flowent 0.0.1 → 0.0.4

package/backend/src/flowent/routes/tabs.py

@@ -0,0 +1,292 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel, ConfigDict
+
+from flowent.graph_service import (
+    create_agent_node,
+    create_edge,
+    create_graph_node,
+    create_tab,
+    delete_agent_node,
+    delete_edge,
+    delete_tab,
+    duplicate_tab,
+    list_node_connection_ids,
+    list_tab_edges,
+    list_workflow_nodes,
+    serialize_tab_summary,
+    update_tab_definition,
+)
+from flowent.models import AgentState, EdgeKind, WorkflowNodeKind
+from flowent.registry import registry
+from flowent.workspace_store import workspace_store
+
+router = APIRouter()
+
+
+class CreateTabRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    title: str
+    allow_network: bool = False
+    write_dirs: list[str] = []
+
+
+class CreateTabNodeRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    node_type: str = WorkflowNodeKind.AGENT.value
+    role_name: str | None = None
+    name: str | None = None
+    config: dict[str, object] = {}
+    tools: list[str] = []
+    write_dirs: list[str] = []
+    allow_network: bool = False
+
+
+class CreateTabEdgeRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    from_node_id: str
+    from_port_key: str = "out"
+    to_node_id: str
+    to_port_key: str = "in"
+    kind: str = EdgeKind.CONTROL.value
+
+
+class UpdateTabDefinitionRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    definition: dict[str, object]
+
+
+def _serialize_workflow_node(
+    *,
+    tab_id: str,
+    node_id: str,
+) -> dict[str, object]:
+    tab = workspace_store.get_tab(tab_id)
+    if tab is None:
+        raise HTTPException(status_code=404, detail="Workflow not found")
+    definition = tab.definition.get_node(node_id)
+    if definition is None:
+        raise HTTPException(status_code=404, detail="Node not found")
+    record = workspace_store.get_node_record(node_id)
+    live_node = registry.get(node_id)
+    config = dict(definition.config)
+    role_name = config.get("role_name")
+    name = config.get("name")
+    position = tab.definition.view.positions.get(node_id)
+    todos = (
+        [todo.serialize() for todo in live_node.get_todos_snapshot()]
+        if live_node is not None
+        else [todo.serialize() for todo in (record.todos if record is not None else [])]
+    )
+    state = (
+        live_node.state.value
+        if live_node is not None
+        else (record.state.value if record is not None else AgentState.IDLE.value)
+    )
+    return {
+        "id": definition.id,
+        "node_type": definition.type.value,
+        "workflow_id": tab_id,
+        "role_name": role_name if isinstance(role_name, str) else None,
+        "is_leader": False,
+        "state": state,
+        "connections": list_node_connection_ids(tab_id=tab_id, node_id=definition.id)
+        if definition.type == WorkflowNodeKind.AGENT
+        else [],
+        "name": name if isinstance(name, str) else None,
+        "todos": todos if definition.type == WorkflowNodeKind.AGENT else [],
+        "position": position.serialize() if position is not None else None,
+        "config": config,
+        "inputs": [port.serialize() for port in definition.inputs],
+        "outputs": [port.serialize() for port in definition.outputs],
+    }
+
+
+@router.get("/api/workflows")
+async def list_workflows() -> dict[str, object]:
+    tabs = workspace_store.list_tabs()
+    return {"workflows": [serialize_tab_summary(tab) for tab in tabs]}
+
+
+@router.post("/api/workflows")
+async def create_workflow_route(req: CreateTabRequest) -> dict[str, object]:
+    title = req.title.strip()
+    if not title:
+        raise HTTPException(status_code=400, detail="title must not be empty")
+    try:
+        tab = create_tab(
+            title=title,
+            allow_network=req.allow_network,
+            write_dirs=req.write_dirs,
+        )
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    return serialize_tab_summary(tab)
+
+
