@flame0510/project-aether 1.1.9

package/lib/credentials/providers.ts

@@ -0,0 +1,110 @@
+export interface CredentialField {
+  key: string;
+  label: string;
+  placeholder: string;
+  type: 'text' | 'password';
+  hint?: string;
+}
+
+export interface CredentialProviderDef {
+  id: string;
+  label: string;
+  category: 'vcs' | 'pm' | 'cloud' | 'db';
+  description: string;
+  authType: 'static-token' | 'api-key-pair';
+  fields: CredentialField[];
+  deliveryMethod: string;
+  docsUrl?: string;
+}
+
+export const CREDENTIAL_PROVIDERS: CredentialProviderDef[] = [
+  {
+    id: 'github-pat',
+    label: 'GitHub',
+    category: 'vcs',
+    description: 'Personal Access Token for GitHub API and git operations',
+    authType: 'static-token',
+    fields: [
+      {
+        key: 'token',
+        label: 'Personal Access Token',
+        placeholder: 'ghp_...',
+        type: 'password',
+        hint: 'Requires repo, read:org scopes at minimum',
+      },
+    ],
+    deliveryMethod: 'gh auth login --with-token',
+    docsUrl: 'https://github.com/settings/tokens',
+  },
+  {
+    id: 'trello',
+    label: 'Trello',
+    category: 'pm',
+    description: 'API Key and Token for Trello board access',
+    authType: 'api-key-pair',
+    fields: [
+      { key: 'apiKey', label: 'API Key', placeholder: 'd3c4a0fee...', type: 'password' },
+      { key: 'token', label: 'Token', placeholder: 'ATTA...', type: 'password', hint: 'Click "Generate Trello Token" below to authorize' },
+    ],
+    deliveryMethod: 'writes ~/.trello-cli/default/config.json',
+    docsUrl: 'https://trello.com/power-ups/admin',
+  },
+  {
+    id: 'vercel',
+    label: 'Vercel',
+    category: 'cloud',
+    description: 'Access Token for Vercel deployments and project management',
+    authType: 'static-token',
+    fields: [
+      {
+        key: 'token',
+        label: 'Access Token',
+        placeholder: 'vcp_...',
+        type: 'password',
+        hint: 'Create in Vercel Settings → Tokens',
+      },
+    ],
+    deliveryMethod: 'writes ~/.local/share/com.vercel.cli/auth.json',
+    docsUrl: 'https://vercel.com/account/tokens',
+  },
+  {
+    id: 'supabase',
+    label: 'Supabase',
+    category: 'db',
+    description: 'Access token for Supabase CLI — grants access to all projects on your account',
+    authType: 'static-token',
+    fields: [
+      {
+        key: 'accessToken',
+        label: 'Access Token',
+        placeholder: 'sbp_...',
+        type: 'password',
+        hint: 'Supabase CLI personal access token. Create at supabase.com/dashboard/account/tokens. Grants access to all your projects for migrations, edge functions, and database management.',
+      },
+    ],
+    deliveryMethod: 'supabase login --token *** --no-browser',
+    docsUrl: 'https://supabase.com/dashboard/account/tokens',
+  },
+  {
+    id: 'notion',
+    label: 'Notion',
+    category: 'pm',
+    description: 'API Token for Notion integration — enables the agent to read/write pages, databases, and blocks',
+    authType: 'static-token',
+    fields: [
+      {
+        key: 'token',
+        label: 'API Token (Internal Integration)',
+        placeholder: 'ntn_... or secret_...',
+        type: 'password',
+        hint: 'Create at notion.so/my-integrations. Grant Read + Insert + Update capabilities.',
+      },
+    ],
+    deliveryMethod: 'writes ~/.config/notion/config.json',
+    docsUrl: 'https://www.notion.so/my-integrations',
+  },
+];
+
+export function getProvider(id: string): CredentialProviderDef | undefined {
+  return CREDENTIAL_PROVIDERS.find((p) => p.id === id);
+}

