@flame0510/project-aether 1.1.9

package/app/api/sessions/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { openDb } from '@/lib/db';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const db = openDb();
+    const sessions = db.prepare(`
+      SELECT s.*,
+             l.label AS lineage_label,
+             l.agent_name AS lineage_agent_name
+      FROM sessions s
+      LEFT JOIN lineage l ON s.session_id = l.child_id
+      ORDER BY s.started_at DESC
+      LIMIT 2000
+    `).all();
+    db.close();
+    return NextResponse.json(sessions);
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}

package/app/api/setup/agent-image/route.ts

@@ -0,0 +1,102 @@
+/**
+ * GET /api/setup/agent-image
+ *
+ * Checks if openclaw-agent-base:latest exists locally or needs downloading.
+ * Returns status and a hint for the UI.
+ *
+ * POST /api/setup/agent-image
+ *
+ * Downloads openclaw-agent-base:latest from ghcr.io (public registry).
+ * Streams progress via SSE so the setup wizard can show a live progress bar.
+ *
+ * Only one download at a time — returns 409 if already running.
+ * Cleans up the docker process if the client disconnects.
+ */
+import { NextResponse } from 'next/server';
+import { downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
+import { execSync } from 'child_process';
+
+export const dynamic = 'force-dynamic';
+
+function dockerOk(): boolean {
+  try {
+    execSync('docker version --format "{{.Client.Version}}" 2>/dev/null', {
+      encoding: 'utf-8',
+      timeout: 2000,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function GET(): Promise<NextResponse> {
+  if (!dockerOk()) {
+    return NextResponse.json({ exists: false });
+  }
+  try {
+    const { exec } = await import('child_process');
+    const result = await new Promise<string>((resolve, reject) => {
+      exec(
+        'docker image inspect openclaw-agent-base:latest --format "{{.ID}}" 2>/dev/null',
+        { timeout: 5000 },
+        (err, stdout) => {
+          if (err) return reject(err);
+          resolve(stdout.trim());
+        },
+      );
+    });
+    if (result) {
+      return NextResponse.json({ exists: true, imageId: result });
+    }
+    return NextResponse.json({ exists: false });
+  } catch {
+    return NextResponse.json({ exists: false });
+  }
+}
+
+export async function POST(): Promise<Response> {
+  if (getIsDownloading()) {
+    return new Response(
+      JSON.stringify({ error: 'A download is already in progress' }),
+      { status: 409, headers: { 'Content-Type': 'application/json' } },
+    );
+  }
+
+  const encoder = new TextEncoder();
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      const send = (data: string) => {
+        try {
+          controller.enqueue(encoder.encode(`data: ${data}\n\n`));
+        } catch { /* stream closed */ }
+      };
+
+      const ctrl = controller as ReadableStreamDefaultController & { signal?: AbortSignal };
+
+      try {
+        await downloadAgentImage({
+          force: false, // setup: skip if already exists
+          onEvent: send,
+          signal: ctrl.signal,
+        });
+      } catch (e: unknown) {
+        send(JSON.stringify({
+          type: 'error',
+          message: (e as Error).message || 'Failed to download agent image',
+        }));
+      }
+      controller.close();
+    },
+    cancel() { /* downloadAgentImage handles cleanup via signal */ },
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive',
+    },
+  });
+}

