@flame0510/project-aether 1.1.15 → 1.2.0

package/app/api/credentials/[id]/sync/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server';
-import { getProfile, markSynced } from '@/lib/credentials/vault';
+import { getProfile, markSynced, markDesynced } from '@/lib/credentials/vault';
 import { syncProfileToAgents, cleanAgentProviders } from '@/lib/credentials/delivery';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
@@ -48,8 +48,8 @@ export async function DELETE(request: Request,
       return NextResponse.json({ error: 'container is required' }, { status: 400 });
     }
 
-    cleanAgentProviders(container, profile.providerId);
-    markSynced(id, 'active');
+    await cleanAgentProviders(container, profile.providerId);
+    markDesynced(id);
 
     return NextResponse.json({ ok: true });
   } catch (e: unknown) {

package/app/api/credentials/detect/route.ts

@@ -2,17 +2,22 @@ import { NextResponse, type NextRequest } from 'next/server';
 import { listProfiles, getSecret } from '@/lib/credentials/vault';
 import {
   listAgentContainers,
-  execInContainer,
-  cliInstalled,
+  probeContainer,
   providerTokenHash,
   profileTokenHash,
-  detectTrello,
-  detectNotion,
+  vercelCurrentTeam,
+  supabaseProjectRef,
+  TOKEN_FIELD,
+  type ContainerProbe,
 } from '@/lib/credentials/detect';
+import { mapWithConcurrency } from '@/lib/docker-exec';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
+/** Containers probed at once. Each is a single `docker exec`. */
+const AGENT_QUERY_CONCURRENCY = 6;
+
 interface DetectedStatus {
   container: string;
   agentId: string;
@@ -33,6 +38,12 @@ interface DetectedStatus {
   notionLoggedIn: boolean;
   toolsMdHasMarkers: boolean;
   matchedProfiles: { profileId: string; providerId: string; label: string }[];
+  /**
+   * Providers with a token present in the container, whether or not it belongs
+   * to a stored profile. A provider listed here but absent from
+   * `matchedProfiles` holds a credential nobody in the vault accounts for.
+   */
+  installedProviders: string[];
 }
 
 interface DetectionError {
@@ -41,125 +52,106 @@ interface DetectionError {
   error: string;
 }
 
-function detectSupabase(container: string): { loggedIn: boolean; linked: boolean; projectRef: string } {
-  if (!cliInstalled(container, 'supabase')) {
-    return { loggedIn: false, linked: false, projectRef: '' };
-  }
-
-  // Verify login by calling the Supabase API (analogous to gh auth status / vercel whoami)
-  const raw = execInContainer(
-    container,
-    'supabase projects list --output json 2>&1',
-    (r) => r.trim(),
-    '',
-  );
-
-  // Unauthorized → not logged in
-  if (!raw || raw.includes('Unauthorized')) {
-    return { loggedIn: false, linked: false, projectRef: '' };
-  }
-
-  // Check if a linked project exists in the workspace
-  let linked = false;
-  let projectRef = '';
-  const linkedRef = execInContainer(
-    container,
-    'cat /data/supabase/config.toml 2>/dev/null | grep project_id | head -1 | sed "s/.*= *\"//;s/\".*//"',
-    (r) => r.trim(),
-    '',
-  );
-  if (linkedRef && linkedRef.length > 0) {
-    linked = true;
-    projectRef = linkedRef;
-  }
-
-  return { loggedIn: true, linked, projectRef };
-}
-
-function detectGithub(container: string): { loggedIn: boolean; user: string } {
-  if (!cliInstalled(container, 'gh')) {
-    return { loggedIn: false, user: '' };
-  }
-
-  const raw = execInContainer(
-    container,
-    'gh auth status 2>&1',
-    (r) => r,
-    '',
-  );
-  if (!raw || raw.includes('not logged into any GitHub hosts')) {
-    return { loggedIn: false, user: '' };
-  }
-  const match = raw.match(/Logged in to github\.com as (\S+)/);
-  return { loggedIn: !!match, user: match?.[1] ?? '' };
+/** Last non-empty line of `vercel whoami` — the rest is header noise. */
+function extractUsername(raw: string): string {
+  const lines = raw.split('\n').filter((l) => l.trim());
+  return lines[lines.length - 1]?.trim() || raw.trim();
 }
 
