triflux 3.2.0-dev.9 → 3.3.0-dev.3

package/hub/server.mjs

@@ -14,6 +14,15 @@ import { createRouter } from './router.mjs';
 import { createHitlManager } from './hitl.mjs';
 import { createPipeServer } from './pipe.mjs';
 import { createTools } from './tools.mjs';
+import {
+  ensurePipelineTable,
+  createPipeline,
+} from './pipeline/index.mjs';
+import {
+  readPipelineState,
+  initPipelineState,
+  listPipelineStates,
+} from './pipeline/state.mjs';
 import {
   teamInfo,
   teamTaskList,
@@ -43,6 +52,14 @@ async function parseBody(req) {
 
 const PID_DIR = join(homedir(), '.claude', 'cache', 'tfx-hub');
 const PID_FILE = join(PID_DIR, 'hub.pid');
+const TOKEN_FILE = join(homedir(), '.claude', '.tfx-hub-token');
+
+// localhost 계열 Origin만 허용
+const ALLOWED_ORIGIN_RE = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/;
+
+function isAllowedOrigin(origin) {
+  return origin && ALLOWED_ORIGIN_RE.test(origin);
+}
 
 /**
  * tfx-hub 시작
@@ -57,6 +74,11 @@ export async function startHub({ port = 27888, dbPath, host = '127.0.0.1', sessi
     dbPath = join(PID_DIR, 'state.db');
   }
 
+  // 인증 토큰 생성 (환경변수 우선, 없으면 자동 생성)
+  const HUB_TOKEN = process.env.TFX_HUB_TOKEN || randomUUID();
+  mkdirSync(join(homedir(), '.claude'), { recursive: true });
+  writeFileSync(TOKEN_FILE, HUB_TOKEN, { mode: 0o600 });
+
   const store = createStore(dbPath);
   const router = createRouter(store);
   const pipe = createPipeServer({ router, store, sessionId });
@@ -100,12 +122,16 @@ export async function startHub({ port = 27888, dbPath, host = '127.0.0.1', sessi
   }
 
   const httpServer = createHttpServer(async (req, res) => {
-    res.setHeader('Access-Control-Allow-Origin', '*');
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, mcp-session-id, Last-Event-ID');
+    // CORS: localhost 계열 Origin만 허용
+    const origin = req.headers['origin'];
+    if (isAllowedOrigin(origin)) {
+      res.setHeader('Access-Control-Allow-Origin', origin);
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, mcp-session-id, Last-Event-ID');
+    }
 
     if (req.method === 'OPTIONS') {
-      res.writeHead(204);
+      res.writeHead(isAllowedOrigin(origin) ? 204 : 403);
       return res.end();
     }
 
@@ -132,6 +158,14 @@ export async function startHub({ port = 27888, dbPath, host = '127.0.0.1', sessi
     if (req.url.startsWith('/bridge')) {
       res.setHeader('Content-Type', 'application/json');
 
+      // Bearer 토큰 인증
+      const authHeader = req.headers['authorization'] || '';
+      const bearerToken = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
+      if (bearerToken !== HUB_TOKEN) {
+        res.writeHead(401);
+        return res.end(JSON.stringify({ ok: false, error: 'Unauthorized' }));
+      }
+
       if (req.method !== 'POST' && req.method !== 'DELETE') {
         res.writeHead(405);
         return res.end(JSON.stringify({ ok: false, error: 'Method Not Allowed' }));
@@ -211,16 +245,111 @@ export async function startHub({ port = 27888, dbPath, host = '127.0.0.1', sessi
           return res.end(JSON.stringify(result));
         }
 
