agent-relay-server 0.4.22 → 0.4.23

package/src/db.ts

@@ -21,6 +21,9 @@ import type {
   TaskSeverity,
   TaskStatus,
   IntegrationEventInput,
+  InboxDraft,
+  InboxState,
+  InboxThreadState,
   TaskStatusInput,
 } from "./types";
 import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS } from "./config";
@@ -144,6 +147,27 @@ export function initDb(path: string = "agent-relay.db"): Database {
     CREATE INDEX IF NOT EXISTS idx_pairs_requester ON pairs(requester_id);
     CREATE INDEX IF NOT EXISTS idx_pairs_target ON pairs(target_id);
     CREATE INDEX IF NOT EXISTS idx_pairs_status ON pairs(status);
+
+    CREATE TABLE IF NOT EXISTS inbox_thread_state (
+      operator_id TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      read_cursor_message_id INTEGER,
+      archived_at_message_id INTEGER,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (operator_id, peer_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_inbox_thread_operator ON inbox_thread_state(operator_id);
+
+    CREATE TABLE IF NOT EXISTS inbox_drafts (
+      operator_id TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      body TEXT NOT NULL,
+      subject TEXT,
+      channel TEXT,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (operator_id, peer_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_inbox_drafts_operator ON inbox_drafts(operator_id);
   `);
 
   // Migrations
@@ -257,6 +281,44 @@ function parseStringArray(raw: string): string[] {
   return parsed.filter((value): value is string => typeof value === "string");
 }
 
+function normalizeTags(tags: string[] | undefined): string[] {
+  return [...new Set((tags ?? []).map((tag) => tag.trim()).filter(Boolean))];
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+function inferProviderTag(input: RegisterAgentInput): "claude" | "codex" | undefined {
+  const meta = input.meta ?? {};
+  const values = [
+    input.id,
+    input.name,
+    input.rig,
+    ...(input.tags ?? []),
+    stringValue(meta.provider),
+    stringValue(meta.client),
+    stringValue(meta.runtime),
+    stringValue(meta.agentType),
+  ].filter((value): value is string => typeof value === "string");
+
+  if (values.some((value) => value.toLowerCase().includes("codex"))) return "codex";
+  if (values.some((value) => value.toLowerCase().includes("claude"))) return "claude";
+
+  // Older Claude hooks did not always send an explicit provider tag, but did
+  // send Claude-style approval metadata. Codex also sends approvalMode, so this
+  // fallback only runs after Codex signals have been ruled out.
+  if (Object.prototype.hasOwnProperty.call(meta, "approvalMode")) return "claude";
+  return undefined;
+}
+
+function tagsWithProvider(input: RegisterAgentInput): string[] {
+  const tags = normalizeTags(input.tags);
+  const provider = inferProviderTag(input);
+  if (!provider || tags.includes(provider)) return tags;
+  return [provider, ...tags];
+}
+
 function rowToAgent(row: any): AgentCard {
   return {
     id: row.id,
@@ -355,6 +417,27 @@ function rowToPair(row: any): PairSession {
   };
 }
 
+function rowToInboxThreadState(row: any): InboxThreadState {
+  return {
+    operatorId: row.operator_id,
+    peerId: row.peer_id,
+    readCursorMessageId: row.read_cursor_message_id ?? undefined,
+    archivedAtMessageId: row.archived_at_message_id ?? undefined,
+    updatedAt: row.updated_at,
+  };
+}
+
+function rowToInboxDraft(row: any): InboxDraft {
+  return {
+    operatorId: row.operator_id,
+    peerId: row.peer_id,
+    body: row.body,
+    subject: row.subject ?? undefined,
+    channel: row.channel ?? undefined,
+    updatedAt: row.updated_at,
+  };
+}
+
 const MSG_SELECT = `SELECT m.*, (
   SELECT json_group_array(agent_id) FROM message_reads WHERE message_id = m.id
 ) AS read_by_agents FROM messages m`;
@@ -363,6 +446,7 @@ const MSG_SELECT = `SELECT m.*, (
 
 export function upsertAgent(input: RegisterAgentInput): AgentCard {
   const now = Date.now();
+  const tags = tagsWithProvider(input);
   // Preserve the existing label across re-registrations unless the caller
   // explicitly sends one (including null to clear).
   const labelProvided = Object.prototype.hasOwnProperty.call(input, "label");
@@ -394,7 +478,7 @@ export function upsertAgent(input: RegisterAgentInput): AgentCard {
     $name: input.name,
     $label: input.label ?? null,
     $labelProvided: labelProvided ? 1 : 0,
-    $tags: JSON.stringify(input.tags ?? []),
+    $tags: JSON.stringify(tags),
     $machine: input.machine ?? null,
     $rig: input.rig ?? null,
     $capabilities: JSON.stringify(input.capabilities ?? []),
@@ -1423,6 +1507,75 @@ export function markRead(messageId: number, agentId: string): boolean {
   return true;
 }
 
