amalgm 0.1.246 → 0.1.247

package/runtime/scripts/amalgm-mcp/automations/scheduler.js

@@ -3,41 +3,32 @@
 /**
  * Automation scheduler.
  *
- * Scheduled delivery is now just one trigger kind. The scheduler claims due
- * scheduled triggers from the unified automation store and runs their
- * workflows; it does not wake an agent unless the workflow explicitly calls
- * an agent/tool cell.
+ * Scheduled delivery is now just one trigger kind. The scheduler materializes
+ * every due slot into the durable local delivery inbox, then asks the shared
+ * delivery worker to drain it.
  *
  * Reliability invariants:
- * - next_run_at is persisted, so triggers due while the process was down are
- *   claimed by the first poll after boot/wake (single-shot catch-up).
+ * - next_run_at is persisted, so every slot due while the process was down is
+ *   materialized by bounded batches after boot/wake.
  * - Boot runs a repair pass that re-arms enabled triggers whose next_run_at
  *   was lost (the claim query skips NULL rows, so without repair those
  *   triggers are permanently dormant).
- * - One automation failing to start must never abort the rest of a claim
- *   batch: claims have already advanced next_run_at, so a lost claim is a
- *   silently missed run.
+ * - A slot advances next_run_at only in the same transaction that inserts its
+ *   delivery. Workflow failure leaves that delivery pending for retry.
  * - Each tick expires stale "running" run rows so crashes and hung cells do
  *   not leave phantom in-progress runs in history.
  */
 
-const crypto = require('crypto');
-
 const { SCHEDULER_INTERVAL_MS } = require('../config');
 const {
   claimDueScheduledTriggers,
   expireStaleAutomationRuns,
   getSchedulerHeartbeat,
   pruneAutomationRuns,
-  recordAutomationRun,
   recordSchedulerHeartbeat,
   repairScheduledTriggers,
 } = require('./store');
-const { executeAutomation } = require('./runner');
-
-// Runs claimed more than this far past their slot are stamped as catch-up
-// runs so workflows and the UI can distinguish "on time" from "made up".
-const CATCH_UP_GRACE_MS = 5 * 60_000;
+const { drainAutomationDeliveries } = require('./deliveries');
 const MAINTENANCE_INTERVAL_MS = 60 * 60_000;
 
 let schedulerTimer = null;
@@ -80,26 +71,6 @@ function startAutomationScheduler() {
   schedulerTimer = setInterval(pollAutomationScheduler, SCHEDULER_INTERVAL_MS);
 }
 
-function recordLostClaim(claim, error) {
-  try {
-    const timestamp = new Date().toISOString();
-    recordAutomationRun(claim.automation.id, {
-      runId: crypto.randomUUID(),
-      automationId: claim.automation.id,
-      automationName: claim.automation.name,
-      triggerId: claim.trigger?.id || null,
-      triggerName: claim.trigger?.name || null,
-      workflowId: claim.automation.workflowId || null,
-      startedAt: timestamp,
-      finishedAt: timestamp,
-      status: 'failed',
-      error: `Scheduled run could not start: ${error.message || error}`,
-    }, { source: 'automation_runs:workflow:start-failed' });
-  } catch (recordError) {
-    console.error('[AmalgmMCP:Automations] Failed to record lost claim:', recordError.message || recordError);
-  }
-}
-
 function pollAutomationScheduler() {
   if (isPolling) return;
   isPolling = true;
@@ -111,36 +82,9 @@ function pollAutomationScheduler() {
     schedulerStatus.lastClaimed = claims.length;
     schedulerStatus.lastError = null;
 
