@chrysb/alphaclaw 0.1.0

package/lib/server/constants.js

@@ -0,0 +1,282 @@
+const os = require("os");
+const path = require("path");
+
+const parsePositiveIntEnv = (value, fallbackValue) => {
+  const parsed = Number.parseInt(String(value || ""), 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackValue;
+};
+
+// Portable root directory: --root-dir flag sets ALPHACLAW_ROOT_DIR before require
+const kRootDir = process.env.ALPHACLAW_ROOT_DIR
+  || path.join(os.homedir(), ".alphaclaw");
+const kPackageRoot = path.resolve(__dirname, "..");
+const kSetupDir = path.join(kPackageRoot, "setup");
+
+const PORT = parseInt(process.env.PORT || "3000", 10);
+const GATEWAY_PORT = 18789;
+const GATEWAY_HOST = "127.0.0.1";
+const GATEWAY_URL = `http://${GATEWAY_HOST}:${GATEWAY_PORT}`;
+const OPENCLAW_DIR = path.join(kRootDir, ".openclaw");
+const GATEWAY_TOKEN = process.env.OPENCLAW_GATEWAY_TOKEN || "";
+const ENV_FILE_PATH = path.join(kRootDir, ".env");
+const WORKSPACE_DIR = path.join(OPENCLAW_DIR, "workspace");
+const AUTH_PROFILES_PATH = path.join(OPENCLAW_DIR, "agents", "main", "agent", "auth-profiles.json");
+const CODEX_PROFILE_ID = "openai-codex:codex-cli";
+const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const CODEX_OAUTH_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CODEX_OAUTH_REDIRECT_URI = "http://localhost:1455/auth/callback";
+const CODEX_OAUTH_SCOPE = "openid profile email offline_access";
+const CODEX_JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const kCodexOauthStateTtlMs = 10 * 60 * 1000;
+
+const kTrustProxyHops = parsePositiveIntEnv(process.env.TRUST_PROXY_HOPS, 1);
+const kLoginWindowMs = parsePositiveIntEnv(
+  process.env.LOGIN_RATE_WINDOW_MS,
+  10 * 60 * 1000,
+);
+const kLoginMaxAttempts = parsePositiveIntEnv(
+  process.env.LOGIN_RATE_MAX_ATTEMPTS,
+  5,
+);
+const kLoginBaseLockMs = parsePositiveIntEnv(
+  process.env.LOGIN_RATE_BASE_LOCK_MS,
+  60 * 1000,
+);
+const kLoginMaxLockMs = parsePositiveIntEnv(
+  process.env.LOGIN_RATE_MAX_LOCK_MS,
+  15 * 60 * 1000,
+);
+const kLoginCleanupIntervalMs = parsePositiveIntEnv(
+  process.env.LOGIN_RATE_CLEANUP_INTERVAL_MS,
+  60 * 1000,
+);
+const kLoginStateTtlMs = Math.max(
+  parsePositiveIntEnv(
+    process.env.LOGIN_RATE_STATE_TTL_MS,
+    Math.max(kLoginWindowMs, kLoginMaxLockMs) * 3,
+  ),
+  kLoginMaxLockMs,
+);
+
+const kOnboardingModelProviders = new Set([
+  "anthropic",
+  "openai",
+  "openai-codex",
+  "google",
+]);
+const kFallbackOnboardingModels = [
+  {
+    key: "anthropic/claude-opus-4-6",
+    provider: "anthropic",
+    label: "Claude Opus 4.6",
+  },
+  {
+    key: "anthropic/claude-sonnet-4-6",
+    provider: "anthropic",
+    label: "Claude Sonnet 4.6",
+  },
+  {
+    key: "anthropic/claude-haiku-4-6",
+    provider: "anthropic",
+    label: "Claude Haiku 4.6",
+  },
+  {
+    key: "openai-codex/gpt-5.3-codex",
+    provider: "openai-codex",
+    label: "Codex GPT-5.3",
+  },
+  {
+    key: "openai/gpt-5.1-codex",
+    provider: "openai",
+    label: "OpenAI GPT-5.1 Codex",
+  },
+  {
+    key: "google/gemini-3-pro-preview",
+    provider: "google",
