elasticdash-sdk 0.2.0

package/src/portal-executor.ts

@@ -0,0 +1,355 @@
+import { callProviderLLM } from './matchers/index.js'
+import {
+  scanTools,
+  resolveRuntimeModule,
+  buildToolArgs,
+  runToolInSubprocess,
+} from './execution/tool-runner.js'
+import type { ToolInfo } from './execution/tool-runner.js'
+import type { PortalTask, PortalTaskResult } from './types/portal.js'
+import { debugLog } from './utils/debug.js'
+
+type SupportedProvider = 'openai' | 'claude' | 'gemini' | 'grok' | 'kimi'
+
+/** Provider → required env var name */
+const PROVIDER_API_KEY_ENV: Record<SupportedProvider, string> = {
+  openai: 'OPENAI_API_KEY',
+  claude: 'ANTHROPIC_API_KEY',
+  gemini: 'GEMINI_API_KEY',
+  grok: 'GROK_API_KEY',
+  kimi: 'KIMI_API_KEY',
+}
+
+// ---------------------------------------------------------------------------
+// Prompt extraction (mirrors dashboard-server.ts logic)
+// ---------------------------------------------------------------------------
+
+function normalizeMessageContent(content: unknown): string {
+  if (typeof content === 'string') return content
+  if (Array.isArray(content)) {
+    return content
+      .map((part) => {
+        if (typeof part === 'string') return part
+        if (part && typeof part === 'object' && typeof (part as any).text === 'string') return (part as any).text
+        try { return JSON.stringify(part) } catch { return String(part) }
+      })
+      .join('\n')
+  }
+  if (content && typeof content === 'object') {
+    if (typeof (content as any).text === 'string') return (content as any).text
+    try { return JSON.stringify(content) } catch { return String(content) }
+  }
+  return content == null ? '' : String(content)
+}
+
+function extractPromptFromInput(input: unknown): { prompt: string; systemPrompt?: string } {
+  if (typeof input === 'string') return { prompt: input }
+
+  const messages = Array.isArray(input)
+    ? input
+    : input && typeof input === 'object' && Array.isArray((input as any).messages)
+      ? (input as any).messages
+      : null
+
+  if (messages && messages.length > 0) {
+    const systemParts: string[] = []
+    const promptParts: string[] = []
+    for (const message of messages as Array<any>) {
+      const role = typeof message?.role === 'string' ? message.role : 'user'
+      const content = normalizeMessageContent(message?.content).trim()
+      if (!content) continue
+      if (role === 'system') systemParts.push(content)
+      else promptParts.push(`${role}: ${content}`)
+    }
+    return {
+      prompt: promptParts.join('\n\n') || systemParts.join('\n\n') || JSON.stringify(input),
+      systemPrompt: systemParts.length > 0 ? systemParts.join('\n\n') : undefined,
+    }
+  }
+
+  if (input && typeof input === 'object' && typeof (input as any).prompt === 'string') {
+    return {
+      prompt: (input as any).prompt,
+      systemPrompt: typeof (input as any).systemPrompt === 'string' ? (input as any).systemPrompt : undefined,
+    }
+  }
+
+  try { return { prompt: JSON.stringify(input) } }
+  catch { return { prompt: String(input ?? '') } }
+}
+
+function inferProvider(task: PortalTask): SupportedProvider {
+  const provider = task.provider?.toLowerCase()
+  if (provider === 'openai' || provider === 'claude' || provider === 'gemini' || provider === 'grok' || provider === 'kimi') {
+    return provider
+  }
+  // Try extracting provider from input (wrapAI attaches it to the event input)
+  const inputProvider = task.input && typeof task.input === 'object'
+    ? (task.input as Record<string, unknown>).provider
+    : undefined
+  if (typeof inputProvider === 'string') {
+    const ip = inputProvider.toLowerCase()
+    if (ip === 'openai' || ip === 'claude' || ip === 'gemini' || ip === 'grok' || ip === 'kimi') return ip
+  }
+  const model = (task.model ?? task.name)?.toLowerCase() ?? ''
+  if (model.includes('claude')) return 'claude'
+  if (model.includes('gemini')) return 'gemini'
+  if (model.includes('grok')) return 'grok'
+  if (model.includes('kimi')) return 'kimi'
+  return 'openai'
+}
+
+// ---------------------------------------------------------------------------
+// Availability checks (used by trigger-executor for pre-validation)
+// ---------------------------------------------------------------------------
+
+export interface AvailabilityResult {
+  available: boolean
+  reason?: string
+}
+
+/**
+ * Check if a tool is available for execution.
