@stigmer/server 3.40.0 → 3.41.0

package/src/boot/oauth-redirect-uri.ts

@@ -7,32 +7,55 @@
  * console's callback page. A local install (`stigmer up`, the desktop app,
  * the all-in-one image) never set it, and `initiateOAuthConnect` refuses
  * without it, so every Sign in surface the console offers was dead on a
- * local install. The posture that already decides how a served console
- * signs its users in (`trusted-local` when no issuer is configured) answers
- * this too: a server that serves the console on its unified port is
- * reached by a browser on the machine it runs on, so its callback is the
- * console's callback page at `http://localhost:<port>`, the same host the
- * config already assumes for `SKILL_TRANSFER_BASE_URL`.
+ * local install. A server that serves the console on its unified port knows
+ * where that console is: the callback is the console's callback page on the
+ * origin browsers reach the unified port on.
+ *
+ * That origin is `SKILL_TRANSFER_BASE_URL` when the operator named one. The
+ * team shapes fill it from the address they were told clients reach the
+ * server on (Compose's `STIGMER_PUBLIC_URL`, the chart's `server.publicUrl`
+ * or its Ingress API host), and the console is served on that same origin,
+ * so its callback page is there too. Unnamed, the server is reached by a
+ * browser on the machine it runs on (`stigmer up`, the desktop app, the
+ * all-in-one image), and the origin is `http://localhost:<port>`, the host
+ * the skill transfer lane derives on (boot/skill-transfer-origin.ts). Before
+ * the public origin was read here, a Compose or Helm console reached over
+ * the network sent its operator's browser to their own localhost
+ * (stigmer#1200).
  *
  * The rules, in order: a configured value always wins; a server that
  * serves no console derives nothing (the CLI and the SDKs need no
- * callback, and today's warn and refusal stand); a server whose port is
- * not yet known (an ephemeral `0`, the test harness's shape) derives
- * nothing either. The console's callback route is the web app's
- * `app/auth/oauth/callback/page.tsx`; its path is a constant here because
- * this is the one place the server names it.
+ * callback, and today's warn and refusal stand); a named public origin
+ * derives the callback on it, whatever the port; a known port derives it on
+ * localhost; a server whose port is not yet known (an ephemeral `0`, the
+ * test harness's shape) derives nothing. The console's callback route is
+ * the web app's `client-apps/web/src/app/auth/oauth/callback/page.tsx`; its
+ * path is a constant here because this is the one place the server names
+ * it.
  *
- * Proven by __tests__/oauth-redirect-uri.test.ts.
+ * Proven by __tests__/oauth-redirect-uri.test.ts and the MCP OAuth callback
+ * case of __tests__/compose.test.ts.
  */
 
 /** The console's OAuth callback page, relative to the served console's origin. */
 export const CONSOLE_OAUTH_CALLBACK_PATH = "/auth/oauth/callback";
 
+/** Which origin a derived callback was rendered on. */
+export type DerivedOAuthRedirectOrigin =
+  /** The operator's `SKILL_TRANSFER_BASE_URL`: the unified port's public origin. */
+  | "public-origin"
+  /** The unified port on localhost: a browser on the server's own machine. */
+  | "loopback";
+
 export type OAuthRedirectUriResolution =
   /** The operator's value, as configured. */
   | { readonly kind: "configured"; readonly uri: string }
   /** Derived from the served console's own origin. */
-  | { readonly kind: "derived"; readonly uri: string }
+  | {
+      readonly kind: "derived";
+      readonly uri: string;
+      readonly from: DerivedOAuthRedirectOrigin;
+    }
   /** Nothing to hand the login server; initiate refuses with the pinned copy. */
   | { readonly kind: "absent" };
 
@@ -41,13 +64,35 @@ export interface OAuthRedirectUriInputs {
   readonly configured: string;
   /** Whether this server serves the web console on its unified port. */
   readonly servesConsole: boolean;
+  /** `SKILL_TRANSFER_BASE_URL` as loaded: the unified port's public origin; empty when unset. */
+  readonly publicOrigin: string;
   /** The port the unified listener binds; 0 means "not known until listen". */
   readonly port: number;
 }
 