+    label: "Gemini 3 Pro Preview",
+  },
+  {
+    key: "google/gemini-3-flash-preview",
+    provider: "google",
+    label: "Gemini 3 Flash Preview",
+  },
+];
+
+const kVersionCacheTtlMs = 60 * 1000;
+const kLatestVersionCacheTtlMs = 10 * 60 * 1000;
+const kOpenclawRegistryUrl = "https://registry.npmjs.org/openclaw";
+const kAppDir = kPackageRoot;
+
+const kSystemVars = new Set([
+  "WEBHOOK_TOKEN",
+  "OPENCLAW_GATEWAY_TOKEN",
+  "SETUP_PASSWORD",
+  "PORT",
+]);
+const kKnownVars = [
+  {
+    key: "ANTHROPIC_API_KEY",
+    label: "Anthropic API Key",
+    group: "models",
+    hint: "From console.anthropic.com",
+  },
+  {
+    key: "ANTHROPIC_TOKEN",
+    label: "Anthropic Setup Token",
+    group: "models",
+    hint: "From claude setup-token",
+  },
+  {
+    key: "OPENAI_API_KEY",
+    label: "OpenAI API Key",
+    group: "models",
+    hint: "From platform.openai.com",
+  },
+  {
+    key: "GEMINI_API_KEY",
+    label: "Gemini API Key",
+    group: "models",
+    hint: "From aistudio.google.com",
+  },
+  {
+    key: "GITHUB_TOKEN",
+    label: "GitHub Access Token",
+    group: "github",
+    hint: "Create one with repo scope at github.com/settings/tokens",
+  },
+  {
+    key: "GITHUB_WORKSPACE_REPO",
+    label: "Workspace Repo",
+    group: "github",
+    hint: "username/repo or https://github.com/username/repo",
+  },
+  {
+    key: "TELEGRAM_BOT_TOKEN",
+    label: "Telegram Bot Token",
+    group: "channels",
+    hint: "From @BotFather",
+  },
+  {
+    key: "DISCORD_BOT_TOKEN",
+    label: "Discord Bot Token",
+    group: "channels",
+    hint: "From Discord Developer Portal",
+  },
+  {
+    key: "BRAVE_API_KEY",
+    label: "Brave Search API Key",
+    group: "tools",
+    hint: "From brave.com/search/api",
+  },
+];
+const kKnownKeys = new Set(kKnownVars.map((v) => v.key));
+
+const SCOPE_MAP = {
+  "gmail:read": "https://www.googleapis.com/auth/gmail.readonly",
+  "gmail:write": "https://www.googleapis.com/auth/gmail.modify",
+  "calendar:read": "https://www.googleapis.com/auth/calendar.readonly",
+  "calendar:write": "https://www.googleapis.com/auth/calendar",
+  "tasks:read": "https://www.googleapis.com/auth/tasks.readonly",
+  "tasks:write": "https://www.googleapis.com/auth/tasks",
+  "docs:read": "https://www.googleapis.com/auth/documents.readonly",
+  "docs:write": "https://www.googleapis.com/auth/documents",
+  "meet:read": "https://www.googleapis.com/auth/meetings.space.readonly",
+  "meet:write": "https://www.googleapis.com/auth/meetings.space.created",
+  "drive:read": "https://www.googleapis.com/auth/drive.readonly",
+  "drive:write": "https://www.googleapis.com/auth/drive",
+  "contacts:read": "https://www.googleapis.com/auth/contacts.readonly",
+  "contacts:write": "https://www.googleapis.com/auth/contacts",
+  "sheets:read": "https://www.googleapis.com/auth/spreadsheets.readonly",
+  "sheets:write": "https://www.googleapis.com/auth/spreadsheets",
+};
+const REVERSE_SCOPE_MAP = Object.fromEntries(
+  Object.entries(SCOPE_MAP).map(([k, v]) => [v, k]),
+);
+const BASE_SCOPES = ["openid", "https://www.googleapis.com/auth/userinfo.email"];
