@tomflow/proflow-agent-gateway 0.1.17 → 0.1.18

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @tomflow/proflow-agent-gateway
 
+## 0.1.18
+
+### Patch Changes
+
+- Aggregate Browser, Permission, Host-application, Provisioning, Direct Tool, and Gateway observability at stable runtime boundaries, preserving owner truth while enabling one operation-chain diagnosis path without logging sensitive payloads.
+
 ## 0.1.17
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -6,7 +6,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             data: {
                 localBaseUrl: string;
                 publicBaseUrl?: string;
@@ -20,7 +20,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.17";
+            readonly moduleVersion: "0.1.18";
         };
         observedEffects: string[];
     }>;
@@ -30,7 +30,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             data: {
                 setupStatus: "BLOCKED" | "READY";
                 runtimeStatus: "RUNNING" | "STOPPED";
@@ -51,7 +51,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             data: {
                 localBaseUrl: string;
                 publicBaseUrl?: string;
@@ -66,7 +66,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             data: {
                 docs: string;
             };
@@ -79,7 +79,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             data: {
                 host: string;
                 port: number;
@@ -90,7 +90,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             ok: false;
             status: "FAILED";
             error: {
@@ -107,7 +107,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.17";
+            readonly moduleVersion: "0.1.18";
         };
         observedEffects: string[];
     } | {
@@ -116,11 +116,11 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.17";
+            readonly moduleVersion: "0.1.18";
         } | {
             contract: "deployment.result.v1";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.18";
             ok: false;
             status: "FAILED";
             error: {

package/dist/deployment/adapter.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { appendFile, mkdir } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
 import { deterministicLoopbackPort, readModuleSharedFacts, writeModuleSharedFacts, } from "@tomflow/proflow-module-contract";
 import { descriptor } from "./descriptor.js";
 const services = new Map();
@@ -72,6 +73,20 @@ async function compose(context) {
     const credentialFile = join(deps.stateRoot, "agent", "secrets", "role-credentials.json");
     if (!existsSync(credentialFile))
         throw new Error("Agent role credential store is not materialized by Platform Host");
+    const logPath = join(deps.stateRoot, "logs", "agent-gateway", "events.jsonl");
+    let logTail = Promise.resolve();
+    const log = (entry) => {
+        logTail = logTail
+            .catch(() => undefined)
+            .then(async () => {
+            await mkdir(dirname(logPath), { recursive: true, mode: 0o700 });
+            await appendFile(logPath, `${JSON.stringify(entry)}\n`, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+        });
+        void logTail;
+    };
     const { createAgentGatewayProcess, parseAgentGatewayProcessConfig } = await import("../src/process.js");
     const listener = new URL(own.localBaseUrl);
     return createAgentGatewayProcess({
@@ -83,6 +98,8 @@ async function compose(context) {
             credentialFile,
             downstreamCredentialFile: deps.downstreamCredentialFile,
         }),
+        log,
+        operationLog: log,
     });
 }
 const failed = (code, message) => ({
@@ -104,7 +121,9 @@ export const behaviorAdapter = {
         }
         return {
             result: base,
-            observedEffects: service ? ["Manage the declared service process"] : [],
+            observedEffects: service
+                ? ["Manage the declared service process"]
+                : [],
         };
     },
     status: async (context) => {
@@ -157,7 +176,9 @@ export const behaviorAdapter = {
         result: {
             ...base,
             data: {
-                docs: readFileSync(new URL(import.meta.url.includes("/dist/") ? "../../DOCS.md" : "../DOCS.md", import.meta.url), "utf8"),
+                docs: readFileSync(new URL(import.meta.url.includes("/dist/")
+                    ? "../../DOCS.md"
+                    : "../DOCS.md", import.meta.url), "utf8"),
             },
         },
         observedEffects: [],
@@ -175,7 +196,9 @@ export const behaviorAdapter = {
         }
         catch (error) {
             return {
-                result: failed("START_FAILED", error instanceof Error ? error.message : "agent-gateway start failed"),
+                result: failed("START_FAILED", error instanceof Error
+                    ? error.message
+                    : "agent-gateway start failed"),
                 observedEffects: [],
             };
         }

