@wingman-ai/gateway 0.4.0 → 0.4.1

package/dist/gateway/types.d.ts

@@ -2,7 +2,7 @@ import type { ServerWebSocket } from "bun";
 /**
  * Message types for gateway communication
  */
-export type MessageType = "connect" | "res" | "req:agent" | "req:agent:cancel" | "event:agent" | "session_subscribe" | "session_unsubscribe" | "register" | "registered" | "unregister" | "join_group" | "leave_group" | "broadcast" | "direct" | "ping" | "pong" | "error" | "ack" | "upgrade";
+export type MessageType = "connect" | "res" | "req:agent" | "req:agent:cancel" | "event:agent" | "req:node" | "event:node" | "session_subscribe" | "session_unsubscribe" | "register" | "registered" | "unregister" | "join_group" | "leave_group" | "broadcast" | "direct" | "ping" | "pong" | "error" | "ack" | "upgrade";
 /**
  * Gateway message structure
  */
@@ -87,6 +87,7 @@ export interface RoutingInfo {
 export interface NodeMetadata {
     id: string;
     name: string;
+    clientId?: string;
     capabilities?: string[];
     groups: Set<string>;
     connectedAt: number;
@@ -102,6 +103,10 @@ export interface NodeMetadata {
 export interface Node extends NodeMetadata {
     ws: ServerWebSocket<{
         nodeId: string;
+        clientId?: string;
+        clientType?: string;
+        authenticated?: boolean;
+        tailscaleUser?: string;
     }>;
 }
 /**

package/dist/gateway/validation.cjs

@@ -44,6 +44,8 @@ const MessageTypeSchema = external_zod_namespaceObject["enum"]([
     "req:agent",
     "req:agent:cancel",
     "event:agent",
+    "req:node",
+    "event:node",
     "session_subscribe",
     "session_unsubscribe",
     "register",

package/dist/gateway/validation.d.ts

@@ -10,6 +10,8 @@ export declare const MessageTypeSchema: z.ZodEnum<{
     "req:agent": "req:agent";
     "req:agent:cancel": "req:agent:cancel";
     "event:agent": "event:agent";
+    "req:node": "req:node";
+    "event:node": "event:node";
     session_subscribe: "session_subscribe";
     session_unsubscribe: "session_unsubscribe";
     register: "register";
@@ -34,6 +36,8 @@ export declare const GatewayMessageSchema: z.ZodObject<{
         "req:agent": "req:agent";
         "req:agent:cancel": "req:agent:cancel";
         "event:agent": "event:agent";
+        "req:node": "req:node";
+        "event:node": "event:node";
         session_subscribe: "session_subscribe";
         session_unsubscribe: "session_unsubscribe";
         register: "register";

package/dist/gateway/validation.js

@@ -5,6 +5,8 @@ const MessageTypeSchema = external_zod_enum([
     "req:agent",
     "req:agent:cancel",
     "event:agent",
+    "req:node",
+    "event:node",
     "session_subscribe",
     "session_unsubscribe",
     "register",

