@castlekit/castle 0.3.1 → 0.4.0

package/.next/standalone/src/app/api/openclaw/session/status/route.ts

@@ -0,0 +1,210 @@
+import { NextRequest, NextResponse } from "next/server";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import { getOpenClawDir } from "@/lib/config";
+import { sanitizeForApi } from "@/lib/api-security";
+import type { SessionStatus } from "@/lib/types/chat";
+import JSON5 from "json5";
+
+// ============================================================================
+// GET /api/openclaw/session/status?sessionKey=X — Real session stats
+//
+// Reads directly from the OpenClaw session store on the filesystem.
+// This is the source of truth — the same data the Gateway uses.
+// ============================================================================
+
+export const dynamic = "force-dynamic";
+
+/**
+ * OpenClaw's default context window when nothing is configured.
+ * Matches DEFAULT_CONTEXT_TOKENS in the Gateway source (2e5 = 200,000).
+ */
+const OPENCLAW_DEFAULT_CONTEXT_TOKENS = 200_000;
+
+/**
+ * Parse a session key like "agent:main:castle:2d16fadb-..." to extract the agent ID.
+ * Format: agent:<agentId>:<channel>:<channelId>
+ */
+function parseAgentId(sessionKey: string): string | null {
+  const parts = sessionKey.split(":");
+  // agent:<agentId>:...
+  if (parts[0] === "agent" && parts.length >= 2) {
+    return parts[1];
+  }
+  return null;
+}
+
+/**
+ * Load a session entry from the OpenClaw session store.
+ * Reads ~/.openclaw/agents/<agentId>/sessions/sessions.json
+ */
+function loadSessionEntry(
+  sessionKey: string,
+  agentId: string
+): Record<string, unknown> | null {
+  const openclawDir = getOpenClawDir();
+  const storePath = join(openclawDir, "agents", agentId, "sessions", "sessions.json");
+
+  if (!existsSync(storePath)) {
+    return null;
+  }
+
+  try {
+    const raw = readFileSync(storePath, "utf-8");
+    const store = JSON.parse(raw) as Record<string, Record<string, unknown>>;
+    return store[sessionKey] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the effective context window limit from OpenClaw config.
+ *
+ * Resolution order (matches Gateway logic):
+ *   1. agents.<agentId>.contextTokens  (per-agent override)
+ *   2. agents.defaults.contextTokens   (global default)
+ *   3. OPENCLAW_DEFAULT_CONTEXT_TOKENS  (200k — Gateway hardcoded default)
+ *
+ * Note: The session entry's `contextTokens` stores the MODEL's max context
+ * (e.g. 1M for Sonnet 4.5) which is NOT the operating limit. The real limit
+ * is set in config or defaults to 200k.
+ */
+function resolveEffectiveContextLimit(agentId: string): number {
+  const openclawDir = getOpenClawDir();
+  const configPaths = [
+    join(openclawDir, "openclaw.json"),
+    join(openclawDir, "openclaw.json5"),
+  ];
+
+  for (const configPath of configPaths) {
+    if (!existsSync(configPath)) continue;
+    try {
+      const raw = readFileSync(configPath, "utf-8");
+      const config = JSON5.parse(raw) as Record<string, unknown>;
+      const agents = config.agents as Record<string, unknown> | undefined;
+      if (!agents) continue;
+
+      // 1. Per-agent override: agents.<agentId>.contextTokens
+      const agentCfg = agents[agentId] as Record<string, unknown> | undefined;
+      if (agentCfg?.contextTokens && typeof agentCfg.contextTokens === "number") {
+        return agentCfg.contextTokens;
+      }
+
+      // 2. Global default: agents.defaults.contextTokens
+      const defaults = agents.defaults as Record<string, unknown> | undefined;
+      if (defaults?.contextTokens && typeof defaults.contextTokens === "number") {
+        return defaults.contextTokens;
+      }
+    } catch {
+      // Continue to next config path
+    }
+  }
+
+  // 3. Fallback: OpenClaw's hardcoded default
