@flame0510/project-aether 1.1.12 → 1.1.14

package/app/api/agents/image-status/route.ts

@@ -2,125 +2,134 @@ import { type NextRequest } from "next/server";
 /**
  * GET /api/agents/image-status
  *
- * Checks whether the openclaw-agent-base image is present and up to date.
- * Compares the local image digest with the remote registry digest
- * (public image on ghcr.io, no auth needed).
+ * Reports whether the openclaw-agent-base image is present, whether a download
+ * is in flight, and whether a newer image exists in the registry.
+ *
+ * The four fields cost wildly different amounts, which is what makes this route
+ * worth structuring carefully. ImageDownloadBanner polls it every 2s to animate
+ * download progress, so anything slow in here is paid over and over:
+ *
+ *   downloading   in-memory flag                          free
+ *   error         local                                   free
+ *   exists        one `docker image inspect`              ~0.5s
+ *   needsUpdate   `docker manifest inspect` over the net  ~3.4s
+ *
+ * The route used to compute all of them, synchronously, on every poll — a 2s
+ * interval driving a ~5s blocking call, so the whole server sat frozen for as
+ * long as the agents page stayed open. It also ran `docker version` three times
+ * per request (once inside each helper) just to ask whether Docker was up, at
+ * ~2s a call, and inspected the same image three times over.
+ *
+ * Now: Docker liveness comes from the socket check in lib/docker-socket (a
+ * cached filesystem stat), the image is inspected once, everything is async, and
+ * the registry lookup — the only genuinely expensive part — is cached. The base
+ * image changes when a release is published, not every two seconds.
  */
 import { NextResponse } from 'next/server';
-import { execSync } from 'child_process';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
 import { getIsDownloading } from '@/lib/buildAgentImage';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { dockerAvailable } from '@/lib/docker-socket';
+
+const execFileAsync = promisify(execFile);
 
 export const dynamic = 'force-dynamic';
 
 const REGISTRY_IMAGE = 'ghcr.io/flame0510/rev4a/openclaw-agent-base:latest';
 const LOCAL_IMAGE = 'openclaw-agent-base:latest';
+const REGISTRY_PREFIX = 'ghcr.io/flame0510/rev4a/openclaw-agent-base@';
 
-function dockerOk(): boolean {
-  try {
-    execSync('docker version --format "{{.Client.Version}}" 2>/dev/null', {
-      encoding: 'utf-8',
-      timeout: 2000,
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
+/**
+ * How long a registry lookup is reused. Long enough that a 2s poll doesn't hit
+ * the network, short enough that a freshly published base image surfaces on its
+ * own. The cost of being stale here is a banner appearing a few minutes late.
+ */
+const REMOTE_TTL_MS = 10 * 60 * 1000;
 
-function localImageExists(): boolean {
-  if (!dockerOk()) return false;
-  try {
-    execSync(
-      `docker image inspect ${LOCAL_IMAGE} --format "{{.ID}}" 2>/dev/null`,
-      { timeout: 3000 },
-    );
-    return true;
-  } catch {
-    return false;
-  }
-}
+let remoteCache: { digest: string | null; at: number } | null = null;
+/** Shared across concurrent requests so a burst of polls triggers one lookup. */
+let remoteInFlight: Promise<string | null> | null = null;
 
-function getLocalImageId(): string | null {
-  if (!dockerOk()) return null;
+/** The local image's ID and its registry digest, from a single inspect. */
+async function inspectLocalImage(): Promise<{ id: string; registryDigest: string | null } | null> {
   try {
-    return execSync(
-      `docker image inspect ${LOCAL_IMAGE} --format "{{.ID}}" 2>/dev/null`,
-      { encoding: 'utf-8', timeout: 3000 },
-    ).trim() || null;
+    const { stdout } = await execFileAsync(
+      'docker',
+      ['image', 'inspect', LOCAL_IMAGE, '--format', '{{json .}}'],
+      { encoding: 'utf-8', timeout: 5000 },
+    );
+    const info = JSON.parse(stdout) as { Id?: string; RepoDigests?: string[] };
+    const fromRegistry = (info.RepoDigests ?? []).find((d) => d.startsWith(REGISTRY_PREFIX));
+    return {
+      id: info.Id ?? '',
+      registryDigest: fromRegistry ? fromRegistry.split('@')[1] ?? null : null,
+    };
   } catch {
     return null;
   }
 }
 
