robotrock 1.3.1 → 1.3.3

package/dist/eve/agent/index.js

@@ -89,6 +89,7 @@ function verifyRobotRockPlatformUserContextJwt(args) {
   const connectionId = readStringClaim(payload, "connectionId");
   const role = parseTenantRoleClaim(readStringClaim(payload, "role"));
   const workosUserId = readStringClaim(payload, "workosUserId");
+  const chatId = readStringClaim(payload, "chatId");
   const iat = payload.iat;
   const exp = payload.exp;
   if (!sub || !email || !name || !tenantSlug || !connectionId || !role || typeof iat !== "number" || typeof exp !== "number") {
@@ -107,6 +108,7 @@ function verifyRobotRockPlatformUserContextJwt(args) {
       role,
       groups: readGroupsClaim(payload),
       ...workosUserId ? { workosUserId } : {},
+      ...chatId ? { chatId } : {},
       iat,
       exp
     }
@@ -387,89 +389,6 @@ function parseEveAskQuestionToolOutput(output) {
   return { ...optionId ? { optionId } : {}, ...text ? { text } : {} };
 }
 
-// src/eve/tool-audit.ts
-var MANAGE_TEAM_MEMBERS_TOOL_NAME = "manage_team_members";
-var MANAGE_GROUPS_TOOL_NAME = "manage_groups";
-var CREATE_INBOX_TASK_TOOL_NAME = "create_robotrock_task";
-var MUTATING_TEAM_MEMBER_ACTIONS = /* @__PURE__ */ new Set([
-  "invite",
-  "update_role",
-  "remove"
-]);
-var MUTATING_GROUP_ACTIONS = /* @__PURE__ */ new Set([
-  "create",
-  "update",
-  "delete",
-  "add_member",
-  "remove_member"
-]);
-var SKIP_TOOL_NAMES = /* @__PURE__ */ new Set([
-  CREATE_INBOX_TASK_TOOL_NAME,
-  "ask_question",
-  "closeChat",
-  "requestActionInput"
-]);
-function readAction(input) {
-  const action = input.action;
-  return typeof action === "string" && action.trim().length > 0 ? action.trim() : void 0;
-}
-function shouldAuditToolExecution(toolName, input) {
-  if (SKIP_TOOL_NAMES.has(toolName)) {
-    return false;
-  }
-  const action = readAction(input);
-  if (toolName === MANAGE_TEAM_MEMBERS_TOOL_NAME) {
-    return action != null && MUTATING_TEAM_MEMBER_ACTIONS.has(action);
-  }
-  if (toolName === MANAGE_GROUPS_TOOL_NAME) {
-    return action != null && MUTATING_GROUP_ACTIONS.has(action);
-  }
-  return false;
-}
-var AUDIT_INPUT_KEYS = /* @__PURE__ */ new Set([
-  "action",
-  "email",
-  "userId",
-  "role",
-  "name",
-  "groupId",
-  "description"
-]);
-function sanitizeToolAuditInput(input) {
-  const sanitized = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!AUDIT_INPUT_KEYS.has(key)) {
-      continue;
-    }
-    if (value == null || value === "") {
-      continue;
-    }
-    if (typeof value === "string" || typeof value === "boolean") {
-      sanitized[key] = value;
-      continue;
-    }
-    if (typeof value === "number") {
-      sanitized[key] = value;
-    }
-  }
-  return sanitized;
-}
-function buildChatToolAuditPayload(input) {
-  const sanitized = sanitizeToolAuditInput(input.toolInput);
-  if (!shouldAuditToolExecution(input.toolName, sanitized)) {
-    return null;
-  }
-  const success = input.status === "completed" && input.isError !== true;
-  return {
-    toolCallId: input.toolCallId,
-    toolName: input.toolName,
-    input: sanitized,
-    success,
-    status: input.status,
-    ...input.error ? { error: input.error } : {}
-  };
-}
-
 // src/eve/index.ts
 var ROBOTROCK_READY_HOOK_SLUG = "robotrock-ready";
 
@@ -521,6 +440,7 @@ function tryResolveTenantCaller(ctx) {
   }
   const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
   const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const chatId = readStringAttribute(caller.attributes, "chatId");
   const groups = readStringArrayAttribute(caller.attributes, "groups");
   return {
     userId: caller.principalId,
@@ -528,6 +448,7 @@ function tryResolveTenantCaller(ctx) {
     name: name ?? email.split("@")[0] ?? email,
     tenantSlug,
     ...connectionId ? { connectionId } : {},
+    ...chatId ? { chatId } : {},
     role,
     isAdmin: role === "admin",
     groups,
@@ -601,7 +522,8 @@ function mapVerifiedClaimsToSessionAuth(claims) {
       role: claims.role,
       groups: claims.groups,
       ...claims.connectionId ? { connectionId: claims.connectionId } : {},
-      ...claims.workosUserId ? { workosUserId: claims.workosUserId } : {}
+      ...claims.workosUserId ? { workosUserId: claims.workosUserId } : {},
+      ...claims.chatId ? { chatId: claims.chatId } : {}
     }
   };
 }
@@ -665,12 +587,14 @@ function robotrockUserContextAuth(options) {
