web-agent-bridge 2.5.0 → 2.7.0

package/server/routes/runtime.js

@@ -19,11 +19,94 @@ const router = express.Router();
 const protocol = require('../protocol');
 const { runtime, bus } = require('../runtime');
 const { logger, tracer, metrics } = require('../observability');
+const { failureAnalyzer } = require('../observability/failure-analysis');
 const { identity, signer, isolation } = require('../security');
 const { agentManager, policyEngine } = require('../control-plane');
 const { executor } = require('../data-plane');
 const { llm } = require('../llm');
 const { commandRegistry, siteRegistry, templateRegistry } = require('../registry');
+const { certificationEngine } = require('../registry/certification');
+const { adapterManager, mcpAdapter, restAdapter, browserAdapter } = require('../adapters');
+const { replayEngine } = require('../runtime/replay');
+const { featureGate, usageLimit } = require('../middleware/featureGate');
+const { listPlans, getPlan, USAGE_PRICING, MARKETPLACE } = require('../config/plans');
+const metering = require('../services/metering');
+const { marketplace } = require('../services/marketplace');
+const { hostedRuntime } = require('../services/hosted-runtime');
+const { sessionEngine } = require('../runtime/session-engine');
+
+// ═══════════════════════════════════════════════════════════════════════════
+// AUTH MIDDLEWARE
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Authenticate requests via API key or session token.
+ * Public endpoints (protocol info, agent registration, health) bypass auth.
+ */
+const PUBLIC_PATHS = [
+  '/protocol',
+  '/agents/register',
+  '/agents/authenticate',
+  '/observability/health',
+  '/llm/models',
+  '/llm/status',
+  '/registry/commands',
+  '/registry/sites',
+  '/registry/templates',
+  '/plans',
+  '/marketplace',
+];
+
+function authMiddleware(req, res, next) {
+  // Allow public GET endpoints
+  const matchesPublic = PUBLIC_PATHS.some(p =>
+    req.path === p || (req.method === 'GET' && req.path.startsWith(p))
+  );
+  if (matchesPublic) return next();
+
+  // Check session token
+  const authHeader = req.headers['authorization'];
+  if (authHeader && authHeader.startsWith('Bearer ')) {
+    const token = authHeader.slice(7);
+    const session = identity.validateSession(token);
+    if (session) {
+      req.agentId = session.agentId;
+      req.session = session;
+      return next();
+    }
+  }
+
+  // Check API key
+  const apiKey = req.headers['x-wab-key'];
+  if (apiKey) {
+    const ip = req.ip || req.connection?.remoteAddress;
+    const session = identity.authenticate(apiKey, ip);
+    if (session) {
+      req.agentId = session.agentId;
+      req.session = session;
+      return next();
+    }
+  }
+
+  // Check agent ID header (for internal/trusted calls)
+  const agentHeader = req.headers['x-wab-agent'];
+  if (agentHeader) {
+    const agent = identity.getAgent(agentHeader);
+    if (agent && agent.status === 'active') {
+      req.agentId = agentHeader;
+      return next();
+    }
+  }
+
+  // No auth on non-mutation GET requests (read-only)
+  if (req.method === 'GET') return next();
+
+  metrics.increment('auth.rejected');
+  return res.status(401).json({ error: 'Authentication required. Provide X-WAB-Key or Authorization: Bearer <token>' });
+}
+
+router.use(authMiddleware);
+router.use(featureGate);
 
 // ═══════════════════════════════════════════════════════════════════════════
 // PROTOCOL ENDPOINTS
@@ -166,7 +249,7 @@ router.delete('/agents/:agentId', (req, res) => {
 /**
  * Submit a task
  */
-router.post('/tasks', (req, res) => {
+router.post('/tasks', usageLimit('tasksPerDay'), (req, res) => {
   try {
     const result = runtime.submitTask(req.body);
     metrics.increment('tasks.submitted', 1, { type: req.body.type });
@@ -224,7 +307,7 @@ router.post('/tasks/:taskId/resume', (req, res) => {
 /**
  * Execute a semantic action
  */
-router.post('/execute', async (req, res) => {
+router.post('/execute', usageLimit('executionsPerDay'), async (req, res) => {
   try {
     const result = await executor.execute(req.body);
     res.json(result);
@@ -443,6 +526,14 @@ router.get('/observability/health', (req, res) => {
   };
