@stacknet/stacks 0.2.0 → 0.2.2

package/src/managers/task-manager.ts

@@ -1,332 +0,0 @@
-/**
- * TaskManager - Redis-backed task state management
- *
- * Manages task lifecycle for long-running operations with real-time updates
- */
-
-import type { TaskType, TaskStatus, TaskState } from '../types';
-import { TASK_PREFIX, CHAT_TASKS_PREFIX, TASK_TTL } from '../utils/constants';
-import { generateUUID } from '../utils/helpers';
-
-// Redis client type - we use a generic interface to avoid hard dependency
-export interface RedisClientLike {
-  hSet(key: string, value: Record<string, string>): Promise<number>;
-  hGetAll(key: string): Promise<Record<string, string>>;
-  expire(key: string, seconds: number): Promise<boolean>;
-  sAdd(key: string, ...members: string[]): Promise<number>;
-  sMembers(key: string): Promise<string[]>;
-  sRem(key: string, ...members: string[]): Promise<number>;
-  del(key: string): Promise<number>;
-  publish(channel: string, message: string): Promise<number>;
-  subscribe(channel: string, callback: (message: string) => void): Promise<void>;
-  unsubscribe(channel: string): Promise<void>;
-}
-
-export interface TaskManagerConfig {
-  redis?: RedisClientLike;
-  getRedisClient?: () => Promise<RedisClientLike>;
-  taskTTL?: number;
-}
-
-export class TaskManager {
-  private redis?: RedisClientLike;
-  private getRedisClient?: () => Promise<RedisClientLike>;
-  private taskTTL: number;
-
-  constructor(config: TaskManagerConfig = {}) {
-    this.redis = config.redis;
-    this.getRedisClient = config.getRedisClient;
-    this.taskTTL = config.taskTTL || TASK_TTL;
-  }
-
-  /**
-   * Get Redis client (lazily initialized)
-   */
-  private async getClient(): Promise<RedisClientLike> {
-    if (this.redis) return this.redis;
-    if (this.getRedisClient) {
-      this.redis = await this.getRedisClient();
-      return this.redis;
-    }
-    throw new Error('Redis client not configured. Provide redis or getRedisClient in config.');
-  }
-
-  /**
-   * Create a new task and return its ID
-   */
-  async createTask(
-    chatId: string,
-    messageId: string,
-    type: TaskType,
-    initialMessage: string = 'Starting...'
-  ): Promise<string> {
-    const redis = await this.getClient();
-    const taskId = generateUUID();
-    const now = Date.now();
-
-    const task: TaskState = {
-      id: taskId,
-      chatId,
-      messageId,
-      type,
-      status: 'pending',
-      progress: 0,
-      message: initialMessage,
-      createdAt: now,
-      updatedAt: now,
-    };
-
-    await redis.hSet(`${TASK_PREFIX}${taskId}`, this.taskToRedis(task));
-    await redis.expire(`${TASK_PREFIX}${taskId}`, this.taskTTL);
-
-    await redis.sAdd(`${CHAT_TASKS_PREFIX}${chatId}`, taskId);
-    await redis.expire(`${CHAT_TASKS_PREFIX}${chatId}`, this.taskTTL);
-
-    console.log(`[TaskManager] Created task ${taskId} for chat ${chatId} (${type})`);
-
-    return taskId;
-  }
-
-  /**
-   * Update task progress
-   */
-  async updateProgress(
-    taskId: string,
-    progress: number,
-    message: string
-  ): Promise<void> {
-    const redis = await this.getClient();
-
-    await redis.hSet(`${TASK_PREFIX}${taskId}`, {
-      status: 'generating',
-      progress: progress.toString(),
-      message,
-      updatedAt: Date.now().toString(),
-    });
-
-    await redis.publish(
-      `task:progress:${taskId}`,
-      JSON.stringify({
-        taskId,
-        progress,
-        message,
-        status: 'generating',
-      })
-    );
-
-    console.log(`[TaskManager] Task ${taskId} progress: ${progress}% - ${message}`);
-  }
-
-  /**
-   * Mark task as complete with result
-   */
-  async complete(taskId: string, result: unknown): Promise<void> {
-    const redis = await this.getClient();
-
-    await redis.hSet(`${TASK_PREFIX}${taskId}`, {
-      status: 'complete',
-      progress: '100',
-      message: 'Complete',
-      result: JSON.stringify(result),
