the-campfire 0.1.0

package/server/replay.ts

@@ -0,0 +1,78 @@
+/**
+ * Replay utility for session recordings.
+ *
+ * Loads JSONL recording files and replays them through WsBridge or CodexAdapter
+ * to produce browser messages. Used in tests to validate that message processing
+ * produces the expected output from recorded real sessions.
+ */
+
+import { readFileSync } from "node:fs";
+import type { RecordingHeader, RecordingEntry } from "./recorder.js";
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+export interface Recording {
+  header: RecordingHeader;
+  entries: RecordingEntry[];
+}
+
+// ─── Loading ─────────────────────────────────────────────────────────────────
+
+/**
+ * Load a JSONL recording file. Returns the parsed header and all entries.
+ * Throws if the file is missing a valid header.
+ */
+export function loadRecording(path: string): Recording {
+  const content = readFileSync(path, "utf-8");
+  const lines = content.split("\n").filter((l) => l.trim());
+
+  if (lines.length === 0) {
+    throw new Error("Recording file is empty");
+  }
+
+  const header = JSON.parse(lines[0]) as RecordingHeader;
+  if (!header._header || header.version !== 1) {
+    throw new Error("Invalid recording header: missing _header or version !== 1");
+  }
+
+  const entries: RecordingEntry[] = [];
+  for (let i = 1; i < lines.length; i++) {
+    try {
+      entries.push(JSON.parse(lines[i]) as RecordingEntry);
+    } catch {
+      // Skip malformed lines — recording might have been truncated
+    }
+  }
+
+  return { header, entries };
+}
+
+// ─── Replay helpers ──────────────────────────────────────────────────────────
+
+/**
+ * Filter recording entries by direction and channel.
+ * Useful for extracting only incoming CLI messages for replay.
+ */
+export function filterEntries(
+  entries: RecordingEntry[],
+  dir: "in" | "out",
+  channel: "cli" | "browser",
+): RecordingEntry[] {
+  return entries.filter((e) => e.dir === dir && e.ch === channel);
+}
+
+/**
+ * Get all outgoing browser messages from a recording.
+ * These represent what the server actually sent to browsers during the recorded session.
+ */
+export function getExpectedBrowserMessages(entries: RecordingEntry[]): string[] {
+  return filterEntries(entries, "out", "browser").map((e) => e.raw);
+}
+
+/**
+ * Get all incoming CLI messages from a recording.
+ * These are the raw NDJSON/JSON-RPC lines received from the backend.
+ */
+export function getIncomingCLIMessages(entries: RecordingEntry[]): string[] {
+  return filterEntries(entries, "in", "cli").map((e) => e.raw);
+}

package/server/routes/adapter-routes.ts

@@ -0,0 +1,31 @@
+import type { Hono } from "hono";
+import type { RouteDeps } from "./route-deps.js";
+
+export function registerAdapterRoutes(api: Hono, deps: RouteDeps): void {
+  const { adapterRegistry } = deps;
+
+  api.get("/adapters", (c) => {
+    if (!adapterRegistry) return c.json([]);
+    return c.json(adapterRegistry.listInstalled());
+  });
+
+  api.post("/adapters/install", async (c) => {
+    if (!adapterRegistry) return c.json({ error: "Adapter registry not available" }, 500);
+    const { npmPackage } = await c.req.json() as { npmPackage: string };
+    if (!npmPackage) return c.json({ error: "npmPackage is required" }, 400);
+    try {
+      const adapter = await adapterRegistry.install(npmPackage);
+      return c.json(adapter, 201);
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
+    }
+  });
+
+  api.delete("/adapters/:name", (c) => {
+    if (!adapterRegistry) return c.json({ error: "Adapter registry not available" }, 500);
+    const name = c.req.param("name");
+    const removed = adapterRegistry.uninstall(name);
+    if (!removed) return c.json({ error: "Adapter not found" }, 404);
+    return c.json({ ok: true });
+  });
+}