-function detectToolsMd(container: string): boolean {
-  const raw = execInContainer(
-    container,
-    `grep -c 'REV4A:INTEGRATIONS:START' /root/.openclaw/workspace/TOOLS.md 2>/dev/null || echo 0`,
-    (r) => r.trim(),
-    '0',
-  );
-  return raw === '1' || parseInt(raw, 10) > 0;
+/**
+ * Stored profiles with their token hashes, computed once per request.
+ *
+ * This used to run inside the per-container loop: `listProfiles()` plus one
+ * `getSecret()` per profile, each opening its own SQLite connection, repeated
+ * for every agent. Nothing in it depends on the container, so it is hoisted.
+ */
+interface HashedProfile {
+  profileId: string;
+  providerId: string;
+  label: string;
+  tokenHash: string;
 }
 
-function detectVercel(container: string): { loggedIn: boolean; user: string; team: string } {
-  if (!cliInstalled(container, 'vercel')) {
-    return { loggedIn: false, user: '', team: '' };
-  }
-
-  const whoami = execInContainer(
-    container,
-    'vercel whoami 2>&1 || true',
-    (r) => r.trim(),
-    '',
-  );
-  if (whoami && !whoami.includes('Error:') && !whoami.includes('Not authorized')) {
-    const teamRaw = execInContainer(
-      container,
-      "cat /root/.local/share/com.vercel.cli/config.json 2>/dev/null | grep 'currentTeam' | head -1 | sed 's/.*: *\"//;s/\".*//'",
-      (r) => r.trim(),
-      '',
-    );
-    return { loggedIn: true, user: extractUsername(whoami), team: teamRaw };
-  }
-
-  return { loggedIn: false, user: '', team: '' };
+function loadHashedProfiles(): HashedProfile[] {
+  return listProfiles()
+    .map((p) => ({
+      profileId: p.id,
+      providerId: p.providerId,
+      label: p.label,
+      tokenHash: profileTokenHash(getSecret(p.id), p.providerId),
+    }))
+    .filter((p) => p.tokenHash);
 }
 
 /**
- * Extract just the username from 'vercel whoami' output (strip header lines).
+ * Hash of whatever token each provider currently has installed in the container.
+ *
+ * Computed for every provider, not only those with a stored profile. The probe
+ * has already fetched all of these files in its single exec, so the extra work
+ * is a handful of SHA-256 over short strings — and restricting it would hide the
+ * case that matters most: a token present in the container that matches nothing
+ * in the vault, which is what a credential edited after syncing looks like.
  */
-function extractUsername(raw: string): string {
-  const lines = raw.split('\n').filter(Boolean);
-  // Return the last non-empty line (the actual username)
-  return lines[lines.length - 1]?.trim() || raw;
+function installedHashes(probe: ContainerProbe): Map<string, string> {
+  const out = new Map<string, string>();
+  for (const providerId of Object.keys(TOKEN_FIELD)) {
+    const h = providerTokenHash(probe, providerId);
+    if (h) out.set(providerId, h);
+  }
+  return out;
 }
 
-/**
- * Match detected state to stored credential profiles by comparing token hashes.
- * `hashes` maps a providerId to the hash of the token currently installed in the
- * container. A profile matches when its own token hashes to the same value.
- * Providers whose token cannot be read yield '' and therefore never match.
- */
-function matchProfiles(
-  hashes: Record<string, string>,
-): { profileId: string; providerId: string; label: string }[] {
-  const profiles = listProfiles();
-  const matched: { profileId: string; providerId: string; label: string }[] = [];
-
-  for (const profile of profiles) {
-    const installedHash = hashes[profile.providerId];
-    if (!installedHash) continue;
-
-    const storedHash = profileTokenHash(getSecret(profile.id), profile.providerId);
-    if (storedHash && storedHash === installedHash) {
-      matched.push({ profileId: profile.id, providerId: profile.providerId, label: profile.label });
-    }
-  }
+function matchProfiles(installed: Map<string, string>, profiles: HashedProfile[]) {
+  return profiles
+    .filter((p) => installed.get(p.providerId) === p.tokenHash)
+    .map(({ profileId, providerId, label }) => ({ profileId, providerId, label }));
+}
 
