ai-agent-command-center 0.0.0-stage → 1.0.0

package/server/dist/server/src/index.js

@@ -0,0 +1,241 @@
+/**
+ * AI Agent Command Center — Backend Server Entry Point
+ */
+import express from 'express';
+import cors from 'cors';
+import { config } from './config/index.js';
+import { initializeDatabase, checkDatabaseHealth } from './db/index.js';
+import { realtimeHub } from './services/realtime.js';
+import { v4 as uuidv4 } from 'uuid';
+import { securityHeadersMiddleware } from './middleware/securityHeaders.js';
+import { authRateLimiter, computeRateLimiter, globalApiRateLimiter } from './middleware/rateLimiter.js';
+import agentsRouter from './routes/agents.js';
+import providersRouter from './routes/providers.js';
+import tasksRouter from './routes/tasks.js';
+import projectsRouter from './routes/projects.js';
+import activitiesRouter from './routes/activities.js';
+import monitoringRouter from './routes/monitoring.js';
+import dashboardRouter from './routes/dashboard.js';
+import authRouter from './routes/auth.js';
+import reportsRouter from './routes/reports.js';
+import notificationsRouter from './routes/notifications.js';
+import documentsRouter from './routes/documents.js';
+import orchestratorRouter from './routes/orchestrator.js';
+import systemRouter from './routes/system.js';
+import playgroundRouter from './routes/playground.js';
+import webhooksRouter from './routes/webhooks.js';
+import { pipelineRouter } from './routes/pipeline.js';
+import actionsRouter from './routes/actions.js';
+import ragRouter from './routes/rag.js';
+import swarmRouter from './routes/swarm.js';
+import { schedulesRouter } from './routes/schedules.js';
+import { alertsRouter } from './routes/alerts.js';
+import { evalsRouter } from './routes/evals.js';
+import { mcpRouter } from './routes/mcp.js';
+import { workflowsRouter } from './routes/workflows.js';
+import { warRoomsRouter } from './routes/warRooms.js';
+import { webResearchRouter } from './routes/webResearch.js';
+import { sreRouter } from './routes/sre.js';
+import { dataAnalystRouter } from './routes/dataAnalyst.js';
+import { skillsRouter } from './routes/skills.js';
+import memoryGraphRouter from './routes/memoryGraph.js';
+import domainRouter from './routes/domain.js';
+import { systemLogger } from './services/logger.js';
+export const app = express();
+// Security Hardening: Trust Proxy for accurate client IP resolution behind Caddy
+app.set('trust proxy', 1);
+// Security Hardening: Disable fingerprinting headers
+app.disable('x-powered-by');
+// Global Graceful Shutdown State
+let isShuttingDown = false;
+// Reject new incoming traffic with 503 if server is gracefully shutting down
+app.use((req, res, next) => {
+    if (isShuttingDown) {
+        res.setHeader('Connection', 'close');
+        return res.status(503).json({
+            error: {
+                code: 'SERVER_SHUTTING_DOWN',
+                message: 'Server sedang dalam proses shutdown. Silakan coba sesaat lagi.'
+            }
+        });
+    }
+    next();
+});
+// Security & Standard Middlewares
+app.use(securityHeadersMiddleware);
+app.use(cors());
+app.use(express.json({ limit: '15mb' }));
+// DoS & Flood Protection
+app.use('/api', globalApiRateLimiter);
+// Request logging (sanitized, zero secret leaking)
+app.use((req, _res, next) => {
+    const sanitizedUrl = req.originalUrl.split('?')[0];
+    console.log(`[API] ${req.method} ${sanitizedUrl}`);
+    if (!sanitizedUrl.startsWith('/api/realtime') && !sanitizedUrl.startsWith('/api/monitoring/logs')) {