-    for (const claim of claims) {
-      if (!claim?.automation || !claim?.trigger) continue;
-      const scheduledFor = claim.scheduledFor || now.toISOString();
-      const lateMs = Math.max(0, now.getTime() - new Date(scheduledFor).getTime());
-      const eventObj = {
-        id: scheduledFor,
-        source: 'amalgm.scheduler',
-        event: 'scheduled',
-        payload: {
-          scheduledFor,
-          catchUp: lateMs > CATCH_UP_GRACE_MS,
-          lateMs,
-          triggerId: claim.trigger.id,
-          automationId: claim.automation.id,
-        },
-        headers: {},
-        receivedAt: now.toISOString(),
-      };
-      // The claim already advanced next_run_at, so this run will not be
-      // retried — isolate every failure (sync throws included) per claim and
-      // leave a failed run row instead of losing the run invisibly.
-      try {
-        executeAutomation(claim.automation, claim.trigger, eventObj).catch((error) => {
-          console.error(`[AmalgmMCP:Automations] Automation ${claim.automation.id} failed:`, error.message);
-        });
-      } catch (error) {
-        console.error(`[AmalgmMCP:Automations] Automation ${claim.automation.id} could not start:`, error.message || error);
-        recordLostClaim(claim, error);
-      }
-    }
+    void drainAutomationDeliveries().catch((error) => {
+      console.error('[AmalgmMCP:Automations] Delivery drain failed:', error.message || error);
+    });
 
     runSchedulerMaintenance(now);
   } catch (error) {

package/runtime/scripts/amalgm-mcp/automations/store.js

@@ -1121,6 +1121,7 @@ function claimDueScheduledTriggers(now = new Date(), options = {}) {
   const db = openLocalDb();
   const nowDate = validDate(now) || new Date();
   const timestamp = nowDate.toISOString();
+  const limit = Math.max(1, Math.min(Number(options.limit) || 100, 1000));
   const rows = db.prepare(`
     SELECT automation_triggers.*
     FROM automation_triggers
@@ -1148,29 +1149,75 @@ function claimDueScheduledTriggers(now = new Date(), options = {}) {
   const claims = [];
   db.transaction(() => {
     for (const row of rows) {
+      if (claims.length >= limit) break;
       const automation = getAutomation(row.automation_id);
       if (!automation) continue;
-      const trigger = automation.triggers.find((item) => item.id === row.id);
+      let trigger = automation.triggers.find((item) => item.id === row.id);
       if (!trigger) continue;
-      const fired = {
-        ...trigger,
-        lastFiredAt: timestamp,
-        updatedAt: timestamp,
-      };
-      if (fired.schedule?.kind === 'once') fired.enabled = false;
-      fired.nextRunAt = fired.enabled === false
-        ? null
-        : computeNextRunAt(fired, nowDate, { anchor: row.next_run_at });
-      upsertTriggerRow(db, fired);
-      claims.push({
-        automation: composeAutomation(
-          automation,
-          automation.triggers.map((item) => (item.id === fired.id ? fired : item)),
-          automation.workflows,
-        ),
-        trigger: fired,
-        scheduledFor: row.next_run_at,
-      });
+      let scheduledFor = row.next_run_at;
+
+      // Materialize every overdue slot in bounded batches. If the batch fills,
+      // next_run_at deliberately remains overdue so the next scheduler tick
+      // continues from the exact first unmaterialized slot.
+      while (
+        claims.length < limit
+        && scheduledFor
+        && scheduledFor <= timestamp
+        && trigger.enabled !== false
+      ) {
+        const lateMs = Math.max(0, nowDate.getTime() - new Date(scheduledFor).getTime());
+        const deliveryId = `scheduled:${trigger.id}:${scheduledFor}`;
+        db.prepare(`
+          INSERT INTO automation_deliveries (
+            id, kind, trigger_id, scheduled_for, payload_json, status,
+            next_attempt_at, created_at, updated_at
+          ) VALUES (?, 'scheduled', ?, ?, ?, 'pending', ?, ?, ?)
+          ON CONFLICT(id) DO NOTHING
+        `).run(
+          deliveryId,
+          trigger.id,
+          scheduledFor,
+          JSON.stringify({
+            scheduledFor,
+            catchUp: lateMs > 5 * 60_000,
+            lateMs,
+            triggerId: trigger.id,
+            automationId: automation.id,
+          }),
+          timestamp,
+          timestamp,
+          timestamp,
+        );
+
+        const fired = {
+          ...trigger,
+          lastFiredAt: scheduledFor,
+          updatedAt: timestamp,
+        };
+        if (fired.schedule?.kind === 'once') {
+          fired.enabled = false;
+          fired.nextRunAt = null;
+        } else {
+          fired.nextRunAt = computeNextRunAt(
+            fired,
+            new Date(scheduledFor),
+            { anchor: scheduledFor },
+          );
+        }
+        upsertTriggerRow(db, fired);
+        claims.push({
+          deliveryId,
+          automation: composeAutomation(
+            automation,
+            automation.triggers.map((item) => (item.id === fired.id ? fired : item)),
+            automation.workflows,
+          ),
+          trigger: fired,
+          scheduledFor,
+        });
+        trigger = fired;
+        scheduledFor = fired.nextRunAt;
+      }
     }
   })();
 

