@wingman-ai/gateway 0.3.2 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (103) hide show
  1. package/README.md +29 -111
  2. package/dist/agent/config/agentConfig.cjs +2 -0
  3. package/dist/agent/config/agentConfig.d.ts +6 -0
  4. package/dist/agent/config/agentConfig.js +2 -0
  5. package/dist/agent/config/agentLoader.cjs +21 -18
  6. package/dist/agent/config/agentLoader.js +22 -19
  7. package/dist/agent/config/mcpClientManager.cjs +48 -9
  8. package/dist/agent/config/mcpClientManager.d.ts +12 -0
  9. package/dist/agent/config/mcpClientManager.js +48 -9
  10. package/dist/agent/config/toolRegistry.cjs +19 -0
  11. package/dist/agent/config/toolRegistry.d.ts +4 -0
  12. package/dist/agent/config/toolRegistry.js +17 -1
  13. package/dist/agent/middleware/additional-messages.cjs +115 -11
  14. package/dist/agent/middleware/additional-messages.d.ts +9 -0
  15. package/dist/agent/middleware/additional-messages.js +115 -11
  16. package/dist/agent/tests/agentLoader.test.cjs +45 -0
  17. package/dist/agent/tests/agentLoader.test.js +45 -0
  18. package/dist/agent/tests/mcpClientManager.test.cjs +50 -0
  19. package/dist/agent/tests/mcpClientManager.test.js +50 -0
  20. package/dist/agent/tests/toolRegistry.test.cjs +2 -0
  21. package/dist/agent/tests/toolRegistry.test.js +2 -0
  22. package/dist/agent/tools/node_invoke.cjs +146 -0
  23. package/dist/agent/tools/node_invoke.d.ts +86 -0
  24. package/dist/agent/tools/node_invoke.js +109 -0
  25. package/dist/cli/commands/gateway.cjs +1 -1
  26. package/dist/cli/commands/gateway.js +1 -1
  27. package/dist/cli/commands/skill.cjs +12 -4
  28. package/dist/cli/commands/skill.js +12 -4
  29. package/dist/cli/config/jsonSchema.cjs +55 -0
  30. package/dist/cli/config/jsonSchema.d.ts +2 -0
  31. package/dist/cli/config/jsonSchema.js +18 -0
  32. package/dist/cli/config/loader.cjs +33 -1
  33. package/dist/cli/config/loader.js +33 -1
  34. package/dist/cli/config/schema.cjs +119 -2
  35. package/dist/cli/config/schema.d.ts +40 -0
  36. package/dist/cli/config/schema.js +119 -2
  37. package/dist/cli/core/agentInvoker.cjs +25 -4
  38. package/dist/cli/core/agentInvoker.d.ts +13 -0
  39. package/dist/cli/core/agentInvoker.js +25 -4
  40. package/dist/cli/services/skillRepository.cjs +138 -20
  41. package/dist/cli/services/skillRepository.d.ts +10 -2
  42. package/dist/cli/services/skillRepository.js +138 -20
  43. package/dist/cli/services/skillSecurityScanner.cjs +158 -0
  44. package/dist/cli/services/skillSecurityScanner.d.ts +28 -0
  45. package/dist/cli/services/skillSecurityScanner.js +121 -0
  46. package/dist/cli/services/skillService.cjs +44 -12
  47. package/dist/cli/services/skillService.d.ts +2 -0
  48. package/dist/cli/services/skillService.js +46 -14
  49. package/dist/cli/types/skill.d.ts +9 -0
  50. package/dist/gateway/http/nodes.cjs +247 -0
  51. package/dist/gateway/http/nodes.d.ts +20 -0
  52. package/dist/gateway/http/nodes.js +210 -0
  53. package/dist/gateway/node.cjs +10 -1
  54. package/dist/gateway/node.d.ts +10 -1
  55. package/dist/gateway/node.js +10 -1
  56. package/dist/gateway/server.cjs +418 -27
  57. package/dist/gateway/server.d.ts +34 -0
  58. package/dist/gateway/server.js +412 -27
  59. package/dist/gateway/types.d.ts +15 -1
  60. package/dist/gateway/validation.cjs +2 -0
  61. package/dist/gateway/validation.d.ts +4 -0
  62. package/dist/gateway/validation.js +2 -0
  63. package/dist/tests/additionalMessageMiddleware.test.cjs +92 -0