-      updatedAt: Date.now().toString(),
-    });
-
-    await redis.publish(
-      `task:progress:${taskId}`,
-      JSON.stringify({
-        taskId,
-        progress: 100,
-        message: 'Complete',
-        status: 'complete',
-        result,
-      })
-    );
-
-    console.log(`[TaskManager] Task ${taskId} completed`);
-  }
-
-  /**
-   * Mark task as failed
-   */
-  async fail(taskId: string, error: string): Promise<void> {
-    const redis = await this.getClient();
-
-    await redis.hSet(`${TASK_PREFIX}${taskId}`, {
-      status: 'failed',
-      message: error,
-      error,
-      updatedAt: Date.now().toString(),
-    });
-
-    await redis.publish(
-      `task:progress:${taskId}`,
-      JSON.stringify({
-        taskId,
-        status: 'failed',
-        error,
-      })
-    );
-
-    console.log(`[TaskManager] Task ${taskId} failed: ${error}`);
-  }
-
-  /**
-   * Get task by ID
-   */
-  async getTask(taskId: string): Promise<TaskState | null> {
-    const redis = await this.getClient();
-    const data = await redis.hGetAll(`${TASK_PREFIX}${taskId}`);
-
-    if (!data || Object.keys(data).length === 0) {
-      return null;
-    }
-
-    return this.redisToTask(data);
-  }
-
-  /**
-   * Get all tasks for a chat
-   */
-  async getTasksForChat(chatId: string): Promise<TaskState[]> {
-    const redis = await this.getClient();
-    const taskIds = await redis.sMembers(`${CHAT_TASKS_PREFIX}${chatId}`);
-
-    if (!taskIds || taskIds.length === 0) {
-      return [];
-    }
-
-    const tasks: TaskState[] = [];
-    for (const taskId of taskIds) {
-      const task = await this.getTask(taskId);
-      if (task) {
-        tasks.push(task);
-      }
-    }
-
-    return tasks.sort((a, b) => b.createdAt - a.createdAt);
-  }
-
-  /**
-   * Get pending/generating tasks for a chat
-   */
-  async getPendingTasksForChat(chatId: string): Promise<TaskState[]> {
-    const tasks = await this.getTasksForChat(chatId);
-    return tasks.filter((t) => t.status === 'pending' || t.status === 'generating');
-  }
-
-  /**
-   * Delete a task
-   */
-  async deleteTask(taskId: string): Promise<void> {
-    const redis = await this.getClient();
-    const task = await this.getTask(taskId);
-
-    if (task) {
-      await redis.del(`${TASK_PREFIX}${taskId}`);
-      await redis.sRem(`${CHAT_TASKS_PREFIX}${task.chatId}`, taskId);
-      console.log(`[TaskManager] Deleted task ${taskId}`);
-    }
-  }
-
-  /**
-   * Clean up old completed/failed tasks for a chat
-   */
-  async cleanupOldTasks(chatId: string, maxAge: number = 86400000): Promise<void> {
-    const tasks = await this.getTasksForChat(chatId);
-    const now = Date.now();
-
-    for (const task of tasks) {
-      if (
-        (task.status === 'complete' || task.status === 'failed') &&
-        now - task.updatedAt > maxAge
-      ) {
-        await this.deleteTask(task.id);
-      }
-    }
-  }
-
-  /**
-   * Subscribe to task progress updates
-   */
-  async subscribeToTask(
-    taskId: string,
-    callback: (update: { taskId: string; status: TaskStatus; progress?: number; message?: string; result?: unknown; error?: string }) => void
-  ): Promise<() => Promise<void>> {
-    const redis = await this.getClient();
-    const channel = `task:progress:${taskId}`;
-
-    await redis.subscribe(channel, (message) => {
-      let data: unknown;
-      try {
-        data = JSON.parse(message);
-      } catch {
-        return; // not JSON — ignore
-      }
-      // Shape-check: Redis pub/sub is a trust boundary. If anything else
-      // (a compromised publisher, a misconfigured tenant, or an operator
-      // pushing test data) posts to this channel, the message reaches
-      // this callback. Drop anything that doesn't match our own
-      // publisher's shape before handing it to consumer code — otherwise
-      // an attacker with publish access could inject arbitrary objects
-      // (prototype keys, unexpected fields) into the UI layer.