+        if (path === '/bridge/assign/async' && req.method === 'POST') {
+          const {
+            supervisor_agent,
+            worker_agent,
+            task,
+            topic = 'assign.job',
+            payload = {},
+            priority = 5,
+            ttl_ms = 600000,
+            timeout_ms = 600000,
+            max_retries = 0,
+            trace_id,
+            correlation_id,
+          } = body;
+
+          if (!supervisor_agent || !worker_agent || !task) {
+            res.writeHead(400);
+            return res.end(JSON.stringify({ ok: false, error: 'supervisor_agent, worker_agent, task 필수' }));
+          }
+
+          const result = await pipe.executeCommand('assign', {
+            supervisor_agent,
+            worker_agent,
+            task,
+            topic,
+            payload,
+            priority,
+            ttl_ms,
+            timeout_ms,
+            max_retries,
+            trace_id,
+            correlation_id,
+          });
+          res.writeHead(result.ok ? 200 : 400);
+          return res.end(JSON.stringify(result));
+        }
+
+        if (path === '/bridge/assign/result' && req.method === 'POST') {
+          const {
+            job_id,
+            worker_agent,
+            status,
+            attempt,
+            result: assignResult,
+            error: assignError,
+            payload = {},
+            metadata = {},
+          } = body;
+
+          if (!job_id || !status) {
+            res.writeHead(400);
+            return res.end(JSON.stringify({ ok: false, error: 'job_id, status 필수' }));
+          }
+
+          const result = await pipe.executeCommand('assign_result', {
+            job_id,
+            worker_agent,
+            status,
+            attempt,
+            result: assignResult,
+            error: assignError,
+            payload,
+            metadata,
+          });
+          res.writeHead(result.ok ? 200 : 409);
+          return res.end(JSON.stringify(result));
+        }
+
+        if (path === '/bridge/assign/status' && req.method === 'POST') {
+          const result = await pipe.executeQuery('assign_status', body);
+          const statusCode = result.ok ? 200 : (result.error?.code === 'ASSIGN_NOT_FOUND' ? 404 : 400);
+          res.writeHead(statusCode);
+          return res.end(JSON.stringify(result));
+        }
+
+        if (path === '/bridge/assign/retry' && req.method === 'POST') {
+          const { job_id, reason, requested_by } = body;
+          if (!job_id) {
+            res.writeHead(400);
+            return res.end(JSON.stringify({ ok: false, error: 'job_id 필수' }));
+          }
+
+          const result = await pipe.executeCommand('assign_retry', {
+            job_id,
+            reason,
+            requested_by,
+          });
+          const statusCode = result.ok ? 200
+            : result.error?.code === 'ASSIGN_NOT_FOUND' ? 404
+              : result.error?.code === 'ASSIGN_RETRY_EXHAUSTED' ? 409
+                : 400;
+          res.writeHead(statusCode);
+          return res.end(JSON.stringify(result));
+        }
+
         if (req.method === 'POST') {
           let teamResult = null;
           if (path === '/bridge/team/info' || path === '/bridge/team-info') {
-            teamResult = teamInfo(body);
+            teamResult = await teamInfo(body);
           } else if (path === '/bridge/team/task-list' || path === '/bridge/team-task-list') {
-            teamResult = teamTaskList(body);
+            teamResult = await teamTaskList(body);
           } else if (path === '/bridge/team/task-update' || path === '/bridge/team-task-update') {
-            teamResult = teamTaskUpdate(body);
+            teamResult = await teamTaskUpdate(body);
           } else if (path === '/bridge/team/send-message' || path === '/bridge/team-send-message') {
-            teamResult = teamSendMessage(body);
+            teamResult = await teamSendMessage(body);
           }
 
