@tomflow/proflow-agent-gateway 0.1.18 → 0.1.19

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @tomflow/proflow-agent-gateway
 
+## 0.1.19
+
+### Patch Changes
+
+- Preserve allowlisted downstream tool error codes across Gateway HTTP translation while keeping unknown failures opaque, and stop generic Gateway logs from fabricating side-effect state.
+
+- Fail closed when the public Gateway role credential store becomes group/world-readable on POSIX systems.
+
 ## 0.1.18
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -6,7 +6,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             data: {
                 localBaseUrl: string;
                 publicBaseUrl?: string;
@@ -20,7 +20,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.18";
+            readonly moduleVersion: "0.1.19";
         };
         observedEffects: string[];
     }>;
@@ -30,7 +30,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             data: {
                 setupStatus: "BLOCKED" | "READY";
                 runtimeStatus: "RUNNING" | "STOPPED";
@@ -51,7 +51,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             data: {
                 localBaseUrl: string;
                 publicBaseUrl?: string;
@@ -66,7 +66,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             data: {
                 docs: string;
             };
@@ -79,7 +79,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             data: {
                 host: string;
                 port: number;
@@ -90,7 +90,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             ok: false;
             status: "FAILED";
             error: {
@@ -107,7 +107,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.18";
+            readonly moduleVersion: "0.1.19";
         };
         observedEffects: string[];
     } | {
@@ -116,11 +116,11 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "agent-gateway";
-            readonly moduleVersion: "0.1.18";
+            readonly moduleVersion: "0.1.19";
         } | {
             contract: "deployment.result.v1";
             moduleRef: "agent-gateway";
-            moduleVersion: "0.1.18";
+            moduleVersion: "0.1.19";
             ok: false;
             status: "FAILED";
             error: {

package/dist/deployment/adapter.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { appendFile, mkdir } from "node:fs/promises";
+import { appendFile, mkdir, stat, rename } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { deterministicLoopbackPort, readModuleSharedFacts, writeModuleSharedFacts, } from "@tomflow/proflow-module-contract";
 import { descriptor } from "./descriptor.js";
@@ -75,15 +75,31 @@ async function compose(context) {
         throw new Error("Agent role credential store is not materialized by Platform Host");
     const logPath = join(deps.stateRoot, "logs", "agent-gateway", "events.jsonl");
     let logTail = Promise.resolve();
+    let pendingLogs = 0;
     const log = (entry) => {
+        if (pendingLogs >= 1000)
+            return;
+        pendingLogs++;
         logTail = logTail
             .catch(() => undefined)
             .then(async () => {
             await mkdir(dirname(logPath), { recursive: true, mode: 0o700 });
-            await appendFile(logPath, `${JSON.stringify(entry)}\n`, {
+            const target = entry.component === "agent-gateway-process"
+                ? logPath.replace("events.jsonl", "lifecycle.jsonl")
+                : logPath;
+            const info = await stat(target).catch(() => null);
+            if (info &&
+                (info.size >= 5 * 1024 * 1024 ||
+                    Date.now() - info.mtimeMs > 7 * 86400_000))
+                await rename(target, `${target}.1`);
+            await appendFile(target, `${JSON.stringify(entry)}\n`, {
                 encoding: "utf8",
                 mode: 0o600,
             });
+        })
+            .catch(() => undefined)
+            .finally(() => {
+            pendingLogs--;
         });
         void logTail;
     };
@@ -121,9 +137,7 @@ export const behaviorAdapter = {
         }
         return {
             result: base,
-            observedEffects: service
-                ? ["Manage the declared service process"]
-                : [],
+            observedEffects: service ? ["Manage the declared service process"] : [],
         };
     },
     status: async (context) => {
@@ -176,9 +190,7 @@ export const behaviorAdapter = {
         result: {
             ...base,
             data: {
-                docs: readFileSync(new URL(import.meta.url.includes("/dist/")
-                    ? "../../DOCS.md"
-                    : "../DOCS.md", import.meta.url), "utf8"),
+                docs: readFileSync(new URL(import.meta.url.includes("/dist/") ? "../../DOCS.md" : "../DOCS.md", import.meta.url), "utf8"),
             },
         },
         observedEffects: [],
@@ -196,9 +208,7 @@ export const behaviorAdapter = {
         }
         catch (error) {
             return {
-                result: failed("START_FAILED", error instanceof Error
-                    ? error.message
-                    : "agent-gateway start failed"),
+                result: failed("START_FAILED", error instanceof Error ? error.message : "agent-gateway start failed"),
                 observedEffects: [],
             };
         }

