@roj-ai/standalone-server 0.1.11 → 0.1.13

package/src/instance.ts

@@ -4,6 +4,10 @@
  * A standalone server hosts exactly one "instance" — a workspace containing
  * sessions. The instance id is either supplied via config or auto-generated
  * on startup and remains stable for the process lifetime.
+ *
+ * `metadata` is mutated by `instances.create` calls (last write wins). It is
+ * a single-tenant local-dev convenience; consumers that need per-instance
+ * isolation must run separate processes.
  */
 
 export interface InstanceState {
@@ -11,13 +15,20 @@ export interface InstanceState {
 	name: string
 	createdAt: string
 	presetIds: string[]
+	metadata: Record<string, unknown> | null
 }
 
-export function createInstance(options: { id?: string; name?: string; presetIds: string[] }): InstanceState {
+export function createInstance(options: {
+	id?: string
+	name?: string
+	presetIds: string[]
+	metadata?: Record<string, unknown> | null
+}): InstanceState {
 	return {
 		id: options.id ?? 'default',
 		name: options.name ?? 'standalone',
 		createdAt: new Date().toISOString(),
 		presetIds: options.presetIds,
+		metadata: options.metadata ?? null,
 	}
 }

package/src/local-registry.ts

@@ -0,0 +1,334 @@
+/**
+ * On-disk file + resource registry for the standalone server.
+ *
+ * Stands in for the platform's Contember-backed file/resource service. State
+ * lives in `{dataPath}/.roj-platform-state.json` (JSON manifest) plus
+ * `{dataPath}/.roj-platform-state/files/{fileId}` (raw bytes). Operations are
+ * append-only at the resource level (revisions accumulate), so re-running
+ * `roj-standalone` between sessions preserves uploads and revisions added
+ * during a previous run.
+ *
+ * Files are content-addressable by SHA-256 — re-uploading the same bytes
+ * returns the existing fileId with `deduped: true`, mirroring the platform's
+ * /files/upload contract used by `@roj-ai/client/platform.files.upload`.
+ */
+
+import { createHash, randomUUID } from 'node:crypto'
+import { existsSync } from 'node:fs'
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { basename, extname, join } from 'node:path'
+import type { LocalResource, Logger } from '@roj-ai/sdk'
+
+interface FileMeta {
+	id: string
+	filename: string
+	mimeType: string
+	size: number
+	contentHash: string
+	createdAt: string
+}
+
+interface ResourceRevision {
+	id: string
+	fileId: string
+	label: string | null
+	createdAt: string
+}
+
+interface ResourceRecord {
+	id: string
+	slug: string
+	name: string | null
+	description: string | null
+	revisions: ResourceRevision[]
+	createdAt: string
+}
+
+interface RegistryState {
+	files: Record<string, FileMeta>
+	resources: Record<string, ResourceRecord>
+}
+
+export interface ResourceOutput {
+	id: string
+	slug: string
+	name: string | null
+	description: string | null
+	latestRevision: {
+		id: string
+		label: string | null
+		file: { id: string; filename: string; mimeType: string; size: number }
+		createdAt: string
+	} | null
+	createdAt: string
+}
+
+export interface UploadResult {
+	fileId: string
+	filename: string
+	mimeType: string
+	size: number
+	deduped: boolean
+}
+
+export class LocalRegistry {
+	private state: RegistryState = { files: {}, resources: {} }
+	private statePath: string
+	private filesDir: string
+
+	constructor(
+		private readonly dataPath: string,
+		private readonly logger: Logger,
+	) {
+		this.statePath = join(dataPath, '.roj-platform-state.json')
+		this.filesDir = join(dataPath, '.roj-platform-state', 'files')
+	}
+
+	async init(): Promise<void> {
+		await mkdir(this.filesDir, { recursive: true })
+		if (existsSync(this.statePath)) {
+			try {
+				const raw = await readFile(this.statePath, 'utf8')
+				this.state = JSON.parse(raw)
+			} catch (err) {
