@clawchatsai/connector 0.0.86 → 0.0.88

package/server/controllers/filesystem.js

@@ -0,0 +1,139 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { send, sendError } from '../util/http.js';
+import { parseMultipart } from '../util/multipart.js';
+
+const HOME = os.homedir();
+const ALLOWED_FILE_DIRS = [HOME, '/tmp'];
+
+export function handleServeFile(req, res, query, memoryConfig) {
+  const filePath = query.path;
+  if (!filePath) return sendError(res, 400, 'Missing path parameter');
+  const resolved = (filePath.startsWith('./') || filePath.startsWith('../'))
+    ? path.resolve(memoryConfig.workspaceDir, filePath)
+    : path.resolve(filePath);
+  if (!ALLOWED_FILE_DIRS.some(dir => resolved.startsWith(dir + '/') || resolved === dir)) return sendError(res, 403, 'Access denied: path not in allowed directories');
+  if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) return sendError(res, 404, 'File not found');
+
+  const MIME = {
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml',
+    '.pdf': 'application/pdf', '.txt': 'text/plain', '.json': 'application/json',
+    '.md': 'text/markdown', '.csv': 'text/csv', '.xml': 'text/xml',
+    '.html': 'text/html', '.css': 'text/css', '.js': 'text/javascript',
+    '.py': 'text/x-python', '.sh': 'text/x-shellscript',
+    '.yaml': 'text/yaml', '.yml': 'text/yaml', '.toml': 'text/toml',
+    '.zip': 'application/zip', '.gz': 'application/gzip', '.tar': 'application/x-tar',
+    '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    '.mp3': 'audio/mpeg', '.wav': 'audio/wav', '.ogg': 'audio/ogg',
+    '.mp4': 'video/mp4', '.webm': 'video/webm',
+  };
+  const stat = fs.statSync(resolved);
+  res.writeHead(200, { 'Content-Type': MIME[path.extname(resolved).toLowerCase()] || 'application/octet-stream', 'Content-Length': stat.size, 'Cache-Control': 'public, max-age=86400', 'Access-Control-Allow-Origin': '*' });
+  fs.createReadStream(resolved).pipe(res);
+}
+
+export function handleWorkspaceList(req, res, query) {
+  const reqPath = query.path || '~/.openclaw/workspace';
+  const depth = parseInt(query.depth || '2', 10);
+  const showHidden = query.hidden === '1' || query.hidden === 'true';
+  const resolved = path.resolve(reqPath.replace(/^~/, HOME));
+  if (!resolved.startsWith(HOME)) return sendError(res, 403, 'Access denied');
+  if (!fs.existsSync(resolved)) return sendError(res, 404, 'Path not found');
+
+  const files = [{ path: resolved + '/', type: 'dir', name: path.basename(resolved), size: 0 }];
+  const walk = (dir, d) => {
+    if (d > depth) return;
+    try {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name.startsWith('.') && entry.name !== '.openclaw' && !showHidden) continue;
+        if (entry.name === 'node_modules') continue;
+        const fullPath = path.join(dir, entry.name);
+        const isDir = entry.isDirectory();
+        files.push({ path: fullPath + (isDir ? '/' : ''), type: isDir ? 'dir' : 'file', name: entry.name, size: isDir ? 0 : (() => { try { return fs.statSync(fullPath).size; } catch { return 0; } })() });
+        if (isDir) walk(fullPath, d + 1);
+      }
+    } catch { /* permission denied */ }
+  };
+  walk(resolved, 1);
+  send(res, 200, { files, cwd: resolved });
+}
+
+export function handleWorkspaceFileRead(req, res, query) {
+  const filePath = query.path;
+  if (!filePath) return sendError(res, 400, 'Missing path parameter');
+  const resolved = path.resolve(filePath.replace(/^~/, HOME));
+  if (!resolved.startsWith(HOME)) return sendError(res, 403, 'Access denied');
+  if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) return sendError(res, 404, 'File not found');
+
+  const stat = fs.statSync(resolved);
+  const ext = path.extname(resolved).toLowerCase().slice(1);
