@synergenius/flow-weaver 0.33.2 → 0.44.0

package/dist/agent/device-connection.js

@@ -1,184 +0,0 @@
-/**
- * Device Connection — WebSocket client for connecting a local machine
- * to the Flow Weaver platform as a mounted device.
- *
- * This is the transport layer. Packs register their own request handlers
- * on top of this connection (e.g., improve status, bot management).
- *
- * The platform relays Studio requests to connected devices and forwards
- * device events to Studio subscribers.
- */
-export class DeviceConnection {
-    ws = null;
-    heartbeatInterval = null;
-    reconnectTimeout = null;
-    requestHandlers = new Map();
-    connected = false;
-    shouldReconnect = true;
-    options;
-    deviceInfo;
-    log;
-    constructor(options) {
-        this.options = options;
-        this.log = options.logger ?? (() => { });
-        const os = require('node:os');
-        this.deviceInfo = {
-            name: options.deviceName ?? os.hostname(),
-            hostname: os.hostname(),
-            projectDir: options.projectDir,
-            platform: process.platform,
-            capabilities: [],
-        };
-    }
-    /**
-     * Add a capability to advertise to the platform.
-     */
-    addCapability(capability) {
-        if (!this.deviceInfo.capabilities.includes(capability)) {
-            this.deviceInfo.capabilities.push(capability);
-        }
-    }
-    /**
-     * Set the list of packs that contributed device handlers.
-     * The platform uses this to auto-install packs in the user's workspace.
-     */
-    setPacks(packs) {
-        this.deviceInfo.packs = packs;
-    }
-    /**
-     * Register a handler for incoming requests from the platform.
-     */
-    onRequest(method, handler) {
-        this.requestHandlers.set(method, handler);
-    }
-    /**
-     * Connect to the platform. Reconnects automatically on disconnect.
-     */
-    async connect() {
-        const wsUrl = this.options.platformUrl
-            .replace(/^http/, 'ws')
-            .replace(/\/$/, '') + '/ws/device';
-        this.log(`Connecting to ${wsUrl}...`);
-        this.shouldReconnect = true;
-        return new Promise((resolve, reject) => {
-            try {
-                this.ws = new WebSocket(`${wsUrl}?token=${encodeURIComponent(this.options.token)}`);
-            }
-            catch (err) {
-                reject(err);
-                return;
-            }
-            this.ws.addEventListener('open', () => {
-                this.connected = true;
-                this.log(`Connected as "${this.deviceInfo.name}"`);
-                // Send device registration
-                this.send({ type: 'device:register', device: this.deviceInfo });
-                // Start heartbeat
-                this.heartbeatInterval = setInterval(() => {
-                    if (this.ws?.readyState === WebSocket.OPEN) {
-                        this.send({ type: 'heartbeat', timestamp: Date.now() });
-                    }
-                }, 30_000);
-                this.options.onConnect?.();
-                resolve();
-            });
-            this.ws.addEventListener('message', async (event) => {
-                try {
-                    const msg = JSON.parse(typeof event.data === 'string' ? event.data : String(event.data));
-                    await this.handleMessage(msg);
-                }
-                catch (err) {
-                    this.log(`Parse error: ${err instanceof Error ? err.message : err}`);
-                }
-            });
-            this.ws.addEventListener('close', (event) => {
-                this.connected = false;
-                if (this.heartbeatInterval)
-                    clearInterval(this.heartbeatInterval);
-                this.options.onDisconnect?.(event.code);
-                if (this.shouldReconnect) {
-                    this.log(`Disconnected (${event.code}). Reconnecting in 5s...`);
-                    this.scheduleReconnect();
-                }
-            });
-            this.ws.addEventListener('error', () => {
-                if (!this.connected) {
-                    reject(new Error('WebSocket connection failed'));
-                }
-                else {
-                    this.log('Connection error');
-                }
-            });
-        });
-    }
-    /**
-     * Emit an event to the platform.
-     */
-    emit(event) {
-        if (!this.connected)
-            return;
-        this.send({ type: 'device:event', event });
-        this.options.onEvent?.(event);
-    }
-    /**
-     * Disconnect from the platform. No auto-reconnect.