  64. package/dist/tests/additionalMessageMiddleware.test.js +92 -0
  65. package/dist/tests/cli-config-loader.test.cjs +33 -1
  66. package/dist/tests/cli-config-loader.test.js +33 -1
  67. package/dist/tests/config-json-schema.test.cjs +25 -0
  68. package/dist/tests/config-json-schema.test.d.ts +1 -0
  69. package/dist/tests/config-json-schema.test.js +19 -0
  70. package/dist/tests/gateway-http-security.test.cjs +277 -0
  71. package/dist/tests/gateway-http-security.test.d.ts +1 -0
  72. package/dist/tests/gateway-http-security.test.js +271 -0
  73. package/dist/tests/gateway-node-mode.test.cjs +174 -0
  74. package/dist/tests/gateway-node-mode.test.d.ts +1 -0
  75. package/dist/tests/gateway-node-mode.test.js +168 -0
  76. package/dist/tests/gateway-origin-policy.test.cjs +60 -0
  77. package/dist/tests/gateway-origin-policy.test.d.ts +1 -0
  78. package/dist/tests/gateway-origin-policy.test.js +54 -0
  79. package/dist/tests/gateway.test.cjs +1 -0
  80. package/dist/tests/gateway.test.js +1 -0
  81. package/dist/tests/node-tools.test.cjs +77 -0
  82. package/dist/tests/node-tools.test.d.ts +1 -0
  83. package/dist/tests/node-tools.test.js +71 -0
  84. package/dist/tests/nodes-api.test.cjs +86 -0
  85. package/dist/tests/nodes-api.test.d.ts +1 -0
  86. package/dist/tests/nodes-api.test.js +80 -0
  87. package/dist/tests/skill-repository.test.cjs +106 -0
  88. package/dist/tests/skill-repository.test.d.ts +1 -0
  89. package/dist/tests/skill-repository.test.js +100 -0
  90. package/dist/tests/skill-security-scanner.test.cjs +126 -0
  91. package/dist/tests/skill-security-scanner.test.d.ts +1 -0
  92. package/dist/tests/skill-security-scanner.test.js +120 -0
  93. package/dist/tests/uv.test.cjs +47 -0
  94. package/dist/tests/uv.test.d.ts +1 -0
  95. package/dist/tests/uv.test.js +41 -0
  96. package/dist/utils/uv.cjs +64 -0
  97. package/dist/utils/uv.d.ts +3 -0
  98. package/dist/utils/uv.js +24 -0
  99. package/dist/webui/assets/{index-DHbfLOUR.js → index-BMekSELC.js} +106 -106
  100. package/dist/webui/index.html +1 -1
  101. package/package.json +2 -1
  102. package/skills/gog/SKILL.md +36 -0
  103. package/skills/weather/SKILL.md +49 -0
@@ -0,0 +1,271 @@
1
+ import { mkdtempSync, rmSync } from "node:fs";
2
+ import { tmpdir } from "node:os";
3
+ import { join } from "node:path";
4
+ import { afterAll, describe, expect, it } from "vitest";
5
+ import { GatewayServer } from "../gateway/server.js";
6
+ const tempWorkspaces = [];
7
+ function createGateway(config) {
8
+ const workspace = mkdtempSync(join(tmpdir(), "wingman-gateway-http-security-"));
9
+ tempWorkspaces.push(workspace);
10
+ return new GatewayServer({
11
+ logLevel: "silent",
12
+ workspace,
13
+ configDir: ".wingman-http-security-config",
14
+ stateDir: ".wingman-http-security-state",
15
+ ...config
16
+ });
17
+ }
18
+ function getGatewayInternals(server) {
19
+ return server;
20
+ }
21
+ function createTestSocket(initialData) {
22
+ const messages = [];
23
+ const ws = {
24
+ data: {
25
+ ...initialData || {}
26
+ },
27
+ send: (serialized)=>{
28
+ messages.push(JSON.parse(serialized));
29
+ return 1;
30
+ },
31
+ close: ()=>{}
32
+ };
33
+ return {
34
+ ws,
35
+ messages
36
+ };
37
+ }
38
+ afterAll(()=>{
39
+ for (const workspace of tempWorkspaces)rmSync(workspace, {
40
+ recursive: true,
41
+ force: true
42
+ });
43
+ });
44
+ describe("gateway HTTP security", ()=>{
45
+ it("requires auth for /api routes when token auth is enabled", async ()=>{
46
+ const server = createGateway({
47