+@router.post("/api/workflows/{tab_id}/duplicate")
+async def duplicate_workflow_route(tab_id: str) -> dict[str, object]:
+    duplicated, error = duplicate_tab(tab_id=tab_id)
+    if error is not None or duplicated is None:
+        raise HTTPException(
+            status_code=404 if error and error.endswith("not found") else 400,
+            detail=error or "Failed to duplicate workflow",
+        )
+    return serialize_tab_summary(duplicated)
+
+
+@router.get("/api/workflows/{tab_id}")
+async def get_workflow(tab_id: str) -> dict[str, object]:
+    tab = workspace_store.get_tab(tab_id)
+    if tab is None:
+        raise HTTPException(status_code=404, detail="Workflow not found")
+    nodes = [
+        _serialize_workflow_node(tab_id=tab_id, node_id=node.id)
+        for node in list_workflow_nodes(tab_id)
+    ]
+    edges = [edge.serialize() for edge in list_tab_edges(tab_id)]
+    return {
+        "workflow": serialize_tab_summary(tab),
+        "nodes": nodes,
+        "edges": edges,
+    }
+
+
+@router.put("/api/workflows/{tab_id}/definition")
+async def update_workflow_definition_route(
+    tab_id: str,
+    req: UpdateTabDefinitionRequest,
+) -> dict[str, object]:
+    updated, error = update_tab_definition(
+        tab_id=tab_id,
+        definition_payload=req.definition,
+        actor_id=tab_id,
+    )
+    if error is not None or updated is None:
+        raise HTTPException(
+            status_code=400 if error and not error.endswith("not found") else 404,
+            detail=error or "Failed to update workflow definition",
+        )
+    return serialize_tab_summary(updated)
+
+
+@router.delete("/api/workflows/{tab_id}")
+async def delete_workflow_route(tab_id: str) -> dict[str, object]:
+    deleted, error = delete_tab(tab_id=tab_id)
+    if error is not None or deleted is None:
+        status_code = 404 if error and error.endswith("not found") else 400
+        raise HTTPException(
+            status_code=status_code,
+            detail=error or "Failed to delete workflow",
+        )
+    return deleted
+
+
+@router.post("/api/workflows/{tab_id}/nodes")
+async def create_workflow_node(
+    tab_id: str,
+    req: CreateTabNodeRequest,
+) -> dict[str, object]:
+    try:
+        node_type = WorkflowNodeKind(req.node_type.strip())
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail="Invalid node_type") from exc
+
+    if node_type == WorkflowNodeKind.AGENT:
+        if not isinstance(req.role_name, str) or not req.role_name.strip():
+            raise HTTPException(status_code=400, detail="role_name is required")
+        record, error = create_agent_node(
+            role_name=req.role_name,
+            tab_id=tab_id,
+            name=req.name,
+            tools=req.tools,
+            write_dirs=req.write_dirs,
+            allow_network=req.allow_network,
+        )
+        if error is not None or record is None:
+            raise HTTPException(
+                status_code=400, detail=error or "Failed to create node"
+            )
+        return _serialize_workflow_node(tab_id=tab_id, node_id=record.id)
+
+    node, error = create_graph_node(
+        tab_id=tab_id,
+        node_type=node_type,
+        config={
+            **req.config,
+            **(
+                {"name": req.name}
+                if isinstance(req.name, str) and req.name.strip()
+                else {}
+            ),
+        },
+        actor_id=tab_id,
+    )
+    if error is not None or node is None:
+        raise HTTPException(status_code=400, detail=error or "Failed to create node")
+    return _serialize_workflow_node(tab_id=tab_id, node_id=node.id)
+
+
+@router.post("/api/workflows/{tab_id}/edges")
+async def create_workflow_edge(
+    tab_id: str,
+    req: CreateTabEdgeRequest,
+) -> dict[str, object]:
+    tab = workspace_store.get_tab(tab_id)
+    if tab is None:
+        raise HTTPException(status_code=404, detail="Workflow not found")
+    try:
+        edge_kind = EdgeKind(req.kind.strip())
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail="Invalid edge kind") from exc