package/app/api/setup/password/route.ts

@@ -0,0 +1,111 @@
+/**
+ * POST /api/setup/password
+ *
+ * No auth required. Sets the admin password on first run.
+ * Refuses if a password is already configured.
+ * Also generates a random JWT secret and API token if missing.
+ *
+ * Body: { password: string }
+ *
+ * Does NOT restart the server — the password takes effect
+ * after the full setup wizard completes and the server restarts.
+ */
+import { NextResponse } from 'next/server';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { ENV_FILE } from '@/lib/rev4a-paths';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+function generateSecret(len: number): string {
+  return crypto.randomBytes(len).toString('base64url').slice(0, len);
+}
+
+export async function POST(request: Request): Promise<NextResponse> {
+  // Check both env and .env file (same fallback pattern as login/status routes)
+  let currentPassword = process.env.REV4A_PASSWORD;
+  if (typeof currentPassword !== 'string' || currentPassword.length === 0) {
+    try {
+      if (fs.existsSync(ENV_FILE)) {
+        const content = fs.readFileSync(ENV_FILE, 'utf-8');
+        const match = content.match(/^REV4A_PASSWORD=(.+)$/m);
+        if (match && match[1].trim()) {
+          currentPassword = match[1].trim();
+        }
+      }
+    } catch { /* ignore */ }
+  }
+  if (typeof currentPassword === 'string' && currentPassword.length > 0) {
+    return NextResponse.json(
+      { error: 'Password is already configured. Use the Config page to change it.' },
+      { status: 409 },
+    );
+  }
+
+  let body: { password?: string };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 });
+  }
+
+  if (!body.password || typeof body.password !== 'string') {
+    return NextResponse.json({ error: 'password is required' }, { status: 400 });
+  }
+
+  if (body.password.length < 8) {
+    return NextResponse.json(
+      { error: 'Password must be at least 8 characters' },
+      { status: 400 },
+    );
+  }
+
+  try {
+    // Ensure parent directory exists
+    const dir = path.dirname(ENV_FILE);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+
+    let content = '';
+    if (fs.existsSync(ENV_FILE)) {
+      content = fs.readFileSync(ENV_FILE, 'utf-8');
+    }
+
+    // Ensure password line
+    if (content.includes('REV4A_PASSWORD=')) {
+      content = content
+        .split('\n')
+        .map((line) =>
+          line.startsWith('REV4A_PASSWORD=')
+            ? 'REV4A_PASSWORD=' + body.password
+            : line,
+        )
+        .join('\n');
+    } else {
+      content += '\nREV4A_PASSWORD=' + body.password + '\n';
+    }
+
+    // Generate JWT secret if missing
+    if (!content.includes('REV4A_JWT_SECRET=')) {
+      const secret = generateSecret(64);
+      content += '\nREV4A_JWT_SECRET=' + secret + '\n';
+    }
+
+    // Generate API token if missing
+    if (!content.includes('REV4A_TOKEN=')) {
+      const token = generateSecret(32);
+      content += '\nREV4A_TOKEN=' + token + '\n';
+    }
+
+    fs.writeFileSync(ENV_FILE, content.trim() + '\n', { encoding: 'utf-8', mode: 0o600 });
+
+    // Update in-memory so proxy redirects work before restart
+    process.env.REV4A_PASSWORD = body.password;
+
+    return NextResponse.json({ status: 'ok' });
+  } catch (e: unknown) {
+    console.error('[setup/password]', e);
+    return NextResponse.json({ error: 'Failed to write password' }, { status: 500 });
+  }
+}

package/app/api/setup/restart/route.ts

@@ -0,0 +1,76 @@
+/**
+ * POST /api/setup/restart
+ *
+ * No auth required. Restarts the Rev4a server so that changes to
+ * .env (especially REV4A_PASSWORD) take effect.
+ *
+ * Next.js inlines env vars at build time, so a runtime process.env
+ * mutation is not enough — the process must restart to reload .env.
+ *
+ * Strategy:
+ *   1. If running under systemd (rev4a.service), restart via systemctl.
+ *   2. Otherwise send SIGTERM to the current process. The parent process
+ *      manager (npx rev4a all or a shell wrapper) should restart it.
+ */
+import { NextResponse } from 'next/server';
+import * as fs from 'fs';
+import { execSync } from 'child_process';
+import { ENV_FILE } from '@/lib/rev4a-paths';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function POST(): Promise<NextResponse> {
+  try {
+    if (!fs.existsSync(ENV_FILE)) {
+      return NextResponse.json({ error: '.env file not found' }, { status: 500 });
+    }
+
+    const envContent = fs.readFileSync(ENV_FILE, 'utf-8');
+    const match = envContent.match(/^REV4A_PASSWORD=(.*)$/m);
+    if (!match || !match[1].trim()) {
+      return NextResponse.json(
+        { error: 'REV4A_PASSWORD is empty or missing in .env' },
+        { status: 400 },
+      );
+    }
+
+    // Try systemd first (production).
+    // If it fails, fall back to SIGTERM (dev mode / container).
+    let usedSystemd = false;
+    try {
+      execSync('sudo systemctl daemon-reload', { timeout: 5000 });
+      usedSystemd = true;
+    } catch {
+      // systemctl not available — fine, we'll SIGTERM
+    }
+
+    const response = NextResponse.json({
+      status: 'ok',
+      restarting: true,
+      mode: usedSystemd ? 'systemd' : 'process',
+    });
+
+    if (usedSystemd) {
+      setTimeout(() => {
+        try {
+          execSync('sudo systemctl restart rev4a.service', { timeout: 15000 });
+        } catch (err) {
+          console.error('[setup/restart] systemd restart failed:', err);
+        }
+      }, 2000);
+    } else {
+      // Dev mode / container: send SIGTERM after flushing response.
+      // The parent (npx rev4a all or shell) will restart the process,
+      // which will re-read .env at startup.
+      setTimeout(() => {
+        process.kill(process.pid, 'SIGTERM');
+      }, 2000);
+    }
+
+    return response;
+  } catch (e: unknown) {
+    console.error('[setup/restart]', e);
+    return NextResponse.json({ error: 'Failed to restart' }, { status: 500 });
+  }
+}

