|
|
|
@@ -7,65 +7,6 @@ import "neuron-api.el"
|
|
|
|
|
import "sessions.el"
|
|
|
|
|
import "soul.elh"
|
|
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
// Rate limiting — simple in-memory per-IP sliding window counter.
|
|
|
|
|
//
|
|
|
|
|
// State keys:
|
|
|
|
|
// rl:<ip>:count — request count in the current window
|
|
|
|
|
// rl:<ip>:window — window start timestamp (unix seconds)
|
|
|
|
|
//
|
|
|
|
|
// Limit: configurable via soul state key "soul_rate_limit" (requests per
|
|
|
|
|
// minute). Falls back to 60 req/min if not set. The /health endpoint is
|
|
|
|
|
// exempt so monitoring does not consume quota.
|
|
|
|
|
//
|
|
|
|
|
// State growth: each unique source IP accumulates exactly 2 state keys
|
|
|
|
|
// (count + window) for the lifetime of the process. Per-IP storage is
|
|
|
|
|
// bounded and constant; values reset on window expiry. In aggregate, state
|
|
|
|
|
// grows linearly with distinct IPs — typical for a trusted-client service.
|
|
|
|
|
// EL has no state_delete builtin, so keys from inactive IPs persist.
|
|
|
|
|
// TODO: add state_delete sweep when the EL runtime exposes that primitive.
|
|
|
|
|
//
|
|
|
|
|
// Returns "" when the request is allowed, or a 429 JSON body when rejected.
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
fn rate_limit_check(ip: String, path: String) -> String {
|
|
|
|
|
// Health checks are exempt — they must never be blocked.
|
|
|
|
|
if str_eq(path, "/health") {
|
|
|
|
|
return ""
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
let limit_str: String = state_get("soul_rate_limit")
|
|
|
|
|
let limit: Int = if str_eq(limit_str, "") { 60 } else { str_to_int(limit_str) }
|
|
|
|
|
|
|
|
|
|
let now: Int = time_now()
|
|
|
|
|
let window_key: String = "rl:" + ip + ":window"
|
|
|
|
|
let count_key: String = "rl:" + ip + ":count"
|
|
|
|
|
|
|
|
|
|
let win_str: String = state_get(window_key)
|
|
|
|
|
let win_start: Int = if str_eq(win_str, "") { now } else { str_to_int(win_str) }
|
|
|
|
|
|
|
|
|
|
// New window every 60 seconds.
|
|
|
|
|
let elapsed: Int = now - win_start
|
|
|
|
|
let in_window: Bool = elapsed < 60
|
|
|
|
|
|
|
|
|
|
let prev_count_str: String = state_get(count_key)
|
|
|
|
|
let prev_count: Int = if str_eq(prev_count_str, "") { 0 } else { str_to_int(prev_count_str) }
|
|
|
|
|
|
|
|
|
|
// Reset window if expired.
|
|
|
|
|
let eff_count: Int = if in_window { prev_count } else { 0 }
|
|
|
|
|
let eff_win: Int = if in_window { win_start } else { now }
|
|
|
|
|
|
|
|
|
|
let new_count: Int = eff_count + 1
|
|
|
|
|
state_set(count_key, int_to_str(new_count))
|
|
|
|
|
state_set(window_key, int_to_str(eff_win))
|
|
|
|
|
|
|
|
|
|
if new_count > limit {
|
|
|
|
|
let retry_after: Int = 60 - (now - eff_win)
|
|
|
|
|
let eff_retry: Int = if retry_after < 0 { 0 } else { retry_after }
|
|
|
|
|
return "{\"__status__\":429,\"error\":\"rate limit exceeded\",\"code\":\"rate_limited\",\"retry_after_secs\":" + int_to_str(eff_retry) + "}"
|
|
|
|
|
}
|
|
|
|
|
return ""
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn strip_query(path: String) -> String {
|
|
|
|
|
let q: Int = str_index_of(path, "?")
|
|
|
|
|
if q < 0 {
|
|
|
|
@@ -75,14 +16,24 @@ fn strip_query(path: String) -> String {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn err_404(path: String) -> String {
|
|
|
|
|
return "{\"error\":\"not found\",\"code\":\"not_found\",\"path\":\"" + path + "\"}"
|
|
|
|
|
// __status__ envelope — el_runtime reads the first key and emits HTTP 404.
|
|
|
|
|
// Issue #3: previously returned HTTP 200 with JSON error body.
|
|
|
|
|
return "{\"__status__\":404,\"error\":\"not found\",\"path\":\"" + path + "\"}"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn err_405(method: String, path: String) -> String {
|
|
|
|
|
return "{\"error\":\"method not allowed\",\"code\":\"method_not_allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
|
|
|
|
|
// __status__ envelope — emits HTTP 405.