+    edge, error = create_edge(
+        tab_id=tab_id,
+        from_node_id=req.from_node_id,
+        from_port_key=req.from_port_key,
+        to_node_id=req.to_node_id,
+        to_port_key=req.to_port_key,
+        kind=edge_kind,
+    )
+    if error is not None or edge is None:
+        raise HTTPException(status_code=400, detail=error or "Failed to create edge")
+    return edge.serialize()
+
+
+@router.delete("/api/workflows/{tab_id}/nodes/{node_id}")
+async def delete_workflow_node(tab_id: str, node_id: str) -> dict[str, object]:
+    deleted, error = delete_agent_node(
+        tab_id=tab_id,
+        node_id=node_id,
+    )
+    if error is not None or deleted is None:
+        status_code = 404 if error and error.endswith("not found") else 400
+        raise HTTPException(
+            status_code=status_code, detail=error or "Failed to delete node"
+        )
+    return deleted
+
+
+@router.delete("/api/workflows/{tab_id}/edges")
+async def delete_workflow_edge(
+    tab_id: str,
+    edge_id: str | None = None,
+    from_node_id: str | None = None,
+    to_node_id: str | None = None,
+    from_port_key: str | None = None,
+    to_port_key: str | None = None,
+) -> dict[str, object]:
+    deleted, error = delete_edge(
+        tab_id=tab_id,
+        edge_id=edge_id,
+        from_node_id=from_node_id,
+        to_node_id=to_node_id,
+        from_port_key=from_port_key,
+        to_port_key=to_port_key,
+    )
+    if error is not None or deleted is None:
+        status_code = 404 if error and error.endswith("not found") else 400
+        raise HTTPException(
+            status_code=status_code, detail=error or "Failed to delete edge"
+        )
+    return deleted

package/backend/src/flowent/routes/ws.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+from fastapi import APIRouter
+from starlette.websockets import WebSocket, WebSocketDisconnect
+
+from flowent.access import authorize_websocket
+from flowent.events import event_bus
+
+router = APIRouter()
+
+
+@router.websocket("/ws/events")
+async def ws_events(ws: WebSocket) -> None:
+    if not await authorize_websocket(ws):
+        return
+    await event_bus.connect_display(ws)
+    try:
+        while True:
+            await ws.receive_text()
+    except WebSocketDisconnect:
+        event_bus.disconnect_display(ws)
+
+
+@router.websocket("/ws/updates")
+async def ws_updates(ws: WebSocket) -> None:
+    if not await authorize_websocket(ws):
+        return
+    await event_bus.connect_updates(ws)
+    try:
+        while True:
+            await ws.receive_text()
+    except WebSocketDisconnect:
+        event_bus.disconnect_updates(ws)

package/backend/src/flowent/runtime.py

@@ -0,0 +1,188 @@
+from __future__ import annotations
+
+import threading
+from typing import TYPE_CHECKING
+
+from loguru import logger
+
+from flowent.registry import registry
+
+if TYPE_CHECKING:
+    from flowent.channels.telegram import TelegramChannel
+
+SYSTEM_NODE_TIMEOUT = 5.0
+_telegram_channel: TelegramChannel | None = None
+_telegram_channel_lock = threading.Lock()
+
+
+def _stop_telegram_channel() -> None:
+    global _telegram_channel
+    with _telegram_channel_lock:
+        channel = _telegram_channel
+        _telegram_channel = None
+
+    if channel is not None:
+        channel.stop()
+
+
+def restart_telegram_channel() -> None:
+    from flowent.channels.telegram import TelegramChannel
+    from flowent.settings import get_settings
+
+    _stop_telegram_channel()
+
+    settings = get_settings()
+    if not settings.telegram.bot_token.strip():
+        return
+
+    channel = TelegramChannel()
+    channel.start()
+    with _telegram_channel_lock:
+        global _telegram_channel
+        _telegram_channel = channel
+
+
+def bootstrap_runtime() -> None:
+    from flowent.access import ensure_access_bootstrap
+    from flowent.agent import Agent
+    from flowent.graph_service import (
+        build_assistant_tools,
+        ensure_tab_leaders,