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "agent-gateway";
     readonly packageName: "@tomflow/proflow-agent-gateway";
-    readonly moduleVersion: "0.1.18";
+    readonly moduleVersion: "0.1.19";
     readonly kind: "service";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "agent-gateway",
     packageName: "@tomflow/proflow-agent-gateway",
-    moduleVersion: "0.1.18",
+    moduleVersion: "0.1.19",
     kind: "service",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",

package/dist/src/index.d.ts

@@ -22,6 +22,11 @@ export type GatewayOptions = {
     port?: number;
     now?: () => number;
     actionTimeoutMs?: number;
+    onIngressFailure?: (entry: {
+        status: "FAILED";
+        httpStatus: number;
+        sideEffectState: "NOT_APPLIED";
+    }) => void;
 };
 export declare class AgentGatewayError extends Error {
     readonly code: string;

package/dist/src/index.js

@@ -225,6 +225,7 @@ export async function createAgentGateway(options) {
     };
     const handler = async (request, response) => {
         inFlight += 1;
+        let ownerEntered = false;
         try {
             const url = new URL(request.url ?? "/", `http://${host}`);
             if (request.method === "GET" && url.pathname === "/health") {
@@ -335,6 +336,7 @@ export async function createAgentGateway(options) {
             const propagationReserveMs = Math.min(1_500, Math.max(100, Math.floor(actionTimeoutMs / 10)));
             const deadlineAt = new Date(now() + Math.max(1, actionTimeoutMs - propagationReserveMs)).toISOString();
             const actionSignal = AbortSignal.timeout(actionTimeoutMs);
+            ownerEntered = true;
             const operation = action.uncertain && options.owners.lookupResult
                 ? options.owners.lookupResult(action.operationId, authenticatedRoleRef, canonicalBody)
                 : options.owners.route(action.operationId, authenticatedRoleRef, canonicalBody, {
@@ -383,6 +385,16 @@ export async function createAgentGateway(options) {
             }));
         }
         finally {
+            if (!ownerEntered && response.statusCode >= 400) {
+                try {
+                    options.onIngressFailure?.({
+                        status: "FAILED",
+                        httpStatus: response.statusCode,
+                        sideEffectState: "NOT_APPLIED",
+                    });
+                }
+                catch { }
+            }
             inFlight -= 1;
         }
     };