package/dist/tests/additionalMessageMiddleware.test.cjs

@@ -117,6 +117,98 @@ const additional_messages_cjs_namespaceObject = require("../agent/middleware/add
         }).length;
         (0, external_vitest_namespaceObject.expect)(injectedCount).toBe(1);
     });
+    (0, external_vitest_namespaceObject.it)("refreshes injected node context on each invocation", async ()=>{
+        let connectedIds = [
+            "node-a"
+        ];
+        const middleware = (0, additional_messages_cjs_namespaceObject.additionalMessageMiddleware)({
+            nodeConnectedIdsProvider: ()=>connectedIds
+        });
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const first = await beforeAgent({
+            messages: [
+                new external_langchain_namespaceObject.HumanMessage("Hello")
+            ]
+        }, {});
+        const firstContent = first.messages[0]?.content ?? "";
+        (0, external_vitest_namespaceObject.expect)(firstContent).toContain("Connected node IDs: node-a");
+        connectedIds = [
+            "node-b"
+        ];
+        const second = await beforeAgent({
+            messages: first.messages
+        }, {});
+        const secondContent = second.messages[0]?.content ?? "";
+        (0, external_vitest_namespaceObject.expect)(secondContent).toContain("Connected node IDs: node-b");
+        (0, external_vitest_namespaceObject.expect)(secondContent).not.toContain("Connected node IDs: node-a");
+    });
+    (0, external_vitest_namespaceObject.it)("injects connected node IDs for node tool targeting when provided", async ()=>{
+        const middleware = (0, additional_messages_cjs_namespaceObject.additionalMessageMiddleware)({
+            nodeConnectedIdsProvider: ()=>[
+                    "node-b",
+                    "node-a",
+                    "",
+                    "node-b"
+                ]
+        });
+        const input = {
+            messages: [
+                new external_langchain_namespaceObject.HumanMessage("Hello")
+            ]
+        };
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const result = await beforeAgent(input, {});
+        const content = result.messages[0]?.content ?? "";
+        (0, external_vitest_namespaceObject.expect)(content).toContain("Connected Node Targets");
+        (0, external_vitest_namespaceObject.expect)(content).toContain("Connected node IDs: node-b, node-a");
+        (0, external_vitest_namespaceObject.expect)(content).toContain("target.nodeId or target.clientId");
+    });
+    (0, external_vitest_namespaceObject.it)("injects default node target clientId when present", async ()=>{
+        const middleware = (0, additional_messages_cjs_namespaceObject.additionalMessageMiddleware)({
+            nodeConnectedIdsProvider: ()=>[],
+            defaultNodeTargetClientId: "desktop-abc123"
+        });
+        const input = {
+            messages: [
+                new external_langchain_namespaceObject.HumanMessage("Hello")
+            ]
+        };
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const result = await beforeAgent(input, {});
+        const content = result.messages[0]?.content ?? "";
+        (0, external_vitest_namespaceObject.expect)(content).toContain("Connected node IDs: (none currently connected)");
+        (0, external_vitest_namespaceObject.expect)(content).toContain("Default node target clientId for this request: desktop-abc123");
+    });
+    (0, external_vitest_namespaceObject.it)("injects connected node metadata when provided", async ()=>{
+        const middleware = (0, additional_messages_cjs_namespaceObject.additionalMessageMiddleware)({
+            nodeConnectedTargetsProvider: ()=>[
+                    {
+                        nodeId: "node-a",
+                        clientId: "desktop-a",
+                        name: "Russell MacBook",
+                        capabilities: [
+                            "system.notify",
+                            "system.run"
+                        ]
+                    }
+                ]
+        });
+        const input = {
+            messages: [
+                new external_langchain_namespaceObject.HumanMessage("Hello")
+            ]
+        };
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const result = await beforeAgent(input, {});
+        const content = result.messages[0]?.content ?? "";
+        (0, external_vitest_namespaceObject.expect)(content).toContain("Connected node metadata:");
+        (0, external_vitest_namespaceObject.expect)(content).toContain("node-a (clientId: desktop-a; name: Russell MacBook;");
+        (0, external_vitest_namespaceObject.expect)(content).toContain("capabilities: system.notify, system.run");
+    });
 });
 for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/dist/tests/additionalMessageMiddleware.test.js