+ * Returns { available: true } or { available: false, reason: "..." }.
+ */
+export function checkToolAvailability(
+  name: string,
+  cwd: string,
+  tools: ToolInfo[],
+): AvailabilityResult {
+  if (!name) {
+    return { available: false, reason: 'Missing tool name.' }
+  }
+  const toolsModulePath = resolveRuntimeModule(cwd, 'ed_tools')
+  if (!toolsModulePath) {
+    return { available: false, reason: 'Cannot find ed_tools.ts/js in workspace root.' }
+  }
+  const toolInfo = tools.find(t => t.name === name)
+  if (!toolInfo) {
+    const available = tools.map(t => t.name).join(', ') || '(none found)'
+    return { available: false, reason: `Tool not found: "${name}". Available tools: ${available}` }
+  }
+  return { available: true }
+}
+
+/**
+ * Check if an AI provider is available for execution (API key present).
+ * Returns { available: true } or { available: false, reason: "..." }.
+ */
+export function checkAIAvailability(
+  provider?: string,
+  model?: string,
+): AvailabilityResult {
+  const resolved = inferProviderFromArgs(provider, model)
+  const supportedProviders: SupportedProvider[] = ['openai', 'claude', 'gemini', 'grok', 'kimi']
+  if (!supportedProviders.includes(resolved)) {
+    return { available: false, reason: `Unsupported AI provider: "${provider ?? model}". Supported: ${supportedProviders.join(', ')}` }
+  }
+  const envVar = PROVIDER_API_KEY_ENV[resolved]
+  if (!process.env[envVar]) {
+    if (resolved === 'gemini' && process.env.GOOGLE_API_KEY) {
+      return { available: true }
+    }
+    return { available: false, reason: `Missing API key for provider "${resolved}". Expected environment variable: ${envVar}` }
+  }
+  return { available: true }
+}
+
+function inferProviderFromArgs(provider?: string, model?: string): SupportedProvider {
+  const p = provider?.toLowerCase()
+  if (p === 'openai' || p === 'claude' || p === 'gemini' || p === 'grok' || p === 'kimi') return p
+  const m = (model ?? '')?.toLowerCase()
+  if (m.includes('claude')) return 'claude'
+  if (m.includes('gemini')) return 'gemini'
+  if (m.includes('grok')) return 'grok'
+  if (m.includes('kimi')) return 'kimi'
+  return 'openai'
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Execute a portal task (tool or AI rerun). Returns a structured result with
+ * output, duration, usage, and error information.