+  const binaryMime = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp', svg: 'image/svg+xml', bmp: 'image/bmp', ico: 'image/x-icon', pdf: 'application/pdf', mp3: 'audio/mpeg', mp4: 'video/mp4', wav: 'audio/wav', ogg: 'audio/ogg', webm: 'video/webm' };
+  const mime = binaryMime[ext];
+
+  if (mime) {
+    if (stat.size > 20 * 1024 * 1024) return sendError(res, 413, 'File too large (max 20MB)');
+    res.writeHead(200, { 'Content-Type': mime, 'Cache-Control': 'private, max-age=60' });
+    res.end(fs.readFileSync(resolved));
+  } else {
+    if (stat.size > 1024 * 1024) return sendError(res, 413, 'File too large (max 1MB)');
+    res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end(fs.readFileSync(resolved, 'utf8'));
+  }
+}
+
+export async function handleWorkspaceFileWrite(req, res, query) {
+  const filePath = query.path;
+  if (!filePath) return sendError(res, 400, 'Missing path parameter');
+  const resolved = path.resolve(filePath.replace(/^~/, HOME));
+  if (!resolved.startsWith(HOME)) return sendError(res, 403, 'Can only write to workspace directory');
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  const dir = path.dirname(resolved);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(resolved, Buffer.concat(chunks).toString('utf8'), 'utf8');
+  send(res, 200, { ok: true });
+}
+
+export function handleWorkspaceFileDelete(req, res, query) {
+  const filePath = query.path;
+  if (!filePath) return sendError(res, 400, 'Missing path parameter');
+  const resolved = path.resolve(filePath.replace(/^~/, HOME));
+  if (!resolved.startsWith(HOME)) return sendError(res, 403, 'Access denied');
+  if (!fs.existsSync(resolved)) return sendError(res, 404, 'Path not found');
+  try {
+    const stat = fs.statSync(resolved);
+    if (stat.isDirectory()) { fs.rmSync(resolved, { recursive: true, force: true }); send(res, 200, { ok: true, type: 'dir' }); }
+    else { fs.unlinkSync(resolved); send(res, 200, { ok: true, type: 'file' }); }
+  } catch (err) { sendError(res, 500, 'Delete failed: ' + err.message); }
+}
+
+export async function handleWorkspaceUpload(req, res, query) {
+  const targetDir = query.path;
+  if (!targetDir) return sendError(res, 400, 'Missing path parameter');
+  const resolved = path.resolve(targetDir.replace(/^~/, HOME));
+  if (!resolved.startsWith(HOME)) return sendError(res, 403, 'Access denied');
+  if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) return sendError(res, 404, 'Target directory not found');
+  if (!(req.headers['content-type'] || '').includes('multipart/form-data')) return sendError(res, 400, 'Expected multipart/form-data');
+
+  let files;
+  try { files = await parseMultipart(req); }
+  catch (err) { return sendError(res, 400, 'Invalid multipart data: ' + err.message); }
+
+  const uploaded = [];
+  for (const { filename, data } of files) {
+    if (!filename || !data.length) continue;
+    const safeName = path.basename(filename);
+    let finalPath = path.join(resolved, safeName);
+    let counter = 1;
+    while (fs.existsSync(finalPath)) {
+      const ext = path.extname(safeName);
+      finalPath = path.join(resolved, `${path.basename(safeName, ext)} (${counter++})${ext}`);
+    }
+    fs.writeFileSync(finalPath, data);
+    uploaded.push({ name: path.basename(finalPath), size: data.length });
+  }
+  send(res, 200, { ok: true, uploaded });
+}

package/server/controllers/memory.js

@@ -0,0 +1,86 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { send, sendError } from '../util/http.js';
+
+export class MemoryController {
+  constructor({ memoryProvider, memoryFilesDir, memoryConfig }) {
+    this.provider = memoryProvider;
+    this.filesDir = memoryFilesDir;
+    this.config = memoryConfig;
+  }
+
+  async list(req, res, query) {
+    const limit = Math.min(parseInt(query.limit) || 20, 100);
+    try { send(res, 200, await this.provider.list(limit, query.offset || null)); }