+    )
+    from flowent.mcp_service import mcp_service
+    from flowent.models import AgentState, NodeConfig, NodeType, StateEntry
+    from flowent.settings import (
+        ensure_builtin_roles,
+        get_settings,
+        save_settings,
+    )
+    from flowent.workspace_store import workspace_store
+
+    workspace_store.reset_cache()
+    mcp_service.clear_runtime_state()
+    settings = get_settings()
+    settings_changed = ensure_builtin_roles(settings)
+    generated_access_code = ensure_access_bootstrap(settings)
+    if settings_changed or generated_access_code is not None:
+        save_settings(settings)
+    mcp_service.bootstrap()
+    assistant_tools = build_assistant_tools(settings=settings)
+
+    assistant_record = next(
+        (
+            record
+            for record in workspace_store.list_node_records()
+            if record.config.node_type == NodeType.ASSISTANT
+            and record.state != AgentState.TERMINATED
+        ),
+        None,
+    )
+    assistant = Agent(
+        NodeConfig(
+            node_type=NodeType.ASSISTANT,
+            role_name=settings.assistant.role_name,
+            name="Assistant",
+            tools=assistant_tools,
+            write_dirs=list(settings.assistant.write_dirs),
+            allow_network=settings.assistant.allow_network,
+        ),
+        uuid=assistant_record.id if assistant_record is not None else None,
+    )
+    if assistant_record is not None:
+        assistant.history = list(assistant_record.history)
+        assistant._set_execution_context(
+            summary=assistant_record.execution_context_summary,
+            history_cutoff=assistant_record.execution_context_history_cutoff,
+        )
+        if not any(isinstance(entry, StateEntry) for entry in assistant.history):
+            assistant.history.insert(
+                0,
+                StateEntry(state=assistant_record.state.value, reason="restored"),
+            )
+        if assistant_record.state in {
+            AgentState.INITIALIZING,
+            AgentState.IDLE,
+            AgentState.RUNNING,
+            AgentState.SLEEPING,
+        }:
+            assistant.history.append(
+                StateEntry(state=AgentState.IDLE.value, reason="restored")
+            )
+        assistant.todos = list(assistant_record.todos)
+        assistant.prime_runtime_state(
+            AgentState.ERROR
+            if assistant_record.state == AgentState.ERROR
+            else AgentState.IDLE
+        )
+    registry.register(assistant)
+    assistant.start()
+    logger.info("Assistant started with role {}", settings.assistant.role_name)
+
+    ensure_tab_leaders()
+
+    restored_node_ids: set[str] = set()
+    for record in workspace_store.list_node_records():
+        if record.config.node_type == NodeType.ASSISTANT:
+            continue
+        if record.state == AgentState.TERMINATED:
+            continue
+        node = Agent(
+            NodeConfig(
+                node_type=record.config.node_type,
+                role_name=record.config.role_name,
+                tab_id=record.config.tab_id,
+                name=record.config.name,
+                tools=list(record.config.tools),
+                write_dirs=list(record.config.write_dirs),
+                allow_network=record.config.allow_network,
+            ),
+            uuid=record.id,
+        )
+        node.history = list(record.history)
+        node._set_execution_context(
+            summary=record.execution_context_summary,
+            history_cutoff=record.execution_context_history_cutoff,
+        )
+        if not any(isinstance(entry, StateEntry) for entry in node.history):
+            node.history.insert(
+                0,
+                StateEntry(state=record.state.value, reason="restored"),
+            )
+        if record.state in {
+            AgentState.INITIALIZING,
+            AgentState.RUNNING,
+            AgentState.SLEEPING,
+        }:
+            node.history.append(