+ *
+ * Error handling:
+ * - Tool not found in ed_tools → ok:false with descriptive error
+ * - ed_tools.ts/js missing → ok:false with descriptive error
+ * - AI provider unsupported → ok:false with error
+ * - AI provider API key missing → ok:false with error naming the expected env var
+ * - Subprocess crash → ok:false with stderr excerpt
+ * - Any other exception → ok:false with error message
+ */
+export async function executePortalTask(
+  task: PortalTask,
+  cwd: string,
+  tools: ToolInfo[],
+): Promise<PortalTaskResult> {
+  const start = Date.now()
+  try {
+    if (task.type === 'tool') {
+      return await executeToolTask(task, cwd, tools)
+    }
+    if (task.type === 'ai') {
+      return await executeAITask(task)
+    }
+    return {
+      taskId: task.taskId,
+      ok: false,
+      output: null,
+      error: `Unknown task type: ${task.type}`,
+      durationMs: Date.now() - start,
+      metadata: task.metadata,
+    }
+  } catch (e) {
+    return {
+      taskId: task.taskId,
+      ok: false,
+      output: null,
+      error: e instanceof Error ? e.message : String(e),
+      durationMs: Date.now() - start,
+      metadata: task.metadata,
+    }
+  }
+}
+
+async function executeToolTask(
+  task: PortalTask,
+  cwd: string,
+  tools: ToolInfo[],
+): Promise<PortalTaskResult> {
+  const start = Date.now()
+
+  if (!task.name) {
+    return { taskId: task.taskId, ok: false, output: null, error: 'Missing tool name on task.', durationMs: 0, metadata: task.metadata }
+  }
+
+  // Check tool exists in the scanned tool list
+  const toolInfo = tools.find(t => t.name === task.name)
+  if (!toolInfo) {
+    const available = tools.map(t => t.name).join(', ') || '(none found)'
+    return {
+      taskId: task.taskId, ok: false, output: null,
+      error: `Tool not found: "${task.name}". Available tools: ${available}`,
+      durationMs: 0, metadata: task.metadata,
+    }
+  }
+
+  // Resolve ed_tools module
+  const toolsModulePath = resolveRuntimeModule(cwd, 'ed_tools')
+  if (!toolsModulePath) {
+    return {
+      taskId: task.taskId, ok: false, output: null,
+      error: 'Cannot find ed_tools.ts/js in workspace root.',
+      durationMs: 0, metadata: task.metadata,
+    }
+  }
+
+  // Parse input
+  let parsedInput = task.input
+  if (typeof parsedInput === 'string') {
+    try { parsedInput = JSON.parse(parsedInput) } catch { /* use as-is */ }
+  }
+
+  const args = buildToolArgs(parsedInput, toolInfo)
+  debugLog(`[elasticdash portal] Executing tool: ${task.name}`, { args })
+
+  const result = await runToolInSubprocess(toolsModulePath, task.name, args, task.frozenEvents)
+  .catch(err => {
+    const errorMsg = err instanceof Error ? err.stack || err.message : String(err)
+    debugLog(`[elasticdash portal] Tool execution failed: ${errorMsg}`)
+    throw new Error(`Tool execution failed: ${errorMsg}`)
+  })
+  const durationMs = result.currentDurationMs ?? (Date.now() - start)
+
+  debugLog(`[elasticdash portal] Tool execution completed: ${task.name}`, { ...result, durationMs })
+
+  return {
+    taskId: task.taskId,
+    ok: result.ok,
+    output: result.currentOutput ?? null,
+    error: result.error,
+    durationMs,
+    usage: result.currentUsage,
+    metadata: task.metadata,
+  }
+}
+
+async function executeAITask(task: PortalTask): Promise<PortalTaskResult> {
+  const start = Date.now()
+
+  // Infer provider
+  const provider = inferProvider(task)
+  const supportedProviders: SupportedProvider[] = ['openai', 'claude', 'gemini', 'grok', 'kimi']
+  if (!supportedProviders.includes(provider)) {
+    return {
+      taskId: task.taskId, ok: false, output: null,
+      error: `Unsupported AI provider: "${task.provider}". Supported: ${supportedProviders.join(', ')}`,
+      durationMs: 0, metadata: task.metadata,
+    }
+  }
+
+  // Check API key is available
+  const envVar = PROVIDER_API_KEY_ENV[provider]
+  if (!process.env[envVar]) {
+    // Gemini also accepts GOOGLE_API_KEY
+    if (provider === 'gemini' && process.env.GOOGLE_API_KEY) {
+      // ok, fallback key available
+    } else {
+      return {
+        taskId: task.taskId, ok: false, output: null,
+        error: `Missing API key for provider "${provider}". Expected environment variable: ${envVar}`,
