@flame0510/project-aether 1.1.12 → 1.1.14

package/lib/docker-socket.ts

@@ -0,0 +1,121 @@
+/**
+ * Docker Engine API over its local unix socket.
+ *
+ * The socket path is NOT the same everywhere. `/var/run/docker.sock` is the
+ * Linux default (and what the VPS uses), but Docker Desktop on macOS puts it
+ * at `~/.docker/run/docker.sock` and does not create the /var/run symlink
+ * unless the user opts in. Hardcoding the Linux path made every read-only
+ * Docker route return an empty list on macOS — agents existed and ran, but
+ * the dashboard showed nothing, because creation shells out to the `docker`
+ * CLI (which reads the context) while listing went through this socket.
+ *
+ * Talking to the socket directly is preferred over shelling out for reads:
+ * no fork, no shell quoting, no `--format` template to parse — just JSON.
+ */
+import * as http from 'http';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { execFileSync } from 'child_process';
+
+let cached: string | null = null;
+let lastMissAt = 0;
+
+/**
+ * How long a failed resolution is remembered. Long enough that a Docker outage
+ * doesn't spawn a `docker context inspect` per request, short enough that a
+ * server which started before the Docker daemon picks it up on its own.
+ */
+const MISS_TTL_MS = 5000;
+
+function fromDockerHostEnv(): string | null {
+  const raw = process.env.DOCKER_HOST;
+  if (!raw) return null;
+  // Only unix sockets are usable here; tcp:// would need a different client.
+  if (!raw.startsWith('unix://')) return null;
+  return raw.slice('unix://'.length);
+}
+
+function fromDockerContext(): string | null {
+  try {
+    const out = execFileSync(
+      'docker',
+      ['context', 'inspect', '--format', '{{.Endpoints.docker.Host}}'],
+      { encoding: 'utf-8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'] },
+    ).trim();
+    return out.startsWith('unix://') ? out.slice('unix://'.length) : null;
+  } catch {
+    return null;
+  }
+}
+
+function usable(candidate: string | null): string | null {
+  if (!candidate) return null;
+  try {
+    fs.accessSync(candidate, fs.constants.R_OK | fs.constants.W_OK);
+    return candidate;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the Docker socket, most authoritative source first. Returns null when
+ * Docker isn't reachable at all.
+ *
+ * A success is cached for the life of the process — the path doesn't move. A
+ * failure is only cached for MISS_TTL_MS: Rev4a can legitimately start before
+ * the Docker daemon is up (systemd ordering, Docker Desktop still booting), and
+ * caching that failure permanently would leave every Docker route returning an
+ * empty list until someone restarted the server.
+ */
+export function resolveDockerSocket(): string | null {
+  if (cached) return cached;
+  if (Date.now() - lastMissAt < MISS_TTL_MS) return null;
+
+  const found =
+    usable(fromDockerHostEnv()) ??
+    usable(fromDockerContext()) ??
+    // Docker Desktop (macOS, and Windows with WSL integration)
+    usable(path.join(os.homedir(), '.docker', 'run', 'docker.sock')) ??
+    // Linux default — the VPS lands here
+    usable('/var/run/docker.sock');
+
+  if (found) cached = found;
+  else lastMissAt = Date.now();
+
+  return found;
+}
+
+/** True when a usable Docker socket exists. */
+export function dockerAvailable(): boolean {
+  return resolveDockerSocket() !== null;
+}
+
+/**
+ * GET/POST against the Docker Engine API, resolving the response as JSON.
+ * Rejects when Docker is unreachable or the payload isn't JSON.
+ */
+export function dockerFetch<T = any>(method: string, apiPath: string): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const socketPath = resolveDockerSocket();
+    if (!socketPath) {
+      reject(new Error('Docker socket not found'));
+      return;
+    }
+
+    const req = http.request(
+      { socketPath, path: apiPath, method, headers: { Host: 'localhost' } },
+      (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          try { resolve(JSON.parse(data) as T); }
+          catch { reject(new Error('Invalid JSON from Docker')); }
+        });
+      },
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}

