@flame0510/project-aether 1.1.12 → 1.1.13

package/app/api/gateway/provider/route.ts

@@ -12,6 +12,7 @@ import { syncAllAgents } from '../sync';
 import { detectProviderGatewayUrl } from '@/lib/docker-utils';
 import { getPricing } from '@/lib/model-pricing';
 import { loadModelsConfig, toggleModelOverride, type ModelConfigEntry } from '@/lib/model-catalogue';
+import { getLivePricing } from '@/lib/openrouter-pricing';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
@@ -136,8 +137,37 @@ function restartService(): { stdout: string; stderr: string } {
 /* ------------------------------------------------------------------ */
 
 export async function GET(request: NextRequest) {
-  const allModels = loadModelsConfig();
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const providerKeys = readProviderKeys();
+
+  // ?summary=1 — just "which providers have a key", no models, no pricing.
+  // The full response awaits live pricing from OpenRouter, a network round trip
+  // that costs ~2.4s cold. Callers that only need the boolean (the agents page,
+  // to decide whether to warn about a missing provider) must not pay for it, and
+  // must not be left guessing while it's in flight.
+  if (request.nextUrl.searchParams.get('summary') === '1') {
+    return NextResponse.json({
+      providers: Object.entries(PROVIDER_CONFIGS).map(([key, cfg]) => ({
+        provider: key,
+        label: cfg.label,
+        configured: !!providerKeys[key],
+      })),
+    });
+  }
+
+  const allModels = loadModelsConfig();
+
+  // Live prices overlaid on the static file, which drifts. Fetched regardless
+  // of whether OpenRouter is configured: the catalogue is public, and prices
+  // are most useful precisely to someone still deciding whether to enable it.
+  // Best-effort — an empty map means the static values stand in.
+  //
+  // Modality deliberately stays on the curated value: sync.ts provisions
+  // containers from it, so taking a different one upstream would advertise
+  // inputs the agent was never configured to accept.
+  const livePricing = await getLivePricing(allModels.map((m) => m.id));
+
   const providers = Object.entries(PROVIDER_CONFIGS).map(([key, cfg]) => {
     const providerModels = allModels.filter((m) => m.provider === key);
     return {
@@ -145,8 +175,14 @@ export async function GET(request: NextRequest) {
       baseUrl: cfg.baseUrl, docsUrl: cfg.docsUrl,
       models: providerModels.map((m) => {
         const entry: Record<string, unknown> = { id: m.id, name: m.name, enabled: m.enabled };
-        const p = getPricing(m.id);
-        if (p) entry.pricing = p;
+        const livePrice = livePricing.get(m.id);
+        if (livePrice) {
+          entry.pricing = livePrice;
+          entry.pricingLive = true;
+        } else {
+          const staticPrice = getPricing(m.id);
+          if (staticPrice) entry.pricing = staticPrice;
+        }
         if (m.modality) entry.modality = m.modality;
         return entry;
       }),
@@ -157,7 +193,8 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const body: { provider?: string; apiKey?: string; _syncOnly?: boolean } = await request.json();
 
@@ -189,7 +226,8 @@ export async function POST(request: NextRequest) {
 }
 
 export async function PUT(request: NextRequest) {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const body: { modelId?: string; enabled?: boolean } = await request.json();
     const { modelId, enabled } = body;

package/app/api/gateway/route.ts

@@ -131,6 +131,8 @@ function getAgentModels(container: string): GatewayModel[] {
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const timestamp = Date.now();
 

package/app/api/models/route.ts

@@ -48,6 +48,8 @@ function loadModelsConfig(): ModelsConfigEntry[] {
 
 export async function GET(_req: NextRequest): Promise<NextResponse> {
   const request = _req;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const allModels = loadModelsConfig();
   const providerKeys = readProviderKeys();
   const configured = new Set(Object.keys(providerKeys));

package/app/api/setup/agent-image/route.ts

@@ -12,9 +12,10 @@
  * Only one download at a time — returns 409 if already running.
  * Cleans up the docker process if the client disconnects.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import { downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
 import { execSync } from 'child_process';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
@@ -30,7 +31,9 @@ function dockerOk(): boolean {
   }
 }
 
-export async function GET(): Promise<NextResponse> {
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
   if (!dockerOk()) {
     return NextResponse.json({ exists: false });
   }
@@ -55,7 +58,9 @@ export async function GET(): Promise<NextResponse> {
   }
 }
 
-export async function POST(): Promise<Response> {
+export async function POST(request: NextRequest): Promise<Response> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
   if (getIsDownloading()) {
     return new Response(
       JSON.stringify({ error: 'A download is already in progress' }),

package/app/api/setup/password/route.ts

@@ -15,6 +15,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as crypto from 'crypto';
 import { ENV_FILE } from '@/lib/rev4a-paths';
+import { isConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
@@ -23,21 +24,33 @@ function generateSecret(len: number): string {
   return crypto.randomBytes(len).toString('base64url').slice(0, len);
 }
 
