takos-control 1.0.0

package/src/application/services/execution/run-events.ts

@@ -0,0 +1,127 @@
+import { getDb, runEvents } from '../../../infra/db';
+import type { Env } from '../../../shared/types';
+import type { PlatformServices } from '../../../platform/platform-config.ts';
+import { now } from '../../../shared/utils';
+import {
+  buildRunNotifierEmitPayload,
+  buildRunNotifierEmitRequest,
+  getRunNotifierStub,
+  type RunNotifierEmitPayload,
+} from '../run-notifier';
+import { logWarn } from '../../../shared/utils/logger';
+
+// ---------------------------------------------------------------------------
+// SSE notifier accessor
+// ---------------------------------------------------------------------------
+
+function getSseNotifier(env: Env): PlatformServices['sseNotifier'] | undefined {
+  return (env as unknown as Record<string, unknown>).SSE_NOTIFIER as PlatformServices['sseNotifier'] | undefined;
+}
+
+// ---------------------------------------------------------------------------
+// Persist a run event to D1 (when not using R2 offload)
+// ---------------------------------------------------------------------------
+
+export async function persistRunEvent(
+  env: Env,
+  runId: string,
+  type: string,
+  data: unknown
+): Promise<number> {
+  const db = getDb(env.DB);
+  const event = await db.insert(runEvents).values({
+    runId,
+    type,
+    data: JSON.stringify(data),
+    createdAt: now(),
+  }).returning({ id: runEvents.id }).get();
+  return event.id;
+}
+
+// ---------------------------------------------------------------------------
+// Emit an event to the RUN_NOTIFIER Durable Object for a given run
+// ---------------------------------------------------------------------------
+
+export async function emitToNotifier(
+  env: Env,
+  runId: string,
+  payload: RunNotifierEmitPayload,
+  useTimeout: boolean = false
+): Promise<Response> {
+  const notifierStub = getRunNotifierStub(env, runId);
+  const request = buildRunNotifierEmitRequest(payload);
+
+  if (useTimeout) {
+    return fetchWithTimeout(notifierStub, request);
+  }
+  return notifierStub.fetch(request) as unknown as Response;
+}
+
+// ---------------------------------------------------------------------------
+// Persist an event (when not using R2 offload) and emit it to the notifier DO.
+// Silently catches notifier failures so callers can fire-and-forget.
+// ---------------------------------------------------------------------------
+
+export async function persistAndEmitEvent(
+  env: Env,
+  runId: string,
+  type: string,
+  data: unknown,
+  useTimeout: boolean = false
+): Promise<void> {
+  const eventId = env.TAKOS_OFFLOAD
+    ? null
+    : await persistRunEvent(env, runId, type, data);
+
+  try {
+    await emitToNotifier(
+      env,
+      runId,
+      buildRunNotifierEmitPayload(runId, type, data, eventId),
+      useTimeout,
+    );
+  } catch (notifyErr) {
+    logWarn(`Failed to notify WebSocket about ${type}`, { module: 'services/execution/run-events', detail: notifyErr });
+  }
+
+  // Also emit via SSE notifier for Node.js / k8s environments
+  const sseNotifier = getSseNotifier(env);
+  if (sseNotifier) {
+    try {
+      sseNotifier.emit(`run:${runId}`, {
+        type,
+        data,
+        event_id: eventId ?? undefined,
+      });
+    } catch (sseErr) {
+      logWarn(`Failed to emit SSE event for ${type}`, { module: 'services/execution/run-events', detail: sseErr });
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// DO fetch with timeout
+// ---------------------------------------------------------------------------
+
+const DO_FETCH_TIMEOUT_MS = 10_000;
+
+export async function fetchWithTimeout(
+  stub: { fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> },
+  request: Request | URL | string,
+  timeoutMs: number = DO_FETCH_TIMEOUT_MS
+): Promise<Response> {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const req = new Request(request, { signal: controller.signal });
+    return await stub.fetch(req);
+  } catch (error) {
+    if (error instanceof Error && error.name === 'AbortError') {
+      throw new Error(`DO fetch timeout after ${timeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}