   health.executor = executor.getStats();
   health.llm = llm.getStatus();
+  health.adapters = adapterManager.getStats();
+  health.replay = replayEngine.getStats();
+  health.sessions = sessionEngine.getStats();
+  health.failures = failureAnalyzer.getStats();
+  health.certification = certificationEngine.getStats();
+  health.marketplace = marketplace.getStats();
+  health.hostedRuntime = hostedRuntime.getStats();
+  health.metering = metering.getStats();
   res.json(health);
 });
 
@@ -554,7 +645,7 @@ router.get('/registry/templates/:templateId', (req, res) => {
 /**
  * LLM completion
  */
-router.post('/llm/complete', async (req, res) => {
+router.post('/llm/complete', usageLimit('executionsPerDay'), async (req, res) => {
   try {
     const result = await llm.complete(req.body.prompt, req.body.options || req.body);
     metrics.increment('llm.api.requests');
@@ -722,4 +813,634 @@ protocolHandler.handle('wab.commerce.compare', async (payload) => {
   });
 });
 
+// ═══════════════════════════════════════════════════════════════════════════
+// ADAPTERS
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * List adapters
+ */
+router.get('/adapters', (req, res) => {
+  res.json({ adapters: adapterManager.list() });
+});
+
+/**
+ * Adapter stats
+ */
+router.get('/adapters/stats', (req, res) => {
+  res.json(adapterManager.getStats());
+});
+
+/**
+ * MCP: list tools
+ */
+router.get('/adapters/mcp/tools', (req, res) => {
+  const commands = protocol.schema.listCommands();
+  res.json(mcpAdapter.handleListTools(commands));
+});
+
+/**
+ * MCP: call tool
+ */
+router.post('/adapters/mcp/call', async (req, res) => {
+  try {
+    const result = await mcpAdapter.handleCallTool(req.body, async (wapReq) => {
+      const request = protocol.createRequest(wapReq.command, wapReq.payload);
+      return protocolHandler.process(request);
+    });
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+/**
+ * REST adapter: register endpoint
+ */
+router.post('/adapters/rest/endpoints', (req, res) => {
+  try {
+    const endpoint = restAdapter.registerEndpoint(req.body.id, req.body);
+    res.json(endpoint);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * REST adapter: list endpoints
+ */
+router.get('/adapters/rest/endpoints', (req, res) => {
+  res.json({ endpoints: restAdapter.listEndpoints() });
+});
+
+/**
+ * REST adapter: execute
+ */
+router.post('/adapters/rest/execute', async (req, res) => {
+  try {
+    const result = await restAdapter.execute(req.body.endpoint, req.body.params);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+/**
+ * Browser adapter: list semantic mappings
+ */
+router.get('/adapters/browser/mappings', (req, res) => {
+  res.json({ mappings: browserAdapter.listMappings() });
+});
+
+/**
+ * Browser adapter: resolve semantic action
+ */
+router.post('/adapters/browser/resolve', (req, res) => {
+  const { domain, action, params } = req.body;
+  const plan = browserAdapter.fromWAP({ domain, action, params });
+  if (!plan) return res.status(404).json({ error: 'No mapping for this semantic action' });
+  res.json(plan);
+});
+
+/**
+ * Browser adapter: register mapping
+ */
+router.post('/adapters/browser/mappings', (req, res) => {
+  const { domainAction, plan } = req.body;
+  if (!domainAction || !plan) return res.status(400).json({ error: 'domainAction and plan required' });
+  browserAdapter.registerMapping(domainAction, plan);
+  res.json({ success: true });
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// REPLAY ENGINE
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * List recordings
+ */
+router.get('/replay/recordings', (req, res) => {
+  res.json({ recordings: replayEngine.listRecordings(parseInt(req.query.limit) || 50) });
+});
+
+/**
+ * Get recording
+ */
+router.get('/replay/recordings/:taskId', (req, res) => {
+  const rec = replayEngine.getRecording(req.params.taskId);
+  if (!rec) return res.status(404).json({ error: 'Recording not found' });
+  res.json(rec);
+});
+
+/**
+ * Replay a task
+ */
+router.post('/replay/:taskId', async (req, res) => {
+  try {
+    const result = await replayEngine.replay(req.params.taskId, {
+      verify: req.body.verify !== false,
+      continueOnMismatch: !!req.body.continueOnMismatch,
