@skaleagents/swarm 0.6.1 → 0.6.2

package/dist/auth.js

@@ -1,285 +0,0 @@
-import { createServer } from "node:http";
-import { spawn } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
-import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { getApiToken, getApiUrl, getOAuthCachePath, isOAuthEnabled } from "./config.js";
-let cachedCredentials = null;
-let authenticationInFlight = null;
-/**
- * Validate the API bearer token before running any tool. OAuth starts in the
- * user's browser when no legacy SKALEAGENTS_API_TOKEN is configured.
- */
-export async function requireApiAuth() {
-    const token = await getAccessToken();
-    if (!token) {
-        return {
-            ok: false,
-            reason: isOAuthEnabled() ? "oauth_failed" : "oauth_required",
-        };
-    }
-    try {
-        let res = await fetchApiUser(token);
-        if ((res.status === 401 || res.status === 403) && !getApiToken()) {
-            const replacementToken = await reauthorizeAfterRejection();
-            if (replacementToken) {
-                res = await fetchApiUser(replacementToken);
-            }
-        }
-        if (res.status === 401 || res.status === 403) {
-            return { ok: false, reason: "unauthorized" };
-        }
-        if (!res.ok) {
-            return { ok: false, reason: "api_unavailable" };
-        }
-        const user = (await res.json());
-        return { ok: true, userId: user.id };
-    }
-    catch {
-        return { ok: false, reason: "api_unavailable" };
-    }
-}
-export async function getApiAccessToken() {
-    return getAccessToken();
-}
-export function unauthorizedContent(reason) {
-    const text = reason.reason === "oauth_required"
-        ? "MCP OAuth is disabled. Set SKALEAGENTS_API_TOKEN or enable OAuth."
-        : reason.reason === "oauth_failed"
-            ? "MCP sign-in could not be completed. Check the browser window and try again."
-            : reason.reason === "unauthorized"
-                ? "unauthorized: the SkaleAgents connection was rejected"
-                : "api unavailable: could not validate the SkaleAgents connection";
-    return {
-        isError: true,
-        content: [{ type: "text", text }],
-    };
-}
-async function getAccessToken() {
-    const legacyToken = getApiToken();
-    if (legacyToken)
-        return legacyToken;
-    if (!isOAuthEnabled())
-        return null;
-    if (!authenticationInFlight) {
-        authenticationInFlight = getOAuthAccessToken().finally(() => {
-            authenticationInFlight = null;
-        });
-    }
-    try {
-        return await authenticationInFlight;
-    }
-    catch {
-        return null;
-    }
-}
-async function fetchApiUser(token) {
-    return fetch(`${getApiUrl()}/api/user`, {
-        headers: {
-            Accept: "application/json",
-            Authorization: `Bearer ${token}`,
-        },
-    });
-}
-async function reauthorizeAfterRejection() {
-    cachedCredentials = null;
-    await removeCredentials();
-    return getAccessToken();
-}
-async function getOAuthAccessToken() {
-    const apiUrl = getApiUrl();
-    const metadata = await getMetadata(apiUrl);
-    const stored = await readCredentials(apiUrl);
-    if (stored && stored.expiresAt > Date.now() + 30_000) {
-        cachedCredentials = stored;
-        return stored.accessToken;
-    }
-    if (stored?.refreshToken) {
-        try {
-            const refreshed = await exchangeRefreshToken(metadata.token_endpoint, stored.refreshToken);
-            await saveCredentials(apiUrl, refreshed);
-            return refreshed.accessToken;
-        }
-        catch {
-            cachedCredentials = null;
-            await removeCredentials();
-        }
-    }
-    const authorizationCode = await authorizeInBrowser(metadata.authorization_endpoint);
-    const exchanged = await exchangeAuthorizationCode(metadata.token_endpoint, authorizationCode.code, authorizationCode.redirectUri, authorizationCode.verifier);
-    await saveCredentials(apiUrl, exchanged);
-    return exchanged.accessToken;
-}
-async function getMetadata(apiUrl) {
-    const response = await fetch(`${apiUrl}/.well-known/oauth-authorization-server`, {
-        headers: { Accept: "application/json" },
-    });
-    if (!response.ok) {
-        throw new Error(`OAuth metadata request failed with status ${response.status}`);
-    }
-    const metadata = (await response.json());
-    if (typeof metadata.authorization_endpoint !== "string" ||
-        typeof metadata.token_endpoint !== "string") {
-        throw new Error("OAuth metadata is incomplete");
-    }
-    return metadata;
-}
-async function authorizeInBrowser(authorizationEndpoint) {
-    const verifier = randomBytes(48).toString("base64url");
-    const challenge = createCodeChallenge(verifier);
-    const state = randomBytes(32).toString("base64url");
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let redirectUri = "";
-        const server = createServer((request, response) => {
-            const requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
-            if (requestUrl.pathname !== "/oauth/callback") {
-                response.writeHead(404);
