agentic-factory-bridge 1.0.0

package/bridge.js

@@ -0,0 +1,700 @@
+/**
+ * Agentic Factory Bridge — Local bridge between Atos Agentic Factory and OpenCode CLI.
+ *
+ * This lightweight Express server runs on the user's machine (port 3001)
+ * and acts as an intermediary:
+ *   1. Receives execution requests from the marketplace frontend
+ *   2. Spawns `opencode run --format json` with the given prompt
+ *   3. Reports results back to the marketplace backend via PATCH
+ *
+ * Security features:
+ *   - CORS restricted to allowed origins
+ *   - HMAC token authentication on all mutating endpoints
+ *   - Input sanitization to prevent command injection
+ *   - Rate limiting on sensitive endpoints
+ *   - Bounded in-memory store with TTL
+ *   - Body size limits
+ *   - No sensitive info leaked in /health
+ *
+ * Usage:
+ *   npm install -g agentic-factory-bridge
+ *   agentic-factory-bridge start
+ *
+ * Environment variables:
+ *   BRIDGE_PORT          — Port to listen on (default: 3001)
+ *   MARKETPLACE_API_URL  — Marketplace backend URL (default: http://localhost:3000/api)
+ *   OPENCODE_PATH        — Path to opencode binary (default: "opencode" — must be in PATH)
+ *   BRIDGE_SECRET        — Shared secret for HMAC authentication (default: auto-generated)
+ *   BRIDGE_CORS_ORIGIN   — Allowed CORS origins, comma-separated
+ */
+
+const express = require('express');
+const cors = require('cors');
+const crypto = require('crypto');
+const { v4: uuidv4 } = require('uuid');
+const { spawn } = require('child_process');
+const http = require('http');
+const https = require('https');
+const path = require('path');
+const fs = require('fs');
+
+const BRIDGE_VERSION = require(path.join(__dirname, 'package.json')).version;
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+const PORT = parseInt(process.env.BRIDGE_PORT || '3001', 10);
+const MARKETPLACE_API_URL = process.env.MARKETPLACE_API_URL || 'http://localhost:3000/api';
+const OPENCODE_PATH = process.env.OPENCODE_PATH || 'opencode';
+
+// Security configuration
+const BRIDGE_SECRET = process.env.BRIDGE_SECRET || crypto.randomBytes(32).toString('hex');
+const CORS_ORIGIN =
+  process.env.BRIDGE_CORS_ORIGIN ||
+  'http://localhost:4200,https://atos-agentic-factory.onrender.com';
+
+// Rate limiting configuration
+const RATE_LIMITS = {
+  execute: { windowMs: 60000, max: 10 },
+  install: { windowMs: 3600000, max: 2 },
+  register: { windowMs: 3600000, max: 3 },
+};
+
+// In-memory store limits
+const MAX_EXECUTIONS = 100;
+const EXECUTION_TTL_MS = 3600000;
+
+// ---------------------------------------------------------------------------
+// Security: Input sanitization
+// ---------------------------------------------------------------------------
+
+const DANGEROUS_PATTERNS = /[&|;`$<>{}()\n\r]/;
+const DANGEROUS_WIN_PATTERNS = /(\^[&|<>])|(%[a-zA-Z0-9]+%)/;
+
+function sanitizeInput(input, fieldName, maxLength = 10000) {
+  if (typeof input !== 'string') {
+    return { safe: false, cleaned: '', reason: `${fieldName} must be a string` };
+  }
+  if (input.length > maxLength) {
+    return {
+      safe: false,
+      cleaned: '',
+      reason: `${fieldName} exceeds maximum length of ${maxLength}`,
+    };
+  }
+  if (DANGEROUS_PATTERNS.test(input)) {
+    return {
+      safe: false,
+      cleaned: '',
+      reason: `${fieldName} contains forbidden characters (& | ; \` $ < > { } ( ))`,
+    };
+  }
+  if (process.platform === 'win32' && DANGEROUS_WIN_PATTERNS.test(input)) {
+    return {
+      safe: false,
+      cleaned: '',
+      reason: `${fieldName} contains forbidden Windows patterns`,
+    };
+  }
+  return { safe: true, cleaned: input.trim() };
+}
+
+function validateModel(model) {
+  if (!model) return { safe: true, cleaned: '' };
+  if (typeof model !== 'string') {
+    return { safe: false, cleaned: '', reason: 'model must be a string' };
+  }
+  if (model.length > 200) {
+    return { safe: false, cleaned: '', reason: 'model name too long (max 200)' };
+  }
+  if (!/^[a-zA-Z0-9_\-./]+$/.test(model)) {
+    return {
+      safe: false,
+      cleaned: '',
+      reason: 'model contains invalid characters (only a-z, 0-9, - _ . / allowed)',
+    };
+  }
+  return { safe: true, cleaned: model };
+}
+
+// ---------------------------------------------------------------------------
+// Security: HMAC token authentication
+// ---------------------------------------------------------------------------
+
+function generateBridgeToken() {
+  const timestamp = Date.now().toString();
+  const hmac = crypto.createHmac('sha256', BRIDGE_SECRET).update(timestamp).digest('hex');
+  return `${timestamp}.${hmac}`;