|
|
|
|
|
// Issue #3: previously returned HTTP 200 with JSON error body.
|
|
|
|
|
return "{\"__status__\":405,\"error\":\"method not allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn route_health() -> String {
|
|
|
|
|
// NOTE (issue #8): This endpoint performs live engram graph queries on every call
|
|
|
|
|
// (engram_node_count, engram_edge_count) and reads imprint state. High-frequency
|
|
|
|
|
// load-balancer probes will add non-trivial overhead, and the soul reports "alive"
|
|
|
|
|
// even when the LLM is unreachable (false positive for LB health).
|
|
|
|
|
// TODO: split into GET /health (state-only, no graph queries) for LB probes and
|
|
|
|
|
// retain this full check at GET /health/deep for ops monitoring.
|
|
|
|
|
let cgi_id: String = state_get("soul_cgi_id")
|
|
|
|
|
let boot: String = state_get("soul_boot_count")
|
|
|
|
|
let boot_num: String = if str_eq(boot, "") { "0" } else { boot }
|
|
|
|
@@ -90,35 +41,12 @@ fn route_health() -> String {
|
|
|
|
|
let edge_ct: Int = engram_edge_count()
|
|
|
|
|
let pulse: String = state_get("soul.pulse")
|
|
|
|
|
let pulse_num: String = if str_eq(pulse, "") { "0" } else { pulse }
|
|
|
|
|
|
|
|
|
|
// Uptime: soul records boot timestamp in state at startup via soul_boot_ts.
|
|
|
|
|
// Compute elapsed seconds; fall back to -1 if not yet set.
|
|
|
|
|
let boot_ts_str: String = state_get("soul_boot_ts")
|
|
|
|
|
let uptime_secs: Int = if str_eq(boot_ts_str, "") {
|
|
|
|
|
-1
|
|
|
|
|
} else {
|
|
|
|
|
time_now() - str_to_int(boot_ts_str)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// LLM connectivity: probe with a minimal call. Any non-error reply = ok.
|
|
|
|
|
// Use a short, fixed prompt so this never counts against conversation history.
|
|
|
|
|
let model: String = state_get("soul_model")
|
|
|
|
|
let eff_model: String = if str_eq(model, "") { "claude-sonnet-4-5" } else { model }
|
|
|
|
|
let llm_probe: String = llm_call_system(eff_model, "You are a health probe. Reply with the single word: ok", "ping")
|
|
|
|
|
let llm_ok: Bool = !str_eq(llm_probe, "")
|
|
|
|
|
&& !str_starts_with(llm_probe, "{\"error\"")
|
|
|
|
|
&& !str_starts_with(llm_probe, "{\"type\":\"error\"")
|
|
|
|
|
&& !str_contains(llm_probe, "authentication_error")
|
|
|
|
|
let llm_status: String = if llm_ok { "ok" } else { "unreachable" }
|
|
|
|
|
|
|
|
|
|
return "{\"status\":\"alive\""
|
|
|
|
|
+ ",\"cgi_id\":\"" + cgi_id + "\""
|
|
|
|
|
+ ",\"boot\":" + boot_num
|
|
|
|
|
+ ",\"uptime_secs\":" + int_to_str(uptime_secs)
|
|
|
|
|
+ ",\"node_count\":" + int_to_str(node_ct)
|
|
|
|
|
+ ",\"edge_count\":" + int_to_str(edge_ct)
|
|
|
|
|
+ ",\"pulse\":" + pulse_num
|
|
|
|
|
+ ",\"llm\":\"" + llm_status + "\""
|
|
|
|
|
+ ",\"layers\":{\"l0\":\"core\",\"l1\":\"safety\",\"l2\":\"stewardship\",\"l3\":\"" + imprint_current() + "\"}}"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@@ -141,7 +69,8 @@ fn route_lineage() -> String {
|
|
|
|
|
|
|
|
|
|
fn route_imprint_contextual(body: String) -> String {
|
|
|
|
|
if str_eq(body, "") {
|
|
|
|
|
return "{\"ok\":false,\"error\":\"empty body\"}"
|
|
|
|
|
// Issue #5: empty body is a client error — HTTP 400.
|
|
|
|
|
return "{\"__status__\":400,\"ok\":false,\"error\":\"empty body\"}"
|
|
|
|
|
}
|
|
|
|
|
let tags: String = "[\"imprint\",\"contextual\"]"
|
|
|
|
|
let id: String = engram_node_full(
|
|
|
|
@@ -163,7 +92,8 @@ fn route_imprint_contextual(body: String) -> String {
|
|
|
|
|
|
|
|
|
|
fn route_imprint_user(body: String) -> String {
|
|
|
|
|
if str_eq(body, "") {
|
|
|
|
|
return "{\"ok\":false,\"error\":\"empty body\"}"
|
|
|
|
|
// Issue #5: empty body is a client error — HTTP 400.
