onbuzz 4.8.3 → 4.9.0

package/src/interfaces/webServer.js

@@ -30,9 +30,10 @@ import { getVisualEditorServer, getVisualEditorPort, getVisualEditorBaseUrl, set
 // Import credential vault for secure credential management
 import { getCredentialVault } from '../services/credentialVault.js';
 import { getGalleryService } from '../services/galleryService.js';
+import composioService from '../services/composioService.js';
 import { getUserDataPaths } from '../utilities/userDataDir.js';
 import { projectActiveRuns } from '../utilities/flowRunFilters.js';
-import { recordOAuthResult, recordResolvedUser, projectAuthStatus } from '../utilities/authCache.js';
+import { recordOAuthResult, recordResolvedUser, projectAuthStatus, isAuthExpired } from '../utilities/authCache.js';
 import AuthCacheStore from '../services/authCacheStore.js';
 import { createAccountRouter } from './accountRoutes.js';
 import { getBrand } from '../utilities/brand.js';
@@ -914,6 +915,7 @@ class WebServer {
           user: userInfo,
           jwt: token,
           hasApiKey: !!apiKey,
+          ttlHours: this.config?.auth?.sessionTtlHours,
         }));
 
         // Broadcast auth success to connected web UI clients
@@ -996,6 +998,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
                 user,
                 jwt,
                 hasApiKey: true,
+                ttlHours: this.config?.auth?.sessionTtlHours,
               }));
               return res.json({ success: true, user, mintedJwt: true });
             }
@@ -1057,7 +1060,11 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
     // touching the user's JWT directly.
     // =====================================================
     this.app.use('/api/account', createAccountRouter({
-      getJwt:   () => this.lastAuthResult?.jwt || null,
+      getJwt:   () => {
+        const cache = this.lastAuthResult;
+        if (isAuthExpired(cache)) return null;
+        return cache?.jwt || null;
+      },
       getBrand: () => getBrand().isOnBuzz ? 'onbuzz' : 'autopilot',
       backendBaseUrl: this.config?.backend?.baseUrl,
       logger:   this.logger,
@@ -4497,6 +4504,343 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
+    /**
+     * POST /api/agents/bulk
+     *
+     * Fan a single action across multiple agents. Used by the web-ui
+     * multi-select action bars in My Squadron and the Import modal.
+     *
+     * Body:
+     *   {
+     *     action:   "delete" | "unload" | "pause" | "resume"
+     *             | "set-model" | "enable-tool" | "disable-tool" | "archive",
+     *     agentIds: string[],          // 1..MAX_BULK
+     *     params?:  { model?, tool?, ... }  // action-specific
+     *   }
+     *
+     * Response:
+     *   200 OK { success: <all ok>, summary: {total, ok, failed}, results: [{agentId, success, error?}] }
+     *   400/422 on validation failure
+     *
+     * Partial-success semantics: one agent's failure does NOT abort the
+     * rest. Per-agent results are returned. The top-level `success` is
+     * true iff EVERY agent succeeded.
+     *
+     * Safety cap: at most BULK_MAX_AGENTS agents per call (prevents a
+     * runaway client from churning the orchestrator).
+     */
+    /*  --------------------------------------------------------------
+     *  Composio integration — UI / CLI management surface
+     *  --------------------------------------------------------------
+     *  The composio tool (toolId: 'composio') already covers the
+     *  agent-facing path. These REST routes power the Connections
+     *  settings page in the web UI and the `loxia composio` CLI
+     *  subcommands. All routes delegate to src/services/composioService.js
+     *  so the SDK client and userId convention are shared.
+     *
+     *  userId convention: defaults to "operator" for these routes.
+     *  Override via ?userId=… (or body.userId on POST) if multi-tenant
+     *  is ever required.
+     *  --------------------------------------------------------------
+     */
+    const OPERATOR_USER = 'operator';
+
+    // Readiness probe — the UI uses this to render the API-key form
+    // instead of crashing into a broken Connections page. Also reports
+    // `keySource` so the UI knows whether the active key came from the
+    // encrypted vault (user can rotate it via UI) or from the env var
+    // (operator-managed, the UI shouldn't let you overwrite it blindly).
+    this.app.get('/api/composio/availability', async (req, res) => {
+      try {
+        const out = await composioService.isAvailable();
+        res.json({ success: true, ...out });
+      } catch (err) {
+        res.status(500).json({ success: false, error: err.message });
+      }
+    });
+
+    // Save / rotate the Composio API key. Persisted encrypted via
+    // ApiKeyManager; cache-invalidates so the next op uses the new key
+    // without a process restart. The handler also probes availability
+    // after saving so the UI can show a clean "ready" or a Composio-
+    // side error in one round-trip.