+    });
+    res.json(result);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Diff two recordings
+ */
+router.get('/replay/diff/:taskId1/:taskId2', (req, res) => {
+  const diff = replayEngine.diff(req.params.taskId1, req.params.taskId2);
+  if (!diff) return res.status(404).json({ error: 'One or both recordings not found' });
+  res.json(diff);
+});
+
+/**
+ * Replay stats
+ */
+router.get('/replay/stats', (req, res) => {
+  res.json(replayEngine.getStats());
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// SESSION ENGINE
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Create browser session
+ */
+router.post('/sessions', (req, res) => {
+  const session = sessionEngine.create(req.body);
+  res.json(session);
+});
+
+/**
+ * List sessions
+ */
+router.get('/sessions', (req, res) => {
+  const sessions = sessionEngine.list({
+    agentId: req.query.agentId,
+    siteId: req.query.siteId,
+    state: req.query.state,
+  }, parseInt(req.query.limit) || 50);
+  res.json({ sessions, total: sessions.length });
+});
+
+/**
+ * Get session
+ */
+router.get('/sessions/:sessionId', (req, res) => {
+  const session = sessionEngine.get(req.params.sessionId);
+  if (!session) return res.status(404).json({ error: 'Session not found or expired' });
+  res.json(session);
+});
+
+/**
+ * Export session
+ */
+router.get('/sessions/:sessionId/export', (req, res) => {
+  const data = sessionEngine.export(req.params.sessionId);
+  if (!data) return res.status(404).json({ error: 'Session not found' });
+  res.json(data);
+});
+
+/**
+ * Import session
+ */
+router.post('/sessions/import', (req, res) => {
+  const session = sessionEngine.import(req.body);
+  res.json(session);
+});
+
+/**
+ * Set cookies
+ */
+router.post('/sessions/:sessionId/cookies', (req, res) => {
+  sessionEngine.setCookies(req.params.sessionId, req.body.cookies || []);
+  res.json({ success: true });
+});
+
+/**
+ * Get cookies
+ */
+router.get('/sessions/:sessionId/cookies', (req, res) => {
+  const cookies = sessionEngine.getCookies(req.params.sessionId, req.query.domain);
+  res.json({ cookies });
+});
+
+/**
+ * Set storage
+ */
+router.post('/sessions/:sessionId/storage', (req, res) => {
+  const { key, value, type } = req.body;
+  sessionEngine.setStorage(req.params.sessionId, key, value, type);
+  res.json({ success: true });
+});
+
+/**
+ * Destroy session
+ */
+router.delete('/sessions/:sessionId', (req, res) => {
+  sessionEngine.destroy(req.params.sessionId);
+  res.json({ success: true });
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// FAILURE ANALYSIS
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Query failures
+ */
+router.get('/failures', (req, res) => {
+  const failures = failureAnalyzer.query({
+    classification: req.query.classification,
+    severity: req.query.severity,
+    agentId: req.query.agentId,
+    taskId: req.query.taskId,
+    retryable: req.query.retryable === 'true' ? true : req.query.retryable === 'false' ? false : undefined,
+    since: parseInt(req.query.since) || undefined,
+  }, parseInt(req.query.limit) || 50);
+  res.json({ failures, total: failures.length });
+});
+
+/**
+ * Get failure
+ */
+router.get('/failures/:failureId', (req, res) => {
+  const failure = failureAnalyzer.getFailure(req.params.failureId);
+  if (!failure) return res.status(404).json({ error: 'Failure not found' });
+  res.json(failure);
+});
+
+/**
+ * Get failure patterns
+ */
+router.get('/failures/analysis/patterns', (req, res) => {
+  res.json({ patterns: failureAnalyzer.getPatterns() });
+});
+
+/**
+ * Get failure summary
+ */
+router.get('/failures/analysis/summary', (req, res) => {
+  res.json(failureAnalyzer.getSummary(parseInt(req.query.since) || 0));
+});
+
+/**
+ * Classify a failure manually
+ */
+router.post('/failures/classify', (req, res) => {
+  const { error, context } = req.body;
+  if (!error) return res.status(400).json({ error: 'error object required' });
+  const classification = failureAnalyzer.classify(error, context || {});
+  res.json(classification);
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// CERTIFICATION
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Verify a site
+ */