+ host: "127.0.0.1",
48
+ port: 18789,
49
+ auth: {
50
+ mode: "token",
51
+ token: "test-token"
52
+ },
53
+ requireAuth: true
54
+ });
55
+ const internals = getGatewayInternals(server);
56
+ const unauthenticated = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers"));
57
+ expect(unauthenticated.status).toBe(401);
58
+ const authenticated = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
59
+ headers: {
60
+ Authorization: "Bearer test-token"
61
+ }
62
+ }));
63
+ expect(authenticated.status).toBe(200);
64
+ });
65
+ it("rejects disallowed origins and allows loopback development preflight", async ()=>{
66
+ const server = createGateway({
67
+ host: "127.0.0.1",
68
+ port: 18789,
69
+ auth: {
70
+ mode: "token",
71
+ token: "test-token"
72
+ },
73
+ requireAuth: true
74
+ });
75
+ const internals = getGatewayInternals(server);
76
+ const denied = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
77
+ method: "OPTIONS",
78
+ headers: {
79
+ Origin: "https://evil.example",
80
+ "Access-Control-Request-Method": "GET"
81
+ }
82
+ }));
83
+ expect(denied.status).toBe(403);
84
+ const allowed = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
85
+ method: "OPTIONS",
86
+ headers: {
87
+ Origin: "http://localhost:5173",
88
+ "Access-Control-Request-Method": "GET"
89
+ }
90
+ }));
91
+ expect(allowed.status).toBe(204);
92
+ expect(allowed.headers.get("access-control-allow-origin")).toBe("http://localhost:5173");
93
+ });
94
+ it("does not trust tailscale identity headers on non-loopback hosts", ()=>{
95
+ const server = createGateway({
96
+ host: "0.0.0.0",
97
+ port: 18789,
98
+ auth: {
99
+ mode: "token",
100
+ token: "tailscale-token",
101
+ allowTailscale: true
102
+ },
103
+ requireAuth: true
104
+ });
105
+ const internals = getGatewayInternals(server);
106
+ const bypassAttempt = internals.requireHttpAuth(new Request("http://127.0.0.1:18789/api/providers", {
107
+ headers: {
108
+ "tailscale-user-login": "attacker@example.com"
109
+ }
110
+ }));
111
+ expect(bypassAttempt?.status).toBe(401);
112
+ const authenticated = internals.requireHttpAuth(new Request("http://127.0.0.1:18789/api/providers", {
113
+ headers: {
114
+ Authorization: "Bearer tailscale-token",
115
+ "tailscale-user-login": "attacker@example.com"
116
+ }
117
+ }));
118
+ expect(authenticated).toBeNull();
119
+ });
120
+ it("enforces bridge node capacity limits", async ()=>{
121
+ const server = createGateway({
122
+ host: "127.0.0.1",
123
+ port: 18789,
124
+ auth: {
125
+ mode: "none"
126
+ },
127
+ requireAuth: false,
128
+ maxNodes: 1
129
+ });
130
+ const internals = getGatewayInternals(server);
131
+ const registerBody = JSON.stringify({
132
+ type: "register",
133
+ payload: {
134
+ name: "bridge-node"
135
+ },
136
+ timestamp: Date.now()
137
+ });
138
+ const first = await internals.handleBridgeSend(new Request("http://127.0.0.1:18789/bridge/send", {
139
+ method: "POST",
140
+ headers: {
141
+ "Content-Type": "application/json"
142
+ },
143
+ body: registerBody
144
+ }));
145
+ expect(first.status).toBe(200);
146
+ const second = await internals.handleBridgeSend(new Request("http://127.0.0.1:18789/bridge/send", {
147
+ method: "POST",
148
+ headers: {
149
+ "Content-Type": "application/json"
150
+ },
151
+ body: registerBody
152
+ }));
153
+ expect(second.status).toBe(429);
154
+ });
155
+ it("rejects malformed /api/nodes client IDs with 400", async ()=>{
156
+ const server = createGateway({
157
+ host: "127.0.0.1",
158
+ port: 18789,
159
+ auth: {
160