+}
+
+function verifyBridgeToken(token) {
+  if (!token || typeof token !== 'string') return false;
+  const parts = token.split('.');
+  if (parts.length !== 2) return false;
+  const [timestamp, hmac] = parts;
+  const ts = parseInt(timestamp, 10);
+  if (isNaN(ts)) return false;
+  const now = Date.now();
+  if (Math.abs(now - ts) > 5 * 60 * 1000) return false;
+  const expected = crypto.createHmac('sha256', BRIDGE_SECRET).update(timestamp).digest('hex');
+  return crypto.timingSafeEqual(Buffer.from(hmac, 'hex'), Buffer.from(expected, 'hex'));
+}
+
+function requireBridgeAuth(req, res, next) {
+  const token = req.headers['x-bridge-token'];
+  if (!verifyBridgeToken(token)) {
+    return res.status(401).json({
+      error: 'Unauthorized: invalid or missing X-Bridge-Token header',
+    });
+  }
+  next();
+}
+
+// ---------------------------------------------------------------------------
+// Security: Rate limiting
+// ---------------------------------------------------------------------------
+
+const rateLimitStore = new Map();
+
+function rateLimit(key, config) {
+  return (req, res, next) => {
+    const ip = req.ip || req.connection.remoteAddress || 'unknown';
+    const storeKey = `${key}:${ip}`;
+    const now = Date.now();
+    let entry = rateLimitStore.get(storeKey);
+    if (!entry || now >= entry.resetAt) {
+      entry = { count: 0, resetAt: now + config.windowMs };
+      rateLimitStore.set(storeKey, entry);
+    }
+    entry.count++;
+    if (entry.count > config.max) {
+      const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
+      res.set('Retry-After', String(retryAfter));
+      return res.status(429).json({
+        error: `Too many requests. Limit: ${config.max} per ${config.windowMs / 1000}s. Retry after ${retryAfter}s.`,
+      });
+    }
+    next();
+  };
+}
+
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of rateLimitStore) {
+    if (now >= entry.resetAt) rateLimitStore.delete(key);
+  }
+}, 600000);
+
+// ---------------------------------------------------------------------------
+// In-memory execution store
+// ---------------------------------------------------------------------------
+
+const executions = new Map();
+
+function evictStaleExecutions() {
+  const now = Date.now();
+  for (const [id, exec] of executions) {
+    if (now - exec.startedAt.getTime() > EXECUTION_TTL_MS) {
+      executions.delete(id);
+    }
+  }
+  if (executions.size > MAX_EXECUTIONS) {
+    const sorted = Array.from(executions.entries()).sort(
+      (a, b) => a[1].startedAt.getTime() - b[1].startedAt.getTime(),
+    );
+    const toRemove = sorted.slice(0, executions.size - MAX_EXECUTIONS);
+    for (const [id] of toRemove) {
+      executions.delete(id);
+    }
+  }
+}
+
+setInterval(evictStaleExecutions, 300000);
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function httpRequest(method, url, body, token) {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    const mod = parsed.protocol === 'https:' ? https : http;
+    const payload = JSON.stringify(body);
+    const options = {
+      hostname: parsed.hostname,
+      port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
+      path: parsed.pathname + parsed.search,
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(payload),
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      },
+    };
+    const req = mod.request(options, (res) => {
+      let data = '';
+      res.on('data', (chunk) => (data += chunk));
+      res.on('end', () => {
+        try {
+          resolve({ status: res.statusCode, body: JSON.parse(data) });
+        } catch {
+          resolve({ status: res.statusCode, body: data });
+        }
+      });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+async function reportToBackend(executionId, update, token) {
+  const url = `${MARKETPLACE_API_URL}/opencode/executions/${executionId}`;
+  try {
+    const result = await httpRequest('PATCH', url, update, token);
+    console.log(`[bridge] Reported to backend: ${url} -> ${result.status}`);
+  } catch (err) {
+    console.error(`[bridge] Failed to report to backend: ${err.message}`);
+  }
+}
+
+function runOpenCode(prompt, model) {
+  return new Promise((resolve, reject) => {
+    const args = ['run', prompt, '--format', 'json'];
+    if (model) {
+      args.push('--model', model);
+    }
+    console.log(`[bridge] Spawning: ${OPENCODE_PATH} ${args.join(' ')}`);
+    const proc = spawn(OPENCODE_PATH, args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 300000,
+      shell: false,
+      windowsHide: true,
+    });
+    let stdout = '';
+    let stderr = '';