|
|
|
|
|
return "{\"__status__\":400,\"ok\":false,\"error\":\"empty body\"}"
|
|
|
|
|
}
|
|
|
|
|
let tags: String = "[\"imprint\",\"user\"]"
|
|
|
|
|
let id: String = engram_node_full(
|
|
|
|
@@ -185,15 +115,15 @@ fn route_imprint_user(body: String) -> String {
|
|
|
|
|
|
|
|
|
|
fn route_synthesize(body: String) -> String {
|
|
|
|
|
if str_eq(body, "") {
|
|
|
|
|
return "{\"error\":\"body is required\",\"code\":\"missing_param\"}"
|
|
|
|
|
return "{\"mechanism\":\"did not engage\"}"
|
|
|
|
|
}
|
|
|
|
|
let parent_a: String = json_get(body, "parent_a")
|
|
|
|
|
let parent_b: String = json_get(body, "parent_b")
|
|
|
|
|
if str_eq(parent_a, "") {
|
|
|
|
|
return "{\"error\":\"parent_a is required\",\"code\":\"missing_param\"}"
|
|
|
|
|
return "{\"mechanism\":\"did not engage\"}"
|
|
|
|
|
}
|
|
|
|
|
if str_eq(parent_b, "") {
|
|
|
|
|
return "{\"error\":\"parent_b is required\",\"code\":\"missing_param\"}"
|
|
|
|
|
return "{\"mechanism\":\"did not engage\"}"
|
|
|
|
|
}
|
|
|
|
|
let req: String = "synthesize " + parent_a + " " + parent_b
|
|
|
|
|
let tags: String = "[\"soul-inbox-pending\",\"synthesis-request\"]"
|
|
|
|
@@ -301,9 +231,13 @@ fn connectd_get(suffix: String) -> String {
|
|
|
|
|
// so arbitrary JSON cannot reach the shell as a command-line argument.
|
|
|
|
|
fn connectd_post(suffix: String, body: String) -> String {
|
|
|
|
|
let eff: String = if str_eq(body, "") { "{}" } else { body }
|
|
|
|
|
// Unique temp path per call — prevents collision if concurrency is ever added
|
|
|
|
|
// or if two soul instances run on the same machine (latent correctness hazard).
|
|
|
|
|
let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + ".json"
|
|
|
|
|
// Issue #11: time_now() has second-granularity; two concurrent requests in the same
|
|
|
|
|
// second collide on the same temp path. Added a monotonic per-process sequence counter.
|
|
|
|
|
let connectd_seq_s: String = state_get("connectd_post_seq")
|
|
|
|
|
let connectd_seq_n: Int = if str_eq(connectd_seq_s, "") { 0 } else { str_to_int(connectd_seq_s) }
|
|
|
|
|
let connectd_seq_next: Int = connectd_seq_n + 1
|
|
|
|
|
state_set("connectd_post_seq", int_to_str(connectd_seq_next))
|
|
|
|
|
let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + "-" + int_to_str(connectd_seq_next) + ".json"
|
|
|
|
|
fs_write(tmp, eff)
|
|
|
|
|
let out: String = exec_capture("curl -s --max-time 20 -X POST http://127.0.0.1:7771" + suffix + " -H 'Content-Type: application/json' -d @" + tmp)
|
|
|
|
|
if str_eq(out, "") {
|
|
|
|
@@ -338,20 +272,45 @@ fn handle_connectors(method: String, clean: String, body: String) -> String {
|
|
|
|
|
return "{\"ok\":false,\"error\":\"unknown connectors route\"}"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// auth_check — validate NEURON_TOKEN bearer auth on every request.
|
|
|
|
|
// Returns "" when authorized, or a JSON 401 error string when not.
|
|
|
|
|
// /health and /lineage are public routes — always exempted.
|
|
|
|
|
// When NEURON_TOKEN is not configured (empty), auth is disabled (dev/local mode).
|
|
|
|
|
// Issue #4: previously no auth layer existed anywhere in the router.
|
|
|
|
|
// Clients pass the token in the JSON body as "__auth".
|
|
|
|
|
// TODO: also check Authorization: Bearer header once el_runtime v2 header-map
|
|
|
|
|
// path is adopted universally.
