veryfront 0.1.64 → 0.1.67

package/src/src/internal-agents/session-manager.ts

@@ -0,0 +1,358 @@
+import * as dntShim from "../../_dnt.shims.js";
+function stableJsonStringify(value: unknown, depth = 0): string {
+  if (depth > 64) {
+    return JSON.stringify(value);
+  }
+
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableJsonStringify(item, depth + 1)).join(",")}]`;
+  }
+
+  const entries = Object.entries(value as Record<string, unknown>)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, item]) => `${JSON.stringify(key)}:${stableJsonStringify(item, depth + 1)}`);
+
+  return `{${entries.join(",")}}`;
+}
+
+function createToolResultKey(result: unknown, isError: boolean): string {
+  return `${isError ? "1" : "0"}:${stableJsonStringify(result)}`;
+}
+
+export class AgentRunCancelledError extends Error {
+  constructor(message = "Run cancelled") {
+    super(message);
+    this.name = "AgentRunCancelledError";
+  }
+}
+
+export class AgentRunAlreadyExistsError extends Error {
+  constructor(runId: string) {
+    super(`Run "${runId}" is already active`);
+    this.name = "AgentRunAlreadyExistsError";
+  }
+}
+
+export class RunNotActiveError extends Error {
+  constructor(runId: string) {
+    super(`Run "${runId}" is not active`);
+    this.name = "RunNotActiveError";
+  }
+}
+
+export class ToolResultNotWaitingError extends Error {
+  constructor(runId: string, toolCallId: string) {
+    super(`Run "${runId}" is not waiting for tool call "${toolCallId}"`);
+    this.name = "ToolResultNotWaitingError";
+  }
+}
+
+export class ToolResultConflictError extends Error {
+  constructor(runId: string, toolCallId: string) {
+    super(`Conflicting tool result for run "${runId}" and tool call "${toolCallId}"`);
+    this.name = "ToolResultConflictError";
+  }
+}
+
+const DEFAULT_WAITING_FOR_TOOL_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_SESSION_TTL_MS = 15 * 60 * 1000;
+const DEFAULT_MAX_CONCURRENT_SESSIONS = 100;
+
+type SessionStatus = "running" | "waiting" | "completed" | "cancelled" | "failed";
+
+interface SubmittedToolResult {
+  toolCallId: string;
+  result: unknown;
+  isError: boolean;
+  key: string;
+}
+
+interface WaitingToolState {
+  toolCallId: string;
+  resolve: (value: SubmittedToolResult) => void;
+  reject: (reason?: unknown) => void;
+}
+
+interface AgentRunSession {
+  runId: string;
+  threadId: string;
+  status: SessionStatus;
+  abortController: AbortController;
+  waitingTool: WaitingToolState | null;
+  submittedResults: Map<string, SubmittedToolResult>;
+  waitingTimeoutId: number | null;
+  sessionTimeoutId: number | null;
+}
+
+export interface SubmitToolResultOutcome {
+  accepted: true;
+  duplicate?: true;
+}
+
+export class AgentRunSessionManager {
+  private readonly sessions = new Map<string, AgentRunSession>();
+
+  constructor(
+    private readonly options: {
+      waitingForToolTtlMs?: number;
+      sessionTtlMs?: number | null;
+      maxConcurrentSessions?: number;
+      setTimeoutFn?: typeof dntShim.setTimeout;
+      clearTimeoutFn?: typeof clearTimeout;
+    } = {},
+  ) {}
+
+  private get waitingForToolTtlMs(): number {
+    return this.options.waitingForToolTtlMs ?? DEFAULT_WAITING_FOR_TOOL_TTL_MS;
+  }
+
+  private get sessionTtlMs(): number | null {
+    return this.options.sessionTtlMs ?? null;
+  }
+
+  private get setTimeoutFn(): typeof dntShim.setTimeout {
+    return this.options.setTimeoutFn ?? dntShim.dntGlobalThis.setTimeout.bind(dntShim.dntGlobalThis);
+  }
+
+  private get clearTimeoutFn(): typeof clearTimeout {
+    return this.options.clearTimeoutFn ?? globalThis.clearTimeout.bind(dntShim.dntGlobalThis);
+  }
+
