@xopcai/xopc 0.0.197 → 0.0.200

package/dist/src/gateway/hono/app.js

@@ -10,7 +10,7 @@ import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
-import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
+import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
@@ -42,10 +42,11 @@ function createHonoApp(config) {
 	const { service } = config;
 	const app = new Hono();
 	const gatewayPort = resolveGatewayServiceListenPort(service);
+	const gatewayBindHost = config.listenHost ?? resolveGatewayEffectiveHost(service.currentConfig);
 	const resolveBrowserOrigins = () => resolveAllowedBrowserOrigins({
 		configuredOrigins: service.currentConfig.gateway.corsOrigins,
 		port: gatewayPort,
-		bindHost: resolveGatewayEffectiveHost(service.currentConfig),
+		bindHost: gatewayBindHost,
 		tunnelPublicUrl: loadTunnelState()?.publicUrl,
 		reverseProxyPublicUrl: resolveReverseProxyPublicUrl(service.currentConfig)
 	});
@@ -153,6 +154,7 @@ function createHonoApp(config) {
 		if (/^\/api\/notes\/[^/]+\/media$/.test(path)) return true;
 		return path === "/api/notes" && contentType?.includes("multipart/form-data") === true;
 	};
+	const isProjectFileUploadRequest = (path, method, contentType) => method === "POST" && /^\/api\/projects\/[^/]+\/files\/upload$/.test(path) && contentType?.includes("multipart/form-data") === true;
 	const discussionUploadBodyMax = (path, method, contentType) => {
 		if (method !== "PUT" || contentType?.includes("multipart/form-data") !== true) return void 0;
 		if (/^\/api\/discussions\/[^/]+\/recording$/.test(path)) return NOTE_MEDIA_BODY_MAX;
@@ -173,7 +175,7 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
+		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,
@@ -211,6 +213,10 @@ function createHonoApp(config) {
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 	}) });
+	const taskRateLimitMiddleware = createTaskRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	const channelRateLimitMiddleware = createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
@@ -219,6 +225,7 @@ function createHonoApp(config) {
 		service,
 		strictRateLimitMiddleware,
 		chatRateLimitMiddleware,
+		taskRateLimitMiddleware,
 		xopcCloudPollRateLimitMiddleware: createXopcCloudPollRateLimitMiddleware({ getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -16,6 +16,10 @@ export declare function createChatRateLimitMiddleware(deps: StrictRateLimitDeps)
     error: string;
     code: string;
 }, 429, "json">>;
+export declare function createTaskRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;
 export declare function createXopcCloudPollRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -70,6 +70,13 @@ function createChatRateLimitMiddleware(deps) {
 		reason: "chat_rate_limit_exceeded"
 	});
 }
+function createTaskRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.taskApi(),
+		exceededMessage: "Task API rate limit exceeded",
+		reason: "task_rate_limit_exceeded"
+	});
+}
 function createXopcCloudPollRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.xopcCloudPoll(),
@@ -85,4 +92,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,5 +1,5 @@
-import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
+import { submitSessionInput } from "./session-input-handler.js";
 //#region src/gateway/hono/routes/agent-stream.ts
 function registerAgentStreamRoutes(authenticated, deps) {
 	const { service, chatRateLimitMiddleware } = deps;
@@ -34,79 +34,7 @@ function registerAgentStreamRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/sessions/:sessionKey/inputs", chatRateLimitMiddleware, async (c) => {
-		const sessionKey = (c.req.param("sessionKey") ?? "").trim();
-		const body = await c.req.json().catch(() => null);
-		if (!body || !sessionKey) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: "Invalid request"
-			}
-		}, 400);
-		const attachments = Array.isArray(body.attachments) ? body.attachments : void 0;
-		const content = typeof body.content === "string" ? body.content : "";
-		const contentError = validateWebchatContent(content);
-		if (contentError) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: contentError
-			}
-		}, 400);
-		const attachmentError = validateWebchatAttachments(attachments);
-		if (attachmentError) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: attachmentError
-			}
-		}, 400);
-		const delivery = body.delivery === "next" || body.delivery === "steer" ? body.delivery : null;
-		if (!delivery) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: "Missing delivery"
-			}
-		}, 400);
-		const origin = endpointTurnClaimSchema.safeParse(body.origin);
-		if (!origin.success) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: "Invalid endpoint origin"
-			}
-		}, 400);
-		if (!service.endpointTools.registry.verifyTurnClaim(origin.data.endpointId, origin.data.token)) return c.json({
-			ok: false,
-			error: {
-				code: "INVALID_ENDPOINT",
-				message: "Endpoint connection is not active"
-			}
-		}, 401);
-		const result = await service.submitSessionInput({
-			sessionKey,
-			clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
-			delivery,
-			content,
-			attachments,
-			thinking: typeof body.thinking === "string" ? body.thinking : void 0,
-			origin: {
-				type: "endpoint",
-				endpointId: origin.data.endpointId
-			}
-		});
-		if (result.ok === false) return c.json({
-			ok: false,
-			error: {
-				code: result.code,
-				message: "Input was not accepted"
-			}
-		}, result.code === "QUEUE_FULL" ? 409 : 400);
-		return c.json({
-			ok: true,
-			payload: result
-		}, 202);
+		return submitSessionInput(c, deps, (c.req.param("sessionKey") ?? "").trim());
 	});
 	authenticated.patch("/api/sessions/:sessionKey/inputs/:inputId", chatRateLimitMiddleware, async (c) => {
 		const sessionKey = (c.req.param("sessionKey") ?? "").trim();

