mercury-agent 0.5.18 → 0.5.19

package/README.md

@@ -445,6 +445,21 @@ runtime:
 
 Auto-created spaces are seeded with `trigger.match=always`, `context.mode=context`, and the configured member permissions. Changing `rate_limit_daily_member` in `mercury.yaml` propagates to all auto-created spaces immediately — no per-space update needed. Explicit per-space overrides (set via dashboard or API) still take precedence.
 
+#### Broadcast
+
+Send a message to all auto-created DM spaces at once (e.g. maintenance notices, promotions):
+
+```bash
+curl -X POST http://localhost:8787/api/broadcast \
+  -H "Authorization: Bearer $API_SECRET" \
+  -H "X-Mercury-Caller: <your-admin-id>" \
+  -H "X-Mercury-Space: main" \
+  -H "Content-Type: application/json" \
+  -d '{"text": "Maintenance tonight 10pm-2am."}'
+```
+
+Returns `{ total, delivered, failed, errors }`. Only global admins (`admins` or `dm_auto_space.admin_ids`) may broadcast. Messages are sent as literal text — no LLM processing.
+
 ### Per-space Config
 
 Conversations are discovered from incoming traffic. Unlinked conversations stay idle until you attach them to a space via `mercury link <conversation-id> <space-id>` or the dashboard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.5.18",
+  "version": "0.5.19",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/core/api-types.ts

@@ -7,6 +7,7 @@ import { logger } from "../logger.js";
 import type { Db } from "../storage/db.js";
 import type { TradeStationFetch } from "../tradestation/host-api.js";
 import { hasPermission } from "./permissions.js";
+import type { MercuryCoreRuntime } from "./runtime.js";
 import type { SpaceQueue } from "./space-queue.js";
 import type { TaskScheduler } from "./task-scheduler.js";
 
@@ -22,6 +23,8 @@ export interface ApiContext {
   configRegistry: ConfigRegistry;
   /** Optional mock for TradeStation HTTP in tests */
   tradeStationFetch?: TradeStationFetch;
+  /** Runtime reference for cross-space operations (broadcast) */
+  runtime?: MercuryCoreRuntime;
 }
 
 export interface AuthContext {

package/src/core/api.ts

@@ -4,6 +4,7 @@ import type { ApiContext, AuthContext, Env } from "./api-types.js";
 import { verifyCallerToken } from "./caller-token.js";
 import { resolveRole } from "./permissions.js";
 import {
+  broadcast,
   capability,
   config,
   connections,
@@ -111,6 +112,7 @@ export function createApiApp(apiCtx: ApiContext): Hono<Env> {
   app.route("/tradestation", tradestation);
   app.route("/tts", tts);
   app.route("/capability", capability);
+  app.route("/broadcast", broadcast);
 
