@flame0510/project-aether 1.1.12 → 1.1.14

package/app/api/skills/route.js

@@ -1,11 +1,19 @@
 import { NextResponse } from 'next/server';
 import fs from 'fs';
 import path from 'path';
-import { execSync, execFileSync } from 'child_process';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { SHARED_SKILLS_DIR } from '@/lib/rev4a-paths';
+import { dockerExecShellNoFail, mapWithConcurrency } from '@/lib/docker-exec';
+
+const execFileAsync = promisify(execFile);
 
-const SHARED_SKILLS_DIR = '/docker/shared-skills';
 const CONTAINER_BUNDLED_SKILLS_DIR = '/usr/local/lib/node_modules/openclaw/skills';
+const WORKSPACE_SKILLS_DIR = '/root/.openclaw/workspace/skills';
+
+/** Agents read at once — each is a single bulk `docker exec`. */
+const AGENT_QUERY_CONCURRENCY = 6;
 
 function readSkillMeta(skillDir, name, type, agentId) {
   const skillMdPath = path.join(skillDir, name, 'SKILL.md');
@@ -41,22 +49,19 @@ function readSkillMeta(skillDir, name, type, agentId) {
  * Discover agent containers with AGENT_ID label.
  * Returns [{ containerName, agentId }]
  */
-function discoverAgentContainers() {
+async function discoverAgentContainers() {
   try {
-    // Get container names with AGENT_ID label
-    const namesRaw = execFileSync('docker', [
-      'ps', '--filter', 'label=AGENT_ID', '--format', '{{.Names}}'
-    ], { encoding: 'utf8', timeout: 5000 }).trim();
-    if (!namesRaw) return [];
-
-    return namesRaw.split('\n').map(name => {
-      const containerName = name.trim();
-      if (!containerName) return null;
-      // Get agent ID from label using docker inspect
-      const agentId = execFileSync('docker', [
-        'inspect', containerName, '--format', '{{index .Config.Labels "AGENT_ID"}}'
-      ], { encoding: 'utf8', timeout: 5000 }).trim();
-      return { containerName, agentId: agentId || containerName };
+    // `docker ps` prints labels itself, so the AGENT_ID comes back with the name.
+    // This used to follow up with a `docker inspect` per container to read that
+    // same label — N+1 process spawns for data the first call already had.
+    const { stdout } = await execFileAsync('docker', [
+      'ps', '--filter', 'label=AGENT_ID', '--format', '{{.Label "AGENT_ID"}}\t{{.Names}}'
+    ], { encoding: 'utf8', timeout: 5000 });
+
+    return stdout.trim().split('\n').map(line => {
+      const [agentId, containerName] = line.split('\t');
+      if (!containerName?.trim()) return null;
+      return { containerName: containerName.trim(), agentId: agentId?.trim() || containerName.trim() };
     }).filter(Boolean);
   } catch {
     return [];
@@ -64,42 +69,44 @@ function discoverAgentContainers() {
 }
 
 /**
- * Read skill directories from a container agent's workspace via docker exec.
- * Returns an array of skill names found.
+ * Read every SKILL.md under `dir` in one shot.
+ *
+ * The previous approach ran `docker exec … cat` once per skill. With 52 bundled
+ * skills in the base image that was 52 sequential process spawns at ~260ms each
+ * — roughly 13s of blocked event loop to read 52 text files sitting in the same
+ * container.
+ *
+ * The shell loop emits `path\0content\0` pairs. NUL is the delimiter precisely
+ * because it cannot occur inside the text files being read, so no SKILL.md can
+ * forge a record boundary — a risk any printable separator would carry.
+ *
+ * Returns a Map of skill name → SKILL.md contents.
  */
-function readContainerSkillDirs(containerName) {
-  const workspaceSkillsPath = '/root/.openclaw/workspace/skills';
-  try {
-    // Check if the skills directory exists
-    execFileSync('docker', ['exec', containerName, 'test', '-d', workspaceSkillsPath], {
-      encoding: 'utf8', timeout: 5000
-    });
-
-    // List subdirectories (each is a potential skill)
-    const raw = execFileSync('docker', ['exec', containerName, 'ls', '-1', workspaceSkillsPath], {
-      encoding: 'utf8', timeout: 5000
-    }).trim();
-
-    if (!raw) return [];
-
-    return raw.split('\n').map(line => line.trim()).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Read SKILL.md content from inside a container.
- */
-function readContainerSkillMd(containerName, skillName) {
-  const filePath = `/root/.openclaw/workspace/skills/${skillName}/SKILL.md`;
-  try {
-    return execFileSync('docker', ['exec', containerName, 'cat', filePath], {
-      encoding: 'utf8', timeout: 5000
-    });
-  } catch {
-    return null;
+async function readSkillsBulk(containerName, dir) {
+  const script =
+    `for d in ${dir}/*/; do ` +
+    `[ -f "$d/SKILL.md" ] || continue; ` +
+    `n=$(basename "$d"); ` +
+    `printf '%s\\0' "$n"; ` +
+    `cat "$d/SKILL.md"; ` +
+    `printf '\\0'; ` +
+    `done`;
+
+  const raw = await dockerExecShellNoFail(containerName, script, {
+    timeoutMs: 15000,
+    maxBuffer: 8 * 1024 * 1024,
+  });
+
+  const out = new Map();
+  if (!raw) return out;
+
+  const parts = raw.split('\0');
+  // Pairs of name, content — a trailing empty element from the final NUL is fine.
+  for (let i = 0; i + 1 < parts.length; i += 2) {
+    const name = parts[i].trim();
+    if (name) out.set(name, parts[i + 1]);
   }
+  return out;
 }
 
