lazyclaw 4.2.1 → 4.3.0

package/daemon.mjs

@@ -21,6 +21,8 @@ import { withFallback } from './providers/fallback.mjs';
 import { withResponseCache } from './providers/cache.mjs';
 import { costFromUsage, RATE_CARD_SHAPE } from './providers/rates.mjs';
 import { composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill } from './skills.mjs';
+import { ChallengeRegistry } from './gateway/device_auth.mjs';
+import { createGateway } from './gateway/http_gateway.mjs';
 import { TokenBucketLimiter } from './ratelimit.mjs';
 import { createLogger } from './logger.mjs';
 import { summarizeState, listSessions as listWorkflowSessions, loadStateFile as loadWorkflowState, aggregateNodeStats } from './workflow/summary.mjs';
@@ -321,6 +323,11 @@ export function makeHandler(ctx) {
     costsByCurrency: /** @type {Record<string, number>} */({}),
     tokensTotal: { inputTokens: 0, outputTokens: 0 },
   };
+  // Device gateway (Phase 27). The ChallengeRegistry is a per-process
+  // singleton: a challenge minted by one request is consumed by a later
+  // one, so it must outlive a single call.
+  const gwConfigDir = typeof ctx.sessionsDirGetter === 'function' ? ctx.sessionsDirGetter() : undefined;
+  const gateway = createGateway({ configDir: gwConfigDir, challengeRegistry: new ChallengeRegistry(), heartbeatMs: 25000 });
   return async function handler(req, res) {
     // Capture method+path before any handler logic runs; req.url survives
     // the response but capturing now keeps the log line stable even if a
@@ -361,6 +368,31 @@ export function makeHandler(ctx) {
       if (!isOriginAllowed(req, allowedOrigins, allowLoopback)) {
         return writeJson(res, 403, { error: 'forbidden origin' });
       }
+      // Device gateway (Phase 27) — routed BEFORE the shared auth-token
+      // gate. Companion-node auth is the gateway's own Ed25519 device-auth
+      // (challenge/sign/approve + bearer token); the only unauthenticated
+      // route, /gateway/connect/challenge, returns nothing but a random
+      // nonce. The bypass decision uses the NORMALIZED pathname (the same
+      // one the gateway routes on) so a dot-segment path like
+      // `/gateway/../sessions` can't skip the auth-token gate — it
+      // normalizes to `/sessions`, fails this prefix test, and falls
+      // through to the protected handler. When the limiter is enabled,
+      // gateway traffic uses its own key namespace so an unauthenticated
+      // flood can't drain the authenticated user's per-IP budget.
+      let gwPath = '';
+      try { gwPath = new URL(req.url || '/', 'http://localhost').pathname; } catch { gwPath = ''; }
+      if (gwPath.startsWith('/gateway/')) {
+        if (limiter) {
+          const key = 'gw:' + (req.socket?.remoteAddress || 'no-socket');
+          const verdict = limiter.consume(key);
+          if (!verdict.allowed) {
+            metrics.rateLimitDenied += 1;
+            const retrySeconds = Math.max(1, Math.ceil(verdict.retryAfterMs / 1000));
+            return writeJson(res, 429, { error: 'rate limit exceeded', retryAfterMs: verdict.retryAfterMs }, { 'retry-after': String(retrySeconds) });
+          }
+        }
+        return await gateway.handle(req, res, { readBody: readTextBody });
+      }
       // Authentication gate — when authToken is set, every request must
       // present `Authorization: Bearer <token>`. This is opt-in because
       // the default deployment is loopback-only single-user; the token
@@ -430,6 +462,26 @@ export function makeHandler(ctx) {
         }
         case route === 'GET /version':
           return writeJson(res, 200, { version: ctx.version(), nodeVersion: process.version, platform: `${process.platform}-${process.arch}` });
+        case route === 'POST /exec/request': {
+          // Remote exec-approval bridge. This route is AUTH-TOKEN-GATED
+          // (above), so only the trusted local operator/CLI can REQUEST an
+          // approval; a paired mobile device RESOLVES it over the gateway
+          // (POST /gateway/exec/resolve). The route long-polls: it awaits
+          // the device's decision (or the approval's timeout) and returns
+          // { approved, by, reason }.
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: `invalid JSON body: ${e.message}` }); }
+          if (!body || typeof body.tool !== 'string' || !body.tool) {
+            return writeJson(res, 400, { error: 'tool is required' });
+          }
+          const { promise } = gateway.requestApproval(
+            { tool: body.tool, args: body.args, agentId: body.agentId, summary: body.summary },
+            { timeoutMs: Number.isFinite(+body.timeoutMs) ? +body.timeoutMs : undefined },
+          );
+          const result = await promise;
+          return writeJson(res, 200, result);
+        }
         case route === 'GET /health':
           // Conventional liveness check — always 200 if the process
           // is alive enough to hit the route. No config inspection
@@ -1486,6 +1538,52 @@ export function makeHandler(ctx) {
             }, m.headers || {});
           }
         }
+        case route === 'POST /inbound': {
+          // Generic inbound bridge — a stable, channel-agnostic relay
+          // target so ANY platform (a Discord/WhatsApp/etc. bot the user
+          // runs elsewhere) can forward a message in and get one reply,
+          // without lazyclaw shipping that platform's SDK. Auth-token
+          // gated like every non-gateway route; additionally pairing-gated
+          // on senderId when a pairing allowlist is configured.
+          const breach = checkCostCap(metrics, costCap);
+          if (breach) return writeJson(res, 402, { error: 'cost cap exceeded', currency: breach.currency, spent: breach.spent, cap: breach.cap });
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: `invalid JSON body: ${e.message}` }); }
+          const text = typeof body.text === 'string' ? body.text.trim() : '';
+          if (!text) return writeJson(res, 400, { error: 'text is required' });
+          const cfg = ctx.readConfig();
+          // Pairing gate: when the operator has paired any senders, the
+          // relay must identify an allowlisted senderId.
+          const allow = Array.isArray(cfg.pairing) ? cfg.pairing.map((p) => String(p && p.id)) : [];
+          if (allow.length > 0) {
+            const sender = String(body.senderId || '');
+            if (!sender || !allow.includes(sender)) return writeJson(res, 403, { error: 'sender not paired' });
+          }
+          const provName = body.provider || cfg.provider || 'mock';
+          const resolved = resolveProvider(body, provName, cachedByName, logger);
+          if (resolved.error) return writeJson(res, 400, { error: resolved.error });
+          let acc = '';
+          let inboundUsage = null;
+          try {
+            for await (const chunk of resolved.provider.sendMessage(
+              [{ role: 'user', content: text }],
+              { apiKey: cfg['api-key'], model: body.model || cfg.model, onUsage: (u) => { inboundUsage = u; } },
+            )) acc += chunk;
+          } catch (err) {
+            const m = statusForProviderError(err);
+            return writeJson(res, m.status, { error: err?.message || String(err), code: err?.code || null }, m.headers || {});
+          }
+          // Feed the running spend total so the cost cap can actually trip
+          // on /inbound traffic (mirrors POST /agent / POST /chat).
+          if (inboundUsage && cfg.rates) {
+            try {
+              const c = costFromUsage({ provider: provName, model: body.model || cfg.model, usage: inboundUsage }, cfg.rates);
+              if (c) accumulateMetricsFromCost(metrics, inboundUsage, c);
+            } catch { /* cost is best-effort; never block a reply on it */ }
+          }
+          return writeJson(res, 200, { reply: acc, threadId: body.threadId || null });
+        }
         case route === 'POST /agent': {
           const breach = checkCostCap(metrics, costCap);
           if (breach) {