+    this.app.post('/api/composio/apikey', async (req, res) => {
+      try {
+        const { apiKey } = req.body || {};
+        if (typeof apiKey !== 'string' || apiKey.trim().length === 0) {
+          return res.status(400).json({ success: false, error: 'apiKey is required' });
+        }
+        const r = await composioService.setApiKey(apiKey);
+        if (!r.success) return res.status(400).json(r);
+        // Probe immediately. If the key authenticates against Composio,
+        // listToolkits() will return success. If it doesn't, surface
+        // the upstream error so the UI can show "key rejected" instead
+        // of "ready" followed by silent failures.
+        const probe = await composioService.listToolkits();
+        if (!probe.success) {
+          // Roll back the bad key so the next page-refresh doesn't
+          // show "ready". The user just learnt the key is wrong; they
+          // shouldn't have to also remember to clear it manually.
+          await composioService.forgetApiKey();
+          return res.status(400).json({
+            success: false,
+            error: `Key rejected by Composio: ${probe.error || 'unknown error'}`,
+          });
+        }
+        res.json({ success: true, keySource: 'vault' });
+      } catch (err) {
+        res.status(500).json({ success: false, error: err.message });
+      }
+    });
+
+    // Forget the stored Composio API key. Drops it from the vault and
+    // invalidates the SDK client cache. After this the service falls
+    // back to env var (if set) or reports "no key configured".
+    this.app.delete('/api/composio/apikey', async (req, res) => {
+      try {
+        const r = await composioService.forgetApiKey();
+        res.json(r);
+      } catch (err) {
+        res.status(500).json({ success: false, error: err.message });
+      }
+    });
+
+    // List enabled toolkits in the operator's Composio org.
+    this.app.get('/api/composio/toolkits', async (req, res) => {
+      try {
+        const r = await composioService.listToolkits();
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    // List the operator's current connections.
+    this.app.get('/api/composio/connections', async (req, res) => {
+      try {
+        const userId = req.query.userId || OPERATOR_USER;
+        const r = await composioService.listConnections(userId);
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    // Status for a specific toolkit. Used by the Connections page to
+    // colour the per-card status dot.
+    this.app.get('/api/composio/toolkits/:slug/status', async (req, res) => {
+      try {
+        const userId = req.query.userId || OPERATOR_USER;
+        const r = await composioService.connectionStatus(userId, req.params.slug);
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    // List actions a toolkit exposes (useful for the agent-creation
+    // toolkit picker to show what each integration can do).
+    this.app.get('/api/composio/toolkits/:slug/tools', async (req, res) => {
+      try {
+        const userId = req.query.userId || undefined;
+        const r = await composioService.listTools(req.params.slug, userId);
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    // Initiate an OAuth connection. Returns a Connect Link URL that
+    // the user opens in a browser to complete authentication.
+    this.app.post('/api/composio/connect', async (req, res) => {
+      try {
+        const { toolkitSlug, authConfigId } = req.body || {};
+        const userId = req.body?.userId || OPERATOR_USER;
+        if (!toolkitSlug) return res.status(400).json({ success: false, error: 'toolkitSlug is required' });
+        const r = await composioService.connect(userId, toolkitSlug, { authConfigId });
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    // Revoke a connection. Accepts either a connectionId in the path
+    // OR a {toolkitSlug, userId} pair in the body for "delete by toolkit".
+    this.app.delete('/api/composio/connections/:id', async (req, res) => {
+      try {
+        const userId = req.query.userId || OPERATOR_USER;
+        const id = req.params.id;
+        if (id && id !== 'by-toolkit') {
+          const r = await composioService.disconnect({ connectionId: id });
+          return res.json(r);
+        }
+        const { toolkitSlug } = req.body || {};
+        if (!toolkitSlug) return res.status(400).json({ success: false, error: 'toolkitSlug required when no connectionId is given' });
+        const r = await composioService.disconnect({ userId, toolkitSlug });
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    // Execute a Composio action on behalf of the operator. Mirrors the
+    // agent-facing execute path so the CLI can drive it for diagnostics.