package/runtime/scripts/amalgm-mcp/events/ingress.js

@@ -1,234 +1,88 @@
+'use strict';
+
 /**
- * /events — webhook ingress.
+ * /events — durable webhook receipt.
  *
- * Accepts raw POST body, requires a verified signature, and on a hit fires a
- * automation workflow run via automations/runner.js and returns 200 with
- * `{ ok, event, triggered }`.
+ * Success means the immutable envelope is in the local SQLite inbox. Workflow
+ * execution happens from that inbox and may outlive this HTTP request.
  */
 
-const {
-  extractSignature,
-  matchAllBySignature,
-  matchBySignature,
-  matchesEventRef,
-  pickSourceLabel,
-  collectPassthroughHeaders,
-} = require('./matcher');
-const { listEventTriggersForIngress, markTriggerFired, recordAutomationRun } = require('../automations/store');
-const { executeAutomationForTrigger } = require('../automations/runner');
-const ring = require('./ring-buffer');
-
-/**
- * Sanitize a sender-declared source/event ref part.
- */
-function cleanRefPart(value) {
-  if (typeof value !== 'string') return '';
-  const trimmed = value.trim();
-  if (!trimmed || trimmed.length > 128) return '';
-  return trimmed;
+const { enqueueEventDelivery, drainAutomationDeliveries } = require('../automations/deliveries');
+
+const MAX_EVENT_BODY_BYTES = 2 * 1024 * 1024;
+const STORED_HEADERS = new Set([
+  'authorization',
+  'content-type',
+  'stripe-signature',
+  'x-amalgm-delivery-id',
+  'x-amalgm-event',
+  'x-amalgm-source',
+  'x-amalgm-webhook-secret',
+  'x-github-delivery',
+  'x-github-event',
+  'x-gitlab-event',
+  'x-gitlab-token',
+  'x-hub-signature',
+  'x-hub-signature-256',
+  'x-linear-event',
+  'x-linear-signature',
+  'x-webhook-secret',
+  'x-webhook-signature',
+]);
+
+function storedHeaders(headers = {}) {
+  const result = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const normalized = key.toLowerCase();
+    if (!STORED_HEADERS.has(normalized)) continue;
+    if (Array.isArray(value)) result[normalized] = value.join(', ');
+    else if (value != null) result[normalized] = String(value);
+  }
+  return result;
 }
 
-/**
- * Read the raw request body as a string.
- */
 async function readRawBody(req) {
-  return new Promise((resolve) => {
-    let data = '';
-    req.on('data', (chunk) => {
-      data += chunk;
-    });
-    req.on('end', () => resolve(data));
-  });
-}
-
-function dayStamp(date = new Date()) {
-  return date.toISOString().slice(0, 10).replace(/-/g, '');
-}
-
-/**
- * Record an authenticated-but-unmatched delivery as a small terminal
- * 'unmatched' run on each authenticated automation. The run id is
- * deterministic per automation + ref + day, so repeated deliveries of the
- * same unmatched ref refresh ONE row (its events array logs each receipt)
- * instead of spamming run history and the live event stream — a sender
- * holding one secret cannot flood the store with junk refs.
- */
-function recordUnmatchedEventRuns(authenticated, eventSource, eventName, timestamp) {
-  const refSlug = `${eventSource}.${eventName}`.toLowerCase().replace(/[^a-z0-9._-]+/g, '_').slice(0, 80);
-  const seenAutomations = new Set();
-  for (const trigger of authenticated) {
-    if (!trigger.automationId || seenAutomations.has(trigger.automationId)) continue;
-    seenAutomations.add(trigger.automationId);
-    try {
-      recordAutomationRun(trigger.automationId, {
-        runId: `unmatched-${trigger.automationId}-${refSlug}-${dayStamp()}`,
-        automationId: trigger.automationId,
-        triggerId: trigger.id,
-        triggerName: trigger.name,
-        status: 'unmatched',
-        startedAt: timestamp,
-        finishedAt: timestamp,
-        output: { received: { source: eventSource, event: eventName, receivedAt: timestamp } },
-        error: `Received ${eventSource}.${eventName} — authenticated, but no trigger selector matched (trigger "${trigger.name}" wants ${trigger.source || '*'}.${trigger.event || '*'}).`,
-      }, { source: 'automation_runs:event-unmatched' });
-    } catch (error) {
-      console.warn('[AmalgmMCP:Events] Failed to record unmatched event run:', error.message || error);
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > MAX_EVENT_BODY_BYTES) {
+      const error = new Error(`Event body exceeds ${MAX_EVENT_BODY_BYTES} bytes`);
+      error.status = 413;
+      throw error;
     }
+    chunks.push(buffer);
   }
+  return Buffer.concat(chunks).toString('utf8');
 }
 
