@flame0510/project-aether 1.1.9

package/app/api/envcheck/route.ts

@@ -0,0 +1,18 @@
+import { type NextRequest } from "next/server";
+import { NextResponse } from 'next/server';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+const SENSITIVE = ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET'];
+
+export async function GET(request: NextRequest) {
+  const safe: Record<string, string> = {};
+  for (const key of ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET', 'REV4A_ALERTS_ENABLED', 'REV4A_DB', 'REV4A_WORKSPACE_ROOT', 'PROVIDER_DEEPSEEK_API_KEY', 'NODE_ENV']) {
+    const val = process.env[key];
+    if (SENSITIVE.includes(key)) {
+      safe[key] = val ? '✅ set (' + val.substring(0, 4) + '...)' : '❌ not set';
+    } else {
+      safe[key] = val || '(not set)';
+    }
+  }
+  return NextResponse.json(safe);
+}

package/app/api/events/route.ts

@@ -0,0 +1,24 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { openDb } from '@/lib/db';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { searchParams } = new URL(request.url);
+  const parsed = Number.parseInt(searchParams.get('limit') ?? '50', 10);
+  const limit = Number.isFinite(parsed) ? Math.min(Math.max(parsed, 1), 500) : 50;
+  try {
+    const db = openDb();
+    const events = db
+      .prepare(
+        `SELECT e.*, s.label AS session_label
+         FROM events e LEFT JOIN sessions s ON s.session_id = e.session_id
+         ORDER BY e.ts DESC LIMIT ?`,
+      )
+      .all(limit);
+    db.close();
+    return NextResponse.json(events);
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}