-     */
-    disconnect() {
-        this.shouldReconnect = false;
-        if (this.heartbeatInterval)
-            clearInterval(this.heartbeatInterval);
-        if (this.reconnectTimeout)
-            clearTimeout(this.reconnectTimeout);
-        if (this.ws) {
-            this.ws.close(1000, 'Device disconnecting');
-            this.ws = null;
-        }
-        this.connected = false;
-    }
-    isConnected() {
-        return this.connected;
-    }
-    getDeviceInfo() {
-        return this.deviceInfo;
-    }
-    // --- Private ---
-    send(msg) {
-        if (this.ws?.readyState === WebSocket.OPEN) {
-            this.ws.send(JSON.stringify(msg));
-        }
-    }
-    async handleMessage(msg) {
-        const type = String(msg.type ?? '');
-        const requestId = String(msg.requestId ?? '');
-        if (type === 'request') {
-            const method = String(msg.method ?? '');
-            const params = msg.params ?? {};
-            const handler = this.requestHandlers.get(method);
-            if (!handler) {
-                this.send({ type: 'response', requestId, success: false, error: `Unknown method: ${method}` });
-                return;
-            }
-            try {
-                const result = await handler(method, params);
-                this.send({ type: 'response', requestId, success: true, result });
-            }
-            catch (err) {
-                this.send({ type: 'response', requestId, success: false, error: err instanceof Error ? err.message : String(err) });
-            }
-        }
-    }
-    scheduleReconnect() {
-        if (this.reconnectTimeout)
-            clearTimeout(this.reconnectTimeout);
-        this.reconnectTimeout = setTimeout(async () => {
-            try {
-                await this.connect();
-            }
-            catch {
-                this.log('Reconnect failed. Retrying in 10s...');
-                this.reconnectTimeout = setTimeout(() => this.scheduleReconnect(), 10_000);
-            }
-        }, 5_000);
-    }
-}
-//# sourceMappingURL=device-connection.js.map

package/dist/agent/env-allowlist.js

@@ -1,60 +0,0 @@
-/**
- * Allowlisted environment variables for spawned CLI processes.
- *
- * Only these variables are forwarded from the host process to prevent
- * leaking secrets, user identity, SSH agent sockets, workspace paths,
- * and other sensitive host data to AI CLI tools.
- */
-/**
- * Minimal PATH for sandboxed AI CLI processes. Contains only standard
- * system directories. CLI binaries are invoked via `process.execPath`
- * (node) directly, bypassing shebang resolution, so the node binary
- * directory is NOT needed here.
- */
-export const MINIMAL_PATH = '/usr/local/bin:/usr/bin:/bin';
-export const ENV_ALLOWLIST = [
-    // System basics
-    'PATH',
-    'LANG',
-    'LC_ALL',
-    'LC_CTYPE',
-    'TERM',
-    'TMPDIR',
-    'TZ',
-    // Node/runtime
-    'NODE_ENV',
-    'NO_COLOR',
-    'FORCE_COLOR',
-    // TLS/certificates
-    'NODE_EXTRA_CA_CERTS',
-    'SSL_CERT_FILE',
-    'SSL_CERT_DIR',
-    // Network proxy (needed behind corporate proxies)
-    'HTTP_PROXY',
-    'HTTPS_PROXY',
-    'NO_PROXY',
-];
-/**
- * Build a safe environment object from the current process, forwarding
- * only allowlisted keys. Callers can spread additional overrides on top.
- */
-export function buildSafeEnv(overrides) {
-    const env = {};
-    for (const key of ENV_ALLOWLIST) {
-        if (process.env[key] !== undefined) {
-            env[key] = process.env[key];
-        }
-    }
-    if (overrides) {
-        Object.assign(env, overrides);
-    }
-    return env;
-}
-/**
- * Convenience helper that returns both `cwd` and `env` in one object,
- * making it harder to forget either when spawning a child process.
- */
-export function buildSafeSpawnOpts(cwd, envOverrides) {
-    return { cwd, env: buildSafeEnv(envOverrides) };
-}
-//# sourceMappingURL=env-allowlist.js.map

package/dist/agent/providers/anthropic.js

@@ -1,198 +0,0 @@
-/**
- * Anthropic API provider — streams messages via raw fetch + SSE parsing.
- * No SDK dependency. Uses only Node.js native fetch (available since Node 18).
- *
- * Adapted from pack-weaver's streamAnthropicWithTools.
- */
-/**
- * Convert a SplitPrompt to Anthropic's system content block array.
- * The prefix gets cache_control for prompt caching; the suffix does not.