-/**
- * Handle a POST /events request. Assumes CORS + method checking has already
- * happened. Writes the response via `sendJson`.
- *
- * @param req - IncomingMessage
- * @param sendJson - (status, body) => void
- */
 async function handleEventsPost(req, sendJson) {
-  const rawBody = await readRawBody(req);
-  const signature = extractSignature(req.headers);
-  if (!signature) {
-    console.warn('[AmalgmMCP:Events] Rejected unsigned event request');
-    return sendJson(401, { error: 'Webhook signature required' });
-  }
-
-  const triggers = listEventTriggersForIngress();
-  const githubEvent = req.headers['x-github-event'];
-
-  let parsedBody;
   try {
-    parsedBody = JSON.parse(rawBody);
-  } catch {
-    parsedBody = rawBody;
-  }
-
-  // Vendor webhooks (GitHub/Stripe/Linear/GitLab) get their ref from vendor
-  // headers. Generic senders carry no vendor headers, so let them declare
-  // their own ref via x-amalgm-source/x-amalgm-event headers or body
-  // source/event fields — otherwise custom refs like "audit.ping" are
-  // permanently unmatchable. This is safe to read before matching: a sender
-  // still only matches triggers whose per-trigger secret verifies its proof
-  // (HMAC binds the body bytes; token compare authenticates the sender).
-  const vendorSource = pickSourceLabel(req.headers);
-  const vendorEvent =
-    githubEvent ||
-    req.headers['x-linear-event'] ||
-    req.headers['x-gitlab-event'] ||
-    null;
-  let eventSource = vendorSource;
-  let eventName = vendorEvent || 'webhook';
-  let fallbackRef = null;
-  if (vendorSource === 'external' && !vendorEvent) {
-    const headerSource = cleanRefPart(req.headers['x-amalgm-source']);
-    const headerEvent = cleanRefPart(req.headers['x-amalgm-event']);
-    const bodySource = cleanRefPart(typeof parsedBody === 'object' ? parsedBody?.source : null);
-    const bodyEvent = cleanRefPart(typeof parsedBody === 'object' ? parsedBody?.event : null);
-    if (headerSource || headerEvent) {
-      // Explicit x-amalgm-* headers are an unambiguous declaration.
-      eventSource = headerSource || 'external';
-      eventName = headerEvent || 'webhook';
-    } else if (bodySource || bodyEvent) {
-      // Body source/event are often incidental keys in third-party payloads
-      // (e.g. {"event": "user.signup"}). Use them as the primary ref, but
-      // keep the legacy external.webhook ref as a matching fallback so
-      // pre-existing generic triggers pinned to it keep firing.
-      eventSource = bodySource || 'external';
-      eventName = bodyEvent || 'webhook';
-      fallbackRef = { source: 'external', event: 'webhook' };
-    }
-  }
-
-  // GitHub webhook handshake: acknowledge verified ping events immediately.
-  if (githubEvent === 'ping') {
-    const pingTrigger = matchBySignature(triggers, signature, rawBody);
-    if (!pingTrigger) {
-      console.warn('[AmalgmMCP:Events] No trigger matched the GitHub ping signature');
-      return sendJson(401, { error: 'Invalid webhook signature — no matching trigger' });
-    }
-    console.log('[AmalgmMCP:Events] GitHub ping — pong');
-    return sendJson(200, { ok: true, message: 'pong' });
-  }
-
-  // Authenticate first, then filter by source/event, so a bad secret (401)
-  // is distinguishable from a valid-but-unmatched ref (202). Vendors treat
-  // 401 as delivery failure and may auto-disable the webhook.
-  const authenticated = matchAllBySignature(triggers, signature, rawBody);
-  if (!authenticated?.length) {