+				this.logger.warn('Local registry manifest is corrupt, starting fresh', {
+					err: err instanceof Error ? err.message : String(err),
+				})
+				this.state = { files: {}, resources: {} }
+			}
+		}
+	}
+
+	async uploadFile(args: {
+		buffer?: Buffer
+		filename: string
+		mimeType: string
+		contentHash?: string
+	}): Promise<UploadResult | { error: 'file-required'; contentHash: string }> {
+		// Phase 1 — preflight by hash. If we already have the bytes, return the
+		// existing fileId without needing the body.
+		if (args.contentHash) {
+			const existing = Object.values(this.state.files).find(f => f.contentHash === args.contentHash)
+			if (existing) {
+				return {
+					fileId: existing.id,
+					filename: existing.filename,
+					mimeType: existing.mimeType,
+					size: existing.size,
+					deduped: true,
+				}
+			}
+			if (!args.buffer) {
+				return { error: 'file-required', contentHash: args.contentHash }
+			}
+		}
+
+		if (!args.buffer) {
+			throw new Error('uploadFile requires a buffer when contentHash is unknown')
+		}
+
+		const contentHash = args.contentHash ?? sha256Hex(args.buffer)
+
+		// Re-check after computing — the client may not have provided a hash but
+		// we still want dedupe.
+		const matched = Object.values(this.state.files).find(f => f.contentHash === contentHash)
+		if (matched) {
+			return {
+				fileId: matched.id,
+				filename: matched.filename,
+				mimeType: matched.mimeType,
+				size: matched.size,
+				deduped: true,
+			}
+		}
+
+		const id = randomUUID()
+		const meta: FileMeta = {
+			id,
+			filename: args.filename,
+			mimeType: args.mimeType,
+			size: args.buffer.length,
+			contentHash,
+			createdAt: new Date().toISOString(),
+		}
+		await writeFile(join(this.filesDir, id), args.buffer)
+		this.state.files[id] = meta
+		await this.persist()
+		return { fileId: id, filename: meta.filename, mimeType: meta.mimeType, size: meta.size, deduped: false }
+	}
+
+	async readFileById(fileId: string): Promise<{ meta: FileMeta; buffer: Buffer } | null> {
+		const meta = this.state.files[fileId]
+		if (!meta) return null
+		try {
+			const buffer = await readFile(join(this.filesDir, fileId))
+			return { meta, buffer }
+		} catch {
+			return null
+		}
+	}
+
+	async createResource(args: {
+		slug: string
+		name?: string
+		description?: string
+		fileId: string
+		label?: string
+	}): Promise<{ resourceId: string; revisionId: string }> {
+		if (!this.state.files[args.fileId]) {
+			throw new Error(`File not found: ${args.fileId}`)
+		}
+		const existing = this.findBySlug(args.slug)
+		if (existing) {
+			throw new Error(`Resource with slug already exists: ${args.slug}`)
+		}
+		const resourceId = randomUUID()
+		const revisionId = randomUUID()
+		const now = new Date().toISOString()
+		this.state.resources[resourceId] = {
+			id: resourceId,
+			slug: args.slug,
+			name: args.name ?? null,
+			description: args.description ?? null,
+			revisions: [{ id: revisionId, fileId: args.fileId, label: args.label ?? null, createdAt: now }],
+			createdAt: now,
+		}
+		await this.persist()
+		return { resourceId, revisionId }
+	}
+
+	async addRevision(args: {
+		resourceId?: string
+		resourceSlug?: string
+		fileId: string
+		label?: string
+	}): Promise<{ revisionId: string; noop: boolean }> {
+		const record = this.findResource(args)
+		if (!record) {
+			throw new Error('Resource not found')
+		}
+		if (!this.state.files[args.fileId]) {
+			throw new Error(`File not found: ${args.fileId}`)
+		}
+		const latest = record.revisions[record.revisions.length - 1]
+		const incomingLabel = args.label ?? null
+		if (latest && latest.fileId === args.fileId && latest.label === incomingLabel) {
+			return { revisionId: latest.id, noop: true }
+		}
+		const revisionId = randomUUID()
+		record.revisions.push({
+			id: revisionId,