+export function getInboxState(operatorId: string): InboxState {
+  const threads = (db.prepare(
+    "SELECT * FROM inbox_thread_state WHERE operator_id = ? ORDER BY updated_at DESC",
+  ).all(operatorId) as any[]).map(rowToInboxThreadState);
+  const drafts = (db.prepare(
+    "SELECT * FROM inbox_drafts WHERE operator_id = ? ORDER BY updated_at DESC",
+  ).all(operatorId) as any[]).map(rowToInboxDraft);
+  return { operatorId, threads, drafts };
+}
+
+export function setInboxThreadState(input: {
+  operatorId: string;
+  peerId: string;
+  readCursorMessageId?: number | null;
+  archivedAtMessageId?: number | null;
+}): InboxThreadState {
+  const now = Date.now();
+  const current = db.prepare(
+    "SELECT * FROM inbox_thread_state WHERE operator_id = ? AND peer_id = ?",
+  ).get(input.operatorId, input.peerId) as any | undefined;
+
+  const readCursorMessageId = Object.prototype.hasOwnProperty.call(input, "readCursorMessageId")
+    ? input.readCursorMessageId ?? null
+    : current?.read_cursor_message_id ?? null;
+  const archivedAtMessageId = Object.prototype.hasOwnProperty.call(input, "archivedAtMessageId")
+    ? input.archivedAtMessageId ?? null
+    : current?.archived_at_message_id ?? null;
+
+  db.prepare(`
+    INSERT INTO inbox_thread_state (operator_id, peer_id, read_cursor_message_id, archived_at_message_id, updated_at)
+    VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(operator_id, peer_id) DO UPDATE SET
+      read_cursor_message_id = excluded.read_cursor_message_id,
+      archived_at_message_id = excluded.archived_at_message_id,
+      updated_at = excluded.updated_at
+  `).run(input.operatorId, input.peerId, readCursorMessageId, archivedAtMessageId, now);
+
+  return rowToInboxThreadState(db.prepare(
+    "SELECT * FROM inbox_thread_state WHERE operator_id = ? AND peer_id = ?",
+  ).get(input.operatorId, input.peerId));
+}
+
+export function setInboxDraft(input: {
+  operatorId: string;
+  peerId: string;
+  body: string;
+  subject?: string | null;
+  channel?: string | null;
+}): InboxDraft {
+  const now = Date.now();
+  db.prepare(`
+    INSERT INTO inbox_drafts (operator_id, peer_id, body, subject, channel, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(operator_id, peer_id) DO UPDATE SET
+      body = excluded.body,
+      subject = excluded.subject,
+      channel = excluded.channel,
+      updated_at = excluded.updated_at
+  `).run(input.operatorId, input.peerId, input.body, input.subject ?? null, input.channel ?? null, now);
+
+  return rowToInboxDraft(db.prepare(
+    "SELECT * FROM inbox_drafts WHERE operator_id = ? AND peer_id = ?",
+  ).get(input.operatorId, input.peerId));
+}
+
+export function deleteInboxDraft(operatorId: string, peerId: string): boolean {
+  return db.prepare("DELETE FROM inbox_drafts WHERE operator_id = ? AND peer_id = ?").run(operatorId, peerId).changes > 0;
+}
+
 export function deleteMessage(id: number): boolean {
   return db.transaction(() => {
     // Break reply_to references from children so the FK doesn't block delete.

package/src/routes.ts

@@ -36,6 +36,10 @@ import {
   rejectPair,
   endPair,
   sendPairMessage,
+  getInboxState,
+  setInboxThreadState,
+  setInboxDraft,
+  deleteInboxDraft,
   createCallbackDelivery,
   finishCallbackDelivery,
   validateAgentSession,
@@ -209,6 +213,15 @@ function cleanPositiveId(value: unknown, field: string): number | undefined {
   return value;
 }
 
+function cleanNullablePositiveId(value: unknown, field: string): number | null | undefined {
+  if (value === undefined) return undefined;
+  if (value === null) return null;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
+    throw new ValidationError(`${field} must be a positive integer or null`);
+  }
+  return value;
+}
+
 function cleanEpoch(value: unknown, field: string): number | undefined {
   if (value === undefined || value === null) return undefined;
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
@@ -370,6 +383,50 @@ function normalizePairMessageInput(body: unknown): PairMessageInput {
   };
 }
 