+        systemLogger.debug('API', `${req.method} ${sanitizedUrl}`);
+    }
+    next();
+});
+// Real-time Server-Sent Events (SSE) Stream
+app.get('/api/realtime', (req, res) => {
+    res.setHeader('Content-Type', 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache');
+    res.setHeader('Connection', 'keep-alive');
+    res.flushHeaders();
+    const clientId = `client-${uuidv4().slice(0, 8)}`;
+    realtimeHub.addClient(clientId, res);
+});
+// Targeted Abuse-Protection Rate Limiters
+app.use('/api/auth/login', authRateLimiter);
+app.use('/api/playground/execute', computeRateLimiter);
+app.use('/api/evals/run', computeRateLimiter);
+app.use('/api/webhooks/dispatch-task', computeRateLimiter);
+// Mount modular feature routes
+app.use('/api/auth', authRouter);
+app.use('/api/agents', agentsRouter);
+app.use('/api/providers', providersRouter);
+app.use('/api/tasks', tasksRouter);
+app.use('/api/projects', projectsRouter);
+app.use('/api/activities', activitiesRouter);
+app.use('/api/monitoring', monitoringRouter);
+app.use('/api/dashboard', dashboardRouter);
+app.use('/api/reports', reportsRouter);
+app.use('/api/notifications', notificationsRouter);
+app.use('/api/documents', documentsRouter);
+app.use('/api/orchestrator', orchestratorRouter);
+app.use('/api/system', systemRouter);
+app.use('/api/playground', playgroundRouter);
+app.use('/api/webhooks', webhooksRouter);
+app.use('/api/pipeline', pipelineRouter);
+app.use('/api/actions', actionsRouter);
+app.use('/api/rag', ragRouter);
+app.use('/api/swarm', swarmRouter);
+app.use('/api/schedules', schedulesRouter);
+app.use('/api/alerts', alertsRouter);
+app.use('/api/evals', evalsRouter);
+app.use('/api/mcp', mcpRouter);
+app.use('/api/workflows', workflowsRouter);
+app.use('/api/war-rooms', warRoomsRouter);
+app.use('/api/web-research', webResearchRouter);
+app.use('/api/sre', sreRouter);
+app.use('/api/data-analyst', dataAnalystRouter);
+app.use('/api/skills', skillsRouter);
+app.use('/api/memory-graph', memoryGraphRouter);
+app.use('/api/system/domain', domainRouter);
+// Comprehensive Root Healthcheck with Database Connectivity Validation
+app.get('/healthz', async (_req, res) => {
+    const dbHealth = await checkDatabaseHealth();
+    const isHealthy = dbHealth.ok && !isShuttingDown;
+    res.status(isHealthy ? 200 : 503).json({
+        status: isHealthy ? 'ok' : 'degraded',
+        database: dbHealth.ok ? 'connected' : 'disconnected',
+        dbLatencyMs: dbHealth.latencyMs,
+        uptimeSeconds: Math.floor(process.uptime()),
+        timestamp: new Date().toISOString()
+    });
+});
+// Serve frontend static files if client/dist exists
+import path from 'path';
+import fs from 'fs';
+import { fileURLToPath } from 'url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const candidateDistPaths = [
+    path.resolve(process.cwd(), 'client/dist'),
+    path.resolve(__dirname, '../../../client/dist'),
+    path.resolve(__dirname, '../../../../client/dist'),
+    path.resolve(__dirname, '../../client/dist')
+];
+const clientDist = candidateDistPaths.find(p => fs.existsSync(p)) || candidateDistPaths[0];
+if (fs.existsSync(clientDist)) {
+    app.use(express.static(clientDist));
+    app.get('*', (req, res, next) => {
+        if (req.path.startsWith('/api') || req.path === '/healthz') {
+            return next();
+        }
+        res.sendFile(path.join(clientDist, 'index.html'));
+    });
+}
+// Resilient Global Error Handler (Prevents ERR_HTTP_HEADERS_SENT crashes)
+app.use((err, _req, res, next) => {
