@flame0510/project-aether 1.1.12 → 1.1.14

package/lib/rev4a-auth.js

@@ -1,36 +1,84 @@
 import { NextResponse } from "next/server";
 import { jwtVerify } from "jose";
+import * as fs from "fs";
+import { ENV_FILE } from "@/lib/rev4a-paths";
 
-function getExpectedToken() {
-  const token = process.env.REV4A_TOKEN || process.env.NEXT_PUBLIC_REV4A_TOKEN || '';
-  if (!token) console.warn('REV4A_TOKEN is not set — auth will reject all requests');
-  return token;
+// ---------------------------------------------------------------------------
+// Single source of truth for secret resolution. Every route and proxy.ts
+// import these instead of keeping their own env+file-fallback copy — the
+// duplication used to drift (proxy.ts had an env-only version because it
+// used to run on Edge runtime, which can't use fs; now that it runs on
+// Node.js runtime the split serves no purpose and only risks desync).
+//
+// In the supported `rev4a serve` flow the file fallback is rarely hit:
+// bin/rev4a.js injects these into the Next.js child's env, and writeEnvVar()
+// updates process.env in-process. It exists for setups that bypass the CLI
+// (a hand-written systemd unit, `npm run dev` before .env exists).
+// ---------------------------------------------------------------------------
+const PASSWORD_RE = /^REV4A_PASSWORD=(.*)$/m;
+const JWT_SECRET_RE = /^REV4A_JWT_SECRET=(.*)$/m;
+
+function readEnvFileValue(re) {
+  try {
+    if (fs.existsSync(ENV_FILE)) {
+      const match = fs.readFileSync(ENV_FILE, "utf-8").match(re);
+      if (match && match[1].trim()) return match[1].trim();
+    }
+  } catch { /* ignore */ }
+  return "";
 }
 
-export function requireAuth(request) {
-  const auth = request.headers.get("authorization");
-  if (!auth || auth !== `Bearer ${getExpectedToken()}`) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  }
-  return null;
+export function getPassword() {
+  return process.env.REV4A_PASSWORD || readEnvFileValue(PASSWORD_RE);
 }
 
-const JWT_SECRET = new TextEncoder().encode(
-  process.env.REV4A_JWT_SECRET || ''
-);
+export function getJwtSecret() {
+  return process.env.REV4A_JWT_SECRET || readEnvFileValue(JWT_SECRET_RE);
+}
 
+export function isConfigured() {
+  return getPassword().length > 0;
+}
+
+function unauthorized() {
+  return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+}
+
+/**
+ * Cookie (JWT) auth, falling back to `Authorization: Bearer <REV4A_TOKEN>`.
+ * Returns null when authorized, or a 401 response to return as-is.
+ */
 export async function requireAuthJWT(request) {
   const cookieToken = request.cookies?.get?.("rev4a_token")?.value;
-  if (cookieToken) {
+  const secret = getJwtSecret();
+
+  // An empty secret would mean verifying against a zero-length HMAC key.
+  // jose rejects that, but bail explicitly rather than relying on it.
+  if (cookieToken && secret) {
     try {
-      await jwtVerify(cookieToken, JWT_SECRET);
+      await jwtVerify(cookieToken, new TextEncoder().encode(secret));
       return null;
-    } catch {}
+    } catch { /* fall through to bearer */ }
+  }
+
+  const expectedToken = process.env.REV4A_TOKEN || process.env.NEXT_PUBLIC_REV4A_TOKEN || "";
+  // Without this guard an unset token would make `Bearer ` match an empty
+  // expected value. HTTP header normalisation already strips the trailing
+  // space so it isn't reachable in practice — the guard makes that safety
+  // explicit instead of dependent on it.
+  if (expectedToken) {
+    const auth = request.headers.get("authorization");
+    if (auth === `Bearer ${expectedToken}`) return null;
   }
 
-  const auth = request.headers.get("authorization");
-  const expectedToken = process.env.REV4A_TOKEN || process.env.NEXT_PUBLIC_REV4A_TOKEN || '';
-  if (auth === `Bearer ${expectedToken}`) return null;
+  return unauthorized();
+}
 
