@castlekit/castle 0.3.1 → 0.4.0

package/.next/standalone/src/app/api/openclaw/events/route.ts

@@ -0,0 +1,140 @@
+import { ensureGateway, type GatewayEvent } from "@/lib/gateway-connection";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+/**
+ * Strip sensitive fields (tokens, keys) from event payloads
+ * before forwarding to the browser.
+ */
+function redactEventPayload(evt: GatewayEvent): GatewayEvent {
+  if (!evt.payload || typeof evt.payload !== "object") return evt;
+
+  const payload = { ...(evt.payload as Record<string, unknown>) };
+
+  // Redact deviceToken from pairing events
+  if (typeof payload.deviceToken === "string") {
+    payload.deviceToken = "[REDACTED]";
+  }
+  // Redact nested auth.deviceToken
+  if (payload.auth && typeof payload.auth === "object") {
+    const auth = { ...(payload.auth as Record<string, unknown>) };
+    if (typeof auth.deviceToken === "string") auth.deviceToken = "[REDACTED]";
+    if (typeof auth.token === "string") auth.token = "[REDACTED]";
+    payload.auth = auth;
+  }
+  // Redact any top-level token field
+  if (typeof payload.token === "string") {
+    payload.token = "[REDACTED]";
+  }
+
+  return { ...evt, payload };
+}
+
+/**
+ * GET /api/openclaw/events
+ * SSE endpoint -- streams OpenClaw Gateway events to the browser in real-time.
+ * Browser connects once via EventSource and receives push updates.
+ */
+export async function GET(request: Request) {
+  const gw = ensureGateway();
+
+  const encoder = new TextEncoder();
+  let closed = false;
+  const connectedAt = Date.now();
+  let eventCount = 0;
+
+  console.log(`[SSE] Client connected (gateway: ${gw.state})`);
+
+  // Use the request's AbortSignal as the primary cleanup mechanism.
+  // ReadableStream.cancel() is unreliable in some environments.
+  const signal = request.signal;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      // Send initial state
+      const initial = {
+        event: "castle.state",
+        payload: {
+          state: gw.state,
+          isConnected: gw.isConnected,
+          server: gw.serverInfo,
+        },
+      };
+      controller.enqueue(encoder.encode(`data: ${JSON.stringify(initial)}\n\n`));
+
+      // Forward gateway events (with sensitive fields redacted)
+      const onGatewayEvent = (evt: GatewayEvent) => {
+        if (closed) return;
+        eventCount++;
+        try {
+          const safe = redactEventPayload(evt);
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(safe)}\n\n`));
+        } catch (err) {
+          console.warn(`[SSE] Stream write failed for event ${evt.event}:`, (err as Error).message);
+          cleanup();
+        }
+      };
+
+      // Forward state changes
+      const onStateChange = (state: string) => {
+        if (closed) return;
+        try {
+          const msg = {
+            event: "castle.state",
+            payload: {
+              state,
+              isConnected: gw.isConnected,
+              server: gw.serverInfo,
+            },
+          };
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(msg)}\n\n`));
+        } catch {
+          cleanup();
+        }
+      };
+
+      // Heartbeat to keep connection alive
+      const heartbeat = setInterval(() => {
+        if (closed) return;
+        try {
+          controller.enqueue(encoder.encode(`: heartbeat\n\n`));
+        } catch {
+          cleanup();
+        }
+      }, 30000);
+
+      gw.on("gatewayEvent", onGatewayEvent);
+      gw.on("stateChange", onStateChange);
+
+      // Cleanup: remove listeners, stop heartbeat
+      const cleanup = () => {
+        if (closed) return; // prevent double cleanup
+        closed = true;
+        const duration = Math.round((Date.now() - connectedAt) / 1000);
+        console.log(`[SSE] Client disconnected (${duration}s, ${eventCount} events forwarded)`);
+        clearInterval(heartbeat);
+        gw.off("gatewayEvent", onGatewayEvent);
+        gw.off("stateChange", onStateChange);
+      };
+
+      // Primary cleanup: request.signal fires when client disconnects
+      signal.addEventListener("abort", cleanup, { once: true });
+
+      // Store for cancel callback as fallback
+      (controller as unknown as { _cleanup: () => void })._cleanup = cleanup;
+    },
+    cancel(controller) {
+      const cleanup = (controller as unknown as { _cleanup: () => void })._cleanup;
+      if (cleanup) cleanup();
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+    },
+  });
+}