+ mode: "none"
161
+ },
162
+ requireAuth: false
163
+ });
164
+ const internals = getGatewayInternals(server);
165
+ const res = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/nodes/%E0%A4%A", {
166
+ method: "PUT",
167
+ headers: {
168
+ "Content-Type": "application/json"
169
+ },
170
+ body: JSON.stringify({
171
+ enabled: true
172
+ })
173
+ }));
174
+ expect(res.status).toBe(400);
175
+ });
176
+ it("requires approved client identity for node execution capabilities", ()=>{
177
+ const server = createGateway({
178
+ host: "127.0.0.1",
179
+ port: 18789,
180
+ auth: {
181
+ mode: "none"
182
+ },
183
+ requireAuth: false
184
+ });
185
+ const internals = getGatewayInternals(server);
186
+ const blocked = createTestSocket({
187
+ authenticated: true
188
+ });
189
+ internals.handleRegister(blocked.ws, {
190
+ type: "register",
191
+ payload: {
192
+ name: "unpaired-node",
193
+ capabilities: [
194
+ "system.run"
195
+ ]
196
+ },
197
+ timestamp: Date.now()
198
+ });
199
+ expect(blocked.messages.some((message)=>"error" === message.type && message.payload?.code === "NODE_NOT_ENABLED")).toBe(true);
200
+ });
201
+ it("rejects duplicate pending node request IDs", async ()=>{
202
+ const server = createGateway({
203
+ host: "127.0.0.1",
204
+ port: 18789,
205
+ auth: {
206
+ mode: "none"
207
+ },
208
+ requireAuth: false
209
+ });
210
+ const internals = getGatewayInternals(server);
211
+ const enableTarget = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/nodes/desktop-target", {
212
+ method: "PUT",
213
+ headers: {
214
+ "Content-Type": "application/json"
215
+ },
216
+ body: JSON.stringify({
217
+ enabled: true,
218
+ name: "Desktop Target"
219
+ })
220
+ }));
221
+ expect(enableTarget.status).toBe(200);
222
+ const target = createTestSocket({
223
+ authenticated: true,
224
+ clientId: "desktop-target",
225
+ clientType: "desktop"
226
+ });
227
+ internals.handleRegister(target.ws, {
228
+ type: "register",
229
+ payload: {
230
+ name: "target-node",
231
+ capabilities: [
232
+ "system.notify"
233
+ ]
234
+ },
235
+ timestamp: Date.now()
236
+ });
237
+ const nodeId = target.messages.find((message)=>"ack" === message.type && "string" == typeof message.payload?.nodeId)?.payload?.nodeId;
238
+ expect(nodeId).toBeTruthy();
239
+ const requester = createTestSocket({
240
+ authenticated: true,
241
+ clientId: "desktop-requester",
242
+ clientType: "desktop"
243
+ });
244
+ const duplicateRequestId = "dup-node-request-id";
245
+ internals.handleNodeRequest(requester.ws, {
246
+ type: "req:node",
247
+ id: duplicateRequestId,
248
+ targetNodeId: nodeId,
249
+ payload: {
250
+ tool: "system.notify",
251
+ args: {
252
+ title: "test"
253
+ }
254
+ },
255
+ timestamp: Date.now()
256
+ });
257
+ internals.handleNodeRequest(requester.ws, {
258
+ type: "req:node",
259
+ id: duplicateRequestId,
260
+ targetNodeId: nodeId,
261
+ payload: {
262
+ tool: "system.notify",
263
+ args: {
264
+ title: "test"
265
+ }
266
+ },
267
+ timestamp: Date.now()
268
+ });
269
+ expect(requester.messages.some((message)=>"error" === message.type && message.payload?.code === "DUPLICATE_REQUEST_ID")).toBe(true);
270
+ });
271
+ });
@@ -0,0 +1,174 @@
1
+ "use strict";
2
+ var __webpack_exports__ = {};
3
+ const external_node_fs_namespaceObject = require("node:fs");
4
+ const external_node_os_namespaceObject = require("node:os");
5
+ const external_node_path_namespaceObject = require("node:path");
6
+ const external_vitest_namespaceObject = require("vitest");
7