 /** The callback URL the McpServer OAuth flows use, and where it came from. */
-export function resolveOAuthRedirectUri(inputs: OAuthRedirectUriInputs): OAuthRedirectUriResolution {
-  if (inputs.configured !== "") return { kind: "configured", uri: inputs.configured };
-  if (!inputs.servesConsole || inputs.port === 0) return { kind: "absent" };
-  return { kind: "derived", uri: `http://localhost:${inputs.port}${CONSOLE_OAUTH_CALLBACK_PATH}` };
+export function resolveOAuthRedirectUri(
+  inputs: OAuthRedirectUriInputs,
+): OAuthRedirectUriResolution {
+  if (inputs.configured !== "")
+    return { kind: "configured", uri: inputs.configured };
+  if (!inputs.servesConsole) return { kind: "absent" };
+  if (inputs.publicOrigin !== "") {
+    return {
+      kind: "derived",
+      uri: `${trimTrailingSlash(inputs.publicOrigin)}${CONSOLE_OAUTH_CALLBACK_PATH}`,
+      from: "public-origin",
+    };
+  }
+  if (inputs.port === 0) return { kind: "absent" };
+  return {
+    kind: "derived",
+    uri: `http://localhost:${inputs.port}${CONSOLE_OAUTH_CALLBACK_PATH}`,
+    from: "loopback",
+  };
+}
+
+/** An origin written `https://host/` names the same origin as `https://host` (the skill lane's join). */
+function trimTrailingSlash(origin: string): string {
+  return origin.endsWith("/") ? origin.slice(0, -1) : origin;
 }

package/src/boot/skill-transfer-origin.ts

@@ -1,17 +1,32 @@
 /**
- * Whether the skill transfer lane's origin can be reached by the callers
- * it is minted for.
+ * The skill transfer lane's origin: where its capability URLs point, and
+ * whether the callers they are minted for can reach it.
  *
  * On the local blob driver the server itself carries artifact bytes over
  * HTTP, and every upload and download capability URL it mints is rendered
- * from `SKILL_TRANSFER_BASE_URL`, which defaults to the server's own
- * loopback. That default is right for a single-operator install reached
- * on the machine it runs on, and silently wrong for a hosted one: the
- * server boots, serves, and passes every in-process check while handing
- * the CLI, the SDKs and the sandbox runner a host none of them can reach —
- * every push above the gRPC cap fails on the PUT and every sandbox mount
- * of a skill with supporting files loses them (stigmer#1219). No test
- * inside the process can see it, so the process says it at boot.
+ * from one base. `SKILL_TRANSFER_BASE_URL` sets it; unset, it is the
+ * server's own port on localhost, and this module is the one place that
+ * says how. The rules, in order: a configured value always wins; a unified
+ * port the composition knows renders `http://localhost:<port>` once; a
+ * unified port of 0 (`GRPC_PORT=0`, and the `portOverride: 0` test seam)
+ * is not known until listen, so the base reads the port the listener
+ * actually bound. Deriving from the configured port instead minted URLs
+ * for `localhost:0`, or for the config default under a port override,
+ * where nothing listens (stigmer#1386). The unified port binds last in
+ * start(), and every minting RPC arrives through it, so a read before the
+ * bind is a construction-order fault and throws rather than minting a URL
+ * for a port nothing listens on: the artifact lane's rule
+ * (boot/artifact-lane.ts).
+ *
+ * The loopback default is right for a single-operator install reached on
+ * the machine it runs on, and silently wrong for a hosted one: the server
+ * boots, serves, and passes every in-process check while handing the CLI,
+ * the SDKs and the sandbox runner a host none of them can reach — every
+ * push above the gRPC cap fails on the PUT and every sandbox mount of a
+ * skill with supporting files loses them (stigmer#1219). No test inside
+ * the process can see it, so the process says it at boot. The verdict
+ * judges the configuration, not a rendered URL: an unset base is loopback
+ * by construction, whatever port it later reads.
  *
  * The hosted signal is the require-authentication posture (boot/compose.ts
  * combines its two sources): a server that requires credentials serves
@@ -20,8 +35,44 @@
  * is moot there and says so rather than warning about a knob nothing
  * reads.
  *
- * Proven by __tests__/skill-transfer-origin.test.ts.
+ * Proven by __tests__/skill-transfer-origin.test.ts and the transfer lane
+ * case of __tests__/compose.test.ts.
+ */
+
+export interface SkillTransferBaseUrlInputs {
+  /** `SKILL_TRANSFER_BASE_URL` as loaded; empty when unset. */
+  readonly configured: string;
+  /** The port the unified listener binds; 0 means "not known until listen". */
+  readonly unifiedPort: number;
+  /** The port the unified listener actually bound; undefined before listen. */
+  readonly boundPort: () => number | undefined;
+}
+
+/**
+ * The base the lane's capability URLs are rendered from: the configured
+ * value as given, the known unified port's loopback origin, or a resolver
+ * over the port the unified listener bound.
  */
+export function resolveSkillTransferBaseUrl(
+  inputs: SkillTransferBaseUrlInputs,
+): string | (() => string) {
+  if (inputs.configured !== "") return inputs.configured;
+  if (inputs.unifiedPort !== 0) return `http://localhost:${inputs.unifiedPort}`;
+  const { boundPort } = inputs;
+  return () => {
+    const port = boundPort();
+    if (port === undefined) {
+      throw new Error(
+        "skill transfer URL requested before the unified port bound",
+      );
+    }
+    return `http://localhost:${port}`;
+  };
+}
+
+/** What the boot warning names when the operator set no base. */
+export const UNSET_BASE_URL_NOTE =
+  "(unset: derived from the server's own port on localhost)";
 