package/lib/docker-utils.ts

@@ -1,54 +1,28 @@
-import { networkInterfaces } from 'os';
-
 /**
- * Detect the host's best public-facing IPv4 address for agent URLs.
+ * Docker-related host helpers.
+ *
+ * This module used to export `detectPublicHost()`, which shelled out to
+ * `curl icanhazip.com` via execSync to discover the machine's public IP, then
+ * fell back to `hostname -I` and finally the literal string 'localhost'. It was
+ * removed rather than optimised, because the caching it seemed to need would
+ * only have made a wrong answer stable:
  *
- * Priority:
- *   1. External IP detection via icanhazip.com (works from Docker containers)
- *   2. Hostname resolution (filters out 172.x Docker internal IPs)
- *   3. First non-internal IPv4 network interface
- *   4. 'localhost' fallback
+ *   - execSync blocks the entire event loop, so every call froze the whole
+ *     server — not just its own request — for ~270ms, and up to the 5s timeout
+ *     when the network hung. Node's own guidance names execSync in a server as
+ *     a denial-of-service vector.
+ *   - On macOS it never even worked: icanhazip answers with IPv6, which the
+ *     IPv4-only validation discarded, and `hostname -I` is a GNU-only flag. The
+ *     value that came back was the machine's `.local` mDNS name, reachable only
+ *     from the same LAN.
+ *   - It answered the wrong question. Callers needed "which URL should this
+ *     user's browser open", not "what is this machine's WAN address". Those
+ *     differ behind NAT, behind a reverse proxy, and over a tunnel.
+ *
+ * Agent URLs are now composed in the browser from the port returned by the API
+ * plus `window.location.hostname` — a hostname already proven to reach this
+ * server, since the dashboard is being served over it.
  */
-export function detectPublicHost(): string {
-  // 1. External detection (works from inside Docker containers)
-  try {
-    const { execSync } = require('child_process');
-    const ip = execSync(
-      'curl -fs --max-time 3 icanhazip.com 2>/dev/null || curl -fs --max-time 3 ifconfig.me 2>/dev/null',
-      { encoding: 'utf-8', timeout: 5000 },
-    ).trim();
-    if (ip && /^\d+\.\d+\.\d+\.\d+$/.test(ip) && !ip.startsWith('172.')) {
-      return ip;
-    }
-  } catch { /* ignore */ }
-
-  // 2. Hostname (often gives public IP on VPS, but Docker internal 172.x is filtered)
-  try {
-    const { execSync } = require('child_process');
-    const hostname = execSync('hostname -I 2>/dev/null || hostname 2>/dev/null', {
-      encoding: 'utf-8', timeout: 2000,
-    }).trim().split(/\s+/)[0];
-    if (hostname && hostname !== '127.0.0.1' && hostname !== '::1' && !hostname.startsWith('172.')) {
-      return hostname;
-    }
-  } catch { /* ignore */ }
-
-  // 3. Network interfaces (bare metal)
-  try {
-    const ifaces = networkInterfaces();
-    for (const [, addrs] of Object.entries(ifaces)) {
-      if (!addrs) continue;
-      for (const addr of addrs) {
-        if (addr.family === 'IPv4' && !addr.internal) {
-          return addr.address;
-        }
-      }
-    }
-  } catch { /* fall through */ }
-
-  // 4. Fallback
-  return 'localhost';
-}
 
 /**
  * Build the provider gateway base URL used to sync model config into agent

package/lib/openclaw-cron.ts

@@ -1,4 +1,19 @@
-import { execFileSync } from 'child_process';
+import { execFileSync, execFile } from 'child_process';
+import { promisify } from 'util';
+import { dockerExecNoFail, mapWithConcurrency } from '@/lib/docker-exec';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * How many agents to query at once.
+ *
+ * Each one costs a `docker exec` plus an OpenClaw CLI boot — ~2.5-3s measured,
+ * and the route used to pay them in sequence: 19.2s on a seven-agent host, with
+ * the event loop blocked throughout. Running them concurrently makes the total
+ * the slowest agent rather than the sum. The cap is here because every one of
+ * these is a process, and the Docker daemon serialises past a point regardless.
+ */
+const AGENT_QUERY_CONCURRENCY = 6;
 