+        durationMs: 0, metadata: task.metadata,
+      }
+    }
+  }
+
+  // Extract prompt from input
+  const { prompt, systemPrompt } = extractPromptFromInput(task.input)
+  if (!prompt.trim()) {
+    return {
+      taskId: task.taskId, ok: false, output: null,
+      error: 'AI task input is empty; cannot execute.',
+      durationMs: 0, metadata: task.metadata,
+    }
+  }
+
+  // Prefer explicit model from trigger step, then try extracting from input
+  // (wrapAI attaches the actual API model name to the event input), fall back to event name
+  const inputModel = task.input && typeof task.input === 'object' && typeof (task.input as Record<string, unknown>).model === 'string'
+    ? (task.input as Record<string, unknown>).model as string
+    : undefined
+  const model = task.model ?? inputModel ?? task.name
+  const temperature = typeof task.modelParameters?.temperature === 'number' ? task.modelParameters.temperature : 0
+  const maxTokens = typeof task.modelParameters?.max_tokens === 'number' ? task.modelParameters.max_tokens : 512
+
+  debugLog(`[elasticdash portal] Executing AI: provider=${provider} model=${model}`)
+
+  try {
+    const result = await callProviderLLM(
+      prompt,
+      { provider, model },
+      systemPrompt ?? 'You are a helpful assistant.',
+      maxTokens,
+      // temperature,
+    )
+
+    return {
+      taskId: task.taskId,
+      ok: true,
+      output: result.content,
+      durationMs: result.durationMs ?? (Date.now() - start),
+      usage: result.usage,
+      metadata: task.metadata,
+    }
+  } catch (e) {
+    return {
+      taskId: task.taskId, ok: false, output: null,
+      error: `AI execution failed: ${e instanceof Error ? e.message : String(e)}`,
+      durationMs: Date.now() - start,
+      metadata: task.metadata,
+    }
+  }
+}

package/src/portal-server.ts

@@ -0,0 +1,304 @@
+import express from 'express'
+import http from 'node:http'
+import { executePortalTask } from './portal-executor.js'
+import { scanTools } from './execution/tool-runner.js'
+import type { ToolInfo } from './execution/tool-runner.js'
+import type {
+  PortalTask,
+  PortalTaskResult,
+  PortalServerOptions,
+  PortalServerHandle,
+  PortalStatus,
+} from './types/portal.js'
+import { debugLog } from './utils/debug.js'
+
+// ---------------------------------------------------------------------------
+// Origin allowlist
+// ---------------------------------------------------------------------------
+
+function extractHost(url: string): string | null {
+  try {
+    return new URL(url).host
+  } catch {
+    return null
+  }
+}
+
+function buildAllowedHosts(backendUrl: string, extra?: string[]): Set<string> {
+  const hosts = new Set<string>()
+  // Always allow localhost variants
+  hosts.add('localhost')
+  hosts.add('127.0.0.1')
+  hosts.add('::1')
+  // Allow the configured backend
+  const backendHost = extractHost(backendUrl)
+  if (backendHost) hosts.add(backendHost)
+  // Allow explicit extra origins
+  if (extra) {
+    for (const origin of extra) {
+      const h = extractHost(origin)
+      if (h) hosts.add(h)
+      else hosts.add(origin) // treat raw hostname as-is
+    }
+  }
+  return hosts
+}
+
+function isAllowedOrigin(req: express.Request, allowedHosts: Set<string>): boolean {
+  // Determine the caller's host from multiple headers
+  // 1. Origin header (set by browsers and some HTTP clients)
+  const origin = req.headers.origin
+  if (origin) {
+    const h = extractHost(origin)
+    return h !== null && isHostAllowed(h, allowedHosts)
+  }
+  // 2. Referer header fallback
+  const referer = req.headers.referer
+  if (referer) {
+    const h = extractHost(referer)
+    return h !== null && isHostAllowed(h, allowedHosts)
+  }
+  // 3. X-Forwarded-For / remote IP — check if it's a local request
+  const remoteIp = req.ip ?? req.socket?.remoteAddress ?? ''
+  if (remoteIp === '127.0.0.1' || remoteIp === '::1' || remoteIp === '::ffff:127.0.0.1') {
+    return true
+  }
+  // 4. No origin info — this is a direct server-to-server call.
+  //    If API key auth is configured and passes, allow it.
+  //    If no API key is configured, reject unknown-origin requests.
