corporateai 0.0.1

package/server/src/adapters/types.ts

@@ -0,0 +1,30 @@
+// Re-export all types from the shared adapter-utils package.
+// This file is kept as a convenience shim so existing in-tree
+// imports (process/, http/, heartbeat.ts) don't need rewriting.
+export type {
+  AdapterAgent,
+  AdapterSessionManagement,
+  AdapterRuntime,
+  UsageSummary,
+  AdapterExecutionResult,
+  AdapterInvocationMeta,
+  AdapterExecutionContext,
+  AdapterEnvironmentCheckLevel,
+  AdapterEnvironmentCheck,
+  AdapterEnvironmentTestStatus,
+  AdapterEnvironmentTestResult,
+  AdapterEnvironmentTestContext,
+  AdapterSkillSyncMode,
+  AdapterSkillState,
+  AdapterSkillOrigin,
+  AdapterSkillEntry,
+  AdapterSkillSnapshot,
+  AdapterSkillContext,
+  AdapterSessionCodec,
+  AdapterModel,
+  NativeContextManagement,
+  ResolvedSessionCompactionPolicy,
+  SessionCompactionPolicy,
+  ServerAdapterModule,
+} from "@corporateai/adapter-utils";
+

package/server/src/adapters/utils.ts

@@ -0,0 +1,48 @@
+// Re-export everything from the shared adapter-utils/server-utils package.
+// This file is kept as a convenience shim so existing in-tree
+// imports (process/, http/, heartbeat.ts) don't need rewriting.
+import { logger } from "../middleware/logger.js";
+export {
+  type RunProcessResult,
+  runningProcesses,
+  MAX_CAPTURE_BYTES,
+  MAX_EXCERPT_BYTES,
+  parseObject,
+  asString,
+  asNumber,
+  asBoolean,
+  asStringArray,
+  parseJson,
+  appendWithCap,
+  resolvePathValue,
+  renderTemplate,
+  redactEnvForLogs,
+  buildPaperclipEnv,
+  defaultPathForPlatform,
+  ensurePathInEnv,
+  ensureAbsoluteDirectory,
+  ensureCommandResolvable,
+} from "@corporateai/adapter-utils/server-utils";
+
+// Re-export runChildProcess with the server's pino logger wired in.
+import { runChildProcess as _runChildProcess } from "@corporateai/adapter-utils/server-utils";
+import type { RunProcessResult } from "@corporateai/adapter-utils/server-utils";
+
+export async function runChildProcess(
+  runId: string,
+  command: string,
+  args: string[],
+  opts: {
+    cwd: string;
+    env: Record<string, string>;
+    timeoutSec: number;
+    graceSec: number;
+    onLog: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+  },
+): Promise<RunProcessResult> {
+  return _runChildProcess(runId, command, args, {
+    ...opts,
+    onLogError: (err, id, msg) => logger.warn({ err, runId: id }, msg),
+  });
+}
+

package/server/src/agent-auth-jwt.ts

@@ -0,0 +1,141 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+interface JwtHeader {
+  alg: string;
+  typ?: string;
+}
+
+export interface LocalAgentJwtClaims {
+  sub: string;
+  company_id: string;
+  adapter_type: string;
+  run_id: string;
+  iat: number;
+  exp: number;
+  iss?: string;
+  aud?: string;
+  jti?: string;
+}
+
+const JWT_ALGORITHM = "HS256";
+
+function parseNumber(value: string | undefined, fallback: number) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+  return Math.floor(parsed);
+}
+
+function jwtConfig() {
+  const secret = process.env.PAPERCLIP_AGENT_JWT_SECRET;
+  if (!secret) return null;
+
+  return {
+    secret,
+    ttlSeconds: parseNumber(process.env.PAPERCLIP_AGENT_JWT_TTL_SECONDS, 60 * 60 * 48),
+    issuer: process.env.PAPERCLIP_AGENT_JWT_ISSUER ?? "paperclip",
+    audience: process.env.PAPERCLIP_AGENT_JWT_AUDIENCE ?? "paperclip-api",
+  };
+}
+
+function base64UrlEncode(value: string) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+
+function base64UrlDecode(value: string) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+
