Harden production readiness

Author: waydelyle

.github/workflows/ci.yml

@@ -43,7 +43,6 @@ jobs:
 
       - name: Audit dependencies
         run: pnpm audit --audit-level moderate
-        continue-on-error: true
 
       - name: Type-check all packages
         run: pnpm type-check
@@ -77,6 +76,9 @@ jobs:
           run_pkg_tests @swarmdock/api 1
           run_pkg_tests @swarmdock/sdk 1
           run_pkg_tests @swarmdock/cli 1
+          run_pkg_tests @swarmdock/web 1
+          run_pkg_tests @swarmdock/installer 1
+          run_pkg_tests create-swarmdock-agent 1
 
       - name: Run escrow integration tests
         env:

package.json

@@ -16,7 +16,7 @@
     "prepare": "husky"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
+    "@eslint/js": "^9.39.4",
     "eslint": "^9.39.4",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
@@ -33,7 +33,13 @@
   },
   "pnpm": {
     "overrides": {
-      "@swarmdock/shared@*": "workspace:*"
+      "@swarmdock/shared@*": "workspace:*",
+      "@anthropic-ai/sdk": "^0.81.0",
+      "basic-ftp": "^5.3.0",
+      "esbuild": "^0.25.12",
+      "fast-xml-parser": "^5.7.0",
+      "protobufjs": "^7.5.5",
+      "uuid": "^14.0.0"
     }
   }
 }

packages/api/package.json

@@ -19,10 +19,10 @@
     "db:studio": "drizzle-kit studio"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.922.0",
-    "@hono/node-server": "^1.14.0",
+    "@aws-sdk/client-s3": "^3.1035.0",
+    "@hono/node-server": "^1.19.14",
     "@hono/swagger-ui": "^0.6.1",
-    "@huggingface/transformers": "^3.0.0",
+    "@huggingface/transformers": "^4.2.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.72.0",
@@ -37,13 +37,14 @@
     "@x402/evm": "^2.0.4",
     "@x402/hono": "^2.0.4",
     "ajv": "^8.18.0",
-    "drizzle-orm": "^0.39.0",
-    "hono": "^4.7.0",
-    "isomorphic-dompurify": "^3.7.1",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.14",
+    "isomorphic-dompurify": "^3.10.0",
     "jose": "^6.0.0",
     "meilisearch": "^0.52.0",
     "nats": "^2.29.3",
     "pg": "^8.13.0",
+    "redis": "^5.12.1",
     "swarmdock-mcp": "^0.2.0",
     "tweetnacl": "^1.0.3",
     "tweetnacl-util": "^0.15.1",
@@ -56,6 +57,6 @@
     "typescript": "^5.8.0"
   },
   "optionalDependencies": {
-    "drizzle-kit": "^0.30.0"
+    "drizzle-kit": "^0.31.10"
   }
 }

packages/api/src/lib/pagination.ts

@@ -0,0 +1,37 @@
+export type PaginationOptions = {
+  defaultLimit?: number;
+  maxLimit?: number;
+};
+
+export type Pagination = {
+  limit: number;
+  offset: number;
+};
+
+export function parseBoundedInteger(
+  raw: string | null | undefined,
+  fallback: number,
+  min: number,
+  max: number,
+): number {
+  const parsed = raw?.trim() ? Number.parseInt(raw, 10) : fallback;
+  if (!Number.isFinite(parsed)) {
+    return fallback;
+  }
+
+  return Math.min(Math.max(parsed, min), max);
+}
+
+export function parsePagination(
+  limitRaw: string | null | undefined,
+  offsetRaw: string | null | undefined,
+  options: PaginationOptions = {},
+): Pagination {
+  const defaultLimit = options.defaultLimit ?? 20;
+  const maxLimit = options.maxLimit ?? 100;
+
+  return {
+    limit: parseBoundedInteger(limitRaw, defaultLimit, 1, maxLimit),
+    offset: parseBoundedInteger(offsetRaw, 0, 0, Number.MAX_SAFE_INTEGER),
+  };
+}

packages/api/src/lib/redis.ts

@@ -7,19 +7,98 @@ type RedisClient = {
   del(key: string | string[]): Promise<number>;
   incr(key: string): Promise<number>;
   expire(key: string, seconds: number): Promise<unknown>;
+  ttl?(key: string): Promise<number>;
   connect(): Promise<void>;
   on(event: string, handler: (...args: unknown[]) => void): void;
 };
 
 let client: RedisClient | null = null;
 let connectionAttempted = false;
 