 // ── Types ─────────────────────────────────────────────────────────────────
 
@@ -75,24 +90,26 @@ function extractScheduleExpr(job: OpenClawCronJob): string {
 
 // ── Discover agent containers ────────────────────────────────────────────
 
-function discoverAgentContainers(): AgentInfo[] {
+async function discoverAgentContainers(): Promise<AgentInfo[]> {
   try {
-    const namesRaw = execFileSync('docker', [
-      'ps', '--filter', 'label=AGENT_ID', '--format', '{{.Names}}'
-    ], { encoding: 'utf8', timeout: 5000 }).trim();
-    if (!namesRaw) return [];
-
-    return namesRaw.split('\n').map(name => {
-      const containerName = name.trim();
-      if (!containerName) return null;
-      let agentId = containerName;
-      try {
-        agentId = execFileSync('docker', [
-          'inspect', containerName, '--format', '{{index .Config.Labels "AGENT_ID"}}'
-        ], { encoding: 'utf8', timeout: 5000 }).trim();
-      } catch { /* fallback */ }
-      return { containerName, agentId: agentId || containerName };
-    }).filter(Boolean) as AgentInfo[];
+    // One `docker ps` for everything. This used to run an extra `docker inspect`
+    // per container just to read the AGENT_ID label — but `docker ps` prints
+    // labels itself, so that was N+1 process spawns (~260ms each) for data the
+    // first call already had.
+    const raw = await execFileAsync('docker', [
+      'ps', '--filter', 'label=AGENT_ID', '--format', '{{.Label "AGENT_ID"}}\t{{.Names}}',
+    ], { encoding: 'utf8', timeout: 5000 });
+
+    return raw.stdout.trim().split('\n')
+      .map((line) => {
+        const [agentId, containerName] = line.split('\t');
+        if (!containerName?.trim()) return null;
+        return {
+          containerName: containerName.trim(),
+          agentId: agentId?.trim() || containerName.trim(),
+        };
+      })
+      .filter(Boolean) as AgentInfo[];
   } catch {
     return [];
   }
@@ -113,34 +130,38 @@ function parseCronListOutput(raw: string): OpenClawCronJob[] | null {
   }
 }
 
-function listJobsOnHost(): OpenClawCronJob[] | null {
+async function listJobsOnHost(): Promise<OpenClawCronJob[] | null> {
   try {
-    const raw = execFileSync('openclaw', ['cron', 'list', '--json', '--all'], {
+    // Not a container command — this is the openclaw CLI on the host itself,
+    // so it goes through execFile directly rather than the docker-exec helper.
+    const raw = await execFileAsync('openclaw', ['cron', 'list', '--json', '--all'], {
       encoding: 'utf8', timeout: 15000,
     });
-    return parseCronListOutput(raw);
+    return parseCronListOutput(raw.stdout);
   } catch {
     return null;
   }
 }
 
-function listJobsInContainer(containerName: string): OpenClawCronJob[] | null {
+async function listJobsInContainer(containerName: string): Promise<OpenClawCronJob[] | null> {
   // Try both common agent gateway ports. Agents default to 3000 (OpenClaw
   // gateway --bind lan --port 3000) but may also run on 18789 (default).
+  // Kept sequential on purpose: the second is a fallback for the first, so
+  // firing both would double the load to discard one answer.
   const gatewayUrls = [
     'http://127.0.0.1:3000',
     'http://127.0.0.1:18789',
   ];
 
   for (const gwUrl of gatewayUrls) {
-    try {
-      const raw = execFileSync('docker', [
-        'exec', '-e', `OPENCLAW_GATEWAY_URL=${gwUrl}`,
-        containerName, 'openclaw', 'cron', 'list', '--json', '--all',
-      ], { encoding: 'utf8', timeout: 15000 });
-      const parsed = parseCronListOutput(raw);
-      if (parsed) return parsed;
-    } catch { /* try next gateway port */ }
+    const raw = await dockerExecNoFail(
+      containerName,
+      ['openclaw', 'cron', 'list', '--json', '--all'],
+      { env: { OPENCLAW_GATEWAY_URL: gwUrl }, timeoutMs: 15000 },
+    );
+    if (!raw) continue;
+    const parsed = parseCronListOutput(raw);
+    if (parsed) return parsed;
   }
 
   return null;
@@ -180,12 +201,20 @@ function toggleInContainer(containerName: string, jobId: string, enabled: boolea
 
 // ── List: host gateway + per-container cron ─────────────────────────────
 
-export function listOpenClawCronJobs(): OpenClawCronListResult {
+export async function listOpenClawCronJobs(): Promise<OpenClawCronListResult> {
   const seen = new Set<string>();
   const jobs: OpenClawCronJob[] = [];
 
+  // The host query and the agent discovery don't depend on each other, so they
+  // overlap. Everything below is ordered deterministically afterwards — host
+  // jobs first, then agents in discovery order — so the response doesn't shuffle
+  // between polls just because a container answered sooner this time.
+  const [hostJobs, agents] = await Promise.all([
+    listJobsOnHost(),
+    discoverAgentContainers(),
+  ]);
+
   // 1. Host gateway cron jobs
-  const hostJobs = listJobsOnHost();
   if (hostJobs) {
     for (const job of hostJobs) {
       job.scheduleExpr = extractScheduleExpr(job);
@@ -195,22 +224,26 @@ export function listOpenClawCronJobs(): OpenClawCronListResult {
     }
   }
 