+  return OPENCLAW_DEFAULT_CONTEXT_TOKENS;
+}
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const sessionKey = searchParams.get("sessionKey");
+
+  if (!sessionKey) {
+    return NextResponse.json(
+      { error: "sessionKey is required" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const agentId = parseAgentId(sessionKey);
+    if (!agentId) {
+      return NextResponse.json(
+        { error: "Could not parse agentId from sessionKey" },
+        { status: 400 }
+      );
+    }
+
+    const entry = loadSessionEntry(sessionKey, agentId);
+    if (!entry) {
+      console.log(`[Session Status] No session data for key=${sessionKey} agent=${agentId}`);
+      return new NextResponse(null, { status: 204 });
+    }
+
+    // Map the raw SessionEntry to our SessionStatus type
+    const inputTokens = (entry.inputTokens as number) ?? 0;
+    const outputTokens = (entry.outputTokens as number) ?? 0;
+    const totalTokens = (entry.totalTokens as number) ?? 0;
+
+    // The session entry's contextTokens is the MODEL's max (e.g. 1M for Sonnet 4.5).
+    // The real operating limit comes from config or defaults to 200k.
+    const modelMaxContext = (entry.contextTokens as number) ?? 0;
+    const effectiveLimit = resolveEffectiveContextLimit(agentId);
+    const percentage = effectiveLimit > 0
+      ? Math.round((totalTokens / effectiveLimit) * 100)
+      : 0;
+
+    // Extract system prompt report if available
+    const spr = entry.systemPromptReport as Record<string, unknown> | undefined;
+    let systemPrompt: SessionStatus["systemPrompt"] = undefined;
+
+    if (spr) {
+      const sp = spr.systemPrompt as Record<string, number> | undefined;
+      const skills = spr.skills as Record<string, unknown> | undefined;
+      const tools = spr.tools as Record<string, unknown> | undefined;
+      const files = spr.injectedWorkspaceFiles as Array<Record<string, unknown>> | undefined;
+
+      systemPrompt = {
+        totalChars: sp?.chars ?? 0,
+        projectContextChars: sp?.projectContextChars ?? 0,
+        nonProjectContextChars: sp?.nonProjectContextChars ?? 0,
+        skills: {
+          promptChars: (skills?.promptChars as number) ?? 0,
+          count: Array.isArray(skills?.entries) ? (skills.entries as unknown[]).length : 0,
+        },
+        tools: {
+          listChars: (tools?.listChars as number) ?? 0,
+          schemaChars: (tools?.schemaChars as number) ?? 0,
+          count: Array.isArray(tools?.entries) ? (tools.entries as unknown[]).length : 0,
+        },
+        workspaceFiles: (files ?? []).map((f) => ({
+          name: (f.name as string) ?? "",
+          injectedChars: (f.injectedChars as number) ?? 0,
+          truncated: (f.truncated as boolean) ?? false,
+        })),
+      };
+    }
+
+    const result: SessionStatus = {
+      sessionKey,
+      sessionId: (entry.sessionId as string) ?? "",
+      agentId,
+      model: (entry.model as string) ?? "unknown",
+      modelProvider: (entry.modelProvider as string) ?? "unknown",
+      tokens: {
+        input: inputTokens,
+        output: outputTokens,
+        total: totalTokens,
+      },
+      context: {
+        used: totalTokens,
+        limit: effectiveLimit,
+        modelMax: modelMaxContext,
+        percentage: Math.min(percentage, 100),
+      },
+      compactions: (entry.compactionCount as number) ?? 0,
+      thinkingLevel: (entry.thinkingLevel as string) ?? null,
+      updatedAt: (entry.updatedAt as number) ?? 0,
+      systemPrompt,
+    };
+
+    return NextResponse.json(result);
+  } catch (err) {
+    const message = (err as Error).message;
+    console.error("[Session Status] Failed:", message);
+    return NextResponse.json(
+      { error: sanitizeForApi(message) },
+      { status: 502 }
+    );
+  }
+}