+    catch (err) { send(res, 502, { error: `Failed to reach ${this.provider.name}`, detail: err.message }); }
+  }
+
+  async search(req, res, query) {
+    const q = (query.query || '').toLowerCase().trim();
+    if (!q) return send(res, 400, { error: 'Missing query parameter' });
+    try { send(res, 200, await this.provider.search(q)); }
+    catch (err) { send(res, 502, { error: `Failed to reach ${this.provider.name}`, detail: err.message }); }
+  }
+
+  files(req, res, query) {
+    const q = (query.query || '').toLowerCase().trim();
+    const memories = this._parseFiles();
+    const filtered = q ? memories.filter(m => m.data.toLowerCase().includes(q) || m.title.toLowerCase().includes(q)) : memories;
+    filtered.sort((a, b) => (b.createdAt || '').localeCompare(a.createdAt || ''));
+    send(res, 200, { memories: filtered });
+  }
+
+  _parseFiles() {
+    const memories = [];
+    const scanDir = (dir, prefix = '') => {
+      let entries;
+      try { entries = fs.readdirSync(dir); } catch { return; }
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry);
+        const stat = (() => { try { return fs.statSync(fullPath); } catch { return null; } })();
+        if (!stat) continue;
+        if (stat.isDirectory() && !prefix) { scanDir(fullPath, entry + '/'); continue; }
+        if (!entry.endsWith('.md') || !stat.isFile()) continue;
+        const content = fs.readFileSync(fullPath, 'utf8');
+        const basename = entry.replace(/\.md$/, '');
+        const dateMatch = basename.match(/^(\d{4}-\d{2}-\d{2})/);
+        if (prefix) {
+          memories.push({ id: `file:${prefix + basename}`, source: 'file', file: prefix + basename, title: basename, data: content.trim(), createdAt: stat.mtime.toISOString() });
+        } else {
+          for (const section of content.split(/^(?=## )/m)) {
+            const trimmed = section.trim();
+            if (!trimmed) continue;
+            const headingMatch = trimmed.match(/^##\s+(.+)/);
+            const heading = headingMatch ? headingMatch[1].trim() : null;
+            const body = headingMatch ? trimmed.slice(trimmed.indexOf('\n') + 1).trim() : trimmed;
+            if (!heading && body.match(/^#\s+/) && body.split('\n').length <= 2) continue;
+            const title = heading || basename;
+            memories.push({ id: `file:${basename}:${title}`, source: 'file', file: basename, title, data: heading ? `**${title}**\n${body}` : body, createdAt: dateMatch ? `${dateMatch[1]}T00:00:00Z` : stat.mtime.toISOString() });
+          }
+        }
+      }
+    };
+    scanDir(this.filesDir);
+    return memories;
+  }
+
+  async update(req, res, params) {
+    try {
+      const chunks = [];
+      for await (const chunk of req) chunks.push(chunk);
+      const { data } = JSON.parse(Buffer.concat(chunks).toString());
+      if (!(data || '').trim()) return send(res, 400, { error: 'Missing data field' });
+      send(res, 200, { ok: true, result: await this.provider.update(params.id, data.trim()) });
+    } catch (err) { send(res, 502, { error: 'Failed to update memory', detail: err.message }); }
+  }
+
+  async delete(req, res, params) {
+    try { send(res, 200, { ok: true, result: await this.provider.delete(params.id) }); }
+    catch (err) { send(res, 502, { error: `Failed to reach ${this.provider.name}`, detail: err.message }); }
+  }
+
+  async status(req, res) {
+    const status = await this.provider.status();
+    send(res, 200, { provider: this.provider.name, host: this.config.host, port: this.config.port, collection: this.config.collection, backend: status, memoryFilesDir: this.filesDir, memoryFilesDirExists: fs.existsSync(this.filesDir) });
+  }
+}

package/server/controllers/messages.js

@@ -0,0 +1,128 @@
+import { send, sendError, parseBody } from '../util/http.js';