package/src/application/services/execution/runtime-request-handler.ts

@@ -0,0 +1,173 @@
+import type { Env, DbEnv } from '../../../shared/types';
+import { parseServiceResponse, ServiceCallError } from '../../../shared/utils/service-client';
+import { getOrCreateBillingAccount, recordUsage } from '../billing/billing';
+import { withTimeout } from '../../../shared/utils/with-timeout';
+import { logWarn, logError } from '../../../shared/utils/logger';
+
+type RuntimeEnv = DbEnv & {
+  RUNTIME_HOST?: { fetch(request: Request): Promise<Response> };
+};
+
+const DEFAULT_TIMEOUT_MS = 3600000;
+
+function anySignal(signals: AbortSignal[]): AbortSignal {
+  const controller = new AbortController();
+  for (const signal of signals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      return controller.signal;
+    }
+    signal.addEventListener('abort', () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+
+export async function callRuntimeRequest(
+  env: RuntimeEnv,
+  endpoint: string,
+  options: {
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    body?: Record<string, unknown>;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+  } = {}
+) {
+  const { method = 'POST', body, timeoutMs = DEFAULT_TIMEOUT_MS, signal } = options;
+  const headers: Record<string, string> = {
+    'X-Takos-Internal': '1',
+  };
+
+  if (body) {
+    headers['Content-Type'] = 'application/json';
+  }
+
+  // Pass space_id as a header so runtime-host can use it for scoping
+  const spaceId = body && typeof body === 'object'
+    ? (body as Record<string, unknown>).space_id as string | undefined
+    : undefined;
+  if (spaceId) {
+    headers['X-Takos-Space-Id'] = spaceId;
+  }
+
+  const bodyStr = body ? JSON.stringify(body) : undefined;
+
+  if (!env.RUNTIME_HOST) {
+    throw new Error('RUNTIME_HOST binding is required');
+  }
+
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  const startMs = Date.now();
+  const requestSignal = signal ? anySignal([signal, controller.signal]) : controller.signal;
+
+  try {
+    const response = await env.RUNTIME_HOST.fetch(
+      new Request(`https://runtime-host${endpoint}`, {
+        method,
+        headers,
+        body: bodyStr,
+        signal: requestSignal,
+      })
+    );
+
+    if (spaceId && endpoint.includes('/exec')) {
+      const elapsedSeconds = Math.ceil((Date.now() - startMs) / 1000);
+      withTimeout(
+        recordRuntimeUsage(env, spaceId, elapsedSeconds, endpoint),
+        10_000,
+        'recordRuntimeUsage timed out'
+      ).catch((err) => {
+        logWarn('[RUNTIME] recordRuntimeUsage failed (non-fatal)', {
+          action: 'recordRuntimeUsage',
+          spaceId,
+          elapsedSeconds: String(elapsedSeconds),
+          endpoint,
+          errorValue: err instanceof Error ? err.message : String(err),
+        });
+      });
+    }
+
+    return response;
+  } catch (err) {
+    if (err instanceof Error && err.name === 'AbortError') {
+      const { GatewayTimeoutError } = await import('takos-common/errors');
+      throw new GatewayTimeoutError(`takos-runtime request timed out after ${Math.round(timeoutMs / 1000)}s`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
+/**
+ * Record exec_seconds usage for billing (non-blocking, fire-and-forget).
+ * Retries once on transient failure.
+ */
+async function recordRuntimeUsage(
+  env: RuntimeEnv,
+  spaceId: string,
+  seconds: number,
+  endpoint: string
+): Promise<void> {
+  const doRecord = async () => {
+    const { getDb, accounts } = await import('../../../infra/db');
+    const { eq } = await import('drizzle-orm');
+    const drizzle = getDb(env.DB);
+    const workspace = await drizzle.select({ ownerAccountId: accounts.ownerAccountId }).from(accounts).where(eq(accounts.id, spaceId)).get();
+    if (!workspace) return;
+    const account = await getOrCreateBillingAccount(env.DB, workspace.ownerAccountId || spaceId);
+    await recordUsage(env.DB, {
+      accountId: account.id,
+      spaceId,
+      meterType: 'exec_seconds',
+      units: seconds,
+      referenceType: 'runtime_exec',
+      metadata: { endpoint },
+    });
+  };
+
+  try {
+    await doRecord();
+  } catch (firstErr) {
+    logWarn('[RUNTIME] recordRuntimeUsage first attempt failed, retrying', {
+      action: 'recordRuntimeUsage',
+      spaceId,
+      endpoint,
+      errorValue: firstErr instanceof Error ? firstErr.message : String(firstErr),
+    });
+    // Retry once for transient failures
+    try {
+      await doRecord();
+    } catch (retryErr) {
+      logError('[RUNTIME] recordRuntimeUsage retry also failed', retryErr, {
+        action: 'recordRuntimeUsage',
+        spaceId,
+        endpoint,
+      });
+      throw retryErr;
+    }
+  }
+}
+
+export async function callRuntime(
+  env: RuntimeEnv,
+  endpoint: string,
+  body: Record<string, unknown>,
+  timeoutMs: number = DEFAULT_TIMEOUT_MS
+) {
+  return callRuntimeRequest(env, endpoint, { method: 'POST', body, timeoutMs });
+}
+
+/**
+ * Call runtime and parse the JSON response with type safety.
+ * Throws ServiceCallError on non-2xx responses.
+ */
+export async function callRuntimeJson<T>(
+  env: RuntimeEnv,
+  endpoint: string,
+  body: Record<string, unknown>,
+  timeoutMs: number = DEFAULT_TIMEOUT_MS,
+): Promise<T> {
+  const res = await callRuntime(env, endpoint, body, timeoutMs);
+  return parseServiceResponse<T>(res, 'takos-runtime');
+}