+type UpstashResponse<T> = {
+  result?: T;
+  error?: string;
+};
+
+function createUpstashRestClient(url: string, token: string): RedisClient {
+  const endpoint = url.replace(/\/+$/, '');
+
+  async function command<T>(parts: Array<string | number>): Promise<T> {
+    const response = await fetch(endpoint, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(parts),
+    });
+
+    if (!response.ok) {
+      throw new Error(`Upstash Redis REST request failed: ${response.status}`);
+    }
+
+    const body = await response.json() as UpstashResponse<T>;
+    if (body.error) {
+      throw new Error(`Upstash Redis REST command failed: ${body.error}`);
+    }
+
+    return body.result as T;
+  }
+
+  return {
+    async get(key) {
+      const value = await command<string | null>(['GET', key]);
+      return value === null || value === undefined ? null : String(value);
+    },
+    async set(key, value, options) {
+      const parts: Array<string | number> = ['SET', key, value];
+      if (options?.EX) {
+        parts.push('EX', options.EX);
+      }
+      if (options?.NX) {
+        parts.push('NX');
+      }
+      return command<string | null>(parts);
+    },
+    async del(key) {
+      const keys = Array.isArray(key) ? key : [key];
+      return Number(await command<number>(['DEL', ...keys]));
+    },
+    async incr(key) {
+      return Number(await command<number>(['INCR', key]));
+    },
+    async expire(key, seconds) {
+      return command<number>(['EXPIRE', key, seconds]);
+    },
+    async ttl(key) {
+      return Number(await command<number>(['TTL', key]));
+    },
+    async connect() {
+      return undefined;
+    },
+    on() {
+      return undefined;
+    },
+  };
+}
+
 export async function getRedisClient(): Promise<RedisClient | null> {
   if (client) return client;
   if (connectionAttempted) return null;
 
   connectionAttempted = true;
 
+  const upstashUrl = process.env.UPSTASH_REDIS_REST_URL?.trim();
+  const upstashToken = process.env.UPSTASH_REDIS_REST_TOKEN?.trim();
+  if (upstashUrl && upstashToken) {
+    client = createUpstashRestClient(upstashUrl, upstashToken);
+    return client;
+  }
+
+  if (upstashUrl || upstashToken) {
+    console.error('[REDIS] UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN must both be configured');
+  }
+
   const url = process.env.REDIS_URL;
   if (!url) return null;
 
@@ -95,7 +174,8 @@ export async function redisTtl(key: string): Promise<number> {
   const c = await getRedisClient();
   if (!c) return -1;
   try {
-    return await (c as unknown as { ttl(key: string): Promise<number> }).ttl(key);
+    if (!c.ttl) return -1;
+    return await c.ttl(key);
   } catch (err) {
     console.error('[REDIS] TTL error:', err);
     return -1;
@@ -135,3 +215,8 @@ export async function redisReleaseLock(key: string, token: string): Promise<void
     console.error('[REDIS] lock release error:', err);
   }
 }
+
+export function resetRedisClientForTests(): void {
+  client = null;
+  connectionAttempted = false;
+}

packages/api/src/routes/admin.ts

@@ -1,7 +1,7 @@
 import { Hono, type Context } from 'hono';
 import { db } from '../db/client.js';
 import { agents, tasks, escrowTransactions, transactions, agentRatings, disputes, anomalyEvents, agentReputation } from '../db/schema.js';
-import { eq, sql, count, desc, and } from 'drizzle-orm';
+import { eq, sql, count, desc, and, inArray } from 'drizzle-orm';
 import { timingSafeEqual } from 'node:crypto';
 import { createMiddleware } from 'hono/factory';
 import { HTTPException } from 'hono/http-exception';
@@ -35,6 +35,24 @@ const adminAuth = createMiddleware(async (c, next) => {
 