+function signPayload(secret: string, signingInput: string) {
+  return createHmac("sha256", secret).update(signingInput).digest("base64url");
+}
+
+function parseJson(value: string): Record<string, unknown> | null {
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" ? parsed as Record<string, unknown> : null;
+  } catch {
+    return null;
+  }
+}
+
+function safeCompare(a: string, b: string) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+
+export function createLocalAgentJwt(agentId: string, companyId: string, adapterType: string, runId: string) {
+  const config = jwtConfig();
+  if (!config) return null;
+
+  const now = Math.floor(Date.now() / 1000);
+  const claims: LocalAgentJwtClaims = {
+    sub: agentId,
+    company_id: companyId,
+    adapter_type: adapterType,
+    run_id: runId,
+    iat: now,
+    exp: now + config.ttlSeconds,
+    iss: config.issuer,
+    aud: config.audience,
+  };
+
+  const header = {
+    alg: JWT_ALGORITHM,
+    typ: "JWT",
+  };
+
+  const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+  const signature = signPayload(config.secret, signingInput);
+
+  return `${signingInput}.${signature}`;
+}
+
+export function verifyLocalAgentJwt(token: string): LocalAgentJwtClaims | null {
+  if (!token) return null;
+  const config = jwtConfig();
+  if (!config) return null;
+
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [headerB64, claimsB64, signature] = parts;
+
+  const header = parseJson(base64UrlDecode(headerB64));
+  if (!header || header.alg !== JWT_ALGORITHM) return null;
+
+  const signingInput = `${headerB64}.${claimsB64}`;
+  const expectedSig = signPayload(config.secret, signingInput);
+  if (!safeCompare(signature, expectedSig)) return null;
+
+  const claims = parseJson(base64UrlDecode(claimsB64));
+  if (!claims) return null;
+
+  const sub = typeof claims.sub === "string" ? claims.sub : null;
+  const companyId = typeof claims.company_id === "string" ? claims.company_id : null;
+  const adapterType = typeof claims.adapter_type === "string" ? claims.adapter_type : null;
+  const runId = typeof claims.run_id === "string" ? claims.run_id : null;
+  const iat = typeof claims.iat === "number" ? claims.iat : null;
+  const exp = typeof claims.exp === "number" ? claims.exp : null;
+  if (!sub || !companyId || !adapterType || !runId || !iat || !exp) return null;
+
+  const now = Math.floor(Date.now() / 1000);
+  if (exp < now) return null;
+
+  const issuer = typeof claims.iss === "string" ? claims.iss : undefined;
+  const audience = typeof claims.aud === "string" ? claims.aud : undefined;
+  if (issuer && issuer !== config.issuer) return null;
+  if (audience && audience !== config.audience) return null;
+
+  return {
+    sub,
+    company_id: companyId,
+    adapter_type: adapterType,
+    run_id: runId,
+    iat,
+    exp,
+    ...(issuer ? { iss: issuer } : {}),
+    ...(audience ? { aud: audience } : {}),
+    jti: typeof claims.jti === "string" ? claims.jti : undefined,
+  };
+}

package/server/src/app.ts

@@ -0,0 +1,321 @@
+import express, { Router, type Request as ExpressRequest } from "express";
+import path from "node:path";
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import type { Db } from "@corporateai/db";
+import type { DeploymentExposure, DeploymentMode } from "@corporateai/shared";
+import type { StorageService } from "./storage/types.js";
+import { httpLogger, errorHandler } from "./middleware/index.js";
+import { actorMiddleware } from "./middleware/auth.js";
+import { boardMutationGuard } from "./middleware/board-mutation-guard.js";