+router.post('/certification/verify', async (req, res) => {
+  try {
+    const { domain, probeData } = req.body;
+    if (!domain) return res.status(400).json({ error: 'domain required' });
+    const result = await certificationEngine.verify(domain, probeData || {});
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+/**
+ * Get certificate
+ */
+router.get('/certification/:domain', (req, res) => {
+  const cert = certificationEngine.getCertificate(req.params.domain);
+  if (!cert) return res.status(404).json({ error: 'No active certificate for this domain' });
+  res.json(cert);
+});
+
+/**
+ * List certificates
+ */
+router.get('/certification', (req, res) => {
+  const certs = certificationEngine.listCertificates({
+    level: req.query.level,
+    minScore: parseInt(req.query.minScore) || undefined,
+  }, parseInt(req.query.limit) || 50);
+  res.json({ certificates: certs, total: certs.length });
+});
+
+/**
+ * Revoke certificate
+ */
+router.delete('/certification/:domain', (req, res) => {
+  certificationEngine.revoke(req.params.domain);
+  res.json({ success: true });
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// PLANS & PRICING
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * List available plans
+ */
+router.get('/plans', (req, res) => {
+  const plans = listPlans().map(p => ({
+    id: p.id,
+    name: p.name,
+    price: p.price,
+    interval: p.interval,
+    description: p.description,
+    limits: p.limits,
+    features: Object.entries(p.features)
+      .filter(([, v]) => v === true)
+      .map(([k]) => k),
+  }));
+  res.json({ plans, usagePricing: USAGE_PRICING });
+});
+
+/**
+ * Get specific plan details
+ */
+router.get('/plans/:planId', (req, res) => {
+  const plan = getPlan(req.params.planId);
+  if (!plan || plan.id === 'free' && req.params.planId !== 'free') {
+    return res.status(404).json({ error: 'Plan not found' });
+  }
+  res.json(plan);
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// USAGE METERING
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Get usage for current agent
+ */
+router.get('/usage', (req, res) => {
+  const entityId = req.agentId || req.ip;
+  const tier = req.agentTier || req.session?.tier || 'free';
+  res.json(metering.getUsage(entityId, tier));
+});
+
+/**
+ * Get billing summary (overages)
+ */
+router.get('/usage/billing', (req, res) => {
+  const entityId = req.agentId || req.ip;
+  res.json(metering.getBillingSummary(entityId));
+});
+
+/**
+ * Get metering stats (admin)
+ */
+router.get('/usage/stats', (req, res) => {
+  res.json(metering.getStats());
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// MARKETPLACE
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Search marketplace
+ */
+router.get('/marketplace', (req, res) => {
+  const listings = marketplace.search({
+    type: req.query.type,
+    category: req.query.category,
+    query: req.query.q,
+    tag: req.query.tag,
+    free: req.query.free === 'true',
+    paid: req.query.paid === 'true',
+    minRating: req.query.minRating ? parseFloat(req.query.minRating) : undefined,
+    sortBy: req.query.sortBy,
+  }, parseInt(req.query.limit) || 50);
+  res.json({ listings, total: listings.length });
+});
+
+/**
+ * Get listing
+ */
+router.get('/marketplace/:listingId', (req, res) => {
+  const listing = marketplace.getListing(req.params.listingId);
+  if (!listing) return res.status(404).json({ error: 'Listing not found' });
+  res.json(listing);
+});
+
+/**
+ * Get reviews
+ */
+router.get('/marketplace/:listingId/reviews', (req, res) => {
+  res.json({ reviews: marketplace.getReviews(req.params.listingId) });
+});
+
+/**
+ * Publish listing
+ */
+router.post('/marketplace/publish', (req, res) => {
+  try {
+    const listing = marketplace.publish({
+      ...req.body,
+      sellerId: req.agentId || req.body.sellerId,
+    });
+    res.json(listing);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Purchase/install listing
+ */
+router.post('/marketplace/:listingId/purchase', (req, res) => {
+  try {
+    const buyerId = req.agentId || req.body.buyerId;
+    if (!buyerId) return res.status(400).json({ error: 'buyerId required' });
+    const purchase = marketplace.purchase(req.params.listingId, buyerId);