+			fileId: args.fileId,
+			label: incomingLabel,
+			createdAt: new Date().toISOString(),
+		})
+		await this.persist()
+		return { revisionId, noop: false }
+	}
+
+	getResource(args: { resourceId?: string; resourceSlug?: string }): ResourceOutput | null {
+		const record = this.findResource(args)
+		return record ? toResourceOutput(record, this.state.files) : null
+	}
+
+	listResources(): ResourceOutput[] {
+		return Object.values(this.state.resources).map(r => toResourceOutput(r, this.state.files))
+	}
+
+	async deleteResource(resourceId: string): Promise<{ ok: boolean }> {
+		if (!this.state.resources[resourceId]) return { ok: true }
+		delete this.state.resources[resourceId]
+		await this.persist()
+		return { ok: true }
+	}
+
+	/**
+	 * Idempotent: ensures every config-declared local resource exists in the
+	 * registry. Skips slugs that already have a record (so previously uploaded
+	 * revisions survive restarts).
+	 */
+	async bootstrapLocalResources(localResources: LocalResource[]): Promise<void> {
+		for (const lr of localResources) {
+			if (this.findBySlug(lr.slug)) {
+				this.logger.info('Local resource already in registry, skipping bootstrap', { slug: lr.slug })
+				continue
+			}
+			const buffer = await readFile(lr.path)
+			const filename = basename(lr.path)
+			const mimeType = guessMimeType(filename)
+			const upload = await this.uploadFile({ buffer, filename, mimeType })
+			if ('error' in upload) {
+				throw new Error(`Bootstrap upload failed for ${lr.slug}: ${upload.error}`)
+			}
+			await this.createResource({
+				slug: lr.slug,
+				name: lr.name ?? lr.slug,
+				fileId: upload.fileId,
+			})
+			this.logger.info('Bootstrapped local resource', { slug: lr.slug, fileId: upload.fileId, size: upload.size })
+		}
+	}
+
+	private async persist(): Promise<void> {
+		const tmp = `${this.statePath}.tmp`
+		await writeFile(tmp, JSON.stringify(this.state, null, 2), 'utf8')
+		await rename(tmp, this.statePath)
+	}
+
+	private findResource(args: { resourceId?: string; resourceSlug?: string }): ResourceRecord | null {
+		if (args.resourceId) return this.state.resources[args.resourceId] ?? null
+		if (args.resourceSlug) return this.findBySlug(args.resourceSlug)
+		return null
+	}
+
+	private findBySlug(slug: string): ResourceRecord | null {
+		for (const r of Object.values(this.state.resources)) {
+			if (r.slug === slug) return r
+		}
+		return null
+	}
+}
+
+function toResourceOutput(record: ResourceRecord, files: Record<string, FileMeta>): ResourceOutput {
+	const latest = record.revisions[record.revisions.length - 1]
+	const file = latest ? files[latest.fileId] : undefined
+	return {
+		id: record.id,
+		slug: record.slug,
+		name: record.name,
+		description: record.description,
+		latestRevision:
+			latest && file
+				? {
+					id: latest.id,
+					label: latest.label,
+					file: { id: file.id, filename: file.filename, mimeType: file.mimeType, size: file.size },
+					createdAt: latest.createdAt,
+				}
+				: null,
+		createdAt: record.createdAt,
+	}
+}
+
+function sha256Hex(buf: Buffer): string {
+	return createHash('sha256').update(buf).digest('hex')
+}
+
+function guessMimeType(filename: string): string {
+	switch (extname(filename).toLowerCase()) {
+		case '.zip':
+			return 'application/zip'
+		case '.json':
+			return 'application/json'
+		default:
+			return 'application/octet-stream'
+	}
+}
+
+// Exported for tests / smoke scripts that want to nuke local state cleanly.
+export async function clearLocalRegistry(dataPath: string): Promise<void> {
+	const statePath = join(dataPath, '.roj-platform-state.json')
+	const filesDir = join(dataPath, '.roj-platform-state')
+	if (existsSync(statePath)) await rm(statePath)
+	if (existsSync(filesDir)) await rm(filesDir, { recursive: true })
+}

