whale-code 6.5.5 → 6.5.7

package/dist/server/local-agent-gateway-api.js

@@ -0,0 +1,156 @@
+// local-agent-gateway-api.ts — Public API for agent execution and tool discovery
+import { WebSocket } from "ws";
+import { randomUUID } from "node:crypto";
+import { agentPool, pendingRequests, pickAgent, send } from "./local-agent-gateway-types.js";
+
+// Re-export stats, cluster, and shutdown from sub-module
+export { getGatewayStats, getRemoteDesktopSessions, getPortalSessions, executeClusterCommand, shutdownGateway } from "./local-agent-gateway-stats.js";
+export function hasLocalAgent(storeId) {
+  const agents = agentPool.get(storeId.toLowerCase());
+  return !!agents?.some(a => a.ws.readyState === WebSocket.OPEN);
+}
+
+/**
+ * Get info about connected agents for a store.
+ */
+export function getAgentInfo(storeId) {
+  const agents = agentPool.get(storeId.toLowerCase()) || [];
+  return agents.filter(a => a.ws.readyState === WebSocket.OPEN).map(a => ({
+    agent_id: a.agentId,
+    platform: a.platform,
+    hostname: a.hostname,
+    capabilities: a.capabilities,
+    connected_at: a.connectedAt.toISOString(),
+    uptime_seconds: Math.floor((Date.now() - a.connectedAt.getTime()) / 1000),
+    node_id: a.nodeId
+  }));
+}
+
+/**
+ * Execute a command on the user's local machine via their connected agent.
+ */
+export async function executeOnLocalAgent(storeId, command, options = {}) {
+  const agent = pickAgent(storeId, options.agent_id);
+  if (!agent) {
+    return {
+      success: false,
+      error: `No local agent connected for this store. Install and run: whale agent start --key YOUR_API_KEY`
+    };
+  }
+  const requestId = randomUUID();
+  const timeout = Math.min(options.timeout || 30000, 600000);
+  const sent = send(agent.ws, {
+    type: "exec",
+    request_id: requestId,
+    command,
+    session_id: options.session_id,
+    timeout
+  });
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: `Local agent command timed out after ${timeout}ms`
+      });
+    }, timeout + 5000);
+    pendingRequests.set(requestId, {
+      resolve,
+      reject,
+      timer,
+      agentId: agent.agentId
+    });
+  });
+}
+
+/**
+ * Execute a managed tool on the local agent (burp, zap, tshark, etc.)
+ */
+export async function executeToolOnLocalAgent(storeId, tool, args, options = {}) {
+  const agent = pickAgent(storeId, options.agent_id);
+  if (!agent) {
+    return {
+      success: false,
+      error: `No local agent connected. Install: whale agent start --key YOUR_API_KEY`
+    };
+  }
+  if (!agent.capabilities.includes(tool)) {
+    return {
+      success: false,
+      error: `Local agent does not have tool "${tool}" installed. Available: ${agent.capabilities.join(", ") || "none"}`
+    };
+  }
+  const requestId = randomUUID();
+  const timeout = Math.min(options.timeout || 30000, 600000);
+  const sent = send(agent.ws, {
+    type: "tool_exec",
+    request_id: requestId,
+    tool,
+    args,
+    timeout
+  });
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: `Local tool "${tool}" timed out after ${timeout}ms`
+      });
+    }, timeout + 5000);
+    pendingRequests.set(requestId, {
+      resolve,
+      reject,
+      timer,
+      agentId: agent.agentId
+    });
+  });
+}
+
+/**
+ * Request tool discovery from agent.
+ */
+export async function discoverLocalTools(storeId) {
+  const agent = pickAgent(storeId.toLowerCase());
+  if (!agent) {
+    return {
+      success: false,
+      error: `No local agent connected. Install: whale agent start --key YOUR_API_KEY`
+    };
+  }
+  const requestId = randomUUID();
+  const sent = send(agent.ws, {
+    type: "discover",
+    request_id: requestId
+  });
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise(resolve => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: "Discovery timed out"
+      });
+    }, 15000);
+    pendingRequests.set(requestId, {
+      resolve,
+      reject: () => resolve({
+        success: false,
+        error: "Discovery failed"
+      }),
+      timer,
+      agentId: agent.agentId
+    });
+  });
+}
+//# sourceMappingURL=local-agent-gateway-api.js.map

package/dist/server/local-agent-gateway-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-agent-gateway-api.js","names":["WebSocket","randomUUID","agentPool","pendingRequests","pickAgent","send","getGatewayStats","getRemoteDesktopSessions","getPortalSessions","executeClusterCommand","shutdownGateway","hasLocalAgent","storeId","agents","get","toLowerCase","some","a","ws","readyState","OPEN","getAgentInfo","filter","map","agent_id","agentId","platform","hostname","capabilities","connected_at","connectedAt","toISOString","uptime_seconds","Math","floor","Date","now","getTime","node_id","nodeId","executeOnLocalAgent","command","options","agent","success","error","requestId","timeout","min","sent","type","request_id","session_id","Promise","resolve","reject","timer","setTimeout","delete","set","executeToolOnLocalAgent","tool","args","includes","join","discoverLocalTools"],"sources":["../../src/server/local-agent-gateway-api.ts"],"sourcesContent":["// local-agent-gateway-api.ts — Public API for agent execution and tool discovery\nimport { WebSocket } from \"ws\";\nimport { randomUUID } from \"node:crypto\";\nimport {\n  type LocalAgent, type AgentResult,\n  agentPool, pendingRequests,\n  pickAgent, send,\n} from \"./local-agent-gateway-types.js\";\n\n// Re-export stats, cluster, and shutdown from sub-module\nexport {\n  getGatewayStats, getRemoteDesktopSessions, getPortalSessions,\n  executeClusterCommand, shutdownGateway,\n  type ClusterCommandArgs,\n} from \"./local-agent-gateway-stats.js\";\n\nexport function hasLocalAgent(storeId: string): boolean {\n  const agents = agentPool.get(storeId.toLowerCase());\n  return !!agents?.some(a => a.ws.readyState === WebSocket.OPEN);\n}\n\n/**\n * Get info about connected agents for a store.