+
+const GOG_CONFIG_DIR = path.join(OPENCLAW_DIR, "gogcli");
+const GOG_CREDENTIALS_PATH = path.join(GOG_CONFIG_DIR, "credentials.json");
+const GOG_STATE_PATH = path.join(GOG_CONFIG_DIR, "state.json");
+const GOG_KEYRING_PASSWORD =
+  process.env.GOG_KEYRING_PASSWORD || "alphaclaw";
+
+const API_TEST_COMMANDS = {
+  gmail: "gmail labels list",
+  calendar: "calendar calendars",
+  tasks: "tasks lists",
+  docs: "docs info __api_check__",
+  meet: "meet spaces list",
+  drive: "drive ls",
+  contacts: "contacts list",
+  sheets: "sheets metadata __api_check__",
+};
+
+const kChannelDefs = {
+  telegram: { envKey: "TELEGRAM_BOT_TOKEN" },
+  discord: { envKey: "DISCORD_BOT_TOKEN" },
+};
+
+const SETUP_API_PREFIXES = [
+  "/api/status",
+  "/api/pairings",
+  "/api/google",
+  "/api/codex",
+  "/api/models",
+  "/api/gateway",
+  "/api/onboard",
+  "/api/env",
+  "/api/auth",
+  "/api/openclaw",
+  "/api/devices",
+  "/api/sync-cron",
+];
+
+module.exports = {
+  kRootDir,
+  kPackageRoot,
+  kSetupDir,
+  PORT,
+  GATEWAY_PORT,
+  GATEWAY_HOST,
+  GATEWAY_URL,
+  OPENCLAW_DIR,
+  GATEWAY_TOKEN,
+  ENV_FILE_PATH,
+  WORKSPACE_DIR,
+  AUTH_PROFILES_PATH,
+  CODEX_PROFILE_ID,
+  CODEX_OAUTH_CLIENT_ID,
+  CODEX_OAUTH_AUTHORIZE_URL,
+  CODEX_OAUTH_TOKEN_URL,
+  CODEX_OAUTH_REDIRECT_URI,
+  CODEX_OAUTH_SCOPE,
+  CODEX_JWT_CLAIM_PATH,
+  kCodexOauthStateTtlMs,
+  kTrustProxyHops,
+  kLoginWindowMs,
+  kLoginMaxAttempts,
+  kLoginBaseLockMs,
+  kLoginMaxLockMs,
+  kLoginCleanupIntervalMs,
+  kLoginStateTtlMs,
+  kOnboardingModelProviders,
+  kFallbackOnboardingModels,
+  kVersionCacheTtlMs,
+  kLatestVersionCacheTtlMs,
+  kOpenclawRegistryUrl,
+  kAppDir,
+  kSystemVars,
+  kKnownVars,
+  kKnownKeys,
+  SCOPE_MAP,
+  REVERSE_SCOPE_MAP,
+  BASE_SCOPES,
+  GOG_CONFIG_DIR,
+  GOG_CREDENTIALS_PATH,
+  GOG_STATE_PATH,
+  GOG_KEYRING_PASSWORD,
+  API_TEST_COMMANDS,
+  kChannelDefs,
+  SETUP_API_PREFIXES,
+};

package/lib/server/env.js

@@ -0,0 +1,78 @@
+const fs = require("fs");
+const { ENV_FILE_PATH, kKnownVars } = require("./constants");
+
+const readEnvFile = () => {
+  try {
+    const content = fs.readFileSync(ENV_FILE_PATH, "utf8");
+    const vars = [];
+    for (const line of content.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eqIdx = trimmed.indexOf("=");
+      if (eqIdx === -1) continue;
+      vars.push({
+        key: trimmed.slice(0, eqIdx),
+        value: trimmed.slice(eqIdx + 1),
+      });
+    }
+    return vars;
+  } catch {
+    return [];
+  }
+};
+
+const writeEnvFile = (vars) => {
+  const lines = [];
+  for (const { key, value } of vars || []) {
+    if (!key) continue;
+    lines.push(`${key}=${String(value || "")}`);
+  }
+  fs.writeFileSync(ENV_FILE_PATH, lines.join("\n"));
+};
+
+const reloadEnv = () => {
+  const vars = readEnvFile();
+  const fileKeys = new Set(vars.map((v) => v.key));
+  let changed = false;
+
+  for (const { key, value } of vars) {
+    if (value && value !== process.env[key]) {
+      console.log(
+        `[wrapper] Env updated: ${key}=${key.toLowerCase().includes("token") || key.toLowerCase().includes("key") || key.toLowerCase().includes("password") ? "***" : value}`,