package/app/api/skills/delete/route.js

@@ -0,0 +1,105 @@
+import { NextResponse } from 'next/server';
+import fs from 'fs';
+import path from 'path';
+import { execFileSync } from 'child_process';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+const SHARED_SKILLS_DIR = '/docker/shared-skills';
+
+/**
+ * DELETE /api/skills/delete
+ *
+ * Deletes a skill. Supports two modes:
+ * - shared: removes from /docker/shared-skills/
+ * - workspace/container: removes from container via docker exec rm -rf
+ *
+ * Body: { skillName, containerName? }
+ */
+export async function DELETE(request) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
+
+  try {
+    const { skillName, containerName } = await request.json();
+
+    if (!skillName) {
+      return NextResponse.json(
+        { error: 'skillName is required' },
+        { status: 400 }
+      );
+    }
+
+    // Sanitize: prevent path traversal
+    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\/[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/.test(skillName)) {
+      return NextResponse.json(
+        { error: 'Invalid skill name format' },
+        { status: 400 }
+      );
+    }
+
+    if (containerName) {
+      // Delete from agent container workspace
+      const skillDir = `/root/.openclaw/workspace/skills/${skillName}`;
+
+      // Verify container exists
+      try {
+        execFileSync('docker', ['inspect', containerName], { encoding: 'utf8', timeout: 5000 });
+      } catch {
+        return NextResponse.json(
+          { error: `Container ${containerName} not found` },
+          { status: 404 }
+        );
+      }
+
+      // Check if skill exists in container
+      try {
+        execFileSync('docker', ['exec', containerName, 'test', '-d', skillDir], { encoding: 'utf8', timeout: 5000 });
+      } catch {
+        return NextResponse.json(
+          { error: `Skill "${skillName}" not found in container ${containerName}` },
+          { status: 404 }
+        );
+      }
+
+      execFileSync('docker', ['exec', containerName, 'rm', '-rf', skillDir], { encoding: 'utf8', timeout: 10000 });
+
+      return NextResponse.json({
+        ok: true,
+        skillName,
+        containerName,
+        deleted: true,
+        from: 'workspace',
+      });
+    }
+
+    // Delete from shared skills directory
+    const skillDir = path.join(SHARED_SKILLS_DIR, skillName);
+
+    if (!fs.existsSync(skillDir)) {
+      return NextResponse.json(
+        { error: `Skill "${skillName}" not found in shared skills` },
+        { status: 404 }
+      );
+    }
+
+    // Prevent deletion of non-shared paths (safety check)
+    if (!skillDir.startsWith(SHARED_SKILLS_DIR)) {
+      return NextResponse.json(
+        { error: 'Invalid path' },
+        { status: 400 }
+      );
+    }
+
+    fs.rmSync(skillDir, { recursive: true, force: true });
+
+    return NextResponse.json({
+      ok: true,
+      skillName,
+      deleted: true,
+      from: 'shared',
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : 'Internal error';
+    return NextResponse.json({ error: msg }, { status: 500 });
+  }
+}