+/**
+ * True only if an actual assignment line for `key` exists — a commented-out
+ * or incidental mention (`# old REV4A_TOKEN=…`) does not count. A substring
+ * check here would report the key as present and skip generating it, leaving
+ * the instance without a usable secret.
+ */
+function hasEnvKey(content: string, key: string): boolean {
+  return content.split('\n').some((line) => line.trimStart().startsWith(`${key}=`));
+}
+
+/** Replace the assignment line for `key`, or append one if none exists. */
+function upsertEnvLine(content: string, key: string, value: string): string {
+  const lines = content.split('\n');
+  let replaced = false;
+  const updated = lines.map((line) => {
+    if (!replaced && line.trimStart().startsWith(`${key}=`)) {
+      replaced = true;
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  if (!replaced) updated.push(`${key}=${value}`);
+  return updated.join('\n');
+}
+
 export async function POST(request: Request): Promise<NextResponse> {
-  // Check both env and .env file (same fallback pattern as login/status routes)
-  let currentPassword = process.env.REV4A_PASSWORD;
-  if (typeof currentPassword !== 'string' || currentPassword.length === 0) {
-    try {
-      if (fs.existsSync(ENV_FILE)) {
-        const content = fs.readFileSync(ENV_FILE, 'utf-8');
-        const match = content.match(/^REV4A_PASSWORD=(.+)$/m);
-        if (match && match[1].trim()) {
-          currentPassword = match[1].trim();
-        }
-      }
-    } catch { /* ignore */ }
-  }
-  if (typeof currentPassword === 'string' && currentPassword.length > 0) {
+  if (isConfigured()) {
     return NextResponse.json(
       { error: 'Password is already configured. Use the Config page to change it.' },
       { status: 409 },
@@ -72,30 +85,12 @@ export async function POST(request: Request): Promise<NextResponse> {
       content = fs.readFileSync(ENV_FILE, 'utf-8');
     }
 
-    // Ensure password line
-    if (content.includes('REV4A_PASSWORD=')) {
-      content = content
-        .split('\n')
-        .map((line) =>
-          line.startsWith('REV4A_PASSWORD=')
-            ? 'REV4A_PASSWORD=' + body.password
-            : line,
-        )
-        .join('\n');
-    } else {
-      content += '\nREV4A_PASSWORD=' + body.password + '\n';
+    content = upsertEnvLine(content, 'REV4A_PASSWORD', body.password);
+    if (!hasEnvKey(content, 'REV4A_JWT_SECRET')) {
+      content = upsertEnvLine(content, 'REV4A_JWT_SECRET', generateSecret(64));
     }
-
-    // Generate JWT secret if missing
-    if (!content.includes('REV4A_JWT_SECRET=')) {
-      const secret = generateSecret(64);
-      content += '\nREV4A_JWT_SECRET=' + secret + '\n';
-    }
-
-    // Generate API token if missing
-    if (!content.includes('REV4A_TOKEN=')) {
-      const token = generateSecret(32);
-      content += '\nREV4A_TOKEN=' + token + '\n';
+    if (!hasEnvKey(content, 'REV4A_TOKEN')) {
+      content = upsertEnvLine(content, 'REV4A_TOKEN', generateSecret(32));
     }
 
     fs.writeFileSync(ENV_FILE, content.trim() + '\n', { encoding: 'utf-8', mode: 0o600 });

package/app/api/setup/restart/route.ts

@@ -12,15 +12,21 @@
  *   2. Otherwise send SIGTERM to the current process. The parent process
  *      manager (npx rev4a all or a shell wrapper) should restart it.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
 import { execSync } from 'child_process';
 import { ENV_FILE } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
 
-export async function POST(): Promise<NextResponse> {
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  // Open only during initial setup (before a password exists). Once
+  // configured, this triggers a production service restart and must
+  // require a valid session like every other privileged route.
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
   try {
     if (!fs.existsSync(ENV_FILE)) {
       return NextResponse.json({ error: '.env file not found' }, { status: 500 });

package/app/api/skills/delete/route.js

@@ -3,8 +3,8 @@ import fs from 'fs';
 import path from 'path';
 import { execFileSync } from 'child_process';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { SHARED_SKILLS_DIR } from '@/lib/rev4a-paths';
 
-const SHARED_SKILLS_DIR = '/docker/shared-skills';
 
 /**
  * DELETE /api/skills/delete

package/app/api/skills/promote/route.js

@@ -3,8 +3,8 @@ import fs from 'fs';
 import path from 'path';
 import { execSync, execFileSync } from 'child_process';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { SHARED_SKILLS_DIR } from '@/lib/rev4a-paths';
 