       result.sessionAuth.attributes,
       "workosUserId"
     );
+    const chatId = readStringAttribute(result.sessionAuth.attributes, "chatId");
     return mapVerifiedClaimsToSessionAuth({
       sub: subject,
       email,
       name: name ?? email.split("@")[0] ?? email,
       tenantSlug,
       connectionId,
+      chatId,
       role,
       groups,
       workosUserId
@@ -714,6 +638,39 @@ function eveSelfServiceAuth() {
   };
 }
 
+// src/eve/agent/deployment-access.ts
+var ROBOTROCK_EVE_CONNECT_ROUTES = {
+  /** Agent manifest + `robotrock-ready` hook detection. */
+  info: { method: "GET", path: "/eve/v1/info" },
+  /** Optional health probe (same auth as `/info` when the channel is protected). */
+  health: { method: "GET", path: "/eve/v1/health" }
+};
+var ROBOTROCK_EVE_ICON_PATHS = [
+  "/favicon.ico",
+  "/icon.svg",
+  "/icon.png"
+];
+var ROBOTROCK_EVE_CHAT_ROUTES = {
+  createSession: { method: "POST", path: "/eve/v1/session" },
+  continueSession: {
+    method: "POST",
+    path: "/eve/v1/session/:sessionId"
+  },
+  messageStream: {
+    method: "GET",
+    path: "/eve/v1/session/:sessionId/stream"
+  }
+};
+var EVE_SELF_AUTH_TOKEN_ENV_VAR = "EVE_SELF_AUTH_TOKEN";
+var ROBOTROCK_EVE_BEARER_PROTECTED_PATHS = [
+  ROBOTROCK_EVE_CONNECT_ROUTES.info.path,
+  ROBOTROCK_EVE_CONNECT_ROUTES.health.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.createSession.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.continueSession.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.messageStream.path,
+  ...ROBOTROCK_EVE_ICON_PATHS
+];
+
 // src/eve/agent/channel.ts
 import { eveChannel } from "eve/channels/eve";
 import { localDev, vercelOidc } from "eve/channels/auth";
@@ -1611,11 +1568,42 @@ function resolveRobotRockAuthConfig(overrides) {
   return { kind: "apiKey", apiKey };
 }
 
+// src/chat-correlation.ts
+var ROBOTROCK_CHAT_ID_HEADER = "x-robotrock-chat-id";
+var ROBOTROCK_EVE_SESSION_ID_HEADER = "x-robotrock-eve-session-id";
+function resolveChatCorrelationFromEnv() {
+  const chatId = process.env.ROBOTROCK_CHAT_ID?.trim();
+  const eveSessionId = process.env.ROBOTROCK_EVE_SESSION_ID?.trim();
+  if (!chatId && !eveSessionId) {
+    return void 0;
+  }
+  return {
+    ...chatId ? { chatId } : {},
+    ...eveSessionId ? { eveSessionId } : {}
+  };
+}
+function buildChatCorrelationHeaders(correlation) {
+  if (!correlation) {
+    return {};
+  }
+  const headers = {};
+  const chatId = correlation.chatId?.trim();
+  const eveSessionId = correlation.eveSessionId?.trim();
+  if (chatId) {
+    headers[ROBOTROCK_CHAT_ID_HEADER] = chatId;
+  }
+  if (eveSessionId) {
+    headers[ROBOTROCK_EVE_SESSION_ID_HEADER] = eveSessionId;
+  }
+  return headers;
+}
+
 // src/chats.ts
 function createChatsApi(config) {
   const headers = () => ({
     "Content-Type": "application/json",
-    ...buildRobotRockAuthHeaders(config.auth)
+    ...buildRobotRockAuthHeaders(config.auth),
+    ...buildChatCorrelationHeaders(config.chatCorrelation)
   });
   return {
     async create(input) {
@@ -1825,6 +1813,7 @@ function serializeValidUntil(value) {
 }
 var RobotRock = class {
   auth;
+  chatCorrelation;
   baseUrl;
   app;
   agentVersion;
@@ -1852,6 +1841,7 @@ var RobotRock = class {
       ...apiKey ? { apiKey } : {},
       ...agentService ? { agentService } : {}
     });
+    this.chatCorrelation = config.chatCorrelation;
     this.baseUrl = config.baseUrl ?? getRobotRockApiBaseUrl();
     this.app = config.app;
     this.agentVersion = config.version ?? resolveAgentVersionFromEnv();
@@ -1869,13 +1859,15 @@ var RobotRock = class {
     this.chats = createChatsApi({
       baseUrl: this.baseUrl,
       auth: this.auth,
-      app: this.app
+      app: this.app,
+      chatCorrelation: this.chatCorrelation
     });
   }
   authHeaders(extra) {
     return {
       "Content-Type": "application/json",
       ...buildRobotRockAuthHeaders(this.auth),
+      ...buildChatCorrelationHeaders(this.chatCorrelation),
       ...extra
     };
   }
@@ -2146,51 +2138,39 @@ function normalizeSendToHumanInput(task, clientDefaults) {
   };
 }
 
-// src/env.ts
-function resolveRobotRockConfig(overrides) {
-  const agentService = overrides?.agentService;
-  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
-  if (agentService && apiKey) {
-    throw new Error(
-      "RobotRock client cannot configure both apiKey and agentService."