-  return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+/**
+ * For routes that must stay reachable during first-run setup (before any
+ * password exists) but must be protected once the instance is configured.
+ */
+export async function requireAuthIfConfigured(request) {
+  if (!isConfigured()) return null;
+  return requireAuthJWT(request);
 }

package/lib/rev4a-paths.ts

@@ -39,6 +39,25 @@ export const AGENTS_TOKEN_FILE = path.join(REV4A_DATA, 'data', 'agents-token.jso
 /** Provider API keys JSON */
 export const PROVIDER_KEYS_FILE = path.join(REV4A_DATA, 'data', 'provider-keys.json');
 
+/* ── Host directories bind-mounted into every agent container ───── */
+
+/**
+ * These used to live at `/docker/shared-skills` and `/docker/rev4a-rules`.
+ * That path can't work on macOS: the root volume is a sealed APFS system
+ * volume, so `/docker` cannot be created even as root. It also required
+ * `sudo mkdir` on Linux for no real benefit.
+ *
+ * Under REV4A_DATA they sit inside the user's home, which additionally
+ * falls within the directories Docker Desktop shares with its Linux VM by
+ * default — so a bind mount from here works with no extra configuration.
+ */
+
+/** Skills shared across all agents, mounted read-only. */
+export const SHARED_SKILLS_DIR = path.join(REV4A_DATA, 'shared', 'shared-skills');
+
+/** Rev4a system rules injected into every agent workspace, mounted read-only. */
+export const REV4A_RULES_DIR = path.join(REV4A_DATA, 'shared', 'rev4a-rules');
+
 /**
  * Model catalogue — read-only, shipped with the package.
  * Resolved at module load from the package root (alongside bin/rev4a.js).