+    if (res.headersSent) {
+        return next(err);
+    }
+    console.error('[Error]', err);
+    res.status(err.status || 500).json({
+        error: {
+            code: err.code || 'INTERNAL_SERVER_ERROR',
+            message: err.message || 'Terjadi kesalahan internal pada server.'
+        }
+    });
+});
+export async function startServer() {
+    await initializeDatabase();
+    const { SwarmService } = await import('./services/swarmService.js');
+    await SwarmService.recoverInterruptedMissions();
+    const { SchedulerService } = await import('./services/schedulerService.js');
+    SchedulerService.startDaemon(30000);
+    const server = app.listen(config.port, '0.0.0.0', () => {
+        console.log(`[Server] AI Agent Command Center backend listening on port ${config.port} (0.0.0.0)`);
+    });
+    // Architectural Resilience: True Graceful Shutdown Handler
+    const gracefulShutdown = async (signal) => {
+        if (isShuttingDown)
+            return;
+        isShuttingDown = true;
+        console.log(`[Server] Received ${signal}. Initiating graceful shutdown...`);
+        // 10-second hard fallback timeout to avoid hanging processes
+        const forceExitTimer = setTimeout(() => {
+            console.error('[Server] Graceful shutdown timed out (10s). Forcing termination.');
+            process.exit(1);
+        }, 10000);
+        forceExitTimer.unref();
+        try {
+            // 1. Stop background daemons and schedulers
+            const { taskRunner } = await import('./services/orchestrator.js');
+            taskRunner.stop();
+            SchedulerService.stopDaemon();
+            // 2. Disconnect real-time SSE clients
+            realtimeHub.closeAll();
+            // 3. Stop accepting new HTTP requests and drain active requests
+            await new Promise((resolve) => {
+                server.close((err) => {
+                    if (err)
+                        console.error('[Server] Error while closing HTTP server:', err);
+                    else
+                        console.log('[Server] In-flight HTTP requests drained and server closed.');
+                    resolve();
+                });
+            });
+            // 4. Safely terminate database pool after HTTP connections have drained
+            const { pool } = await import('./db/index.js');
+            await pool.end();
+            console.log('[Server] Database pool closed cleanly. Shutdown complete.');
+            clearTimeout(forceExitTimer);
+            process.exit(0);
+        }
+        catch (shutdownErr) {
+            console.error('[Server] Error during graceful shutdown:', shutdownErr);
+            process.exit(1);
+        }
+    };
+    process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
+    process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+    return server;
+}
+// Global Process Stability Handlers
+process.on('uncaughtException', (err) => {
+    console.error('[Process UncaughtException]', err);
+    systemLogger.error('SYSTEM', `Uncaught exception: ${err.message}`, { stack: err.stack });
+});
+process.on('unhandledRejection', (reason) => {
+    console.error('[Process UnhandledRejection]', reason);
+    systemLogger.error('SYSTEM', `Unhandled rejection: ${reason?.message || reason}`);
+});
+// Auto-start if executed directly
+if (process.env.NODE_ENV !== 'test') {
+    startServer().catch(err => {
+        console.error('Failed to start server:', err);
+        process.exit(1);
+    });
+}