-/** Fetch the remote manifest digest from ghcr.io (public, no auth). */
-function getRemoteDigest(): string | null {
-  if (!dockerOk()) return null;
+/** Manifest digest of the published image, cached for REMOTE_TTL_MS. */
+async function getRemoteDigest(): Promise<string | null> {
+  if (remoteCache && Date.now() - remoteCache.at < REMOTE_TTL_MS) return remoteCache.digest;
+  if (remoteInFlight) return remoteInFlight;
+
+  remoteInFlight = (async () => {
+    try {
+      const { stdout } = await execFileAsync(
+        'docker',
+        ['manifest', 'inspect', REGISTRY_IMAGE, '--verbose'],
+        { encoding: 'utf-8', timeout: 15000 },
+      );
+      const manifest = JSON.parse(stdout) as { Descriptor?: { digest?: string } };
+      // The descriptor digest is what RepoDigests can be compared against;
+      // config.digest is a different hash entirely.
+      return manifest?.Descriptor?.digest ?? null;
+    } catch {
+      return null;
+    }
+  })();
+
   try {
-    const out = execSync(
-      `docker manifest inspect ${REGISTRY_IMAGE} --verbose 2>/dev/null`,
-      { encoding: 'utf-8', timeout: 15000 },
-    );
-    const manifest = JSON.parse(out);
-    // Use the manifest descriptor digest (comparable with RepoDigests),
-    // not config.digest (which is a different hash).
-    return manifest?.Descriptor?.digest || null;
-  } catch {
-    return null;
+    const digest = await remoteInFlight;
+    remoteCache = { digest, at: Date.now() };
+    return digest;
+  } finally {
+    remoteInFlight = null;
   }
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
-  const exists = localImageExists();
-  const localId = getLocalImageId();
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
+
   const downloading = getIsDownloading();
 
-  if (!exists) {
-    return NextResponse.json({
-      exists: false,
-      needsUpdate: true,
-      downloading,
-      localId: null,
-    });
+  if (!dockerAvailable()) {
+    return NextResponse.json({ exists: false, needsUpdate: true, downloading, localId: null });
   }
 
-  // Compare local image digest with remote registry digest.
-  // If they differ, a newer image is available.
-  let needsUpdate = false;
-  const remoteDigest = getRemoteDigest();
+  const local = await inspectLocalImage();
+  if (!local) {
+    return NextResponse.json({ exists: false, needsUpdate: true, downloading, localId: null });
+  }
 
-  if (remoteDigest && localId) {
-    // localId is the image ID (e.g. sha256:abc123...).
-    // Extract it from any RepoDigest that references the registry.
-    try {
-      const inspect = JSON.parse(
-        execSync(
-          `docker image inspect ${LOCAL_IMAGE} --format '{{json .}}' 2>/dev/null`,
-          { encoding: 'utf-8', timeout: 3000 },
-        ),
-      );
-      const localRepoDigests: string[] = inspect?.RepoDigests || [];
-      const registryDigest = localRepoDigests.find((d: string) =>
-        d.startsWith('ghcr.io/flame0510/rev4a/openclaw-agent-base@'),
-      );
+  // A cached registry digest answers immediately; a cold one costs a network
+  // round trip, but only once per TTL rather than once per poll.
+  const remoteDigest = await getRemoteDigest();
 
-      if (registryDigest) {
-        // Extract sha256:... from "ghcr.io/...@sha256:xxx"
-        const localDigest = registryDigest.split('@')[1] || '';
-        needsUpdate = localDigest !== remoteDigest;
-      } else {
-        // Image was built locally, never pulled — needs update
-        needsUpdate = true;
-      }
-    } catch {
-      // Can't determine — assume up to date
-    }
+  let needsUpdate = false;
+  if (remoteDigest) {
+    // No registry digest locally means the image was built here and never
+    // pulled, so it can't be compared — treat it as updatable.
+    needsUpdate = local.registryDigest ? local.registryDigest !== remoteDigest : true;
   }
 
   return NextResponse.json({
     exists: true,
     needsUpdate,
     downloading,
-    localId,
+    localId: local.id || null,
   });
 }