package/.next/standalone/src/app/api/openclaw/logs/route.ts

@@ -0,0 +1,74 @@
+import { NextRequest, NextResponse } from "next/server";
+import { readFileSync, existsSync, readdirSync } from "fs";
+import { join, resolve } from "path";
+import { getOpenClawDir } from "@/lib/config";
+import { sanitizeForApi } from "@/lib/api-security";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * GET /api/openclaw/logs?lines=100&file=gateway
+ * God mode: reads log files from ~/.openclaw/logs/
+ */
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const rawLines = parseInt(searchParams.get("lines") || "100", 10);
+  const lines = Math.min(Math.max(1, Number.isFinite(rawLines) ? rawLines : 100), 10000);
+  const rawFile = searchParams.get("file")?.trim() || "gateway";
+
+  // Sanitize file parameter: only allow alphanumeric, hyphens, underscores, dots
+  // Reject anything with path separators or traversal patterns
+  const file = rawFile.replace(/[^a-zA-Z0-9._-]/g, "");
+  if (!file || file.includes("..") || file !== rawFile) {
+    return NextResponse.json(
+      { error: "Invalid log file name" },
+      { status: 400 }
+    );
+  }
+
+  const logsDir = join(getOpenClawDir(), "logs");
+
+  if (!existsSync(logsDir)) {
+    return NextResponse.json({ logs: [], error: "No logs directory found" });
+  }
+
+  // List available log files
+  const availableFiles = existsSync(logsDir)
+    ? readdirSync(logsDir).filter((f) => f.endsWith(".log"))
+    : [];
+
+  // Find matching log file — must match prefix exactly within the logs directory
+  const logFile = availableFiles.find((f) => f.startsWith(file));
+  if (!logFile) {
+    return NextResponse.json({
+      logs: [],
+      available: availableFiles,
+      error: `Log file '${file}' not found`,
+    });
+  }
+
+  try {
+    const logPath = join(logsDir, logFile);
+    // Final safety check: resolved path must be inside the logs directory
+    if (!resolve(logPath).startsWith(resolve(logsDir))) {
+      return NextResponse.json({ error: "Invalid log file path" }, { status: 400 });
+    }
+    const content = readFileSync(logPath, "utf-8");
+    const allLines = content.split("\n").filter(Boolean);
+
+    // Return last N lines, sanitized to strip tokens/keys
+    const tailLines = allLines.slice(-lines).map(sanitizeForApi);
+
+    return NextResponse.json({
+      logs: tailLines,
+      file: logFile,
+      totalLines: allLines.length,
+      available: availableFiles,
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Failed to read logs" },
+      { status: 500 }
+    );
+  }
+}