package/app/api/skills/promote/route.js

@@ -0,0 +1,129 @@
+import { NextResponse } from 'next/server';
+import fs from 'fs';
+import path from 'path';
+import { execSync, execFileSync } from 'child_process';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+const SHARED_SKILLS_DIR = '/docker/shared-skills';
+
+/**
+ * POST /api/skills/promote
+ *
+ * Copies a skill from an agent container's workspace to the shared skills
+ * directory, making it available to all agents via extraDirs.
+ *
+ * Body: {
+ *   containerName: "openclaw-atlas",
+ *   skillName: "my-custom-skill"
+ * }
+ */
+export async function POST(request) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
+
+  try {
+    const { containerName, skillName } = await request.json();
+
+    if (!containerName || !skillName) {
+      return NextResponse.json(
+        { error: 'containerName and skillName are required' },
+        { status: 400 }
+      );
+    }
+
+    // Sanitize: skill name must be a valid directory name
+    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\/[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/.test(skillName)) {
+      return NextResponse.json(
+        { error: 'Invalid skill name format' },
+        { status: 400 }
+      );
+    }
+
+    // Verify the container exists and has an AGENT_ID label
+    let agentId;
+    try {
+      agentId = execFileSync('docker', [
+        'inspect', containerName,
+        '--format', '{{index .Config.Labels "AGENT_ID"}}'
+      ], { encoding: 'utf8', timeout: 5000 }).trim();
+      if (!agentId) {
+        return NextResponse.json(
+          { error: `Container ${containerName} has no AGENT_ID label` },
+          { status: 400 }
+        );
+      }
+    } catch {
+      return NextResponse.json(
+        { error: `Container ${containerName} not found` },
+        { status: 404 }
+      );
+    }
+
+    // Read SKILL.md content from the container
+    const srcPath = `/root/.openclaw/workspace/skills/${skillName}/SKILL.md`;
+    let content;
+    try {
+      content = execFileSync('docker', ['exec', containerName, 'cat', srcPath], {
+        encoding: 'utf8', timeout: 5000
+      });
+    } catch {
+      return NextResponse.json(
+        { error: `Skill "${skillName}" not found in container ${containerName}` },
+        { status: 404 }
+      );
+    }
+
+    // Check for additional files in the skill directory (assets, scripts, etc.)
+    const extraFiles = [];
+    try {
+      const listRaw = execFileSync('docker', ['exec', containerName, 'ls', '-1p', `/root/.openclaw/workspace/skills/${skillName}/`], {
+        encoding: 'utf8', timeout: 5000
+      }).trim();
+      // Exclude SKILL.md and directories from the extras list
+      extraFiles.push(
+        ...listRaw.split('\n')
+          .map(f => f.trim())
+          .filter(f => f && !f.endsWith('/') && f !== 'SKILL.md')
+      );
+    } catch {
+      // No extra files — that's fine
+    }
+
+    // Create shared skills directory if it doesn't exist
+    const destDir = path.join(SHARED_SKILLS_DIR, skillName);
+    fs.mkdirSync(destDir, { recursive: true });
+
+    // Write SKILL.md
+    const destPath = path.join(destDir, 'SKILL.md');
+    const overwritten = fs.existsSync(destPath);
+    fs.writeFileSync(destPath, content, 'utf8');
+
+    // Copy extra files from container
+    let extraCopied = 0;
+    for (const file of extraFiles) {
+      try {
+        const fileContent = execFileSync('docker', ['exec', containerName, 'cat', `/root/.openclaw/workspace/skills/${skillName}/${file}`], {
+          encoding: 'utf8', timeout: 5000
+        });
+        fs.writeFileSync(path.join(destDir, file), fileContent, 'utf8');
+        extraCopied++;
+      } catch {
+        // Skip files that can't be read
+      }
+    }
+
+    return NextResponse.json({
+      ok: true,
+      skillName,
+      agentId,
+      containerName,
+      destPath,
+      overwritten,
+      extraCopied,
+    });
+  } catch (err) {
+    // Only return message for known Error objects, never raw unknown throws
+    const msg = err instanceof Error ? err.message : 'Internal error';
+    return NextResponse.json({ error: msg }, { status: 500 });
+  }
+}