package/lib/credentials/vault.ts

@@ -0,0 +1,195 @@
+import Database from 'better-sqlite3';
+import { openCredentialsDb as openDb } from './db';
+import { getProvider } from './providers';
+
+export interface CredentialProfile {
+  id: string;
+  providerId: string;
+  label: string;
+  status: 'active' | 'error';
+  secretMasked: string | null;
+  createdAt: number;
+  updatedAt: number;
+  lastSyncedAt: number | null;
+}
+
+export type CredentialSecret = Record<string, string>;
+
+function mask(value: string): string {
+  if (!value) return '••••••••';
+  if (value.length <= 8) return '•'.repeat(value.length);
+  return value.slice(0, 4) + '••••' + value.slice(-4);
+}
+
+/**
+ * Find the first password field in a provider to use for masked display.
+ * Falls back to the first field if no password field exists.
+ */
+function firstPasswordField(provider: { fields: { key: string; type: string }[] }): string | undefined {
+  const pwField = provider.fields.find((f) => f.type === 'password');
+  return pwField?.key ?? provider.fields[0]?.key;
+}
+
+export function appendAudit(db: Database.Database, action: string, profileId: string, result: string): void {
+  try {
+    db.prepare(
+      'INSERT INTO credential_audit_log (ts, actor, action, profile_id, result) VALUES (?, ?, ?, ?, ?)',
+    ).run(Date.now(), 'system', action, profileId, result);
+  } catch {
+    // Audit failures are non-fatal
+  }
+}
+
+export function listProfiles(): CredentialProfile[] {
+  const db = openDb(true);
+  try {
+    return db.prepare(
+      `SELECT id, provider_id AS providerId, label, status,
+              secret_masked AS secretMasked, created_at AS createdAt,
+              updated_at AS updatedAt, last_synced_at AS lastSyncedAt
+       FROM credential_profiles ORDER BY created_at DESC`,
+    ).all() as CredentialProfile[];
+  } finally {
+    db.close();
+  }
+}
+
+export function getProfile(id: string): CredentialProfile | null {
+  const db = openDb(true);
+  try {
+    return db.prepare(
+      `SELECT id, provider_id AS providerId, label, status,
+              secret_masked AS secretMasked, created_at AS createdAt,
+              updated_at AS updatedAt, last_synced_at AS lastSyncedAt
+       FROM credential_profiles WHERE id = ?`,
+    ).get(id) as CredentialProfile | null;
+  } finally {
+    db.close();
+  }
+}
+
+export function getSecret(profileId: string): CredentialSecret {
+  const db = openDb(true);
+  try {
+    const row = db.prepare(
+      'SELECT payload FROM credential_secrets WHERE profile_id = ?',
+    ).get(profileId) as { payload: string } | null;
+    if (!row) return {};
+    return JSON.parse(row.payload) as CredentialSecret;
+  } finally {
+    db.close();
+  }
+}
+
+export function createProfile(
+  providerId: string,
+  label: string,
+  secret: CredentialSecret,
+): string {
+  const provider = getProvider(providerId);
+  if (!provider) throw new Error(`Unknown provider: ${providerId}`);
+
+  const id = `cred_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  const now = Date.now();
+  const maskKey = firstPasswordField(provider);
+  const secretMasked = mask(maskKey ? (secret[maskKey] ?? '') : '');
+  const payload = JSON.stringify(secret);
+
+  const db = openDb(false);
+  try {
+    db.prepare(
+      `INSERT INTO credential_profiles
+         (id, provider_id, label, status, secret_masked, created_at, updated_at, last_synced_at)
+       VALUES (?, ?, ?, 'active', ?, ?, ?, NULL)`,
+    ).run(id, providerId, label, secretMasked, now, now);
+
+    db.prepare(
+      'INSERT INTO credential_secrets (profile_id, payload) VALUES (?, ?)',
+    ).run(id, payload);
+
+    appendAudit(db, 'create', id, 'ok');
+    return id;
+  } finally {
+    db.close();
+  }
+}
+
+export function updateProfile(
+  id: string,
+  label: string,
+  secret: CredentialSecret,
+): void {
+  const profile = getProfile(id);
+  if (!profile) throw new Error(`Profile not found: ${id}`);
+
+  const now = Date.now();
+  const db = openDb(false);
+  try {
+    // Only update secret fields if at least one field has a non-empty value
+    const hasValues = Object.values(secret).some((v) => v && v.trim().length > 0);
+
+    if (hasValues) {
+      const provider = getProvider(profile.providerId);
+      if (!provider) throw new Error(`Unknown provider: ${profile.providerId}`);
+
+      const maskKey = firstPasswordField(provider);
+      const secretMasked = mask(maskKey ? (secret[maskKey] ?? '') : '');
+      const payload = JSON.stringify(secret);
+
+      db.prepare(
+        'UPDATE credential_profiles SET label = ?, secret_masked = ?, updated_at = ? WHERE id = ?',
+      ).run(label, secretMasked, now, id);
+
+      db.prepare(
+        'UPDATE credential_secrets SET payload = ? WHERE profile_id = ?',
+      ).run(payload, id);
+    } else {
+      // Only update label, keep existing secret and secret_masked
+      db.prepare(
+        'UPDATE credential_profiles SET label = ?, updated_at = ? WHERE id = ?',
+      ).run(label, now, id);
+    }
+
+    appendAudit(db, 'update', id, 'ok');
+  } finally {
+    db.close();
+  }
+}
+
+export function deleteProfile(id: string): void {
+  const db = openDb(false);
+  try {
+    db.prepare('DELETE FROM credential_secrets WHERE profile_id = ?').run(id);
+    db.prepare('DELETE FROM credential_profiles WHERE id = ?').run(id);
+    appendAudit(db, 'delete', id, 'ok');
+  } finally {
+    db.close();
+  }
+}
+
+export function markSynced(id: string, status: 'active' | 'error'): void {
+  const db = openDb(false);
+  try {
+    db.prepare(
+      'UPDATE credential_profiles SET last_synced_at = ?, status = ?, updated_at = ? WHERE id = ?',
+    ).run(Date.now(), status, Date.now(), id);
+    appendAudit(db, 'sync', id, status);
+  } finally {
+    db.close();
+  }
+}
+
+/**
+ * Reveal a secret payload and log the access in the audit trail.
+ * Use sparingly — every call is logged.
+ */
+export function revealSecret(profileId: string): CredentialSecret {
+  const db = openDb(true);
+  try {
+    const secret = getSecret(profileId);
+    appendAudit(db, 'reveal', profileId, 'ok');
+    return secret;
+  } finally {
+    db.close();
+  }
+}