@@ -93,4 +93,96 @@ describe("additionalMessageMiddleware", ()=>{
         }).length;
         expect(injectedCount).toBe(1);
     });
+    it("refreshes injected node context on each invocation", async ()=>{
+        let connectedIds = [
+            "node-a"
+        ];
+        const middleware = additionalMessageMiddleware({
+            nodeConnectedIdsProvider: ()=>connectedIds
+        });
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const first = await beforeAgent({
+            messages: [
+                new HumanMessage("Hello")
+            ]
+        }, {});
+        const firstContent = first.messages[0]?.content ?? "";
+        expect(firstContent).toContain("Connected node IDs: node-a");
+        connectedIds = [
+            "node-b"
+        ];
+        const second = await beforeAgent({
+            messages: first.messages
+        }, {});
+        const secondContent = second.messages[0]?.content ?? "";
+        expect(secondContent).toContain("Connected node IDs: node-b");
+        expect(secondContent).not.toContain("Connected node IDs: node-a");
+    });
+    it("injects connected node IDs for node tool targeting when provided", async ()=>{
+        const middleware = additionalMessageMiddleware({
+            nodeConnectedIdsProvider: ()=>[
+                    "node-b",
+                    "node-a",
+                    "",
+                    "node-b"
+                ]
+        });
+        const input = {
+            messages: [
+                new HumanMessage("Hello")
+            ]
+        };
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const result = await beforeAgent(input, {});
+        const content = result.messages[0]?.content ?? "";
+        expect(content).toContain("Connected Node Targets");
+        expect(content).toContain("Connected node IDs: node-b, node-a");
+        expect(content).toContain("target.nodeId or target.clientId");
+    });
+    it("injects default node target clientId when present", async ()=>{
+        const middleware = additionalMessageMiddleware({
+            nodeConnectedIdsProvider: ()=>[],
+            defaultNodeTargetClientId: "desktop-abc123"
+        });
+        const input = {
+            messages: [
+                new HumanMessage("Hello")
+            ]
+        };
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const result = await beforeAgent(input, {});
+        const content = result.messages[0]?.content ?? "";
+        expect(content).toContain("Connected node IDs: (none currently connected)");
+        expect(content).toContain("Default node target clientId for this request: desktop-abc123");
+    });
+    it("injects connected node metadata when provided", async ()=>{
+        const middleware = additionalMessageMiddleware({
+            nodeConnectedTargetsProvider: ()=>[
+                    {
+                        nodeId: "node-a",
+                        clientId: "desktop-a",
+                        name: "Russell MacBook",
+                        capabilities: [
+                            "system.notify",
+                            "system.run"
+                        ]
+                    }
+                ]
+        });
+        const input = {
+            messages: [
+                new HumanMessage("Hello")
+            ]
+        };
+        const beforeAgent = "function" == typeof middleware.beforeAgent ? middleware.beforeAgent : middleware.beforeAgent?.hook;
+        if (!beforeAgent) throw new Error("beforeAgent hook not configured");
+        const result = await beforeAgent(input, {});
+        const content = result.messages[0]?.content ?? "";
+        expect(content).toContain("Connected node metadata:");
+        expect(content).toContain("node-a (clientId: desktop-a; name: Russell MacBook;");
+        expect(content).toContain("capabilities: system.notify, system.run");
+    });
 });