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -176,12 +176,13 @@ async function applyMiscPatch(config, body) {
 function validateGatewayAfterPatch(config, body) {
 	if (body.gateway === void 0) return PATCH_OK;
 	try {
+		const port = config.gateway?.port ?? 18790;
 		const auth = resolveGatewayAuth({ authConfig: config.gateway?.auth });
 		assertGatewayAuthConfigured(auth);
 		assertGatewayRuntimeConfig({
 			cfg: config,
 			auth,
-			port: config.gateway?.port ?? 18790
+			port
 		});
 	} catch (err) {
 		return patchError(err instanceof Error ? err.message : String(err));

package/dist/src/gateway/hono/routes/config.js

@@ -1,3 +1,4 @@
+import { enumerateLanGatewayCandidates } from "../../host.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
 import { applyAgentsPatch } from "./config-patch/agents.js";
 import { applyChannelsPatch } from "./config-patch/channels.js";
@@ -39,6 +40,14 @@ function registerConfigRoutes(authenticated, deps) {
 			payload: { config: safeConfig }
 		});
 	});
+	authenticated.get("/api/gateway/cors-origin-candidates", (c) => {
+		const requestedPort = Number(c.req.query("port"));
+		const port = Number.isInteger(requestedPort) && requestedPort >= 1 && requestedPort <= 65535 ? requestedPort : service.currentConfig.gateway?.port ?? 18790;
+		return c.json({
+			ok: true,
+			payload: { candidates: enumerateLanGatewayCandidates(port) }
+		});
+	});
 	authenticated.patch("/api/config", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json();
 		const config = service.currentConfig;

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -4,6 +4,7 @@ export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
     chatRateLimitMiddleware: MiddlewareHandler;
+    taskRateLimitMiddleware?: MiddlewareHandler;
     xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;
 }

package/dist/src/gateway/hono/routes/projects.js

@@ -1128,6 +1128,61 @@ function registerProjectsRoutes(authenticated, deps) {
 			}, 500);
 		}
 	});
+	authenticated.post("/api/projects/:id/files/upload", async (c) => {
+		let body;
+		try {
+			body = await c.req.parseBody();
+		} catch {
+			return c.json({
+				ok: false,
+				error: { message: "Invalid multipart body" }
+			}, 400);
+		}
+		const file = body.file;
+		if (!(file instanceof File)) return c.json({
+			ok: false,
+			error: { message: "Missing file" }
+		}, 400);
+		const requestedPath = typeof body.path === "string" ? body.path.trim() : "";
+		if (!requestedPath) return c.json({
+			ok: false,
+			error: { message: "Missing path" }
+		}, 400);
+		const resolved = await resolveProjectWorkspaceWritePath(service, c.req.param("id"), requestedPath);
+		if (resolved.ok === false) return c.json({
+			ok: false,
+			error: { message: resolved.error }
+		}, resolved.status);
+		if (resolved.existingStat) return c.json({
+			ok: false,
+			error: { message: "File already exists" }
+		}, 409);
+		try {
+			await writeFile(resolved.absolutePath, Buffer.from(await file.arrayBuffer()), { flag: "wx" });
+			const entryStat = await stat(resolved.absolutePath);
+			return c.json({
+				ok: true,
+				entry: {
+					name: path$1.basename(resolved.relativePath),
+					path: resolved.relativePath,
+					absolutePath: resolved.absolutePath,
+					type: "file",
+					size: entryStat.size,
+					updatedAt: entryStat.mtime.toISOString()
+				}
+			}, 201);
+		} catch (err) {
+			log.error({
+				err,
+				projectId: resolved.projectId,
+				path: resolved.absolutePath
+			}, "project file upload failed");
+			return c.json({
+				ok: false,
+				error: { message: "Upload failed" }
+			}, 500);
+		}
+	});
 	authenticated.post("/api/projects/:id/sessions/:sessionKey", async (c) => {
 		try {
 			service.projects.attachSession(c.req.param("sessionKey"), c.req.param("id"));