package/server/routes/agent-mcp-routes.ts

@@ -0,0 +1,35 @@
+import type { Hono } from "hono";
+import type { RouteDeps } from "./route-deps.js";
+import { generateAgentToolDefinitions } from "../agent-mcp-tools.js";
+
+function isInternalAuthorized(c: { req: { header: (name: string) => string | undefined } }): boolean {
+  const expected = process.env.CAMPFIRE_INTERNAL_AGENT_MCP_TOKEN;
+  if (!expected) return false;
+  const header = c.req.header("Authorization") || "";
+  return header === `Bearer ${expected}`;
+}
+
+export function registerAgentMcpRoutes(api: Hono, deps: RouteDeps): void {
+  api.get("/internal/agent-mcp/tools", (c) => {
+    if (!isInternalAuthorized(c)) return c.json({ error: "Unauthorized" }, 401);
+    return c.json({ tools: generateAgentToolDefinitions() });
+  });
+
+  api.post("/internal/agent-mcp/call", async (c) => {
+    if (!isInternalAuthorized(c)) return c.json({ error: "Unauthorized" }, 401);
+    if (!deps.agentMcpBridge) return c.json({ error: "Agent MCP bridge is not configured" }, 503);
+
+    const body = await c.req.json<{
+      parentSessionId?: string;
+      toolName?: string;
+      input?: Record<string, unknown>;
+    }>().catch(() => ({} as { parentSessionId?: string; toolName?: string; input?: Record<string, unknown> }));
+
+    if (!body.parentSessionId || !body.toolName) {
+      return c.json({ error: "parentSessionId and toolName are required" }, 400);
+    }
+
+    const result = await deps.agentMcpBridge.callTool(body.parentSessionId, body.toolName, body.input ?? {});
+    return c.json(result);
+  });
+}