package/server/dist/server/src/middleware/rateLimiter.js

@@ -0,0 +1,76 @@
+/**
+ * Creates an in-memory sliding-window rate limiter middleware
+ */
+export function createRateLimiter(options) {
+    const { windowMs, max, message = 'Terlalu banyak permintaan. Silakan coba beberapa saat lagi.', code = 'RATE_LIMIT_EXCEEDED', skipInTests = true } = options;
+    const hits = new Map();
+    // Periodic memory garbage collection every 60 seconds
+    const cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [key, record] of hits.entries()) {
+            if (now > record.resetAt) {
+                hits.delete(key);
+            }
+        }
+    }, 60000);
+    // Prevent interval from blocking process shutdown
+    cleanupInterval.unref();
+    return (req, res, next) => {
+        if (skipInTests && process.env.NODE_ENV === 'test' && !req.headers['x-test-rate-limit']) {
+            return next();
+        }
+        const clientIp = (req.ip || req.socket.remoteAddress || 'unknown').toString();
+        const now = Date.now();
+        const existing = hits.get(clientIp);
+        if (!existing || now > existing.resetAt) {
+            hits.set(clientIp, {
+                count: 1,
+                resetAt: now + windowMs
+            });
+            res.setHeader('X-RateLimit-Limit', max);
+            res.setHeader('X-RateLimit-Remaining', max - 1);
+            res.setHeader('X-RateLimit-Reset', Math.ceil((now + windowMs) / 1000));
+            return next();
+        }
+        if (existing.count >= max) {
+            const retryAfterSec = Math.ceil((existing.resetAt - now) / 1000);
+            res.setHeader('Retry-After', retryAfterSec);
+            res.setHeader('X-RateLimit-Limit', max);
+            res.setHeader('X-RateLimit-Remaining', 0);
+            res.setHeader('X-RateLimit-Reset', Math.ceil(existing.resetAt / 1000));
+            return res.status(429).json({
+                error: {
+                    code,
+                    message,
+                    retryAfterSeconds: retryAfterSec
+                }
+            });
+        }
+        existing.count += 1;
+        res.setHeader('X-RateLimit-Limit', max);
+        res.setHeader('X-RateLimit-Remaining', Math.max(0, max - existing.count));
+        res.setHeader('X-RateLimit-Reset', Math.ceil(existing.resetAt / 1000));
+        return next();
+    };
+}
+// 1. Strict rate limiter for Authentication (prevent credential brute-force)
+export const authRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000, // 1 minute
+    max: 15,
+    message: 'Terlalu banyak percobaan login gagal. Mohon tunggu 1 menit sebelum mencoba kembali.',
+    code: 'AUTH_RATE_LIMIT_EXCEEDED'
+});
+// 2. Compute / Task execution rate limiter (prevent LLM compute exhaustion)
+export const computeRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000, // 1 minute
+    max: 30,
+    message: 'Batas eksekusi komputasi intensif tercapai. Silakan coba kembali dalam 1 menit.',
+    code: 'COMPUTE_RATE_LIMIT_EXCEEDED'
+});
+// 3. Global API flood protection limiter (prevent DoS flooding)
+export const globalApiRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000, // 1 minute
+    max: 300,
+    message: 'Terlalu banyak request ke API. Silakan perlambat frekuensi panggilan Anda.',
+    code: 'API_RATE_LIMIT_EXCEEDED'
+});

package/server/dist/server/src/middleware/securityHeaders.js

@@ -0,0 +1,21 @@
+/**
+ * Security Headers Middleware — Enforces HTTP defense-in-depth protections
+ * Prevents MIME sniffing, clickjacking, inline script execution attacks, and removes fingerprinting headers.
+ */
+export function securityHeadersMiddleware(req, res, next) {
+    // 1. Remove technology fingerprint headers
+    res.removeHeader('X-Powered-By');
+    // 2. Prevent MIME-type confusion attacks
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    // 3. Mitigate clickjacking via framing restrictions
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+    // 4. Enable browser XSS filter block mode
+    res.setHeader('X-XSS-Protection', '1; mode=block');
+    // 5. Enforce HTTPS via HSTS
+    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+    // 6. Referrer leakage defense
+    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+    // 7. Restrict unneeded browser hardware capabilities
+    res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+    next();
+}

