(json.ok).toBe(true)
+			expect(json.value!.total).toBeGreaterThanOrEqual(1)
+		})
+
+		it('presets.list dispatches correctly', async () => {
+			const res = await rpcCall(app, 'presets.list', {})
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse<{ presets: Array<{ id: string; name: string }> }> = JSON.parse(await res.text())
+			expect(json.ok).toBe(true)
+			expect(json.value!.presets).toBeInstanceOf(Array)
+			expect(json.value!.presets.some(p => p.id === 'test')).toBe(true)
+		})
+	})
+
+	// =========================================================================
+	// Session method dispatch
+	// =========================================================================
+
+	describe('session method dispatch', () => {
+		it('sessions.get dispatches correctly', async () => {
+			const createRes = await rpcCall(app, 'sessions.create', { presetId: 'test' })
+			const createJson: RpcResponse<{ sessionId: string }> = JSON.parse(await createRes.text())
+			const sessionId = createJson.value!.sessionId
+
+			const res = await rpcCall(app, 'sessions.get', { sessionId })
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse<{ sessionId: string; presetId: string; status: string }> = JSON.parse(await res.text())
+			expect(json.ok).toBe(true)
+			expect(json.value!.sessionId).toBe(sessionId)
+			expect(json.value!.presetId).toBe('test')
+			expect(json.value!.status).toBe('active')
+		})
+
+		it('sessions.close dispatches correctly', async () => {
+			const createRes = await rpcCall(app, 'sessions.create', { presetId: 'test' })
+			const createJson: RpcResponse<{ sessionId: string }> = JSON.parse(await createRes.text())
+			const sessionId = createJson.value!.sessionId
+
+			const res = await rpcCall(app, 'sessions.close', { sessionId })
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse = JSON.parse(await res.text())
+			expect(json.ok).toBe(true)
+
+			// Verify session is closed
+			const getRes = await rpcCall(app, 'sessions.get', { sessionId })
+			const getJson: RpcResponse<{ status: string }> = JSON.parse(await getRes.text())
+			expect(getJson.ok).toBe(true)
+			expect(getJson.value!.status).toBe('closed')
+		})
+
+		it('user-chat.sendMessage dispatches correctly', async () => {
+			const createRes = await rpcCall(app, 'sessions.create', { presetId: 'test' })
+			const createJson: RpcResponse<{ sessionId: string }> = JSON.parse(await createRes.text())
+			const sessionId = createJson.value!.sessionId
+
+			// Get entry agent
+			const getRes = await rpcCall(app, 'sessions.get', { sessionId })
+			const getJson: RpcResponse<{ entryAgentId: string }> = JSON.parse(await getRes.text())
+			const agentId = getJson.value!.entryAgentId
+
+			const res = await rpcCall(app, 'user-chat.sendMessage', { sessionId, agentId, content: 'Hello via RPC' })
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse<{ messageId: string }> = JSON.parse(await res.text())
+			expect(json.ok).toBe(true)
+			expect(json.value!.messageId).toBeDefined()
+		})
+	})
+
+	// =========================================================================
+	// Error handling
+	// =========================================================================
+
+	describe('error handling', () => {
+		it('method not found → error with type method_not_found', async () => {
+			const res = await rpcCall(app, 'nonexistent.method', {})
+
+			expect(res.status).toBe(400)
+			const json: RpcResponse = JSON.parse(await res.text())
+			expect(json.ok).toBe(false)
+			expect(json.error!.type).toBe('method_not_found')
+		})
+
+		it('input validation error → error with type validation_error', async () => {
+			const res = await rpcCall(app, 'sessions.list', { limit: 'not_a_number' })
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse = JSON.parse(await res.text())
+			expect(json.ok).toBe(false)
+			expect(json.error!.type).toBe('validation_error')
+		})
+
+		it('session not found → error with type session_not_found', async () => {
+			const res = await rpcCall(app, 'sessions.get', { sessionId: 'nonexistent-session-id' })
+
+			expect(res.status).toBe(200)
+			const json: RpcResponse = JSON.parse(await res.text())
+			expect(json.ok).toBe(false)
+			expect(json.error!.type).toBe('session_not_found')
+		})
+	})
+})