+import { privateHostnameGuard, resolvePrivateHostnameAllowSet } from "./middleware/private-hostname-guard.js";
+import { healthRoutes } from "./routes/health.js";
+import { companyRoutes } from "./routes/companies.js";
+import { companySkillRoutes } from "./routes/company-skills.js";
+import { agentRoutes } from "./routes/agents.js";
+import { projectRoutes } from "./routes/projects.js";
+import { issueRoutes } from "./routes/issues.js";
+import { routineRoutes } from "./routes/routines.js";
+import { executionWorkspaceRoutes } from "./routes/execution-workspaces.js";
+import { goalRoutes } from "./routes/goals.js";
+import { approvalRoutes } from "./routes/approvals.js";
+import { secretRoutes } from "./routes/secrets.js";
+import { costRoutes } from "./routes/costs.js";
+import { activityRoutes } from "./routes/activity.js";
+import { dashboardRoutes } from "./routes/dashboard.js";
+import { sidebarBadgeRoutes } from "./routes/sidebar-badges.js";
+import { instanceSettingsRoutes } from "./routes/instance-settings.js";
+import { llmRoutes } from "./routes/llms.js";
+import { assetRoutes } from "./routes/assets.js";
+import { accessRoutes } from "./routes/access.js";
+import { pluginRoutes } from "./routes/plugins.js";
+import { pluginUiStaticRoutes } from "./routes/plugin-ui-static.js";
+import { applyUiBranding } from "./ui-branding.js";
+import { logger } from "./middleware/logger.js";
+import { DEFAULT_LOCAL_PLUGIN_DIR, pluginLoader } from "./services/plugin-loader.js";
+import { createPluginWorkerManager } from "./services/plugin-worker-manager.js";
+import { createPluginJobScheduler } from "./services/plugin-job-scheduler.js";
+import { pluginJobStore } from "./services/plugin-job-store.js";
+import { createPluginToolDispatcher } from "./services/plugin-tool-dispatcher.js";
+import { pluginLifecycleManager } from "./services/plugin-lifecycle.js";
+import { createPluginJobCoordinator } from "./services/plugin-job-coordinator.js";
+import { buildHostServices, flushPluginLogBuffer } from "./services/plugin-host-services.js";
+import { createPluginEventBus } from "./services/plugin-event-bus.js";
+import { setPluginEventBus } from "./services/activity-log.js";
+import { createPluginDevWatcher } from "./services/plugin-dev-watcher.js";
+import { createPluginHostServiceCleanup } from "./services/plugin-host-service-cleanup.js";
+import { pluginRegistryService } from "./services/plugin-registry.js";
+import { createHostClientHandlers } from "@corporateai/plugin-sdk";
+import type { BetterAuthSessionResult } from "./auth/better-auth.js";
+
+type UiMode = "none" | "static" | "vite-dev";
+
+export function resolveViteHmrPort(serverPort: number): number {
+  if (serverPort <= 55_535) {
+    return serverPort + 10_000;
+  }
+  return Math.max(1_024, serverPort - 10_000);
+}
+
+export async function createApp(
+  db: Db,
+  opts: {
+    uiMode: UiMode;
+    serverPort: number;
+    storageService: StorageService;
+    deploymentMode: DeploymentMode;
+    deploymentExposure: DeploymentExposure;
+    allowedHostnames: string[];
+    bindHost: string;
+    authReady: boolean;
+    companyDeletionEnabled: boolean;
+    instanceId?: string;
+    hostVersion?: string;
+    localPluginDir?: string;
+    betterAuthHandler?: express.RequestHandler;
+    resolveSession?: (req: ExpressRequest) => Promise<BetterAuthSessionResult | null>;
+  },
+) {
+  const app = express();
+
+  app.use(express.json({
+    // Company import/export payloads can inline full portable packages.