package/dist/tests/gateway-http-security.test.cjs

@@ -0,0 +1,277 @@
+"use strict";
+var __webpack_exports__ = {};
+const external_node_fs_namespaceObject = require("node:fs");
+const external_node_os_namespaceObject = require("node:os");
+const external_node_path_namespaceObject = require("node:path");
+const external_vitest_namespaceObject = require("vitest");
+const server_cjs_namespaceObject = require("../gateway/server.cjs");
+const tempWorkspaces = [];
+function createGateway(config) {
+    const workspace = (0, external_node_fs_namespaceObject.mkdtempSync)((0, external_node_path_namespaceObject.join)((0, external_node_os_namespaceObject.tmpdir)(), "wingman-gateway-http-security-"));
+    tempWorkspaces.push(workspace);
+    return new server_cjs_namespaceObject.GatewayServer({
+        logLevel: "silent",
+        workspace,
+        configDir: ".wingman-http-security-config",
+        stateDir: ".wingman-http-security-state",
+        ...config
+    });
+}
+function getGatewayInternals(server) {
+    return server;
+}
+function createTestSocket(initialData) {
+    const messages = [];
+    const ws = {
+        data: {
+            ...initialData || {}
+        },
+        send: (serialized)=>{
+            messages.push(JSON.parse(serialized));
+            return 1;
+        },
+        close: ()=>{}
+    };
+    return {
+        ws,
+        messages
+    };
+}
+(0, external_vitest_namespaceObject.afterAll)(()=>{
+    for (const workspace of tempWorkspaces)(0, external_node_fs_namespaceObject.rmSync)(workspace, {
+        recursive: true,
+        force: true
+    });
+});
+(0, external_vitest_namespaceObject.describe)("gateway HTTP security", ()=>{
+    (0, external_vitest_namespaceObject.it)("requires auth for /api routes when token auth is enabled", async ()=>{
+        const server = createGateway({
+            host: "127.0.0.1",
+            port: 18789,
+            auth: {
+                mode: "token",
+                token: "test-token"
+            },
+            requireAuth: true
+        });
+        const internals = getGatewayInternals(server);
+        const unauthenticated = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers"));
+        (0, external_vitest_namespaceObject.expect)(unauthenticated.status).toBe(401);
+        const authenticated = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
+            headers: {
+                Authorization: "Bearer test-token"
+            }
+        }));
+        (0, external_vitest_namespaceObject.expect)(authenticated.status).toBe(200);
+    });
+    (0, external_vitest_namespaceObject.it)("rejects disallowed origins and allows loopback development preflight", async ()=>{
+        const server = createGateway({
+            host: "127.0.0.1",
+            port: 18789,
+            auth: {
+                mode: "token",
+                token: "test-token"
+            },
+            requireAuth: true
+        });
+        const internals = getGatewayInternals(server);
+        const denied = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
+            method: "OPTIONS",
+            headers: {
+                Origin: "https://evil.example",
+                "Access-Control-Request-Method": "GET"
+            }
+        }));
+        (0, external_vitest_namespaceObject.expect)(denied.status).toBe(403);
+        const allowed = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
+            method: "OPTIONS",
+            headers: {
+                Origin: "http://localhost:5173",
+                "Access-Control-Request-Method": "GET"
+            }
+        }));
+        (0, external_vitest_namespaceObject.expect)(allowed.status).toBe(204);
+        (0, external_vitest_namespaceObject.expect)(allowed.headers.get("access-control-allow-origin")).toBe("http://localhost:5173");
+    });
+    (0, external_vitest_namespaceObject.it)("does not trust tailscale identity headers on non-loopback hosts", ()=>{
+        const server = createGateway({
+            host: "0.0.0.0",
+            port: 18789,
+            auth: {
+                mode: "token",
+                token: "tailscale-token",
+                allowTailscale: true
+            },
+            requireAuth: true
+        });
+        const internals = getGatewayInternals(server);
+        const bypassAttempt = internals.requireHttpAuth(new Request("http://127.0.0.1:18789/api/providers", {
+            headers: {
+                "tailscale-user-login": "attacker@example.com"
+            }
+        }));
+        (0, external_vitest_namespaceObject.expect)(bypassAttempt?.status).toBe(401);
+        const authenticated = internals.requireHttpAuth(new Request("http://127.0.0.1:18789/api/providers", {
+            headers: {
+                Authorization: "Bearer tailscale-token",
+                "tailscale-user-login": "attacker@example.com"
+            }
+        }));
+        (0, external_vitest_namespaceObject.expect)(authenticated).toBeNull();
+    });
+    (0, external_vitest_namespaceObject.it)("enforces bridge node capacity limits", async ()=>{
+        const server = createGateway({
+            host: "127.0.0.1",
+            port: 18789,
+            auth: {
+                mode: "none"