-                response.end("Not found");
-                return;
-            }
-            const receivedState = requestUrl.searchParams.get("state");
-            const error = requestUrl.searchParams.get("error");
-            const code = requestUrl.searchParams.get("code");
-            response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-            response.end("<!doctype html><title>SkaleAgents connected</title>" +
-                "<p>You can close this window and return to your AI client.</p>");
-            if (settled)
-                return;
-            settled = true;
-            server.close();
-            if (receivedState !== state) {
-                reject(new Error("OAuth state validation failed"));
-                return;
-            }
-            if (error || !code) {
-                reject(new Error("OAuth authorization was denied"));
-                return;
-            }
-            resolve({
-                code,
-                redirectUri,
-                verifier,
-            });
-        });
-        server.once("error", reject);
-        server.listen(0, "127.0.0.1", () => {
-            const port = addressPort(server);
-            redirectUri = `http://127.0.0.1:${port}/oauth/callback`;
-            const url = new URL(authorizationEndpoint);
-            url.search = new URLSearchParams({
-                client_id: "skaleagents-mcp",
-                response_type: "code",
-                redirect_uri: redirectUri,
-                scope: "mcp",
-                state,
-                code_challenge: challenge,
-                code_challenge_method: "S256",
-            }).toString();
-            console.error("Opening SkaleAgents sign-in in your browser...");
-            console.error(url.toString());
-            openBrowser(url.toString());
-        });
-    });
-}
-async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, verifier) {
-    const response = await fetchToken(tokenEndpoint, {
-        grant_type: "authorization_code",
-        client_id: "skaleagents-mcp",
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: verifier,
-    });
-    return parseTokenResponse(response);
-}
-async function exchangeRefreshToken(tokenEndpoint, refreshToken) {
-    const response = await fetchToken(tokenEndpoint, {
-        grant_type: "refresh_token",
-        client_id: "skaleagents-mcp",
-        refresh_token: refreshToken,
-    });
-    return parseTokenResponse(response);
-}
-async function fetchToken(tokenEndpoint, values) {
-    const response = await fetch(tokenEndpoint, {
-        method: "POST",
-        headers: {
-            Accept: "application/json",
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-        body: new URLSearchParams(values),
-    });
-    const payload = (await response.json().catch(() => ({})));
-    if (!response.ok) {
-        throw new Error(`OAuth token request failed with status ${response.status}`);
-    }
-    return payload;
-}
-function parseTokenResponse(response) {
-    if (typeof response.access_token !== "string" ||
-        typeof response.refresh_token !== "string" ||
-        typeof response.expires_in !== "number") {
-        throw new Error("OAuth token response is incomplete");
-    }
-    return {
-        apiUrl: getApiUrl(),
-        accessToken: response.access_token,
-        refreshToken: response.refresh_token,
-        expiresAt: Date.now() + response.expires_in * 1000,
-    };
-}
-async function readCredentials(apiUrl) {
-    if (cachedCredentials?.apiUrl === apiUrl)
-        return cachedCredentials;
-    try {
-        const parsed = JSON.parse(await readFile(getOAuthCachePath(), "utf8"));
-        if (parsed.apiUrl !== apiUrl ||
-            typeof parsed.accessToken !== "string" ||
-            typeof parsed.refreshToken !== "string" ||
-            typeof parsed.expiresAt !== "number") {
-            return null;
-        }
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
-async function saveCredentials(apiUrl, credentials) {
-    cachedCredentials = { ...credentials, apiUrl };
-    const path = getOAuthCachePath();
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, JSON.stringify(cachedCredentials), { encoding: "utf8", mode: 0o600 });
-    await chmod(path, 0o600);
-}
-async function removeCredentials() {
-    try {
-        await unlink(getOAuthCachePath());
-    }
-    catch {
-        /* Cache may not exist. */
-    }
-}
-function createCodeChallenge(verifier) {
-    return createHash("sha256").update(verifier).digest("base64url");
-}
-function addressPort(server) {
-    const address = server.address();
-    if (address === null || typeof address === "string") {
-        throw new Error("OAuth callback server did not receive a port");
-    }
-    return address.port;
-}
-function openBrowser(url) {
-    const command = process.platform === "darwin"
-        ? "open"
-        : process.platform === "win32"
-            ? "cmd"
-            : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
-    child.once("error", () => {
-        console.error("Could not open a browser automatically. Open the URL printed above.");
-    });
-    child.unref();
-}