+  return false
+}
+
+function isHostAllowed(host: string, allowedHosts: Set<string>): boolean {
+  // Exact match (includes port, e.g. "localhost:4573")
+  if (allowedHosts.has(host)) return true
+  // Match without port
+  const hostWithoutPort = host.split(':')[0]
+  if (allowedHosts.has(hostWithoutPort)) return true
+  // Match subdomains (e.g. "api.elasticdash.com" matches "elasticdash.com")
+  for (const allowed of allowedHosts) {
+    if (hostWithoutPort.endsWith('.' + allowed)) return true
+  }
+  return false
+}
+
+// ---------------------------------------------------------------------------
+// Server
+// ---------------------------------------------------------------------------
+
+export async function startPortalServer(options: PortalServerOptions): Promise<PortalServerHandle> {
+  const port = options.port ?? 4574
+  const backendUrl = options.backendUrl.replace(/\/$/, '')
+  const apiKey = options.apiKey
+  const cwd = options.cwd ?? process.cwd()
+
+  // Build allowed-origin set from backendUrl + explicit allowlist + localhost
+  const allowedHosts = buildAllowedHosts(backendUrl, options.allowedOrigins)
+  console.log(`[elasticdash portal] Allowed origins: ${[...allowedHosts].join(', ')}`)
+
+  // Scan tools at startup
+  const tools: ToolInfo[] = scanTools(cwd)
+  console.log(`[elasticdash portal] Scanned ${tools.length} tools: ${tools.map(t => t.name).join(', ') || '(none)'}`)
+
+  // Queue state
+  const queue: PortalTask[] = []
+  let processing: string | null = null
+  let completed = 0
+  let failed = 0
+  let draining = false
+
+  // -------------------------------------------------------------------------
+  // Queue processor
+  // -------------------------------------------------------------------------
+
+  async function processQueue(): Promise<void> {
+    if (draining || processing) return
+    if (queue.length === 0) return
+
+    const task = queue.shift()!
+    processing = task.taskId
+    console.log(`[elasticdash portal] Processing task ${task.taskId} (type=${task.type}, name=${task.name}) — ${queue.length} remaining`)
+
+    const result = await executePortalTask(task, cwd, tools)
+
+    if (result.ok) {
+      completed++
+      console.log(`[elasticdash portal] Task ${task.taskId} completed (${result.durationMs}ms)`)
+    } else {
+      failed++
+      console.log(`[elasticdash portal] Task ${task.taskId} failed: ${result.error}`)
+    }
+
+    processing = null
+
+    // Deliver result to backend
+    await deliverResult(result)
+
+    // Process next task
+    processQueue().catch(() => {})
+  }
+
+  async function deliverResult(result: PortalTaskResult): Promise<void> {
+    const url = `${backendUrl}/api/portal/results/${result.taskId}`
+    const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+    if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`
+
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        const res = await fetch(url, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify(result),
+        })
+        if (res.ok || res.status < 500) {
+          debugLog(`[elasticdash portal] Result delivered for task ${result.taskId} (status ${res.status})`)
+          return
+        }
+        debugLog(`[elasticdash portal] Result delivery failed (status ${res.status}), attempt ${attempt + 1}/3`)
+      } catch (e) {
+        debugLog(`[elasticdash portal] Result delivery error, attempt ${attempt + 1}/3: ${e instanceof Error ? e.message : String(e)}`)
+      }
+      if (attempt < 2) {
+        await new Promise(r => setTimeout(r, Math.pow(2, attempt) * 1000))
+      }
+    }
+    console.warn(`[elasticdash portal] WARNING: Failed to deliver result for task ${result.taskId} after 3 retries`)
+  }
+
+  // -------------------------------------------------------------------------
+  // Security middleware: origin allowlist + API key auth
+  // -------------------------------------------------------------------------
+
+  function securityMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void {
+    // Check API key first — a valid key overrides origin checks
+    if (apiKey) {
+      const authHeader = req.headers.authorization
+      if (authHeader === `Bearer ${apiKey}`) return next()
+    }
+
+    // Check origin allowlist
+    if (isAllowedOrigin(req, allowedHosts)) {
+      // If API key is configured but not provided, still reject
+      if (apiKey) {