package/lib/db-bootstrap.d.ts

@@ -0,0 +1,3 @@
+declare module '*/db-bootstrap.mjs' {
+  export function initializeRev4aDb(dbPath: string): void;
+}

package/lib/db-bootstrap.mjs

@@ -0,0 +1,144 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import Database from 'better-sqlite3';
+
+const SESSION_COLUMNS = [
+  ['parent_id', 'TEXT'],
+  ['label', 'TEXT'],
+  ['model', 'TEXT'],
+  ['tokens_in', 'INTEGER DEFAULT 0'],
+  ['tokens_out', 'INTEGER DEFAULT 0'],
+  ['cost_usd', 'REAL DEFAULT 0'],
+  ['status', "TEXT DEFAULT 'idle'"],
+  ['task_preview', 'TEXT'],
+  ['started_at', 'INTEGER'],
+  ['ended_at', 'INTEGER'],
+  ['updated_at', 'INTEGER'],
+  ['trello_card_url', 'TEXT'],
+];
+
+const LINEAGE_COLUMNS = [
+  ['agent_name', 'TEXT'],
+  ['label', 'TEXT'],
+];
+
+function ensureParentDir(dbPath) {
+  const dir = path.dirname(dbPath);
+  if (!dir || dir === '.') return;
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function addMissingColumns(db, tableName, columns) {
+  const existing = new Set(db.prepare(`PRAGMA table_info(${tableName})`).all().map((col) => col.name));
+  for (const [name, type] of columns) {
+    if (!existing.has(name)) {
+      db.exec(`ALTER TABLE ${tableName} ADD COLUMN ${name} ${type}`);
+    }
+  }
+}
+
+export function initializeRev4aDb(dbPath) {
+  ensureParentDir(dbPath);
+  const db = new Database(dbPath);
+  db.pragma('journal_mode = WAL');
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS sessions (
+      session_id TEXT PRIMARY KEY,
+      parent_id TEXT,
+      label TEXT,
+      model TEXT,
+      tokens_in INTEGER DEFAULT 0,
+      tokens_out INTEGER DEFAULT 0,
+      cost_usd REAL DEFAULT 0,
+      status TEXT DEFAULT 'idle',
+      task_preview TEXT,
+      started_at INTEGER,
+      ended_at INTEGER,
+      updated_at INTEGER,
+      trello_card_url TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts INTEGER NOT NULL,
+      session_id TEXT NOT NULL,
+      type TEXT NOT NULL,
+      data TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS tool_calls (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts INTEGER NOT NULL,
+      session_id TEXT NOT NULL,
+      tool_name TEXT,
+      status TEXT,
+      duration_ms INTEGER,
+      data TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS lineage (
+      child_id TEXT PRIMARY KEY,
+      parent_id TEXT NOT NULL,
+      declared_at INTEGER NOT NULL,
+      agent_name TEXT,
+      label TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS cost_override (
+      month TEXT PRIMARY KEY,
+      amount REAL,
+      note TEXT,
+      updated_at INTEGER
+    );
+
+  CREATE TABLE IF NOT EXISTS system_metrics (
+      ts INTEGER PRIMARY KEY,
+      cpu_percent REAL,
+      ram_used_mb INTEGER,
+      ram_total_mb INTEGER,
+      disk_used_gb REAL,
+      disk_total_gb REAL,
+      load_avg_1m REAL
+    );
+
+    CREATE TABLE IF NOT EXISTS alert_state (
+      alert_key TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      state TEXT NOT NULL,
+      last_sent_at INTEGER,
+      last_resolved_at INTEGER,
+      updated_at INTEGER NOT NULL,
+      payload TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_events_session ON events(session_id, ts);
+    CREATE INDEX IF NOT EXISTS idx_sessions_updated ON sessions(updated_at);
+    CREATE INDEX IF NOT EXISTS idx_sessions_started ON sessions(started_at);
+    CREATE INDEX IF NOT EXISTS idx_metrics_ts ON system_metrics(ts);
+    CREATE INDEX IF NOT EXISTS idx_tool_calls_session ON tool_calls(session_id, ts);
+    CREATE INDEX IF NOT EXISTS idx_alert_state_updated ON alert_state(updated_at);
+  `);
+
+  addMissingColumns(db, 'sessions', SESSION_COLUMNS);
+  addMissingColumns(db, 'lineage', LINEAGE_COLUMNS);
+
+  // Chat messages table
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS chat_messages (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts INTEGER NOT NULL,
+      user_id TEXT NOT NULL,
+      role TEXT NOT NULL,
+      content TEXT NOT NULL,
+      openclaw_session_id TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_chat_user ON chat_messages(user_id, ts);
+  `);
+
+  addMissingColumns(db, 'chat_messages', [
+    ['model', 'TEXT'],
+  ]);
+
+
+  db.close();
+}