package/.next/standalone/src/app/api/openclaw/ping/route.ts

@@ -0,0 +1,73 @@
+import { NextResponse } from "next/server";
+import { ensureGateway } from "@/lib/gateway-connection";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * POST /api/openclaw/ping
+ * Health check -- tests connection to OpenClaw Gateway
+ */
+export async function POST() {
+  const gw = ensureGateway();
+
+  if (!gw.isConfigured) {
+    return NextResponse.json({
+      ok: false,
+      configured: false,
+      error: "No OpenClaw token found. Run 'castle setup' or check ~/.openclaw/openclaw.json",
+    });
+  }
+
+  // If not connected yet, give it a moment to complete handshake
+  if (gw.state === "connecting") {
+    await new Promise<void>((resolve) => {
+      const timeout = setTimeout(resolve, 5000);
+      const onState = () => {
+        clearTimeout(timeout);
+        gw.off("stateChange", onState);
+        resolve();
+      };
+      gw.on("stateChange", onState);
+    });
+  }
+
+  if (!gw.isConnected) {
+    return NextResponse.json({
+      ok: false,
+      configured: true,
+      state: gw.state,
+      error: gw.state === "error"
+        ? "Failed to connect to OpenClaw Gateway. Is it running?"
+        : "Connecting to OpenClaw Gateway...",
+    });
+  }
+
+  try {
+    const start = Date.now();
+    await gw.request("health", {});
+    const latency = Date.now() - start;
+
+    if (latency > 1000) {
+      console.warn(`[Ping] Health check slow: ${latency}ms`);
+    }
+
+    return NextResponse.json({
+      ok: true,
+      configured: true,
+      latency_ms: latency,
+      server: gw.serverInfo,
+    });
+  } catch (err) {
+    console.error("[Ping] Health check failed:", err instanceof Error ? err.message : "Unknown error");
+    return NextResponse.json({
+      ok: false,
+      configured: true,
+      error: err instanceof Error ? err.message : "Health check failed",
+    });
+  }
+}
+
+// Allow GET for easy status checks
+export async function GET() {
+  return POST();
+}

package/.next/standalone/src/app/api/openclaw/restart/route.ts

@@ -0,0 +1,73 @@
+import { NextRequest, NextResponse } from "next/server";
+import { execSync } from "child_process";
+import { checkCsrf, checkRateLimit, rateLimitKey } from "@/lib/api-security";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * POST /api/openclaw/restart
+ * Restart the OpenClaw Gateway process.
+ * Protected against CSRF — only requests from the Castle UI are allowed.
+ */
+export async function POST(request: NextRequest) {
+  const csrf = checkCsrf(request);
+  if (csrf) return csrf;
+
+  // Rate limit: 5 restarts per minute
+  const rl = checkRateLimit(rateLimitKey(request, "restart"), 5);
+  if (rl) return rl;
+
+  try {
+    // Try openclaw CLI restart first
+    try {
+      execSync("openclaw gateway restart", {
+        timeout: 10000,
+        stdio: "pipe",
+      });
+      return NextResponse.json({
+        ok: true,
+        method: "openclaw gateway restart",
+      });
+    } catch {
+      // openclaw CLI not available or restart command failed
+    }
+
+    // Try stopping and starting via process signal
+    try {
+      const pids = execSync("pgrep -f 'openclaw.*gateway'", {
+        timeout: 5000,
+        stdio: "pipe",
+      })
+        .toString()
+        .trim()
+        .split(/\s+/)
+        .filter((p) => /^\d+$/.test(p));
+
+      const pid = pids[0];
+      if (pid) {
+        execSync(`kill -HUP ${pid}`, { timeout: 5000, stdio: "pipe" });
+        return NextResponse.json({
+          ok: true,
+          method: "SIGHUP",
+          pid: parseInt(pid, 10),
+        });
+      }
+    } catch {
+      // pgrep not available or no process found
+    }
+
+    return NextResponse.json(
+      {
+        ok: false,
+        error:
+          "Could not restart gateway. Try manually: openclaw gateway restart",
+      },
+      { status: 500 }
+    );
+  } catch (err) {
+    return NextResponse.json(
+      { ok: false, error: err instanceof Error ? err.message : "Restart failed" },
+      { status: 500 }
+    );
+  }
+}