+ const server_cjs_namespaceObject = require("../gateway/server.cjs");
8
+ const isBun = void 0 !== globalThis.Bun;
9
+ const describeIfBun = isBun ? external_vitest_namespaceObject.describe : external_vitest_namespaceObject.describe.skip;
10
+ describeIfBun("Gateway node enablement", ()=>{
11
+ let server;
12
+ let port = 0;
13
+ let workspace;
14
+ (0, external_vitest_namespaceObject.beforeAll)(async ()=>{
15
+ workspace = (0, external_node_fs_namespaceObject.mkdtempSync)((0, external_node_path_namespaceObject.join)((0, external_node_os_namespaceObject.tmpdir)(), "wingman-gateway-node-mode-"));
16
+ server = new server_cjs_namespaceObject.GatewayServer({
17
+ port: 0,
18
+ host: "localhost",
19
+ requireAuth: false,
20
+ auth: {
21
+ mode: "none"
22
+ },
23
+ logLevel: "silent",
24
+ workspace,
25
+ configDir: ".wingman-node-test-config",
26
+ stateDir: ".wingman-node-test-state"
27
+ });
28
+ await server.start();
29
+ port = server.getPort();
30
+ if (!port) throw new Error("Unable to determine gateway port");
31
+ });
32
+ (0, external_vitest_namespaceObject.afterAll)(async ()=>{
33
+ await server.stop();
34
+ (0, external_node_fs_namespaceObject.rmSync)(workspace, {
35
+ recursive: true,
36
+ force: true
37
+ });
38
+ });
39
+ const connectClient = (instanceId, clientType = "desktop")=>new Promise((resolve, reject)=>{
40
+ const ws = new WebSocket(`ws://localhost:${port}/ws`);
41
+ const connectId = `connect-${instanceId}-${Date.now()}`;
42
+ const timeout = setTimeout(()=>reject(new Error("Connect timeout")), 5000);
43
+ ws.addEventListener("open", ()=>{
44
+ ws.send(JSON.stringify({
45
+ type: "connect",
46
+ id: connectId,
47
+ client: {
48
+ instanceId,
49
+ clientType,
50
+ version: "test"
51
+ },
52
+ timestamp: Date.now()
53
+ }));
54
+ });
55
+ ws.addEventListener("message", (event)=>{
56
+ const msg = JSON.parse(event.data);
57
+ if ("res" === msg.type && msg.id === connectId && msg.ok) {
58
+ clearTimeout(timeout);
59
+ resolve(ws);
60
+ }
61
+ });
62
+ ws.addEventListener("error", ()=>{
63
+ clearTimeout(timeout);
64
+ reject(new Error("WebSocket error"));
65
+ });
66
+ });
67
+ const waitForMessage = (ws, predicate, timeoutMs = 5000)=>new Promise((resolve, reject)=>{
68
+ const timeout = setTimeout(()=>reject(new Error("Message timeout")), timeoutMs);
69
+ const handler = (event)=>{
70
+ const data = event.data;
71
+ if ("string" != typeof data) return;
72
+ let msg;
73
+ try {
74
+ msg = JSON.parse(data);
75
+ } catch {
76
+ return;
77
+ }
78
+ if (!predicate(msg)) return;
79
+ clearTimeout(timeout);
80
+ ws.removeEventListener("message", handler);
81
+ resolve(msg);
82
+ };
83
+ ws.addEventListener("message", handler);
84
+ });
85
+ (0, external_vitest_namespaceObject.it)("blocks node registration before device enablement", async ()=>{
86
+ const ws = await connectClient("desktop-node-blocked");
87
+ ws.send(JSON.stringify({
88
+ type: "register",
89
+ payload: {
90
+ name: "Blocked Node",
91
+ capabilities: [
92
+ "system.notify"
93
+ ]
94
+ },
95
+ timestamp: Date.now()
96
+ }));
97
+ const errorMessage = await waitForMessage(ws, (msg)=>"error" === msg.type && msg.payload?.code === "NODE_NOT_ENABLED");
98
+ (0, external_vitest_namespaceObject.expect)(errorMessage.payload?.message).toContain("not approved");
99
+ ws.close();
100
+ });
101
+ (0, external_vitest_namespaceObject.it)("allows enabled devices to register, execute, and revoke", async ()=>{
102
+ const enableResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
103