+            },
+            requireAuth: false,
+            maxNodes: 1
+        });
+        const internals = getGatewayInternals(server);
+        const registerBody = JSON.stringify({
+            type: "register",
+            payload: {
+                name: "bridge-node"
+            },
+            timestamp: Date.now()
+        });
+        const first = await internals.handleBridgeSend(new Request("http://127.0.0.1:18789/bridge/send", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: registerBody
+        }));
+        (0, external_vitest_namespaceObject.expect)(first.status).toBe(200);
+        const second = await internals.handleBridgeSend(new Request("http://127.0.0.1:18789/bridge/send", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: registerBody
+        }));
+        (0, external_vitest_namespaceObject.expect)(second.status).toBe(429);
+    });
+    (0, external_vitest_namespaceObject.it)("rejects malformed /api/nodes client IDs with 400", async ()=>{
+        const server = createGateway({
+            host: "127.0.0.1",
+            port: 18789,
+            auth: {
+                mode: "none"
+            },
+            requireAuth: false
+        });
+        const internals = getGatewayInternals(server);
+        const res = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/nodes/%E0%A4%A", {
+            method: "PUT",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                enabled: true
+            })
+        }));
+        (0, external_vitest_namespaceObject.expect)(res.status).toBe(400);
+    });
+    (0, external_vitest_namespaceObject.it)("requires approved client identity for node execution capabilities", ()=>{
+        const server = createGateway({
+            host: "127.0.0.1",
+            port: 18789,
+            auth: {
+                mode: "none"
+            },
+            requireAuth: false
+        });
+        const internals = getGatewayInternals(server);
+        const blocked = createTestSocket({
+            authenticated: true
+        });
+        internals.handleRegister(blocked.ws, {
+            type: "register",
+            payload: {
+                name: "unpaired-node",
+                capabilities: [
+                    "system.run"
+                ]
+            },
+            timestamp: Date.now()
+        });
+        (0, external_vitest_namespaceObject.expect)(blocked.messages.some((message)=>"error" === message.type && message.payload?.code === "NODE_NOT_ENABLED")).toBe(true);
+    });
+    (0, external_vitest_namespaceObject.it)("rejects duplicate pending node request IDs", async ()=>{
+        const server = createGateway({
+            host: "127.0.0.1",
+            port: 18789,
+            auth: {
+                mode: "none"
+            },
+            requireAuth: false
+        });
+        const internals = getGatewayInternals(server);
+        const enableTarget = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/nodes/desktop-target", {
+            method: "PUT",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                enabled: true,
+                name: "Desktop Target"
+            })
+        }));
+        (0, external_vitest_namespaceObject.expect)(enableTarget.status).toBe(200);
+        const target = createTestSocket({
+            authenticated: true,
+            clientId: "desktop-target",
+            clientType: "desktop"
+        });
+        internals.handleRegister(target.ws, {
+            type: "register",
+            payload: {
+                name: "target-node",
+                capabilities: [
+                    "system.notify"
+                ]
+            },
+            timestamp: Date.now()
+        });
+        const nodeId = target.messages.find((message)=>"ack" === message.type && "string" == typeof message.payload?.nodeId)?.payload?.nodeId;
+        (0, external_vitest_namespaceObject.expect)(nodeId).toBeTruthy();
+        const requester = createTestSocket({
+            authenticated: true,
+            clientId: "desktop-requester",
+            clientType: "desktop"
+        });
+        const duplicateRequestId = "dup-node-request-id";
+        internals.handleNodeRequest(requester.ws, {
+            type: "req:node",
+            id: duplicateRequestId,
+            targetNodeId: nodeId,
+            payload: {
+                tool: "system.notify",
+                args: {
+                    title: "test"
+                }
+            },
+            timestamp: Date.now()
+        });
+        internals.handleNodeRequest(requester.ws, {
+            type: "req:node",
+            id: duplicateRequestId,
+            targetNodeId: nodeId,
+            payload: {
+                tool: "system.notify",
+                args: {
+                    title: "test"
+                }
+            },
+            timestamp: Date.now()
+        });
+        (0, external_vitest_namespaceObject.expect)(requester.messages.some((message)=>"error" === message.type && message.payload?.code === "DUPLICATE_REQUEST_ID")).toBe(true);
+    });
+});
+for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/tests/gateway-http-security.test.d.ts

@@ -0,0 +1 @@
+export {};