           if (teamResult) {
@@ -240,6 +369,41 @@ export async function startHub({ port = 27888, dbPath, host = '127.0.0.1', sessi
             res.writeHead(404);
             return res.end(JSON.stringify({ ok: false, error: `Unknown team endpoint: ${path}` }));
           }
+
+          // ── 파이프라인 엔드포인트 ──
+          if (path === '/bridge/pipeline/state' && req.method === 'POST') {
+            ensurePipelineTable(store.db);
+            const { team_name } = body;
+            const state = readPipelineState(store.db, team_name);
+            res.writeHead(state ? 200 : 404);
+            return res.end(JSON.stringify(state
+              ? { ok: true, data: state }
+              : { ok: false, error: 'pipeline_not_found' }));
+          }
+
+          if (path === '/bridge/pipeline/advance' && req.method === 'POST') {
+            ensurePipelineTable(store.db);
+            const { team_name, phase } = body;
+            const pipeline = createPipeline(store.db, team_name);
+            const result = pipeline.advance(phase);
+            res.writeHead(result.ok ? 200 : 400);
+            return res.end(JSON.stringify(result));
+          }
+
+          if (path === '/bridge/pipeline/init' && req.method === 'POST') {
+            ensurePipelineTable(store.db);
+            const { team_name, fix_max, ralph_max } = body;
+            const state = initPipelineState(store.db, team_name, { fix_max, ralph_max });
+            res.writeHead(200);
+            return res.end(JSON.stringify({ ok: true, data: state }));
+          }
+
+          if (path === '/bridge/pipeline/list' && req.method === 'POST') {
+            ensurePipelineTable(store.db);
+            const states = listPipelineStates(store.db);
+            res.writeHead(200);
+            return res.end(JSON.stringify({ ok: true, data: states }));
+          }
         }
 
         if (path === '/bridge/context' && req.method === 'POST') {
@@ -408,6 +572,7 @@ export async function startHub({ port = 27888, dbPath, host = '127.0.0.1', sessi
         await pipe.stop();
         store.close();
         try { unlinkSync(PID_FILE); } catch {}
+        try { unlinkSync(TOKEN_FILE); } catch {}
         await new Promise((resolveClose) => httpServer.close(resolveClose));
       };
 

package/hub/store.mjs

@@ -80,6 +80,17 @@ function parseHumanRequestRow(row) {
   };
 }
 
+function parseAssignRow(row) {
+  if (!row) return null;
+  const { payload_json, result_json, error_json, ...rest } = row;
+  return {
+    ...rest,
+    payload: parseJson(payload_json, {}),
+    result: parseJson(result_json, null),
+    error: parseJson(error_json, null),
+  };
+}
+
 /**
  * 저장소 생성
  * @param {string} dbPath
@@ -96,7 +107,7 @@ export function createStore(dbPath) {
 
   const schemaSQL = readFileSync(join(__dirname, 'schema.sql'), 'utf8');
   db.exec("CREATE TABLE IF NOT EXISTS _meta (key TEXT PRIMARY KEY, value TEXT)");
-  const SCHEMA_VERSION = '1';
+  const SCHEMA_VERSION = '2';
   const curVer = (() => {
     try { return db.prepare("SELECT value FROM _meta WHERE key='schema_version'").pluck().get(); }
     catch { return null; }
@@ -162,6 +173,45 @@ export function createStore(dbPath) {
     insertDL: db.prepare('INSERT OR REPLACE INTO dead_letters (message_id, reason, failed_at_ms, last_error) VALUES (?,?,?,?)'),
     getDL: db.prepare('SELECT * FROM dead_letters ORDER BY failed_at_ms DESC LIMIT ?'),
 