+                StateEntry(state=AgentState.IDLE.value, reason="restored")
+            )
+        node.todos = list(record.todos)
+        node.prime_runtime_state(
+            AgentState.ERROR if record.state == AgentState.ERROR else AgentState.IDLE
+        )
+        registry.register(node)
+        node.start()
+        restored_node_ids.add(node.uuid)
+
+    if settings.telegram.bot_token.strip():
+        restart_telegram_channel()
+
+
+def shutdown_runtime(timeout: float = SYSTEM_NODE_TIMEOUT) -> None:
+    from flowent.mcp_service import mcp_service
+    from flowent.models import NodeType
+
+    logger.info("Shutting down runtime")
+    _stop_telegram_channel()
+    mcp_service.clear_runtime_state()
+    persistent_agents = []
+    for agent in registry.get_all():
+        if agent.node_type == NodeType.ASSISTANT or agent.config.tab_id:
+            agent.request_process_exit()
+            persistent_agents.append(agent)
+            continue
+        agent.terminate_and_wait(timeout=timeout)
+    for agent in persistent_agents:
+        agent.wait_for_termination(timeout=timeout)
+    registry.reset()
+    logger.info("Runtime shutdown complete")

package/backend/src/flowent/sandbox.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def is_path_writable(path: str | Path, write_dirs: list[str]) -> bool:
+    from flowent.settings import resolve_path
+
+    p = resolve_path(path)
+    return any(p.is_relative_to(resolve_path(directory)) for directory in write_dirs)
+
+
+def build_bwrap_cmd(
+    write_dirs: list[str],
+    command: str,
+    *,
+    allow_network: bool = False,
+    cwd: str | Path | None = None,
+) -> list[str]:
+    from flowent.settings import resolve_path
+
+    resolved_cwd = resolve_path(cwd) if cwd is not None else None
+    cmd = [
+        "bwrap",
+        "--ro-bind",
+        "/",
+        "/",
+        "--dev",
+        "/dev",
+        "--proc",
+        "/proc",
+        "--tmpfs",
+        "/tmp",
+    ]
+    if resolved_cwd is not None:
+        cmd.extend(["--ro-bind", str(resolved_cwd), str(resolved_cwd)])
+    for directory in write_dirs:
+        resolved_dir = resolve_path(directory)
+        cmd.extend(["--bind", str(resolved_dir), str(resolved_dir)])
+    if not allow_network:
+        cmd.append("--unshare-net")
+    if resolved_cwd is not None:
+        cmd.extend(["--chdir", str(resolved_cwd)])
+    cmd.extend(["--die-with-parent", "--new-session", "--", "bash", "-c", command])
+    return cmd

package/backend/src/flowent/security.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from flowent.sandbox import is_path_writable
+
+if TYPE_CHECKING:
+    from flowent.agent import Agent
+
+
+def authorize(tool_name: str, agent: Agent, args: dict[str, Any]) -> str | None:
+    if tool_name.startswith("mcp__"):
+        from flowent.mcp_service import mcp_service
+        from flowent.settings import find_mcp_server, get_settings
+
+        descriptor = mcp_service.get_dynamic_tool_descriptor(tool_name)
+        if descriptor is None:
+            return f"MCP tool not found: {tool_name}"
+        server = find_mcp_server(get_settings(), descriptor.server_name)
+        if (
+            server is not None
+            and server.transport == "streamable_http"
+            and not agent.config.allow_network
+        ):
+            return "Network access is disabled for this agent"
+        if descriptor.open_world_hint and not agent.config.allow_network:
+            return "Network access is disabled for this agent"
+        return None
+
+    if tool_name == "edit":
+        write_dirs = agent.config.write_dirs
+        if not write_dirs:
+            return "Write access is disabled for this agent"
+        path = args.get("path")
+        if isinstance(path, str) and not is_path_writable(path, write_dirs):
+            return f"Path not in write_dirs: {path}"
+        return None
+
+    if tool_name == "fetch" and not agent.config.allow_network:
+        return "Network access is disabled for this agent"
+
+    return None