package/server/routes/agent-routes.ts

@@ -0,0 +1,185 @@
+import type { Hono } from "hono";
+import type { RouteDeps } from "./route-deps.js";
+import * as agentStore from "../agent-store.js";
+
+export function registerAgentRoutes(api: Hono, deps: RouteDeps): void {
+  const { agentExecutor } = deps;
+
+  // ─── List all agents (enriched with runtime state) ──────────────────────
+  api.get("/agents", (c) => {
+    const agents = agentStore.listAgents();
+    const enriched = agents.map((a) => ({
+      ...a,
+      isRunning: agentExecutor?.isRunning(a.id) ?? false,
+      nextRunAt: agentExecutor?.getNextRunTime(a.id)?.getTime() ?? null,
+    }));
+    return c.json(enriched);
+  });
+
+  // ─── Get single agent ───────────────────────────────────────────────────
+  api.get("/agents/:id", (c) => {
+    const agent = agentStore.getAgent(c.req.param("id"));
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    return c.json({
+      ...agent,
+      isRunning: agentExecutor?.isRunning(agent.id) ?? false,
+      nextRunAt: agentExecutor?.getNextRunTime(agent.id)?.getTime() ?? null,
+    });
+  });
+
+  // ─── Create agent ──────────────────────────────────────────────────────
+  api.post("/agents", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const agent = agentStore.createAgent({
+        name: body.name || "",
+        description: body.description || "",
+        icon: body.icon,
+        backendType: body.backendType || "claude",
+        model: body.model || "",
+        permissionMode: body.permissionMode || "bypassPermissions",
+        cwd: body.cwd || "",
+        prompt: body.prompt || "",
+        triggers: body.triggers,
+        envSlug: body.envSlug,
+        env: body.env,
+        mcpServers: body.mcpServers,
+        codexInternetAccess: body.codexInternetAccess,
+        enabled: body.enabled ?? true,
+      });
+      if (agent.enabled && agent.triggers?.schedule?.enabled) {
+        agentExecutor?.scheduleAgent(agent);
+      }
+      return c.json(agent, 201);
+    } catch (e: unknown) {
+      return c.json({ error: e instanceof Error ? e.message : "Unknown error" }, 400);
+    }
+  });
+
+  // ─── Update agent ──────────────────────────────────────────────────────
+  api.put("/agents/:id", async (c) => {
+    const id = c.req.param("id");
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const EDITABLE = [
+        "name", "description", "icon", "backendType", "model", "permissionMode",
+        "cwd", "prompt", "triggers", "envSlug", "env", "mcpServers",
+        "codexInternetAccess", "enabled",
+      ] as const;
+      const allowed: Record<string, unknown> = {};
+      for (const key of EDITABLE) {
+        if (key in body) allowed[key] = body[key];
+      }
+      const agent = agentStore.updateAgent(id, allowed);
+      if (!agent) return c.json({ error: "Agent not found" }, 404);
+
+      // Reschedule if ID changed or schedule updated
+      if (agent.id !== id) agentExecutor?.unscheduleAgent(id);
+      if (agent.enabled && agent.triggers?.schedule?.enabled) {
+        agentExecutor?.scheduleAgent(agent);
+      } else {
+        agentExecutor?.unscheduleAgent(agent.id);
+      }
+      return c.json(agent);
+    } catch (e: unknown) {
+      return c.json({ error: e instanceof Error ? e.message : "Unknown error" }, 400);
+    }
+  });
+
+  // ─── Delete agent ──────────────────────────────────────────────────────
+  api.delete("/agents/:id", (c) => {
+    const id = c.req.param("id");
+    agentExecutor?.unscheduleAgent(id);
+    const deleted = agentStore.deleteAgent(id);
+    if (!deleted) return c.json({ error: "Agent not found" }, 404);
+    return c.json({ ok: true });
+  });
+
+  // ─── Toggle enabled ────────────────────────────────────────────────────
+  api.post("/agents/:id/toggle", (c) => {
+    const id = c.req.param("id");
+    const agent = agentStore.getAgent(id);
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    const updated = agentStore.updateAgent(id, { enabled: !agent.enabled });
+    if (updated?.enabled && updated.triggers?.schedule?.enabled) {
+      agentExecutor?.scheduleAgent(updated);
+    } else {
+      agentExecutor?.unscheduleAgent(id);
+    }
+    return c.json(updated);
+  });
+
+  // ─── Run agent manually ────────────────────────────────────────────────
+  api.post("/agents/:id/run", async (c) => {
+    const id = c.req.param("id");
+    const agent = agentStore.getAgent(id);
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const execution = await agentExecutor?.executeAgent(id, {
+        input: body.input,
+        trigger: "manual",
+        force: true,
+      });
+      return c.json({
+        ok: true,
+        executionId: execution?.executionId,
+        sessionId: execution?.sessionId,
+      });
+    } catch (e: unknown) {
+      return c.json({ error: e instanceof Error ? e.message : "Unknown error" }, 500);
+    }
+  });
+
+  // ─── Execution history ─────────────────────────────────────────────────
+  api.get("/agents/:id/executions", (c) => {
+    const id = c.req.param("id");
+    return c.json(agentStore.listExecutions(id));
+  });
+
+  // ─── Export agent (portable JSON) ──────────────────────────────────────
+  api.get("/agents/:id/export", (c) => {
+    const agent = agentStore.getAgent(c.req.param("id"));
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    const { id: _id, createdAt: _ca, updatedAt: _ua, totalRuns: _tr,
+      consecutiveFailures: _cf, lastRunAt: _lr, lastSessionId: _ls,
+      ...exportData } = agent;
+    return c.json(exportData);
+  });
+
+  // ─── Import agent ──────────────────────────────────────────────────────
+  api.post("/agents/import", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const agent = agentStore.createAgent({
+        ...body,
+        enabled: false,
+      });
+      return c.json(agent, 201);
+    } catch (e: unknown) {
+      return c.json({ error: e instanceof Error ? e.message : "Unknown error" }, 400);
+    }
+  });
+
+  // ─── Webhook trigger ───────────────────────────────────────────────────
+  api.post("/agents/:id/webhook", async (c) => {
+    const id = c.req.param("id");
+    const agent = agentStore.getAgent(id);
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    if (!agent.triggers?.webhook?.enabled) return c.json({ error: "Webhook not enabled" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const execution = await agentExecutor?.executeAgent(id, {
+        input: typeof body.input === "string" ? body.input : JSON.stringify(body),
+        trigger: "webhook",
+      });
+      return c.json({
+        ok: true,
+        executionId: execution?.executionId,
+        sessionId: execution?.sessionId,
+      });
+    } catch (e: unknown) {
+      return c.json({ error: e instanceof Error ? e.message : "Unknown error" }, 500);
+    }
+  });
+}