+    insertAssign: db.prepare(`
+      INSERT INTO assign_jobs (
+        job_id, supervisor_agent, worker_agent, topic, task, payload_json,
+        status, attempt, retry_count, max_retries, priority, ttl_ms, timeout_ms, deadline_ms,
+        trace_id, correlation_id, last_message_id, result_json, error_json,
+        created_at_ms, updated_at_ms, started_at_ms, completed_at_ms, last_retry_at_ms
+      ) VALUES (
+        @job_id, @supervisor_agent, @worker_agent, @topic, @task, @payload_json,
+        @status, @attempt, @retry_count, @max_retries, @priority, @ttl_ms, @timeout_ms, @deadline_ms,
+        @trace_id, @correlation_id, @last_message_id, @result_json, @error_json,
+        @created_at_ms, @updated_at_ms, @started_at_ms, @completed_at_ms, @last_retry_at_ms
+      )`),
+    getAssign: db.prepare('SELECT * FROM assign_jobs WHERE job_id = ?'),
+    updateAssign: db.prepare(`
+      UPDATE assign_jobs SET
+        supervisor_agent=@supervisor_agent,
+        worker_agent=@worker_agent,
+        topic=@topic,
+        task=@task,
+        payload_json=@payload_json,
+        status=@status,
+        attempt=@attempt,
+        retry_count=@retry_count,
+        max_retries=@max_retries,
+        priority=@priority,
+        ttl_ms=@ttl_ms,
+        timeout_ms=@timeout_ms,
+        deadline_ms=@deadline_ms,
+        trace_id=@trace_id,
+        correlation_id=@correlation_id,
+        last_message_id=@last_message_id,
+        result_json=@result_json,
+        error_json=@error_json,
+        updated_at_ms=@updated_at_ms,
+        started_at_ms=@started_at_ms,
+        completed_at_ms=@completed_at_ms,
+        last_retry_at_ms=@last_retry_at_ms
+      WHERE job_id=@job_id`),
+
     findExpired: db.prepare("SELECT id FROM messages WHERE status='queued' AND expires_at_ms < ?"),
     urgentDepth: db.prepare("SELECT COUNT(*) as cnt FROM messages WHERE status='queued' AND priority >= 7"),
     normalDepth: db.prepare("SELECT COUNT(*) as cnt FROM messages WHERE status='queued' AND priority < 7"),
@@ -169,6 +219,8 @@ export function createStore(dbPath) {
     msgCount: db.prepare('SELECT COUNT(*) as cnt FROM messages'),
     dlqDepth: db.prepare('SELECT COUNT(*) as cnt FROM dead_letters'),
     ackedRecent: db.prepare("SELECT COUNT(*) as cnt FROM messages WHERE status='acked' AND created_at_ms > ? - 300000"),
+    assignCountByStatus: db.prepare('SELECT COUNT(*) as cnt FROM assign_jobs WHERE status = ?'),
+    activeAssignCount: db.prepare("SELECT COUNT(*) as cnt FROM assign_jobs WHERE status IN ('queued','running')"),
   };
 
   function clampMaxMessages(value, fallback = 20) {
@@ -177,6 +229,18 @@ export function createStore(dbPath) {
     return Math.max(1, Math.min(Math.trunc(num), 100));
   }
 
+  function clampPriority(value, fallback = 5) {
+    const num = Number(value);
+    if (!Number.isFinite(num)) return fallback;
+    return Math.max(1, Math.min(Math.trunc(num), 9));
+  }
+
+  function clampDuration(value, fallback = 600000, min = 1000, max = 86400000) {
+    const num = Number(value);
+    if (!Number.isFinite(num)) return fallback;
+    return Math.max(min, Math.min(Math.trunc(num), max));
+  }
+
   const store = {
     db,
     uuidv7,
@@ -365,6 +429,195 @@ export function createStore(dbPath) {
       return S.getDL.all(limit);
     },
 