-  return matched;
+function shape(container: string, agentId: string, probe: ContainerProbe, profiles: HashedProfile[]): DetectedStatus {
+  const installed = installedHashes(probe);
+  // `gh` changed the wording: 2.97 prints "…github.com account <user>", older
+  // builds print "…as <user>". The image installs it unpinned from apt, so both
+  // are accepted rather than tracking whichever one ships today.
+  const ghMatch = /Logged in to github\.com (?:as|account) (\S+)/.exec(probe.ghStatus);
+  const githubLoggedIn =
+    probe.cli.gh && !probe.ghStatus.includes('not logged into any GitHub hosts') && !!ghMatch;
+
+  const whoami = probe.vercelWhoami.trim();
+  const vercelLoggedIn =
+    probe.cli.vercel && !!whoami && !whoami.includes('Error:') && !whoami.includes('Not authorized');
+
+  const projects = probe.supabaseProjects.trim();
+  // The exit status is the signal, not the wording. Matching on 'Unauthorized'
+  // recognised only the one failure whose text happened to say so; a missing
+  // token and an unreachable network both printed something else and passed.
+  const supabaseLoggedIn = probe.cli.supabase && probe.supabaseRc === 0 && !!projects;
+  const projectRef = supabaseLoggedIn ? supabaseProjectRef(probe) : '';
+
+  return {
+    container,
+    agentId,
+    displayName: probe.agentName || undefined,
+    githubLoggedIn,
+    githubUser: ghMatch?.[1] ?? '',
+    githubCliInstalled: probe.cli.gh,
+    vercelLoggedIn,
+    vercelUser: vercelLoggedIn ? extractUsername(probe.vercelWhoami) : '',
+    vercelTeam: vercelLoggedIn ? vercelCurrentTeam(probe) : '',
+    vercelCliInstalled: probe.cli.vercel,
+    supabaseLoggedIn,
+    supabaseLinked: !!projectRef,
+    supabaseProjectRef: projectRef,
+    supabaseCliInstalled: probe.cli.supabase,
+    // Presence of the config file is the login signal for both — neither ships a
+    // status command. An empty file now counts as absent, where `test -f` used
+    // to accept it.
+    trelloLoggedIn: !!probe.files.trelloConfig.trim(),
+    trelloCliInstalled: probe.cli.trello,
+    notionLoggedIn: !!probe.files.notionConfig.trim(),
+    toolsMdHasMarkers: probe.toolsMdMarkers > 0,
+    matchedProfiles: matchProfiles(installed, profiles),
+    installedProviders: [...installed.keys()],
+  };
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
@@ -167,8 +159,8 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
   try {
     const url = new URL(request.url);
     const filterAgent = url.searchParams.get('agent');
-    let containers = listAgentContainers();
 
+    let containers = await listAgentContainers();
     if (filterAgent) {
       containers = containers.filter((c) => c.name === filterAgent);
       if (containers.length === 0) {
@@ -176,70 +168,28 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
       }
     }
 