package/server/routes/auth-routes.ts

@@ -0,0 +1,101 @@
+import type { Hono } from "hono";
+import type { RouteDeps } from "./route-deps.js";
+import {
+  isAuthEnabled,
+  login,
+  logout,
+  verifyToken,
+  getAuthStatus,
+  setPassword,
+  disableAuth,
+} from "../auth.js";
+
+export function registerAuthRoutes(api: Hono, _deps: RouteDeps): void {
+  // Check if auth is enabled and whether the user is logged in
+  api.get("/auth/status", (c) => {
+    const status = getAuthStatus();
+    const token = c.req.header("Authorization")?.replace("Bearer ", "")
+      || c.req.query("token");
+    const isLoggedIn = token ? verifyToken(token) : !status.enabled;
+    return c.json({ ...status, isLoggedIn });
+  });
+
+  // Login with password
+  api.post("/auth/login", async (c) => {
+    const body = await c.req.json<{ password?: string }>().catch(() => ({} as { password?: string }));
+    if (!body.password) {
+      return c.json({ error: "Password is required" }, 400);
+    }
+    const userAgent = c.req.header("User-Agent");
+    const token = login(body.password, userAgent);
+    if (!token) {
+      return c.json({ error: "Invalid password" }, 401);
+    }
+    return c.json({ token });
+  });
+
+  // Logout
+  api.post("/auth/logout", async (c) => {
+    const token = c.req.header("Authorization")?.replace("Bearer ", "");
+    if (token) {
+      logout(token);
+    }
+    return c.json({ ok: true });
+  });
+
+  // Set password (only when no password is set yet, or when authenticated)
+  api.post("/auth/setup", async (c) => {
+    const status = getAuthStatus();
+    // If auth is already enabled, require a valid token
+    if (status.enabled) {
+      const token = c.req.header("Authorization")?.replace("Bearer ", "");
+      if (!token || !verifyToken(token)) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+    }
+
+    const body = await c.req.json<{ password?: string }>().catch(() => ({} as { password?: string }));
+    if (!body.password || body.password.length < 4) {
+      return c.json({ error: "Password must be at least 4 characters" }, 400);
+    }
+    setPassword(body.password);
+    return c.json({ ok: true, ...getAuthStatus() });
+  });
+
+  // Disable auth (requires valid token)
+  api.post("/auth/disable", async (c) => {
+    const token = c.req.header("Authorization")?.replace("Bearer ", "");
+    if (!token || !verifyToken(token)) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+    disableAuth();
+    return c.json({ ok: true });
+  });
+}
+
+/**
+ * Middleware that checks auth for all /api/* routes except /api/auth/*
+ */
+export function authMiddleware() {
+  return async (c: any, next: () => Promise<void>) => {
+    // Always allow auth routes
+    if (c.req.path.startsWith("/api/auth")) {
+      return next();
+    }
+
+    // If auth is not enabled, skip
+    if (!isAuthEnabled()) {
+      return next();
+    }
+
+    // Check token from Authorization header or query param
+    const token = c.req.header("Authorization")?.replace("Bearer ", "")
+      || c.req.query("token");
+
+    if (!token || !verifyToken(token)) {
+      return c.json({ error: "Unauthorized", authRequired: true }, 401);
+    }
+
+    return next();
+  };
+}