+    proc.stdout.on('data', (data) => {
+      stdout += data.toString();
+    });
+    proc.stderr.on('data', (data) => {
+      stderr += data.toString();
+    });
+    proc.on('close', (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr, code });
+      } else {
+        reject(new Error(`OpenCode exited with code ${code}: ${stderr || stdout}`));
+      }
+    });
+    proc.on('error', (err) => {
+      reject(new Error(`Failed to spawn OpenCode: ${err.message}`));
+    });
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Express app
+// ---------------------------------------------------------------------------
+const app = express();
+
+const allowedOrigins = CORS_ORIGIN.split(',').map((o) => o.trim());
+app.use(
+  cors({
+    origin: (origin, callback) => {
+      if (!origin) return callback(null, true);
+      if (allowedOrigins.includes(origin)) return callback(null, true);
+      callback(new Error(`CORS: origin ${origin} not allowed`));
+    },
+    credentials: true,
+  }),
+);
+
+app.use(express.json({ limit: '1mb' }));
+
+app.use((_req, res, next) => {
+  res.set('X-Content-Type-Options', 'nosniff');
+  res.set('X-Frame-Options', 'DENY');
+  res.set('Cache-Control', 'no-store');
+  next();
+});
+
+// ---------------------------------------------------------------------------
+// Public endpoints
+// ---------------------------------------------------------------------------
+
+app.get('/health', (_req, res) => {
+  res.json({
+    status: 'ok',
+    bridge: 'agentic-factory-bridge',
+    version: BRIDGE_VERSION,
+    uptime: Math.floor(process.uptime()),
+    activeExecutions: executions.size,
+  });
+});
+
+app.get('/bridge-token', (_req, res) => {
+  const token = generateBridgeToken();
+  res.json({ token, expiresIn: 300 });
+});
+
+// ---------------------------------------------------------------------------
+// Protected endpoints
+// ---------------------------------------------------------------------------
+
+app.post(
+  '/execute',
+  requireBridgeAuth,
+  rateLimit('execute', RATE_LIMITS.execute),
+  async (req, res) => {
+    const { executionId, prompt, agentId, model, token } = req.body;
+
+    if (!executionId || !prompt) {
+      return res.status(400).json({ error: 'Missing required fields: executionId, prompt' });
+    }
+    if (!token) {
+      return res
+        .status(400)
+        .json({ error: 'Missing required field: token (JWT for backend callback)' });
+    }
+    if (
+      typeof executionId !== 'string' ||
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(executionId)
+    ) {
+      return res.status(400).json({ error: 'executionId must be a valid UUID' });
+    }
+
+    const promptCheck = sanitizeInput(prompt, 'prompt');
+    if (!promptCheck.safe) {
+      return res.status(400).json({ error: promptCheck.reason });
+    }
+    const modelCheck = validateModel(model);
+    if (!modelCheck.safe) {
+      return res.status(400).json({ error: modelCheck.reason });
+    }
+
+    evictStaleExecutions();
+
+    const execution = {
+      id: executionId,
+      status: 'running',
+      startedAt: new Date(),
+      prompt: promptCheck.cleaned,
+      agentId,
+      model: modelCheck.cleaned || undefined,
+      logs: [],
+    };
+    executions.set(executionId, execution);
+
+    res.json({ message: 'Execution started', executionId, status: 'running' });
+
+    const startTime = Date.now();
+    try {
+      execution.logs.push(`[${new Date().toISOString()}] Starting OpenCode CLI...`);
+      const result = await runOpenCode(promptCheck.cleaned, modelCheck.cleaned || undefined);
+      const executionTime = Date.now() - startTime;
+      execution.status = 'completed';
+      execution.logs.push(`[${new Date().toISOString()}] Completed in ${executionTime}ms`);
+
+      let response = result.stdout;
+      let tokensUsed = null;
+      let cost = null;
+      try {
+        const parsed = JSON.parse(result.stdout);
+        response = parsed.response || parsed.output || parsed.result || result.stdout;
+        tokensUsed = parsed.tokens || parsed.tokensUsed || null;
+        cost = parsed.cost || null;
+      } catch {
+        execution.logs.push(`[${new Date().toISOString()}] Output is not JSON, using raw text`);
+      }
+
+      execution.response = response;
+      await reportToBackend(
+        executionId,
+        {
+          status: 'completed',
+          response: typeof response === 'string' ? response : JSON.stringify(response),
+          executionTime,
+          tokensUsed,
+          cost,
+          logs: execution.logs,
+          bridgeVersion: BRIDGE_VERSION,
+        },
+        token,