 /**
@@ -136,66 +143,51 @@ export async function GET(request) {
     }
   } catch {}
 
-  // 2. Agent container skills (workspace-local)
-  const agents = discoverAgentContainers();
-  for (const agent of agents) {
-    const dirs = readContainerSkillDirs(agent.containerName);
-    for (const dir of dirs) {
-      const content = readContainerSkillMd(agent.containerName, dir);
-      if (content) {
-        const { description, version } = parseSkillContent(content);
-        skills.push({
-          name: dir,
-          type: 'workspace',
-          agentId: agent.agentId,
-          containerName: agent.containerName,
-          path: `/root/.openclaw/workspace/skills/${dir}`,
-          skillMdPath: `/root/.openclaw/workspace/skills/${dir}/SKILL.md`,
-          hasSkillMd: true,
-          description,
-          version,
-        });
-      }
+  // 2. Agent container skills (workspace-local) — one bulk read per agent,
+  //    agents queried concurrently.
+  const agents = await discoverAgentContainers();
+  const perAgent = await mapWithConcurrency(agents, AGENT_QUERY_CONCURRENCY, (agent) =>
+    readSkillsBulk(agent.containerName, WORKSPACE_SKILLS_DIR),
+  );
+
+  for (const [i, found] of perAgent.entries()) {
+    const agent = agents[i];
+    for (const [name, content] of found) {
+      const { description, version } = parseSkillContent(content);
+      skills.push({
+        name,
+        type: 'workspace',
+        agentId: agent.agentId,
+        containerName: agent.containerName,
+        path: `${WORKSPACE_SKILLS_DIR}/${name}`,
+        skillMdPath: `${WORKSPACE_SKILLS_DIR}/${name}/SKILL.md`,
+        hasSkillMd: true,
+        description,
+        version,
+      });
     }
   }
 
-  // 3. Bundled skills (read-only) — discover from any agent container
+  // 3. Bundled skills (read-only) — identical in every agent, so the first
+  //    container that answers is enough. One bulk read instead of 52 `cat`s.
   try {
-    let bundledDirNames = [];
-    let bundledSourceContainer = null;
-
-    if (agents.length > 0) {
-      for (const agent of agents) {
-        try {
-          const raw = execFileSync('docker', [
-            'exec', agent.containerName, 'ls', '-1', CONTAINER_BUNDLED_SKILLS_DIR
-          ], { encoding: 'utf8', timeout: 5000 }).trim();
-          if (raw) {
-            bundledDirNames = raw.split('\n').map(l => l.trim()).filter(Boolean);
-            bundledSourceContainer = agent.containerName;
-            break;
-          }
-        } catch { /* try next container */ }
-      }
-    }
+    for (const agent of agents) {
+      const found = await readSkillsBulk(agent.containerName, CONTAINER_BUNDLED_SKILLS_DIR);
+      if (found.size === 0) continue; // container not ready — try the next one
 