package/server/routes/ci-routes.ts

@@ -0,0 +1,165 @@
+import type { Hono } from "hono";
+import type { RouteDeps } from "./route-deps.js";
+import type { BackendType } from "../session-types.js";
+
+export function registerCiRoutes(api: Hono, deps: RouteDeps): void {
+  const { wsBridge } = deps;
+
+  // ─── Collective Intelligence: Semantic Memory ──────────────────────────────
+  api.get("/sessions/:id/memory", async (c) => {
+    const { queryFragments, getConsolidatedKnowledge, getSessionFragments } = await import("../semantic-memory.js");
+    const sessionId = c.req.param("id");
+    const [fragments, consolidated] = await Promise.all([
+      getSessionFragments(sessionId),
+      getConsolidatedKnowledge(""), // cross-session consolidated
+    ]);
+    return c.json({ fragments, consolidated });
+  });
+
+  api.post("/sessions/:id/memory", async (c) => {
+    const { storeFragment } = await import("../semantic-memory.js");
+    const sessionId = c.req.param("id");
+    const body = await c.req.json() as { content: string; type: string; tags?: string[]; gitContext?: Record<string, unknown> };
+    if (!body.content) return c.json({ error: "content is required" }, 400);
+    const fragment = await storeFragment({
+      sessionId,
+      agentId: "human",
+      backendType: "claude",
+      type: (body.type as "observation" | "hypothesis" | "decision" | "pattern") ?? "observation",
+      content: body.content,
+      tags: body.tags ?? [],
+      gitContext: (body.gitContext as unknown as import("../semantic-memory.js").GitContext) ?? { branch: "unknown", files: [], repoRoot: "" },
+    });
+    return c.json({ fragment }, 201);
+  });
+
+  api.get("/sessions/:id/memory/query", async (c) => {
+    const { queryFragments } = await import("../semantic-memory.js");
+    const sessionId = c.req.param("id");
+    const q = c.req.query("q") ?? "";
+    const limit = parseInt(c.req.query("limit") ?? "10", 10);
+    const results = await queryFragments(q, { sessionId, limit });
+    return c.json({ results });
+  });
+
+  api.post("/sessions/:id/memory/consolidate", async (c) => {
+    const { consolidateSession } = await import("../semantic-memory.js");
+    const sessionId = c.req.param("id");
+    const session = wsBridge.getSession(sessionId);
+    const repoRoot = session?.state.cwd ?? "";
+    const consolidated = await consolidateSession(sessionId, repoRoot);
+    return c.json({ consolidated, count: consolidated.length });
+  });
+
+  api.get("/memory/global", async (c) => {
+    const { getConsolidatedKnowledge } = await import("../semantic-memory.js");
+    const tag = c.req.query("tag");
+    const knowledge = await getConsolidatedKnowledge("", tag);
+    return c.json({ knowledge });
+  });
+
+  // ─── Collective Intelligence: Deliberation ─────────────────────────────────
+  api.get("/sessions/:id/deliberations", (c) => {
+    const { deliberationEngine } = require("../deliberation-engine.js") as typeof import("../deliberation-engine.js");
+    const sessionId = c.req.param("id");
+    const active = deliberationEngine.getActiveProposals(sessionId);
+    return c.json({ active, resolved: [] });
+  });
+
+  api.get("/sessions/:id/deliberations/:proposalId", (c) => {
+    const { deliberationEngine } = require("../deliberation-engine.js") as typeof import("../deliberation-engine.js");
+    const proposalId = c.req.param("proposalId");
+    const proposal = deliberationEngine.getProposal(proposalId);
+    if (!proposal) return c.json({ error: "Not found" }, 404);
+    const responses = deliberationEngine.getResponses(proposalId);
+    return c.json({ proposal, responses });
+  });
+
+  api.post("/sessions/:id/deliberations/:proposalId/respond", async (c) => {
+    const { deliberationEngine } = await import("../deliberation-engine.js");
+    const proposalId = c.req.param("proposalId");
+    const body = await c.req.json() as { stance: string; reasoning: string; suggestedAlternative?: string; concerns?: string[] };
+    const response = deliberationEngine.addResponse({
+      proposalId,
+      responderId: "human",
+      responderType: "human",
+      timestamp: Date.now(),