+ method: "PUT",
104
+ headers: {
105
+ "Content-Type": "application/json"
106
+ },
107
+ body: JSON.stringify({
108
+ enabled: true,
109
+ name: "Enabled Desktop"
110
+ })
111
+ });
112
+ (0, external_vitest_namespaceObject.expect)(enableResponse.ok).toBe(true);
113
+ const nodeWs = await connectClient("desktop-node-enabled");
114
+ nodeWs.send(JSON.stringify({
115
+ type: "register",
116
+ payload: {
117
+ name: "Enabled Desktop",
118
+ capabilities: [
119
+ "system.notify"
120
+ ]
121
+ },
122
+ timestamp: Date.now()
123
+ }));
124
+ const registrationAck = await waitForMessage(nodeWs, (msg)=>"ack" === msg.type && "string" == typeof msg.payload?.nodeId);
125
+ const nodeId = registrationAck.payload.nodeId;
126
+ (0, external_vitest_namespaceObject.expect)(nodeId).toBeTruthy();
127
+ const requesterWs = await connectClient("desktop-requester");
128
+ requesterWs.send(JSON.stringify({
129
+ type: "req:node",
130
+ id: "node-req-1",
131
+ targetNodeId: nodeId,
132
+ payload: {
133
+ tool: "system.notify",
134
+ args: {
135
+ title: "Hello",
136
+ body: "Node test"
137
+ }
138
+ },
139
+ timestamp: Date.now()
140
+ }));
141
+ const forwardedToNode = await waitForMessage(nodeWs, (msg)=>"req:node" === msg.type && "node-req-1" === msg.id);
142
+ (0, external_vitest_namespaceObject.expect)(forwardedToNode.targetNodeId).toBe(nodeId);
143
+ nodeWs.send(JSON.stringify({
144
+ type: "res",
145
+ id: "node-req-1",
146
+ ok: true,
147
+ payload: {
148
+ delivered: true
149
+ },
150
+ timestamp: Date.now()
151
+ }));
152
+ const returnedToRequester = await waitForMessage(requesterWs, (msg)=>"res" === msg.type && "node-req-1" === msg.id);
153
+ (0, external_vitest_namespaceObject.expect)(returnedToRequester.ok).toBe(true);
154
+ (0, external_vitest_namespaceObject.expect)(returnedToRequester.nodeId).toBe(nodeId);
155
+ const closePromise = new Promise((resolve)=>{
156
+ nodeWs.addEventListener("close", ()=>{
157
+ resolve();
158
+ }, {
159
+ once: true
160
+ });
161
+ });
162
+ const revokeResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
163
+ method: "DELETE"
164
+ });
165
+ (0, external_vitest_namespaceObject.expect)(revokeResponse.ok).toBe(true);
166
+ await closePromise;
167
+ requesterWs.close();
168
+ nodeWs.close();
169
+ });
170
+ });
171
+ for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
172
+ Object.defineProperty(exports, '__esModule', {
173
+ value: true
174
+ });
@@ -0,0 +1 @@
1
+ export {};
@@ -0,0 +1,168 @@
1
+ import { mkdtempSync, rmSync } from "node:fs";
2
+ import { tmpdir } from "node:os";
3
+ import { join } from "node:path";
4
+ import { afterAll, beforeAll, describe, expect, it } from "vitest";
5
+ import { GatewayServer } from "../gateway/server.js";
6
+ const isBun = void 0 !== globalThis.Bun;
7
+ const describeIfBun = isBun ? describe : describe.skip;
8
+ describeIfBun("Gateway node enablement", ()=>{
9
+ let server;
10
+ let port = 0;
11
+ let workspace;
12
+ beforeAll(async ()=>{
13
+ workspace = mkdtempSync(join(tmpdir(), "wingman-gateway-node-mode-"));
14
+ server = new GatewayServer({
15
+ port: 0,
16
+ host: "localhost",
17
+ requireAuth: false,
18
+ auth: {
19
+ mode: "none"
20
+ },
21
+ logLevel: "silent",
22
+ workspace,
23
+ configDir: ".wingman-node-test-config",
24
+ stateDir: ".wingman-node-test-state"
25
+ });
26
+ await server.start();
27
+ port = server.getPort();
28
+ if (!port) throw new Error("Unable to determine gateway port");
29
+ });
30
+ afterAll(async ()=>{
31
+ await server.stop();
32