-    for (const name of bundledDirNames) {
-      try {
-        const skillMdPath = `${CONTAINER_BUNDLED_SKILLS_DIR}/${name}/SKILL.md`;
-        const content = execFileSync('docker', [
-          'exec', bundledSourceContainer, 'cat', skillMdPath
-        ], { encoding: 'utf8', timeout: 5000 });
+      for (const [name, content] of found) {
         const { description, version } = parseSkillContent(content);
         skills.push({
           name,
           type: 'bundled',
           path: `${CONTAINER_BUNDLED_SKILLS_DIR}/${name}`,
-          skillMdPath,
+          skillMdPath: `${CONTAINER_BUNDLED_SKILLS_DIR}/${name}/SKILL.md`,
           hasSkillMd: true,
           description,
           version,
         });
-      } catch { /* skip this skill */ }
+      }
+      break;
     }
   } catch {}
 

package/app/api/skills/save/route.js

@@ -3,10 +3,25 @@ import fs from 'fs';
 import path from 'path';
 import { execSync, execFileSync } from 'child_process';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { SHARED_SKILLS_DIR } from '@/lib/rev4a-paths';
 
-const SHARED_SKILLS_DIR = '/docker/shared-skills';
 const BUNDLED_SKILLS_DIR = '/usr/lib/node_modules/openclaw/skills';
 
+/**
+ * Pick an HTTP status from a caught error.
+ *
+ * Only the deliberate `Object.assign(new Error(…), { status: 404 })` throws in
+ * this file carry a real HTTP status. A failing `docker exec` also sets
+ * `.status`, but to the process exit code — usually 1. Passing that straight
+ * to NextResponse makes undici throw `RangeError: init["status"] must be in
+ * the range of 200 to 599`, so the caller got an opaque 500 with no body
+ * instead of the intended error. Anything outside the valid range falls back.
+ */
+function httpStatus(err, fallback) {
+  const s = err?.status;
+  return Number.isInteger(s) && s >= 200 && s <= 599 ? s : fallback;
+}
+
 /**
  * Read SKILL.md content from various sources:
  * - Host path (shared / bundled)
@@ -96,8 +111,7 @@ export async function POST(request) {
     return NextResponse.json({ ok: true, saved: isContainer ? skillPath : absPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : 'Internal error';
-    const status = err.status || 500;
-    return NextResponse.json({ error: msg }, { status });
+    return NextResponse.json({ error: msg }, { status: httpStatus(err, 500) });
   }
 }
 
@@ -136,7 +150,6 @@ export async function GET(request) {
     return NextResponse.json({ content });
   } catch (err) {
     const msg = err instanceof Error ? err.message : 'Internal error';
-    const status = err.status || 404;
-    return NextResponse.json({ error: msg }, { status });
+    return NextResponse.json({ error: msg }, { status: httpStatus(err, 404) });
   }
 }

package/app/api/update-check/route.ts

@@ -1,5 +1,4 @@
 import { NextResponse } from 'next/server';
-import { jwtVerify } from 'jose';
 import { execSync } from 'child_process';
 import { readFileSync } from 'fs';
 import { join } from 'path';
@@ -33,7 +32,8 @@ const CACHE_TTL_MS = 15 * 60 * 1000;
  * GET /api/update-check
  */
 export async function GET(request: Request): Promise<NextResponse> {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const url = new URL(request.url);
   const check = url.searchParams.get('check') === '1';
 
@@ -71,23 +71,6 @@ export async function GET(request: Request): Promise<NextResponse> {
   return NextResponse.json({ installed, latest, updateAvailable, package: getPackageInfo().name });
 }
 
-async function verifyAuth(request: Request): Promise<boolean> {
-  const raw = request.headers.get('cookie') || '';
-  const match = raw.split(';').map(c => c.trim()).find(c => c.startsWith('rev4a_token='));
-  if (!match) return false;
-
-  const cookieToken = decodeURIComponent(match.split('=')[1]);
-  try {
-    const secret = new TextEncoder().encode(
-      process.env.REV4A_JWT_SECRET || (() => { throw new Error('REV4A_JWT_SECRET not set'); })(),
-    );
-    await jwtVerify(cookieToken, secret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * POST /api/update-check
  *
@@ -97,10 +80,8 @@ async function verifyAuth(request: Request): Promise<boolean> {
  * with the newly installed binary. No systemd required.
  */
 export async function POST(request: Request): Promise<NextResponse> {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
-  if (!(await verifyAuth(request))) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-  }
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
 