package/app/api/gateway/agent/route.ts

@@ -0,0 +1,154 @@
+/**
+ * PUT /api/gateway/agent
+ *
+ * Update the model configuration for an agent container.
+ * Uses base64-safe write — no heredoc shell escaping issues.
+ *
+ * Body:
+ *   { "containerName": "openclaw-atlas", "model": "rev4a/deepseek-v4-flash", "fallbacks": ["rev4a/deepseek-v4-pro"] }
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import { execSync } from 'child_process';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+function execInContainer(container: string, cmd: string, timeout = 15000): string {
+  try {
+    return execSync(
+      `docker exec ${container} sh -c ${JSON.stringify(cmd)}`,
+      { timeout, maxBuffer: 1024 * 1024, encoding: 'utf-8' },
+    ).trim();
+  } catch (e: unknown) {
+    const err = e as { stderr?: string; message?: string };
+    throw new Error(err.stderr || err.message || `Failed to exec in ${container}`);
+  }
+}
+
+function ensureRev4aPrefix(id: string): string {
+  return id.startsWith('rev4a/') ? id : `rev4a/${id}`;
+}
+
+function ensureRev4aPrefixes(ids: string[]): string[] {
+  return ids.map(ensureRev4aPrefix);
+}
+
+function dedupe<T>(arr: T[]): T[] {
+  return [...new Set(arr)];
+}
+
+/** Write content to a file inside a container. */
+function writeFileToContainer(container: string, remotePath: string, content: string): void {
+  const b64 = Buffer.from(content, 'utf-8').toString('base64');
+  execSync(
+    `docker exec ${container} sh -c "echo '${b64}' | base64 -d > ${remotePath}"`,
+    { timeout: 15000, maxBuffer: 128 * 1024 },
+  );
+}
+
+/** Read file content from container (stderr goes to /dev/null). */
+function readFileFromContainer(container: string, remotePath: string): string {
+  try {
+    return execInContainer(container, `cat ${remotePath} 2>/dev/null`);
+  } catch {
+    return '';
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const body: { containerName?: string; model?: string; fallbacks?: string[] } = await request.json();
+    const { containerName } = body;
+
+    if (!containerName) {
+      return NextResponse.json({ status: 'error', error: 'containerName is required' }, { status: 400 });
+    }
+
+    const safeContainer = containerName.replace(/[^a-zA-Z0-9_.-]/g, '');
+    if (safeContainer !== containerName) {
+      return NextResponse.json({ status: 'error', error: 'Invalid container name' }, { status: 400 });
+    }
+
+    if (!body.model) {
+      return NextResponse.json({ status: 'error', error: 'model is required' }, { status: 400 });
+    }
+
+    // Read current config
+    const raw = readFileFromContainer(safeContainer, '/root/.openclaw/openclaw.json');
+    if (!raw) {
+      return NextResponse.json({ status: 'error', error: 'Failed to read config from container (empty)' }, { status: 500 });
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      config = JSON.parse(raw);
+    } catch (e) {
+      return NextResponse.json({
+        status: 'error',
+        error: 'Failed to parse config from container',
+        detail: raw.slice(0, 200),
+      }, { status: 500 });
+    }
+
+    // Update model config
+    const agents = (config.agents || {}) as Record<string, unknown>;
+    const list = (agents.list || []) as Record<string, unknown>[];
+
+    const mainAgent = list.find((a) => a.id === 'main');
+    if (mainAgent) {
+      const primary = ensureRev4aPrefix(body.model);
+      let fallbacks = dedupe(ensureRev4aPrefixes(body.fallbacks || []));
+      // Remove the primary model dai fallback
+      fallbacks = fallbacks.filter((fb) => fb !== primary);
+      mainAgent.model = {
+        primary,
+        fallbacks,
+      };
+    }
+
+    const defaults = (agents.defaults || {}) as Record<string, unknown>;
+    {
+      const primary = ensureRev4aPrefix(body.model);
+      let fallbacks = dedupe(ensureRev4aPrefixes(body.fallbacks || []));
+      fallbacks = fallbacks.filter((fb) => fb !== primary);
+      defaults.model = {
+        primary,
+        fallbacks,
+      };
+    }
+
+    // Write back
+    const newConfig = JSON.stringify(config, null, 2);
+    execSync(
+      `docker exec -i ${safeContainer} sh -c 'cat > /root/.openclaw/openclaw.json'`,
+      { timeout: 15000, maxBuffer: 1024 * 1024, input: newConfig },
+    );
+
+    // Restart gateway to pick up the changes
+    try {
+      execSync(`docker exec ${safeContainer} openclaw gateway restart`, { timeout: 15000, maxBuffer: 64 * 1024 });
+    } catch {
+      // restart failure is non-fatal, config was written
+    }
+
+    // Verify
+    const verifyRaw = readFileFromContainer(safeContainer, '/root/.openclaw/openclaw.json');
+    const verifyOk = verifyRaw.includes('"primary"');
+    const verifyBytes = verifyRaw.length;
+
+    return NextResponse.json({
+      status: 'ok',
+      agent: safeContainer,
+      model: {
+        primary: body.model,
+        fallbacks: body.fallbacks || [],
+      },
+      verify: { ok: verifyOk, bytes: verifyBytes },
+    });
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e);
+    return NextResponse.json({ status: 'error', error: message }, { status: 500 });
+  }
+}

package/app/api/gateway/provider/balance/route.ts

@@ -0,0 +1,38 @@
+/**
+ * GET /api/gateway/provider/balance?provider=deepseek
+ *
+ * Fetches the current balance/credits from an upstream AI provider.
+ * Requires the provider's API key to be configured in provider-keys.json.
+ *
+ * Supported providers: deepseek, openrouter, glm
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import { fetchProviderBalance, type BalanceProvider } from '@/lib/provider-balance';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+const SUPPORTED: BalanceProvider[] = ['deepseek', 'openrouter', 'glm'];
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const provider = request.nextUrl.searchParams.get('provider') as BalanceProvider | null;
+
+  if (!provider || !SUPPORTED.includes(provider)) {
+    return NextResponse.json(
+      {
+        error: `Unsupported or missing provider. Supported: ${SUPPORTED.join(', ')}`,
+      },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await fetchProviderBalance(provider);
+    return NextResponse.json({ provider, ...result });
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e);
+    return NextResponse.json({ provider, error: message }, { status: 502 });
+  }
+}