package/src/application/services/execution/sql-validation.ts

@@ -0,0 +1,202 @@
+type ValidationResult = {
+  valid: boolean;
+  statement?: string;
+  error?: string;
+};
+
+type MigrationValidationResult = {
+  valid: boolean;
+  statements?: string[];
+  error?: string;
+};
+
+const MAX_SQL_LENGTH = 100_000; // 100KB max SQL statement
+const MAX_BATCH_STATEMENTS = 100;
+
+const FORBIDDEN_VERBS = new Set(['ATTACH', 'DETACH', 'LOAD_EXTENSION', 'PRAGMA']);
+const QUERY_ALLOWED_VERBS = new Set(['SELECT', 'WITH', 'EXPLAIN']);
+const FORBIDDEN_SQL_PATTERNS = [
+  /\bLOAD_EXTENSION\s*\(/i,
+];
+
+function stripTrailingSemicolon(sql: string): string {
+  return sql.trim().replace(/;+\s*$/, '');
+}
+
+function containsSqlComment(sql: string): boolean {
+  let inSingle = false;
+  let inDouble = false;
+
+  for (let i = 0; i < sql.length; i += 1) {
+    const char = sql[i];
+    const next = sql[i + 1];
+
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (inSingle || inDouble) {
+      continue;
+    }
+    if (char === '-' && next === '-') {
+      return true;
+    }
+    if (char === '/' && next === '*') {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function splitSqlStatements(sql: string): { statements: string[]; error?: string } {
+  const statements: string[] = [];
+  let current = '';
+  let inSingle = false;
+  let inDouble = false;
+
+  for (let i = 0; i < sql.length; i += 1) {
+    const char = sql[i];
+
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      current += char;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      current += char;
+      continue;
+    }
+    if (!inSingle && !inDouble && char === ';') {
+      const trimmed = current.trim();
+      if (trimmed) {
+        statements.push(trimmed);
+      }
+      current = '';
+      continue;
+    }
+
+    current += char;
+  }
+
+  if (inSingle || inDouble) {
+    return { statements: [], error: 'Unterminated SQL string' };
+  }
+
+  const trailing = current.trim();
+  if (trailing) {
+    statements.push(trailing);
+  }
+
+  return { statements };
+}
+
+function getStatementVerb(sql: string): string {
+  const normalized = stripTrailingSemicolon(sql).trim().toUpperCase();
+  return normalized.split(/\s+/, 1)[0] ?? '';
+}
+
+function isForbiddenVerb(sql: string): boolean {
+  const verb = getStatementVerb(sql);
+  return FORBIDDEN_VERBS.has(verb) || FORBIDDEN_SQL_PATTERNS.some((pattern) => pattern.test(sql));
+}
+
+export function validateD1QuerySql(sql: string): ValidationResult {
+  if (sql.length > MAX_SQL_LENGTH) {
+    return { valid: false, error: 'SQL statement exceeds maximum length' };
+  }
+
+  if (containsSqlComment(sql)) {
+    return { valid: false, error: 'SQL comments are not allowed' };
+  }
+
+  const { statements, error } = splitSqlStatements(sql);