package/model-pricing.json

@@ -40,8 +40,8 @@
     "output": 8.0
   },
   "openrouter/auto": {
-    "input": -1,
-    "output": -1
+    "input": -1.0,
+    "output": -1.0
   },
   "google/gemini-3.1-pro-preview": {
     "input": 2.0,
@@ -124,8 +124,8 @@
     "output": 2.2
   },
   "glm/glm-4.7-flash": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "glm/glm-4.7-flashx": {
     "input": 0.07,
@@ -136,8 +136,8 @@
     "output": 4.0
   },
   "glm/glm-4.6v-flash": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "qwen/qwen3.7-max": {
     "input": 0.83,
@@ -160,36 +160,36 @@
     "output": 0.28
   },
   "groq/llama-3.1-8b-instant": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "groq/llama-3.3-70b-versatile": {
-    "input": 0,
-    "output": 0
+    "input": 0.0,
+    "output": 0.0
   },
   "openrouter/deepseek/deepseek-v4-flash": {
-    "input": 0.14,
-    "output": 0.28
+    "input": 0.04886,
+    "output": 0.09772
   },
   "openrouter/google/gemini-2.5-flash": {
-    "input": 0.075,
-    "output": 0.3
+    "input": 0.3,
+    "output": 2.5
   },
   "openrouter/google/gemini-2.5-pro": {
     "input": 1.25,
-    "output": 5.0
+    "output": 10.0
   },
   "openrouter/anthropic/claude-sonnet-4.6": {
     "input": 3.0,
     "output": 15.0
   },
   "openrouter/deepseek/deepseek-v4-pro": {
-    "input": 0.43,
-    "output": 0.87
+    "input": 0.396894,
+    "output": 0.793788
   },
   "openrouter/qwen/qwen3.7-max": {
-    "input": 1.48,
-    "output": 4.42
+    "input": 1.475,
+    "output": 4.425
   },
   "openrouter/qwen/qwen3.7-plus": {
     "input": 0.32,
@@ -200,16 +200,16 @@
     "output": 0.13
   },
   "openrouter/qwen/qwen3.6-plus": {
-    "input": 0.33,
+    "input": 0.325,
     "output": 1.95
   },
   "openrouter/qwen/qwen3.6-flash": {
-    "input": 0.19,
-    "output": 1.12
+    "input": 0.1875,
+    "output": 1.125
   },
   "openrouter/qwen/qwen3.6-27b": {
-    "input": 0.29,
-    "output": 2.4
+    "input": 0.6,
+    "output": 3.6
   },
   "openrouter/qwen/qwen3.6-35b-a3b": {
     "input": 0.14,
@@ -228,7 +228,7 @@
     "output": 3.9
   },
   "openrouter/qwen/qwen3-next-80b-a3b-instruct": {
-    "input": 0.09,
+    "input": 0.1,
     "output": 1.1
   },
   "openrouter/qwen/qwen3-next-80b-a3b-thinking": {
@@ -244,20 +244,20 @@
     "output": 6.0
   },
   "openrouter/qwen/qwen3.6-max-preview": {
-    "input": 1.03,
-    "output": 6.16
+    "input": 1.027,
+    "output": 6.162
   },
   "openrouter/minimax/minimax-m3": {
     "input": 0.3,
     "output": 1.2
   },
   "openrouter/moonshotai/kimi-k2.7-code": {
-    "input": 0.73,
-    "output": 3.5
+    "input": 0.67,
+    "output": 3.4
   },
   "openrouter/moonshotai/kimi-k2.6": {
-    "input": 0.59,
-    "output": 2.48
+    "input": 0.95,
+    "output": 4.0
   },
   "openrouter/moonshotai/kimi-k2": {
     "input": 0.57,
@@ -272,16 +272,16 @@
     "output": 15.0
   },
   "openrouter/z-ai/glm-5.2": {
-    "input": 0.76,
-    "output": 2.42
+    "input": 0.966,
+    "output": 3.036
   },
   "openrouter/z-ai/glm-5.1": {
-    "input": 0.97,
-    "output": 3.04
+    "input": 0.966,
+    "output": 3.036
   },
   "openrouter/z-ai/glm-5": {
-    "input": 0.95,
-    "output": 2.55
+    "input": 0.6,
+    "output": 1.92
   },
   "openrouter/z-ai/glm-5v-turbo": {
     "input": 1.2,
@@ -308,15 +308,15 @@
     "output": 0.3
   },
   "openrouter/tencent/hy3": {
-    "input": 0.13,
-    "output": 0.53
+    "input": 0.132,
+    "output": 0.528
   },
   "openrouter/tencent/hy3-preview": {
-    "input": 0.06,
-    "output": 0.21
+    "input": 0.18,
+    "output": 0.6
   },
   "openrouter/xiaomi/mimo-v2.5-pro": {
-    "input": 0.43,
+    "input": 0.435,
     "output": 0.87
   },
   "openrouter/xiaomi/mimo-v2.5": {
@@ -384,7 +384,7 @@
     "output": 3.2
   },
   "openrouter/nvidia/nemotron-3-super-120b-a12b": {
-    "input": 0.08,
+    "input": 0.085,
     "output": 0.4
   },
   "openrouter/nvidia/nemotron-3-ultra-550b-a55b": {
@@ -396,7 +396,7 @@
     "output": 3.0
   },
   "openrouter/thinkingmachines/inkling": {
-    "input": 1.0,
+    "input": 0.95,
     "output": 4.05
   },
   "openrouter/relace/relace-apply-3": {
@@ -416,8 +416,8 @@
     "output": 12.0
   },
   "openrouter/google/gemini-3.6-flash": {
-    "input": 1.5,
-    "output": 7.5
+    "input": 0.75,
+    "output": 3.75
   },
   "openrouter/anthropic/claude-opus-5": {
     "input": 5.0,
@@ -436,12 +436,12 @@
     "output": 25.0
   },
   "openrouter/openai/gpt-5.6-sol": {
-    "input": 5.0,
-    "output": 30.0
+    "input": 2.0,
+    "output": 10.0
   },
   "openrouter/openai/gpt-5.6-luna": {
-    "input": 0.1,
-    "output": 0.6
+    "input": 0.2,
+    "output": 1.2
   },
   "openrouter/openai/gpt-5.4-mini": {
     "input": 0.75,