-  // 2. Agent container cron jobs
-  const agents = discoverAgentContainers();
-  for (const agent of agents) {
-    const containerJobs = listJobsInContainer(agent.containerName);
-    if (containerJobs) {
-      for (const job of containerJobs) {
-        job.scheduleExpr = extractScheduleExpr(job);
-        job.source = 'container';
-        job.containerName = agent.containerName;
-        if (!job.agentId) job.agentId = agent.agentId;
-
-        if (job.id && seen.has(job.id)) continue;
-
-        jobs.push(job);
-        if (job.id) seen.add(job.id);
-      }
+  // 2. Agent container cron jobs — queried concurrently, merged in order.
+  const perAgent = await mapWithConcurrency(
+    agents,
+    AGENT_QUERY_CONCURRENCY,
+    (agent) => listJobsInContainer(agent.containerName),
+  );
+
+  for (const [i, containerJobs] of perAgent.entries()) {
+    if (!containerJobs) continue;
+    const agent = agents[i];
+    for (const job of containerJobs) {
+      job.scheduleExpr = extractScheduleExpr(job);
+      job.source = 'container';
+      job.containerName = agent.containerName;
+      if (!job.agentId) job.agentId = agent.agentId;
+
+      if (job.id && seen.has(job.id)) continue;
+
+      jobs.push(job);
+      if (job.id) seen.add(job.id);
     }
   }
 