   // ─── Fallback ───────────────────────────────────────────────────────────
 

package/src/core/routes/broadcast.ts

@@ -0,0 +1,78 @@
+import { Hono } from "hono";
+import { logger } from "../../logger.js";
+import { type Env, getApiCtx, getAuth } from "../api-types.js";
+
+export const broadcast = new Hono<Env>();
+
+broadcast.post("/", async (c) => {
+  const { callerId } = getAuth(c);
+  const { config, runtime } = getApiCtx(c);
+
+  if (!config.dmAutoSpaceEnabled) {
+    return c.json({ error: "dm_auto_space is not enabled" }, 503);
+  }
+
+  const globalAdmins = [
+    ...(config.admins
+      ? config.admins
+          .split(",")
+          .map((s) => s.trim())
+          .filter(Boolean)
+      : []),
+    ...(config.dmAutoSpaceAdminIds
+      ? config.dmAutoSpaceAdminIds
+          .split(",")
+          .map((s) => s.trim())
+          .filter(Boolean)
+      : []),
+  ];
+
+  const normalize = (s: string) =>
+    s
+      .replace(/^[^:]+:/, "")
+      .replace(/^[+]+/, "")
+      .replace(/@.*$/, "");
+
+  const callerNormalized = normalize(callerId);
+
+  const isAdmin = globalAdmins.some(
+    (id) => id === callerId || normalize(id) === callerNormalized,
+  );
+
+  if (!isAdmin) {
+    logger.warn("Broadcast denied — caller is not a global admin", {
+      callerId,
+    });
+    return c.json({ error: "Forbidden: requires global admin" }, 403);
+  }
+
+  if (!runtime) {
+    return c.json({ error: "Runtime not available" }, 503);
+  }
+
+  const body = (await c.req.json().catch(() => ({}))) as { text?: string };
+  const text = typeof body.text === "string" ? body.text.trim() : "";
+
+  if (!text) {
+    return c.json({ error: "Missing or empty 'text' field" }, 400);
+  }
+
+  if (text.length > 4096) {
+    return c.json({ error: "Text exceeds 4096 character limit" }, 400);
+  }
+
+  try {
+    const result = await runtime.broadcastToAutoSpaces(text);
+    return c.json(result);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message === "Broadcast already in progress") {
+      return c.json({ error: message }, 409);
+    }
+    if (message === "MessageSender not initialized") {
+      return c.json({ error: "Message sender not ready" }, 503);
+    }
+    logger.error("Broadcast failed", { error: message });
+    return c.json({ error: "Broadcast failed" }, 500);
+  }
+});

package/src/core/routes/index.ts

@@ -1,3 +1,4 @@
+export { broadcast } from "./broadcast.js";
 export { capability } from "./capability.js";
 export { config } from "./config.js";
 export { connections } from "./connections.js";

package/src/core/runtime.ts

@@ -72,6 +72,7 @@ export class MercuryCoreRuntime {
   private readonly shutdownHooks: ShutdownHook[] = [];
   private readonly pauseTimers = new Map<string, NodeJS.Timeout>();
   private messageSender: MessageSender | undefined;
+  private broadcastInProgress = false;
   private shuttingDown = false;
   private signalHandlersInstalled = false;
 
@@ -293,6 +294,63 @@ export class MercuryCoreRuntime {
     });
   }
 
+  getMessageSender(): MessageSender | undefined {
+    return this.messageSender;
+  }
+
+  async broadcastToAutoSpaces(text: string): Promise<{
+    total: number;
+    delivered: number;
+    failed: number;
+    errors: Array<{ spaceId: string; error: string }>;
+  }> {
+    if (!this.messageSender) {
+      throw new Error("MessageSender not initialized");
+    }
+    if (this.broadcastInProgress) {
+      throw new Error("Broadcast already in progress");
+    }
+
+    this.broadcastInProgress = true;
+    try {
+      const spaces = this.db.listSpaces().filter((s) => s.id.startsWith("dm-"));
+
+      const errors: Array<{ spaceId: string; error: string }> = [];
+      let delivered = 0;
+
+      for (let i = 0; i < spaces.length; i++) {
+        const space = spaces[i];
+        try {
+          await this.messageSender.send(space.id, text);
+          delivered++;
+        } catch (err) {
+          errors.push({
+            spaceId: space.id,
+            error: err instanceof Error ? err.message : String(err),
+          });
+        }
+        if (i < spaces.length - 1) {
+          await new Promise((r) => setTimeout(r, 100));
+        }
+      }
+
+      logger.info("Broadcast complete", {
+        total: spaces.length,
+        delivered,
+        failed: errors.length,
+      });
+
+      return {
+        total: spaces.length,
+        delivered,
+        failed: errors.length,
+        errors,
+      };
+    } finally {
+      this.broadcastInProgress = false;
+    }
+  }
+
   private deliverTaskOutput(spaceId: string, text: string): void {
     const consoleUrl = process.env.MERCURY_CONSOLE_URL;
     const secret = process.env.MERCURY_CONSOLE_INTERNAL_SECRET;

package/src/server.ts

@@ -362,6 +362,7 @@ export function createApp(ctx: ServerContext): Hono {
     scheduler: core.scheduler,
     registry: ctx.registry,
     configRegistry: ctx.configRegistry,
+    runtime: core,
   });
 
   app.route("/api", apiApp);