+    limit: "10mb",
+    verify: (req, _res, buf) => {
+      (req as unknown as { rawBody: Buffer }).rawBody = buf;
+    },
+  }));
+  app.use(httpLogger);
+  const privateHostnameGateEnabled =
+    opts.deploymentMode === "authenticated" && opts.deploymentExposure === "private";
+  const privateHostnameAllowSet = resolvePrivateHostnameAllowSet({
+    allowedHostnames: opts.allowedHostnames,
+    bindHost: opts.bindHost,
+  });
+  app.use(
+    privateHostnameGuard({
+      enabled: privateHostnameGateEnabled,
+      allowedHostnames: opts.allowedHostnames,
+      bindHost: opts.bindHost,
+    }),
+  );
+  app.use(
+    actorMiddleware(db, {
+      deploymentMode: opts.deploymentMode,
+      resolveSession: opts.resolveSession,
+    }),
+  );
+  app.get("/api/auth/get-session", (req, res) => {
+    if (req.actor.type !== "board" || !req.actor.userId) {
+      res.status(401).json({ error: "Unauthorized" });
+      return;
+    }
+    res.json({
+      session: {
+        id: `paperclip:${req.actor.source}:${req.actor.userId}`,
+        userId: req.actor.userId,
+      },
+      user: {
+        id: req.actor.userId,
+        email: null,
+        name: req.actor.source === "local_implicit" ? "Local Board" : null,
+      },
+    });
+  });
+  if (opts.betterAuthHandler) {
+    app.all("/api/auth/*authPath", opts.betterAuthHandler);
+  }
+  app.use(llmRoutes(db));
+
+  // Mount API routes
+  const api = Router();
+  api.use(boardMutationGuard());
+  api.use(
+    "/health",
+    healthRoutes(db, {
+      deploymentMode: opts.deploymentMode,
+      deploymentExposure: opts.deploymentExposure,
+      authReady: opts.authReady,
+      companyDeletionEnabled: opts.companyDeletionEnabled,
+    }),
+  );
+  api.use("/companies", companyRoutes(db, opts.storageService));
+  api.use(companySkillRoutes(db));
+  api.use(agentRoutes(db));
+  api.use(assetRoutes(db, opts.storageService));
+  api.use(projectRoutes(db));
+  api.use(issueRoutes(db, opts.storageService));
+  api.use(routineRoutes(db));
+  api.use(executionWorkspaceRoutes(db));
+  api.use(goalRoutes(db));
+  api.use(approvalRoutes(db));
+  api.use(secretRoutes(db));
+  api.use(costRoutes(db));
+  api.use(activityRoutes(db));
+  api.use(dashboardRoutes(db));
+  api.use(sidebarBadgeRoutes(db));
+  api.use(instanceSettingsRoutes(db));
+  const hostServicesDisposers = new Map<string, () => void>();
+  const workerManager = createPluginWorkerManager();
+  const pluginRegistry = pluginRegistryService(db);
+  const eventBus = createPluginEventBus();
+  setPluginEventBus(eventBus);
+  const jobStore = pluginJobStore(db);
+  const lifecycle = pluginLifecycleManager(db, { workerManager });
+  const scheduler = createPluginJobScheduler({
+    db,
+    jobStore,
+    workerManager,
+  });
+  const toolDispatcher = createPluginToolDispatcher({
+    workerManager,
+    lifecycleManager: lifecycle,
+    db,
+  });
+  const jobCoordinator = createPluginJobCoordinator({
+    db,
+    lifecycle,
+    scheduler,
+    jobStore,
+  });
+  const hostServiceCleanup = createPluginHostServiceCleanup(lifecycle, hostServicesDisposers);
+  const loader = pluginLoader(
+    db,
+    { localPluginDir: opts.localPluginDir ?? DEFAULT_LOCAL_PLUGIN_DIR },
+    {
+      workerManager,
+      eventBus,
+      jobScheduler: scheduler,
+      jobStore,
+      toolDispatcher,
+      lifecycleManager: lifecycle,
+      instanceInfo: {
+        instanceId: opts.instanceId ?? "default",
+        hostVersion: opts.hostVersion ?? "0.0.0",
+      },
+      buildHostHandlers: (pluginId, manifest) => {
+        const notifyWorker = (method: string, params: unknown) => {
+          const handle = workerManager.getWorker(pluginId);
+          if (handle) handle.notify(method, params);
+        };
+        const services = buildHostServices(db, pluginId, manifest.id, eventBus, notifyWorker);