+      );
+      process.env[key] = value;
+      changed = true;
+    } else if (!value && process.env[key]) {
+      console.log(`[wrapper] Env cleared: ${key}`);
+      delete process.env[key];
+      changed = true;
+    }
+  }
+
+  const allKnownKeys = kKnownVars.map((v) => v.key);
+  for (const key of allKnownKeys) {
+    if (!fileKeys.has(key) && process.env[key]) {
+      console.log(`[wrapper] Env removed: ${key}`);
+      delete process.env[key];
+      changed = true;
+    }
+  }
+
+  return changed;
+};
+
+const startEnvWatcher = () => {
+  try {
+    fs.watchFile(ENV_FILE_PATH, { interval: 2000 }, () => {
+      console.log(`[wrapper] ${ENV_FILE_PATH} changed externally, reloading...`);
+      reloadEnv();
+    });
+  } catch {}
+};
+
+module.exports = {
+  readEnvFile,
+  writeEnvFile,
+  reloadEnv,
+  startEnvWatcher,
+};

package/lib/server/gateway.js

@@ -0,0 +1,262 @@
+const { spawn, execSync } = require("child_process");
+const fs = require("fs");
+const net = require("net");
+const { OPENCLAW_DIR, GATEWAY_HOST, GATEWAY_PORT, kChannelDefs, kRootDir } = require("./constants");
+
+let gatewayChild = null;
+
+const gatewayEnv = () => ({
+  ...process.env,
+  OPENCLAW_HOME: kRootDir,
+  OPENCLAW_CONFIG_PATH: `${OPENCLAW_DIR}/openclaw.json`,
+  XDG_CONFIG_HOME: OPENCLAW_DIR,
+});
+
+const isOnboarded = () => fs.existsSync(`${OPENCLAW_DIR}/openclaw.json`);
+
+const isGatewayRunning = () =>
+  new Promise((resolve) => {
+    const sock = net.createConnection(GATEWAY_PORT, GATEWAY_HOST);
+    sock.setTimeout(1000);
+    sock.on("connect", () => {
+      sock.destroy();
+      resolve(true);
+    });
+    sock.on("error", () => resolve(false));
+    sock.on("timeout", () => {
+      sock.destroy();
+      resolve(false);
+    });
+  });
+
+const runGatewayCmd = (cmd) => {
+  console.log(`[wrapper] Running: openclaw gateway ${cmd}`);
+  try {
+    const out = execSync(`openclaw gateway ${cmd}`, {
+      env: gatewayEnv(),
+      timeout: 15000,
+      encoding: "utf8",
+    });
+    if (out.trim()) console.log(`[wrapper] ${out.trim()}`);
+  } catch (e) {
+    if (e.stdout?.trim())
+      console.log(`[wrapper] gateway ${cmd} stdout: ${e.stdout.trim()}`);
+    if (e.stderr?.trim())
+      console.log(`[wrapper] gateway ${cmd} stderr: ${e.stderr.trim()}`);
+    if (!e.stdout?.trim() && !e.stderr?.trim())
+      console.log(`[wrapper] gateway ${cmd} error: ${e.message}`);
+    console.log(`[wrapper] gateway ${cmd} exit code: ${e.status}`);
+  }
+};
+
+const launchGatewayProcess = () => {
+  if (gatewayChild && gatewayChild.exitCode === null && !gatewayChild.killed) {
+    console.log("[wrapper] Managed gateway process already running — skipping launch");
+    return;
+  }
+  const child = spawn("openclaw", ["gateway", "run"], {
+    env: gatewayEnv(),
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+  gatewayChild = child;
+  child.stdout.on("data", (d) => process.stdout.write(`[gateway] ${d}`));
+  child.stderr.on("data", (d) => process.stderr.write(`[gateway] ${d}`));
+  child.on("exit", (code) => {