-    const results: (DetectedStatus | DetectionError)[] = [];
-
-    for (const { name, agentId } of containers) {
-      try {
-        const { loggedIn: githubLoggedIn, user: githubUser } = detectGithub(name);
-        const { loggedIn: trelloLoggedIn } = detectTrello(name);
-        const { loggedIn: notionLoggedIn } = detectNotion(name);
-        const { loggedIn: vercelLoggedIn, user: vercelUser, team: vercelTeam } = detectVercel(name);
-        const { loggedIn: supabaseLoggedIn, linked: supabaseLinked, projectRef: supabaseProjectRef } = detectSupabase(name);
-
-        const githubCliInstalled = cliInstalled(name, 'gh');
-        const vercelCliInstalled = cliInstalled(name, 'vercel');
-        const supabaseCliInstalled = cliInstalled(name, 'supabase');
-        const trelloCliInstalled = cliInstalled(name, 'trello');
-        const toolsMdHasMarkers = detectToolsMd(name);
-
-        // Read AGENT_NAME env for display name (may differ from container name)
-        const displayName = execInContainer(
-          name,
-          'printenv AGENT_NAME',
-          (r) => r.trim(),
-          '',
-        ) || undefined;
-
-        // Precise profile matching by token hash — one source of truth for all providers.
-        const matchedProfiles = matchProfiles({
-          'github-pat': providerTokenHash(name, 'github-pat'),
-          vercel: providerTokenHash(name, 'vercel'),
-          supabase: providerTokenHash(name, 'supabase'),
-          trello: providerTokenHash(name, 'trello'),
-          notion: providerTokenHash(name, 'notion'),
-        });
-
-        results.push({
-          container: name,
-          agentId,
-          displayName,
-          githubLoggedIn,
-          githubUser,
-          githubCliInstalled,
-          vercelLoggedIn,
-          vercelUser,
-          vercelTeam,
-          vercelCliInstalled,
-          supabaseLoggedIn,
-          supabaseLinked,
-          supabaseProjectRef,
-          supabaseCliInstalled,
-          trelloLoggedIn,
-          trelloCliInstalled,
-          notionLoggedIn,
-          toolsMdHasMarkers,
-          matchedProfiles,
-        });
-      } catch (e: unknown) {
-        results.push({
-          container: name,
-          agentId,
-          error: (e as Error).message,
-        });
-      }
-    }
+    const profiles = loadHashedProfiles();
+
+    // The callback swallows its own failures: mapWithConcurrency is fail-fast,
+    // so letting one unreachable container reject would discard the results
+    // already computed for every other agent.
+    const agents = await mapWithConcurrency<{ name: string; agentId: string }, DetectedStatus | DetectionError>(
+      containers,
+      AGENT_QUERY_CONCURRENCY,
+      async ({ name, agentId }) => {
+        try {
+          const probe = await probeContainer(name);
+          if (!probe.ok) {
+            return { container: name, agentId, error: 'Container did not respond' };
+          }
+          return shape(name, agentId, probe, profiles);
+        } catch (e: unknown) {
+          return { container: name, agentId, error: (e as Error).message };
+        }
+      },
+    );
 
-    return NextResponse.json({ agents: results });
+    return NextResponse.json({ agents });
   } catch (e: unknown) {
     return NextResponse.json({ error: (e as Error).message }, { status: 500 });
   }

package/app/api/credentials/route.ts

@@ -7,6 +7,9 @@ import { requireAuthJWT } from '@/lib/rev4a-auth';
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  // requireAuthJWT was imported for the POST below and never applied here,
+  // leaving this the only unauthenticated route in the credentials feature.
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
   try {
     const profiles = listProfiles();
     return NextResponse.json({ profiles, providers: CREDENTIAL_PROVIDERS });