package/.next/standalone/src/app/api/openclaw/sessions/route.ts

@@ -0,0 +1,64 @@
+import { NextResponse } from "next/server";
+import { readdirSync, readFileSync, existsSync, statSync } from "fs";
+import { join, basename } from "path";
+import { getOpenClawDir } from "@/lib/config";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * GET /api/openclaw/sessions
+ * God mode: reads session files directly from ~/.openclaw/ filesystem.
+ * Returns a list of sessions with basic metadata.
+ */
+export async function GET() {
+  const openclawDir = getOpenClawDir();
+  const agentsDir = join(openclawDir, "agents");
+
+  if (!existsSync(agentsDir)) {
+    return NextResponse.json({ sessions: [] });
+  }
+
+  try {
+    const sessions: Array<{
+      agentId: string;
+      sessionId: string;
+      sizeBytes: number;
+      modifiedAt: string;
+    }> = [];
+
+    // Scan all agent directories
+    const agentDirs = readdirSync(agentsDir, { withFileTypes: true })
+      .filter((d) => d.isDirectory());
+
+    for (const agentDir of agentDirs) {
+      const sessionsDir = join(agentsDir, agentDir.name, "sessions");
+      if (!existsSync(sessionsDir)) continue;
+
+      const files = readdirSync(sessionsDir)
+        .filter((f) => f.endsWith(".jsonl"));
+
+      for (const file of files) {
+        const filePath = join(sessionsDir, file);
+        const stat = statSync(filePath);
+        sessions.push({
+          agentId: agentDir.name,
+          sessionId: basename(file, ".jsonl"),
+          sizeBytes: stat.size,
+          modifiedAt: stat.mtime.toISOString(),
+        });
+      }
+    }
+
+    // Sort by most recently modified
+    sessions.sort((a, b) => new Date(b.modifiedAt).getTime() - new Date(a.modifiedAt).getTime());
+
+    console.log(`[Sessions API] GET OK — ${sessions.length} sessions`);
+    return NextResponse.json({ sessions });
+  } catch (err) {
+    console.error("[Sessions API] GET FAILED:", err instanceof Error ? err.message : "Unknown error");
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Failed to read sessions" },
+      { status: 500 }
+    );
+  }
+}

