feat(ai/workflow): distributed workflow execution with multi-tenant isolation

src/ai/api.ts

@@ -0,0 +1,206 @@
+/**
+ * Context-Aware API Module
+ *
+ * Provides framework utilities that automatically use the current tenant context.
+ * Tools and workflows can import and use these without passing any context parameters.
+ *
+ * @example
+ * ```typescript
+ * import { api } from "veryfront/ai";
+ *
+ * const myTool = {
+ *   id: "fetch-file",
+ *   execute: async (input) => {
+ *     // Just use api - it automatically knows the current project
+ *     const content = await api.files.read(input.path);
+ *     return content;
+ *   },
+ * };
+ * ```
+ */
+
+import { getWorkflowTenant } from "./workflow/executor/step-executor.ts";
+import { getCurrentRequestContext } from "../platform/adapters/fs/veryfront/multi-project-adapter.ts";
+import { VeryfrontAPIClient } from "../platform/adapters/veryfront-api-client/client.ts";
+
+/**
+ * Validate that a project slug is safe and well-formed.
+ * Prevents path traversal and injection attacks.
+ *
+ * Valid slugs: alphanumeric characters, hyphens, underscores
+ * Max length: 128 characters
+ */
+function isValidProjectSlug(slug: string): boolean {
+  if (!slug || typeof slug !== "string") {
+    return false;
+  }
+
+  // Check length
+  if (slug.length > 128) {
+    return false;
+  }
+
+  // Only allow alphanumeric, hyphens, and underscores
+  // Must start with alphanumeric
+  const validSlugPattern = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+  return validSlugPattern.test(slug);
+}
+
+/**
+ * Get the current tenant context from either workflow execution or request context.
+ * @throws Error if no tenant context is available or if validation fails
+ */
+function getTenant() {
+  // Check workflow context first (for tool execution within workflows)
+  // Then fall back to request context (for direct API route calls)
+  const tenant = getWorkflowTenant() ?? getCurrentRequestContext();
+
+  if (!tenant) {
+    throw new Error(
+      "No tenant context available. " +
+        "This API must be called within a request or workflow execution. " +
+        "If you're calling this from a standalone script, you need to wrap " +
+        "your code with runWithContext() first.",
+    );
+  }
+
+  // Validate tenant fields to prevent injection attacks
+  if (!isValidProjectSlug(tenant.projectSlug)) {
+    throw new Error(
+      `Invalid project slug: "${tenant.projectSlug}". ` +
+        "Project slugs must be 1-128 characters, start with alphanumeric, " +
+        "and contain only alphanumeric characters, hyphens, or underscores.",
+    );
+  }
+
+  return tenant;
+}
+
+/**
+ * Create a VeryfrontAPIClient configured for the current tenant.
+ * Each call creates a new client instance configured with the current tenant's credentials.
+ */
+function getClient(): VeryfrontAPIClient {
+  const tenant = getTenant();
+
+  const client = new VeryfrontAPIClient({
+    apiBaseUrl: Deno.env.get("VERYFRONT_API_URL") || "https://api.veryfront.com",
+    proxyMode: true,
+    projectId: tenant.projectId,
+    projectSlug: tenant.projectSlug,
+  });
+
+  client.setRequestToken(tenant.token);
+  client.setProjectSlug(tenant.projectSlug);
+
+  return client;
+}
+
+/**
+ * Context-aware API that automatically uses the current tenant.
+ *
+ * All methods will throw an error if called outside of a request or workflow context.
+ */
+export const api = {
+  /**
+   * File operations for the current project
+   */
+  files: {
+    /**
+     * Read file content by path
+     * @param path - File path relative to project root (e.g., "/pages/index.tsx")
+     */
+    read: (path: string) => {
+      const tenant = getTenant();
+      return getClient().getFileContent(path, tenant.projectId);
+    },
+
+    /**
+     * List files in the project
+     * @param cursor - Pagination cursor
+     * @param limit - Maximum number of files to return
+     */
+    list: (cursor?: string, limit?: number) => {
+      const tenant = getTenant();
+      return getClient().listFiles(tenant.projectId, cursor, limit);
+    },
+
+    /**
+     * List all files in the project (handles pagination automatically)
+     */
+    listAll: () => {
+      const tenant = getTenant();
+      return getClient().listAllFiles(tenant.projectId);
+    },
+
+    /**
+     * Check if a file exists
+     * @param path - File path relative to project root
+     */
+    exists: (path: string) => {
+      const tenant = getTenant();
+      return getClient().fileExists(path, tenant.projectId);
+    },
+
+    /**
+     * Get file metadata
+     * @param path - File path relative to project root
+     */
+    metadata: (path: string) => {
+      const tenant = getTenant();
+      return getClient().getFileMetadata(path, tenant.projectId);
+    },
+
+    /**
+     * Search for files matching a pattern
+     * @param pattern - Search pattern (glob-like)
+     */
+    search: (pattern: string) => {
+      const tenant = getTenant();
+      return getClient().searchFiles(pattern, tenant.projectId);
+    },
+  },
+
+  /**
+   * Project operations
+   */
+  project: {
+    /**
+     * Get current project details
+     */
+    get: () => {
+      const tenant = getTenant();
+      if (!tenant.projectId) {
+        throw new Error("Project ID not available in current context");
+      }
+      return getClient().getProject(tenant.projectId);
+    },
+
+    /**
+     * Get the current project slug
+     */
+    slug: () => getTenant().projectSlug,
+
+    /**
+     * Get the current project ID (if available)
+     */
+    id: () => getTenant().projectId,
+
+    /**
+     * Check if running in production mode
+     */
+    isProduction: () => getTenant().productionMode,
+  },
+
+  /**
+   * Get the raw tenant context (for advanced use cases)
+   * @internal
+   */
+  _getTenant: getTenant,
+
+  /**
+   * Get a configured API client (for advanced use cases)
+   * @internal
+   */
+  _getClient: getClient,
+};