package/app/components/Skeleton.tsx

@@ -202,3 +202,135 @@ export function CardRowSkeleton({ count = 3, height = 56 }: { count?: number; he
     </div>
   );
 }
+
+/**
+ * Credential provider cards.
+ *
+ * The credentials page renders one card per entry in CREDENTIAL_PROVIDERS,
+ * which is a static array of five — so the card count here is known, not
+ * guessed, and the grid will not reflow when the data lands.
+ *
+ * Each shape mirrors the real text it stands in for: the label and category
+ * widths track the actual provider names ("Cloud" is short, "Project
+ * Management" is not), and the description line count follows how long each
+ * provider's blurb actually is. That is what keeps the shimmer from jumping
+ * when it is replaced.
+ *
+ * `configuredCards` is the one genuine unknown: whether a provider has stored
+ * profiles is only known once /api/credentials answers. Cards with a profile
+ * are markedly taller, so rendering none would guarantee a jump downward for
+ * anyone who has set some up. Two of five is the middle of the realistic range
+ * and keeps the error small in both directions.
+ */
+export function CredentialCardsSkeleton({ configuredCards = 2 }: { configuredCards?: number }) {
+  // Ordered as CREDENTIAL_PROVIDERS: GitHub, Trello, Vercel, Supabase, Notion.
+  const cards = [
+    { label: 46, cat: 84, pill: 64, desc: ['100%', '58%'], delivery: '56%' },
+    { label: 44, cat: 98, pill: 54, desc: ['92%'], delivery: '82%' },
+    { label: 44, cat: 34, pill: 64, desc: ['100%', '64%'], delivery: '90%' },
+    { label: 58, cat: 50, pill: 54, desc: ['100%', '86%'], delivery: '78%' },
+    { label: 44, cat: 98, pill: 54, desc: ['100%', '92%'], delivery: '72%' },
+  ];
+
+  return (
+    <div
+      aria-hidden="true"
+      style={{
+        display: 'grid',
+        gridTemplateColumns: 'repeat(auto-fill, minmax(320px, 1fr))',
+        gap: 'clamp(12px, 3vw, 16px)',
+      }}
+    >
+      {cards.map((c, i) => (
+        <div
+          key={i}
+          style={{
+            background: 'var(--bg2)',
+            border: '1px solid var(--border)',
+            display: 'flex',
+            flexDirection: 'column',
+          }}
+        >
+          {/* Header: provider badge, name over category, status pill */}
+          <div style={{ display: 'flex', alignItems: 'center', gap: 10, padding: '12px 14px', borderBottom: '1px solid var(--border)' }}>
+            <Skeleton width={28} height={28} accent style={{ flexShrink: 0 }} />
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <Skeleton width={c.label} height={12} />
+              <Skeleton width={c.cat} height={9} style={{ marginTop: 4 }} />
+            </div>
+            <Skeleton width={c.pill} height={16} style={{ flexShrink: 0 }} />
+          </div>
+
+          {/* Description */}
+          <div style={{ padding: '10px 14px', borderBottom: '1px solid var(--border)' }}>
+            {c.desc.map((w, j) => (
+              <Skeleton key={j} width={w} height={9} style={{ marginTop: j === 0 ? 0 : 5 }} />
+            ))}
+          </div>
+
+          {/* Delivery method — one mono line */}
+          <div style={{ padding: '8px 14px', borderBottom: '1px solid var(--border)' }}>
+            <Skeleton width={c.delivery} height={9} />
+          </div>
+
+          {/* A stored profile: label, masked secret + status + sync time, actions,
+              then the per-agent sync rows underneath. */}
+          {i < configuredCards && (
+            <div style={{ padding: '10px 14px', borderBottom: '1px solid var(--border)' }}>
+              <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
+                <div style={{ flex: 1, minWidth: 0 }}>
+                  <Skeleton width="52%" height={11} />
+                  <div style={{ display: 'flex', gap: 10, marginTop: 5 }}>
+                    <Skeleton width={76} height={9} />
+                    <Skeleton width={8} height={9} />
+                    <Skeleton width={62} height={9} />
+                  </div>
+                </div>
+                <Skeleton width={38} height={22} style={{ flexShrink: 0 }} />
+                <Skeleton width={22} height={22} style={{ flexShrink: 0 }} />
+              </div>
+              <div style={{ display: 'flex', flexDirection: 'column', gap: 5, marginTop: 9 }}>
+                <Skeleton width="74%" height={9} />
+                <Skeleton width="66%" height={9} />
+              </div>
+            </div>
+          )}
+
+          {/* Footer action, pinned to the bottom as in the real card */}
+          <div style={{ padding: '10px 14px', marginTop: 'auto' }}>
+            <Skeleton width={i < configuredCards ? 92 : 74} height={26} />
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+/**
+ * Per-agent sync rows inside a credential profile.
+ *
+ * Stands in for the block fed by /api/credentials/detect, which shells into
+ * every agent container and takes seconds. The agent list itself comes from that
+ * same response, so before it lands the count is unknown — three rows is a
+ * placeholder, not a prediction, and the block is deliberately the only thing
+ * that waits: the cards, the stored profiles and the Add buttons all come from
+ * the cheap endpoint and render immediately.
+ *
+ * No Sync/De-sync button is drawn here on purpose. Their label depends on
+ * whether the credential is installed, which is exactly what is still unknown —
+ * a button rendered now would have to guess, and guessing wrong invites a click
+ * that does the opposite of what it says.
+ */
+export function AgentSyncRowsSkeleton({ rows = 3 }: { rows?: number }) {
+  const widths = ['62%', '48%', '55%'];
+  return (
+    <div aria-hidden="true" style={{ marginTop: 8, display: 'flex', flexDirection: 'column', gap: 3 }}>
+      {Array.from({ length: rows }).map((_, i) => (
+        <div key={i} style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
+          <Skeleton width={8} height={8} variant="circle" style={{ flexShrink: 0 }} />
+          <Skeleton width={widths[i % widths.length]} height={9} />
+        </div>
+      ))}
+    </div>
+  );
+}