package/server/dist/server/src/routes/actions.js

@@ -0,0 +1,79 @@
+/**
+ * Agent Actions & Tool Calling Router — AI Agent Command Center
+ */
+import { Router } from 'express';
+import { ActionManager } from '../services/actionManager.js';
+import { AVAILABLE_TOOLS } from '../services/sandbox.js';
+import { pool } from '../db/index.js';
+const router = Router();
+// GET /api/actions — List recent actions
+router.get('/', async (req, res) => {
+    try {
+        const status = req.query.status;
+        const limit = parseInt(req.query.limit, 10) || 50;
+        const actions = await ActionManager.listActions(status, limit);
+        res.json({ actions });
+    }
+    catch (err) {
+        res.status(500).json({ error: { message: err.message } });
+    }
+});
+// GET /api/actions/tools — List available sandbox tools and risk definitions
+router.get('/tools', (_req, res) => {
+    res.json({ tools: Object.values(AVAILABLE_TOOLS) });
+});
+// GET /api/actions/pending-count — Quick count of actions awaiting approval
+router.get('/pending-count', async (_req, res) => {
+    try {
+        const countRes = await pool.query("SELECT count(*) as count FROM agent_actions WHERE status = 'PENDING';");
+        res.json({ pendingCount: parseInt(countRes.rows[0].count, 10) });
+    }
+    catch (err) {
+        res.status(500).json({ error: { message: err.message } });
+    }
+});
+// POST /api/actions/request — Request a new tool execution
+router.post('/request', async (req, res) => {
+    try {
+        const { agentId, toolName, toolInput, taskId, runId, autoApprove } = req.body;
+        if (!agentId || !toolName || !toolInput) {
+            return res.status(400).json({ error: { message: 'agentId, toolName, dan toolInput wajib diisi.' } });
+        }
+        const action = await ActionManager.requestAction({
+            agentId,
+            toolName,
+            toolInput,
+            taskId,
+            runId,
+            autoApprove
+        });
+        res.status(201).json(action);
+    }
+    catch (err) {
+        res.status(500).json({ error: { message: err.message } });
+    }
+});
+// POST /api/actions/:id/approve — Operator approves an action
+router.post('/:id/approve', async (req, res) => {
+    try {
+        const operatorId = req.body.operatorId || 'lead-operator';
+        const action = await ActionManager.executeAction(req.params.id, operatorId);
+        res.json(action);
+    }
+    catch (err) {
+        res.status(500).json({ error: { message: err.message } });
+    }
+});
+// POST /api/actions/:id/reject — Operator rejects an action
+router.post('/:id/reject', async (req, res) => {
+    try {
+        const operatorId = req.body.operatorId || 'lead-operator';
+        const reason = req.body.reason;
+        const action = await ActionManager.rejectAction(req.params.id, operatorId, reason);
+        res.json(action);
+    }
+    catch (err) {
+        res.status(500).json({ error: { message: err.message } });
+    }
+});
+export default router;

package/server/dist/server/src/routes/activities.js

@@ -0,0 +1,35 @@
+/**
+ * Activities API Routes — AI Agent Command Center
+ */
+import { Router } from 'express';
+import { pool } from '../db/index.js';
+const router = Router();
+// GET /api/activities
+router.get('/', async (req, res) => {
+    try {
+        const limit = parseInt(req.query.limit || '30', 10);
+        const result = await pool.query(`
+      SELECT id, workspace_id, actor_type, actor_id, actor_name, event_type, summary, target_type, target_id, created_at
+      FROM activities
+      ORDER BY created_at DESC
+      LIMIT $1;
+    `, [limit]);
+        const activities = result.rows.map(row => ({
+            id: row.id,
+            workspaceId: row.workspace_id,
+            actorType: row.actor_type,
+            actorId: row.actor_id,
+            actorName: row.actor_name,
+            eventType: row.event_type,
+            summary: row.summary,
+            targetType: row.target_type,
+            targetId: row.target_id,
+            createdAt: row.created_at
+        }));
+        res.json(activities);
+    }
+    catch (err) {
+        res.status(500).json({ error: { message: err.message } });
+    }
+});
+export default router;