package/lib/db.ts

@@ -0,0 +1,25 @@
+// Shared DB helpers for API routes
+import Database from 'better-sqlite3';
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { initializeRev4aDb } from './db-bootstrap.mjs';
+import { DB_FILE } from './rev4a-paths';
+
+export const DB_PATH = process.env.REV4A_DB || DB_FILE;
+export const TOKEN = process.env.REV4A_TOKEN ?? '';
+
+export function requireAuth(request: NextRequest): NextResponse | null {
+  const token = new URL(request.url).searchParams.get('token');
+  const auth = request.headers.get('authorization');
+  const ok = token === TOKEN || auth === `Bearer ${TOKEN}`;
+  return ok ? null : NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+}
+
+export function ensureDbReady(): void {
+  initializeRev4aDb(DB_PATH);
+}
+
+export function openDb(readonly = true): Database.Database {
+  ensureDbReady();
+  return new Database(DB_PATH, { readonly });
+}

package/lib/docker-utils.ts

@@ -0,0 +1,60 @@
+import { networkInterfaces } from 'os';
+
+/**
+ * Detect the host's best public-facing IPv4 address for agent URLs.
+ *
+ * Priority:
+ *   1. External IP detection via icanhazip.com (works from Docker containers)
+ *   2. Hostname resolution (filters out 172.x Docker internal IPs)
+ *   3. First non-internal IPv4 network interface
+ *   4. 'localhost' fallback
+ */
+export function detectPublicHost(): string {
+  // 1. External detection (works from inside Docker containers)
+  try {
+    const { execSync } = require('child_process');
+    const ip = execSync(
+      'curl -fs --max-time 3 icanhazip.com 2>/dev/null || curl -fs --max-time 3 ifconfig.me 2>/dev/null',
+      { encoding: 'utf-8', timeout: 5000 },
+    ).trim();
+    if (ip && /^\d+\.\d+\.\d+\.\d+$/.test(ip) && !ip.startsWith('172.')) {
+      return ip;
+    }
+  } catch { /* ignore */ }
+
+  // 2. Hostname (often gives public IP on VPS, but Docker internal 172.x is filtered)
+  try {
+    const { execSync } = require('child_process');
+    const hostname = execSync('hostname -I 2>/dev/null || hostname 2>/dev/null', {
+      encoding: 'utf-8', timeout: 2000,
+    }).trim().split(/\s+/)[0];
+    if (hostname && hostname !== '127.0.0.1' && hostname !== '::1' && !hostname.startsWith('172.')) {
+      return hostname;
+    }
+  } catch { /* ignore */ }
+
+  // 3. Network interfaces (bare metal)
+  try {
+    const ifaces = networkInterfaces();
+    for (const [, addrs] of Object.entries(ifaces)) {
+      if (!addrs) continue;
+      for (const addr of addrs) {
+        if (addr.family === 'IPv4' && !addr.internal) {
+          return addr.address;
+        }
+      }
+    }
+  } catch { /* fall through */ }
+
+  // 4. Fallback
+  return 'localhost';
+}
+
+/**
+ * Build the provider gateway base URL used to sync model config into agent
+ * containers. Agents reach Rev4a through the Docker host gateway
+ * (host.docker.internal), injected at container creation via --add-host.
+ */
+export function detectProviderGatewayUrl(): string {
+  return 'http://host.docker.internal:3740/api/provider/v1';
+}