package/app/api/agents/route.ts

@@ -1,48 +1,12 @@
 import { NextResponse, type NextRequest } from 'next/server';
-import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
-import { detectPublicHost } from '@/lib/docker-utils';
 import { AGENTS_TOKEN_FILE } from '@/lib/rev4a-paths';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
-
-const DOCKER_SOCKET = '/var/run/docker.sock';
-
-function dockerFetch(method: string, path: string): Promise<any> {
-  return new Promise((resolve, reject) => {
-    const options = {
-      socketPath: DOCKER_SOCKET,
-      path,
-      method,
-      headers: { 'Host': 'localhost' } as any,
-    };
-    const req = http.request(options, (res: any) => {
-      let data = '';
-      res.on('data', (chunk: string) => (data += chunk));
-      res.on('end', () => {
-        try {
-          resolve(JSON.parse(data));
-        } catch {
-          reject(new Error('Invalid JSON from Docker API'));
-        }
-      });
-    });
-    req.on('error', reject);
-    req.end();
-  });
-}
+import { dockerAvailable, dockerFetch } from '@/lib/docker-socket';
 
 export const dynamic = 'force-dynamic';
 
-function dockerAvailable(): boolean {
-  try {
-    fs.accessSync(DOCKER_SOCKET, fs.constants.R_OK | fs.constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request); if (denied) return denied as any;
   // If Docker is not available (e.g. testing environment), return empty list
@@ -73,7 +37,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
         let created: string | null = null;
         let env: string[] = [];
         let authToken: string | null = null;
-        let traefikUrl: string | null = null;
+        let controlPort: string | null = null;
         let portBindings: Record<string, Array<{ HostIp: string; HostPort: string }>> | null = null;
 
         try {
@@ -124,22 +88,15 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
             }
           }
 
-          // Build the agent URL from the host's public IP + mapped port.
-          // Every agent has -p <port>:3000, so we look for the public port
-          // that maps to the internal port 3000.
-          // Use portBindings from inspect (works stopped) with fallback to c.Ports (running only).
+          // The host port mapped to the agent's Control UI (container port 3000).
+          // Only the port is returned: the browser composes the full URL, because
+          // only the browser knows which hostname actually reaches this machine.
+          // Read from portBindings (works on a stopped container) with a fallback
+          // to c.Ports, which is only populated while running.
           const port3000Binding = portBindings?.['3000/tcp'];
-          const publicPort = port3000Binding?.[0]?.HostPort
-            || (c.Ports || []).find((p: any) => p.PublicPort && p.PrivatePort === 3000)?.PublicPort
+          controlPort = port3000Binding?.[0]?.HostPort
+            || (c.Ports || []).find((p: any) => p.PublicPort && p.PrivatePort === 3000)?.PublicPort?.toString()
             || null;
-          if (publicPort) {
-            const host = detectPublicHost();
-            let baseUrl = `http://${host}:${publicPort}`;
-            if (authToken) {
-              baseUrl += `#token=${encodeURIComponent(authToken)}`;
-            }
-            traefikUrl = baseUrl;
-          }
         } catch {
           // inspect non-critical, continue with partial data
         }
@@ -185,7 +142,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
           ip,
           created,
           env,
-          traefikUrl,
+          controlPort,
           authToken,
           // Flag as outdated when the container's image differs from the current base image.
           // We compare raw ImageID digests — no fragile name-based filtering.

package/app/api/agents/token/route.ts

@@ -29,11 +29,14 @@ function shellQuote(value: string): string {
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   return NextResponse.json(readTokenFile());
 }
 
 export async function PUT(request: NextRequest): Promise<NextResponse> {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const body = await request.json();
     const token = typeof body?.token === 'string' ? body.token : null;

package/app/api/auth/check/route.ts

@@ -1,33 +1,12 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { jwtVerify } from 'jose';
-import * as fs from 'fs';
-import { ENV_FILE } from '@/lib/rev4a-paths';
-
-function getJwtSecret(): Uint8Array {
-  const fromEnv = process.env.REV4A_JWT_SECRET;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) {
-    return new TextEncoder().encode(fromEnv);
-  }
-  // Fallback: read from persistent .env
-  for (const file of [ENV_FILE]) {
-    try {
-      if (fs.existsSync(file)) {
-        const content = fs.readFileSync(file, 'utf-8');
-        const match = content.match(/^REV4A_JWT_SECRET=(.*)$/m);
-        if (match && match[1].trim()) {
-          return new TextEncoder().encode(match[1].trim());
-        }
-      }
-    } catch { /* ignore */ }
-  }
-  return new TextEncoder().encode('');
-}
+import { getJwtSecret } from '@/lib/rev4a-auth';
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const cookieToken = request.cookies.get('rev4a_token')?.value;
   if (cookieToken) {
     try {
-      const secret = getJwtSecret();
+      const secret = new TextEncoder().encode(getJwtSecret());
       await jwtVerify(cookieToken, secret);
       return NextResponse.json({ authenticated: true });
     } catch {