package/src/main.ts

@@ -20,13 +20,19 @@ async function main() {
 		userConfig = await loadUserConfig(absoluteConfigPath)
 		console.log(`Loaded config from: ${absoluteConfigPath}`)
 		console.log(`  Presets: ${userConfig.presets.map(p => p.id).join(', ')}`)
+		if (userConfig.localResources?.length) {
+			console.log(`  Local resources: ${userConfig.localResources.map(r => r.slug).join(', ')}`)
+		}
 	} catch (error) {
 		console.error(`Failed to load config from ${absoluteConfigPath}:`)
 		console.error(error instanceof Error ? error.message : String(error))
 		process.exit(1)
 	}
 
-	await startStandaloneServer({ presets: userConfig.presets })
+	await startStandaloneServer({
+		presets: userConfig.presets,
+		localResources: userConfig.localResources,
+	})
 }
 
 main().catch((error) => {

package/src/platform-api.ts

@@ -14,14 +14,27 @@
  * - instances.archive  — no-op; shutdown the server instead
  */
 
-import type { Logger, SessionManager } from '@roj-ai/sdk'
+import type { Logger, Preset, SessionManager } from '@roj-ai/sdk'
+import { SessionId } from '@roj-ai/sdk'
+import { randomUUID } from 'node:crypto'
 import { Hono } from 'hono'
+import type { GitInstanceFs } from './git-instance-fs.js'
 import type { InstanceState } from './instance.js'
+import type { LocalRegistry } from './local-registry.js'
+import { signFileToken } from './signed-token.js'
 
 interface Deps {
 	instance: InstanceState
 	sessionManager: SessionManager
 	logger: Logger
+	presets: Preset[]
+	registry: LocalRegistry
+	/** Per-instance bare repo + per-session worktree manager. */
+	gitFs: GitInstanceFs
+	/** HMAC secret for signing download tokens (`sessionFiles.createDownloadUrl`). */
+	tokenSecret: string
+	/** Externally-reachable base URL (e.g. `http://localhost:8765`) used when minting download URLs. */
+	publicBaseUrl: string
 }
 