+ rmSync(workspace, {
33
+ recursive: true,
34
+ force: true
35
+ });
36
+ });
37
+ const connectClient = (instanceId, clientType = "desktop")=>new Promise((resolve, reject)=>{
38
+ const ws = new WebSocket(`ws://localhost:${port}/ws`);
39
+ const connectId = `connect-${instanceId}-${Date.now()}`;
40
+ const timeout = setTimeout(()=>reject(new Error("Connect timeout")), 5000);
41
+ ws.addEventListener("open", ()=>{
42
+ ws.send(JSON.stringify({
43
+ type: "connect",
44
+ id: connectId,
45
+ client: {
46
+ instanceId,
47
+ clientType,
48
+ version: "test"
49
+ },
50
+ timestamp: Date.now()
51
+ }));
52
+ });
53
+ ws.addEventListener("message", (event)=>{
54
+ const msg = JSON.parse(event.data);
55
+ if ("res" === msg.type && msg.id === connectId && msg.ok) {
56
+ clearTimeout(timeout);
57
+ resolve(ws);
58
+ }
59
+ });
60
+ ws.addEventListener("error", ()=>{
61
+ clearTimeout(timeout);
62
+ reject(new Error("WebSocket error"));
63
+ });
64
+ });
65
+ const waitForMessage = (ws, predicate, timeoutMs = 5000)=>new Promise((resolve, reject)=>{
66
+ const timeout = setTimeout(()=>reject(new Error("Message timeout")), timeoutMs);
67
+ const handler = (event)=>{
68
+ const data = event.data;
69
+ if ("string" != typeof data) return;
70
+ let msg;
71
+ try {
72
+ msg = JSON.parse(data);
73
+ } catch {
74
+ return;
75
+ }
76
+ if (!predicate(msg)) return;
77
+ clearTimeout(timeout);
78
+ ws.removeEventListener("message", handler);
79
+ resolve(msg);
80
+ };
81
+ ws.addEventListener("message", handler);
82
+ });
83
+ it("blocks node registration before device enablement", async ()=>{
84
+ const ws = await connectClient("desktop-node-blocked");
85
+ ws.send(JSON.stringify({
86
+ type: "register",
87
+ payload: {
88
+ name: "Blocked Node",
89
+ capabilities: [
90
+ "system.notify"
91
+ ]
92
+ },
93
+ timestamp: Date.now()
94
+ }));
95
+ const errorMessage = await waitForMessage(ws, (msg)=>"error" === msg.type && msg.payload?.code === "NODE_NOT_ENABLED");
96
+ expect(errorMessage.payload?.message).toContain("not approved");
97
+ ws.close();
98
+ });
99
+ it("allows enabled devices to register, execute, and revoke", async ()=>{
100
+ const enableResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
101
+ method: "PUT",
102
+ headers: {
103
+ "Content-Type": "application/json"
104
+ },
105
+ body: JSON.stringify({
106
+ enabled: true,
107
+ name: "Enabled Desktop"
108
+ })
109
+ });
110
+ expect(enableResponse.ok).toBe(true);
111
+ const nodeWs = await connectClient("desktop-node-enabled");
112
+ nodeWs.send(JSON.stringify({
113
+ type: "register",
114
+ payload: {
115
+ name: "Enabled Desktop",
116
+ capabilities: [
117
+ "system.notify"
118
+ ]
119
+ },
120
+ timestamp: Date.now()
121
+ }));
122
+ const registrationAck = await waitForMessage(nodeWs, (msg)=>"ack" === msg.type && "string" == typeof msg.payload?.nodeId);
123
+ const nodeId = registrationAck.payload.nodeId;
124
+ expect(nodeId).toBeTruthy();
125
+ const requesterWs = await connectClient("desktop-requester");
126
+ requesterWs.send(JSON.stringify({
127
+ type: "req:node",
128
+ id: "node-req-1",
129
+ targetNodeId: nodeId,
130
+ payload: {
131
+ tool: "system.notify",
132
+ args: {
133
+ title: "Hello",
134
+ body: "Node test"
135
+ }
136
+ },
137
+ timestamp: Date.now()
138
+ }));
139
+ const forwardedToNode = await waitForMessage(nodeWs, (msg)=>"req:node" === msg.type && "node-req-1" === msg.id);
140
+ expect(forwardedToNode.targetNodeId).toBe(nodeId);
141
+ nodeWs.send(JSON.stringify({