package/app/api/auth/login/route.ts

@@ -1,43 +1,11 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { SignJWT } from 'jose';
-import * as fs from 'fs';
-import { ENV_FILE } from '@/lib/rev4a-paths';
-
-// ---------------------------------------------------------------------------
-// Resolve credentials at runtime from the persistent .env file.
-// ---------------------------------------------------------------------------
-function getEnvPassword(): string {
-  const fromEnv = process.env.REV4A_PASSWORD;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) return fromEnv;
-
-  try {
-    if (fs.existsSync(ENV_FILE)) {
-      const content = fs.readFileSync(ENV_FILE, 'utf-8');
-      const match = content.match(/^REV4A_PASSWORD=(.*)$/m);
-      if (match && match[1].trim()) return match[1].trim();
-    }
-  } catch { /* ignore */ }
-  return '';
-}
-
-function getEnvJwtSecret(): string {
-  const fromEnv = process.env.REV4A_JWT_SECRET;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) return fromEnv;
-
-  try {
-    if (fs.existsSync(ENV_FILE)) {
-      const content = fs.readFileSync(ENV_FILE, 'utf-8');
-      const match = content.match(/^REV4A_JWT_SECRET=(.*)$/m);
-      if (match && match[1].trim()) return match[1].trim();
-    }
-  } catch { /* ignore */ }
-  return '';
-}
+import { getPassword, getJwtSecret } from '@/lib/rev4a-auth';
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
-    const password = getEnvPassword();
-    const jwtSecret = getEnvJwtSecret();
+    const password = getPassword();
+    const jwtSecret = getJwtSecret();
 
     if (!password) {
       console.error('[auth] No password configured — rejecting login');

package/app/api/auth/logout/route.ts

@@ -2,6 +2,6 @@ import { NextResponse } from 'next/server';
 
 export async function POST(): Promise<NextResponse> {
   const response = NextResponse.json({ ok: true });
-  response.cookies.delete('rev4a_token');
+  response.cookies.delete({ name: 'rev4a_token', path: '/' });
   return response;
 }

package/app/api/auth/status/route.ts

@@ -1,6 +1,5 @@
 import { NextResponse } from 'next/server';
-import * as fs from 'fs';
-import { ENV_FILE } from '@/lib/rev4a-paths';
+import { isConfigured } from '@/lib/rev4a-auth';
 
 /**
  * GET /api/auth/status
@@ -11,23 +10,5 @@ import { ENV_FILE } from '@/lib/rev4a-paths';
  * the setup wizard or the login form.
  */
 export function GET(): NextResponse {
-  let password = process.env.REV4A_PASSWORD;
-
-  // Fallback: read .env from config dir if env var is empty (Next.js inlines at build)
-  if (typeof password !== 'string' || password.length === 0) {
-    try {
-      if (fs.existsSync(ENV_FILE)) {
-        const content = fs.readFileSync(ENV_FILE, 'utf-8');
-        const match = content.match(/^REV4A_PASSWORD=(.*)$/m);
-        if (match && match[1].trim()) {
-          password = match[1].trim();
-        }
-      }
-    } catch {
-      // ignore
-    }
-  }
-
-  const configured = typeof password === 'string' && password.length > 0;
-  return NextResponse.json({ configured });
+  return NextResponse.json({ configured: isConfigured() });
 }

package/app/api/config/env/route.ts

@@ -5,7 +5,8 @@
  * PUT  /api/config/env  — upsert one or more env vars
  *
  * Only keys prefixed with REV4A_ or PROVIDER_ are exposed.
- * Auth: browser cookie (authenticated session via middleware).
+ * Auth: requireAuthJWT (browser cookie or bearer token) — API routes are
+ * never covered by proxy.ts, it explicitly exempts /api/*.
  */
 import { NextRequest, NextResponse } from 'next/server';
 import * as fs from 'fs';
@@ -54,6 +55,8 @@ function serializeEnvFile(vars: Record<string, string>): string {
 }
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     let content = '';
     try {
@@ -78,7 +81,8 @@ export async function GET(request: NextRequest) {
 }
 
 export async function PUT(request: NextRequest) {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const body: { env?: Record<string, string> } = await request.json();
     if (!body.env || typeof body.env !== 'object') {
@@ -115,7 +119,7 @@ export async function PUT(request: NextRequest) {
 