+  if (error) {
+    return { valid: false, error };
+  }
+  if (statements.length !== 1) {
+    return { valid: false, error: 'Semicolons are not allowed in query statements' };
+  }
+
+  const statement = statements[0]!;
+  if (isForbiddenVerb(statement)) {
+    return { valid: false, error: 'SQL contains a forbidden verb' };
+  }
+
+  const verb = getStatementVerb(statement);
+  if (!QUERY_ALLOWED_VERBS.has(verb)) {
+    if (['INSERT', 'UPDATE', 'DELETE', 'REPLACE'].includes(verb)) {
+      return { valid: false, error: 'Query endpoint is read-only' };
+    }
+    return { valid: false, error: `Statement verb ${verb || '(unknown)'} is not allowed` };
+  }
+
+  return { valid: true, statement: stripTrailingSemicolon(statement) };
+}
+
+export function validateD1ProxySql(sql: string): ValidationResult {
+  if (sql.length > MAX_SQL_LENGTH) {
+    return { valid: false, error: 'SQL statement exceeds maximum length' };
+  }
+
+  if (containsSqlComment(sql)) {
+    return { valid: false, error: 'SQL comments are not allowed' };
+  }
+
+  const { statements, error } = splitSqlStatements(sql);
+  if (error) {
+    return { valid: false, error };
+  }
+  if (statements.length !== 1) {
+    return { valid: false, error: 'Multi-statement SQL is not allowed in proxy' };
+  }
+
+  const statement = statements[0]!;
+  if (isForbiddenVerb(statement)) {
+    return { valid: false, error: 'SQL contains a forbidden verb' };
+  }
+
+  const verb = getStatementVerb(statement);
+  const proxyAllowedVerbs = new Set([
+    'SELECT', 'WITH', 'EXPLAIN', 'INSERT', 'UPDATE', 'DELETE', 'REPLACE',
+  ]);
+  if (!proxyAllowedVerbs.has(verb)) {
+    return { valid: false, error: `Statement verb ${verb || '(unknown)'} is not allowed in proxy` };
+  }
+
+  return { valid: true, statement: stripTrailingSemicolon(statement) };
+}
+
+export function validateD1MigrationSql(sql: string): MigrationValidationResult {
+  if (sql.length > MAX_SQL_LENGTH * 10) {
+    return { valid: false, error: 'SQL migration exceeds maximum length' };
+  }
+
+  if (containsSqlComment(sql)) {
+    return { valid: false, error: 'SQL comments are not allowed' };
+  }
+
+  const { statements, error } = splitSqlStatements(sql);
+  if (error) {
+    return { valid: false, error };
+  }
+  if (statements.length === 0) {
+    return { valid: false, error: 'No SQL statements provided' };
+  }
+  if (statements.length > MAX_BATCH_STATEMENTS) {
+    return { valid: false, error: `Migration contains too many statements (max ${MAX_BATCH_STATEMENTS})` };
+  }
+
+  for (const statement of statements) {
+    if (isForbiddenVerb(statement)) {
+      return { valid: false, error: 'SQL contains a forbidden verb' };
+    }
+  }
+
+  return { valid: true, statements: statements.map(stripTrailingSemicolon) };
+}