-      if (!data || typeof data !== 'object' || Array.isArray(data)) return;
-      const d = data as Record<string, unknown>;
-      if (typeof d.taskId !== 'string' || d.taskId !== taskId) return;
-      if (typeof d.status !== 'string') return;
-      if (d.progress !== undefined && typeof d.progress !== 'number') return;
-      if (d.message !== undefined && typeof d.message !== 'string') return;
-      if (d.error !== undefined && typeof d.error !== 'string') return;
-      callback({
-        taskId: d.taskId,
-        status: d.status as TaskStatus,
-        progress: d.progress as number | undefined,
-        message: d.message as string | undefined,
-        result: d.result,
-        error: d.error as string | undefined,
-      });
-    });
-
-    return async () => {
-      await redis.unsubscribe(channel);
-    };
-  }
-
-  private taskToRedis(task: TaskState): Record<string, string> {
-    return {
-      id: task.id,
-      chatId: task.chatId,
-      messageId: task.messageId,
-      type: task.type,
-      status: task.status,
-      progress: task.progress.toString(),
-      message: task.message,
-      result: task.result || '',
-      error: task.error || '',
-      createdAt: task.createdAt.toString(),
-      updatedAt: task.updatedAt.toString(),
-    };
-  }
-
-  private redisToTask(data: Record<string, string>): TaskState {
-    return {
-      id: data.id,
-      chatId: data.chatId,
-      messageId: data.messageId,
-      type: data.type as TaskType,
-      status: data.status as TaskStatus,
-      progress: parseInt(data.progress, 10),
-      message: data.message,
-      result: data.result || undefined,
-      error: data.error || undefined,
-      createdAt: parseInt(data.createdAt, 10),
-      updatedAt: parseInt(data.updatedAt, 10),
-    };
-  }
-}
-
-/**
- * Factory function to create a TaskManager
- */
-export function createTaskManager(config?: TaskManagerConfig): TaskManager {
-  return new TaskManager(config);
-}

package/src/proxy/forwarder.ts

@@ -1,235 +0,0 @@
-/**
- * Generic request forwarding utilities
- */
-
-import { DEFAULT_TASK_NETWORK_URL } from '../utils/constants';
-
-export interface ForwarderConfig {
-  baseUrl?: string;
-  defaultHeaders?: Record<string, string>;
-  /** Request timeout in milliseconds. Applied via AbortSignal to every
-   *  outbound fetch. Default: 30_000 (30s). Previously declared but not
-   *  wired — an upstream hang would leak file descriptors indefinitely. */
-  timeout?: number;
-  /** Hard cap on inbound JSON body size (bytes) read by `createProxyHandler`.
-   *  Requests larger than this are rejected with 413. Default: 1 MiB. */
-  maxBodyBytes?: number;
-}
-
-export interface RequestOptions {
-  method?: string;
-  headers?: Record<string, string>;
-  body?: unknown;
-  searchParams?: Record<string, string | undefined>;
-  stream?: boolean;
-}
-
-const DEFAULT_TIMEOUT_MS = 30_000;
-const DEFAULT_MAX_BODY_BYTES = 1024 * 1024; // 1 MiB
-
-/** Headers that are safe to forward from an inbound request to the upstream.