+    createAssign({
+      job_id,
+      supervisor_agent,
+      worker_agent,
+      topic = 'assign.job',
+      task = '',
+      payload = {},
+      status = 'queued',
+      attempt = 1,
+      retry_count = 0,
+      max_retries = 0,
+      priority = 5,
+      ttl_ms = 600000,
+      timeout_ms = 600000,
+      deadline_ms,
+      trace_id,
+      correlation_id,
+      last_message_id = null,
+      result = null,
+      error = null,
+    }) {
+      const now = Date.now();
+      const normalizedTimeout = clampDuration(timeout_ms, 600000);
+      const row = {
+        job_id: job_id || uuidv7(),
+        supervisor_agent,
+        worker_agent,
+        topic: String(topic || 'assign.job'),
+        task: String(task || ''),
+        payload_json: JSON.stringify(payload || {}),
+        status,
+        attempt: Math.max(1, Number(attempt) || 1),
+        retry_count: Math.max(0, Number(retry_count) || 0),
+        max_retries: Math.max(0, Number(max_retries) || 0),
+        priority: clampPriority(priority, 5),
+        ttl_ms: clampDuration(ttl_ms, normalizedTimeout),
+        timeout_ms: normalizedTimeout,
+        deadline_ms: Number.isFinite(Number(deadline_ms))
+          ? Math.trunc(Number(deadline_ms))
+          : now + normalizedTimeout,
+        trace_id: trace_id || uuidv7(),
+        correlation_id: correlation_id || uuidv7(),
+        last_message_id,
+        result_json: result == null ? null : JSON.stringify(result),
+        error_json: error == null ? null : JSON.stringify(error),
+        created_at_ms: now,
+        updated_at_ms: now,
+        started_at_ms: status === 'running' ? now : null,
+        completed_at_ms: ['succeeded', 'failed', 'timed_out'].includes(status) ? now : null,
+        last_retry_at_ms: retry_count > 0 ? now : null,
+      };
+      S.insertAssign.run(row);
+      return store.getAssign(row.job_id);
+    },
+
+    getAssign(jobId) {
+      return parseAssignRow(S.getAssign.get(jobId));
+    },
+
+    updateAssignStatus(jobId, status, patch = {}) {
+      const current = store.getAssign(jobId);
+      if (!current) return null;
+
+      const now = Date.now();
+      const nextStatus = status || current.status;
+      const isTerminal = ['succeeded', 'failed', 'timed_out'].includes(nextStatus);
+      const nextTimeout = clampDuration(patch.timeout_ms ?? current.timeout_ms, current.timeout_ms);
+      const nextRow = {
+        job_id: current.job_id,
+        supervisor_agent: patch.supervisor_agent ?? current.supervisor_agent,
+        worker_agent: patch.worker_agent ?? current.worker_agent,
+        topic: patch.topic ?? current.topic,
+        task: patch.task ?? current.task,
+        payload_json: JSON.stringify(patch.payload ?? current.payload ?? {}),
+        status: nextStatus,
+        attempt: Math.max(1, Number(patch.attempt ?? current.attempt) || current.attempt || 1),
+        retry_count: Math.max(0, Number(patch.retry_count ?? current.retry_count) || 0),
+        max_retries: Math.max(0, Number(patch.max_retries ?? current.max_retries) || 0),
+        priority: clampPriority(patch.priority ?? current.priority, current.priority || 5),
+        ttl_ms: clampDuration(patch.ttl_ms ?? current.ttl_ms, current.ttl_ms || nextTimeout),
+        timeout_ms: nextTimeout,
+        deadline_ms: (() => {
+          if (Object.prototype.hasOwnProperty.call(patch, 'deadline_ms')) {
+            return patch.deadline_ms == null ? null : Math.trunc(Number(patch.deadline_ms));
+          }
+          if (isTerminal) return null;
+          if (nextStatus === 'running' && !current.deadline_ms) return now + nextTimeout;
+          return current.deadline_ms;
+        })(),
+        trace_id: patch.trace_id ?? current.trace_id,
+        correlation_id: patch.correlation_id ?? current.correlation_id,
+        last_message_id: Object.prototype.hasOwnProperty.call(patch, 'last_message_id')
+          ? patch.last_message_id
+          : current.last_message_id,
+        result_json: Object.prototype.hasOwnProperty.call(patch, 'result')
+          ? (patch.result == null ? null : JSON.stringify(patch.result))
+          : (current.result == null ? null : JSON.stringify(current.result)),