- */
-function buildSystemBlocks(prompt) {
-    const blocks = [
-        { type: 'text', text: prompt.prefix, cache_control: { type: 'ephemeral' } },
-    ];
-    if (prompt.suffix) {
-        blocks.push({ type: 'text', text: prompt.suffix });
-    }
-    return blocks;
-}
-export class AnthropicProvider {
-    apiKey;
-    model;
-    maxTokens;
-    baseUrl;
-    constructor(options) {
-        if (!options.apiKey) {
-            throw new Error('AnthropicProvider requires an API key');
-        }
-        this.apiKey = options.apiKey;
-        this.model = options.model ?? 'claude-sonnet-4-20250514';
-        this.maxTokens = options.maxTokens ?? 8192;
-        this.baseUrl = options.baseUrl ?? 'https://api.anthropic.com';
-    }
-    async *stream(messages, tools, options) {
-        const model = options?.model ?? this.model;
-        const maxTokens = options?.maxTokens ?? this.maxTokens;
-        // Build Anthropic API request body
-        const apiMessages = messages.map((m) => {
-            if (m.role === 'tool') {
-                return {
-                    role: 'user',
-                    content: [{ type: 'tool_result', tool_use_id: m.toolCallId, content: m.content }],
-                };
-            }
-            if (m.role === 'assistant' && m.toolCalls?.length) {
-                const blocks = [];
-                if (m.content)
-                    blocks.push({ type: 'text', text: m.content });
-                for (const tc of m.toolCalls) {
-                    blocks.push({ type: 'tool_use', id: tc.id, name: tc.name, input: tc.arguments });
-                }
-                return { role: 'assistant', content: blocks };
-            }
-            return { role: m.role, content: m.content };
-        });
-        const apiTools = tools.map((t) => ({
-            name: t.name,
-            description: t.description,
-            input_schema: t.inputSchema,
-        }));
-        const body = JSON.stringify({
-            model,
-            max_tokens: maxTokens,
-            stream: true,
-            ...(options?.systemPrompt ? { system: buildSystemBlocks(options.systemPrompt) } : {}),
-            messages: apiMessages,
-            ...(apiTools.length > 0 ? { tools: apiTools } : {}),
-        });
-        const response = await fetch(`${this.baseUrl}/v1/messages`, {
-            method: 'POST',
-            headers: {
-                'x-api-key': this.apiKey,
-                'anthropic-version': '2025-04-15',
-                'content-type': 'application/json',
-            },
-            body,
-            signal: options?.signal ?? AbortSignal.timeout(300_000),
-        });
-        if (!response.ok) {
-            const err = await response.text();
-            throw new Error(`Anthropic API error ${response.status}: ${err.slice(0, 200)}`);
-        }
-        if (!response.body)
-            throw new Error('No response body');
-        // Parse SSE stream
-        const reader = response.body.getReader();
-        const decoder = new TextDecoder();
-        let buffer = '';
-        const activeToolUses = new Map();
-        try {
-            while (true) {
-                const { done, value } = await reader.read();
-                if (done)
-                    break;
-                buffer += decoder.decode(value, { stream: true });
-                const lines = buffer.split('\n');
-                buffer = lines.pop() || '';
-                for (const line of lines) {
-                    if (!line.startsWith('data: '))
-                        continue;
-                    const jsonStr = line.slice(6).trim();
-                    if (jsonStr === '[DONE]')
-                        continue;
-                    let event;
-                    try {
-                        event = JSON.parse(jsonStr);
-                    }
-                    catch {
-                        continue;
-                    }
-                    const eventType = event.type;
-                    if (eventType === 'content_block_start') {
-                        const block = event.content_block;
-                        const index = event.index;
-                        if (block.type === 'tool_use' && block.id && block.name) {
-                            activeToolUses.set(index, { id: block.id, name: block.name, jsonChunks: [] });
-                            yield { type: 'tool_use_start', id: block.id, name: block.name };
-                        }
-                    }
-                    if (eventType === 'content_block_delta') {
-                        const delta = event.delta;
-                        const index = event.index;
-                        if (delta.type === 'text_delta' && delta.text) {
-                            yield { type: 'text_delta', text: delta.text };
-                        }
-                        if (delta.type === 'thinking_delta' && delta.thinking) {
-                            yield { type: 'thinking_delta', text: delta.thinking };
-                        }
-                        if (delta.type === 'input_json_delta' && delta.partial_json !== undefined) {