-    console.warn('[AmalgmMCP:Events] Webhook signature did not verify against any trigger');
-    return sendJson(401, { error: 'Invalid webhook signature' });
-  }
-
-  let matchedTriggers = authenticated.filter((trigger) => (
-    matchesEventRef(trigger, { source: eventSource, event: eventName })
-  ));
-  if (!matchedTriggers.length && fallbackRef) {
-    const fallbackMatches = authenticated.filter((trigger) => matchesEventRef(trigger, fallbackRef));
-    if (fallbackMatches.length > 0) {
-      eventSource = fallbackRef.source;
-      eventName = fallbackRef.event;
-      matchedTriggers = fallbackMatches;
-    }
-  }
-  const eventHeaders = collectPassthroughHeaders(req.headers);
-
-  const eventObj = {
-    source: eventSource,
-    event: eventName,
-    payload: parsedBody,
-    headers: eventHeaders,
-    timestamp: new Date().toISOString(),
-  };
-
-  if (!matchedTriggers.length) {
-    ring.push({ ...eventObj, disposition: 'unmatched' });
-    console.warn(`[AmalgmMCP:Events] Authenticated event ${eventSource}.${eventName} matched no trigger selector`);
-    // Receiving an authenticated event counts as a run: surface it in the
-    // automation's run history instead of a separate event log.
-    recordUnmatchedEventRuns(authenticated, eventSource, eventName, eventObj.timestamp);
+    const rawBody = await readRawBody(req);
+    const headers = storedHeaders(req.headers);
+    const delivery = enqueueEventDelivery({
+      id: headers['x-amalgm-delivery-id'],
+      rawBody,
+      headers,
+      receivedAt: new Date().toISOString(),
+    });
+    void drainAutomationDeliveries().catch((error) => {
+      console.error('[AmalgmMCP:Events] Delivery drain failed:', error.message || error);
+    });
     return sendJson(202, {
       ok: true,
-      triggered: false,
-      reason: `No enabled trigger matches ${eventSource}.${eventName}`,
-      authenticatedTriggerIds: authenticated.map((trigger) => trigger.id),
+      accepted: true,
+      deliveryId: delivery.id,
+      status: delivery.status,
     });
+  } catch (error) {
+    return sendJson(error.status || 500, { error: error.message || String(error) });
   }
-
-  console.log(
-    `[AmalgmMCP:Events] Matched ${matchedTriggers.length} trigger(s) for ${eventSource}.${eventName}`,
-  );
-  ring.push(eventObj);
-
-  for (const matchedTrigger of matchedTriggers) {
-    // Isolate per trigger: a synchronous throw (missing workflow, IR drift)
-    // must not skip the remaining matched triggers or 5xx the sender.
-    try {
-      executeAutomationForTrigger(matchedTrigger.id, eventObj).catch((err) => {
-        console.error(
-          `[AmalgmMCP:Events] Automation workflow failed for trigger "${matchedTrigger.name}":`,
-          err.message,
-        );
-      });
-    } catch (err) {
-      console.error(
-        `[AmalgmMCP:Events] Automation could not start for trigger "${matchedTrigger.name}":`,
-        err.message || err,
-      );
-    }
-
-    try {
-      markTriggerFired(matchedTrigger.id, { source: 'events:ingress' });
-    } catch (err) {
-      console.error(`[AmalgmMCP:Events] Failed to mark trigger fired "${matchedTrigger.name}":`, err.message || err);
-    }
-  }
-
-  return sendJson(200, {
-    ok: true,
-    event: eventObj,
-    triggered: true,
-    triggerCount: matchedTriggers.length,
-    triggerIds: matchedTriggers.map((trigger) => trigger.id),
-  });
 }
 
-module.exports = { handleEventsPost };
+module.exports = {
+  handleEventsPost,
+  readRawBody,
+  storedHeaders,
+};