+import { buildContextPreamble } from '../util/context.js';
+
+export class MessageController {
+  constructor({ getActiveDb, getWorkspaces, broadcast }) {
+    this.getActiveDb = getActiveDb;
+    this.getWorkspaces = getWorkspaces;
+    this.broadcast = broadcast;
+  }
+
+  getAll(req, res, params, query) {
+    const db = this.getActiveDb();
+    if (!db.prepare('SELECT id FROM threads WHERE id = ?').get(params.id)) return sendError(res, 404, 'Thread not found');
+    const limit = Math.min(parseInt(query.limit || '100', 10), 500);
+    const before = query.before ? parseInt(query.before, 10) : null;
+    const after = query.after ? parseInt(query.after, 10) : null;
+    let sql = 'SELECT * FROM messages WHERE thread_id = ?';
+    const sqlParams = [params.id];
+    if (before) { sql += ' AND timestamp < ?'; sqlParams.push(before); }
+    if (after) { sql += ' AND timestamp > ?'; sqlParams.push(after); }
+    const total = db.prepare(sql.replace('SELECT *', 'SELECT COUNT(*) as c')).get(...sqlParams).c;
+    const rows = db.prepare(sql + ' ORDER BY timestamp DESC LIMIT ?').all(...sqlParams, limit + 1);
+    const messages = rows.slice(0, limit).reverse();
+    for (const m of messages) { if (m.metadata) { try { m.metadata = JSON.parse(m.metadata); } catch { /* ok */ } } }
+    send(res, 200, { messages, hasMore: rows.length > limit });
+  }
+
+  async create(req, res, params) {
+    const body = await parseBody(req);
+    const db = this.getActiveDb();
+    if (!db.prepare('SELECT id FROM threads WHERE id = ?').get(params.id)) return sendError(res, 404, 'Thread not found');
+    if (!body.id || !body.role || body.content === undefined || !body.timestamp) return sendError(res, 400, 'Required: id, role, content, timestamp');
+    const metadata = body.metadata ? JSON.stringify(body.metadata) : null;
+    const existing = db.prepare('SELECT id, status, metadata FROM messages WHERE id = ?').get(body.id);
+    if (existing) {
+      if (body.status && body.status !== existing.status) {
+        db.prepare('UPDATE messages SET status = ?, content = ?, metadata = ? WHERE id = ?').run(body.status, body.content, metadata || existing.metadata, body.id);
+      }
+    } else {
+      db.prepare('INSERT INTO messages (id, thread_id, role, content, status, metadata, seq, timestamp, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)').run(body.id, params.id, body.role, body.content, body.status || 'sent', metadata, body.seq || null, body.timestamp, Date.now());
+      db.prepare('UPDATE threads SET updated_at = ? WHERE id = ?').run(Date.now(), params.id);
+      if (body.role === 'user' && body.content) {
+        const thread = db.prepare('SELECT title FROM threads WHERE id = ?').get(params.id);
+        if (thread?.title === 'New chat') {
+          const title = body.content.replace(/\n.*/s, '').slice(0, 40).trim() + (body.content.length > 40 ? '...' : '');
+          if (title) {
+            db.prepare('UPDATE threads SET title = ? WHERE id = ?').run(title, params.id);
+            this.broadcast(JSON.stringify({ type: 'clawchats', event: 'thread-title-updated', threadId: params.id, workspace: this.getWorkspaces().active, title }));
+          }
+        }
+      }
+    }
+    const message = db.prepare('SELECT * FROM messages WHERE id = ?').get(body.id);
+    if (message?.metadata) { try { message.metadata = JSON.parse(message.metadata); } catch { /* ok */ } }
+    send(res, existing ? 200 : 201, { message });
+  }
+
+  delete(req, res, params) {
+    const db = this.getActiveDb();
+    if (!db.prepare('SELECT id FROM messages WHERE id = ? AND thread_id = ?').get(params.messageId, params.id)) return sendError(res, 404, 'Message not found');
+    db.prepare('DELETE FROM messages WHERE id = ?').run(params.messageId);
+    send(res, 200, { ok: true });
+  }
+
+  contextFill(req, res, params) {