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "agent-gateway";
     readonly packageName: "@tomflow/proflow-agent-gateway";
-    readonly moduleVersion: "0.1.17";
+    readonly moduleVersion: "0.1.18";
     readonly kind: "service";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "agent-gateway",
     packageName: "@tomflow/proflow-agent-gateway",
-    moduleVersion: "0.1.17",
+    moduleVersion: "0.1.18",
     kind: "service",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",

package/dist/src/process.d.ts

@@ -12,6 +12,7 @@ export declare function createAgentGatewayProcess(input: {
     config: AgentGatewayProcessConfig;
     fetch?: typeof globalThis.fetch;
     log?: (entry: Record<string, unknown>) => void;
+    operationLog?: (entry: Record<string, unknown>) => void;
 }): Promise<Readonly<{
     readiness: () => Promise<{
         status: "NOT_READY" | "READY";

package/dist/src/process.js

@@ -31,6 +31,7 @@ const safeDownstreamErrorCodes = new Set([
     "LOCAL_TOOL_SCOPE_DENIED",
     "LOCAL_TOOL_COMMAND_FAILED",
 ]);
+const directToolOperationIds = new Set(["localDev", "repomix", "codeGraph"]);
 async function boundedDownstreamErrorCode(response) {
     if (!response.body)
         return null;
@@ -82,6 +83,27 @@ function text(value, name) {
         throw new TypeError(`${name} must be a non-empty string`);
     return value;
 }
+function logErrorCode(error) {
+    const value = error instanceof AgentGatewayError
+        ? error.code
+        : error &&
+            typeof error === "object" &&
+            typeof Reflect.get(error, "message") === "string"
+            ? String(Reflect.get(error, "message"))
+            : "GATEWAY_FAILURE";
+    return /^[A-Z][A-Z0-9_.:-]{0,159}$/.test(value)
+        ? value
+        : "GATEWAY_FAILURE";
+}
+function optionalToolOperation(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Array.isArray(value) ||
+        typeof Reflect.get(value, "operation") !== "string")
+        return undefined;
+    const operation = String(Reflect.get(value, "operation"));
+    return /^[A-Za-z0-9_.:-]{1,160}$/.test(operation) ? operation : undefined;
+}
 export function parseAgentGatewayProcessConfig(value) {
     const input = record(value, "agent-gateway config");
     const publicBaseUrl = new URL(text(input.publicBaseUrl, "publicBaseUrl"));
@@ -142,11 +164,6 @@ async function readDownstreamCredential(file) {
 export async function createAgentGatewayProcess(input) {
     const fetchImplementation = input.fetch ?? globalThis.fetch;
     const credentialFile = input.config.credentialFile;
-    // Fail-fast at startup so a malformed configured credential store is rejected
-    // before the process advertises readiness. Authentication re-reads the current
-    // store on every attempt below, so a rotated key takes effect without a restart
-    // and a malformed/half-written store fails closed instead of serving a stale
-    // snapshot.
     await readCurrentCredentialStore(credentialFile);
     if (input.config.downstreamCredentialFile)
         await readDownstreamCredential(input.config.downstreamCredentialFile);
@@ -199,6 +216,29 @@ export async function createAgentGatewayProcess(input) {
         }
         return response.json();
     };
+    const emitOperation = (inputEvent) => {
+        const toolOperation = directToolOperationIds.has(inputEvent.operationId)
+            ? optionalToolOperation(inputEvent.value)
+            : undefined;
+        input.operationLog?.({
+            contract: "proflow.operation-boundary.v1",
+            timestamp: new Date().toISOString(),
+            source: "agent-gateway",
+            component: "agent-gateway-ingress",
+            event: inputEvent.mode === "LOOKUP"
+                ? "GATEWAY_ACTION_LOOKUP"
+                : "GATEWAY_ACTION",
+            boundary: directToolOperationIds.has(inputEvent.operationId)
+                ? "TOOL_INVOCATION"
+                : "ACTION",
+            status: inputEvent.status,
+            operationId: inputEvent.operationId,
+            roleRef: inputEvent.roleRef,
+            ...(toolOperation ? { toolOperation } : {}),
+            ...(inputEvent.errorCode ? { errorCode: inputEvent.errorCode } : {}),
+            durationMs: inputEvent.durationMs,
+        });
+    };
     const gateway = await createAgentGateway({
         host: input.config.host,
         port: input.config.port,
@@ -211,23 +251,68 @@ export async function createAgentGatewayProcess(input) {
                         return roleRef;
                 throw new Error("AUTHENTICATION_FAILED");
             },
-            route(operationId, authenticatedRoleRef, value, context) {
-                return downstream(`/actions/${encodeURIComponent(operationId)}`, {
-                    authenticatedRoleRef,
-                    input: value,
-                    deadlineAt: context?.deadlineAt,
-                    ...(context?.fileMaterializationInputs === undefined