\n */\nexport function getAgentInfo(storeId: string): Array<{\n  agent_id: string;\n  platform: string;\n  hostname: string;\n  capabilities: string[];\n  connected_at: string;\n  uptime_seconds: number;\n  node_id: string | null;\n}> {\n  const agents = agentPool.get(storeId.toLowerCase()) || [];\n  return agents\n    .filter(a => a.ws.readyState === WebSocket.OPEN)\n    .map(a => ({\n      agent_id: a.agentId,\n      platform: a.platform,\n      hostname: a.hostname,\n      capabilities: a.capabilities,\n      connected_at: a.connectedAt.toISOString(),\n      uptime_seconds: Math.floor((Date.now() - a.connectedAt.getTime()) / 1000),\n      node_id: a.nodeId,\n    }));\n}\n\n/**\n * Execute a command on the user's local machine via their connected agent.\n */\nexport async function executeOnLocalAgent(\n  storeId: string,\n  command: string,\n  options: {\n    session_id?: string;\n    timeout?: number;\n    agent_id?: string;\n  } = {},\n): Promise<AgentResult> {\n  const agent = pickAgent(storeId, options.agent_id);\n  if (!agent) {\n    return {\n      success: false,\n      error: `No local agent connected for this store. Install and run: whale agent start --key YOUR_API_KEY`,\n    };\n  }\n\n  const requestId = randomUUID();\n  const timeout = Math.min(options.timeout || 30000, 600000);\n\n  const sent = send(agent.ws, {\n    type: \"exec\",\n    request_id: requestId,\n    command,\n    session_id: options.session_id,\n    timeout,\n  });\n  if (!sent) return { success: false, error: \"Agent connection closed\" };\n\n  return new Promise<AgentResult>((resolve, reject) => {\n    const timer = setTimeout(() => {\n      pendingRequests.delete(requestId);\n      resolve({\n        success: false,\n        error: `Local agent command timed out after ${timeout}ms`,\n      });\n    }, timeout + 5000);\n\n    pendingRequests.set(requestId, { resolve, reject, timer, agentId: agent.agentId });\n  });\n}\n\n/**\n * Execute a managed tool on the local agent (burp, zap, tshark, etc.)\n */\nexport async function executeToolOnLocalAgent(\n  storeId: string,\n  tool: string,\n  args: Record<string, unknown>,\n  options: {\n    timeout?: number;\n    agent_id?: string;\n  } = {},\n): Promise<AgentResult> {\n  const agent = pickAgent(storeId, options.agent_id);\n  if (!agent) {\n    return {\n      success: false,\n      error: `No local agent connected. Install: whale agent start --key YOUR_API_KEY`,\n    };\n  }\n\n  if (!agent.capabilities.includes(tool)) {\n    return {\n      success: false,\n      error: `Local agent does not have tool \"${tool}\" installed. Available: ${agent.capabilities.join(\", \") || \"none\"}`,\n    };\n  }\n\n  const requestId = randomUUID();\n  const timeout = Math.min(options.timeout || 30000, 600000);\n\n  const sent = send(agent.ws, {\n    type: \"tool_exec\",\n    request_id: requestId,\n    tool,\n    args,\n    timeout,\n  });\n  if (!sent) return { success: false, error: \"Agent connection closed\" };\n\n  return new Promise<AgentResult>((resolve, reject) => {\n    const timer = setTimeout(() => {\n      pendingRequests.delete(requestId);\n      resolve({\n        success: false,\n        error: `Local tool \"${tool}\" timed out after ${timeout}ms`,\n      });\n    }, timeout + 5000);\n\n    pendingRequests.set(requestId, { resolve, reject, timer, agentId: agent.agentId });\n  });\n}\n\n/**\n * Request tool discovery from agent.\n */\nexport async function discoverLocalTools(storeId: string): Promise<AgentResult> {\n  const agent = pickAgent(storeId.toLowerCase());\n  if (!agent) {\n    return {\n      success: false,\n      error: `No local agent connected. Install: whale agent start --key YOUR_API_KEY`,\n    };\n  }\n\n  const requestId = randomUUID();\n\n  const sent = send(agent.ws, { type: \"discover\", request_id: requestId });\n  if (!sent) return { success: false, error: \"Agent connection closed\" };\n\n  return new Promise<AgentResult>((resolve) => {\n    const timer = setTimeout(() => {\n      pendingRequests.delete(requestId);\n      resolve({ success: false, error: \"Discovery timed out\" });\n    }, 15000);\n\n    pendingRequests.set(requestId, {\n      resolve,\n      reject: () => resolve({ success: false, error: \"Discovery failed\" }),\n      timer,\n      agentId: agent.agentId,\n    });\n  });\n}\n"],"mappings":"AAAA;AACA,SAASA,SAAS,QAAQ,IAAI;AAC9B,SAASC,UAAU,QAAQ,aAAa;AACxC,SAEEC,SAAS,EAAEC,eAAe,EAC1BC,SAAS,EAAEC,IAAI,QACV,gCAAgC;;AAEvC;AACA,SACEC,eAAe,EAAEC,wBAAwB,EAAEC,iBAAiB,EAC5DC,qBAAqB,EAAEC,eAAe,QAEjC,gCAAgC;AAEvC,OAAO,SAASC,aAAaA,CAACC,OAAe,EAAW;EACtD,MAAMC,MAAM,GAAGX,SAAS,CAACY,GAAG,CAACF,OAAO,CAACG,WAAW,CAAC,CAAC,CAAC;EACnD,OAAO,CAAC,CAACF,MAAM,EAAEG,IAAI,CAACC,CAAC,IAAIA,CAAC,CAACC,EAAE,CAACC,UAAU,KAAKnB,SAAS,CAACoB,IAAI,CAAC;AAChE;;AAEA;AACA;AACA;AACA,OAAO,SAASC,YAAYA,CAACT,OAAe,EAQzC;EACD,MAAMC,MAAM,GAAGX,SAAS,CAACY,GAAG,CAACF,OAAO,CAACG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;EACzD,OAAOF,MAAM,CACVS,MAAM,CAACL,CAAC,IAAIA,CAAC,CAACC,EAAE,CAACC,UAAU,KAAKnB,SAAS,CAACoB,IAAI,CAAC,CAC/CG,GAAG,CAACN,CAAC,KAAK;IACTO,QAAQ,EAAEP,CAAC,CAACQ,OAAO;IACnBC,QAAQ,EAAET,CAAC,CAACS,QAAQ;IACpBC,QAAQ,EAAEV,CAAC,CAACU,QAAQ;IACpBC,YAAY,EAAEX,CAAC,CAACW,YAAY;IAC5BC,YAAY,EAAEZ,CAAC,CAACa,WAAW,CAACC,WAAW,CAAC,CAAC;IACzCC,cAAc,EAAEC,IAAI,CAACC,KAAK,CAAC,CAACC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGnB,CAAC,CAACa,WAAW,CAACO,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IACzEC,OAAO,EAAErB,CAAC,CAACsB;EACb,CAAC,CAAC,CAAC;AACP;;AAEA;AACA;AACA;AACA,OAAO,eAAeC,mBAAmBA,CACvC5B,OAAe,EACf6B,OAAe,EACfC,OAIC,GAAG,CAAC,CAAC,EACgB;EACtB,MAAMC,KAAK,GAAGvC,SAAS,CAACQ,OAAO,EAAE8B,OAAO,CAAClB,QAAQ,CAAC;EAClD,IAAI,CAACmB,KAAK,EAAE;IACV,OAAO;MACLC,OAAO,EAAE,KAAK;MACdC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,MAAMC,SAAS,GAAG7C,UAAU,CAAC,CAAC;EAC9B,MAAM8C,OAAO,GAAGd,IAAI,CAACe,GAAG,CAACN,OAAO,CAACK,OAAO,IAAI,KAAK,EAAE,MAAM,CAAC;EAE1D,MAAME,IAAI,GAAG5C,IAAI,CAACsC,KAAK,CAACzB,EAAE,EAAE;IAC1BgC,IAAI,EAAE,MAAM;IACZC,UAAU,EAAEL,SAAS;IACrBL,OAAO;IACPW,UAAU,EAAEV,OAAO,CAACU,UAAU;IAC9BL;EACF,CAAC,CAAC;EACF,IAAI,CAACE,IAAI,EAAE,OAAO;IAAEL,OAAO,EAAE,KAAK;IAAEC,KAAK,EAAE;EAA0B,CAAC;EAEtE,OAAO,IAAIQ,OAAO,CAAc,CAACC,OAAO,EAAEC,MAAM,KAAK;IACnD,MAAMC,KAAK,GAAGC,UAAU,CAAC,MAAM;MAC7BtD,eAAe,CAACuD,MAAM,CAACZ,SAAS,CAAC;MACjCQ,OAAO,CAAC;QACNV,OAAO,EAAE,KAAK;QACdC,KAAK,EAAE,uCAAuCE,OAAO;MACvD,CAAC,CAAC;IACJ,CAAC,EAAEA,OAAO,GAAG,IAAI,CAAC;IAElB5C,eAAe,CAACwD,GAAG,CAACb,SAAS,EAAE;MAAEQ,OAAO;MAAEC,MAAM;MAAEC,KAAK;MAAE/B,OAAO,EAAEkB,KAAK,CAAClB;IAAQ,CAAC,CAAC;EACpF,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA,OAAO,eAAemC,uBAAuBA,CAC3ChD,OAAe,EACfiD,IAAY,EACZC,IAA6B,EAC7BpB,OAGC,GAAG,CAAC,CAAC,EACgB;EACtB,MAAMC,KAAK,GAAGvC,SAAS,CAACQ,OAAO,EAAE8B,OAAO,CAAClB,QAAQ,CAAC;EAClD,IAAI,CAACmB,KAAK,EAAE;IACV,OAAO;MACLC,OAAO,EAAE,KAAK;MACdC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,IAAI,CAACF,KAAK,CAACf,YAAY,CAACmC,QAAQ,CAACF,IAAI,CAAC,EAAE;IACtC,OAAO;MACLjB,OAAO,EAAE,KAAK;MACdC,KAAK,EAAE,mCAAmCgB,IAAI,2BAA2BlB,KAAK,CAACf,YAAY,CAACoC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM;IAClH,CAAC;EACH;EAEA,MAAMlB,SAAS,GAAG7C,UAAU,CAAC,CAAC;EAC9B,MAAM8C,OAAO,GAAGd,IAAI,CAACe,GAAG,CAACN,OAAO,CAACK,OAAO,IAAI,KAAK,EAAE,MAAM,CAAC;EAE1D,MAAME,IAAI,GAAG5C,IAAI,CAACsC,KAAK,CAACzB,EAAE,EAAE;IAC1BgC,IAAI,EAAE,WAAW;IACjBC,UAAU,EAAEL,SAAS;IACrBe,IAAI;IACJC,IAAI;IACJf;EACF,CAAC,CAAC;EACF,IAAI,CAACE,IAAI,EAAE,OAAO;IAAEL,OAAO,EAAE,KAAK;IAAEC,KAAK,EAAE;EAA0B,CAAC;EAEtE,OAAO,IAAIQ,OAAO,CAAc,CAACC,OAAO,EAAEC,MAAM,KAAK;IACnD,MAAMC,KAAK,GAAGC,UAAU,CAAC,MAAM;MAC7BtD,eAAe,CAACuD,MAAM,CAACZ,SAAS,CAAC;MACjCQ,OAAO,CAAC;QACNV,OAAO,EAAE,KAAK;QACdC,KAAK,EAAE,eAAegB,IAAI,qBAAqBd,OAAO;MACxD,CAAC,CAAC;IACJ,CAAC,EAAEA,OAAO,GAAG,IAAI,CAAC;IAElB5C,eAAe,CAACwD,GAAG,CAACb,SAAS,EAAE;MAAEQ,OAAO;MAAEC,MAAM;MAAEC,KAAK;MAAE/B,OAAO,EAAEkB,KAAK,CAAClB;IAAQ,CAAC,CAAC;EACpF,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA,OAAO,eAAewC,kBAAkBA,CAACrD,OAAe,EAAwB;EAC9E,MAAM+B,KAAK,GAAGvC,SAAS,CAACQ,OAAO,CAACG,WAAW,CAAC,CAAC,CAAC;EAC9C,IAAI,CAAC4B,KAAK,EAAE;IACV,OAAO;MACLC,OAAO,EAAE,KAAK;MACdC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,MAAMC,SAAS,GAAG7C,UAAU,CAAC,CAAC;EAE9B,MAAMgD,IAAI,GAAG5C,IAAI,CAACsC,KAAK,CAACzB,EAAE,EAAE;IAAEgC,IAAI,EAAE,UAAU;IAAEC,UAAU,EAAEL;EAAU,CAAC,CAAC;EACxE,IAAI,CAACG,IAAI,EAAE,OAAO;IAAEL,OAAO,EAAE,KAAK;IAAEC,KAAK,EAAE;EAA0B,CAAC;EAEtE,OAAO,IAAIQ,OAAO,CAAeC,OAAO,IAAK;IAC3C,MAAME,KAAK,GAAGC,UAAU,CAAC,MAAM;MAC7BtD,eAAe,CAACuD,MAAM,CAACZ,SAAS,CAAC;MACjCQ,OAAO,CAAC;QAAEV,OAAO,EAAE,KAAK;QAAEC,KAAK,EAAE;MAAsB,CAAC,CAAC;IAC3D,CAAC,EAAE,KAAK,CAAC;IAET1C,eAAe,CAACwD,GAAG,CAACb,SAAS,EAAE;MAC7BQ,OAAO;MACPC,MAAM,EAAEA,CAAA,KAAMD,OAAO,CAAC;QAAEV,OAAO,EAAE,KAAK;QAAEC,KAAK,EAAE;MAAmB,CAAC,CAAC;MACpEW,KAAK;MACL/B,OAAO,EAAEkB,KAAK,CAAClB;IACjB,CAAC,CAAC;EACJ,CAAC,CAAC;AACJ","ignoreList":[]}

package/dist/server/local-agent-gateway-handler.d.ts

@@ -0,0 +1,3 @@
+import { WebSocket } from "ws";
+import type http from "node:http";
+export declare function handleConnection(ws: WebSocket, _req: http.IncomingMessage): void;

package/dist/server/local-agent-gateway-handler.js

@@ -0,0 +1,292 @@
+// local-agent-gateway-handler.ts — WebSocket connection handler (message routing, auth, cleanup)
+import { WebSocket } from "ws";
+import { randomUUID } from "node:crypto";
+import { queueSpan, auditRowToSpan } from "./lib/clickhouse-buffer.js";
+import { agentPool, rdSessions, portalSessions, PORTAL_MARKER, MAX_AGENTS_PER_STORE, pickAgent, pickAgentById, isJsonString, send, failPendingRequestsForAgent } from "./local-agent-gateway-types.js";
+import { authenticateAgent, authenticateViewer } from "./local-agent-gateway-init.js";
+import { handlePortalRequest, handlePortalAccept, handlePortalReject, handlePortalClose, handleResult } from "./local-agent-gateway-messages.js";
+export function handleConnection(ws, _req) {
+  let authenticated = false;
+  let agent = null;
+  let viewerSession = null;
+
+  // Auth timeout — must authenticate within 10 seconds
+  const authTimer = setTimeout(() => {
+    if (!authenticated) {
+      send(ws, {
+        type: "error",
+        error: "Authentication timeout"
+      });
+      ws.close(4001, "Authentication timeout");
+    }
+  }, 10_000);
+  ws.on("message", async raw => {
+    // Handle binary messages — forward to paired viewer/agent in RD/portal sessions
+    if (typeof raw !== "string" && !isJsonString(raw)) {
+      const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+
+      // Portal binary frames (marker 0x01) — route by session UUID
+      if (buf.length > 17 && buf[0] === PORTAL_MARKER) {
+        const sessionUuid = buf.subarray(1, 17).toString("hex");
+        const sessionId = `${sessionUuid.slice(0, 8)}-${sessionUuid.slice(8, 12)}-${sessionUuid.slice(12, 16)}-${sessionUuid.slice(16, 20)}-${sessionUuid.slice(20)}`;
+        const portalSession = portalSessions.get(sessionId);
+        if (portalSession && agent) {
+          const targetAgentId = agent.agentId === portalSession.initiatorAgentId ? portalSession.targetAgentId : portalSession.initiatorAgentId;
+          const target = pickAgentById(targetAgentId);
+          if (target?.ws.readyState === WebSocket.OPEN) {
+            target.ws.send(buf);
+            portalSession.bytesRelayed += buf.length;
+          }
+        }
+        return;
+      }
+
+      // Remote desktop binary frames (no marker or 0x00) — existing behavior
+      if (agent) {
+        for (const [, session] of rdSessions) {
+          if (session.agentId === agent.agentId && session.viewerWs.readyState === WebSocket.OPEN) {
+            session.viewerWs.send(buf);
+            session.framesRelayed++;
+            session.bytesRelayed += buf.length;
+          }
+        }
+      }
+      if (viewerSession) {
+        const target = pickAgentById(viewerSession.agentId);
+        if (target?.ws.readyState === WebSocket.OPEN) {
+          target.ws.send(buf);
+        }
+      }
+      return;
+    }
+    let msg;
+    try {
+      msg = JSON.parse(raw.toString());
+    } catch {
+      send(ws, {
+        type: "error",
+        error: "Invalid JSON"
+      });
+      return;
+    }
+
+    // Handle viewer auth (remote desktop relay)