+      );
+    } catch (err) {
+      const executionTime = Date.now() - startTime;
+      execution.status = 'failed';
+      execution.error = err.message;
+      execution.logs.push(`[${new Date().toISOString()}] Error: ${err.message}`);
+      await reportToBackend(
+        executionId,
+        {
+          status: 'failed',
+          errorMessage: err.message,
+          executionTime,
+          logs: execution.logs,
+          bridgeVersion: BRIDGE_VERSION,
+        },
+        token,
+      );
+    }
+  },
+);
+
+app.get('/status/:executionId', requireBridgeAuth, (req, res) => {
+  const execution = executions.get(req.params.executionId);
+  if (!execution) {
+    return res.status(404).json({ error: 'Execution not found' });
+  }
+  res.json({
+    id: execution.id,
+    status: execution.status,
+    startedAt: execution.startedAt,
+    prompt: execution.prompt,
+    response: execution.response,
+    error: execution.error,
+    logs: execution.logs,
+  });
+});
+
+app.get('/executions', requireBridgeAuth, (_req, res) => {
+  const list = Array.from(executions.values()).map((e) => ({
+    id: e.id,
+    status: e.status,
+    startedAt: e.startedAt,
+    prompt: e.prompt.substring(0, 100) + (e.prompt.length > 100 ? '...' : ''),
+    agentId: e.agentId,
+  }));
+  res.json(list);
+});
+
+app.delete('/executions', requireBridgeAuth, (_req, res) => {
+  const count = executions.size;
+  executions.clear();
+  res.json({ message: `Cleared ${count} executions` });
+});
+
+// ---------------------------------------------------------------------------
+// Smart Detection
+// ---------------------------------------------------------------------------
+
+function checkCommandExists(command) {
+  return new Promise((resolve) => {
+    const isWin = process.platform === 'win32';
+    const checkCmd = isWin ? 'where' : 'which';
+    const proc = spawn(checkCmd, [command], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 10000,
+      shell: false,
+    });
+    let stdout = '';
+    proc.stdout.on('data', (data) => {
+      stdout += data.toString();
+    });
+    proc.on('close', (code) => {
+      if (code === 0 && stdout.trim()) {
+        const cmdPath = stdout.trim().split('\n')[0].trim();
+        const versionProc = spawn(command, ['--version'], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+          timeout: 10000,
+          shell: false,
+        });
+        let versionOut = '';
+        versionProc.stdout.on('data', (d) => {
+          versionOut += d.toString();
+        });
+        versionProc.stderr.on('data', (d) => {
+          versionOut += d.toString();
+        });
+        versionProc.on('close', () => {
+          resolve({ installed: true, version: versionOut.trim() || 'unknown', path: cmdPath });
+        });
+        versionProc.on('error', () => {
+          resolve({ installed: true, version: 'unknown', path: cmdPath });
+        });
+      } else {
+        resolve({ installed: false, version: null, path: null });
+      }
+    });
+    proc.on('error', () => {
+      resolve({ installed: false, version: null, path: null });
+    });
+  });
+}
+
+app.get('/check-opencode', async (_req, res) => {
+  try {
+    const result = await checkCommandExists(OPENCODE_PATH);
+    console.log(
+      `[bridge] OpenCode check: installed=${result.installed}, version=${result.version}`,
+    );
+    res.json(result);
+  } catch (err) {
+    console.error(`[bridge] OpenCode check error: ${err.message}`);
+    res.json({ installed: false, version: null, path: null, error: err.message });
+  }
+});
+
+app.post(
+  '/install-opencode',
+  requireBridgeAuth,
+  rateLimit('install', RATE_LIMITS.install),
+  async (_req, res) => {
+    console.log('[bridge] Installing OpenCode CLI via npm install -g opencode...');
+    try {
+      await new Promise((resolve, reject) => {
+        const proc = spawn('npm', ['install', '-g', 'opencode'], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+          timeout: 120000,
+          shell: false,
+        });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (data) => {
+          stdout += data.toString();
+          console.log(`[bridge] npm install stdout: ${data.toString().trim()}`);
+        });
+        proc.stderr.on('data', (data) => {
+          stderr += data.toString();
+        });
+        proc.on('close', (code) => {
+          if (code === 0) resolve({ success: true, stdout, stderr });
+          else
+            reject(
+              new Error(`npm install -g opencode failed with code ${code}: ${stderr || stdout}`),
+            );
+        });
+        proc.on('error', (err) => {