+  private clearWaitingTimeout(session: AgentRunSession): void {
+    if (session.waitingTimeoutId === null) {
+      return;
+    }
+
+    this.clearTimeoutFn(session.waitingTimeoutId);
+    session.waitingTimeoutId = null;
+  }
+
+  private clearSessionTimeout(session: AgentRunSession): void {
+    if (session.sessionTimeoutId === null) {
+      return;
+    }
+
+    this.clearTimeoutFn(session.sessionTimeoutId);
+    session.sessionTimeoutId = null;
+  }
+
+  private scheduleSessionTimeout(session: AgentRunSession): void {
+    if (this.sessionTtlMs === null) {
+      return;
+    }
+
+    this.clearSessionTimeout(session);
+    session.sessionTimeoutId = this.setTimeoutFn(() => {
+      this.cancelRun(session.runId);
+    }, this.sessionTtlMs) as unknown as number;
+  }
+
+  private scheduleWaitingTimeout(session: AgentRunSession): void {
+    this.clearWaitingTimeout(session);
+    session.waitingTimeoutId = this.setTimeoutFn(() => {
+      this.cancelRun(session.runId);
+    }, this.waitingForToolTtlMs) as unknown as number;
+  }
+
+  private touchSession(session: AgentRunSession): void {
+    if (
+      session.status === "running" || session.status === "waiting"
+    ) {
+      this.scheduleSessionTimeout(session);
+    }
+  }
+
+  private get maxConcurrentSessions(): number {
+    return this.options.maxConcurrentSessions ?? DEFAULT_MAX_CONCURRENT_SESSIONS;
+  }
+
+  startRun(input: { runId: string; threadId: string }): AbortSignal {
+    const existing = this.sessions.get(input.runId);
+    if (existing && (existing.status === "running" || existing.status === "waiting")) {
+      throw new AgentRunAlreadyExistsError(input.runId);
+    }
+
+    if (this.sessions.size >= this.maxConcurrentSessions) {
+      throw new Error(
+        `Maximum concurrent sessions (${this.maxConcurrentSessions}) reached`,
+      );
+    }
+
+    const session: AgentRunSession = {
+      runId: input.runId,
+      threadId: input.threadId,
+      status: "running",
+      abortController: new AbortController(),
+      waitingTool: null,
+      submittedResults: new Map(),
+      waitingTimeoutId: null,
+      sessionTimeoutId: null,
+    };
+
+    this.sessions.set(input.runId, session);
+    this.touchSession(session);
+    return session.abortController.signal;
+  }
+
+  async waitForToolResult(runId: string, toolCallId: string): Promise<{
+    result: unknown;
+    isError: boolean;
+  }> {
+    const session = this.sessions.get(runId);
+    if (!session || session.status === "completed" || session.status === "failed") {
+      throw new RunNotActiveError(runId);
+    }
+
+    if (session.abortController.signal.aborted || session.status === "cancelled") {
+      throw new AgentRunCancelledError();
+    }
+
+    const existingResult = session.submittedResults.get(toolCallId);
+    if (existingResult) {
+      session.status = "running";
+      this.touchSession(session);
+      return { result: existingResult.result, isError: existingResult.isError };
+    }
+
+    if (session.waitingTool && session.waitingTool.toolCallId !== toolCallId) {
+      throw new ToolResultNotWaitingError(runId, toolCallId);
+    }
+
+    session.status = "waiting";
+    this.scheduleWaitingTimeout(session);
+    this.touchSession(session);
+
+    return await new Promise<{ result: unknown; isError: boolean }>((resolve, reject) => {
+      const abortHandler = () => {
+        this.clearWaitingTimeout(session);
+        session.waitingTool = null;
+        session.status = "cancelled";
+        reject(new AgentRunCancelledError());
+      };
+
+      session.abortController.signal.addEventListener("abort", abortHandler, { once: true });