package/app/api/gateway/provider/keys.ts

@@ -0,0 +1,38 @@
+import * as fs from 'fs';
+import { PROVIDER_KEYS_FILE } from '@/lib/rev4a-paths';
+import * as path from 'path';
+
+const KEYS_PATH = PROVIDER_KEYS_FILE;
+
+interface ProviderKeys {
+  [provider: string]: string;
+}
+
+function ensureDir(): void {
+  const dir = path.dirname(KEYS_PATH);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+}
+
+export function readProviderKeys(): ProviderKeys {
+  ensureDir();
+  try {
+    const raw = fs.readFileSync(KEYS_PATH, 'utf-8');
+    return JSON.parse(raw);
+  } catch {
+    // File doesn't exist — try to migrate from env
+    const keys: ProviderKeys = {};
+    if (process.env.PROVIDER_DEEPSEEK_API_KEY) keys['deepseek'] = process.env.PROVIDER_DEEPSEEK_API_KEY;
+    if (process.env.PROVIDER_OPENROUTER_API_KEY) keys['openrouter'] = process.env.PROVIDER_OPENROUTER_API_KEY;
+    if (Object.keys(keys).length > 0) {
+      writeProviderKeys(keys);
+    }
+    return keys;
+  }
+}
+
+export function writeProviderKeys(keys: ProviderKeys): void {
+  ensureDir();
+  fs.writeFileSync(KEYS_PATH, JSON.stringify(keys, null, 2), 'utf-8');
+}