package/models.config.json

@@ -796,7 +796,7 @@
       "name": "Kimi K3 (OR)",
       "provider": "openrouter",
       "enabled": false,
-      "modality": "text+image->text"
+      "modality": "text+image+video->text"
     },
     {
       "id": "openrouter/amazon/nova-premier-v1",
@@ -841,4 +841,4 @@
       "modality": "text+image->text"
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flame0510/project-aether",
-  "version": "1.1.12",
+  "version": "1.1.14",
   "description": "Rev4a — Revolution for Agents. OpenClaw agent fleet orchestrator.",
   "keywords": [
     "openclaw",
@@ -38,6 +38,8 @@
     "lineage.js",
     "terminal-ws-server.js",
     "package.json",
+    "proxy.ts",
+    "instrumentation.ts",
     "next.config.mjs",
     "tsconfig.json",
     "next-env.d.ts",
@@ -51,6 +53,7 @@
     "build": "next build",
     "start": "rev4a serve",
     "start:all": "rev4a serve",
+    "refresh:pricing": "node scripts/refresh-model-pricing.mjs",
     "smoke:db-bootstrap": "node scripts/smoke-db-bootstrap.mjs",
     "postinstall": "node bin/postinstall.js"
   },

package/proxy.ts

@@ -0,0 +1,68 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import { jwtVerify } from 'jose';
+import { getJwtSecret } from '@/lib/rev4a-auth';
+
+/* ------------------------------------------------------------------ */
+/*  Public routes — no auth required                                  */
+/* ------------------------------------------------------------------ */
+const PUBLIC_PREFIXES = ['/login', '/setup'];
+
+/* ------------------------------------------------------------------ */
+/*  Bypass — static assets and APIs have their own auth               */
+/* ------------------------------------------------------------------ */
+function isStaticOrApi(pathname: string): boolean {
+  return (
+    pathname.startsWith('/_next') ||
+    pathname.startsWith('/api') ||
+    pathname.startsWith('/favicon') ||
+    pathname.startsWith('/icon') ||
+    pathname.startsWith('/apple-touch') ||
+    pathname.startsWith('/rev4a-logo') ||
+    pathname.startsWith('/manifest') ||
+    pathname.includes('.') // file extensions (png, svg, ico, etc.)
+  );
+}
+
+/* ------------------------------------------------------------------ */
+/*  Proxy (formerly middleware — Next.js 16 renamed the convention;   */
+/*  runs on Node.js runtime by default now, so it shares the same     */
+/*  env+file secret resolution as every API route instead of its own */
+/*  env-only copy.)                                                    */
+/* ------------------------------------------------------------------ */
+export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  // Public routes
+  if (PUBLIC_PREFIXES.some((p) => pathname.startsWith(p))) {
+    return NextResponse.next();
+  }
+
+  // Static assets & API routes
+  if (isStaticOrApi(pathname)) {
+    return NextResponse.next();
+  }
+
+  // Protected route — verify JWT
+  const token = request.cookies.get('rev4a_token')?.value;
+  if (!token) {
+    const loginUrl = new URL('/login', request.url);
+    return NextResponse.redirect(loginUrl);
+  }
+
+  try {
+    const secret = new TextEncoder().encode(getJwtSecret());
+    await jwtVerify(token, secret);
+    return NextResponse.next();
+  } catch {
+    const loginUrl = new URL('/login', request.url);
+    return NextResponse.redirect(loginUrl);
+  }
+}
+
+/* ------------------------------------------------------------------ */
+/*  Matcher — only run on page routes, skip Next.js internals         */
+/* ------------------------------------------------------------------ */
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+};