+    if (msg.type === "auth" && msg.role === "viewer") {
+      clearTimeout(authTimer);
+      const viewerAuth = msg;
+      const authResult = await authenticateViewer(viewerAuth);
+      if (!authResult) {
+        send(ws, {
+          type: "error",
+          error: "Invalid token or unauthorized"
+        });
+        ws.close(4003, "Authentication failed");
+        return;
+      }
+      authenticated = true;
+      const targetAgent = pickAgent(authResult.storeId, undefined, viewerAuth.target_node_id);
+      if (!targetAgent || !targetAgent.capabilities.includes("remote_desktop")) {
+        send(ws, {
+          type: "remote_desktop_response",
+          success: false,
+          error: "No remote desktop capable node online"
+        });
+        ws.close(4004, "No target node");
+        return;
+      }
+      const sessionId = randomUUID();
+      viewerSession = {
+        sessionId,
+        viewerWs: ws,
+        agentId: targetAgent.agentId,
+        storeId: authResult.storeId,
+        userId: authResult.userId,
+        startedAt: new Date(),
+        framesRelayed: 0,
+        bytesRelayed: 0
+      };
+      rdSessions.set(sessionId, viewerSession);
+      send(targetAgent.ws, {
+        type: "remote_desktop",
+        request_id: randomUUID(),
+        type_inner: "remote_desktop_request",
+        session_id: sessionId,
+        viewer_user_id: authResult.userId
+      });
+      send(ws, {
+        type: "remote_desktop_response",
+        success: true,
+        session_id: sessionId,
+        agent_hostname: targetAgent.hostname
+      });
+      console.log(`[remote-desktop] Relay session ${sessionId}: viewer=${authResult.userId} -> agent=${targetAgent.agentId}`);
+      return;
+    }
+
+    // Handle auth
+    if (msg.type === "auth") {
+      clearTimeout(authTimer);
+      const authResult = await authenticateAgent(msg);
+      if (!authResult) {
+        send(ws, {
+          type: "error",
+          error: "Invalid API key"
+        });
+        ws.close(4003, "Authentication failed");
+        return;
+      }
+      agent = {
+        ws,
+        storeId: authResult.storeId.toLowerCase(),
+        userId: authResult.userId,
+        nodeId: authResult.nodeId,
+        capabilities: msg.capabilities || [],
+        connectedAt: new Date(),
+        lastPong: Date.now(),
+        agentId: randomUUID(),
+        platform: msg.platform || "unknown",
+        hostname: msg.hostname || "unknown"
+      };
+      const existing = agentPool.get(agent.storeId) || [];
+      if (existing.length >= MAX_AGENTS_PER_STORE) {
+        const oldest = existing.shift();
+        send(oldest.ws, {
+          type: "error",
+          error: "Replaced by newer agent connection"
+        });
+        oldest.ws.close(4004, "Replaced by newer connection");
+      }
+      existing.push(agent);
+      agentPool.set(agent.storeId, existing);
+      authenticated = true;
+      send(ws, {
+        type: "authenticated",
+        agent_id: agent.agentId,
+        message: `Connected to WhaleTools. ${agent.capabilities.length} local tools registered.`
+      });
+      console.log(`[local-agent] Agent connected: store=${agent.storeId} platform=${agent.platform} hostname=${agent.hostname} tools=${agent.capabilities.length}`);
+      queueSpan(auditRowToSpan({
+        action: "local_agent.connected",
+        severity: "info",
+        store_id: agent.storeId,
+        resource_type: "local_agent",
+        resource_id: agent.agentId,
+        source: "local_agent",
+        service_name: "agent-server",
+        span_kind: "INTERNAL",
+        status_code: "OK",
+        start_time: new Date().toISOString(),
+        end_time: new Date().toISOString(),
+        details: {
+          platform: agent.platform,
+          hostname: agent.hostname,
+          capabilities: agent.capabilities
+        },
+        user_id: agent.userId
+      }));
+      return;
+    }
+
+    // Handle viewer input forwarding (after auth)
+    if (authenticated && viewerSession && !agent) {
+      const target = pickAgentById(viewerSession.agentId);
+      if (target?.ws.readyState === WebSocket.OPEN) {
+        send(target.ws, {
+          type: "remote_desktop",
+          ...msg
+        });
+      }
+      return;
+    }
+    if (!authenticated || !agent) {
+      send(ws, {
+        type: "error",
+        error: "Not authenticated"
+      });
+      return;
+    }
+
+    // Handle pong
+    if (msg.type === "pong") {
+      agent.lastPong = Date.now();
+      return;
+    }
+
+    // Delegate portal + result messages to extracted module
+    if (msg.type === "portal_request") {
+      handlePortalRequest(ws, msg, agent);
+      return;
+    }
+    if (msg.type === "portal_accept") {
+      handlePortalAccept(msg, agent);
+      return;
+    }
+    if (msg.type === "portal_reject") {
+      handlePortalReject(msg, agent);
+      return;
+    }
+    if (msg.type === "portal_close") {
+      handlePortalClose(msg, agent);
+      return;
+    }
+
+    // Handle tool discovery response
+    if (msg.type === "tools") {
+      agent.capabilities = msg.tools;
+      console.log(`[local-agent] Updated tools for ${agent.agentId}: ${msg.tools.join(", ")}`);
+      return;
+    }
+
+    // Handle command result
+    if (msg.type === "result") {
+      handleResult(msg);
+    }
+  });
+  ws.on("close", () => {
+    clearTimeout(authTimer);
+    if (agent) {
+      const agents = agentPool.get(agent.storeId);
+      if (agents) {
+        const idx = agents.findIndex(a => a.agentId === agent.agentId);
+        if (idx >= 0) agents.splice(idx, 1);
+        if (agents.length === 0) agentPool.delete(agent.storeId);
+      }
+      console.log(`[local-agent] Agent disconnected: ${agent.agentId} (store=${agent.storeId})`);
+      failPendingRequestsForAgent(agent.agentId, `Agent disconnected (${agent.hostname})`);
+      for (const [sessionId, session] of portalSessions) {
+        if (session.initiatorAgentId === agent.agentId || session.targetAgentId === agent.agentId) {