 interface RpcEnvelope {
@@ -77,11 +90,180 @@ async function dispatch(
 
 type Handler = (deps: Deps, input: any) => Promise<unknown>
 
+interface AutoCreateSessionInput {
+	presetId: string
+	initialPrompt?: string
+	resourceIds?: string[]
+	fileIds?: string[]
+	blocking?: boolean
+}
+
+// Shared by `instances.create.autoCreateSession` and `sessions.create`. Creates
+// a session via the SDK session manager, injects any matching local resources,
+// then (if set) pushes `initialPrompt` as a user-chat message — order matters:
+// resources must land in the workspace before the agent's first inference so
+// the agent sees a non-empty workspace. Mirrors roj-platform's project-init
+// (inject-resources → activatePendingSession with initialPrompt).
+//
+// SessionId is minted up-front (rather than letting the SDK generate one) so we
+// can create the matching git worktree before the SDK initializes the session
+// — the worktree path is then passed through as `workspaceDir`.
+async function startSession(
+	deps: Deps,
+	input: { presetId: string; initialPrompt?: string; resourceIds?: string[] },
+): Promise<{ sessionId: string }> {
+	const sessionId = randomUUID()
+	const workspaceDir = await deps.gitFs.addSessionWorktree(deps.instance.id, sessionId)
+
+	const created = await deps.sessionManager.callManagerMethod('sessions.create', {
+		presetId: input.presetId,
+		sessionId,
+		workspaceDir,
+	})
+	if (!created.ok) {
+		// Roll back the worktree we just created so a retry isn't blocked by an
+		// orphaned dir. Best-effort — failure here is logged inside removeSessionWorktree.
+		await deps.gitFs.removeSessionWorktree(deps.instance.id, sessionId)
+		throw new Error(created.error.message)
+	}
+
+	const resources = resolveSessionResources(deps, input.presetId, input.resourceIds)
+	for (const resource of resources) {
+		await injectRegistryResource(deps, sessionId, resource)
+	}
+
+	if (input.initialPrompt) {
+		const sent = await deps.sessionManager.callPluginMethod(SessionId(sessionId), 'user-chat.sendMessage', {
+			content: input.initialPrompt,
+		})
+		if (!sent.ok) {
+			deps.logger.warn('Failed to deliver initialPrompt', {
+				sessionId,
+				error: sent.error,
+			})
+		}
+	}
+
+	return { sessionId }
+}
+
+interface ResolvedResource {
+	resourceId: string
+	slug: string
+	name: string | null
+	fileId: string
+	filename: string
+	mimeType: string
+}
+
+// Resolution mirrors roj-platform's project-init.ts:206:
+//   1. explicit input.resourceIds — matched against the local registry by ID
+//      first, then by slug (since local-dev callers often pass slugs as ids).
+//   2. fallback to preset.defaultResourceSlugs (looked up by slug).
+function resolveSessionResources(
+	deps: Deps,
+	presetId: string,
+	inputResourceIds: string[] | undefined,
+): ResolvedResource[] {
+	if (inputResourceIds && inputResourceIds.length > 0) {
+		const matched: ResolvedResource[] = []
+		const unmatched: string[] = []
+		for (const id of inputResourceIds) {
+			const resource =
+				deps.registry.getResource({ resourceId: id }) ?? deps.registry.getResource({ resourceSlug: id })
+			const resolved = toResolvedResource(resource)
+			if (resolved) matched.push(resolved)
+			else unmatched.push(id)
+		}
+		if (unmatched.length > 0) {
+			deps.logger.warn('Some input resourceIds did not match the local registry; ignoring', {
+				unmatched,
+				availableSlugs: deps.registry.listResources().map(r => r.slug),
+			})
+		}
+		if (matched.length > 0) return matched
+	}
+
+	const preset = deps.presets.find(p => p.id === presetId)
+	const slugs = preset?.defaultResourceSlugs ?? []
+	const resolved: ResolvedResource[] = []
+	const missing: string[] = []
+	for (const slug of slugs) {
+		const r = toResolvedResource(deps.registry.getResource({ resourceSlug: slug }))
+		if (r) resolved.push(r)
+		else missing.push(slug)
+	}
+	if (missing.length > 0) {
+		deps.logger.warn(
+			"Preset declares defaultResourceSlugs not present in the local registry; those slots will be skipped",
+			{ presetId, missing, availableSlugs: deps.registry.listResources().map(r => r.slug) },
+		)
+	}
+	return resolved
+}
+
+function toResolvedResource(resource: ReturnType<LocalRegistry['getResource']>): ResolvedResource | null {
+	if (!resource || !resource.latestRevision) return null
+	const file = resource.latestRevision.file
+	return {
+		resourceId: resource.id,
+		slug: resource.slug,
+		name: resource.name,
+		fileId: file.id,
+		filename: file.filename,
+		mimeType: file.mimeType,
+	}
+}
+
+async function injectRegistryResource(deps: Deps, sessionId: string, resource: ResolvedResource): Promise<void> {
+	const file = await deps.registry.readFileById(resource.fileId)
+	if (!file) {
+		throw new Error(`Registry file not found for resource ${resource.slug} (fileId=${resource.fileId})`)
+	}
+
+	const result = await deps.sessionManager.callPluginMethod(SessionId(sessionId), 'resources.inject', {
+		sessionId,
+		filename: resource.filename,
+		mimeType: resource.mimeType,
+		size: file.buffer.length,
+		fileBuffer: file.buffer,
+		metadata: { slug: resource.slug, name: resource.name ?? resource.slug },
+	})
+	if (!result.ok) {
+		deps.logger.error('Registry resource injection failed', undefined, {
+			sessionId,
+			slug: resource.slug,
+			error: result.error,
+		})
+		throw new Error(`Failed to inject resource '${resource.slug}': ${result.error.message ?? result.error.type}`)
+	}
+}
+
 const handlers: Record<string, Handler> = {
-	'instances.create': async ({ instance }) => ({
-		instanceId: instance.id,
-		status: 'ready',
-	}),
+	'instances.create': async (
+		deps,
+		input: { metadata?: Record<string, unknown>; autoCreateSession?: AutoCreateSessionInput },
+	) => {
+		if (input.metadata !== undefined) {
+			deps.instance.metadata = input.metadata
+		}
+
+		let sessionId: string | undefined
+		if (input.autoCreateSession?.presetId) {
+			const result = await startSession(deps, {
+				presetId: input.autoCreateSession.presetId,
+				initialPrompt: input.autoCreateSession.initialPrompt,
+				resourceIds: input.autoCreateSession.resourceIds,
+			})
+			sessionId = result.sessionId
+		}
+
+		return {
+			instanceId: deps.instance.id,
+			status: 'ready',
+			...(sessionId ? { sessionId } : {}),
+		}
+	},
 