package/scripts/refresh-model-pricing.mjs

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * Refresh model-pricing.json and models.config.json from the live OpenRouter
+ * catalogue.
+ *
+ * Why this exists: both files are maintained by hand and drift. When this was
+ * written, 16 of 79 OpenRouter entries had stale prices — google/gemini-2.5-flash
+ * understated the real cost by ~8x. The dashboard reads these files, and so does
+ * daemon.js when it writes cost_usd rows, so a wrong number here is a wrong
+ * number in every spend figure the product reports.
+ *
+ * SCOPE — deliberately limited to `openrouter/*` models.
+ *   OpenRouter resells models we also offer direct (openai, anthropic, google,
+ *   deepseek, qwen). Their rates are NOT the same: at time of writing 8 of the
+ *   25 overlapping models differ — openai/gpt-5.6-sol is $5/$30 direct in our
+ *   file but $2/$10 on OpenRouter. We can't tell from OpenRouter's catalogue
+ *   what the direct vendor charges, so those entries are left alone. Keep them
+ *   updated by hand from each provider's own pricing page.
+ *
+ * The endpoint is public — no API key, CDN-cached, never billed.
+ *
+ * Usage:
+ *   node scripts/refresh-model-pricing.mjs            # apply
+ *   node scripts/refresh-model-pricing.mjs --dry-run  # preview only
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PRICING_FILE = path.join(ROOT, 'model-pricing.json');
+const MODELS_FILE = path.join(ROOT, 'models.config.json');
+const CATALOGUE_URL = 'https://openrouter.ai/api/v1/models';
+
+const dryRun = process.argv.includes('--dry-run');
+
+function perMillion(raw) {
+  if (raw === undefined || raw === null) return null;
+  const n = parseFloat(raw);
+  // -1 marks router models (OpenRouter Auto): dynamic, not a real price.
+  if (!Number.isFinite(n) || n < 0) return null;
+  return n * 1_000_000;
+}
+
+/** Round to the precision the file already uses, so we don't churn on float noise. */
+function round(n) {
+  return Math.round(n * 1e6) / 1e6;
+}
+
+/**
+ * Serialise model-pricing.json preserving its `5.0` style for whole numbers.
+ * JSON.stringify writes `5`, which is the same value but rewrites ~114 lines
+ * that didn't change — burying the handful of real price moves in noise and
+ * making the diff unreviewable on every run.
+ */
+function serialisePricing(pricing) {
+  const num = (n) => (Number.isInteger(n) ? n.toFixed(1) : String(n));
+  const body = Object.entries(pricing)
+    .map(([id, p]) => `  ${JSON.stringify(id)}: {\n    "input": ${num(p.input)},\n    "output": ${num(p.output)}\n  }`)
+    .join(',\n');
+  return `{\n${body}\n}\n`;
+}
+
+/**
+ * Our catalogue namespaces OpenRouter entries as `openrouter/<upstream id>`,
+ * but OpenRouter also publishes house models under a literal `openrouter/`
+ * vendor prefix (openrouter/auto). Try the stripped form, then the id as-is.
+ */
+function upstreamCandidates(id) {
+  const stripped = id.slice('openrouter/'.length);
+  return stripped === id ? [id] : [stripped, id];
+}
+
+async function main() {
+  console.log(`Fetching ${CATALOGUE_URL} …`);
+  const res = await fetch(CATALOGUE_URL, { headers: { accept: 'application/json' } });
+  if (!res.ok) {
+    console.error(`✗ Catalogue returned HTTP ${res.status}`);
+    process.exit(1);
+  }
+  const body = await res.json();
+  if (!Array.isArray(body?.data) || body.data.length === 0) {
+    console.error('✗ Unexpected catalogue shape');
+    process.exit(1);
+  }
+  const live = new Map(body.data.map((m) => [m.id, m]));
+  console.log(`  ${live.size} models upstream\n`);
+
+  const modelsDoc = JSON.parse(fs.readFileSync(MODELS_FILE, 'utf-8'));
+  const models = Array.isArray(modelsDoc) ? modelsDoc : modelsDoc.models;