package/lib/openrouter-pricing.ts

@@ -0,0 +1,184 @@
+/**
+ * Live pricing for OpenRouter-hosted models.
+ *
+ * model-pricing.json is maintained by hand and drifts: at the time this was
+ * written, 16 of 79 OpenRouter entries disagreed with the live catalogue —
+ * one of them (google/gemini-2.5-flash) understated the real cost by ~8x.
+ * The static file stays as the offline fallback; this overlays it when the
+ * catalogue is reachable.
+ *
+ * Scope is deliberately narrow: only models whose provider is `openrouter`.
+ * OpenRouter resells models that we ALSO offer direct (openai, anthropic,
+ * google, …) at different rates, so applying these prices to a direct
+ * provider entry would show the wrong vendor's price.
+ *
+ * Only pricing is taken from upstream — NOT modality. app/api/gateway/sync.ts
+ * provisions agent containers from the curated models.config.json value, so
+ * showing a different capability set in the UI would advertise inputs the
+ * container was never configured to accept.
+ *
+ * The endpoint is public (no API key, served from CDN) — calling it costs
+ * nothing and is never billed.
+ */
+
+const CATALOGUE_URL = 'https://openrouter.ai/api/v1/models';
+// The call measures ~300ms against the CDN, so 3s is ~10x headroom. A longer
+// limit wouldn't protect anything — it would just hold the response open when
+// the catalogue is unreachable, and the static file is a fine stand-in.
+const FETCH_TIMEOUT_MS = 3000;
+
+// Mirrors the cache policy OpenRouter declares on the endpoint itself:
+//   cache-control: public, max-age=300, stale-while-revalidate=3600, stale-if-error=3600
+const TTL_MS = 5 * 60 * 1000; // max-age=300
+const MAX_STALE_MS = 60 * 60 * 1000; // stale-if-error=3600
+// After a failure, don't retry on every single request — an unreachable
+// catalogue would otherwise make each one pay the full abort timeout.
+const RETRY_AFTER_FAILURE_MS = 60 * 1000;
+
+export interface LivePricing {
+  input: number; // USD per 1M prompt tokens
+  output: number; // USD per 1M completion tokens
+}
+
+interface OpenRouterModel {
+  id: string;
+  pricing?: { prompt?: string; completion?: string };
+}
+
+interface CacheEntry {
+  pricing: Map<string, LivePricing>;
+  fetchedAt: number;
+}
+
+let cache: CacheEntry | null = null;
+let lastFailureAt = 0;
+let inFlight: Promise<CacheEntry | null> | null = null;
+
+/** OpenRouter quotes per-token; the UI works in per-million. */
+function perMillion(raw: string | undefined): number | null {
+  if (!raw) return null;
+  const n = parseFloat(raw);
+  // -1 means "dynamic" (router models); not a real price, leave it to the
+  // static file which already encodes it as -1/-1 and renders as "Dynamic".
+  if (!Number.isFinite(n) || n < 0) return null;
+  return n * 1_000_000;
+}
+
+async function fetchCatalogue(): Promise<CacheEntry | null> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(CATALOGUE_URL, {
+      signal: controller.signal,
+      headers: { accept: 'application/json' },
+    });
+    if (!res.ok) {
+      console.warn(`[openrouter-pricing] catalogue returned HTTP ${res.status}`);
+      return null;
+    }
+
+    const body = (await res.json()) as { data?: OpenRouterModel[] };
+    if (!Array.isArray(body?.data)) {
+      console.warn('[openrouter-pricing] unexpected catalogue shape');
+      return null;
+    }
+
+    const pricing = new Map<string, LivePricing>();
+    for (const m of body.data) {
+      if (!m?.id) continue;
+      const input = perMillion(m.pricing?.prompt);
+      const output = perMillion(m.pricing?.completion);
+      if (input !== null && output !== null) pricing.set(m.id, { input, output });
+    }
+
+    if (pricing.size === 0) return null;
+    return { pricing, fetchedAt: Date.now() };
+  } catch (e) {
+    const reason = e instanceof Error ? e.name : 'unknown';
+    console.warn(`[openrouter-pricing] catalogue unreachable (${reason}) — using static prices`);
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function isUsable(entry: CacheEntry | null): entry is CacheEntry {
+  // Past stale-if-error we stop trusting it entirely and fall back to the
+  // static file, rather than labelling day-old numbers as live.
+  return !!entry && Date.now() - entry.fetchedAt < MAX_STALE_MS;
+}
+
+/**
+ * Cached catalogue, refreshed when stale. Concurrent callers share one
+ * in-flight request. A failure is remembered so an unreachable catalogue
+ * doesn't make every request pay the timeout; the previous entry keeps
+ * being served until it exceeds the stale-if-error window.
+ */
+async function getCatalogue(): Promise<CacheEntry | null> {
+  const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
+  if (fresh) return cache;
+
+  if (inFlight) return inFlight;
+
+  // Backing off after a recent failure — serve what we have, if still usable.
+  if (Date.now() - lastFailureAt < RETRY_AFTER_FAILURE_MS) {
+    return isUsable(cache) ? cache : null;
+  }
+
+  inFlight = fetchCatalogue()
+    .then((result) => {
+      if (result) {
+        cache = result;
+        lastFailureAt = 0;
+      } else {
+        lastFailureAt = Date.now();
+      }
+      return isUsable(cache) ? cache : null;
+    })
+    .finally(() => {
+      inFlight = null;
+    });
+
+  return inFlight;
+}
+
+/**
+ * Map one of our ids to the upstream one.
+ *
+ * Our catalogue namespaces OpenRouter entries as `openrouter/<upstream id>`,
+ * but OpenRouter also publishes its own house models under a literal
+ * `openrouter/` vendor prefix (`openrouter/auto`, `openrouter/auto-beta`, …).
+ * Stripping unconditionally turns `openrouter/auto` into `auto`, which does
+ * not exist upstream — so try the stripped form first and fall back to the
+ * id as-is.
+ */
+function candidateUpstreamIds(modelId: string): string[] {
+  if (!modelId.startsWith('openrouter/')) return [];
+  const stripped = modelId.slice('openrouter/'.length);
+  return stripped === modelId ? [modelId] : [stripped, modelId];
+}
+
+/**
+ * Pricing overlay keyed by OUR model ids, for the OpenRouter-hosted subset.
+ * Returns an empty map when the catalogue can't be reached — never throws.
+ */
+export async function getLivePricing(modelIds: string[]): Promise<Map<string, LivePricing>> {
+  const overlay = new Map<string, LivePricing>();
+
+  const wanted = modelIds.filter((id) => id.startsWith('openrouter/'));
+  if (wanted.length === 0) return overlay;
+
+  const catalogue = await getCatalogue();
+  if (!catalogue) return overlay;
+
+  for (const ourId of wanted) {
+    for (const upstreamId of candidateUpstreamIds(ourId)) {
+      const price = catalogue.pricing.get(upstreamId);
+      if (price) {
+        overlay.set(ourId, price);
+        break;
+      }
+    }
+  }
+  return overlay;
+}

package/lib/rev4a-auth.d.ts

@@ -1,3 +1,6 @@
 import { NextResponse } from "next/server";
-export function requireAuth(request: Request): NextResponse | null;
 export function requireAuthJWT(request: Request): Promise<NextResponse | null>;
+export function requireAuthIfConfigured(request: Request): Promise<NextResponse | null>;
+export function getPassword(): string;
+export function getJwtSecret(): string;
+export function isConfigured(): boolean;