+          const otherAgentId = agent.agentId === session.initiatorAgentId ? session.targetAgentId : session.initiatorAgentId;
+          const other = pickAgentById(otherAgentId);
+          if (other) {
+            send(other.ws, {
+              type: "portal_close",
+              session_id: sessionId
+            });
+          }
+          portalSessions.delete(sessionId);
+          console.log(`[portal] Session ${sessionId} ended (agent disconnected)`);
+        }
+      }
+      for (const [sessionId, session] of rdSessions) {
+        if (session.agentId === agent.agentId) {
+          send(session.viewerWs, {
+            type: "session_end",
+            reason: "agent_disconnected"
+          });
+          session.viewerWs.close(1001, "Agent disconnected");
+          rdSessions.delete(sessionId);
+          console.log(`[remote-desktop] Session ${sessionId} ended (agent disconnected)`);
+        }
+      }
+    }
+    if (viewerSession) {
+      rdSessions.delete(viewerSession.sessionId);
+      console.log(`[remote-desktop] Session ${viewerSession.sessionId} ended (viewer disconnected)`);
+      viewerSession = null;
+    }
+  });
+  ws.on("error", err => {
+    console.error("[local-agent] WebSocket error:", err.message);
+  });
+}
+//# sourceMappingURL=local-agent-gateway-handler.js.map

package/dist/server/local-agent-gateway-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-agent-gateway-handler.js","names":["WebSocket","randomUUID","queueSpan","auditRowToSpan","agentPool","rdSessions","portalSessions","PORTAL_MARKER","MAX_AGENTS_PER_STORE","pickAgent","pickAgentById","isJsonString","send","failPendingRequestsForAgent","authenticateAgent","authenticateViewer","handlePortalRequest","handlePortalAccept","handlePortalReject","handlePortalClose","handleResult","handleConnection","ws","_req","authenticated","agent","viewerSession","authTimer","setTimeout","type","error","close","on","raw","buf","Buffer","isBuffer","from","length","sessionUuid","subarray","toString","sessionId","slice","portalSession","get","targetAgentId","agentId","initiatorAgentId","target","readyState","OPEN","bytesRelayed","session","viewerWs","framesRelayed","msg","JSON","parse","role","clearTimeout","viewerAuth","authResult","targetAgent","storeId","undefined","target_node_id","capabilities","includes","success","userId","startedAt","Date","set","request_id","type_inner","session_id","viewer_user_id","agent_hostname","hostname","console","log","toLowerCase","nodeId","connectedAt","lastPong","now","platform","existing","oldest","shift","push","agent_id","message","action","severity","store_id","resource_type","resource_id","source","service_name","span_kind","status_code","start_time","toISOString","end_time","details","user_id","tools","join","agents","idx","findIndex","a","splice","delete","otherAgentId","other","reason","err"],"sources":["../../src/server/local-agent-gateway-handler.ts"],"sourcesContent":["// local-agent-gateway-handler.ts — WebSocket connection handler (message routing, auth, cleanup)\nimport { WebSocket } from \"ws\";\nimport { randomUUID } from \"node:crypto\";\nimport type http from \"node:http\";\nimport { queueSpan, auditRowToSpan } from \"./lib/clickhouse-buffer.js\";\nimport {\n  type LocalAgent, type ViewerAuthMessage, type RemoteDesktopSession,\n  agentPool, pendingRequests, rdSessions, portalSessions,\n  PORTAL_MARKER, MAX_AGENTS_PER_STORE,\n  pickAgent, pickAgentById, isJsonString, send, failPendingRequestsForAgent,\n} from \"./local-agent-gateway-types.js\";\nimport { authenticateAgent, authenticateViewer } from \"./local-agent-gateway-init.js\";\nimport {\n  handlePortalRequest, handlePortalAccept, handlePortalReject,\n  handlePortalClose, handleResult,\n} from \"./local-agent-gateway-messages.js\";\n\nexport function handleConnection(ws: WebSocket, _req: http.IncomingMessage): void {\n  let authenticated = false;\n  let agent: LocalAgent | null = null;\n  let viewerSession: RemoteDesktopSession | null = null;\n\n  // Auth timeout — must authenticate within 10 seconds\n  const authTimer = setTimeout(() => {\n    if (!authenticated) {\n      send(ws, { type: \"error\", error: \"Authentication timeout\" });\n      ws.close(4001, \"Authentication timeout\");\n    }\n  }, 10_000);\n\n  ws.on(\"message\", async (raw) => {\n    // Handle binary messages — forward to paired viewer/agent in RD/portal sessions\n    if (typeof raw !== \"string\" && !isJsonString(raw)) {\n      const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(raw as any);\n\n      // Portal binary frames (marker 0x01) — route by session UUID\n      if (buf.length > 17 && buf[0] === PORTAL_MARKER) {\n        const sessionUuid = buf.subarray(1, 17).toString(\"hex\");\n        const sessionId = `${sessionUuid.slice(0, 8)}-${sessionUuid.slice(8, 12)}-${sessionUuid.slice(12, 16)}-${sessionUuid.slice(16, 20)}-${sessionUuid.slice(20)}`;\n        const portalSession = portalSessions.get(sessionId);\n        if (portalSession && agent) {\n          const targetAgentId = agent.agentId === portalSession.initiatorAgentId\n            ? portalSession.targetAgentId\n            : portalSession.initiatorAgentId;\n          const target = pickAgentById(targetAgentId);\n          if (target?.ws.readyState === WebSocket.OPEN) {\n            target.ws.send(buf);\n            portalSession.bytesRelayed += buf.length;\n          }\n        }\n        return;\n      }\n\n      // Remote desktop binary frames (no marker or 0x00) — existing behavior\n      if (agent) {\n        for (const [, session] of rdSessions) {\n          if (session.agentId === agent.agentId && session.viewerWs.readyState === WebSocket.OPEN) {\n            session.viewerWs.send(buf);\n            session.framesRelayed++;\n            session.bytesRelayed += buf.length;\n          }\n        }\n      }\n      if (viewerSession) {\n        const target = pickAgentById(viewerSession.agentId);\n        if (target?.ws.readyState === WebSocket.OPEN) {\n          