+function cleanOperatorId(value: unknown): string {
+  return cleanString(value, "operatorId", { max: 200 }) || "user";
+}
+
+function normalizeInboxThreadStateInput(body: unknown): {
+  operatorId: string;
+  peerId: string;
+  readCursorMessageId?: number | null;
+  archivedAtMessageId?: number | null;
+} {
+  if (!isRecord(body)) throw new ValidationError("JSON object body required");
+  const input: {
+    operatorId: string;
+    peerId: string;
+    readCursorMessageId?: number | null;
+    archivedAtMessageId?: number | null;
+  } = {
+    operatorId: cleanOperatorId(body.operatorId),
+    peerId: cleanString(body.peerId, "peerId", { required: true, max: 200 })!,
+  };
+  const readCursorMessageId = cleanNullablePositiveId(body.readCursorMessageId, "readCursorMessageId");
+  if (readCursorMessageId !== undefined) input.readCursorMessageId = readCursorMessageId;
+  const archivedAtMessageId = cleanNullablePositiveId(body.archivedAtMessageId, "archivedAtMessageId");
+  if (archivedAtMessageId !== undefined) input.archivedAtMessageId = archivedAtMessageId;
+  return input;
+}
+
+function normalizeInboxDraftInput(body: unknown): {
+  operatorId: string;
+  peerId: string;
+  body: string;
+  subject?: string;
+  channel?: string;
+} {
+  if (!isRecord(body)) throw new ValidationError("JSON object body required");
+  return {
+    operatorId: cleanOperatorId(body.operatorId),
+    peerId: cleanString(body.peerId, "peerId", { required: true, max: 200 })!,
+    body: cleanString(body.body, "body", { required: true, max: MAX_BODY_BYTES })!,
+    subject: cleanString(body.subject, "subject", { max: 200 }),
+    channel: cleanString(body.channel, "channel", { max: 120 }),
+  };
+}
+
 function pairErrorStatus(code: string): number {
   if (code === "not_found") return 404;
   if (code === "busy") return 409;
@@ -730,6 +787,49 @@ const deleteMessageById: Handler = (_req, params) => {
 
 const getCursorRoute: Handler = () => json({ latestId: getLatestMessageId() });
 
+// --- Inbox operator state ---
+
+const getInboxStateRoute: Handler = (req) => {
+  const url = new URL(req.url);
+  const operatorId = cleanOperatorId(url.searchParams.get("operatorId") ?? undefined);
+  return json(getInboxState(operatorId));
+};
+
+const patchInboxThreadState: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(setInboxThreadState(normalizeInboxThreadStateInput(parsed.body)));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+const putInboxDraft: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(setInboxDraft(normalizeInboxDraftInput(parsed.body)));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+const deleteInboxDraftRoute: Handler = (req) => {
+  const url = new URL(req.url);
+  try {
+    const operatorId = cleanOperatorId(url.searchParams.get("operatorId") ?? undefined);
+    const peerId = cleanString(url.searchParams.get("peerId") ?? undefined, "peerId", { required: true, max: 200 })!;
+    deleteInboxDraft(operatorId, peerId);
+    return json({ ok: true });
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
 // --- Tasks and integrations ---
 
 const postIntegrationEvent: Handler = async (req) => {
@@ -1001,6 +1101,11 @@ const routes: Route[] = [
   route("PATCH", "/api/messages/:id", patchMessage),
   route("DELETE", "/api/messages/:id", deleteMessageById),
 
+  route("GET", "/api/inbox/state", getInboxStateRoute),
+  route("PATCH", "/api/inbox/threads", patchInboxThreadState),
+  route("PUT", "/api/inbox/drafts", putInboxDraft),
+  route("DELETE", "/api/inbox/drafts", deleteInboxDraftRoute),
+
   route("POST", "/api/integrations/events", postIntegrationEvent),
   route("GET", "/api/tasks", getTasks),
   route("GET", "/api/tasks/:id", getTaskById),

package/src/security.ts

@@ -55,7 +55,7 @@ export function corsPreflight(req: Request): Response {
 
   const response = new Response(null, {
     headers: {
-      "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
+      "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
       "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Agent-Relay-Token, Idempotency-Key, X-Agent-Relay-Instance-Id, X-Agent-Relay-Epoch",
       "Access-Control-Max-Age": "600",
     },
@@ -97,6 +97,7 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname === "/api/events") return "events:read";
   if (pathname.startsWith("/api/integrations/")) return method === "GET" ? "integrations:read" : "integrations:write";
   if (pathname.startsWith("/api/agents")) return method === "GET" ? "agents:read" : "agents:write";
+  if (pathname.startsWith("/api/inbox")) return method === "GET" ? "messages:read" : "messages:write";
   if (pathname.startsWith("/api/messages")) return method === "GET" ? "messages:read" : "messages:write";
   if (pathname.startsWith("/api/tasks")) return method === "GET" ? "tasks:read" : "tasks:write";
   if (pathname.startsWith("/api/pairs")) return method === "GET" ? "pairs:read" : "pairs:write";

package/src/types.ts

@@ -184,6 +184,29 @@ export interface TaskStatusInput {
   metadata?: Record<string, unknown>;
 }
 
+export interface InboxThreadState {
+  operatorId: string;
+  peerId: string;
+  readCursorMessageId?: number;
+  archivedAtMessageId?: number;
+  updatedAt: number;
+}
+
+export interface InboxDraft {
+  operatorId: string;
+  peerId: string;
+  body: string;
+  subject?: string;
+  channel?: string;
+  updatedAt: number;
+}
+
+export interface InboxState {
+  operatorId: string;
+  threads: InboxThreadState[];
+  drafts: InboxDraft[];
+}
+
 export interface HealthCheck {
   name: string;
   status: "ok" | "warn" | "error";