142
+ type: "res",
143
+ id: "node-req-1",
144
+ ok: true,
145
+ payload: {
146
+ delivered: true
147
+ },
148
+ timestamp: Date.now()
149
+ }));
150
+ const returnedToRequester = await waitForMessage(requesterWs, (msg)=>"res" === msg.type && "node-req-1" === msg.id);
151
+ expect(returnedToRequester.ok).toBe(true);
152
+ expect(returnedToRequester.nodeId).toBe(nodeId);
153
+ const closePromise = new Promise((resolve)=>{
154
+ nodeWs.addEventListener("close", ()=>{
155
+ resolve();
156
+ }, {
157
+ once: true
158
+ });
159
+ });
160
+ const revokeResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
161
+ method: "DELETE"
162
+ });
163
+ expect(revokeResponse.ok).toBe(true);
164
+ await closePromise;
165
+ requesterWs.close();
166
+ nodeWs.close();
167
+ });
168
+ });
@@ -0,0 +1,60 @@
1
+ "use strict";
2
+ var __webpack_exports__ = {};
3
+ const external_vitest_namespaceObject = require("vitest");
4
+ const server_cjs_namespaceObject = require("../gateway/server.cjs");
5
+ (0, external_vitest_namespaceObject.describe)("gateway origin policy", ()=>{
6
+ (0, external_vitest_namespaceObject.it)("identifies loopback hostnames", ()=>{
7
+ (0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("127.0.0.1")).toBe(true);
8
+ (0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("localhost")).toBe(true);
9
+ (0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("[::1]")).toBe(true);
10
+ (0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("example.com")).toBe(false);
11
+ });
12
+ (0, external_vitest_namespaceObject.it)("allows loopback development origins", ()=>{
13
+ const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
14
+ origin: "http://localhost:5173",
15
+ requestUrl: "http://127.0.0.1:18789/api/sessions",
16
+ gatewayHost: "127.0.0.1",
17
+ gatewayPort: 18789,
18
+ controlUiEnabled: true,
19
+ controlUiPort: 18790
20
+ });
21
+ (0, external_vitest_namespaceObject.expect)(allowed).toBe(true);
22
+ });
23
+ (0, external_vitest_namespaceObject.it)("rejects unrelated internet origins", ()=>{
24
+ const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
25
+ origin: "https://evil.example",
26
+ requestUrl: "http://127.0.0.1:18789/api/sessions",
27
+ gatewayHost: "127.0.0.1",
28
+ gatewayPort: 18789,
29
+ controlUiEnabled: true,
30
+ controlUiPort: 18790
31
+ });
32
+ (0, external_vitest_namespaceObject.expect)(allowed).toBe(false);
33
+ });
34
+ (0, external_vitest_namespaceObject.it)("allows same-host control UI origin on configured port", ()=>{
35
+ const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
36
+ origin: "http://192.168.1.50:18790",
37
+ requestUrl: "http://192.168.1.50:18789/api/sessions",
38
+ gatewayHost: "0.0.0.0",
39
+ gatewayPort: 18789,
40
+ controlUiEnabled: true,
41
+ controlUiPort: 18790
42
+ });
43
+ (0, external_vitest_namespaceObject.expect)(allowed).toBe(true);
44
+ });
45
+ (0, external_vitest_namespaceObject.it)("rejects same-host origins on unapproved ports", ()=>{
46
+ const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
47
+ origin: "http://192.168.1.50:9999",
48
+ requestUrl: "http://192.168.1.50:18789/api/sessions",
49
+ gatewayHost: "0.0.0.0",
50
+ gatewayPort: 18789,
51
+ controlUiEnabled: true,
52
+ controlUiPort: 18790
53
+ });
54
+ (0, external_vitest_namespaceObject.expect)(allowed).toBe(false);
55
+ });
56
+ });
57
+ for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
58
+ Object.defineProperty(exports, '__esModule', {
59
+ value: true
60
+ });
@@ -0,0 +1 @@
1
+ export {};