package/dist/config.d.ts

@@ -1,4 +0,0 @@
-export declare function getApiUrl(): string;
-export declare function getApiToken(): string;
-export declare function getOAuthCachePath(): string;
-export declare function isOAuthEnabled(): boolean;

package/dist/config.js

@@ -1,15 +0,0 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
-export function getApiUrl() {
-    return (process.env.PLATFORM_API_URL?.trim().replace(/\/+$/, "") || "https://api.skaleagents.com");
-}
-export function getApiToken() {
-    return process.env.SKALEAGENTS_API_TOKEN?.trim() ?? "";
-}
-export function getOAuthCachePath() {
-    return (process.env.SKALEAGENTS_OAUTH_CACHE?.trim() ??
-        join(homedir(), ".config", "skaleagents", "oauth.json"));
-}
-export function isOAuthEnabled() {
-    return process.env.SKALEAGENTS_OAUTH_ENABLED !== "false";
-}

package/dist/http.d.ts

@@ -1,2 +0,0 @@
-export declare function protectedResourceMetadata(): Response;
-export declare function handleMcpRequest(request: Request): Promise<Response>;

package/dist/http.js

@@ -1,134 +0,0 @@
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { createServer } from "./server.js";
-import { getApiUrl } from "./config.js";
-const resource = process.env.MCP_RESOURCE_URL ?? "https://skaleagents.com/mcp";
-const metadataUrl = `${new URL(resource).origin}/.well-known/oauth-protected-resource/mcp`;
-const allowedOrigins = new Set([
-    "https://claude.ai",
-    "https://chatgpt.com",
-    "https://platform.openai.com",
-    new URL(resource).origin,
-]);
-const headers = {
-    "Cache-Control": "no-store",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Authorization, Content-Type, Accept, MCP-Protocol-Version, MCP-Session-Id, Last-Event-ID",
-    "Access-Control-Expose-Headers": "WWW-Authenticate, MCP-Session-Id, MCP-Protocol-Version",
-};
-function json(status, body, extraHeaders = {}) {
-    return Response.json(body, {
-        status,
-        headers: { ...headers, ...extraHeaders },
-    });
-}
-function challenge() {
-    return json(401, { error: "unauthorized" }, {
-        "WWW-Authenticate": `Bearer resource_metadata="${metadataUrl}", scope="mcp"`,
-    });
-}
-export function protectedResourceMetadata() {
-    return json(200, {
-        resource,
-        authorization_servers: [getApiUrl()],
-        scopes_supported: ["mcp"],
-        bearer_methods_supported: ["header"],
-        resource_documentation: "https://skaleagents.com/settings",
-    });
-}
-export async function handleMcpRequest(request) {
-    const origin = request.headers.get("origin");
-    if (origin && !allowedOrigins.has(origin))
-        return json(403, { error: "origin_not_allowed" });
-    if (request.method === "OPTIONS")
-        return new Response(null, { status: 204, headers });
-    const authorization = request.headers.get("authorization");
-    if (!authorization || !/^Bearer [^\s]+$/i.test(authorization))
-        return challenge();
-    try {
-        // Validate the opaque token with its issuer, including the MCP audience.
-        const validation = await fetch(`${getApiUrl()}/api/oauth/mcp-token`, {
-            headers: { Authorization: authorization, Accept: "application/json" },
-            signal: AbortSignal.timeout(10_000),
-            redirect: "error",
-            cache: "no-store",
-        });
-        if (validation.status === 401 || validation.status === 403)
-            return challenge();
-        if (!validation.ok)