-                            const active = activeToolUses.get(index);
-                            if (active) {
-                                active.jsonChunks.push(delta.partial_json);
-                                yield { type: 'tool_use_delta', id: active.id, partialJson: delta.partial_json };
-                            }
-                        }
-                    }
-                    if (eventType === 'content_block_stop') {
-                        const index = event.index;
-                        const active = activeToolUses.get(index);
-                        if (active) {
-                            activeToolUses.delete(index);
-                            let args = {};
-                            try {
-                                args = JSON.parse(active.jsonChunks.join(''));
-                            }
-                            catch {
-                                /* malformed */
-                            }
-                            yield { type: 'tool_use_end', id: active.id, arguments: args };
-                        }
-                    }
-                    if (eventType === 'message_start' && event.message?.usage) {
-                        const usage = event.message.usage;
-                        yield {
-                            type: 'usage',
-                            promptTokens: usage.input_tokens ?? 0,
-                            completionTokens: usage.output_tokens ?? 0,
-                        };
-                    }
-                    if (eventType === 'message_delta') {
-                        const delta = event.delta;
-                        if (event.usage) {
-                            const usage = event.usage;
-                            yield {
-                                type: 'usage',
-                                promptTokens: 0,
-                                completionTokens: usage.output_tokens ?? 0,
-                            };
-                        }
-                        if (delta?.stop_reason === 'tool_use') {
-                            yield { type: 'message_stop', finishReason: 'tool_calls' };
-                        }
-                        else if (delta?.stop_reason === 'end_turn') {
-                            yield { type: 'message_stop', finishReason: 'stop' };
-                        }
-                        else if (delta?.stop_reason === 'max_tokens') {
-                            yield { type: 'message_stop', finishReason: 'length' };
-                        }
-                        else if (delta?.stop_reason) {
-                            yield { type: 'message_stop', finishReason: 'stop' };
-                        }
-                    }
-                    if (eventType === 'error') {
-                        const errObj = event.error;
-                        throw new Error(`Anthropic stream error: ${errObj?.message ?? 'unknown'}`);
-                    }
-                }
-            }
-        }
-        finally {
-            reader.releaseLock();
-        }
-    }
-}
-export function createAnthropicProvider(options) {
-    return new AnthropicProvider(options);
-}
-//# sourceMappingURL=anthropic.js.map

package/dist/agent/providers/claude-cli.js

@@ -1,161 +0,0 @@
-/**
- * Claude CLI provider — spawns the Claude Code CLI with stream-json output
- * and MCP bridge for tool execution.
- *
- * Adapted from platform's streamClaudeCliChat. Platform-specific dependencies
- * (spawnSandboxed, getBinPath, config) are replaced with injectable options.
- */
-import { spawn as nodeSpawn } from 'node:child_process';
-import { joinSplitPrompt, } from '../types.js';
-import { StreamJsonParser } from '../streaming.js';
-import { createMcpBridge } from '../mcp-bridge.js';
-export class ClaudeCliProvider {
-    binPath;
-    cwd;
-    env;
-    model;
-    mcpConfigPath;
-    spawnFn;
-    timeout;
-    disallowedTools;
-    constructor(options = {}) {
-        this.binPath = options.binPath ?? 'claude';
-        this.cwd = options.cwd ?? process.cwd();
-        this.env = options.env ?? process.env;
-        this.model = options.model;
-        this.mcpConfigPath = options.mcpConfigPath;
-        this.disallowedTools = options.disallowedTools ?? [];
-        this.spawnFn = options.spawnFn ?? ((cmd, args, opts) => nodeSpawn(cmd, args, { ...opts, stdio: opts.stdio }));
-        this.timeout = options.timeout ?? 600_000;
-    }
-    async *stream(messages, tools, options) {
-        const model = options?.model ?? this.model;
-        // Format messages into a single prompt for -p mode
-        const prompt = formatPrompt(messages);
-        const systemPrompt = options?.systemPrompt
-            ? joinSplitPrompt(options.systemPrompt)
-            : undefined;
-        // Set up MCP bridge for tool access if tools are provided and no config given
-        let bridge = null;
-        let mcpConfigPath = this.mcpConfigPath;
-        if (tools.length > 0 && !mcpConfigPath) {
-            // Create MCP bridge with real executor so CLI tool calls go through our
-            // safety guards (path traversal, shrink detection, shell blocklist, etc.)