- *  `createProxyHandler` previously copied every inbound header — including
- *  `cookie`, attacker-set `x-forwarded-for`, and the consumer app's session
- *  cookies — to an arbitrary upstream. Only the headers that carry request
- *  semantics (auth + content negotiation + a request id for tracing) are
- *  preserved now. */
-const FORWARDABLE_REQUEST_HEADERS = new Set([
-  'authorization',
-  'content-type',
-  'accept',
-  'accept-language',
-  'x-request-id',
-  'x-correlation-id',
-  'idempotency-key',
-]);
-
-/** Build the outbound URL by resolving `path` relative to `baseUrl`. Using
- *  the URL constructor here (instead of string concatenation) prevents a
- *  path like ".evil.com/x" from producing an unintended host.
- *  Throws if the resolved URL escapes the baseUrl origin. */
-function resolveUrl(baseUrl: string, path: string): string {
-  // Ensure baseUrl ends with '/' so URL() treats it as a directory root.
-  const baseForResolve = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
-  // Drop leading '/' on path so it doesn't replace the baseUrl pathname.
-  const rel = path.startsWith('/') ? path.slice(1) : path;
-  const resolved = new URL(rel, baseForResolve);
-  const base = new URL(baseForResolve);
-  if (resolved.origin !== base.origin) {
-    throw new Error(`forwarder: resolved URL ${resolved.origin} escapes baseUrl origin ${base.origin}`);
-  }
-  return resolved.toString();
-}
-
-/**
- * Forward a request to a backend URL
- */
-export async function forwardRequest(
-  path: string,
-  options: RequestOptions = {},
-  config: ForwarderConfig = {}
-): Promise<Response> {
-  const baseUrl = config.baseUrl || DEFAULT_TASK_NETWORK_URL;
-  const { method = 'GET', headers = {}, body, searchParams, stream } = options;
-
-  // Build URL safely, then attach search params.
-  const urlObj = new URL(resolveUrl(baseUrl, path));
-  if (searchParams) {
-    Object.entries(searchParams).forEach(([key, value]) => {
-      if (value !== undefined) {
-        urlObj.searchParams.set(key, value);
-      }
-    });
-  }
-
-  const fetchOptions: RequestInit = {
-    method,
-    headers: {
-      ...config.defaultHeaders,
-      ...headers,
-    },
-    signal: AbortSignal.timeout(config.timeout ?? DEFAULT_TIMEOUT_MS),
-  };
-
-  if (body && method !== 'GET') {
-    fetchOptions.headers = {
-      ...fetchOptions.headers,
-      'Content-Type': 'application/json',
-    };
-    fetchOptions.body = JSON.stringify(body);
-  }
-
-  const response = await fetch(urlObj.toString(), fetchOptions);
-
-  // For streaming responses, return directly
-  if (stream && response.body) {
-    return response;
-  }
-
-  return response;
-}
-
-/**
- * Forward and return JSON response
- */
-export async function forwardJSON<T = unknown>(
-  path: string,
-  options: RequestOptions = {},
-  config: ForwarderConfig = {}
-): Promise<{ data: T; status: number }> {
-  const response = await forwardRequest(path, options, config);
-  const data = await response.json();
-  return { data, status: response.status };
-}
-
-/** Read a request body with a hard byte cap. Returns `null` if the body
- *  exceeds the cap, so the caller can return 413 without first buffering
- *  an attacker-sized payload into memory. */
-async function readBodyCapped(request: Request, maxBytes: number): Promise<unknown | { _tooLarge: true }> {
-  const contentLength = request.headers.get('content-length');
-  if (contentLength) {
-    const n = parseInt(contentLength, 10);
-    if (Number.isFinite(n) && n > maxBytes) return { _tooLarge: true };
-  }
-  if (!request.body) return undefined;
-  const reader = request.body.getReader();
-  let received = 0;
-  const chunks: Uint8Array[] = [];
-  // Streaming read with byte cap — aborts as soon as the cap is exceeded.