+      session.waitingTool = {
+        toolCallId,
+        resolve: (value) => {
+          session.abortController.signal.removeEventListener("abort", abortHandler);
+          this.clearWaitingTimeout(session);
+          session.waitingTool = null;
+          session.status = "running";
+          this.touchSession(session);
+          resolve({ result: value.result, isError: value.isError });
+        },
+        reject: (reason) => {
+          session.abortController.signal.removeEventListener("abort", abortHandler);
+          this.clearWaitingTimeout(session);
+          session.waitingTool = null;
+          reject(reason);
+        },
+      };
+    });
+  }
+
+  submitToolResult(
+    runId: string,
+    input: { toolCallId: string; result: unknown; isError?: boolean },
+  ): SubmitToolResultOutcome {
+    const session = this.sessions.get(runId);
+    if (!session) {
+      throw new RunNotActiveError(runId);
+    }
+
+    const normalized: SubmittedToolResult = {
+      toolCallId: input.toolCallId,
+      result: input.result,
+      isError: Boolean(input.isError),
+      key: createToolResultKey(input.result, Boolean(input.isError)),
+    };
+
+    const existingResult = session.submittedResults.get(input.toolCallId);
+    if (existingResult) {
+      if (existingResult.key === normalized.key) {
+        return { accepted: true, duplicate: true };
+      }
+
+      throw new ToolResultConflictError(runId, input.toolCallId);
+    }
+
+    if (
+      session.status === "completed" || session.status === "failed" ||
+      session.status === "cancelled"
+    ) {
+      throw new RunNotActiveError(runId);
+    }
+
+    if (!session.waitingTool || session.waitingTool.toolCallId !== input.toolCallId) {
+      throw new ToolResultNotWaitingError(runId, input.toolCallId);
+    }
+
+    session.submittedResults.set(input.toolCallId, normalized);
+    this.touchSession(session);
+    session.waitingTool.resolve(normalized);
+    return { accepted: true };
+  }
+
+  cancelRun(runId: string): boolean {
+    const session = this.sessions.get(runId);
+    if (!session) {
+      return false;
+    }
+
+    if (
+      session.status === "completed" || session.status === "failed" ||
+      session.status === "cancelled"
+    ) {
+      return false;
+    }
+
+    session.status = "cancelled";
+    this.clearWaitingTimeout(session);
+    this.clearSessionTimeout(session);
+    session.abortController.abort(new AgentRunCancelledError());
+    session.waitingTool?.reject(new AgentRunCancelledError());
+    session.waitingTool = null;
+    this.sessions.delete(runId);
+    return true;
+  }
+
+  completeRun(runId: string): void {
+    const session = this.sessions.get(runId);
+    if (!session) return;
+    session.status = "completed";
+    this.clearWaitingTimeout(session);
+    this.clearSessionTimeout(session);
+    session.waitingTool = null;
+    this.sessions.delete(runId);
+  }
+
+  failRun(runId: string): void {
+    const session = this.sessions.get(runId);
+    if (!session) return;
+    session.status = "failed";
+    this.clearWaitingTimeout(session);
+    this.clearSessionTimeout(session);
+    session.waitingTool = null;
+    this.sessions.delete(runId);
+  }
+
+  getRunStatus(runId: string): SessionStatus | null {
+    return this.sessions.get(runId)?.status ?? null;
+  }
+
+  reset(): void {
+    for (const session of this.sessions.values()) {
+      this.clearWaitingTimeout(session);
+      this.clearSessionTimeout(session);
+    }
+    this.sessions.clear();
+  }
+}
+
+export const agentRunSessionManager = new AgentRunSessionManager({
+  sessionTtlMs: DEFAULT_SESSION_TTL_MS,
+});