-                        ? {}
-                        : {
-                            fileMaterializationInputs: context.fileMaterializationInputs,
-                        }),
-                }, context?.signal);
+            async route(operationId, authenticatedRoleRef, value, context) {
+                const started = performance.now();
+                try {
+                    const result = await downstream(`/actions/${encodeURIComponent(operationId)}`, {
+                        authenticatedRoleRef,
+                        input: value,
+                        deadlineAt: context?.deadlineAt,
+                        ...(context?.fileMaterializationInputs === undefined
+                            ? {}
+                            : {
+                                fileMaterializationInputs: context.fileMaterializationInputs,
+                            }),
+                    }, context?.signal);
+                    emitOperation({
+                        mode: "ROUTE",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "SUCCEEDED",
+                        durationMs: performance.now() - started,
+                    });
+                    return result;
+                }
+                catch (error) {
+                    emitOperation({
+                        mode: "ROUTE",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "FAILED",
+                        errorCode: logErrorCode(error),
+                        durationMs: performance.now() - started,
+                    });
+                    throw error;
+                }
             },
-            lookupResult(operationId, authenticatedRoleRef, value) {
-                return downstream(`/actions/${encodeURIComponent(operationId)}/result`, {
-                    authenticatedRoleRef,
-                    input: value,
-                });
+            async lookupResult(operationId, authenticatedRoleRef, value) {
+                const started = performance.now();
+                try {
+                    const result = await downstream(`/actions/${encodeURIComponent(operationId)}/result`, { authenticatedRoleRef, input: value });
+                    emitOperation({
+                        mode: "LOOKUP",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "SUCCEEDED",
+                        durationMs: performance.now() - started,
+                    });
+                    return result;
+                }
+                catch (error) {
+                    emitOperation({
+                        mode: "LOOKUP",
+                        operationId,
+                        roleRef: authenticatedRoleRef,
+                        value,
+                        status: "FAILED",
+                        errorCode: logErrorCode(error),
+                        durationMs: performance.now() - started,
+                    });
+                    throw error;
+                }
             },
             async readiness() {
                 try {
@@ -260,6 +345,7 @@ export async function createAgentGatewayProcess(input) {
             timestamp: new Date().toISOString(),
             component: "agent-gateway-process",
             event: "SERVICE_STARTED",
+            status: "SUCCEEDED",
             ...address,
         });
         return address;
@@ -270,6 +356,7 @@ export async function createAgentGatewayProcess(input) {
             timestamp: new Date().toISOString(),
             component: "agent-gateway-process",
             event: "SERVICE_STOPPED",
+            status: "SUCCEEDED",
         });
     };
     return Object.freeze({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-agent-gateway",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -28,13 +28,13 @@
     "@tomflow/proflow-module-contract": "^0.1.13"
   },
   "devDependencies": {
-    "@tomflow/proflow-execution-browser-extension": "^0.1.51",
-    "@tomflow/proflow-deployment-conformance": "^0.1.13",
+    "@tomflow/proflow-agent-runtime": "^0.1.17",
+    "@tomflow/proflow-execution-browser-extension": "^0.1.58",
     "@tomflow/proflow-execution-runtime": "^0.1.19",
-    "@tomflow/proflow-agent-runtime": "^0.1.14",
-    "@tomflow/proflow-platform-host": "^0.1.23",
-    "@tomflow/proflow-task-orchestration": "^0.1.11",
+    "@tomflow/proflow-platform-host": "^0.1.28",
+    "@tomflow/proflow-deployment-conformance": "^0.1.13",
     "@tomflow/proflow-task-migration-runner": "^0.1.11",
+    "@tomflow/proflow-task-orchestration": "^0.1.11",
     "@tomflow/proflow-task-store-sqlite": "^0.1.12"
   },
   "description": "The sole Custom GPT Actions HTTP ingress and OpenAI transport anti-corruption layer.",

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "agent-gateway",
 	"packageName": "@tomflow/proflow-agent-gateway",
-	"moduleVersion": "0.1.17",
+	"moduleVersion": "0.1.18",
 	"kind": "service",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",