+    const db = this.getActiveDb();
+    const thread = db.prepare('SELECT * FROM threads WHERE id = ?').get(params.id);
+    if (!thread) return sendError(res, 404, 'Thread not found');
+    send(res, 200, buildContextPreamble(db, params.id, thread.last_session_id, thread.session_key));
+  }
+
+  search(req, res, params, query) {
+    const q = query.q || '';
+    if (!q) return send(res, 200, { results: [], total: 0 });
+    const db = this.getActiveDb();
+    const page = parseInt(query.page || '1', 10);
+    const limit = Math.min(parseInt(query.limit || '20', 10), 100);
+    const offset = (page - 1) * limit;
+    try {
+      const results = db.prepare(`SELECT m.id as messageId, m.thread_id as threadId, t.title as threadTitle, m.role, snippet(messages_fts, 0, '<mark>', '</mark>', '...', 40) as content, m.timestamp FROM messages_fts JOIN messages m ON messages_fts.rowid = m.rowid JOIN threads t ON m.thread_id = t.id WHERE messages_fts MATCH ? ORDER BY rank LIMIT ? OFFSET ?`).all(q, limit, offset);
+      const total = db.prepare(`SELECT COUNT(*) as c FROM messages_fts WHERE messages_fts MATCH ?`).get(q).c;
+      send(res, 200, { results, total });
+    } catch { send(res, 200, { results: [], total: 0 }); }
+  }
+
+  export(req, res) {
+    const db = this.getActiveDb();
+    const ws = this.getWorkspaces();
+    const threads = db.prepare('SELECT * FROM threads ORDER BY updated_at DESC').all();
+    send(res, 200, {
+      workspace: ws.active,
+      exportedAt: Date.now(),
+      threads: threads.map(t => {
+        const messages = db.prepare('SELECT * FROM messages WHERE thread_id = ? ORDER BY timestamp ASC').all(t.id);
+        for (const m of messages) { if (m.metadata) { try { m.metadata = JSON.parse(m.metadata); } catch { /* ok */ } } }
+        return { ...t, messages };
+      }),
+    });
+  }
+
+  async import(req, res) {
+    const body = await parseBody(req);
+    const db = this.getActiveDb();
+    const ws = this.getWorkspaces();
+    if (!body.threads || !Array.isArray(body.threads)) return sendError(res, 400, 'Expected { threads: [...] }');
+    let threadsImported = 0, messagesImported = 0;
+    const insertThread = db.prepare('INSERT OR IGNORE INTO threads (id, session_key, title, pinned, pin_order, model, last_session_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)');
+    const insertMsg = db.prepare('INSERT OR IGNORE INTO messages (id, thread_id, role, content, status, metadata, seq, timestamp, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)');
+    db.exec('BEGIN');
+    try {
+      for (const t of body.threads) {
+        if (!t.id) continue;
+        const sessionKey = t.session_key || `agent:main:${ws.active}:chat:${t.id}`;
+        if (insertThread.run(t.id, sessionKey, t.title || 'Imported chat', t.pinned || 0, t.pin_order || 0, t.model || null, t.last_session_id || null, t.created_at || Date.now(), t.updated_at || Date.now()).changes > 0) threadsImported++;
+        for (const m of (t.messages || [])) {
+          if (!m.id || !m.role) continue;
+          const meta = m.metadata ? (typeof m.metadata === 'string' ? m.metadata : JSON.stringify(m.metadata)) : null;
+          if (insertMsg.run(m.id, t.id, m.role, m.content || '', m.status || 'sent', meta, m.seq || null, m.timestamp || Date.now(), m.created_at || Date.now()).changes > 0) messagesImported++;
+        }
+      }
+      db.exec('COMMIT');
+    } catch (e) {
+      db.exec('ROLLBACK');
+      throw e;
+    }
+    send(res, 200, { ok: true, threadsImported, messagesImported });
+  }
+}

package/server/controllers/settings.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { send } from '../util/http.js';
+
+/**
+ * Factory that returns settings GET/PUT handlers bound to a specific settings file path.
+ * Keeps file I/O out of the HTTP router (server/index.js).