   // Spawn rev4a update in background, then write restart flag directly
   // from this process so rev4a serve detects it and restarts.

package/app/api/wizard/complete/route.ts

@@ -4,16 +4,20 @@
  * Sets wizard as complete in a persistent file (cross-browser).
  * Also sets the httpOnly cookie for backwards compatibility.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
 import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
-const WIZARD_FILE = REV4A_DATA + '/data/wizard.json';
+const WIZARD_FILE = path.join(REV4A_DATA, 'data', 'wizard.json');
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
 
-export function POST(): NextResponse {
   // Write persistent marker
   const dir = path.dirname(WIZARD_FILE);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

package/app/api/wizard/reset/route.ts

@@ -4,15 +4,20 @@
  * Clears the wizard marker so the wizard runs again.
  * Removes both the persistent file and the cookie.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
+import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
-const WIZARD_FILE = REV4A_DATA + '/data/wizard.json';
+const WIZARD_FILE = path.join(REV4A_DATA, 'data', 'wizard.json');
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
 
-export function POST(): NextResponse {
   // Remove persistent marker
   try { fs.unlinkSync(WIZARD_FILE); } catch { /* ignore */ }
 

package/app/api/wizard/status/route.ts

@@ -4,13 +4,15 @@
  * Returns whether the wizard is complete.
  * Checks a persistent file so it survives browser changes and cache clears.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
+import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
-const WIZARD_FILE = REV4A_DATA + '/data/wizard.json';
+const WIZARD_FILE = path.join(REV4A_DATA, 'data', 'wizard.json');
 
 function readWizardFile(): boolean {
   try {
@@ -22,7 +24,8 @@ function readWizardFile(): boolean {
   }
 }
 
-export function GET(): NextResponse {
-  const done = readWizardFile();
-  return NextResponse.json({ done });
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthIfConfigured(request);
+  if (denied) return denied;
+  return NextResponse.json({ done: readWizardFile() });
 }

package/app/components/AuthGuard.tsx

@@ -7,17 +7,38 @@ import { useRouter, usePathname } from 'next/navigation';
 const authCache = { valid: false, checked: false, ts: 0 };
 const AUTH_CACHE_TTL = 30_000; // 30s before re-check
 
+function isCacheValid(): boolean {
+  return authCache.checked && authCache.valid && (Date.now() - authCache.ts) < AUTH_CACHE_TTL;
+}
+
 export default function AuthGuard({ children }: { children: React.ReactNode }) {
   const router = useRouter();
   const pathname = usePathname();
   const [redirecting, setRedirecting] = useState(false);
   const checkingRef = useRef(false);
 
+  // Which pathname the last successful check applies to. Kept per-path so a
+  // client-side navigation to a different protected route can't inherit the
+  // previous route's "verified" state and flash its content for a frame.
+  const [verifiedPath, setVerifiedPath] = useState<string | null>(null);
+
+  const isPublicRoute = pathname === '/setup' || pathname === '/login';
+  // Evaluated fresh on every render (not held in state), so an expired cache
+  // closes the gate immediately rather than one paint late.
+  const ready = isPublicRoute || isCacheValid() || verifiedPath === pathname;
+
   useEffect(() => {
+    // A redirect that has landed is finished: clear the flag on every
+    // navigation, otherwise the render gate below stays closed forever and
+    // the destination page renders blank. (AppShell currently unmounts this
+    // component for /login, /setup and /wizard, which used to hide the bug —
+    // don't depend on that staying true.)
+    setRedirecting(false);
+
     // /setup: always accessible
     if (pathname === '/setup') return;
 
-    // /login: public, check if already authenticated
+    // /login: public, but bounce to /setup if no password exists yet
     if (pathname === '/login') {
       fetch('/api/auth/status')
         .then((r) => r.json())
@@ -31,18 +52,16 @@ export default function AuthGuard({ children }: { children: React.ReactNode }) {
     // Already checking — prevent duplicate
     if (checkingRef.current) return;
 
-    // Cache hit — skip check
-    if (authCache.checked && authCache.valid && (Date.now() - authCache.ts) < AUTH_CACHE_TTL) {
-      return; // Still valid, no re-check
-    }
+    // Cache hit — content is already known-good, `ready` above covers it
+    if (isCacheValid()) return;
 
     checkingRef.current = true;
 