+    console.log(`[wrapper] Gateway launcher exited with code ${code}`);
+    if (gatewayChild === child) gatewayChild = null;
+  });
+};
+
+const startGateway = async () => {
+  if (!isOnboarded()) {
+    console.log("[wrapper] Not onboarded yet — skipping gateway start");
+    return;
+  }
+  if (await isGatewayRunning()) {
+    console.log("[wrapper] Gateway already running — skipping start");
+    return;
+  }
+  console.log("[wrapper] Starting openclaw gateway...");
+  launchGatewayProcess();
+};
+
+const restartGateway = (reloadEnv) => {
+  reloadEnv();
+  if (gatewayChild && gatewayChild.exitCode === null && !gatewayChild.killed) {
+    console.log("[wrapper] Stopping managed gateway process...");
+    try {
+      gatewayChild.kill("SIGTERM");
+      gatewayChild = null;
+    } catch (e) {
+      console.log(`[wrapper] Failed to stop managed gateway process: ${e.message}`);
+      runGatewayCmd("stop");
+    }
+  } else {
+    runGatewayCmd("stop");
+  }
+  runGatewayCmd("install --force");
+  const launchWhenReady = async () => {
+    const waitUntil = Date.now() + 8000;
+    while (Date.now() < waitUntil) {
+      if (!(await isGatewayRunning())) break;
+      await new Promise((resolve) => setTimeout(resolve, 250));
+    }
+    console.log("[wrapper] Starting openclaw gateway with refreshed environment...");
+    launchGatewayProcess();
+  };
+  void launchWhenReady();
+};
+
+const attachGatewaySignalHandlers = () => {
+  process.on("SIGTERM", () => {
+    runGatewayCmd("stop");
+    process.exit(0);
+  });
+  process.on("SIGINT", () => {
+    runGatewayCmd("stop");
+    process.exit(0);
+  });
+};
+
+const ensureGatewayProxyConfig = (origin) => {
+  if (!isOnboarded()) return false;
+  try {
+    const configPath = `${OPENCLAW_DIR}/openclaw.json`;
+    const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    if (!cfg.gateway) cfg.gateway = {};
+    let changed = false;
+
+    if (!Array.isArray(cfg.gateway.trustedProxies)) {
+      cfg.gateway.trustedProxies = [];
+    }
+    if (!cfg.gateway.trustedProxies.includes("127.0.0.1")) {
+      cfg.gateway.trustedProxies.push("127.0.0.1");
+      console.log("[wrapper] Added 127.0.0.1 to gateway.trustedProxies");
+      changed = true;
+    }
+
+    if (origin) {
+      if (!cfg.gateway.controlUi) cfg.gateway.controlUi = {};
+      if (!Array.isArray(cfg.gateway.controlUi.allowedOrigins)) {
+        cfg.gateway.controlUi.allowedOrigins = [];
+      }
+      if (!cfg.gateway.controlUi.allowedOrigins.includes(origin)) {
+        cfg.gateway.controlUi.allowedOrigins.push(origin);
+        console.log(`[wrapper] Added dashboard origin: ${origin}`);
+        changed = true;
+      }
+    }
+
+    if (changed) {
+      fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));
+    }
+    return changed;
+  } catch (e) {
+    console.error(`[wrapper] ensureGatewayProxyConfig error: ${e.message}`);
+    return false;
+  }
+};
+
+const syncChannelConfig = (savedVars, mode = "all") => {
+  try {
+    const configPath = `${OPENCLAW_DIR}/openclaw.json`;
+    const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    const savedMap = Object.fromEntries(