 /** Hosts that name the process's own machine and nothing beyond it. */
 const LOOPBACK_HOSTS = new Set([
@@ -33,7 +84,7 @@ const LOOPBACK_HOSTS = new Set([
 ]);
 
 export type SkillTransferOriginVerdict =
-  /** The base URL names a host other than the server's own loopback. */
+  /** The configured base names a host other than the server's own loopback. */
   | { readonly kind: "reachable" }
   /** Loopback on a single-operator install: the default, and correct. */
   | { readonly kind: "loopback-local" }
@@ -43,8 +94,8 @@ export type SkillTransferOriginVerdict =
   | { readonly kind: "unused" };
 
 export interface SkillTransferOriginInputs {
-  /** The configured or defaulted `SKILL_TRANSFER_BASE_URL`. */
-  readonly baseUrl: string;
+  /** `SKILL_TRANSFER_BASE_URL` as loaded; empty (the loopback default) when unset. */
+  readonly configured: string;
   /** Whether the local driver relays artifact bytes through this server. */
   readonly relaysThroughServer: boolean;
   /** The composed require-authentication posture. */
@@ -57,11 +108,15 @@ export function assessSkillTransferOrigin(
   if (!inputs.relaysThroughServer) {
     return { kind: "unused" };
   }
-  if (!namesLoopback(inputs.baseUrl)) {
+  if (inputs.configured !== "" && !namesLoopback(inputs.configured)) {
     return { kind: "reachable" };
   }
   return inputs.requireAuthentication
-    ? { kind: "loopback-hosted", baseUrl: inputs.baseUrl }
+    ? {
+        kind: "loopback-hosted",
+        baseUrl:
+          inputs.configured === "" ? UNSET_BASE_URL_NOTE : inputs.configured,
+      }
     : { kind: "loopback-local" };
 }
 

package/src/domain/agent/__tests__/agent.test.ts

@@ -14,7 +14,10 @@
  *   - cascade delete (oss#611): ALL instances of the agent are swept by
  *     spec.agent_id — including a cross-ORG instance — same-org shares are
  *     deleted, cross-org shares of the same agent SURVIVE, and a
- *     bystander agent's instances are untouched.
+ *     bystander agent's instances are untouched;
+ *   - the server assigns a new agent's id (stigmer#1266): an id the
+ *     request carries is replaced, on create and on an apply that
+ *     creates, and the chosen id addresses nothing.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -41,6 +44,7 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 import { ResourceNotFoundError } from "../../../store/interface.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -82,6 +86,7 @@ beforeAll(async () => {
   });
   const port = await server.start();
   transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+  await seedOrganizations(transport, [ORG, "globex"]);
   command = createClient(AgentCommandController, transport);
   query = createClient(AgentQueryController, transport);
   instanceCommand = createClient(AgentInstanceCommandController, transport);
@@ -420,6 +425,42 @@ describe("agent cascade delete (oss#611)", () => {
   });
 });
 
+describe("agent create — the server assigns the id (stigmer#1266)", () => {
+  const CHOSEN_ID = "agt_01hzzzzzzzzzzzzzzzzzzzzzzz";
+
+  async function expectMintedNotChosen(created: {
+    metadata?: { id: string };
+  }): Promise<void> {
+    const id = created.metadata?.id ?? "";
+    expect(id).toMatch(/^agt_[0-9a-hjkmnp-tv-z]{26}$/);
+    expect(id).not.toBe(CHOSEN_ID);
+    const fetched = await query.get({ value: id });
+    expect(fetched.metadata?.id).toBe(id);
+    const missing = await grpcError(() => query.get({ value: CHOSEN_ID }));
+    expect(missing.code).toBe(Code.NotFound);
+  }
+
+  it("create replaces a client-supplied id with a minted one", async () => {
+    const input = agentInput();
+    const created = await command.create({
+      ...input,
+      metadata: { ...input.metadata, id: CHOSEN_ID },
+    });
+    await expectMintedNotChosen(created);
+    await command.delete({ value: created.metadata?.id ?? "" });
+  });
+
+  it("an apply that creates (an exported manifest re-applied) replaces the id too", async () => {
+    const input = agentInput();
+    const applied = await command.apply({
+      ...input,
+      metadata: { ...input.metadata, id: CHOSEN_ID },
+    });
+    await expectMintedNotChosen(applied);
+    await command.delete({ value: applied.metadata?.id ?? "" });
+  });
+});
+
 describe("agent create — CreateDefaultInstance failure wire contract (oss#852)", () => {
   it("answers the inner code with Go's %w-wrapped transport-formatted message", async () => {
     // Pre-occupy the deterministic default-instance slug with an instance