-const SHARED_SKILLS_DIR = '/docker/shared-skills';
 
 /**
  * POST /api/skills/promote

package/app/api/skills/route.js

@@ -3,8 +3,8 @@ import fs from 'fs';
 import path from 'path';
 import { execSync, execFileSync } from 'child_process';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { SHARED_SKILLS_DIR } from '@/lib/rev4a-paths';
 
-const SHARED_SKILLS_DIR = '/docker/shared-skills';
 const CONTAINER_BUNDLED_SKILLS_DIR = '/usr/local/lib/node_modules/openclaw/skills';
 
 function readSkillMeta(skillDir, name, type, agentId) {

package/app/api/skills/save/route.js

@@ -3,10 +3,25 @@ import fs from 'fs';
 import path from 'path';
 import { execSync, execFileSync } from 'child_process';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { SHARED_SKILLS_DIR } from '@/lib/rev4a-paths';
 
-const SHARED_SKILLS_DIR = '/docker/shared-skills';
 const BUNDLED_SKILLS_DIR = '/usr/lib/node_modules/openclaw/skills';
 
+/**
+ * Pick an HTTP status from a caught error.
+ *
+ * Only the deliberate `Object.assign(new Error(…), { status: 404 })` throws in
+ * this file carry a real HTTP status. A failing `docker exec` also sets
+ * `.status`, but to the process exit code — usually 1. Passing that straight
+ * to NextResponse makes undici throw `RangeError: init["status"] must be in
+ * the range of 200 to 599`, so the caller got an opaque 500 with no body
+ * instead of the intended error. Anything outside the valid range falls back.
+ */
+function httpStatus(err, fallback) {
+  const s = err?.status;
+  return Number.isInteger(s) && s >= 200 && s <= 599 ? s : fallback;
+}
+
 /**
  * Read SKILL.md content from various sources:
  * - Host path (shared / bundled)
@@ -96,8 +111,7 @@ export async function POST(request) {
     return NextResponse.json({ ok: true, saved: isContainer ? skillPath : absPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : 'Internal error';
-    const status = err.status || 500;
-    return NextResponse.json({ error: msg }, { status });
+    return NextResponse.json({ error: msg }, { status: httpStatus(err, 500) });
   }
 }
 
@@ -136,7 +150,6 @@ export async function GET(request) {
     return NextResponse.json({ content });
   } catch (err) {
     const msg = err instanceof Error ? err.message : 'Internal error';
-    const status = err.status || 404;
-    return NextResponse.json({ error: msg }, { status });
+    return NextResponse.json({ error: msg }, { status: httpStatus(err, 404) });
   }
 }

package/app/api/update-check/route.ts

@@ -1,5 +1,4 @@
 import { NextResponse } from 'next/server';
-import { jwtVerify } from 'jose';
 import { execSync } from 'child_process';
 import { readFileSync } from 'fs';
 import { join } from 'path';
@@ -33,7 +32,8 @@ const CACHE_TTL_MS = 15 * 60 * 1000;
  * GET /api/update-check
  */
 export async function GET(request: Request): Promise<NextResponse> {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const url = new URL(request.url);
   const check = url.searchParams.get('check') === '1';
 
@@ -71,23 +71,6 @@ export async function GET(request: Request): Promise<NextResponse> {
   return NextResponse.json({ installed, latest, updateAvailable, package: getPackageInfo().name });
 }
 
-async function verifyAuth(request: Request): Promise<boolean> {
-  const raw = request.headers.get('cookie') || '';
-  const match = raw.split(';').map(c => c.trim()).find(c => c.startsWith('rev4a_token='));
-  if (!match) return false;
-
-  const cookieToken = decodeURIComponent(match.split('=')[1]);
-  try {
-    const secret = new TextEncoder().encode(
-      process.env.REV4A_JWT_SECRET || (() => { throw new Error('REV4A_JWT_SECRET not set'); })(),
-    );
-    await jwtVerify(cookieToken, secret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * POST /api/update-check
  *
@@ -97,10 +80,8 @@ async function verifyAuth(request: Request): Promise<boolean> {
  * with the newly installed binary. No systemd required.
  */
 export async function POST(request: Request): Promise<NextResponse> {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
-  if (!(await verifyAuth(request))) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-  }
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
 
   // Spawn rev4a update in background, then write restart flag directly
   // from this process so rev4a serve detects it and restarts.

package/app/api/wizard/complete/route.ts

@@ -4,16 +4,20 @@
  * Sets wizard as complete in a persistent file (cross-browser).
  * Also sets the httpOnly cookie for backwards compatibility.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
 import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
-const WIZARD_FILE = REV4A_DATA + '/data/wizard.json';
+const WIZARD_FILE = path.join(REV4A_DATA, 'data', 'wizard.json');
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
 