target.ws.send(buf);\n        }\n      }\n      return;\n    }\n\n    let msg: any;\n    try {\n      msg = JSON.parse(raw.toString());\n    } catch {\n      send(ws, { type: \"error\", error: \"Invalid JSON\" });\n      return;\n    }\n\n    // Handle viewer auth (remote desktop relay)\n    if (msg.type === \"auth\" && msg.role === \"viewer\") {\n      clearTimeout(authTimer);\n      const viewerAuth = msg as ViewerAuthMessage;\n      const authResult = await authenticateViewer(viewerAuth);\n      if (!authResult) {\n        send(ws, { type: \"error\", error: \"Invalid token or unauthorized\" });\n        ws.close(4003, \"Authentication failed\");\n        return;\n      }\n\n      authenticated = true;\n\n      const targetAgent = pickAgent(authResult.storeId, undefined, viewerAuth.target_node_id);\n      if (!targetAgent || !targetAgent.capabilities.includes(\"remote_desktop\")) {\n        send(ws, { type: \"remote_desktop_response\", success: false, error: \"No remote desktop capable node online\" });\n        ws.close(4004, \"No target node\");\n        return;\n      }\n\n      const sessionId = randomUUID();\n      viewerSession = {\n        sessionId,\n        viewerWs: ws,\n        agentId: targetAgent.agentId,\n        storeId: authResult.storeId,\n        userId: authResult.userId,\n        startedAt: new Date(),\n        framesRelayed: 0,\n        bytesRelayed: 0,\n      };\n      rdSessions.set(sessionId, viewerSession);\n\n      send(targetAgent.ws, {\n        type: \"remote_desktop\",\n        request_id: randomUUID(),\n        type_inner: \"remote_desktop_request\",\n        session_id: sessionId,\n        viewer_user_id: authResult.userId,\n      });\n\n      send(ws, {\n        type: \"remote_desktop_response\",\n        success: true,\n        session_id: sessionId,\n        agent_hostname: targetAgent.hostname,\n      });\n\n      console.log(`[remote-desktop] Relay session ${sessionId}: viewer=${authResult.userId} -> agent=${targetAgent.agentId}`);\n      return;\n    }\n\n    // Handle auth\n    if (msg.type === \"auth\") {\n      clearTimeout(authTimer);\n      const authResult = await authenticateAgent(msg);\n      if (!authResult) {\n        send(ws, { type: \"error\", error: \"Invalid API key\" });\n        ws.close(4003, \"Authentication failed\");\n        return;\n      }\n\n      agent = {\n        ws,\n        storeId: authResult.storeId.toLowerCase(),\n        userId: authResult.userId,\n        nodeId: authResult.nodeId,\n        capabilities: msg.capabilities || [],\n        connectedAt: new Date(),\n        lastPong: Date.now(),\n        agentId: randomUUID(),\n        platform: msg.platform || \"unknown\",\n        hostname: msg.hostname || \"unknown\",\n      };\n\n      const existing = agentPool.get(agent.storeId) || [];\n      if (existing.length >= MAX_AGENTS_PER_STORE) {\n        const oldest = existing.shift()!;\n        send(oldest.ws, { type: \"error\", error: \"Replaced by newer agent connection\" });\n        oldest.ws.close(4004, \"Replaced by newer connection\");\n      }\n      existing.push(agent);\n      agentPool.set(agent.storeId, existing);\n      authenticated = true;\n\n      send(ws, {\n        type: \"authenticated\",\n        agent_id: agent.agentId,\n        message: `Connected to WhaleTools. ${agent.capabilities.length} local tools registered.`,\n      });\n\n      console.log(`[local-agent] Agent connected: store=${agent.storeId} platform=${agent.platform} hostname=${agent.hostname} tools=${agent.capabilities.length}`);\n\n      queueSpan(auditRowToSpan({\n        action: \"local_agent.connected\",\n        severity: \"info\",\n        store_id: agent.storeId,\n        resource_type: \"local_agent\",\n        resource_id: agent.agentId,\n        source: \"local_agent\",\n        service_name: \"agent-server\",\n        span_kind: \"INTERNAL\",\n        status_code: \"OK\",\n        start_time: new Date().toISOString(),\n        end_time: new Date().toISOString(),\n        details: {\n          platform: agent.platform,\n          hostname: agent.hostname,\n          capabilities: agent.capabilities,\n        },\n        user_id: agent.userId,\n      }));\n      return;\n    }\n\n    // Handle viewer input forwarding (after auth)\n    if (authenticated && viewerSession && !agent) {\n      const target = pickAgentById(viewerSession.agentId);\n      if (target?.ws.readyState === WebSocket.OPEN) {\n        send(target.ws, { type: \"remote_desktop\", ...msg });\n      }\n      return;\n    }\n\n    if (!authenticated || !agent) {\n      send(ws, { type: \"error\", error: \"Not authenticated\" });\n      return;\n    }\n\n    // Handle pong\n    if (msg.type === \"pong\") { agent.lastPong = Date.now(); return; }\n\n    // Delegate portal + result messages to extracted module\n    if (msg.type === \"portal_request\") { handlePortalRequest(ws, msg, agent); return; }\n    if (msg.type === \"portal_accept\") { handlePortalAccept(msg, agent); return; }\n    if (msg.type === \"portal_reject\") { handlePortalReject(msg, agent); return; }\n    if (msg.type === \"portal_close\") { handlePortalClose(msg, agent); return; }\n\n    // Handle tool discovery response\n    if (msg.type === \"tools\") {\n      agent.capabilities = msg.tools;\n      console.log(`[local-agent] Updated tools for ${agent.agentId}: ${msg.tools.join(\", \")}`);\n      return;\n    }\n\n    // Handle command result\n    if (msg.type === \"result\") { handleResult(msg); }\n  });\n\n  ws.on(\"close\", () => {\n    clearTimeout(authTimer);\n    if (agent) {\n      const agents = agentPool.get(agent.storeId);\n      if (agents) {\n        const idx = agents.findIndex(a => a.agentId === agent!.agentId);\n        if (idx >= 0) agents.splice(idx, 1);\n        if (agents.length === 0) agentPool.delete(agent.storeId);\n      }\n      console.log(`[local-agent] Agent disconnected: ${agent.agentId} (store=${agent.storeId})`);\n\n      failPendingRequestsForAgent(agent.agentId, `Agent disconnected (${agent.hostname})`);\n\n      for (const [sessionId, session] of portalSessions) {\n        if (session.initiatorAgentId === agent.agentId || session.targetAgentId === agent.agentId) {\n          const otherAgentId = agent.agentId === session.initiatorAgentId\n            ? session.targetAgentId : session.initiatorAgentId;\n          const other = pickAgentById(otherAgentId);\n          if (other) {\n            send(other.ws, { type: \"portal_close\", session_id: sessionId });\n          }\n          portalSessions.delete(sessionId);\n          console.log(`[portal] Session ${sessionId} ended (agent disconnected)`);\n        }\n      }\n\n      for (const [sessionId, session] of rdSessions) {\n        if (session.agentId === agent.agentId) {\n          send(session.viewerWs, { type: \"session_end\", reason: \"agent_disconnected\" });\n          session.viewerWs.close(1001, \"Agent disconnected\");\n          rdSessions.delete(sessionId);\n          console.log(`[remote-desktop] Session ${sessionId} ended (agent disconnected)`);\n        }\n      }\n    }\n\n    if (viewerSession) {\n      rdSessions.delete(viewerSession.sessionId);\n      console.log(`[remote-desktop] Session ${viewerSession.sessionId} ended (viewer disconnected)`);\n      viewerSession = null;\n    }\n  });\n\n  ws.on(\"error\", (err) => {\n    console.error(\"[local-agent] WebSocket error:\", err.message);\n  });\n}\n"],"mappings":"AAAA;AACA,SAASA,SAAS,QAAQ,IAAI;AAC9B,SAASC,UAAU,QAAQ,aAAa;AAExC,SAASC,SAAS,EAAEC,cAAc,QAAQ,4BAA4B;AACtE,SAEEC,SAAS,EAAmBC,UAAU,EAAEC,cAAc,EACtDC,aAAa,EAAEC,oBAAoB,EACnCC,SAAS,EAAEC,aAAa,EAAEC,YAAY,EAAEC,IAAI,EAAEC,2BAA2B,QACpE,gCAAgC;AACvC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,+BAA+B;AACrF,SACEC,mBAAmB,EAAEC,kBAAkB,EAAEC,kBAAkB,EAC3DC,iBAAiB,EAAEC,YAAY,QAC1B,mCAAmC;AAE1C,OAAO,SAASC,gBAAgBA,CAACC,EAAa,EAAEC,IAA0B,EAAQ;EAChF,IAAIC,aAAa,GAAG,KAAK;EACzB,IAAIC,KAAwB,GAAG,IAAI;EACnC,IAAIC,aAA0C,GAAG,IAAI;;EAErD;EACA,MAAMC,SAAS,GAAGC,UAAU,CAAC,MAAM;IACjC,IAAI,CAACJ,aAAa,EAAE;MAClBZ,IAAI,CAACU,EAAE,EAAE;QAAEO,IAAI,EAAE,OAAO;QAAEC,KAAK,EAAE;MAAyB,CAAC,CAAC;MAC5DR,EAAE,CAACS,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC;IAC1C;EACF,CAAC,EAAE,MAAM,CAAC;EAEVT,EAAE,CAACU,EAAE,CAAC,SAAS,EAAE,MAAOC,GAAG,IAAK;IAC9B;IACA,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAI,CAACtB,YAAY,CAACsB,GAAG,CAAC,EAAE;MACjD,MAAMC,GAAG,GAAGC,MAAM,CAACC,QAAQ,CAACH,GAAG,CAAC,GAAGA,GAAG,GAAGE,MAAM,CAACE,IAAI,CAACJ,GAAU,CAAC;;MAEhE;MACA,IAAIC,GAAG,CAACI,MAAM,GAAG,EAAE,IAAIJ,GAAG,CAAC,CAAC,CAAC,KAAK3B,aAAa,EAAE;QAC/C,MAAMgC,WAAW,GAAGL,GAAG,CAACM,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAACC,QAAQ,CAAC,KAAK,CAAC;QACvD,MAAMC,SAAS,GAAG,GAAGH,WAAW,CAACI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAIJ,WAAW,CAACI,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAIJ,WAAW,CAACI,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAIJ,WAAW,CAACI,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAIJ,WAAW,CAACI,KAAK,CAAC,EAAE,CAAC,EAAE;QAC7J,MAAMC,aAAa,GAAGtC,cAAc,CAACuC,GAAG,CAACH,SAAS,CAAC;QACnD,IAAIE,aAAa,IAAInB,KAAK,EAAE;UAC1B,MAAMqB,aAAa,GAAGrB,KAAK,CAACsB,OAAO,KAAKH,aAAa,CAACI,gBAAgB,GAClEJ,aAAa,CAACE,aAAa,GAC3BF,aAAa,CAACI,gBAAgB;UAClC,MAAMC,MAAM,GAAGvC,aAAa,CAACoC,aAAa,CAAC;UAC3C,IAAIG,MAAM,EAAE3B,EAAE,CAAC4B,UAAU,KAAKlD,SAAS,CAACmD,IAAI,EAAE;YAC5CF,MAAM,CAAC3B,EAAE,CAACV,IAAI,CAACsB,GAAG,CAAC;YACnBU,aAAa,CAACQ,YAAY,IAAIlB,GAAG,CAACI,MAAM;UAC1C;QACF;QACA;MACF;;MAEA;MACA,IAAIb,KAAK,EAAE;QACT,KAAK,MAAM,GAAG4B,OAAO,CAAC,IAAIhD,UAAU,EAAE;UACpC,IAAIgD,OAAO,CAACN,OAAO,KAAKtB,KAAK,CAACsB,OAAO,IAAIM,OAAO,CAACC,QAAQ,CAACJ,UAAU,KAAKlD,SAAS,CAACmD,IAAI,EAAE;YACvFE,OAAO,CAACC,QAAQ,CAAC1C,IAAI,CAACsB,GAAG,CAAC;YAC1BmB,OAAO,CAACE,aAAa,EAAE;YACvBF,OAAO,CAACD,YAAY,IAAIlB,GAAG,CAACI,MAAM;UACpC;QACF;MACF;MACA,IAAIZ,aAAa,EAAE;QACjB,MAAMuB,MAAM,GAAGvC,aAAa,CAACgB,aAAa,CAACqB,OAAO,CAAC;QACnD,IAAIE,MAAM,EAAE3B,EAAE,CAAC4B,UAAU,KAAKlD,SAAS,CAACmD,IAAI,EAAE;UAC5CF,MAAM,CAAC3B,EAAE,CAACV,IAAI,CAACsB,GAAG,CAAC;QACrB;MACF;MACA;IACF;IAEA,IAAIsB,GAAQ;IACZ,IAAI;MACFA,GAAG,GAAGC,IAAI,CAACC,KAAK,CAACzB,GAAG,CAACQ,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,MAAM;MACN7B,IAAI,CAACU,EAAE,EAAE;QAAEO,IAAI,EAAE,OAAO;QAAEC,KAAK,EAAE;MAAe,CAAC,CAAC;MAClD;IACF;;IAEA;IACA,IAAI0B,GAAG,CAAC3B,IAAI,KAAK,MAAM,IAAI2B,GAAG,CAACG,IAAI,KAAK,QAAQ,EAAE;MAChDC,YAAY,CAACjC,SAAS,CAAC;MACvB,MAAMkC,UAAU,GAAGL,GAAwB;MAC3C,MAAMM,UAAU,GAAG,MAAM/C,kBAAkB,CAAC8C,UAAU,CAAC;MACvD,IAAI,CAACC,UAAU,EAAE;QACflD,IAAI,CAACU,EAAE,EAAE;UAAEO,IAAI,EAAE,OAAO;UAAEC,KAAK,EAAE;QAAgC,CAAC,CAAC;QACnER,EAAE,CAACS,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACvC;MACF;MAEAP,aAAa,GAAG,IAAI;MAEpB,MAAMuC,WAAW,GAAGtD,SAAS,CAACqD,UAAU,CAACE,OAAO,EAAEC,SAAS,EAAEJ,UAAU,CAACK,cAAc,CAAC;MACvF,IAAI,CAACH,WAAW,IAAI,CAACA,WAAW,CAACI,YAAY,CAACC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QACxExD,IAAI,CAACU,EAAE,EAAE;UAAEO,IAAI,EAAE,yBAAyB;UAAEwC,OAAO,EAAE,KAAK;UAAEvC,KAAK,EAAE;QAAwC,CAAC,CAAC;QAC7GR,EAAE,CAACS,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC;MACF;MAEA,MAAMW,SAAS,GAAGzC,UAAU,CAAC,CAAC;MAC9ByB,aAAa,GAAG;QACdgB,SAAS;QACTY,QAAQ,EAAEhC,EAAE;QACZyB,OAAO,EAAEgB,WAAW,CAAChB,OAAO;QAC5BiB,OAAO,EAAEF,UAAU,CAACE,OAAO;QAC3BM,MAAM,EAAER,UAAU,CAACQ,MAAM;QACzBC,SAAS,EAAE,IAAIC,IAAI,CAAC,CAAC;QACrBjB,aAAa,EAAE,CAAC;QAChBH,YAAY,EAAE;MAChB,CAAC;MACD/C,UAAU,CAACoE,GAAG,CAAC/B,SAAS,EAAEhB,aAAa,CAAC;MAExCd,IAAI,CAACmD,WAAW,CAACzC,EAAE,EAAE;QACnBO,IAAI,EAAE,gBAAgB;QACtB6C,UAAU,EAAEzE,UAAU,CAAC,CAAC;QACxB0E,UAAU,EAAE,wBAAwB;QACpCC,UAAU,EAAElC,SAAS;QACrBmC,cAAc,EAAEf,UAAU,CAACQ;MAC7B,CAAC,CAAC;MAEF1D,IAAI,CAACU,EAAE,EAAE;QACPO,IAAI,EAAE,yBAAyB;QAC/BwC,OAAO,EAAE,IAAI;QACbO,UAAU,EAAElC,SAAS;QACrBoC,cAAc,EAAEf,WAAW,CAACgB;MAC9B,CAAC,CAAC;MAEFC,OAAO,CAACC,GAAG,CAAC,kCAAkCvC,SAAS,YAAYoB,UAAU,CAACQ,MAAM,aAAaP,WAAW,CAAChB,OAAO,EAAE,CAAC;MACvH;IACF;;IAEA;IACA,IAAIS,GAAG,CAAC3B,IAAI,KAAK,MAAM,EAAE;MACvB+B,YAAY,CAACjC,SAAS,CAAC;MACvB,MAAMmC,UAAU,GAAG,MAAMhD,iBAAiB,CAAC0C,GAAG,CAAC;MAC/C,IAAI,CAACM,UAAU,EAAE;QACflD,IAAI,CAACU,EAAE,EAAE;UAAEO,IAAI,EAAE,OAAO;UAAEC,KAAK,EAAE;QAAkB,CAAC,CAAC;QACrDR,EAAE,CAACS,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACvC;MACF;MAEAN,KAAK,GAAG;QACNH,EAAE;QACF0C,OAAO,EAAEF,UAAU,CAACE,OAAO,CAACkB,WAAW,CAAC,CAAC;QACzCZ,MAAM,EAAER,UAAU,CAACQ,MAAM;QACzBa,MAAM,EAAErB,UAAU,CAACqB,MAAM;QACzBhB,YAAY,EAAEX,GAAG,CAACW,YAAY,IAAI,EAAE;QACpCiB,WAAW,EAAE,IAAIZ,IAAI,CAAC,CAAC;QACvBa,QAAQ,EAAEb,IAAI,CAACc,GAAG,CAAC,CAAC;QACpBvC,OAAO,EAAE9C,UAAU,CAAC,CAAC;QACrBsF,QAAQ,EAAE/B,GAAG,CAAC+B,QAAQ,IAAI,SAAS;QACnCR,QAAQ,EAAEvB,GAAG,CAACuB,QAAQ,IAAI;MAC5B,CAAC;MAED,MAAMS,QAAQ,GAAGpF,SAAS,CAACyC,GAAG,CAACpB,KAAK,CAACuC,OAAO,CAAC,IAAI,EAAE;MACnD,IAAIwB,QAAQ,CAAClD,MAAM,IAAI9B,oBAAoB,EAAE;QAC3C,MAAMiF,MAAM,GAAGD,QAAQ,CAACE,KAAK,CAAC,CAAE;QAChC9E,IAAI,CAAC6E,MAAM,CAACnE,EAAE,EAAE;UAAEO,IAAI,EAAE,OAAO;UAAEC,KAAK,EAAE;QAAqC,CAAC,CAAC;QAC/E2D,MAAM,CAACnE,EAAE,CAACS,KAAK,CAAC,IAAI,EAAE,8BAA8B,CAAC;MACvD;MACAyD,QAAQ,CAACG,IAAI,CAAClE,KAAK,CAAC;MACpBrB,SAAS,CAACqE,GAAG,CAAChD,KAAK,CAACuC,OAAO,EAAEwB,QAAQ,CAAC;MACtChE,aAAa,GAAG,IAAI;MAEpBZ,IAAI,CAACU,EAAE,EAAE;QACPO,IAAI,EAAE,eAAe;QACrB+D,QAAQ,EAAEnE,KAAK,CAACsB,OAAO;QACvB8C,OAAO,EAAE,4BAA4BpE,KAAK,CAAC0C,YAAY,CAAC7B,MAAM;MAChE,CAAC,CAAC;MAEF0C,OAAO,CAACC,GAAG,CAAC,wCAAwCxD,KAAK,CAACuC,OAAO,aAAavC,KAAK,CAAC8D,QAAQ,aAAa9D,KAAK,CAACsD,QAAQ,UAAUtD,KAAK,CAAC0C,YAAY,CAAC7B,MAAM,EAAE,CAAC;MAE7JpC,SAAS,CAACC,cAAc,CAAC;QACvB2F,MAAM,EAAE,uBAAuB;QAC/BC,QAAQ,EAAE,MAAM;QAChBC,QAAQ,EAAEvE,KAAK,CAACuC,OAAO;QACvBiC,aAAa,EAAE,aAAa;QAC5BC,WAAW,EAAEzE,KAAK,CAACsB,OAAO;QAC1BoD,MAAM,EAAE,aAAa;QACrBC,YAAY,EAAE,cAAc;QAC5BC,SAAS,EAAE,UAAU;QACrBC,WAAW,EAAE,IAAI;QACjBC,UAAU,EAAE,IAAI/B,IAAI,CAAC,CAAC,CAACgC,WAAW,CAAC,CAAC;QACpCC,QAAQ,EAAE,IAAIjC,IAAI,CAAC,CAAC,CAACgC,WAAW,CAAC,CAAC;QAClCE,OAAO,EAAE;UACPnB,QAAQ,EAAE9D,KAAK,CAAC8D,QAAQ;UACxBR,QAAQ,EAAEtD,KAAK,CAACsD,QAAQ;UACxBZ,YAAY,EAAE1C,KAAK,CAAC0C;QACtB,CAAC;QACDwC,OAAO,EAAElF,KAAK,CAAC6C;MACjB,CAAC,CAAC,CAAC;MACH;IACF;;IAEA;IACA,IAAI9C,aAAa,IAAIE,aAAa,IAAI,CAACD,KAAK,EAAE;MAC5C,MAAMwB,MAAM,GAAGvC,aAAa,CAACgB,aAAa,CAACqB,OAAO,CAAC;MACnD,IAAIE,MAAM,EAAE3B,EAAE,CAAC4B,UAAU,KAAKlD,SAAS,CAACmD,IAAI,EAAE;QAC5CvC,IAAI,CAACqC,MAAM,CAAC3B,EAAE,EAAE;UAAEO,IAAI,EAAE,gBAAgB;UAAE,GAAG2B;QAAI,CAAC,CAAC;MACrD;MACA;IACF;IAEA,IAAI,CAAChC,aAAa,IAAI,CAACC,KAAK,EAAE;MAC5Bb,IAAI,CAACU,EAAE,EAAE;QAAEO,IAAI,EAAE,OAAO;QAAEC,KAAK,EAAE;MAAoB,CAAC,CAAC;MACvD;IACF;;IAEA;IACA,IAAI0B,GAAG,CAAC3B,IAAI,KAAK,MAAM,EAAE;MAAEJ,KAAK,CAAC4D,QAAQ,GAAGb,IAAI,CAACc,GAAG,CAAC,CAAC;MAAE;IAAQ;;IAEhE;IACA,IAAI9B,GAAG,CAAC3B,IAAI,KAAK,gBAAgB,EAAE;MAAEb,mBAAmB,CAACM,EAAE,EAAEkC,GAAG,EAAE/B,KAAK,CAAC;MAAE;IAAQ;IAClF,IAAI+B,GAAG,CAAC3B,IAAI,KAAK,eAAe,EAAE;MAAEZ,kBAAkB,CAACuC,GAAG,EAAE/B,KAAK,CAAC;MAAE;IAAQ;IAC5E,IAAI+B,GAAG,CAAC3B,IAAI,KAAK,eAAe,EAAE;MAAEX,kBAAkB,CAACsC,GAAG,EAAE/B,KAAK,CAAC;MAAE;IAAQ;IAC5E,IAAI+B,GAAG,CAAC3B,IAAI,KAAK,cAAc,EAAE;MAAEV,iBAAiB,CAACqC,GAAG,EAAE/B,KAAK,CAAC;MAAE;IAAQ;;IAE1E;IACA,IAAI+B,GAAG,CAAC3B,IAAI,KAAK,OAAO,EAAE;MACxBJ,KAAK,CAAC0C,YAAY,GAAGX,GAAG,CAACoD,KAAK;MAC9B5B,OAAO,CAACC,GAAG,CAAC,mCAAmCxD,KAAK,CAACsB,OAAO,KAAKS,GAAG,CAACoD,KAAK,CAACC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;MACxF;IACF;;IAEA;IACA,IAAIrD,GAAG,CAAC3B,IAAI,KAAK,QAAQ,EAAE;MAAET,YAAY,CAACoC,GAAG,CAAC;IAAE;EAClD,CAAC,CAAC;EAEFlC,EAAE,CAACU,EAAE,CAAC,OAAO,EAAE,MAAM;IACnB4B,YAAY,CAACjC,SAAS,CAAC;IACvB,IAAIF,KAAK,EAAE;MACT,MAAMqF,MAAM,GAAG1G,SAAS,CAACyC,GAAG,CAACpB,KAAK,CAACuC,OAAO,CAAC;MAC3C,IAAI8C,MAAM,EAAE;QACV,MAAMC,GAAG,GAAGD,MAAM,CAACE,SAAS,CAACC,CAAC,IAAIA,CAAC,CAAClE,OAAO,KAAKtB,KAAK,CAAEsB,OAAO,CAAC;QAC/D,IAAIgE,GAAG,IAAI,CAAC,EAAED,MAAM,CAACI,MAAM,CAACH,GAAG,EAAE,CAAC,CAAC;QACnC,IAAID,MAAM,CAACxE,MAAM,KAAK,CAAC,EAAElC,SAAS,CAAC+G,MAAM,CAAC1F,KAAK,CAACuC,OAAO,CAAC;MAC1D;MACAgB,OAAO,CAACC,GAAG,CAAC,qCAAqCxD,KAAK,CAACsB,OAAO,WAAWtB,KAAK,CAACuC,OAAO,GAAG,CAAC;MAE1FnD,2BAA2B,CAACY,KAAK,CAACsB,OAAO,EAAE,uBAAuBtB,KAAK,CAACsD,QAAQ,GAAG,CAAC;MAEpF,KAAK,MAAM,CAACrC,SAAS,EAAEW,OAAO,CAAC,IAAI/C,cAAc,EAAE;QACjD,IAAI+C,OAAO,CAACL,gBAAgB,KAAKvB,KAAK,CAACsB,OAAO,IAAIM,OAAO,CAACP,aAAa,KAAKrB,KAAK,CAACsB,OAAO,EAAE;UACzF,MAAMqE,YAAY,GAAG3F,KAAK,CAACsB,OAAO,KAAKM,OAAO,CAACL,gBAAgB,GAC3DK,OAAO,CAACP,aAAa,GAAGO,OAAO,CAACL,gBAAgB;UACpD,MAAMqE,KAAK,GAAG3G,aAAa,CAAC0G,YAAY,CAAC;UACzC,IAAIC,KAAK,EAAE;YACTzG,IAAI,CAACyG,KAAK,CAAC/F,EAAE,EAAE;cAAEO,IAAI,EAAE,cAAc;cAAE+C,UAAU,EAAElC;YAAU,CAAC,CAAC;UACjE;UACApC,cAAc,CAAC6G,MAAM,CAACzE,SAAS,CAAC;UAChCsC,OAAO,CAACC,GAAG,CAAC,oBAAoBvC,SAAS,6BAA6B,CAAC;QACzE;MACF;MAEA,KAAK,MAAM,CAACA,SAAS,EAAEW,OAAO,CAAC,IAAIhD,UAAU,EAAE;QAC7C,IAAIgD,OAAO,CAACN,OAAO,KAAKtB,KAAK,CAACsB,OAAO,EAAE;UACrCnC,IAAI,CAACyC,OAAO,CAACC,QAAQ,EAAE;YAAEzB,IAAI,EAAE,aAAa;YAAEyF,MAAM,EAAE;UAAqB,CAAC,CAAC;UAC7EjE,OAAO,CAACC,QAAQ,CAACvB,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC;UAClD1B,UAAU,CAAC8G,MAAM,CAACzE,SAAS,CAAC;UAC5BsC,OAAO,CAACC,GAAG,CAAC,4BAA4BvC,SAAS,6BAA6B,CAAC;QACjF;MACF;IACF;IAEA,IAAIhB,aAAa,EAAE;MACjBrB,UAAU,CAAC8G,MAAM,CAACzF,aAAa,CAACgB,SAAS,CAAC;MAC1CsC,OAAO,CAACC,GAAG,CAAC,4BAA4BvD,aAAa,CAACgB,SAAS,8BAA8B,CAAC;MAC9FhB,aAAa,GAAG,IAAI;IACtB;EACF,CAAC,CAAC;EAEFJ,EAAE,CAACU,EAAE,CAAC,OAAO,EAAGuF,GAAG,IAAK;IACtBvC,OAAO,CAAClD,KAAK,CAAC,gCAAgC,EAAEyF,GAAG,CAAC1B,OAAO,CAAC;EAC9D,CAAC,CAAC;AACJ","ignoreList":[]}

package/dist/server/local-agent-gateway-init.d.ts

@@ -0,0 +1,21 @@
+import { WebSocketServer } from "ws";
+import type http from "node:http";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type AgentAuthMessage, type ViewerAuthMessage } from "./local-agent-gateway-types.js";
+export declare let supabaseClient: SupabaseClient | null;
+export declare function getWss(): WebSocketServer | null;
+export declare function initLocalAgentGateway(server: http.Server): void;
+export declare function authenticateAgent(msg: AgentAuthMessage): Promise<{
+    storeId: string;
+    userId: string | null;
+    nodeId: string | null;
+} | null>;
+/**
+ * Authenticate a viewer connection using Supabase JWT.
+ */
+export declare function authenticateViewer(msg: ViewerAuthMessage): Promise<{
+    storeId: string;
+    userId: string;
+} | null>;
+export declare function clearHeartbeat(): void;
+export declare function closeWss(): void;