+        hostServicesDisposers.set(pluginId, () => services.dispose());
+        return createHostClientHandlers({
+          pluginId,
+          capabilities: manifest.capabilities,
+          services,
+        });
+      },
+    },
+  );
+  api.use(
+    pluginRoutes(
+      db,
+      loader,
+      { scheduler, jobStore },
+      { workerManager },
+      { toolDispatcher },
+      { workerManager },
+    ),
+  );
+  api.use(
+    accessRoutes(db, {
+      deploymentMode: opts.deploymentMode,
+      deploymentExposure: opts.deploymentExposure,
+      bindHost: opts.bindHost,
+      allowedHostnames: opts.allowedHostnames,
+    }),
+  );
+  app.use("/api", api);
+  app.use("/api", (_req, res) => {
+    res.status(404).json({ error: "API route not found" });
+  });
+  app.use(pluginUiStaticRoutes(db, {
+    localPluginDir: opts.localPluginDir ?? DEFAULT_LOCAL_PLUGIN_DIR,
+  }));
+
+  const __dirname = path.dirname(fileURLToPath(import.meta.url));
+  if (opts.uiMode === "static") {
+    // Try published location first (server/ui-dist/), then monorepo dev location (../../ui/dist)
+    const candidates = [
+      path.resolve(__dirname, "../ui-dist"),
+      path.resolve(__dirname, "../../ui/dist"),
+    ];
+    const uiDist = candidates.find((p) => fs.existsSync(path.join(p, "index.html")));
+    if (uiDist) {
+      const indexHtml = applyUiBranding(fs.readFileSync(path.join(uiDist, "index.html"), "utf-8"));
+      app.use(express.static(uiDist));
+      app.get(/.*/, (_req, res) => {
+        res.status(200).set("Content-Type", "text/html").end(indexHtml);
+      });
+    } else {
+      console.warn("[paperclip] UI dist not found; running in API-only mode");
+    }
+  }
+
+  if (opts.uiMode === "vite-dev") {
+    const uiRoot = path.resolve(__dirname, "../../ui");
+    const hmrPort = resolveViteHmrPort(opts.serverPort);
+    const { createServer: createViteServer } = await import("vite");
+    const vite = await createViteServer({
+      root: uiRoot,
+      appType: "custom",
+      server: {
+        middlewareMode: true,
+        hmr: {
+          host: opts.bindHost,
+          port: hmrPort,
+          clientPort: hmrPort,
+        },
+        allowedHosts: privateHostnameGateEnabled ? Array.from(privateHostnameAllowSet) : undefined,
+      },
+    });
+
+    app.use(vite.middlewares);
+    app.get(/.*/, async (req, res, next) => {
+      try {
+        const templatePath = path.resolve(uiRoot, "index.html");
+        const template = fs.readFileSync(templatePath, "utf-8");
+        const html = applyUiBranding(await vite.transformIndexHtml(req.originalUrl, template));
+        res.status(200).set({ "Content-Type": "text/html" }).end(html);
+      } catch (err) {
+        next(err);
+      }
+    });
+  }
+
+  app.use(errorHandler);
+
+  jobCoordinator.start();
+  scheduler.start();
+  void toolDispatcher.initialize().catch((err) => {
+    logger.error({ err }, "Failed to initialize plugin tool dispatcher");
+  });
+  const devWatcher = opts.uiMode === "vite-dev"
+    ? createPluginDevWatcher(
+      lifecycle,
+      async (pluginId) => (await pluginRegistry.getById(pluginId))?.packagePath ?? null,
+    )
+    : null;
+  void loader.loadAll().then((result) => {
+    if (!result) return;
+    for (const loaded of result.results) {
+      if (devWatcher && loaded.success && loaded.plugin.packagePath) {
+        devWatcher.watch(loaded.plugin.id, loaded.plugin.packagePath);
+      }
+    }
+  }).catch((err) => {
+    logger.error({ err }, "Failed to load ready plugins on startup");
+  });
+  process.once("exit", () => {
+    devWatcher?.close();
+    hostServiceCleanup.disposeAll();
+    hostServiceCleanup.teardown();
+  });
+  process.once("beforeExit", () => {
+    void flushPluginLogBuffer();
+  });
+
+  return app;
+}
+

package/server/src/attachment-types.ts

@@ -0,0 +1,74 @@
+/**
+ * Shared attachment content-type configuration.