package/src/src/platform/adapters/runtime/deno/adapter.ts

@@ -17,7 +17,12 @@ import type {
   WebSocketUpgrade,
 } from "../../base.js";
 import { serverLogger } from "../../../../utils/index.js";
-import { getEnvOverlayStorage } from "../../../compat/process.js";
+import {
+  env as getEnvObject,
+  getEnv,
+  getEnvOverlayStorage,
+  setEnv,
+} from "../../../compat/process.js";
 import {
   createFileWatcher,
   createWatcherIterator,
@@ -272,22 +277,15 @@ class DenoFileSystemAdapter implements FileSystemAdapter {
 
 class DenoEnvironmentAdapter implements EnvironmentAdapter {
   get(key: string): string | undefined {
-    if (typeof dntShim.Deno === "undefined" || typeof dntShim.Deno.env === "undefined") return undefined;
-    return dntShim.Deno.env.get(key);
+    return getEnv(key);
   }
 
   set(key: string, value: string): void {
-    if (typeof dntShim.Deno === "undefined" || typeof dntShim.Deno.env === "undefined") {
-      throw NOT_SUPPORTED.create({
-        detail: "DenoEnvironmentAdapter.set() can only be used in Deno runtime",
-      });
-    }
-    dntShim.Deno.env.set(key, value);
+    setEnv(key, value);
   }
 
   toObject(): Record<string, string> {
-    if (typeof dntShim.Deno === "undefined" || typeof dntShim.Deno.env === "undefined") return {};
-    return dntShim.Deno.env.toObject();
+    return getEnvObject();
   }
 }
 

package/src/src/platform/compat/process.ts

@@ -57,10 +57,46 @@ export function chdir(directory: string): void {
   throw new Error("chdir() is not supported in this runtime");
 }
 
+type EnvOverlayValue = string | null;
+type EnvOverlayStore = Map<string, EnvOverlayValue>;
+
+function getEnvOverlayStore(): EnvOverlayStore | null {
+  const storage = getEnvOverlayStorage();
+  const store = storage?.getStore();
+  return store instanceof Map ? store as EnvOverlayStore : null;
+}
+
+function getOverlayEnvValue(
+  store: EnvOverlayStore | null,
+  key: string,
+): { hasValue: boolean; value: string | undefined } {
+  if (!store?.has(key)) {
+    return { hasValue: false, value: undefined };
+  }
+
+  const value = store.get(key);
+  return { hasValue: true, value: value ?? undefined };
+}
+
 export function env(): Record<string, string> {
-  if (IS_DENO) return dntShim.Deno.env.toObject();
-  if (runtimeProcess) return runtimeProcess.env as Record<string, string>;
-  return {};
+  const base = IS_DENO
+    ? dntShim.Deno.env.toObject()
+    : runtimeProcess
+    ? { ...runtimeProcess.env } as Record<string, string>
+    : {};
+
+  const overlay = getEnvOverlayStore();
+  if (!overlay) return base;
+
+  for (const [key, value] of overlay.entries()) {
+    if (value === null) {
+      delete base[key];
+      continue;
+    }
+    base[key] = value;
+  }
+
+  return base;
 }
 
 /**
@@ -68,6 +104,11 @@ export function env(): Record<string, string> {
  * Use this for framework-owned runtime configuration that should not be shadowed by tenant env.
  */
 export function getHostEnv(key: string): string | undefined {
+  const overlayResult = getOverlayEnvValue(getEnvOverlayStore(), key);
+  if (overlayResult.hasValue) {
+    return overlayResult.value;
+  }
+
   if (IS_DENO) return dntShim.Deno.env.get(key);
   if (runtimeProcess) return runtimeProcess.env[key];
   return undefined;
@@ -184,6 +225,12 @@ export function getEnvBoolean(
 }
 
 export function setEnv(key: string, value: string): void {
+  const overlay = getEnvOverlayStore();
+  if (overlay) {
+    overlay.set(key, value);
+    return;
+  }
+
   if (IS_DENO) {
     dntShim.Deno.env.set(key, value);
     return;
@@ -196,6 +243,12 @@ export function setEnv(key: string, value: string): void {
 }
 
 export function deleteEnv(key: string): void {
+  const overlay = getEnvOverlayStore();
+  if (overlay) {
+    overlay.set(key, null);
+    return;
+  }
+
   if (IS_DENO) {
     dntShim.Deno.env.delete(key);
     return;

package/src/src/server/bootstrap.ts

@@ -10,7 +10,7 @@ import { getErrorMessage } from "../errors/veryfront-error.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
 import { enhanceAdapterWithFS } from "../platform/adapters/fs/integration.js";
 import { isExtendedFSAdapter } from "../platform/adapters/fs/wrapper.js";
-import { getEnv } from "../platform/compat/process.js";
+import { getEnv, getHostEnv } from "../platform/compat/process.js";
 import { initializeEsbuild } from "../platform/compat/esbuild.js";
 import { logger } from "../utils/index.js";
 import { isDebugEnabled } from "../utils/constants/env.js";
@@ -256,6 +256,7 @@ export async function bootstrapProd(
 function validateProductionEnvironment(_adapter: RuntimeAdapter): void {
   const nodeEnv = getEnv("NODE_ENV") ?? getEnv("DENO_ENV");
   const proxyMode = getEnv("PROXY_MODE");
+  const controlPlanePublicKey = getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
 