 const ADMIN_LIST_MAX_LIMIT = 200;
 const ADMIN_LIST_DEFAULT_LIMIT = 50;
+export const TRIBUNAL_SELECTABLE_STATUSES = [
+  DISPUTE_STATUS.OPEN,
+  DISPUTE_STATUS.ESCALATED,
+] as const;
+export const ADMIN_RESOLVABLE_DISPUTE_STATUSES = [
+  DISPUTE_STATUS.OPEN,
+  DISPUTE_STATUS.ESCALATED,
+  DISPUTE_STATUS.TRIBUNAL,
+  DISPUTE_STATUS.ADMIN_REQUIRED,
+] as const;
+
+export function isDisputeStatusSelectableForTribunal(status: string): boolean {
+  return (TRIBUNAL_SELECTABLE_STATUSES as readonly string[]).includes(status);
+}
+
+export function isDisputeStatusResolvableByAdmin(status: string): boolean {
+  return (ADMIN_RESOLVABLE_DISPUTE_STATUSES as readonly string[]).includes(status);
+}
 
 function parseListLimit(raw: string | undefined): number {
   const parsed = parseInt(raw ?? String(ADMIN_LIST_DEFAULT_LIMIT), 10);
@@ -199,31 +217,42 @@ app.get('/disputes', adminAuth, async (c) => {
   });
 });
 
-// GET /api/v1/admin/disputes/:id/tribunal — Trigger tribunal selection
-app.get('/disputes/:id/tribunal', adminAuth, async (c) => {
+// GET /api/v1/admin/disputes/:id/tribunal — Deprecated: use POST for state changes
+app.get('/disputes/:id/tribunal', adminAuth, (c) =>
+  c.json({ error: 'Use POST /api/v1/admin/disputes/:id/tribunal to select tribunal judges' }, 405),
+);
+
+// POST /api/v1/admin/disputes/:id/tribunal — Trigger tribunal selection
+app.post('/disputes/:id/tribunal', adminAuth, async (c) => {
   const id = c.req.param('id');
 
   const [dispute] = await db
     .select()
     .from(disputes)
-    .where(and(eq(disputes.id, id), eq(disputes.status, DISPUTE_STATUS.OPEN)))
+    .where(eq(disputes.id, id))
     .limit(1);
 
   if (!dispute) {
-    return c.json({ error: 'Open dispute not found' }, 404);
+    return c.json({ error: 'Dispute not found' }, 404);
+  }
+  if (!isDisputeStatusSelectableForTribunal(dispute.status)) {
+    return c.json({ error: `Dispute is not selectable for tribunal in status: ${dispute.status}` }, 409);
   }
 
   const tribunalAgents = await selectTribunalJudges(dispute.id);
-
   const [updatedDispute] = await db
-    .update(disputes)
-    .set({
-      status: DISPUTE_STATUS.TRIBUNAL,
-      tribunalAgents,
-      updatedAt: new Date(),
-    })
+    .select()
+    .from(disputes)
     .where(eq(disputes.id, id))
-    .returning();
+    .limit(1);
+
+  if (tribunalAgents.length === 0) {
+    return c.json({
+      dispute: updatedDispute,
+      tribunalAgents,
+      error: 'Not enough eligible judges; admin resolution required',
+    }, 409);
+  }
 
   // Notify tribunal agents
   for (const agentId of tribunalAgents) {
@@ -248,11 +277,11 @@ app.post('/disputes/:id/resolve', adminAuth, async (c) => {
   const [dispute] = await db
     .select()
     .from(disputes)
-    .where(and(eq(disputes.id, id), eq(disputes.status, DISPUTE_STATUS.OPEN)))
+    .where(and(eq(disputes.id, id), inArray(disputes.status, [...ADMIN_RESOLVABLE_DISPUTE_STATUSES])))
     .limit(1);
 
   if (!dispute) {
-    return c.json({ error: 'Open dispute not found' }, 404);
+    return c.json({ error: 'Resolvable dispute not found' }, 404);
   }
 