-            return json(503, { error: "authorization_unavailable" });
-        const token = (await validation.json());
-        if (!token.active ||
-            token.resource !== resource ||
-            token.scope !== "mcp" ||
-            !token.expiresAt ||
-            token.expiresAt * 1000 <= Date.now()) {
-            return challenge();
-        }
-    }
-    catch {
-        return json(503, { error: "authorization_unavailable" });
-    }
-    if (request.method !== "POST")
-        return json(405, { error: "method_not_allowed" }, { Allow: "POST, OPTIONS" });
-    if (!request.headers.get("content-type")?.startsWith("application/json"))
-        return json(415, { error: "expected_json" });
-    let body;
-    try {
-        const reader = request.body?.getReader();
-        if (!reader)
-            return json(400, { error: "missing_body" });
-        const chunks = [];
-        let size = 0;
-        try {
-            for (;;) {
-                const { value, done } = await reader.read();
-                if (done)
-                    break;
-                size += value.byteLength;
-                if (size > 2_100_000) {
-                    await reader.cancel();
-                    return json(413, { error: "request_too_large" });
-                }
-                chunks.push(value);
-            }
-        }
-        finally {
-            reader.releaseLock();
-        }
-        body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    }
-    catch {
-        return json(400, {
-            jsonrpc: "2.0",
-            id: null,
-            error: { code: -32700, message: "Invalid JSON" },
-        });
-    }
-    const server = createServer(true);
-    const transport = new WebStandardStreamableHTTPServerTransport({
-        sessionIdGenerator: undefined,
-        enableJsonResponse: true,
-    });
-    try {
-        await server.connect(transport);
-        const response = await transport.handleRequest(request, {
-            parsedBody: body,
-        });
-        // Finish the JSON response before closing this request-scoped transport.
-        const responseBody = await response.arrayBuffer();
-        const responseHeaders = new Headers(response.headers);
-        for (const [key, value] of Object.entries(headers))
-            responseHeaders.set(key, value);
-        return new Response(responseBody.byteLength ? responseBody : null, {
-            status: response.status,
-            headers: responseHeaders,
-        });
-    }
-    catch {
-        return json(500, { error: "mcp_request_failed" });
-    }
-    finally {
-        await server.close();
-    }
-}

package/dist/iac/parse.d.ts

@@ -1,25 +0,0 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes";
-export type Path = (string | number)[];
-export type Location = {
-    line: number;
-    column: number;
-    path: string;
-};
-export type Resource = {
-    id: string;
-    type: string;
-    value: Record<string, unknown>;
-    locate: (path?: Path) => Location;
-};
-export type ParsedIac = {
-    format: IacFormat;
-    resources: Resource[];
-    warnings: string[];
-};
-export declare class ScanInputError extends Error {
-    constructor(message: string);
-}
-export declare function object(value: unknown): Record<string, unknown>;
-export declare function array(value: unknown): unknown[];
-export declare function looksLikeIac(content: string): boolean;
-export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;