+  const pricing = JSON.parse(fs.readFileSync(PRICING_FILE, 'utf-8'));
+
+  const priceChanges = [];
+  const modalityChanges = [];
+  let missing = 0;
+  let dynamic = 0;
+
+  for (const m of models) {
+    if (m.provider !== 'openrouter') continue;
+
+    let up = null;
+    for (const candidate of upstreamCandidates(m.id)) {
+      if (live.has(candidate)) { up = live.get(candidate); break; }
+    }
+    if (!up) {
+      missing++;
+      console.log(`  ? ${m.id} — not in the upstream catalogue, left as-is`);
+      continue;
+    }
+
+    // Pricing
+    const input = perMillion(up.pricing?.prompt);
+    const output = perMillion(up.pricing?.completion);
+    if (input === null || output === null) {
+      dynamic++; // router model — keep whatever the file says (-1/-1)
+    } else {
+      const current = pricing[m.id];
+      const next = { input: round(input), output: round(output) };
+      if (!current || current.input !== next.input || current.output !== next.output) {
+        priceChanges.push({
+          id: m.id,
+          from: current ? `$${current.input}/$${current.output}` : '(none)',
+          to: `$${next.input}/$${next.output}`,
+        });
+        pricing[m.id] = next;
+      }
+    }
+
+    // Modality — updating the curated file (rather than overriding at runtime)
+    // keeps the UI and app/api/gateway/sync.ts, which provisions containers
+    // from this same value, in agreement.
+    const upModality = up.architecture?.modality;
+    if (upModality && upModality !== m.modality) {
+      modalityChanges.push({ id: m.id, from: m.modality ?? '(none)', to: upModality });
+      m.modality = upModality;
+    }
+  }
+
+  console.log(`\nPricing:  ${priceChanges.length} changed`);
+  for (const c of priceChanges) console.log(`  ${c.id}\n      ${c.from}  →  ${c.to}`);
+
+  console.log(`\nModality: ${modalityChanges.length} changed`);
+  for (const c of modalityChanges) console.log(`  ${c.id}\n      ${c.from}  →  ${c.to}`);
+
+  const direct = models.filter((m) => m.provider !== 'openrouter').length;
+  console.log(
+    `\nSkipped:  ${dynamic} dynamic (router), ${missing} not upstream, ` +
+    `${direct} direct-provider (different vendor, different rates — update by hand)`,
+  );
+
+  if (priceChanges.length === 0 && modalityChanges.length === 0) {
+    console.log('\n✓ Already up to date.');
+    return;
+  }
+
+  if (dryRun) {
+    console.log('\n(dry run — nothing written)');
+    return;
+  }
+
+  fs.writeFileSync(PRICING_FILE, serialisePricing(pricing), 'utf-8');
+  fs.writeFileSync(MODELS_FILE, JSON.stringify(modelsDoc, null, 2) + '\n', 'utf-8');
+  console.log('\n✓ Wrote model-pricing.json and models.config.json');
+  console.log('  Review the diff before committing.');
+}
+
+main().catch((e) => {
+  console.error(`✗ ${e.message}`);
+  process.exit(1);
+});

package/lib/auth.ts

@@ -1,28 +0,0 @@
-import { NextResponse, type NextRequest } from 'next/server';
-import { jwtVerify } from 'jose';
-import { TOKEN } from '@/lib/db';
-
-const JWT_SECRET = new TextEncoder().encode(
-  process.env.REV4A_JWT_SECRET ?? 'rev4a-jwt-secret-change-in-prod',
-);
-
-export async function requireBrowserAuth(request: NextRequest): Promise<NextResponse | null> {
-  const token = new URL(request.url).searchParams.get('token');
-  const auth = request.headers.get('authorization');
-
-  if (token === TOKEN || auth === `Bearer ${TOKEN}`) {
-    return null;
-  }
-
-  const cookieToken = request.cookies.get('rev4a_token')?.value;
-  if (cookieToken) {
-    try {
-      await jwtVerify(cookieToken, JWT_SECRET);
-      return null;
-    } catch {
-      // Fall through to unauthorized.
-    }
-  }
-
-  return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-}