+        error_json: Object.prototype.hasOwnProperty.call(patch, 'error')
+          ? (patch.error == null ? null : JSON.stringify(patch.error))
+          : (current.error == null ? null : JSON.stringify(current.error)),
+        updated_at_ms: now,
+        started_at_ms: Object.prototype.hasOwnProperty.call(patch, 'started_at_ms')
+          ? patch.started_at_ms
+          : (nextStatus === 'running' ? (current.started_at_ms || now) : current.started_at_ms),
+        completed_at_ms: Object.prototype.hasOwnProperty.call(patch, 'completed_at_ms')
+          ? patch.completed_at_ms
+          : (isTerminal ? (current.completed_at_ms || now) : current.completed_at_ms),
+        last_retry_at_ms: Object.prototype.hasOwnProperty.call(patch, 'last_retry_at_ms')
+          ? patch.last_retry_at_ms
+          : current.last_retry_at_ms,
+      };
+      S.updateAssign.run(nextRow);
+      return store.getAssign(jobId);
+    },
+
+    listAssigns({
+      supervisor_agent,
+      worker_agent,
+      status,
+      statuses,
+      trace_id,
+      correlation_id,
+      active_before_ms,
+      limit = 50,
+    } = {}) {
+      const clauses = [];
+      const values = [];
+
+      if (supervisor_agent) {
+        clauses.push('supervisor_agent = ?');
+        values.push(supervisor_agent);
+      }
+      if (worker_agent) {
+        clauses.push('worker_agent = ?');
+        values.push(worker_agent);
+      }
+      if (trace_id) {
+        clauses.push('trace_id = ?');
+        values.push(trace_id);
+      }
+      if (correlation_id) {
+        clauses.push('correlation_id = ?');
+        values.push(correlation_id);
+      }
+
+      const statusList = Array.isArray(statuses) && statuses.length
+        ? statuses
+        : (status ? [status] : []);
+      if (statusList.length) {
+        clauses.push(`status IN (${statusList.map(() => '?').join(',')})`);
+        values.push(...statusList);
+      }
+
+      if (Number.isFinite(Number(active_before_ms))) {
+        clauses.push('deadline_ms IS NOT NULL AND deadline_ms <= ?');
+        values.push(Math.trunc(Number(active_before_ms)));
+      }
+
+      const sql = `
+        SELECT * FROM assign_jobs
+        ${clauses.length ? `WHERE ${clauses.join(' AND ')}` : ''}
+        ORDER BY updated_at_ms DESC
+        LIMIT ?`;
+      values.push(clampMaxMessages(limit, 50));
+      return db.prepare(sql).all(...values).map(parseAssignRow);
+    },
+
+    retryAssign(jobId, patch = {}) {
+      const current = store.getAssign(jobId);
+      if (!current) return null;
+
+      const nextRetryCount = Math.max(0, Number(patch.retry_count ?? current.retry_count + 1) || 0);
+      const nextAttempt = Math.max(current.attempt + 1, Number(patch.attempt ?? current.attempt + 1) || 1);
+      const nextTimeout = clampDuration(patch.timeout_ms ?? current.timeout_ms, current.timeout_ms);
+      return store.updateAssignStatus(jobId, 'queued', {
+        retry_count: nextRetryCount,
+        attempt: nextAttempt,
+        timeout_ms: nextTimeout,
+        ttl_ms: patch.ttl_ms ?? current.ttl_ms,
+        deadline_ms: Date.now() + nextTimeout,
+        completed_at_ms: null,
+        started_at_ms: null,
+        last_retry_at_ms: Date.now(),
+        result: patch.result ?? null,
+        error: Object.prototype.hasOwnProperty.call(patch, 'error') ? patch.error : current.error,
+        last_message_id: null,
+      });
+    },
+
     sweepExpired() {
       const now = Date.now();
       return db.transaction(() => {
@@ -397,6 +650,7 @@ export function createStore(dbPath) {
       return {
         online_agents: S.onlineCount.get().cnt,
         total_messages: S.msgCount.get().cnt,
+        active_assign_jobs: S.activeAssignCount.get().cnt,
         ...store.getQueueDepths(),
       };
     },
@@ -406,6 +660,10 @@ export function createStore(dbPath) {
         online_agents: S.onlineCount.get().cnt,
         total_messages: S.msgCount.get().cnt,
         dlq: S.dlqDepth.get().cnt,
+        assign_queued: S.assignCountByStatus.get('queued').cnt,
+        assign_running: S.assignCountByStatus.get('running').cnt,
+        assign_failed: S.assignCountByStatus.get('failed').cnt,
+        assign_timed_out: S.assignCountByStatus.get('timed_out').cnt,
       };
     },
   };