 	'instances.list': async ({ instance }) => ({
 		instances: [instanceSummary(instance)],
@@ -109,13 +291,10 @@ const handlers: Record<string, Handler> = {
 
 	'instances.archive': async () => ({ ok: true }),
 
-	'sessions.create': async ({ sessionManager }, input: { presetId: string; initialPrompt?: string }) => {
-		const result = await sessionManager.callManagerMethod('sessions.create', {
-			presetId: input.presetId,
-		})
-		if (!result.ok) throw new Error(result.error.message)
-		return result.value as { sessionId: string }
-	},
+	'sessions.create': async (
+		deps,
+		input: { presetId: string; initialPrompt?: string; resourceIds?: string[] },
+	) => startSession(deps, input),
 
 	'sessions.list': async ({ sessionManager }) => {
 		const result = await sessionManager.callManagerMethod('sessions.list', {})
@@ -124,6 +303,65 @@ const handlers: Record<string, Handler> = {
 	},
 
 	'tokens.create': async () => ({ token: '' }),
+
+	'resources.create': async (
+		deps,
+		input: { slug: string; name?: string; description?: string; fileId: string; label?: string },
+	) => deps.registry.createResource(input),
+
+	'resources.addRevision': async (
+		deps,
+		input: { resourceId?: string; resourceSlug?: string; fileId: string; label?: string },
+	) => deps.registry.addRevision(input),
+
+	'resources.get': async (deps, input: { resourceId?: string; resourceSlug?: string }) => {
+		const resource = deps.registry.getResource(input)
+		if (!resource) throw new Error('Resource not found')
+		return resource
+	},
+
+	'resources.list': async (deps, _input: { limit?: number; offset?: number }) => ({
+		resources: deps.registry.listResources(),
+	}),
+
+	'resources.delete': async (deps, input: { resourceId: string }) => deps.registry.deleteResource(input.resourceId),
+
+	'sessionFiles.createDownloadUrl': async (
+		deps,
+		input: {
+			instanceId: string
+			sessionId: string
+			scope: 'workspace' | 'session'
+			path: string
+			ttlSeconds?: number
+		},
+	) => {
+		if (input.scope !== 'workspace' && input.scope !== 'session') {
+			throw new Error(`Invalid scope: ${input.scope}`)
+		}
+		if (!input.path || input.path.includes('..')) {
+			throw new Error('Path traversal not allowed')
+		}
+
+		const ttl = Math.min(Math.max(input.ttlSeconds ?? 300, 1), 3600)
+		const expiresAt = Date.now() + ttl * 1000
+
+		const token = signFileToken(deps.tokenSecret, {
+			instanceId: input.instanceId,
+			sessionId: input.sessionId,
+			scope: input.scope,
+			path: input.path,
+			expiresAt,
+		})
+
+		const encodedPath = input.path
+			.split('/')
+			.map(seg => encodeURIComponent(seg))
+			.join('/')
+		const url = `${deps.publicBaseUrl}/api/v1/instances/${input.instanceId}/sessions/${input.sessionId}/files/${input.scope}/${encodedPath}?token=${encodeURIComponent(token)}`
+
+		return { url, expiresAt: new Date(expiresAt).toISOString() }
+	},
 }
 
 function instanceSummary(instance: InstanceState) {
@@ -135,7 +373,7 @@ function instanceSummary(instance: InstanceState) {
 		bundleSlug: 'standalone',
 		bundleRevisionId: '',
 		vcsType: 'none',
-		metadata: null,
+		metadata: instance.metadata,
 		createdAt: instance.createdAt,
 	}
 }