-    );
-  }
-  const baseUrl = overrides?.baseUrl ?? getRobotRockApiBaseUrl();
-  const app = overrides?.app ?? process.env.ROBOTROCK_APP;
-  if (agentService) {
-    return app ? { agentService, baseUrl, app } : { agentService, baseUrl };
-  }
-  if (!apiKey) {
-    throw new Error(
-      "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass agentService when creating the client."
-    );
-  }
-  return app ? { apiKey, baseUrl, app } : { apiKey, baseUrl };
-}
-
 // src/eve/agent/client-from-session.ts
 var warnedMissingAuth = false;
+function resolveBoundChatCorrelation(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  return {
+    eveSessionId: ctx.session.id,
+    ...caller?.chatId ? { chatId: caller.chatId } : {},
+    ...resolveChatCorrelationFromEnv()
+  };
+}
 function tryCreateBoundRobotRockClient(ctx) {
   const caller = tryResolveTenantCaller(ctx);
   const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  const chatCorrelation = resolveBoundChatCorrelation(ctx);
   if (caller?.connectionId && serviceToken) {
     return createClient({
       baseUrl: process.env.ROBOTROCK_BASE_URL?.trim(),
+      chatCorrelation,
       agentService: {
         token: serviceToken,
         tenantSlug: caller.tenantSlug,
-        connectionId: caller.connectionId
+        connectionId: caller.connectionId,
+        actingUserId: caller.userId
       }
     });
   }
   const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
   if (apiKey) {
-    return createClient(
-      resolveRobotRockConfig({
-        apiKey,
-        baseUrl: process.env.ROBOTROCK_BASE_URL?.trim()
-      })
-    );
+    return createClient({
+      apiKey,
+      baseUrl: process.env.ROBOTROCK_BASE_URL?.trim(),
+      chatCorrelation
+    });
   }
   if (!warnedMissingAuth) {
     warnedMissingAuth = true;
@@ -2238,23 +2218,6 @@ function logAuditFailure(label, error) {
   const hint = error instanceof RobotRockError && error.statusCode === 405 ? " \u2014 set ROBOTROCK_BASE_URL=http://localhost:4001/v1 and run the local API" : "";
   console.warn(`robotrock-chat-audit: failed to ${label}${hint}`, error);
 }
-async function postRobotRockChatToolAudit(ctx, payload) {
-  const client = tryCreateBoundRobotRockClient(ctx);
-  if (!client) {
-    if (!warnedMissingAuth2) {
-      warnedMissingAuth2 = true;
-      console.warn(
-        "robotrock-chat-audit: RobotRock auth is unset; skipping tool audit logging."
-      );
-    }
-    return;
-  }
-  try {
-    await client.chats.logToolExecution(payload);
-  } catch (error) {
-    logAuditFailure("log tool execution", error);
-  }
-}
 async function postRobotRockChatInputAudit(ctx, payload) {
   const client = tryCreateBoundRobotRockClient(ctx);
   if (!client) {
@@ -2422,6 +2385,28 @@ function buildRobotRockTaskPayload(input, options) {
   return payload;
 }
 
+// src/env.ts
+function resolveRobotRockConfig(overrides) {
+  const agentService = overrides?.agentService;
+  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
+  if (agentService && apiKey) {
+    throw new Error(
+      "RobotRock client cannot configure both apiKey and agentService."