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -0,0 +1,62 @@
+import type { Context } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteDeps, sessionKey: string): Promise<(Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}, 401, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: "BAD_REQUEST" | "QUEUE_FULL";
+        message: string;
+    };
+}, 400 | 409, "json">) | (Response & import("hono").TypedResponse<{
+    ok: true;
+    payload: {
+        sessionKey: string;
+        ok: true;
+        effectiveDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
+        state: {
+            sessionKey: string;
+            revision: number;
+            activeRunId?: string;
+            activeInputId?: string;
+            inputs: {
+                id: string;
+                sessionKey: string;
+                clientMessageId: string;
+                requestedDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
+                effectiveDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
+                status: import("../../../storage/sqlite/session-input-repository.js").SessionInputStatus;
+                content: string;
+                attachments?: import("hono/dist/types/utils/types.js").JSONValue[];
+                thinking?: string;
+                origin: {
+                    type: "endpoint";
+                    endpointId: string;
+                } | {
+                    type: "channel";
+                    channel: string;
+                } | {
+                    type: "system";
+                    source: "cli" | "workflow" | "automation" | "heartbeat" | "internal";
+                };
+                position: number;
+                targetRunId?: string;
+                runId?: string;
+                version: number;
+                error?: string;
+                createdAtMs: number;
+                updatedAtMs: number;
+            }[];
+        };
+    };
+}, 202, "json">)>;

package/dist/src/gateway/hono/routes/session-input-handler.js

@@ -0,0 +1,82 @@
+import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
+import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
+//#region src/gateway/hono/routes/session-input-handler.ts
+async function submitSessionInput(c, deps, sessionKey) {
+	const body = await c.req.json().catch(() => null);
+	if (!body || !sessionKey) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: "Invalid request"
+		}
+	}, 400);
+	const attachments = Array.isArray(body.attachments) ? body.attachments : void 0;
+	const content = typeof body.content === "string" ? body.content : "";
+	const contentError = validateWebchatContent(content);
+	if (contentError) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: contentError
+		}
+	}, 400);
+	const attachmentError = validateWebchatAttachments(attachments);
+	if (attachmentError) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: attachmentError
+		}
+	}, 400);
+	const delivery = body.delivery === "next" || body.delivery === "steer" ? body.delivery : null;
+	if (!delivery) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: "Missing delivery"
+		}
+	}, 400);
+	const origin = endpointTurnClaimSchema.safeParse(body.origin);
+	if (!origin.success) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: "Invalid endpoint origin"
+		}
+	}, 400);
+	if (!deps.service.endpointTools.registry.verifyTurnClaim(origin.data.endpointId, origin.data.token)) return c.json({
+		ok: false,
+		error: {
+			code: "INVALID_ENDPOINT",
+			message: "Endpoint connection is not active"
+		}
+	}, 401);
+	const result = await deps.service.submitSessionInput({
+		sessionKey,
+		clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
+		delivery,
+		content,
+		attachments,
+		thinking: typeof body.thinking === "string" ? body.thinking : void 0,
+		origin: {
+			type: "endpoint",
+			endpointId: origin.data.endpointId
+		}
+	});
+	if (result.ok === false) return c.json({
+		ok: false,
+		error: {
+			code: result.code,
+			message: "Input was not accepted"
+		}
+	}, result.code === "QUEUE_FULL" ? 409 : 400);
+	return c.json({
+		ok: true,
+		payload: {
+			...result,
+			sessionKey
+		}
+	}, 202);
+}
+//#endregion
+export { submitSessionInput };