   // In proxy mode (deployed pods), NODE_ENV must be explicitly set to production
   if (proxyMode === "1") {
@@ -276,6 +277,17 @@ function validateProductionEnvironment(_adapter: RuntimeAdapter): void {
         nodeEnv,
       );
     }
+
+    if (!controlPlanePublicKey) {
+      logger.error(
+        "[Bootstrap:Prod] CRITICAL: CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY is not set in proxy mode. " +
+          "Hosted runtimes cannot verify control-plane requests without it.",
+      );
+      throw INVALID_ARGUMENT.create({
+        detail:
+          "CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY must be set when running in proxy mode (PROXY_MODE=1)",
+      });
+    }
   }
 
   // Log effective configuration for debugging

package/src/src/server/handlers/request/agent-run-cancel.handler.ts

@@ -0,0 +1,86 @@
+import * as dntShim from "../../../../_dnt.shims.js";
+import {
+  ControlPlaneRequestError,
+  verifyControlPlaneRequest,
+} from "../../../internal-agents/control-plane-auth.js";
+import {
+  type AgentRunSessionManager,
+  agentRunSessionManager,
+} from "../../../internal-agents/session-manager.js";
+import {
+  INTERNAL_AGENT_CONTROL_PLANE_MAX_BODY_BYTES,
+  InternalAgentRequestBodyTooLargeError,
+  readInternalAgentRequestBody,
+} from "../../../internal-agents/request-body.js";
+import { BaseHandler } from "../response/base.js";
+import type { HandlerContext, HandlerMetadata, HandlerPriority, HandlerResult } from "../types.js";
+import { PRIORITY_MEDIUM_API } from "../../../utils/constants/index.js";
+
+const CANCEL_PATH_REGEX = /^\/internal\/agents\/runs\/([^/]+)$/;
+
+function getRunId(pathname: string): string | null {
+  return CANCEL_PATH_REGEX.exec(pathname)?.[1] ?? null;
+}
+
+export class AgentRunCancelHandler extends BaseHandler {
+  metadata: HandlerMetadata = {
+    name: "AgentRunCancelHandler",
+    priority: PRIORITY_MEDIUM_API as HandlerPriority,
+    patterns: [{ pattern: "/internal/agents/runs/", prefix: true, method: "DELETE" }],
+  };
+
+  constructor(private readonly sessionManager: AgentRunSessionManager = agentRunSessionManager) {
+    super();
+  }
+
+  async handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult> {
+    if (!this.shouldHandle(req, ctx)) {
+      return this.continue();
+    }
+
+    const runId = getRunId(new URL(req.url).pathname);
+    if (!runId) {
+      return this.continue();
+    }
+
+    return this.withProxyContext(ctx, async () => {
+      const builder = this.createResponseBuilder(ctx)
+        .withCORS(req, ctx.securityConfig?.cors)
+        .withSecurity(ctx.securityConfig ?? undefined, req);
+
+      try {
+        const rawBody = await readInternalAgentRequestBody(
+          req,
+          INTERNAL_AGENT_CONTROL_PLANE_MAX_BODY_BYTES,
+        );
+        await verifyControlPlaneRequest(req, ctx, rawBody, {
+          expectedSubject: runId,
+          expectedSurface: "studio",
+        });
+
+        const accepted = this.sessionManager.cancelRun(runId);
+        if (accepted) {
+          return this.respond(builder.json({ accepted: true }, 202));
+        }
+
+        return this.respond(builder.build(null, 204));
+      } catch (error) {
+        if (error instanceof InternalAgentRequestBodyTooLargeError) {
+          return this.respond(builder.json({ error: error.message }, error.status));
+        }
+
+        if (error instanceof ControlPlaneRequestError) {
+          return this.respond(builder.json({ error: error.message }, error.status));
+        }
+
+        this.logWarn("Internal agent run cancel failed", {
+          error: error instanceof Error ? error.message : String(error),
+          runId,
+          projectId: ctx.projectId,
+          projectSlug: ctx.projectSlug,
+        });
+        return this.respond(builder.json({ error: "Internal cancel failed" }, 500));
+      }
+    });
+  }
+}