package/.next/standalone/src/app/api/settings/avatar/route.ts

@@ -0,0 +1,190 @@
+import { NextRequest, NextResponse } from "next/server";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, unlinkSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import sharp from "sharp";
+import { setSetting } from "@/lib/db/queries";
+import { checkCsrf, checkRateLimit, rateLimitKey } from "@/lib/api-security";
+
+export const dynamic = "force-dynamic";
+
+const MAX_UPLOAD_SIZE = 5 * 1024 * 1024; // 5MB raw upload limit
+const AVATAR_SIZE = 256; // px (square)
+const MAX_OUTPUT_SIZE = 100 * 1024; // 100KB after processing
+
+const ALLOWED_TYPES = new Set([
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+  "image/gif",
+]);
+
+const AVATARS_DIR = join(homedir(), ".castle", "avatars");
+
+/**
+ * Resize and compress an avatar image to 256x256, under 100KB.
+ */
+async function processAvatar(input: Buffer): Promise<{ data: Buffer; ext: string }> {
+  const processed = sharp(input).resize(AVATAR_SIZE, AVATAR_SIZE, {
+    fit: "cover",
+    position: "centre",
+  });
+
+  // Try PNG first (transparency support)
+  let data = await processed.png({ quality: 80, compressionLevel: 9 }).toBuffer();
+  if (data.length <= MAX_OUTPUT_SIZE) return { data, ext: ".png" };
+
+  // WebP (better compression, keeps transparency)
+  data = await processed.webp({ quality: 80 }).toBuffer();
+  if (data.length <= MAX_OUTPUT_SIZE) return { data, ext: ".webp" };
+
+  // JPEG with lower quality
+  data = await processed.jpeg({ quality: 70 }).toBuffer();
+  if (data.length <= MAX_OUTPUT_SIZE) return { data, ext: ".jpg" };
+
+  // Last resort
+  data = await processed.jpeg({ quality: 40 }).toBuffer();
+  return { data, ext: ".jpg" };
+}
+
+// ============================================================================
+// GET /api/settings/avatar — Serve user avatar
+// ============================================================================
+
+const MIME_TYPES: Record<string, string> = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+};
+
+export async function GET() {
+  if (!existsSync(AVATARS_DIR)) {
+    return new NextResponse(null, { status: 404 });
+  }
+
+  // Find user avatar file
+  const files = readdirSync(AVATARS_DIR).filter((f) => f.startsWith("user."));
+  if (files.length === 0) {
+    return new NextResponse(null, { status: 404 });
+  }
+
+  const filePath = join(AVATARS_DIR, files[0]);
+  const data = readFileSync(filePath);
+  const ext = filePath.substring(filePath.lastIndexOf(".")).toLowerCase();
+  const contentType = MIME_TYPES[ext] || "image/png";
+
+  return new NextResponse(data, {
+    headers: {
+      "Content-Type": contentType,
+      "Cache-Control": "public, max-age=60",
+    },
+  });
+}
+
+// ============================================================================
+// POST /api/settings/avatar — Upload user avatar
+// ============================================================================
+
+export async function POST(request: NextRequest) {
+  const csrfError = checkCsrf(request);
+  if (csrfError) return csrfError;
+
+  // Rate limit: 10 avatar uploads per minute
+  const rl = checkRateLimit(rateLimitKey(request, "avatar:upload"), 10);
+  if (rl) return rl;
+
+  const formData = await request.formData();
+  const file = formData.get("avatar") as File | null;
+
+  if (!file) {
+    return NextResponse.json({ error: "No file provided" }, { status: 400 });
+  }
+
+  if (!ALLOWED_TYPES.has(file.type)) {
+    return NextResponse.json(
+      { error: "Unsupported format. Use PNG, JPEG, WebP, or GIF." },
+      { status: 400 }
+    );
+  }
+
+  if (file.size > MAX_UPLOAD_SIZE) {
+    return NextResponse.json(
+      { error: "File too large (max 5MB)" },
+      { status: 400 }
+    );
+  }
+
+  // Process image
+  let processed: { data: Buffer; ext: string };
+  try {
+    const rawBuffer = Buffer.from(await file.arrayBuffer());
+    processed = await processAvatar(rawBuffer);
+  } catch (err) {
+    return NextResponse.json(
+      { error: `Failed to process image: ${err instanceof Error ? err.message : "unknown"}` },
+      { status: 400 }
+    );
+  }
+
+  // Remove any existing user avatar files
+  try {
+    mkdirSync(AVATARS_DIR, { recursive: true, mode: 0o755 });
+    if (existsSync(AVATARS_DIR)) {
+      const existing = readdirSync(AVATARS_DIR).filter((f) => f.startsWith("user."));
+      for (const f of existing) {
+        unlinkSync(join(AVATARS_DIR, f));
+      }
+    }
+  } catch {
+    // silent
+  }
+
+  // Save new avatar
+  const fileName = `user${processed.ext}`;
+  const filePath = join(AVATARS_DIR, fileName);
+
+  try {
+    writeFileSync(filePath, processed.data);
+  } catch (err) {
+    return NextResponse.json(
+      { error: `Failed to save avatar: ${err instanceof Error ? err.message : "unknown"}` },
+      { status: 500 }
+    );
+  }
+
+  // Store the avatar path with a version timestamp for cache-busting
+  setSetting("avatarPath", `${fileName}?t=${Date.now()}`);
+
+  return NextResponse.json({
+    success: true,
+    avatar: `/api/settings/avatar?t=${Date.now()}`,
+    size: processed.data.length,
+  });
+}
+
+// ============================================================================
+// DELETE /api/settings/avatar — Remove user avatar
+// ============================================================================
+
+export async function DELETE(request: NextRequest) {
+  const csrfError = checkCsrf(request);
+  if (csrfError) return csrfError;
+
+  try {
+    if (existsSync(AVATARS_DIR)) {
+      const existing = readdirSync(AVATARS_DIR).filter((f) => f.startsWith("user."));
+      for (const f of existing) {
+        unlinkSync(join(AVATARS_DIR, f));
+      }
+    }
+    setSetting("avatarPath", "");
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    return NextResponse.json(
+      { error: `Failed to remove avatar: ${err instanceof Error ? err.message : "unknown"}` },
+      { status: 500 }
+    );
+  }
+}