   const [task] = await db.select().from(tasks).where(eq(tasks.id, dispute.taskId)).limit(1);

packages/api/src/routes/bids.ts

@@ -1,14 +1,15 @@
 import { Hono } from 'hono';
 import { db, type Database } from '../db/client.js';
 import { tasks, taskBids, escrowTransactions } from '../db/schema.js';
-import { eq, and, ne, sql } from 'drizzle-orm';
+import { eq, and, ne, sql, desc, count } from 'drizzle-orm';
 import { authMiddleware, optionalAuthMiddleware, requireScope, type AuthContext } from '../middleware/auth.js';
 import { BidCreateSchema, TASK_STATUS, BID_STATUS, ESCROW_STATUS } from '@swarmdock/shared';
 import { eventBus } from '../lib/events.js';
 import { getX402Network, microUsdcToUsdPrice, requireX402Payment } from '../services/x402.js';
 import { createSimulatedTxHash } from '../services/escrow.js';
 import { canReadTask } from './task-access.js';
 import { sanitizeFreeText } from '../lib/sanitize.js';
+import { parsePagination } from '../lib/pagination.js';
 
 type BidContext = AuthContext & { Variables: AuthContext['Variables'] };
 
@@ -120,8 +121,17 @@ export function createBidsApp(overrides: Partial<BidRouteDeps> = {}) {
       return c.json({ error: 'Task not found' }, 404);
     }
 
-    const bids = await database.select().from(taskBids).where(eq(taskBids.taskId, taskId));
-    return c.json({ bids });
+    const { limit, offset } = parsePagination(c.req.query('limit'), c.req.query('offset'));
+    const [{ total }] = await database.select({ total: count() }).from(taskBids).where(eq(taskBids.taskId, taskId));
+    const bids = await database
+      .select()
+      .from(taskBids)
+      .where(eq(taskBids.taskId, taskId))
+      .orderBy(desc(taskBids.createdAt))
+      .limit(limit)
+      .offset(offset);
+
+    return c.json({ bids, limit, offset, total: Number(total) });
   });
 
   // POST /api/v1/tasks/:taskId/bids/:bidId/accept — Accept bid

packages/api/src/routes/docs.ts

@@ -378,8 +378,9 @@ const spec = {
       post: { tags: ['A2A'], summary: 'Send message via relay', security: [{ bearerAuth: [] }], responses: { 201: { description: 'Message sent' } } },
     },
     // ── MCP ──
-    '/agents/{id}/mcp': {
-      post: { tags: ['MCP'], summary: 'Proxy MCP tool calls to agent', parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }], responses: { 200: { description: 'MCP response' } } },
+    '/mcp': {
+      get: { tags: ['MCP'], summary: 'MCP health probe', responses: { 200: { description: 'MCP endpoint metadata' } } },
+      post: { tags: ['MCP'], summary: 'Hosted MCP streamable HTTP endpoint', security: [{ bearerAuth: [] }], responses: { 200: { description: 'MCP response' }, 401: { description: 'Missing or invalid bearer credential' } } },
     },
     // ── Admin ──
     '/api/v1/admin/stats': {
@@ -394,6 +395,9 @@ const spec = {
     '/api/v1/admin/disputes': {
       get: { tags: ['Admin'], summary: 'List disputes', security: [{ adminKey: [] }], parameters: [{ name: 'status', in: 'query', schema: { type: 'string' } }], responses: { 200: { description: 'Dispute list' } } },
     },
+    '/api/v1/admin/disputes/{id}/tribunal': {
+      post: { tags: ['Admin'], summary: 'Select tribunal judges for a dispute', security: [{ adminKey: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }], responses: { 200: { description: 'Tribunal selected' }, 409: { description: 'Dispute needs admin resolution or cannot enter tribunal' } } },
+    },
     '/api/v1/admin/disputes/{id}/resolve': {
       post: { tags: ['Admin'], summary: 'Resolve a dispute', security: [{ adminKey: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }], responses: { 200: { description: 'Dispute resolved' } } },
     },