+        console.warn(JSON.stringify({
+          event: 'auth.failure',
+          reason: 'invalid_api_key',
+          ip: req.ip || req.headers['x-forwarded-for'] || 'unknown',
+          userAgent: req.headers['user-agent'] || 'unknown',
+          timestamp: new Date().toISOString(),
+        }))
+        res.status(401).json({ ok: false, error: 'unauthorized — valid API key required' })
+        return
+      }
+      return next()
+    }
+
+    // Origin not in allowlist and no valid API key
+    const origin = req.headers.origin ?? req.headers.referer ?? req.ip ?? 'unknown'
+    console.warn(JSON.stringify({
+      event: 'auth.failure',
+      reason: 'origin_not_allowed',
+      origin,
+      ip: req.ip || req.headers['x-forwarded-for'] || 'unknown',
+      userAgent: req.headers['user-agent'] || 'unknown',
+      timestamp: new Date().toISOString(),
+    }))
+    res.status(403).json({ ok: false, error: 'forbidden — origin not in allowlist' })
+  }
+
+  // -------------------------------------------------------------------------
+  // Express app
+  // -------------------------------------------------------------------------
+
+  const app = express()
+  app.use(express.json({ limit: '10mb' }))
+
+  // POST /api/portal/tasks — enqueue a single task
+  app.post('/api/portal/tasks', securityMiddleware, (req, res) => {
+    const task = req.body as PortalTask
+    if (!task?.taskId || !task?.type || !task?.name) {
+      res.status(400).json({ ok: false, error: 'Missing required fields: taskId, type, name' })
+      return
+    }
+    queue.push(task)
+    const position = queue.length
+    debugLog(`[elasticdash portal] Task ${task.taskId} enqueued at position ${position}`)
+    res.status(202).json({ ok: true, taskId: task.taskId, position })
+    processQueue().catch(() => {})
+  })
+
+  // POST /api/portal/tasks/batch — enqueue multiple tasks
+  app.post('/api/portal/tasks/batch', securityMiddleware, (req, res) => {
+    const body = req.body as { tasks?: PortalTask[] }
+    if (!Array.isArray(body?.tasks) || body.tasks.length === 0) {
+      res.status(400).json({ ok: false, error: 'Missing or empty tasks array' })
+      return
+    }
+    const results: Array<{ taskId: string; position: number }> = []
+    for (const task of body.tasks) {
+      if (!task?.taskId || !task?.type || !task?.name) continue
+      queue.push(task)
+      results.push({ taskId: task.taskId, position: queue.length })
+    }
+    debugLog(`[elasticdash portal] Batch enqueued ${results.length} tasks`)
+    res.status(202).json({ ok: true, tasks: results })
+    processQueue().catch(() => {})
+  })
+
+  // GET /api/portal/status — health check
+  app.get('/api/portal/status', (_req, res) => {
+    const status: PortalStatus = {
+      ok: true,
+      queueLength: queue.length,
+      processing,
+      completed,
+      failed,
+    }
+    res.json(status)
+  })
+
+  // DELETE /api/portal/tasks/:taskId — cancel a pending task
+  app.delete('/api/portal/tasks/:taskId', securityMiddleware, (req, res) => {
+    const taskId = req.params.taskId
+    const index = queue.findIndex(t => t.taskId === taskId)
+    if (index === -1) {
+      res.status(404).json({ ok: false, error: 'Task not found in queue (may be already processing or completed)' })
+      return
+    }
+    queue.splice(index, 1)
+    res.json({ ok: true, taskId })
+  })
+
+  // -------------------------------------------------------------------------
+  // Start server
+  // -------------------------------------------------------------------------
+
+  const server = http.createServer(app)
+
+  await new Promise<void>((resolve, reject) => {
+    server.on('error', reject)
+    server.listen(port, () => resolve())
+  })
+
+  const url = `http://localhost:${port}`
+
+  return {
+    port,
+    url,
+    close: async () => {
+      draining = true
+      // Wait for current task to finish if processing
+      if (processing) {
+        console.log(`[elasticdash portal] Waiting for current task ${processing} to finish...`)
+        await new Promise<void>((resolve) => {
+          const check = setInterval(() => {
+            if (!processing) { clearInterval(check); resolve() }
+          }, 200)
+        })
+      }
+      await new Promise<void>((resolve, reject) => {
+        server.close((err) => err ? reject(err) : resolve())
+      })
+    },
+  }
+}