package/dist/src/process.js

@@ -1,4 +1,4 @@
-import { createHash, timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual, randomUUID } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
 import { resolve } from "node:path";
 import { AgentGatewayError, createAgentGateway } from "./index.js";
@@ -91,9 +91,7 @@ function logErrorCode(error) {
             typeof Reflect.get(error, "message") === "string"
             ? String(Reflect.get(error, "message"))
             : "GATEWAY_FAILURE";
-    return /^[A-Z][A-Z0-9_.:-]{0,159}$/.test(value)
-        ? value
-        : "GATEWAY_FAILURE";
+    return /^[A-Z][A-Z0-9_.:-]{0,159}$/.test(value) ? value : "GATEWAY_FAILURE";
 }
 function optionalToolOperation(value) {
     if (typeof value !== "object" ||
@@ -150,6 +148,9 @@ function parseCredentialStore(value) {
     return credentials;
 }
 async function readCurrentCredentialStore(file) {
+    const info = await stat(file);
+    if (process.platform !== "win32" && (info.mode & 0o077) !== 0)
+        throw new Error("ROLE_CREDENTIAL_STORE_PERMISSIONS_INVALID");
     return parseCredentialStore(JSON.parse(await readFile(file, "utf8")));
 }
 async function readDownstreamCredential(file) {
@@ -175,7 +176,7 @@ export async function createAgentGatewayProcess(input) {
             return false;
         }
     };
-    const downstream = async (path, body, signal) => {
+    const downstream = async (path, body, signal, operationRef) => {
         const downstreamCredential = input.config.downstreamCredentialFile
             ? await readDownstreamCredential(input.config.downstreamCredentialFile)
             : undefined;
@@ -184,6 +185,9 @@ export async function createAgentGatewayProcess(input) {
             response = await fetchImplementation(`${input.config.downstreamBaseUrl}${path}`, {
                 method: body === undefined ? "GET" : "POST",
                 headers: {
+                    ...(operationRef
+                        ? { "x-proflow-operation-ref": operationRef }
+                        : {}),
                     ...(body === undefined
                         ? {}
                         : { "content-type": "application/json" }),
@@ -202,14 +206,16 @@ export async function createAgentGatewayProcess(input) {
         }
         if (!response.ok) {
             const downstreamCode = await boundedDownstreamErrorCode(response);
-            const code = response.status >= 500 || response.status === 401
+            const code = response.status === 401
                 ? "OWNER_SERVICE_UNAVAILABLE"
                 : (downstreamCode ??
-                    (response.status === 400
-                        ? "INVALID_REQUEST"
-                        : response.status === 403
-                            ? "ROLE_OPERATION_DENIED"
-                            : "DOWNSTREAM_UNAVAILABLE"));
+                    (response.status >= 500
+                        ? "OWNER_SERVICE_UNAVAILABLE"
+                        : response.status === 400
+                            ? "INVALID_REQUEST"
+                            : response.status === 403
+                                ? "ROLE_OPERATION_DENIED"
+                                : "DOWNSTREAM_UNAVAILABLE"));
             throw Object.assign(new AgentGatewayError(code), {
                 httpStatus: response.status,
             });
@@ -220,26 +226,49 @@ export async function createAgentGatewayProcess(input) {
         const toolOperation = directToolOperationIds.has(inputEvent.operationId)
             ? optionalToolOperation(inputEvent.value)
             : undefined;
-        input.operationLog?.({
-            contract: "proflow.operation-boundary.v1",
-            timestamp: new Date().toISOString(),
-            source: "agent-gateway",
-            component: "agent-gateway-ingress",
-            event: inputEvent.mode === "LOOKUP"
-                ? "GATEWAY_ACTION_LOOKUP"
-                : "GATEWAY_ACTION",
-            boundary: directToolOperationIds.has(inputEvent.operationId)
-                ? "TOOL_INVOCATION"
-                : "ACTION",
-            status: inputEvent.status,
-            operationId: inputEvent.operationId,
-            roleRef: inputEvent.roleRef,
-            ...(toolOperation ? { toolOperation } : {}),
-            ...(inputEvent.errorCode ? { errorCode: inputEvent.errorCode } : {}),
-            durationMs: inputEvent.durationMs,
-        });
+        try {
+            void Promise.resolve(input.operationLog?.({
+                contract: "proflow.operation-boundary.v1",
+                eventId: `gateway-event:${randomUUID()}`,
+                operationRef: inputEvent.operationRef,
+                correlationKind: "EXACT",
+                timestamp: new Date().toISOString(),
+                source: "agent-gateway",
+                component: "agent-gateway-ingress",
+                event: inputEvent.mode === "LOOKUP"
+                    ? "GATEWAY_ACTION_LOOKUP"
+                    : "GATEWAY_ACTION",
+                boundary: directToolOperationIds.has(inputEvent.operationId)
+                    ? "TOOL_INVOCATION"
+                    : "ACTION",
+                status: inputEvent.status,
+                operationId: inputEvent.operationId,