-    // Protected routes — check auth in background
+    // Protected route with no valid cache — verify before revealing content
     fetch('/api/auth/check')
       .then(async (r) => {
         if (!r.ok) {
-          // Not authenticated — redirect
+          // Not authenticated — redirect, keep content hidden
           authCache.valid = false;
           authCache.checked = true;
           const status = await fetch('/api/auth/status').then((r2) => r2.json());
@@ -55,6 +74,7 @@ export default function AuthGuard({ children }: { children: React.ReactNode }) {
         authCache.valid = true;
         authCache.checked = true;
         authCache.ts = Date.now();
+        setVerifiedPath(pathname);
 
         if (pathname === '/wizard') return;
 
@@ -86,6 +106,7 @@ export default function AuthGuard({ children }: { children: React.ReactNode }) {
       });
   }, [pathname, router]);
 
-  // NEVER hide children — always render, auth check happens in background
+  if (redirecting) return null;
+  if (!ready) return null; // hold content until this route's check resolves
   return <>{children}</>;
 }

package/app/components/Skeleton.tsx

@@ -95,6 +95,77 @@ export function CodeSkeleton({ lines = 12 }: { lines?: number }) {
   );
 }
 
+/**
+ * Cron job rows — mirrors the real row in the scheduled-jobs column so the
+ * layout doesn't jump when the data lands: same 12px/14px padding, same divider,
+ * same title/description/badge header, schedule line, and NEXT RUN / LAST RUN
+ * grid. Widths vary per row so it reads as a list rather than a stack of bars.
+ */
+export function CronJobsSkeleton({ rows = 5 }: { rows?: number }) {
+  const shapes = [
+    { title: '58%', desc: '82%', badge: 54, expr: '34%' },
+    { title: '42%', desc: null, badge: 40, expr: '28%' },
+    { title: '66%', desc: '71%', badge: 62, expr: '40%' },
+    { title: '50%', desc: null, badge: 46, expr: '31%' },
+    { title: '61%', desc: '64%', badge: 58, expr: '36%' },
+    { title: '45%', desc: null, badge: 50, expr: '26%' },
+  ];
+
+  return (
+    <div aria-hidden="true">
+      {shapes.slice(0, rows).map((s, i) => (
+        <div key={i} style={{ padding: '12px 14px', borderBottom: '1px solid var(--border)' }}>
+          {/* Header: title + optional description on the left, agent pill right */}
+          <div style={{ display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', marginBottom: 6, gap: 8 }}>
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <Skeleton width={s.title} height={12} accent />
+              {s.desc && <Skeleton width={s.desc} height={9} style={{ marginTop: 4 }} />}
+            </div>
+            <Skeleton width={s.badge} height={13} style={{ flexShrink: 0 }} />
+          </div>
+
+          {/* Schedule line: label + cron expression */}
+          <div style={{ display: 'flex', alignItems: 'center', gap: 6, marginBottom: 8 }}>
+            <Skeleton width={46} height={9} />
+            <Skeleton width={s.expr} height={10} />
+          </div>
+
+          {/* NEXT RUN / LAST RUN grid */}
+          <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: '4px 12px' }}>
+            {[0, 1].map((c) => (
+              <div key={c}>
+                <Skeleton width={52} height={8} style={{ marginBottom: 3 }} />
+                <Skeleton width="72%" height={10} />
+              </div>
+            ))}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+/**
+ * Cron run-history entries — one timestamp line plus a status/duration row,
+ * matching the entries the runs column renders once a job is selected.
+ */
+export function CronRunsSkeleton({ rows = 6 }: { rows?: number }) {
+  const widths = ['64%', '48%', '71%', '55%', '60%', '44%'];
+  return (
+    <div aria-hidden="true">
+      {widths.slice(0, rows).map((w, i) => (
+        <div key={i} style={{ padding: '10px 12px', borderBottom: '1px solid var(--border)' }}>
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8, marginBottom: 5 }}>
+            <Skeleton width={w} height={10} />
+            <Skeleton width={38} height={11} style={{ flexShrink: 0 }} />
+          </div>
+          <Skeleton width="30%" height={9} />
+        </div>
+      ))}
+    </div>
+  );
+}
+
 /* ─── Legacy aliases (used by existing components) ────────────────────────── */
 /** Stack of horizontal skeleton lines */
 export function SkeletonLines({ count = 3, width }: { count?: number; width?: string | number }) {