+      stance: body.stance as "agree" | "disagree" | "suggest_alternative" | "abstain",
+      reasoning: body.reasoning,
+      suggestedAlternative: body.suggestedAlternative,
+      concerns: body.concerns,
+    });
+    if (!response) return c.json({ error: "Proposal not found or already resolved" }, 404);
+    return c.json({ response });
+  });
+
+  api.post("/sessions/:id/deliberations/:proposalId/resolve", async (c) => {
+    const { deliberationEngine } = await import("../deliberation-engine.js");
+    const proposalId = c.req.param("proposalId");
+    const resolution = deliberationEngine.resolveById(proposalId);
+    if (!resolution) return c.json({ error: "Proposal not found or already resolved" }, 404);
+    return c.json({ resolution });
+  });
+
+  // ─── Collective Intelligence: Capability Routing ───────────────────────────
+  api.post("/sessions/route-task", async (c) => {
+    const { capabilityDiscovery } = await import("../capability-discovery.js");
+    const body = await c.req.json() as { taskDescription: string; availableSessions?: string[]; constraints?: Record<string, unknown> };
+    if (!body.taskDescription) return c.json({ error: "taskDescription is required" }, 400);
+    const available = body.availableSessions ?? wsBridge.getConnectedSessionIds();
+    const result = await capabilityDiscovery.route({
+      taskDescription: body.taskDescription,
+      availableSessions: available,
+      constraints: body.constraints as Record<string, unknown>,
+    });
+    return c.json(result);
+  });
+
+  api.get("/capabilities", async (c) => {
+    const { capabilityDiscovery } = await import("../capability-discovery.js");
+    return c.json({ sessions: capabilityDiscovery.getAllCapabilities() });
+  });
+
+  api.get("/capabilities/history", async (c) => {
+    const { capabilityDiscovery } = await import("../capability-discovery.js");
+    const backendType = c.req.query("backendType") as BackendType | undefined;
+    const taskType = c.req.query("taskType");
+    const executions = capabilityDiscovery.getExecutionHistory({ backendType, taskType });
+    const total = executions.length;
+    const successes = executions.filter((e) => e.outcome === "success").length;
+    return c.json({ executions, successRate: total > 0 ? successes / total : 0, total });
+  });
+
+  api.post("/capabilities/feedback", async (c) => {
+    const { capabilityDiscovery } = await import("../capability-discovery.js");
+    const body = await c.req.json() as { sessionId: string; taskId: string; feedback: "positive" | "negative" | "neutral"; backendType?: string; taskDescription?: string };
+    capabilityDiscovery.recordFeedback(body.taskId, body.sessionId, (body.backendType as BackendType) ?? "claude", body.taskDescription ?? "", body.feedback);
+    return c.json({ ok: true });
+  });
+
+  // ─── Collective Intelligence: Shared Context ───────────────────────────────
+  api.get("/sessions/:id/context/stream", (c) => {
+    const { sharedContextManager } = require("../shared-context.js") as typeof import("../shared-context.js");
+    const sessionId = c.req.param("id");
+    const stream = sharedContextManager.get(sessionId);
+    return c.json({ fragments: stream?.getAllFragments() ?? [] });
+  });
+
+  api.get("/sessions/:id/context/consensus", (c) => {
+    const { sharedContextManager } = require("../shared-context.js") as typeof import("../shared-context.js");
+    const sessionId = c.req.param("id");
+    const stream = sharedContextManager.get(sessionId);
+    if (!stream) return c.json({ error: "No active context stream for this session" }, 404);
+    return c.json(stream.getConsensusState());
+  });
+
+  api.get("/sessions/:id/context/thread/:fragmentId", (c) => {
+    const { sharedContextManager } = require("../shared-context.js") as typeof import("../shared-context.js");
+    const sessionId = c.req.param("id");
+    const fragmentId = c.req.param("fragmentId");
+    const stream = sharedContextManager.get(sessionId);
+    if (!stream) return c.json({ error: "No active context stream for this session" }, 404);
+    const thread = stream.getThread(fragmentId);
+    return c.json({ thread });
+  });
+}