     // Reload systemd so EnvironmentFile= picks up .env changes on next restart.
     // No need to write individual Environment= lines into unit files —
-    // rev4a-next.service already reads .env via EnvironmentFile=.
+    // rev4a.service already reads .env via EnvironmentFile=.
     try {
       execSync('sudo systemctl daemon-reload', { timeout: 5000 });
     } catch (syncErr) {

package/app/api/config/restart/route.ts

@@ -13,6 +13,8 @@ export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
 
 export async function POST(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     execSync('sudo systemctl daemon-reload && sudo systemctl restart rev4a.service', {
       timeout: 15000,

package/app/api/containers/route.ts

@@ -1,44 +1,13 @@
 import { type NextRequest } from "next/server";
 import { NextResponse } from 'next/server';
-import * as http from 'http';
-import * as fs from 'fs';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
-
-const DOCKER_SOCKET = '/var/run/docker.sock';
-
-function dockerAvailable(): boolean {
-  try {
-    fs.accessSync(DOCKER_SOCKET, fs.constants.R_OK | fs.constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function dockerFetch(method: string, path: string): Promise<any> {
-  return new Promise((resolve, reject) => {
-    const options = {
-      socketPath: DOCKER_SOCKET,
-      path,
-      method,
-      headers: { 'Host': 'localhost' } as any,
-    };
-    const req = http.request(options, (res: any) => {
-      let data = '';
-      res.on('data', (chunk: string) => data += chunk);
-      res.on('end', () => {
-        try { resolve(JSON.parse(data)); }
-        catch { reject(new Error('Invalid JSON from Docker')); }
-      });
-    });
-    req.on('error', reject);
-    req.end();
-  });
-}
+import { dockerAvailable, dockerFetch } from '@/lib/docker-socket';
 
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   if (!dockerAvailable()) {
     return NextResponse.json([]);
   }

package/app/api/crons/route.ts

@@ -7,6 +7,8 @@ import { requireAuthJWT } from '@/lib/rev4a-auth';
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const result = await listOpenClawCronJobs();
   return NextResponse.json(result.jobs);
 }

package/app/api/debug/route.ts

@@ -3,6 +3,8 @@ import { NextResponse } from 'next/server';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   return NextResponse.json({
     hasPassword: !!process.env.REV4A_PASSWORD,
     hasJwtSecret: !!process.env.REV4A_JWT_SECRET,

package/app/api/envcheck/route.ts

@@ -2,9 +2,11 @@ import { type NextRequest } from "next/server";
 import { NextResponse } from 'next/server';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
-const SENSITIVE = ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET'];
+const SENSITIVE = ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET', 'PROVIDER_DEEPSEEK_API_KEY'];
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const safe: Record<string, string> = {};
   for (const key of ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET', 'REV4A_ALERTS_ENABLED', 'REV4A_DB', 'REV4A_WORKSPACE_ROOT', 'PROVIDER_DEEPSEEK_API_KEY', 'NODE_ENV']) {
     const val = process.env[key];

package/app/api/gateway/agent/route.ts

@@ -126,12 +126,14 @@ export async function PUT(request: NextRequest) {
       { timeout: 15000, maxBuffer: 1024 * 1024, input: newConfig },
     );
 
-    // Restart gateway to pick up the changes
-    try {
-      execSync(`docker exec ${safeContainer} openclaw gateway restart`, { timeout: 15000, maxBuffer: 64 * 1024 });
-    } catch {
-      // restart failure is non-fatal, config was written
-    }
+    // No gateway restart: the Gateway watches openclaw.json and hot-applies this.
+    // Confirmed against a live agent by writing the file exactly the way this
+    // route does — the container logged:
+    //   [reload] config change detected; evaluating reload (agents.defaults.model.primary)
+    //   [reload] config hot reload applied (agents.defaults.model.primary)
+    // OpenClaw's docs put `agents` in the no-restart column, and gateway.reload
+    // defaults to `hybrid`, which restarts on its own for the sections that do
+    // need it. The restart here cost ~7.5s of fully blocked event loop.
 
     // Verify
     const verifyRaw = readFileFromContainer(safeContainer, '/root/.openclaw/openclaw.json');