+    this.app.post('/api/composio/execute', async (req, res) => {
+      try {
+        const { toolkitSlug, actionSlug, arguments: args } = req.body || {};
+        const userId = req.body?.userId || OPERATOR_USER;
+        if (!toolkitSlug || !actionSlug) {
+          return res.status(400).json({ success: false, error: 'toolkitSlug and actionSlug are required' });
+        }
+        const r = await composioService.execute(userId, toolkitSlug, actionSlug, args || {});
+        res.json(r);
+      } catch (err) { res.status(500).json({ success: false, error: err.message }); }
+    });
+
+    this.app.post('/api/agents/bulk', async (req, res) => {
+      const BULK_MAX_AGENTS = 100;
+      const VALID_ACTIONS = ['delete', 'unload', 'pause', 'resume', 'set-model', 'enable-tool', 'disable-tool', 'archive'];
+
+      try {
+        const { action, agentIds, params = {}, sessionId } = req.body || {};
+
+        if (!action || !VALID_ACTIONS.includes(action)) {
+          return res.status(400).json({
+            success: false,
+            error: `Invalid action: ${action}. Must be one of: ${VALID_ACTIONS.join(', ')}`,
+          });
+        }
+        if (!Array.isArray(agentIds) || agentIds.length === 0) {
+          return res.status(400).json({
+            success: false,
+            error: 'agentIds must be a non-empty array',
+          });
+        }
+        if (agentIds.length > BULK_MAX_AGENTS) {
+          return res.status(422).json({
+            success: false,
+            error: `Too many agents in one call: ${agentIds.length}. Maximum is ${BULK_MAX_AGENTS}.`,
+          });
+        }
+        // Per-action param validation.
+        if (action === 'set-model' && (!params.model || typeof params.model !== 'string')) {
+          return res.status(400).json({ success: false, error: 'set-model requires params.model (string)' });
+        }
+        if ((action === 'enable-tool' || action === 'disable-tool') && (!params.tool || typeof params.tool !== 'string')) {
+          return res.status(400).json({ success: false, error: `${action} requires params.tool (string)` });
+        }
+
+        const projectDir = this.orchestrator.config.project?.directory || process.cwd();
+        const effectiveSessionId = sessionId || 'bulk-action';
+
+        // Per-agent action runner. Returns { success, error? } per agent.
+        // Errors are CAUGHT here — the loop continues regardless.
+        const runOne = async (agentId) => {
+          try {
+            const agent = await this.orchestrator.agentPool.getAgent(agentId).catch(() => null);
+            if (!agent && action !== 'delete') {
+              // Allow `delete` to proceed against missing agents
+              // (idempotent cleanup); other actions need the agent loaded.
+              return { agentId, success: false, error: 'Agent not found' };
+            }
+
+            switch (action) {
+              case 'delete': {
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'delete_agent',
+                  payload: { agentId },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              case 'unload': {
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'unload_agent',
+                  payload: { agentId },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              case 'pause': {
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'pause_agent',
+                  payload: { agentId },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              case 'resume': {
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'resume_agent',
+                  payload: { agentId },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              case 'set-model': {
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'switch_model',
+                  payload: { agentId, model: params.model },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              case 'enable-tool':
+              case 'disable-tool': {
+                // Toggle capability on the agent's loaded state.
+                if (!agent) return { agentId, success: false, error: 'Agent not loaded' };
+                const caps = Array.isArray(agent.capabilities) ? [...agent.capabilities] : [];
+                const tool = params.tool;
+                const i = caps.indexOf(tool);
+                if (action === 'enable-tool' && i === -1) caps.push(tool);
+                if (action === 'disable-tool' && i !== -1) caps.splice(i, 1);
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'update_agent',
+                  payload: { agentId, updates: { capabilities: caps } },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              case 'archive': {
+                // Treat "archive" as unload + state marker. If
+                // stateManager has an archive primitive, use it;
+                // otherwise fall back to unload.
+                if (this.orchestrator.stateManager?.archiveAgent) {
+                  await this.orchestrator.stateManager.archiveAgent(agentId, projectDir);
+                  return { agentId, success: true };
+                }
+                const r = await this.orchestrator.processRequest({
+                  sessionId: effectiveSessionId, interface: 'WEB',
+                  action: 'unload_agent',
+                  payload: { agentId },
+                  projectDir,
+                });
+                return { agentId, success: r?.success !== false, error: r?.error || null };
+              }
+              default:
+                return { agentId, success: false, error: `Unhandled action: ${action}` };
+            }
+          } catch (err) {
+            return { agentId, success: false, error: err.message || String(err) };
+          }
+        };
+
+        // Run sequentially. Parallelism would be possible (Promise.all)
+        // but the orchestrator's agentPool state mutation is not lock-
+        // free, and the UI doesn't strictly need parallel speed for the
+        // typical N ≤ 20 case. Keep it simple.
+        const results = [];
+        for (const id of agentIds) {
+          results.push(await runOne(id));
+        }
+        const ok = results.filter(r => r.success).length;
+        const failed = results.length - ok;
+
+        res.json({
+          success: failed === 0,
+          summary: { total: results.length, ok, failed },
+          results,
+        });
+      } catch (error) {
+        this.logger.error('Bulk action failed', { error: error.message, stack: error.stack });
+        res.status(500).json({ success: false, error: error.message });
+      }
+    });
+
     // Duplicate/Clone an agent
     this.app.post('/api/agents/:agentId/duplicate', async (req, res) => {
       const { agentId } = req.params;