-  // eslint-disable-next-line no-constant-condition
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    received += value.byteLength;
-    if (received > maxBytes) {
-      try { await reader.cancel(); } catch { /* ignore */ }
-      return { _tooLarge: true };
-    }
-    chunks.push(value);
-  }
-  if (received === 0) return undefined;
-  const buf = new Uint8Array(received);
-  let offset = 0;
-  for (const c of chunks) { buf.set(c, offset); offset += c.byteLength; }
-  const text = new TextDecoder().decode(buf);
-  if (text.trim() === '') return undefined;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Create a proxy handler that forwards requests.
- *
- * SECURITY: only a small whitelist of inbound headers is forwarded (see
- * FORWARDABLE_REQUEST_HEADERS). Everything else — including `cookie`,
- * `x-forwarded-for`, `host` — is stripped so a caller cannot poison the
- * upstream's view of the request or smuggle the consumer app's cookies to
- * a third-party StackNet endpoint.
- */
-export function createProxyHandler(
-  path: string | ((req: Request) => string),
-  config: ForwarderConfig = {}
-) {
-  const maxBodyBytes = config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
-
-  return async (request: Request): Promise<Response> => {
-    const url = new URL(request.url);
-    const targetPath = typeof path === 'function' ? path(request) : path;
-
-    // Forward search params
-    const searchParams: Record<string, string> = {};
-    url.searchParams.forEach((value, key) => {
-      searchParams[key] = value;
-    });
-
-    let body: unknown = undefined;
-    if (request.method !== 'GET' && request.method !== 'HEAD') {
-      const read = await readBodyCapped(request, maxBodyBytes);
-      if (read && typeof read === 'object' && (read as { _tooLarge?: boolean })._tooLarge) {
-        return Response.json(
-          { error: `Request body exceeds ${maxBodyBytes} bytes` },
-          { status: 413 },
-        );
-      }
-      body = read;
-    }
-
-    // Forward ONLY the whitelisted headers.
-    const requestHeaders: Record<string, string> = {};
-    request.headers.forEach((value, key) => {
-      if (FORWARDABLE_REQUEST_HEADERS.has(key.toLowerCase())) {
-        requestHeaders[key] = value;
-      }
-    });
-
-    const response = await forwardRequest(
-      targetPath,
-      {
-        method: request.method,
-        headers: requestHeaders,
-        body,
-        searchParams,
-      },
-      config
-    );
-
-    // Check if streaming response
-    const contentType = response.headers.get('content-type') || '';
-    if (contentType.includes('text/event-stream')) {
-      return new Response(response.body, {
-        status: response.status,
-        headers: {
-          'Content-Type': 'text/event-stream',
-          'Cache-Control': 'no-cache',
-          'Connection': 'keep-alive',
-        },
-      });
-    }
-
-    // Return JSON response
-    const data = await response.json();
-    return Response.json(data, { status: response.status });
-  };
-}

package/src/proxy/index.ts

@@ -1,32 +0,0 @@
-/**
- * @stacknet/stacks - Proxy utilities
- */
-
-export {
-  forwardRequest,
-  forwardJSON,
-  createProxyHandler,
-  type ForwarderConfig,
-  type RequestOptions,
-} from './forwarder';
-
-export {
-  createAgentRoutes,
-  createAgentDetailRoutes,
-  createAgentExecuteRoute,
-  createAgentToggleRoutes,
-  createSkillRoutes,
-  createSkillDetailRoutes,
-  createWidgetRoutes,
-  createWidgetDetailRoutes,
-  createImaginationRoutes,
-  // Stack management routes
-  createStackRoutes,
-  createStackDetailRoutes,
-  createStackKeysRoutes,
-  createStackMembersRoutes,
-  type RouteHandlerConfig,
-  type StackRouteHandlerConfig,
-  type RouteHandler,
-  type CRUDRouteHandlers,
-} from './route-handlers';