aiden-runtime 4.1.5 → 4.6.0

package/dist/api/server.js

@@ -81,6 +81,10 @@ const modelDiscovery_1 = require("../core/modelDiscovery");
 const userProfile_1 = require("../core/userProfile");
 const toolRegistry_1 = require("../core/toolRegistry");
 const playwrightBridge_1 = require("../core/playwrightBridge");
+// v4.5 Phase 1 — daemon foundation (gated by AIDEN_DAEMON=1; dormant otherwise).
+// The shared `bootstrapDaemon` module handles every responsibility — db open,
+// runtime lock, crash recovery, health endpoints, signal handlers.
+const daemon_1 = require("../core/v4/daemon");
 const computerControl_1 = require("../core/computerControl");
 const agentLoop_1 = require("../core/agentLoop");
 const statusVerbs_1 = require("../core/statusVerbs");
@@ -503,8 +507,18 @@ function createApiServer() {
             }
         }
     }, 5 * 60 * 1000).unref();
-    // JSON body parsing (10 MB limit)
-    app.use(express_1.default.json({ limit: '10mb' }));
+    // JSON body parsing (10 MB limit) — path-conditional skip for the
+    // v4.5 daemon's webhook routes, which need the RAW body to verify
+    // HMAC signatures. Without this guard, express.json would consume
+    // the request stream before mountWebhookRoutes' inline express.raw
+    // could see it, breaking signature verification (every valid POST
+    // would 401 because we'd HMAC empty bytes).
+    const _jsonParser = express_1.default.json({ limit: '10mb' });
+    app.use((req, res, next) => {
+        if (req.path.startsWith('/api/triggers/webhook/'))
+            return next();
+        return _jsonParser(req, res, next);
+    });
     // Security headers
     app.use((_req, res, next) => {
         res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -6080,9 +6094,22 @@ function startApiServer(portArg) {
         }
         catch { }
     }
-    // ── Clean shutdown: remove PID on signal ────────────────────
-    process.once('SIGINT', () => { removePid(); (0, playwrightBridge_1.pwClose)().finally(() => (0, memoryDistiller_1.distillAllActiveSessions)(8000).finally(() => process.exit(0))); });
-    process.once('SIGTERM', () => { removePid(); (0, playwrightBridge_1.pwClose)().finally(() => (0, memoryDistiller_1.distillAllActiveSessions)(8000).finally(() => process.exit(0))); });
+    // ── v4.5 Phase 1 — daemon foundation (gated, dormant when off) ──
+    // When AIDEN_DAEMON=1, the shared bootstrap module activates the
+    // foundation (opens daemon.db, acquires runtime lock, evaluates
+    // boot state, mounts /health/* + /metrics + /api/daemon/* onto
+    // the existing app, installs the 5-step ordered drain on SIGINT/
+    // SIGTERM/SIGUSR1).
+    //
+    // When AIDEN_DAEMON is unset/=0, bootstrap returns a NOOP_HANDLE
+    // and the legacy signal handlers below run — zero regression for
+    // the current OpenAI-compatible API surface.
+    const _daemonHandle = (0, daemon_1.bootstrapDaemon)({ app });
+    if (!_daemonHandle.active) {
+        // ── Legacy clean shutdown: remove PID on signal (AIDEN_DAEMON=0) ──
+        process.once('SIGINT', () => { removePid(); (0, playwrightBridge_1.pwClose)().finally(() => (0, memoryDistiller_1.distillAllActiveSessions)(8000).finally(() => process.exit(0))); });
+        process.once('SIGTERM', () => { removePid(); (0, playwrightBridge_1.pwClose)().finally(() => (0, memoryDistiller_1.distillAllActiveSessions)(8000).finally(() => process.exit(0))); });
+    }
     // ── EADDRINUSE: kill stale process, retry once ───────────────
     server.on('error', (err) => {
         if (err.code !== 'EADDRINUSE') {