package/src/domain/agentchannel/__tests__/agentchannel.test.ts

@@ -61,6 +61,7 @@ import {
   providerImmutableMessage,
   sameOrgInvariantMessage,
 } from "../constants.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -106,6 +107,14 @@ beforeAll(async () => {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [
+    ORG,
+    "acme",
+    "channel-other-org",
+    "channel-bystander-org",
+    "channel-apply-org",
+    "channel-list-org",
+  ]);
   channels = createClient(AgentChannelCommandController, transport);
   query = createClient(AgentChannelQueryController, transport);
   agents = createClient(AgentCommandController, transport);

package/src/domain/agentchannel/__tests__/channel-runtime.test.ts

@@ -68,6 +68,7 @@ import { createLogger } from "../../../boot/logger.js";
 import { invalidArgumentError } from "../../../pipeline/errors.js";
 import type { CallerIdentity } from "../../../extensions/identity.js";
 import type { ChannelRuntime } from "../channel-runtime.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -273,6 +274,7 @@ beforeAll(async () => {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [ORG]);
   channels = createClient(AgentChannelCommandController, transport);
   query = createClient(AgentChannelQueryController, transport);
   agents = createClient(AgentCommandController, transport);

package/src/domain/agentchannel/__tests__/create-authorization.test.ts

@@ -1,9 +1,10 @@
 /**
  * Pins the create lane's authorization question (steps.ts,
- * resolveChannelCreateTargets): can_edit on the REFERENCED AGENT with the
- * Java handler's copy, and nothing on the organization (the same-org
- * invariant already binds the channel to the agent's); a missing
- * referenced agent throws.
+ * resolveChannelCreateTargets): can_manage_audience on the REFERENCED AGENT
+ * with the Java handler's copy (binding a channel widens who reaches the
+ * agent, the owner's decision, so an editor's can_edit is not enough), and
+ * nothing on the organization (the same-org invariant already binds the
+ * channel to the agent's); a missing referenced agent throws.
  */
 import { describe, expect, it } from "vitest";
 import { create } from "@bufbuild/protobuf";
@@ -39,10 +40,10 @@ function ctxFor(stash = true) {
 }
 
 describe("resolveChannelCreateTargets", () => {
-  it("asks can_edit on the referenced agent and nothing else", () => {
+  it("asks can_manage_audience on the referenced agent and nothing else", () => {
     expect(resolveChannelCreateTargets(ctxFor())).toEqual([
       {
-        permission: IamPermission.can_edit,
+        permission: IamPermission.can_manage_audience,
         resourceKind: ApiResourceKind.agent,
         resourceId: "agt_01target",
         deniedMessage: CHANNEL_CREATE_DENIED_MESSAGE,

package/src/domain/agentchannel/steps.ts

@@ -190,12 +190,14 @@ export const CHANNEL_CREATE_DENIED_MESSAGE =
 
 /**
  * The create lane's authorization question, for AuthorizeResolvedTarget
- * after ResolveChannelDefaults: can_edit on the REFERENCED AGENT. The RPC
- * is is_skip_authorization because its target is that agent, resolved from
- * a slug, not a request field. Binding an agent to a channel puts it in
- * front of a wider audience, an editor's act; the same-org invariant the
- * resolve step enforces already binds the channel's organization to the
- * agent's, so there is no separate organization bar (command.proto).
+ * after ResolveChannelDefaults: can_manage_audience on the REFERENCED AGENT.
+ * The RPC is is_skip_authorization because its target is that agent,
+ * resolved from a slug, not a request field. Binding an agent to a channel
+ * puts it in front of a wider audience, so it decides who reaches the agent:
+ * the owner's act, never an editor's, who may change the definition but not
+ * its audience. The same-org invariant the resolve step enforces already
+ * binds the channel's organization to the agent's, so there is no separate
+ * organization bar (command.proto).
  */
 export function resolveChannelCreateTargets(
   ctx: RequestContext<AgentChannelDesc>,
@@ -206,7 +208,7 @@ export function resolveChannelCreateTargets(
   }
   return [
     {
-      permission: IamPermission.can_edit,
+      permission: IamPermission.can_manage_audience,
       resourceKind: ApiResourceKind.agent,
       resourceId: agent.metadata?.id ?? "",
       deniedMessage: CHANNEL_CREATE_DENIED_MESSAGE,