-            const executor = options?.executor ?? (async () => ({ result: 'Tool executor not provided', isError: true }));
-            bridge = await createMcpBridge(tools, executor, options?.onToolEvent);
-            mcpConfigPath = bridge.configPath;
-        }
-        const args = [
-            '-p',
-            '--verbose',
-            '--output-format',
-            'stream-json',
-            '--include-partial-messages',
-            '--setting-sources',
-            'user,local',
-            '--dangerously-skip-permissions',
-            '--permission-mode',
-            'bypassPermissions',
-            ...(systemPrompt ? ['--system-prompt', systemPrompt] : []),
-            ...(mcpConfigPath ? ['--mcp-config', mcpConfigPath, '--strict-mcp-config'] : []),
-            ...(this.disallowedTools.length > 0 ? ['--disallowed-tools', this.disallowedTools.join(' ')] : []),
-            ...(model ? ['--model', model] : []),
-        ];
-        // Spawn the CLI process
-        const spawnResult = this.spawnFn(this.binPath, args, { cwd: this.cwd, stdio: ['pipe', 'pipe', 'pipe'], env: this.env });
-        const child = 'child' in spawnResult ? spawnResult.child : spawnResult;
-        const spawnCleanup = 'cleanup' in spawnResult ? spawnResult.cleanup : undefined;
-        const signal = options?.signal;
-        if (signal) {
-            signal.addEventListener('abort', () => {
-                child.kill('SIGTERM');
-                setTimeout(() => {
-                    if (!child.killed)
-                        child.kill('SIGKILL');
-                }, 2000);
-            }, { once: true });
-        }
-        // Timeout — per-request override or provider default
-        const timeout = options?.timeout ?? this.timeout;
-        const timer = setTimeout(() => {
-            child.kill('SIGTERM');
-        }, timeout);
-        child.stdin.write(prompt);
-        child.stdin.end();
-        // Collect events from the parser
-        const events = [];
-        let done = false;
-        const parser = new StreamJsonParser((event) => {
-            events.push(event);
-        });
-        let stderrBuf = '';
-        child.stderr.on('data', (chunk) => {
-            stderrBuf += chunk.toString();
-        });
-        let stdoutBuffer = '';
-        child.stdout.on('data', (chunk) => {
-            stdoutBuffer += chunk.toString();
-            const lines = stdoutBuffer.split('\n');
-            stdoutBuffer = lines.pop() || '';
-            for (const line of lines) {
-                parser.feed(line);
-            }
-        });
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            // Process remaining buffer
-            if (stdoutBuffer.trim()) {
-                parser.feed(stdoutBuffer);
-            }
-            if (code !== 0 && !parser.hasText && stderrBuf.trim()) {
-                events.push({ type: 'text_delta', text: `Claude CLI error: ${stderrBuf.trim().slice(0, 500)}` });
-            }
-            if (!events.some((e) => e.type === 'message_stop')) {
-                events.push({ type: 'message_stop', finishReason: code === 0 ? 'stop' : 'error' });
-            }
-            done = true;
-        });
-        child.on('error', () => {
-            clearTimeout(timer);
-            events.push({ type: 'message_stop', finishReason: 'error' });
-            done = true;
-        });
-        // Yield events as they become available
-        try {
-            while (!done || events.length > 0) {
-                if (events.length > 0) {
-                    yield events.shift();
-                }
-                else {
-                    await new Promise((r) => setTimeout(r, 10));
-                }
-            }
-        }
-        finally {
-            bridge?.cleanup();
-            spawnCleanup?.();
-        }
-    }
-}
-/**
- * Format agent messages into a single prompt string for the CLI's -p mode.
- */
-function formatPrompt(messages) {
-    const parts = [];
-    for (const msg of messages) {
-        if (msg.role === 'user') {
-            parts.push(`User: ${typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content)}\n`);
-        }
-        else if (msg.role === 'assistant') {
-            parts.push(`Assistant: ${typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content)}\n`);
-        }
-        else if (msg.role === 'tool') {
-            parts.push(`Tool result (${msg.toolCallId}): ${typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content)}\n`);
-        }
-    }
-    return parts.join('\n');
-}
-export function createClaudeCliProvider(options) {
-    return new ClaudeCliProvider(options);
-}
-//# sourceMappingURL=claude-cli.js.map