+ */
+export function createSettingsHandlers(settingsFile) {
+  function handleGetSettings(req, res) {
+    try {
+      send(res, 200, fs.existsSync(settingsFile)
+        ? JSON.parse(fs.readFileSync(settingsFile, 'utf8'))
+        : {});
+    } catch {
+      send(res, 200, {});
+    }
+  }
+
+  async function handleSaveSettings(req, res, parseBody) {
+    const body = await parseBody(req);
+    fs.mkdirSync(path.dirname(settingsFile), { recursive: true });
+    fs.writeFileSync(settingsFile, JSON.stringify(body, null, 2));
+    send(res, 200, { ok: true });
+  }
+
+  return { handleGetSettings, handleSaveSettings };
+}

package/server/controllers/static.js

@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const MIME = {
+  '.html': 'text/html',
+  '.js':   'text/javascript',
+  '.css':  'text/css',
+  '.json': 'application/json',
+  '.ico':  'image/x-icon',
+  '.png':  'image/png',
+  '.svg':  'image/svg+xml',
+  '.gif':  'image/gif',
+  '.webp': 'image/webp',
+};
+
+const STATIC_MAP = {
+  '/':            'index.html',
+  '/index.html':  'index.html',
+  '/app.js':      'app.js',
+  '/style.css':   'style.css',
+  '/error-handler.js': 'error-handler.js',
+  '/manifest.json': 'manifest.json',
+  '/favicon.ico': 'favicon.ico',
+};
+
+/**
+ * Serve static files from pluginDir.
+ * Returns true if the request was handled, false if it should fall through.
+ * Keeps fs.createReadStream out of the HTTP router (server/index.js).
+ */
+export function handleStatic(req, res, pluginDir) {
+  const urlPath = (req.url || '/').split('?')[0];
+  const fileName = STATIC_MAP[urlPath];
+  const isAllowed =
+    fileName ||
+    urlPath.startsWith('/icons/') ||
+    urlPath.startsWith('/lib/') ||
+    urlPath.startsWith('/frontend/') ||
+    urlPath.startsWith('/emoji/') ||
+    urlPath === '/config.js';
+
+  if (!isAllowed) return false;
+
+  const staticPath = path.join(pluginDir, fileName || urlPath.slice(1));
+  if (!fs.existsSync(staticPath) || !fs.statSync(staticPath).isFile()) return false;
+
+  const ext  = path.extname(staticPath).toLowerCase();
+  const stat = fs.statSync(staticPath);
+  res.writeHead(200, {
+    'Content-Type':   MIME[ext] || 'application/octet-stream',
+    'Content-Length': stat.size,
+    'Cache-Control':  ext === '.html' ? 'no-cache' : 'public, max-age=3600',
+  });
+  fs.createReadStream(staticPath).pipe(res);
+  return true;
+}

package/server/controllers/threads.js

@@ -0,0 +1,113 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { send, sendError, parseBody, uuid } from '../util/http.js';
+import { syncThreadUnreadCount } from '../util/helpers.js';
+import { getSessionsDirForAgent } from '../config.js';
+import { cleanGatewaySession } from '../gateway-cleanup.js';
+
+export class ThreadController {
+  constructor({ getActiveDb, getWorkspaces, uploadsDir, broadcast }) {
+    this.getActiveDb = getActiveDb;
+    this.getWorkspaces = getWorkspaces;
+    this.uploadsDir = uploadsDir;
+    this.broadcast = broadcast;
+  }
+
+  getAll(req, res, params, query) {
+    const db = this.getActiveDb();
+    const page = parseInt(query.page || '1', 10);
+    const limit = Math.min(parseInt(query.limit || '50', 10), 200);
+    const offset = (page - 1) * limit;
+    const search = query.search || '';
+    let threads, total;
+    if (search) {
+      try {
+        const matchingIds = db.prepare(`SELECT DISTINCT m.thread_id FROM messages m JOIN messages_fts ON messages_fts.rowid = m.rowid WHERE messages_fts MATCH ?`).all(search).map(r => r.thread_id);
+        if (!matchingIds.length) return send(res, 200, { threads: [], total: 0, page });