+      savedVars.filter((v) => v.value).map((v) => [v.key, v.value]),
+    );
+    const env = gatewayEnv();
+
+    for (const [ch, def] of Object.entries(kChannelDefs)) {
+      const token = savedMap[def.envKey];
+      const isConfigured = cfg.channels?.[ch]?.enabled;
+
+      if (token && !isConfigured && (mode === "add" || mode === "all")) {
+        console.log(`[wrapper] Adding channel: ${ch}`);
+        try {
+          execSync(`openclaw channels add --channel ${ch} --token "${token}"`, {
+            env,
+            timeout: 15000,
+            encoding: "utf8",
+          });
+          const raw = fs.readFileSync(configPath, "utf8");
+          if (raw.includes(token)) {
+            fs.writeFileSync(
+              configPath,
+              raw.split(token).join("${" + def.envKey + "}"),
+            );
+          }
+          console.log(`[wrapper] Channel ${ch} added`);
+        } catch (e) {
+          console.error(
+            `[wrapper] channels add ${ch}: ${(e.stderr || e.message || "").toString().trim().slice(0, 200)}`,
+          );
+        }
+      } else if (
+        !token &&
+        isConfigured &&
+        (mode === "remove" || mode === "all")
+      ) {
+        console.log(`[wrapper] Removing channel: ${ch}`);
+        try {
+          execSync(`openclaw channels remove --channel ${ch} --delete`, {
+            env,
+            timeout: 15000,
+            encoding: "utf8",
+          });
+          console.log(`[wrapper] Channel ${ch} removed`);
+        } catch (e) {
+          console.error(
+            `[wrapper] channels remove ${ch}: ${(e.stderr || e.message || "").toString().trim().slice(0, 200)}`,
+          );
+        }
+      }
+    }
+  } catch (e) {
+    console.error("[wrapper] syncChannelConfig error:", e.message);
+  }
+};
+
+const getChannelStatus = () => {
+  try {
+    const config = JSON.parse(fs.readFileSync(`${OPENCLAW_DIR}/openclaw.json`, "utf8"));
+    const credDir = `${OPENCLAW_DIR}/credentials`;
+    const channels = {};
+
+    for (const ch of ["telegram", "discord"]) {
+      if (!config.channels?.[ch]?.enabled) continue;
+      if (!process.env[kChannelDefs[ch].envKey]) continue;
+
+      let paired = 0;
+      try {
+        const files = fs
+          .readdirSync(credDir)
+          .filter((f) => f.startsWith(`${ch}-`) && f.endsWith("-allowFrom.json"));
+        for (const file of files) {
+          const data = JSON.parse(fs.readFileSync(`${credDir}/${file}`, "utf8"));
+          paired += (data.allowFrom || []).length;
+        }
+      } catch {}
+      const inlineAllowFrom = config.channels[ch]?.allowFrom;
+      if (Array.isArray(inlineAllowFrom)) paired += inlineAllowFrom.length;
+
+      channels[ch] = { status: paired > 0 ? "paired" : "configured", paired };
+    }
+
+    return channels;
+  } catch {
+    return {};
+  }
+};
+
+module.exports = {
+  gatewayEnv,
+  isOnboarded,
+  isGatewayRunning,
+  runGatewayCmd,
+  startGateway,
+  restartGateway,
+  attachGatewaySignalHandlers,
+  ensureGatewayProxyConfig,
+  syncChannelConfig,
+  getChannelStatus,
+};