-export function POST(): NextResponse {
   // Write persistent marker
   const dir = path.dirname(WIZARD_FILE);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

package/app/api/wizard/reset/route.ts

@@ -4,15 +4,20 @@
  * Clears the wizard marker so the wizard runs again.
  * Removes both the persistent file and the cookie.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
+import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
-const WIZARD_FILE = REV4A_DATA + '/data/wizard.json';
+const WIZARD_FILE = path.join(REV4A_DATA, 'data', 'wizard.json');
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
 
-export function POST(): NextResponse {
   // Remove persistent marker
   try { fs.unlinkSync(WIZARD_FILE); } catch { /* ignore */ }
 

package/app/api/wizard/status/route.ts

@@ -4,13 +4,15 @@
  * Returns whether the wizard is complete.
  * Checks a persistent file so it survives browser changes and cache clears.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
+import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
-const WIZARD_FILE = REV4A_DATA + '/data/wizard.json';
+const WIZARD_FILE = path.join(REV4A_DATA, 'data', 'wizard.json');
 
 function readWizardFile(): boolean {
   try {
@@ -22,7 +24,8 @@ function readWizardFile(): boolean {
   }
 }
 
-export function GET(): NextResponse {
-  const done = readWizardFile();
-  return NextResponse.json({ done });
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
+  return NextResponse.json({ done: readWizardFile() });
 }

package/app/components/AuthGuard.tsx

@@ -7,17 +7,38 @@ import { useRouter, usePathname } from 'next/navigation';
 const authCache = { valid: false, checked: false, ts: 0 };
 const AUTH_CACHE_TTL = 30_000; // 30s before re-check
 
+function isCacheValid(): boolean {
+  return authCache.checked && authCache.valid && (Date.now() - authCache.ts) < AUTH_CACHE_TTL;
+}
+
 export default function AuthGuard({ children }: { children: React.ReactNode }) {
   const router = useRouter();
   const pathname = usePathname();
   const [redirecting, setRedirecting] = useState(false);
   const checkingRef = useRef(false);
 
+  // Which pathname the last successful check applies to. Kept per-path so a
+  // client-side navigation to a different protected route can't inherit the
+  // previous route's "verified" state and flash its content for a frame.
+  const [verifiedPath, setVerifiedPath] = useState<string | null>(null);
+
+  const isPublicRoute = pathname === '/setup' || pathname === '/login';
+  // Evaluated fresh on every render (not held in state), so an expired cache
+  // closes the gate immediately rather than one paint late.
+  const ready = isPublicRoute || isCacheValid() || verifiedPath === pathname;
+
   useEffect(() => {
+    // A redirect that has landed is finished: clear the flag on every
+    // navigation, otherwise the render gate below stays closed forever and
+    // the destination page renders blank. (AppShell currently unmounts this
+    // component for /login, /setup and /wizard, which used to hide the bug —
+    // don't depend on that staying true.)
+    setRedirecting(false);
+
     // /setup: always accessible
     if (pathname === '/setup') return;
 
-    // /login: public, check if already authenticated
+    // /login: public, but bounce to /setup if no password exists yet
     if (pathname === '/login') {
       fetch('/api/auth/status')
         .then((r) => r.json())
@@ -31,18 +52,16 @@ export default function AuthGuard({ children }: { children: React.ReactNode }) {
     // Already checking — prevent duplicate
     if (checkingRef.current) return;
 
-    // Cache hit — skip check
-    if (authCache.checked && authCache.valid && (Date.now() - authCache.ts) < AUTH_CACHE_TTL) {
-      return; // Still valid, no re-check
-    }
+    // Cache hit — content is already known-good, `ready` above covers it
+    if (isCacheValid()) return;
 
     checkingRef.current = true;
 
-    // Protected routes — check auth in background
+    // Protected route with no valid cache — verify before revealing content
     fetch('/api/auth/check')
       .then(async (r) => {
         if (!r.ok) {
-          // Not authenticated — redirect
+          // Not authenticated — redirect, keep content hidden
           authCache.valid = false;
           authCache.checked = true;
           const status = await fetch('/api/auth/status').then((r2) => r2.json());
@@ -55,6 +74,7 @@ export default function AuthGuard({ children }: { children: React.ReactNode }) {
         authCache.valid = true;
         authCache.checked = true;
         authCache.ts = Date.now();
+        setVerifiedPath(pathname);
 
         if (pathname === '/wizard') return;
 
@@ -86,6 +106,7 @@ export default function AuthGuard({ children }: { children: React.ReactNode }) {
       });
   }, [pathname, router]);
 
-  // NEVER hide children — always render, auth check happens in background
+  if (redirecting) return null;
+  if (!ready) return null; // hold content until this route's check resolves
   return <>{children}</>;
 }