package/.next/standalone/src/app/api/settings/route.ts

@@ -0,0 +1,88 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getAllSettings, setSetting } from "@/lib/db/queries";
+import { checkCsrf } from "@/lib/api-security";
+
+// Known setting keys and their validation
+const VALID_KEYS: Record<string, { maxLength: number }> = {
+  displayName: { maxLength: 100 },
+  avatarPath: { maxLength: 255 },
+  tooltips: { maxLength: 5 }, // "true" or "false"
+};
+
+// ============================================================================
+// GET /api/settings — Get all settings
+// ============================================================================
+
+export async function GET() {
+  try {
+    const all = getAllSettings();
+    return NextResponse.json(all);
+  } catch (err) {
+    console.error("[Settings] GET failed:", (err as Error).message);
+    return NextResponse.json(
+      { error: "Failed to load settings" },
+      { status: 500 }
+    );
+  }
+}
+
+// ============================================================================
+// POST /api/settings — Update one or more settings
+// ============================================================================
+
+export async function POST(request: NextRequest) {
+  const csrfError = checkCsrf(request);
+  if (csrfError) return csrfError;
+
+  let body: Record<string, string>;
+
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
+  if (!body || typeof body !== "object") {
+    return NextResponse.json({ error: "Body must be an object" }, { status: 400 });
+  }
+
+  try {
+    for (const [key, value] of Object.entries(body)) {
+      // Validate key
+      if (!VALID_KEYS[key]) {
+        return NextResponse.json(
+          { error: `Unknown setting: ${key}` },
+          { status: 400 }
+        );
+      }
+
+      // Validate value type
+      if (typeof value !== "string") {
+        return NextResponse.json(
+          { error: `Setting "${key}" must be a string` },
+          { status: 400 }
+        );
+      }
+
+      // Validate length
+      const trimmed = value.trim();
+      if (trimmed.length > VALID_KEYS[key].maxLength) {
+        return NextResponse.json(
+          { error: `Setting "${key}" must be at most ${VALID_KEYS[key].maxLength} characters` },
+          { status: 400 }
+        );
+      }
+
+      setSetting(key, trimmed);
+    }
+
+    const all = getAllSettings();
+    return NextResponse.json(all);
+  } catch (err) {
+    console.error("[Settings] POST failed:", (err as Error).message);
+    return NextResponse.json(
+      { error: "Failed to save settings" },
+      { status: 500 }
+    );
+  }
+}

package/.next/standalone/src/app/chat/[channelId]/error-boundary.tsx

@@ -0,0 +1,64 @@
+"use client";
+
+import React from "react";
+import { AlertTriangle, RefreshCw } from "lucide-react";
+import { Button } from "@/components/ui/button";
+
+interface ErrorBoundaryState {
+  hasError: boolean;
+  error?: Error;
+}
+
+interface ErrorBoundaryProps {
+  children: React.ReactNode;
+}
+
+export class ChatErrorBoundary extends React.Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  constructor(props: ErrorBoundaryProps) {
+    super(props);
+    this.state = { hasError: false };
+  }
+
+  static getDerivedStateFromError(error: Error): ErrorBoundaryState {
+    return { hasError: true, error };
+  }
+
+  componentDidCatch(error: Error, info: React.ErrorInfo) {
+    console.error("[Chat Error Boundary]", error, info.componentStack);
+  }
+
+  handleRetry = () => {
+    this.setState({ hasError: false, error: undefined });
+  };
+
+  render() {
+    if (this.state.hasError) {
+      return (
+        <div className="flex-1 flex items-center justify-center p-8">
+          <div className="text-center space-y-4 max-w-md">
+            <AlertTriangle className="h-10 w-10 mx-auto text-warning" />
+            <div>
+              <h3 className="text-lg font-semibold text-foreground">
+                Something went wrong
+              </h3>
+              <p className="text-sm text-foreground-secondary mt-1">
+                The chat encountered an unexpected error. Your messages are safe in the database.
+              </p>
+              {this.state.error && (
+                <p className="text-xs text-foreground-secondary/60 mt-2 font-mono">
+                  {this.state.error.message}
+                </p>
+              )}
+            </div>
+            <Button onClick={this.handleRetry} variant="primary" size="sm">
+              <RefreshCw className="h-4 w-4 mr-2" />
+              Try Again
+            </Button>
+          </div>
+        </div>
+      );
+    }
+
+    return this.props.children;
+  }
+}