+        const ph = matchingIds.map(() => '?').join(',');
+        total = db.prepare(`SELECT COUNT(*) as c FROM threads WHERE id IN (${ph})`).get(...matchingIds).c;
+        threads = db.prepare(`SELECT * FROM threads WHERE id IN (${ph}) ORDER BY pinned DESC, sort_order DESC, updated_at DESC LIMIT ? OFFSET ?`).all(...matchingIds, limit, offset);
+      } catch { return send(res, 200, { threads: [], total: 0, page }); }
+    } else {
+      total = db.prepare('SELECT COUNT(*) as c FROM threads').get().c;
+      threads = db.prepare('SELECT * FROM threads ORDER BY pinned DESC, sort_order DESC, updated_at DESC LIMIT ? OFFSET ?').all(limit, offset);
+    }
+    send(res, 200, { threads, total, page });
+  }
+
+  getUnread(req, res) {
+    const db = this.getActiveDb();
+    const threads = db.prepare(`SELECT t.id, t.title, t.unread_count, m.content as lastMessage FROM threads t LEFT JOIN messages m ON m.thread_id = t.id WHERE t.unread_count > 0 AND m.timestamp = (SELECT MAX(timestamp) FROM messages WHERE thread_id = t.id) ORDER BY t.updated_at DESC`).all();
+    for (const t of threads) t.unreadMessageIds = db.prepare('SELECT message_id FROM unread_messages WHERE thread_id = ?').all(t.id).map(r => r.message_id);
+    send(res, 200, { threads });
+  }
+
+  async markRead(req, res, params) {
+    const { messageIds } = await parseBody(req);
+    if (!Array.isArray(messageIds) || !messageIds.length) return send(res, 400, { error: 'messageIds array required' });
+    const db = this.getActiveDb();
+    const ph = messageIds.map(() => '?').join(',');
+    db.prepare(`DELETE FROM unread_messages WHERE thread_id = ? AND message_id IN (${ph})`).run(params.id, ...messageIds);
+    const remaining = syncThreadUnreadCount(db, params.id);
+    this.broadcast(JSON.stringify({ type: 'clawchats', event: 'unread-update', workspace: this.getWorkspaces().active, threadId: params.id, action: 'read', messageIds, unreadCount: remaining, timestamp: Date.now() }));
+    send(res, 200, { unread_count: remaining });
+  }
+
+  async create(req, res) {
+    const body = await parseBody(req);
+    const db = this.getActiveDb();
+    const ws = this.getWorkspaces();
+    const id = body.id || uuid();
+    const now = Date.now();
+    const agent = ws.workspaces[ws.active]?.agent || 'main';
+    try {
+      db.prepare('INSERT INTO threads (id, session_key, title, created_at, updated_at) VALUES (?, ?, ?, ?, ?)').run(id, `agent:${agent}:${ws.active}:chat:${id}`, 'New chat', now, now);
+    } catch (e) {
+      if (e.message.includes('UNIQUE constraint')) return sendError(res, 409, 'Thread already exists');
+      throw e;
+    }
+    send(res, 201, { thread: db.prepare('SELECT * FROM threads WHERE id = ?').get(id) });
+  }
+
+  get(req, res, params) {
+    const thread = this.getActiveDb().prepare('SELECT * FROM threads WHERE id = ?').get(params.id);
+    if (!thread) return sendError(res, 404, 'Thread not found');
+    send(res, 200, { thread });
+  }
+
+  async update(req, res, params) {
+    const body = await parseBody(req);
+    const db = this.getActiveDb();
+    if (!db.prepare('SELECT id FROM threads WHERE id = ?').get(params.id)) return sendError(res, 404, 'Thread not found');
+    const fields = [], values = [];
+    for (const [col, val] of [['title', body.title], ['model', body.model], ['last_session_id', body.last_session_id], ['unread_count', body.unread_count]]) {
+      if (val !== undefined) { fields.push(`${col} = ?`); values.push(val); }
+    }
+    if (body.pinned !== undefined) { fields.push('pinned = ?'); values.push(body.pinned ? 1 : 0); }