package/src/application/services/execution/workflow-engine-converters.ts

@@ -0,0 +1,75 @@
+/**
+ * Workflow Engine – pure helper / conversion functions
+ */
+
+import type { Job } from 'takos-actions-engine';
+import { toIsoString } from '../../../shared/utils';
+import type { WorkflowJobDefinition, WorkflowShell } from '../../../shared/types';
+import type { DrizzleWorkflowRun, WorkflowRunRecord } from './workflow-engine-types';
+
+export function normalizeWorkflowShell(shell: string | undefined): WorkflowShell | undefined {
+  if (
+    shell === 'bash' ||
+    shell === 'pwsh' ||
+    shell === 'python' ||
+    shell === 'sh' ||
+    shell === 'cmd' ||
+    shell === 'powershell'
+  ) {
+    return shell;
+  }
+  return undefined;
+}
+
+export function toWorkflowJobDefinition(job: Job): WorkflowJobDefinition {
+  const defaults: WorkflowJobDefinition['defaults'] = job.defaults?.run
+    ? {
+        run: {
+          shell: normalizeWorkflowShell(job.defaults.run.shell),
+          'working-directory': job.defaults.run['working-directory'],
+        },
+      }
+    : undefined;
+
+  return {
+    ...job,
+    defaults,
+    steps: job.steps.map((step) => ({
+      ...step,
+      shell: normalizeWorkflowShell(step.shell),
+    })),
+  };
+}
+
+/**
+ * Normalize needs field (string | string[] | undefined) to string[]
+ */
+export function normalizeNeeds(needs: string | string[] | undefined): string[] {
+  if (!needs) return [];
+  return Array.isArray(needs) ? needs : [needs];
+}
+
+/**
+ * Map a Drizzle WorkflowRun record to the snake_case WorkflowRunRecord shape
+ */
+export function toRunRecord(run: DrizzleWorkflowRun): WorkflowRunRecord {
+  return {
+    id: run.id,
+    repo_id: run.repoId,
+    workflow_id: run.workflowId,
+    workflow_path: run.workflowPath,
+    event: run.event,
+    ref: run.ref,
+    sha: run.sha,
+    actor_id: run.actorAccountId,
+    status: run.status,
+    conclusion: run.conclusion,
+    queued_at: toIsoString(run.queuedAt),
+    started_at: toIsoString(run.startedAt),
+    completed_at: toIsoString(run.completedAt),
+    inputs: run.inputs,
+    run_number: run.runNumber,
+    run_attempt: run.runAttempt,
+    created_at: toIsoString(run.createdAt) ?? new Date(0).toISOString(),
+  };
+}

package/src/application/services/execution/workflow-engine-types.ts

@@ -0,0 +1,77 @@
+/**
+ * Workflow Engine – shared types and interfaces
+ */
+
+import type { D1Database, Queue } from '../../../shared/types/bindings.ts';
+import type { Conclusion } from 'takos-actions-engine';
+import type { WorkflowJobQueueMessage } from '../../../shared/types';
+import type { SelectOf } from '../../../shared/types/drizzle-helpers';
+import type { workflowRuns } from '../../../infra/db';
+import * as gitStore from '../git-smart';
+
+export type WorkflowBucket = Parameters<typeof gitStore.getCommitData>[0] & Parameters<typeof gitStore.getBlobAtPath>[0];
+
+export interface WorkflowEngineConfig {
+  db: D1Database;
+  bucket: WorkflowBucket;
+  queue?: Queue<WorkflowJobQueueMessage>;
+}
+
+export interface StartRunOptions {
+  repoId: string;
+  workflowPath: string;
+  event: string;
+  ref: string;
+  sha: string;
+  inputs?: Record<string, unknown>;
+  actorId: string;
+}
+
+export interface WorkflowJobResult {
+  jobId: string;
+  status: 'completed';
+  conclusion: Conclusion;
+  outputs: Record<string, string>;
+  stepResults: WorkflowStepResult[];
+  startedAt: string;
+  completedAt: string;
+}
+
+export interface WorkflowStepResult {
+  stepNumber: number;
+  name: string;
+  status: 'completed' | 'skipped';
+  conclusion: Conclusion | null;
+  exitCode?: number;
+  error?: string;
+  outputs: Record<string, string>;
+  startedAt?: string;
+  completedAt?: string;
+}
+
+export interface WorkflowRunRecord {
+  id: string;
+  repo_id: string;
+  workflow_id: string | null;
+  workflow_path: string;
+  event: string;
+  ref: string | null;
+  sha: string | null;
+  actor_id: string | null;
+  status: string;
+  conclusion: string | null;
+  queued_at: string | null;
+  started_at: string | null;
+  completed_at: string | null;
+  inputs: string | null;
+  run_number: number | null;
+  run_attempt: number;
+  created_at: string;
+}
+
+export interface DependencyState {
+  allCompleted: boolean;
+  allSuccessful: boolean;
+}
+
+export type DrizzleWorkflowRun = SelectOf<typeof workflowRuns>;