package/.next/standalone/src/app/api/openclaw/session/context/route.ts

@@ -0,0 +1,163 @@
+import { NextRequest, NextResponse } from "next/server";
+import { ensureGateway } from "@/lib/gateway-connection";
+import { sanitizeForApi } from "@/lib/api-security";
+import {
+  getCompactionBoundary,
+  setCompactionBoundary,
+} from "@/lib/db/queries";
+
+// ============================================================================
+// Types
+// ============================================================================
+
+interface PreviewMessage {
+  role: string;
+  content?: string;
+  timestamp?: number;
+}
+
+interface PreviewResponse {
+  messages?: PreviewMessage[];
+  entries?: PreviewMessage[];
+}
+
+interface ContextBoundaryResponse {
+  /** ID of the oldest message still in the agent's context. Null if unknown. */
+  boundaryMessageId: string | null;
+  /** Whether the boundary was freshly determined (true) or loaded from cache (false). */
+  fresh: boolean;
+}
+
+// ============================================================================
+// GET /api/openclaw/session/context?sessionKey=X&channelId=Y
+//
+// Determines the compaction boundary: which messages the agent can "see".
+// Calls sessions.preview on the Gateway, matches against local DB, caches result.
+// ============================================================================
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const sessionKey = searchParams.get("sessionKey");
+  const channelId = searchParams.get("channelId");
+
+  if (!sessionKey) {
+    return NextResponse.json(
+      { error: "sessionKey is required" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    // First, check cached boundary
+    const cached = getCompactionBoundary(sessionKey);
+
+    // Try to get fresh boundary from Gateway
+    const gateway = ensureGateway();
+    let fresh = false;
+    let boundaryMessageId = cached;
+
+    try {
+      const preview = await gateway.request<PreviewResponse>(
+        "sessions.preview",
+        {
+          keys: [sessionKey],
+          limit: 100,
+          maxChars: 20000,
+        }
+      );
+
+      // The preview returns messages that the agent can currently see.
+      // Find the oldest message in the preview to determine the boundary.
+      const previewMessages = preview.messages || preview.entries || [];
+
+      if (previewMessages.length > 0 && channelId) {
+        // Import dynamically to avoid circular deps
+        const { getDb } = await import("@/lib/db/index");
+        const { messages } = await import("@/lib/db/schema");
+        const { eq, asc } = await import("drizzle-orm");
+
+        const db = getDb();
+
+        // Get oldest message timestamp from preview
+        const oldestPreview = previewMessages[0];
+        const oldestTimestamp = oldestPreview?.timestamp;
+
+        if (oldestTimestamp) {
+          // Find the Castle message closest to this timestamp
+          const localMessages = db
+            .select({ id: messages.id, createdAt: messages.createdAt })
+            .from(messages)
+            .where(eq(messages.channelId, channelId))
+            .orderBy(asc(messages.createdAt))
+            .all();
+
+          // Find the message with timestamp closest to the oldest preview message
+          let closestId: string | null = null;
+          let closestDiff = Infinity;
+          for (const msg of localMessages) {
+            const diff = Math.abs(msg.createdAt - oldestTimestamp);
+            if (diff < closestDiff) {
+              closestDiff = diff;
+              closestId = msg.id;
+            }
+          }
+
+          if (closestId && closestDiff < 60000) {
+            // Match within 60s tolerance
+            boundaryMessageId = closestId;
+            fresh = true;
+
+            // Cache it in the DB
+            setCompactionBoundary(sessionKey, closestId);
+          }
+        }
+      }
+    } catch (previewErr) {
+      // sessions.preview might not be available — fall back to cached
+      console.warn(
+        "[Session Context] sessions.preview failed, using cached boundary:",
+        (previewErr as Error).message
+      );
+    }
+
+    const response: ContextBoundaryResponse = {
+      boundaryMessageId,
+      fresh,
+    };
+
+    return NextResponse.json(response);
+  } catch (err) {
+    const message = (err as Error).message;
+    console.error("[Session Context] Failed:", message);
+    return NextResponse.json(
+      { error: sanitizeForApi(message) },
+      { status: 502 }
+    );
+  }
+}
+
+// ============================================================================
+// POST /api/openclaw/session/context — Update boundary after compaction event
+// ============================================================================
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+    const { sessionKey, boundaryMessageId } = body;
+
+    if (!sessionKey || !boundaryMessageId) {
+      return NextResponse.json(
+        { error: "sessionKey and boundaryMessageId are required" },
+        { status: 400 }
+      );
+    }
+
+    setCompactionBoundary(sessionKey, boundaryMessageId);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    return NextResponse.json(
+      { error: (err as Error).message },
+      { status: 500 }
+    );
+  }
+}