+    );
+  }
+  const baseUrl = overrides?.baseUrl ?? getRobotRockApiBaseUrl();
+  const app = overrides?.app ?? process.env.ROBOTROCK_APP;
+  if (agentService) {
+    return app ? { agentService, baseUrl, app } : { agentService, baseUrl };
+  }
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass agentService when creating the client."
+    );
+  }
+  return app ? { apiKey, baseUrl, app } : { apiKey, baseUrl };
+}
+
 // src/eve/agent/cron-chat.ts
 function resolveCronAgentIdentifier(agentIdentifier) {
   return agentIdentifier?.trim() || process.env.ROBOTROCK_CRON_AGENT_IDENTIFIER?.trim() || "robotrock-agent";
@@ -2451,8 +2436,6 @@ function defineRobotRockReadyHook() {
 // src/eve/agent/hooks/chat-audit.ts
 import { defineHook as defineHook2 } from "eve/hooks";
 var loggedIdempotencyKeys = /* @__PURE__ */ new Set();
-var loggedToolCallIds = /* @__PURE__ */ new Set();
-var pendingToolCallsBySession = /* @__PURE__ */ new Map();
 function toEveInputRequest(request) {
   return {
     requestId: request.requestId,
@@ -2462,22 +2445,6 @@ function toEveInputRequest(request) {
     ...request.options ? { options: request.options } : {}
   };
 }
-function stashPendingToolCall(sessionId, callId, toolName, input) {
-  const sessionCalls = pendingToolCallsBySession.get(sessionId) ?? /* @__PURE__ */ new Map();
-  sessionCalls.set(callId, { toolName, input });
-  pendingToolCallsBySession.set(sessionId, sessionCalls);
-}
-function takePendingToolCall(sessionId, callId) {
-  const sessionCalls = pendingToolCallsBySession.get(sessionId);
-  const pending = sessionCalls?.get(callId);
-  if (pending && sessionCalls) {
-    sessionCalls.delete(callId);
-    if (sessionCalls.size === 0) {
-      pendingToolCallsBySession.delete(sessionId);
-    }
-  }
-  return pending;
-}
 async function logPendingInputResponse(ctx, pending, response) {
   const caller = tryResolveTenantCaller(ctx);
   if (!caller) {
@@ -2514,70 +2481,11 @@ async function logPendingInputResponse(ctx, pending, response) {
   });
   loggedIdempotencyKeys.add(idempotencyKey);
 }
-async function logToolExecutionFromResult(ctx, event) {
-  const result = event.data.result;
-  if (result.kind !== "tool-result") {
-    return;
-  }
-  const callId = result.callId;
-  const toolName = result.toolName;
-  if (!callId || !toolName) {
-    return;
-  }
-  const dedupeKey = `${ctx.session.id}:${callId}`;
-  if (loggedToolCallIds.has(dedupeKey)) {
-    return;
-  }
-  const pending = takePendingToolCall(ctx.session.id, callId) ?? { toolName, input: {} };
-  const payload = buildChatToolAuditPayload({
-    toolCallId: callId,
-    toolName: pending.toolName,
-    toolInput: pending.input,
-    status: event.data.status,
-    isError: result.isError,
-    error: event.data.error?.message
-  });
-  if (!payload) {
-    return;
-  }
-  const caller = tryResolveTenantCaller(ctx);
-  if (!caller) {
-    return;
-  }
-  await postRobotRockChatToolAudit(ctx, {
-    eveSessionId: ctx.session.id,
-    userId: caller.userId,
-    toolCallId: payload.toolCallId,
-    toolName: payload.toolName,
-    input: payload.input,
-    success: payload.success,
-    status: payload.status,
-    ...payload.error ? { error: payload.error } : {},
-    idempotencyKey: dedupeKey
-  });
-  loggedToolCallIds.add(dedupeKey);
-}
 function resetRobotrockChatAuditIdempotencyKeys() {
   loggedIdempotencyKeys.clear();
-  loggedToolCallIds.clear();
-  pendingToolCallsBySession.clear();
 }
 var robotrockChatAuditHook = defineHook2({
   events: {
-    async "actions.requested"(event, ctx) {
-      for (const action of event.data.actions) {
-        if (action.kind !== "tool-call") {
-          continue;
-        }
-        const input = action.input != null && typeof action.input === "object" && !Array.isArray(action.input) ? action.input : {};
-        stashPendingToolCall(
-          ctx.session.id,
-          action.callId,
-          action.toolName,
-          input
-        );
-      }
-    },
     async "input.requested"(event, ctx) {
       const requests = [];
       for (const request of event.data.requests) {
@@ -2621,37 +2529,39 @@ var robotrockChatAuditHook = defineHook2({
     },
     async "action.result"(event, ctx) {
       const result = event.data.result;
-      if (result.kind === "tool-result") {