+    if (body.pin_order !== undefined) { fields.push('pin_order = ?'); values.push(body.pin_order); }
+    if (body.sort_order !== undefined) { fields.push('sort_order = ?'); values.push(body.sort_order); }
+    if (fields.length) {
+      fields.push('updated_at = ?');
+      values.push(Date.now(), params.id);
+      db.prepare(`UPDATE threads SET ${fields.join(', ')} WHERE id = ?`).run(...values);
+    }
+    send(res, 200, { thread: db.prepare('SELECT * FROM threads WHERE id = ?').get(params.id) });
+  }
+
+  delete(req, res, params) {
+    const db = this.getActiveDb();
+    const thread = db.prepare('SELECT * FROM threads WHERE id = ?').get(params.id);
+    if (!thread) return sendError(res, 404, 'Thread not found');
+    db.prepare('DELETE FROM threads WHERE id = ?').run(params.id);
+    const agentMatch = (thread.session_key || '').match(/^agent:([^:]+):/);
+    const sessionsDir = getSessionsDirForAgent(agentMatch?.[1]);
+    let sessionIdToDelete = thread.last_session_id;
+    if (!sessionIdToDelete) {
+      try { sessionIdToDelete = JSON.parse(fs.readFileSync(path.join(sessionsDir, 'sessions.json'), 'utf8'))[thread.session_key]?.sessionId; } catch { /* ok */ }
+    }
+    cleanGatewaySession(thread.session_key);
+    if (sessionIdToDelete) { try { fs.unlinkSync(path.join(sessionsDir, `${sessionIdToDelete}.jsonl`)); } catch { /* ok */ } }
+    try { fs.rmSync(path.join(this.uploadsDir, params.id), { recursive: true }); } catch { /* ok */ }
+    send(res, 200, { ok: true });
+  }
+}

package/server/controllers/transcribe.js

@@ -0,0 +1,44 @@
+import { send } from '../util/http.js';
+
+export async function handleTranscribe(req, res, opts = {}) {
+  try {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const audioBuffer = Buffer.concat(chunks);
+
+    if (audioBuffer.length === 0) return send(res, 400, { error: 'No audio data' });
+    if (audioBuffer.length > 25 * 1024 * 1024) return send(res, 400, { error: 'Audio too large (max 25MB)' });
+
+    // API key is resolved by the plugin host (src/index.ts) and passed via opts.openaiApiKey.
+    const apiKey = opts.openaiApiKey;
+    if (!apiKey) return send(res, 500, { error: 'No OpenAI API key configured' });
+
+    const contentType = req.headers['content-type'] || 'audio/webm';
+    const ext = contentType.includes('wav') ? 'wav' : contentType.includes('mp4') || contentType.includes('m4a') ? 'm4a' : contentType.includes('ogg') ? 'ogg' : 'webm';
+
+    const boundary = '----WhisperBoundary' + Date.now();
+    const body = Buffer.concat([
+      `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="audio.${ext}"\r\nContent-Type: ${contentType}\r\n\r\n`,
+      audioBuffer,
+      `\r\n--${boundary}\r\nContent-Disposition: form-data; name="model"\r\n\r\nwhisper-1\r\n`,
+      `--${boundary}\r\nContent-Disposition: form-data; name="response_format"\r\n\r\njson\r\n`,
+      `--${boundary}--\r\n`,
+    ].map(p => typeof p === 'string' ? Buffer.from(p) : p));
+
+    const resp = await fetch('https://api.openai.com/v1/audio/transcriptions', {
+      method: 'POST',
+      headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': `multipart/form-data; boundary=${boundary}` },
+      body,
+    });
+
+    if (!resp.ok) {
+      console.error('Whisper API error:', resp.status, await resp.text());
+      return send(res, 502, { error: `Whisper API error: ${resp.status}` });
+    }
+    const result = await resp.json();
+    return send(res, 200, { text: result.text || '' });
+  } catch (err) {
+    console.error('Transcribe error:', err);
+    return send(res, 500, { error: err.message });
+  }
+}