+          reject(new Error(`Failed to spawn npm: ${err.message}`));
+        });
+      });
+
+      const check = await checkCommandExists(OPENCODE_PATH);
+      res.json({
+        success: true,
+        message: 'OpenCode CLI installed successfully',
+        version: check.version || 'unknown',
+        path: check.path || null,
+      });
+    } catch (err) {
+      console.error(`[bridge] OpenCode install error: ${err.message}`);
+      res.status(500).json({
+        success: false,
+        message: `Installation failed: ${err.message}`,
+        version: null,
+        path: null,
+      });
+    }
+  },
+);
+
+// ---------------------------------------------------------------------------
+// Protocol Registration
+// ---------------------------------------------------------------------------
+
+app.post(
+  '/register-protocol',
+  requireBridgeAuth,
+  rateLimit('register', RATE_LIMITS.register),
+  async (_req, res) => {
+    const isWin = process.platform === 'win32';
+    if (!isWin) {
+      return res.status(400).json({
+        success: false,
+        message: 'Protocol registration is only supported on Windows.',
+      });
+    }
+
+    const scriptPath = path.join(__dirname, 'install-protocol.ps1');
+    const handlerPath = path.join(__dirname, 'opencode-handler.cmd');
+
+    if (!fs.existsSync(scriptPath)) {
+      return res.status(404).json({
+        success: false,
+        message: `install-protocol.ps1 not found in ${__dirname}`,
+      });
+    }
+    if (!fs.existsSync(handlerPath)) {
+      return res.status(404).json({
+        success: false,
+        message: `opencode-handler.cmd not found in ${__dirname}`,
+      });
+    }
+
+    console.log('[bridge] Registering opencode:// protocol via install-protocol.ps1...');
+
+    try {
+      await new Promise((resolve, reject) => {
+        const proc = spawn(
+          'powershell',
+          ['-ExecutionPolicy', 'Bypass', '-NonInteractive', '-File', scriptPath],
+          {
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: 30000,
+            shell: false,
+          },
+        );
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (data) => {
+          stdout += data.toString();
+          console.log(`[bridge] ps1 stdout: ${data.toString().trim()}`);
+        });
+        proc.stderr.on('data', (data) => {
+          stderr += data.toString();
+        });
+        proc.on('close', (code) => {
+          if (code === 0) resolve({ stdout, stderr });
+          else
+            reject(new Error(`install-protocol.ps1 exited with code ${code}: ${stderr || stdout}`));
+        });
+        proc.on('error', (err) => {
+          reject(new Error(`Failed to spawn PowerShell: ${err.message}`));
+        });
+      });
+
+      res.json({
+        success: true,
+        message: 'Protocol opencode:// registered successfully. Please restart your browser.',
+      });
+    } catch (err) {
+      console.error(`[bridge] Protocol registration error: ${err.message}`);
+      res.status(500).json({
+        success: false,
+        message: `Registration failed: ${err.message}`,
+      });
+    }
+  },
+);
+
+// ---------------------------------------------------------------------------
+// Start server
+// ---------------------------------------------------------------------------
+app.listen(PORT, '127.0.0.1', () => {
+  const isAutoSecret = !process.env.BRIDGE_SECRET;
+  console.log('');
+  console.log('  +----------------------------------------------+');
+  console.log('  |                                              |');
+  console.log(`  |   Agentic Factory Bridge v${BRIDGE_VERSION.padEnd(19)}|`);
+  console.log(`  |   Listening on http://127.0.0.1:${PORT}        |`);
+  console.log('  |                                              |');
+  const origins = CORS_ORIGIN.split(',').map((o) => o.trim());
+  origins.forEach((o, i) => {
+    const label = i === 0 ? 'CORS:     ' : '          ';
+    console.log(`  |   ${label}${o.padEnd(33).substring(0, 33)}|`);
+  });
+  console.log('  |                                              |');
+  if (isAutoSecret) {
+    console.log('  |   [!] Using auto-generated bridge secret     |');
+    console.log('  |       Set BRIDGE_SECRET env var for fixed key |');
+  } else {
+    console.log('  |   [OK] Using configured BRIDGE_SECRET        |');
+  }
+  console.log('  |                                              |');
+  console.log('  +----------------------------------------------+');
+  console.log('');
+  if (isAutoSecret) {
+    console.log(`  Bridge secret: ${BRIDGE_SECRET.substring(0, 16)}...`);
+    console.log('');
+  }
+});