-        const staged = await fetchRobotRockStagedHitl(ctx, ctx.session.id);
-        const pending = staged.find((entry) => entry.toolCallId === result.callId);
-        if (pending) {
-          const idempotencyKey = `${ctx.session.id}:${pending.requestId}`;
-          if (!loggedIdempotencyKeys.has(idempotencyKey)) {
-            if (pending.toolName === "ask_question") {
-              const parsed = parseEveAskQuestionToolOutput(result.output);
-              if (parsed) {
-                await logPendingInputResponse(ctx, pending, {
-                  requestId: pending.requestId,
-                  ...parsed
-                });
-              }
-            } else if (isEveApprovalInputRequest(toEveInputRequest(pending))) {
-              if (event.data.status === "rejected") {
-                await logPendingInputResponse(ctx, pending, {
-                  requestId: pending.requestId,
-                  optionId: "deny"
-                });
-              } else if (event.data.status === "completed") {
-                await logPendingInputResponse(ctx, pending, {
-                  requestId: pending.requestId,
-                  optionId: "approve"
-                });
-              }
-            }
-          }
+      if (result.kind !== "tool-result") {
+        return;
+      }
+      const staged = await fetchRobotRockStagedHitl(ctx, ctx.session.id);
+      const pending = staged.find((entry) => entry.toolCallId === result.callId);
+      if (!pending) {
+        return;
+      }
+      const idempotencyKey = `${ctx.session.id}:${pending.requestId}`;
+      if (loggedIdempotencyKeys.has(idempotencyKey)) {
+        return;
+      }
+      if (pending.toolName === "ask_question") {
+        const parsed = parseEveAskQuestionToolOutput(result.output);
+        if (parsed) {
+          await logPendingInputResponse(ctx, pending, {
+            requestId: pending.requestId,
+            ...parsed
+          });
+        }
+      } else if (isEveApprovalInputRequest(toEveInputRequest(pending))) {
+        if (event.data.status === "rejected") {
+          await logPendingInputResponse(ctx, pending, {
+            requestId: pending.requestId,
+            optionId: "deny"
+          });
+        } else if (event.data.status === "completed") {
+          await logPendingInputResponse(ctx, pending, {
+            requestId: pending.requestId,
+            optionId: "approve"
+          });
         }
       }
-      await logToolExecutionFromResult(ctx, event);
     }
   }
 });
@@ -2671,6 +2581,7 @@ async function agentAdminFetch(config, path, init) {
     headers: {
       "Content-Type": "application/json",
       ...buildRobotRockAuthHeaders(config.auth),
+      ...buildChatCorrelationHeaders(config.chatCorrelation),
       ...init?.headers ?? {}
     }
   });
@@ -2780,13 +2691,23 @@ function createAgentAdminApi(config) {
     }
   };
 }
+function resolveBoundChatCorrelation2(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  return {
+    eveSessionId: ctx.session.id,
+    ...caller?.chatId ? { chatId: caller.chatId } : {},
+    ...resolveChatCorrelationFromEnv()
+  };
+}
 function createBoundAgentAdminClient(ctx) {
   const caller = requireTenantCaller(ctx);
   const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
   const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  const chatCorrelation = resolveBoundChatCorrelation2(ctx);
   if (caller.connectionId && serviceToken) {
     return createAgentAdminApi({
       baseUrl,
+      chatCorrelation,
       auth: resolveRobotRockAuthConfig({
         agentService: {
           token: serviceToken,
@@ -2801,6 +2722,7 @@ function createBoundAgentAdminClient(ctx) {
   if (apiKey) {
     return createAgentAdminApi({
       baseUrl,
+      chatCorrelation,
       auth: {
         kind: "apiKey",
         apiKey,
@@ -2817,6 +2739,11 @@ function requireBoundAgentAdminClient(ctx) {
   return createBoundAgentAdminClient(ctx);
 }
 export {
+  EVE_SELF_AUTH_TOKEN_ENV_VAR,
+  ROBOTROCK_EVE_BEARER_PROTECTED_PATHS,
+  ROBOTROCK_EVE_CHAT_ROUTES,
+  ROBOTROCK_EVE_CONNECT_ROUTES,
+  ROBOTROCK_EVE_ICON_PATHS,
   ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL,
   ROBOTROCK_READY_HOOK_SLUG,
   ROBOTROCK_USER_CONTEXT_AUDIENCE,