+                roleRef: inputEvent.roleRef,
+                ...(toolOperation ? { toolOperation } : {}),
+                ...(inputEvent.errorCode ? { errorCode: inputEvent.errorCode } : {}),
+                durationMs: inputEvent.durationMs,
+            })).catch(() => undefined);
+        }
+        catch { }
     };
     const gateway = await createAgentGateway({
+        onIngressFailure(entry) {
+            try {
+                void Promise.resolve(input.operationLog?.({
+                    contract: "proflow.operation-boundary.v1",
+                    timestamp: new Date().toISOString(),
+                    eventId: `gateway-event:${randomUUID()}`,
+                    operationRef: `op:${randomUUID()}`,
+                    correlationKind: "EXACT",
+                    source: "agent-gateway",
+                    component: "agent-gateway-ingress",
+                    event: "GATEWAY_INGRESS_REJECTED",
+                    ...entry,
+                    errorCode: "GATEWAY_INGRESS_REJECTED",
+                })).catch(() => undefined);
+            }
+            catch { }
+        },
         host: input.config.host,
         port: input.config.port,
         relayBaseUrl: `${input.config.publicBaseUrl}/relay/`,
@@ -253,6 +282,7 @@ export async function createAgentGatewayProcess(input) {
             },
             async route(operationId, authenticatedRoleRef, value, context) {
                 const started = performance.now();
+                const operationRef = `op:${randomUUID()}`;
                 try {
                     const result = await downstream(`/actions/${encodeURIComponent(operationId)}`, {
                         authenticatedRoleRef,
@@ -263,9 +293,10 @@ export async function createAgentGatewayProcess(input) {
                             : {
                                 fileMaterializationInputs: context.fileMaterializationInputs,
                             }),
-                    }, context?.signal);
+                    }, context?.signal, operationRef);
                     emitOperation({
                         mode: "ROUTE",
+                        operationRef,
                         operationId,
                         roleRef: authenticatedRoleRef,
                         value,
@@ -277,6 +308,7 @@ export async function createAgentGatewayProcess(input) {
                 catch (error) {
                     emitOperation({
                         mode: "ROUTE",
+                        operationRef,
                         operationId,
                         roleRef: authenticatedRoleRef,
                         value,
@@ -289,10 +321,12 @@ export async function createAgentGatewayProcess(input) {
             },
             async lookupResult(operationId, authenticatedRoleRef, value) {
                 const started = performance.now();
+                const operationRef = `op:${randomUUID()}`;
                 try {
-                    const result = await downstream(`/actions/${encodeURIComponent(operationId)}/result`, { authenticatedRoleRef, input: value });
+                    const result = await downstream(`/actions/${encodeURIComponent(operationId)}/result`, { authenticatedRoleRef, input: value }, undefined, operationRef);
                     emitOperation({
                         mode: "LOOKUP",
+                        operationRef,
                         operationId,
                         roleRef: authenticatedRoleRef,
                         value,
@@ -304,6 +338,7 @@ export async function createAgentGatewayProcess(input) {
                 catch (error) {
                     emitOperation({
                         mode: "LOOKUP",
+                        operationRef,
                         operationId,
                         roleRef: authenticatedRoleRef,
                         value,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-agent-gateway",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -28,14 +28,14 @@
     "@tomflow/proflow-module-contract": "^0.1.13"
   },
   "devDependencies": {
+    "@tomflow/proflow-task-migration-runner": "^0.1.11",
+    "@tomflow/proflow-execution-browser-extension": "^0.1.62",
+    "@tomflow/proflow-deployment-conformance": "^0.1.13",
     "@tomflow/proflow-agent-runtime": "^0.1.17",
-    "@tomflow/proflow-execution-browser-extension": "^0.1.58",
+    "@tomflow/proflow-task-store-sqlite": "^0.1.12",
     "@tomflow/proflow-execution-runtime": "^0.1.19",
-    "@tomflow/proflow-platform-host": "^0.1.28",
-    "@tomflow/proflow-deployment-conformance": "^0.1.13",
-    "@tomflow/proflow-task-migration-runner": "^0.1.11",
-    "@tomflow/proflow-task-orchestration": "^0.1.11",
-    "@tomflow/proflow-task-store-sqlite": "^0.1.12"
+    "@tomflow/proflow-platform-host": "^0.1.29",
+    "@tomflow/proflow-task-orchestration": "^0.1.11"
   },
   "description": "The sole Custom GPT Actions HTTP ingress and OpenAI transport anti-corruption layer.",
   "keywords": [

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "agent-gateway",
 	"packageName": "@tomflow/proflow-agent-gateway",
-	"moduleVersion": "0.1.18",
+	"moduleVersion": "0.1.19",
 	"kind": "service",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",