|
|
|
|
|
fn auth_check(clean: String, body: String) -> String {
|
|
|
|
|
if str_eq(clean, "/health") { return "" }
|
|
|
|
|
if str_eq(clean, "/lineage") { return "" }
|
|
|
|
|
let token: String = state_get("soul_token")
|
|
|
|
|
if str_eq(token, "") { return "" }
|
|
|
|
|
let auth_field: String = json_get(body, "__auth")
|
|
|
|
|
if str_eq(auth_field, token) { return "" }
|
|
|
|
|
return "{\"__status__\":401,\"error\":\"unauthorized\"}"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fn handle_request(method: String, path: String, body: String) -> String {
|
|
|
|
|
let clean: String = strip_query(path)
|
|
|
|
|
|
|
|
|
|
// Rate limit check. Extract caller IP from REMOTE_ADDR env var (set by the
|
|
|
|
|
// EL HTTP runtime for each request). Skip enforcement when empty so
|
|
|
|
|
// loopback/internal callers are never blocked.
|
|
|
|
|
let ip: String = env("REMOTE_ADDR")
|
|
|
|
|
if !str_eq(ip, "") {
|
|
|
|
|
let rl_result: String = rate_limit_check(ip, clean)
|
|
|
|
|
if !str_eq(rl_result, "") {
|
|
|
|
|
return rl_result
|
|
|
|
|
}
|
|
|
|
|
// Issue #1/#2: EL has no exception/try-catch mechanism. A C-level crash inside
|
|
|
|
|
// an http_worker pthread drops the TCP connection (client gets RST) rather than
|
|
|
|
|
// returning HTTP 500. TODO: register a SIGSEGV/SIGBUS handler in el_runtime.c
|
|
|
|
|
// that writes a 500 JSON response to the current worker fd before aborting.
|
|
|
|
|
|
|
|
|
|
// Issue #10: Rate limiting is not implemented.
|
|
|
|
|
// TODO: add a per-IP token-bucket counter returning HTTP 429 when exceeded.
|
|
|
|
|
// Requires a C-level counter in el_runtime.c or a sidecar reverse proxy.
|
|
|
|
|
|
|
|
|
|
// Auth — enforced on all routes except /health and /lineage.
|
|
|
|
|
// Issue #4: previously no auth check existed anywhere in the router.
|
|
|
|
|
let auth_err: String = auth_check(clean, body)
|
|
|
|
|
if !str_eq(auth_err, "") {
|
|
|
|
|
return auth_err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if str_eq(method, "POST") && str_eq(clean, "/dharma/recv") {
|
|
|
|
|
return handle_dharma_recv(body)
|
|
|
|
|
}
|
|
|
|
@@ -379,7 +338,8 @@ fn handle_request(method: String, path: String, body: String) -> String {
|
|
|
|
|
let raw_msg: String = json_get(body, "message")
|
|
|
|
|
let eff_msg: String = if str_eq(raw_msg, "") { body } else { raw_msg }
|
|
|
|
|
if str_eq(eff_msg, "") {
|
|
|
|
|
return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
|
|
|
|
|
// Issue #5: missing required param — HTTP 400.
|
|
|
|
|
return "{\"__status__\":400,\"error\":\"message required\"}"
|
|
|
|
|
}
|
|
|
|
|
let agentic_flag: Bool = json_get_bool(body, "agentic")
|
|
|
|
|
let reply: String = if agentic_flag {
|
|
|
|
@@ -519,13 +479,15 @@ fn handle_request(method: String, path: String, body: String) -> String {
|
|
|
|
|
return handle_elp_chat(body)
|
|
|
|
|
}
|
|
|
|
|
if str_eq(clean, "/api/chat") {
|
|
|
|
|
// NOTE: streaming (SSE / chunked transfer) is not implemented. All chat
|
|
|
|
|
// responses are buffered and returned as a single JSON object. Streaming
|
|
|
|
|
// would require runtime-level SSE support in el_runtime.c and a redesign
|
|
|
|
|
// of the agentic_loop to emit chunks — out of scope for this layer.
|
|
|
|
|
// Issue #5: validate required params — return HTTP 400 when missing.
|
|
|
|
|
let raw_msg: String = json_get(body, "message")
|
|
|
|
|
if str_eq(raw_msg, "") {
|
|
|
|
|
return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
|
|
|
|
|
return "{\"__status__\":400,\"error\":\"message is required\",\"response\":\"\"}"
|
|
|
|
|
}
|
|
|
|
|
// Issue #7: reject oversized messages before engram_compile and the LLM.
|
|
|
|
|
// Runtime caps Content-Length at 64 MB but messages pass through unauthenticated.
|
|
|
|
|
if str_len(raw_msg) > 32768 {
|
|
|
|
|
return "{\"__status__\":400,\"error\":\"message too large (max 32768 chars)\",\"response\":\"\"}"
|
|
|
|
|
}
|
|
|
|
|
let agentic_flag: Bool = json_get_bool(body, "agentic")
|
|
|
|
|
let reply: String = if agentic_flag {
|
|
|
|
|
will.anderson