package/app/api/gateway/provider/oauth/route.ts

@@ -0,0 +1,304 @@
+/**
+ * Gateway OAuth — Device Code Flow
+ *
+ * POST /api/gateway/provider/oauth           — start device code flow
+ * GET  /api/gateway/provider/oauth           — poll authorization status
+ * POST /api/gateway/provider/oauth/save      — save completed token
+ *
+ * Designed for multiple providers (openai-codex, github-copilot, claude-cli, etc.)
+ * Each provider defines its own device code config + token exchange logic.
+ *
+ * After successful auth, the API key is saved to provider-keys.json
+ * and the provider appears automatically in /api/models and Pulse.
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import { readProviderKeys, writeProviderKeys } from '@/app/api/gateway/provider/keys';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+// ── Provider OAuth configs ─────────────────────────────────────────────
+
+interface DeviceCodeConfig {
+  clientId: string;
+  clientSecret?: string;
+  deviceCodeUrl: string;
+  pollUrl: string;
+  tokenUrl: string;
+  verificationUrl: string;
+  verificationTitle?: string;
+  defaultIntervalMs: number;
+  /** How to authenticate in the token exchange */
+  authStyle: 'basic' | 'json' | 'form';
+  /** Extra headers to send */
+  extraHeaders?: Record<string, string>;
+  /** Custom token exchange logic — returns { accessToken, refreshToken?, expiresMs? } */
+  exchangeTokens?: (data: Record<string, unknown>, config: DeviceCodeConfig) => Promise<OAuthTokenResult>;
+  /** Display-friendly name */
+  label: string;
+}
+
+interface OAuthTokenResult {
+  accessToken: string;
+  refreshToken?: string;
+  expiresMs?: number;
+}
+
+const OAUTH_CONFIGS: Record<string, DeviceCodeConfig> = {
+  'openai-codex': {
+    label: 'OpenAI Codex',
+    clientId: 'app_EMoamEEZ73f0CkXaXp7hrann',
+    deviceCodeUrl: 'https://auth.openai.com/api/accounts/deviceauth/usercode',
+    pollUrl: 'https://auth.openai.com/api/accounts/deviceauth/token',
+    tokenUrl: 'https://auth.openai.com/oauth/token',
+    verificationUrl: 'https://auth.openai.com/codex/device',
+    verificationTitle: 'auth.openai.com',
+    defaultIntervalMs: 5000,
+    authStyle: 'json',
+    extraHeaders: {
+      originator: 'openclaw',
+      'User-Agent': 'openclaw/rev4a',
+    },
+  },
+
+  'github-copilot': {
+    label: 'GitHub Copilot',
+    clientId: 'Iv23lirMpKoFUugB9w4p',
+    deviceCodeUrl: 'https://github.com/login/device/code',
+    pollUrl: 'https://github.com/login/oauth/access_token',
+    tokenUrl: 'https://github.com/login/oauth/access_token',
+    verificationUrl: 'https://github.com/login/device',
+    verificationTitle: 'github.com',
+    defaultIntervalMs: 5000,
+    authStyle: 'json',
+  },
+
+  // Placeholder for future providers:
+  // 'claude-cli': {
+  //   label: 'Claude CLI',
+  //   clientId: '...',
+  //   ...
+  // },
+};
+
+// ── START device code flow ─────────────────────────────────────────────
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const body = await request.json().catch(() => ({}));
+    const provider = body.provider as string | undefined;
+
+    if (!provider || !OAUTH_CONFIGS[provider]) {
+      const available = Object.keys(OAUTH_CONFIGS);
+      return NextResponse.json({
+        error: `Unknown or unsupported provider: '${provider}'`,
+        available,
+      }, { status: 400 });
+    }
+
+    const config = OAUTH_CONFIGS[provider];
+
+    // Step 1: request device code
+    const deviceRes = await fetch(config.deviceCodeUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...config.extraHeaders,
+      },
+      body: JSON.stringify({ client_id: config.clientId }),
+    });
+
+    if (!deviceRes.ok) {
+      const errText = await deviceRes.text();
+      return NextResponse.json({
+        status: 'failed',
+        error: `Device code request failed: HTTP ${deviceRes.status} — ${errText.slice(0, 300)}`,
+      }, { status: 502 });
+    }
+
+    const deviceData = await deviceRes.json() as Record<string, unknown>;
+    const deviceAuthId = (deviceData.device_auth_id || deviceData.device_code) as string | undefined;
+    const userCode = (deviceData.user_code || deviceData.usercode) as string | undefined;
+
+    if (!deviceAuthId || !userCode) {
+      return NextResponse.json({
+        status: 'failed',
+        error: 'Provider response missing device_auth_id or user_code',
+        raw: deviceData,
+      }, { status: 502 });
+    }
+
+    const intervalMs = typeof deviceData.interval === 'number'
+      ? deviceData.interval * 1000
+      : config.defaultIntervalMs;
+
+    return NextResponse.json({
+      status: 'pending',
+      provider,
+      label: config.label,
+      deviceAuthId,
+      userCode,
+      verificationUri: config.verificationUrl,
+      verificationTitle: config.verificationTitle || new URL(config.verificationUrl).hostname,
+      intervalMs,
+      expiresMs: Date.now() + 15 * 60 * 1000, // 15 min timeout
+    });
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e);
+    return NextResponse.json({ status: 'failed', error: message }, { status: 500 });
+  }
+}
+
+// ── POLL authorization status ──────────────────────────────────────────