+    res.json(purchase);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Add review
+ */
+router.post('/marketplace/:listingId/review', (req, res) => {
+  try {
+    const review = marketplace.addReview(req.params.listingId, {
+      userId: req.agentId || req.body.userId,
+      rating: req.body.rating,
+      comment: req.body.comment,
+    });
+    res.json(review);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Get my purchases
+ */
+router.get('/marketplace/my/purchases', (req, res) => {
+  const buyerId = req.agentId || req.query.buyerId;
+  res.json({ purchases: marketplace.getPurchases(buyerId) });
+});
+
+/**
+ * Get seller earnings
+ */
+router.get('/marketplace/my/earnings', (req, res) => {
+  const sellerId = req.agentId || req.query.sellerId;
+  res.json(marketplace.getEarnings(sellerId));
+});
+
+/**
+ * Admin: pending listings
+ */
+router.get('/marketplace/admin/pending', (req, res) => {
+  res.json({ listings: marketplace.getPendingListings() });
+});
+
+/**
+ * Admin: approve listing
+ */
+router.post('/marketplace/admin/:listingId/approve', (req, res) => {
+  try {
+    const listing = marketplace.approve(req.params.listingId);
+    res.json(listing);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Admin: reject listing
+ */
+router.post('/marketplace/admin/:listingId/reject', (req, res) => {
+  try {
+    const listing = marketplace.reject(req.params.listingId, req.body.reason);
+    res.json(listing);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Marketplace stats
+ */
+router.get('/marketplace/stats', (req, res) => {
+  res.json(marketplace.getStats());
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// HOSTED RUNTIME
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Launch hosted instance
+ */
+router.post('/hosted/launch', (req, res) => {
+  try {
+    const instance = hostedRuntime.launch({
+      agentId: req.agentId || req.body.agentId,
+      tier: req.agentTier || req.session?.tier || 'starter',
+      region: req.body.region,
+      cpu: req.body.cpu,
+      memory: req.body.memory,
+      timeout: req.body.timeout,
+    });
+    res.json(instance);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Execute on hosted instance
+ */
+router.post('/hosted/:instanceId/execute', async (req, res) => {
+  try {
+    const execution = await hostedRuntime.execute(req.params.instanceId, req.body);
+    res.json(execution);
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+/**
+ * Complete execution
+ */
+router.post('/hosted/executions/:executionId/complete', (req, res) => {
+  const execution = hostedRuntime.completeExecution(
+    req.params.executionId,
+    req.body.result,
+    req.body.error ? new Error(req.body.error) : null
+  );
+  if (!execution) return res.status(404).json({ error: 'Execution not found' });
+  res.json(execution);
+});
+
+/**
+ * Stop hosted instance
+ */
+router.post('/hosted/:instanceId/stop', (req, res) => {
+  const success = hostedRuntime.stop(req.params.instanceId);
+  res.json({ success });
+});
+
+/**
+ * Get hosted instance
+ */
+router.get('/hosted/:instanceId', (req, res) => {
+  const instance = hostedRuntime.getInstance(req.params.instanceId);
+  if (!instance) return res.status(404).json({ error: 'Instance not found' });
+  res.json(instance);
+});
+
+/**
+ * List instances
+ */
+router.get('/hosted', (req, res) => {
+  const instances = hostedRuntime.listInstances({
+    agentId: req.query.agentId,
+    status: req.query.status,
+    region: req.query.region,
+  }, parseInt(req.query.limit) || 50);
+  res.json({ instances, total: instances.length });
+});
+
+/**
+ * List executions for instance
+ */
+router.get('/hosted/:instanceId/executions', (req, res) => {
+  const executions = hostedRuntime.listExecutions(
+    req.params.instanceId,
+    parseInt(req.query.limit) || 50
+  );
+  res.json({ executions, total: executions.length });
+});
+
+/**
+ * Get compute usage
+ */
+router.get('/hosted/usage/:agentId', (req, res) => {
+  res.json(hostedRuntime.getComputeUsage(req.params.agentId));
+});
+
+/**
+ * Hosted runtime stats
+ */
+router.get('/hosted/stats', (req, res) => {
+  res.json(hostedRuntime.getStats());
+});
+
 module.exports = router;