src/ai/index.ts

@@ -270,6 +270,25 @@ export type {
   WorkflowStatus,
 } from "./workflow/index.ts";
 
+// ============================================================================
+// Public API - Context-Aware Utilities
+// ============================================================================
+
+/**
+ * Context-aware API for accessing project resources.
+ * Automatically uses the current tenant context (from request or workflow execution).
+ *
+ * @example
+ * ```typescript
+ * import { api } from 'veryfront/ai';
+ *
+ * // In a tool or workflow step:
+ * const content = await api.files.read("/pages/index.tsx");
+ * const slug = api.project.slug();
+ * ```
+ */
+export { api } from "./api.ts";
+
 // ============================================================================
 // Public API - Types
 // ============================================================================

src/ai/mcp/server.ts

@@ -11,6 +11,7 @@ import { resourceRegistry } from "./resource.ts";
 import { promptRegistry } from "./prompt.ts";
 import type { MCPServerConfig } from "../types/mcp.ts";
 import { createError, toError } from "@veryfront/errors/veryfront-error.ts";
+import { runWithRequestContext } from "../../platform/adapters/fs/veryfront/multi-project-adapter.ts";
 
 /**
  * JSON-RPC 2.0 Params type
@@ -315,10 +316,18 @@ export class MCPServer {
         }
       }
 
+      // Extract tenant context from request headers (set by proxy)
+      const tenantContext = this.extractTenantFromRequest(request);
+
       // Parse JSON-RPC request
       try {
         const rpcRequest: JSONRPCRequest = await request.json();
-        const rpcResponse = await this.handleRequest(rpcRequest);
+
+        // Execute request within tenant context if available
+        // This enables tools to access project-scoped resources via the api module
+        const rpcResponse = tenantContext
+          ? await runWithRequestContext(tenantContext, () => this.handleRequest(rpcRequest))
+          : await this.handleRequest(rpcRequest);
 
         return new Response(JSON.stringify(rpcResponse), {
           headers: {
@@ -346,6 +355,38 @@ export class MCPServer {
     };
   }
 
+  /**
+   * Extract tenant context from request headers
+   * Returns undefined if required headers are missing
+   */
+  private extractTenantFromRequest(request: Request): {
+    projectSlug: string;
+    token: string;
+    projectId?: string;
+    productionMode?: boolean;
+    releaseId?: string | null;
+  } | undefined {
+    const token = request.headers.get("x-token");
+    const projectSlug = request.headers.get("x-project-slug");
+
+    // Both token and project slug are required for tenant context
+    if (!token || !projectSlug) {
+      return undefined;
+    }
+
+    const projectId = request.headers.get("x-project-id") || undefined;
+    const environment = request.headers.get("x-environment");
+    const releaseId = request.headers.get("x-release-id") || null;
+
+    return {
+      projectSlug,
+      token,
+      projectId,
+      productionMode: environment === "production",
+      releaseId,
+    };
+  }
+
   /**
    * Validate authentication
    */