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const provider = request.nextUrl.searchParams.get('provider');
+    const deviceAuthId = request.nextUrl.searchParams.get('deviceAuthId');
+    const userCode = request.nextUrl.searchParams.get('userCode') || '';
+    const expiresMs = parseInt(request.nextUrl.searchParams.get('expiresMs') || '0');
+
+    if (!provider || !deviceAuthId) {
+      return NextResponse.json({ status: 'missing_params', error: 'provider and deviceAuthId required' }, { status: 400 });
+    }
+
+    // Check timeout
+    if (expiresMs && Date.now() > expiresMs) {
+      return NextResponse.json({ status: 'timeout', message: 'Authorization timed out. Please start again.' });
+    }
+
+    const config = OAUTH_CONFIGS[provider];
+    if (!config) {
+      return NextResponse.json({ status: 'unsupported', error: `Unknown provider: ${provider}` }, { status: 400 });
+    }
+
+    // Poll
+    const pollHeaders: Record<string, string> = {
+      'Content-Type': 'application/json',
+      ...config.extraHeaders,
+    };
+
+    const pollBody: Record<string, string> = {
+      device_auth_id: deviceAuthId,
+      user_code: userCode,
+    };
+
+    if (config.authStyle === 'json') {
+      pollBody.client_id = config.clientId;
+    }
+
+    const pollRes = await fetch(config.pollUrl, {
+      method: 'POST',
+      headers: pollHeaders,
+      body: JSON.stringify(pollBody),
+    });
+
+    // Authorization still pending — provider returns 403/40x
+    if (!pollRes.ok) {
+      if (pollRes.status === 403 || pollRes.status === 404) {
+        return NextResponse.json({ status: 'pending' });
+      }
+
+      const errText = await pollRes.text();
+      try {
+        const err = JSON.parse(errText);
+        if (err.error === 'authorization_pending') {
+          return NextResponse.json({ status: 'pending' });
+        }
+        if (err.error === 'slow_down') {
+          return NextResponse.json({ status: 'pending', delayMs: 10000 });
+        }
+      } catch {
+        // not JSON, fall through
+      }
+
+      return NextResponse.json({
+        status: 'failed',
+        error: `Poll failed: HTTP ${pollRes.status} — ${errText.slice(0, 300)}`,
+      }, { status: 502 });
+    }
+
+    // Success! Parse tokens
+    const data = await pollRes.json() as Record<string, unknown>;
+
+    // OpenAI Codex: returns authorization_code + code_verifier, needs exchange
+    if (provider === 'openai-codex' && data.authorization_code && data.code_verifier) {
+      const exchangeBody = new URLSearchParams();
+      exchangeBody.append('grant_type', 'authorization_code');
+      exchangeBody.append('code', data.authorization_code as string);
+      exchangeBody.append('redirect_uri', 'https://auth.openai.com/deviceauth/callback');
+      exchangeBody.append('client_id', config.clientId);
+      exchangeBody.append('code_verifier', data.code_verifier as string);
+
+      const exchangeHeaders: Record<string, string> = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        ...config.extraHeaders,
+      };
+
+      const exchangeRes = await fetch(config.tokenUrl, {
+        method: 'POST',
+        headers: exchangeHeaders,
+        body: exchangeBody,
+      });
+
+      if (!exchangeRes.ok) {
+        const errText = await exchangeRes.text();
+        return NextResponse.json({
+          status: 'failed',
+          error: `Token exchange failed: HTTP ${exchangeRes.status} — ${errText.slice(0, 300)}`,
+        }, { status: 502 });
+      }
+
+      const tokenData = await exchangeRes.json() as Record<string, unknown>;
+      const accessToken = tokenData.access_token as string;
+      const refreshToken = tokenData.refresh_token as string;
+
+      if (!accessToken) {
+        return NextResponse.json({ status: 'failed', error: 'No access_token in exchange response' }, { status: 502 });
+      }
+
+      // Save to provider-keys.json
+      const keys = readProviderKeys();
+      keys[provider] = accessToken;
+      writeProviderKeys(keys);
+
+      const expiresIn = tokenData.expires_in as number | undefined;
+
+      return NextResponse.json({
+        status: 'completed',
+        provider,
+        label: config.label,
+        refreshToken: refreshToken || null,
+        expiresMs: expiresIn ? Date.now() + expiresIn * 1000 : null,
+      });
+    }
+
+    // Direct access_token providers (github-copilot, etc.)
+    if (data.access_token) {
+      const accessToken = data.access_token as string;
+
+      // Save to provider-keys.json
+      const keys = readProviderKeys();
+      keys[provider] = accessToken;
+      writeProviderKeys(keys);
+
+      const expiresIn = data.expires_in as number | undefined;
+
+      return NextResponse.json({
+        status: 'completed',
+        provider,
+        label: config.label,
+        refreshToken: (data.refresh_token as string) || null,
+        expiresMs: expiresIn ? Date.now() + expiresIn * 1000 : null,
+      });
+    }
+
+    // Still waiting
+    return NextResponse.json({ status: 'pending' });
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e);
+    return NextResponse.json({ status: 'failed', error: message }, { status: 500 });
+  }
+}