+ *
+ * By default only image types are allowed.  Set the
+ * `PAPERCLIP_ALLOWED_ATTACHMENT_TYPES` environment variable to a
+ * comma-separated list of MIME types or wildcard patterns to expand the
+ * allowed set.
+ *
+ * Examples:
+ *   PAPERCLIP_ALLOWED_ATTACHMENT_TYPES=image/*,application/pdf
+ *   PAPERCLIP_ALLOWED_ATTACHMENT_TYPES=image/*,application/pdf,text/*
+ *
+ * Supported pattern syntax:
+ *   - Exact types:   "application/pdf"
+ *   - Wildcards:     "image/*"  or  "application/vnd.openxmlformats-officedocument.*"
+ */
+
+export const DEFAULT_ALLOWED_TYPES: readonly string[] = [
+  "image/png",
+  "image/jpeg",
+  "image/jpg",
+  "image/webp",
+  "image/gif",
+  "application/pdf",
+  "text/markdown",
+  "text/plain",
+  "application/json",
+  "text/csv",
+  "text/html",
+];
+
+/**
+ * Parse a comma-separated list of MIME type patterns into a normalised array.
+ * Returns the default image-only list when the input is empty or undefined.
+ */
+export function parseAllowedTypes(raw: string | undefined): string[] {
+  if (!raw) return [...DEFAULT_ALLOWED_TYPES];
+  const parsed = raw
+    .split(",")
+    .map((s) => s.trim().toLowerCase())
+    .filter((s) => s.length > 0);
+  return parsed.length > 0 ? parsed : [...DEFAULT_ALLOWED_TYPES];
+}
+
+/**
+ * Check whether `contentType` matches any entry in `allowedPatterns`.
+ *
+ * Supports exact matches ("application/pdf") and wildcard / prefix
+ * patterns ("image/*", "application/vnd.openxmlformats-officedocument.*").
+ */
+export function matchesContentType(contentType: string, allowedPatterns: string[]): boolean {
+  const ct = contentType.toLowerCase();
+  return allowedPatterns.some((pattern) => {
+    if (pattern === "*") return true;
+    if (pattern.endsWith("/*") || pattern.endsWith(".*")) {
+      return ct.startsWith(pattern.slice(0, -1));
+    }
+    return ct === pattern;
+  });
+}
+
+// ---------- Module-level singletons read once at startup ----------
+
+const allowedPatterns: string[] = parseAllowedTypes(
+  process.env.PAPERCLIP_ALLOWED_ATTACHMENT_TYPES,
+);
+
+/** Convenience wrapper using the process-level allowed list. */
+export function isAllowedContentType(contentType: string): boolean {
+  return matchesContentType(contentType, allowedPatterns);
+}
+
+export const MAX_ATTACHMENT_BYTES =
+  Number(process.env.PAPERCLIP_ATTACHMENT_MAX_BYTES) || 10 * 1024 * 1024;