@flame0510/project-aether 1.1.9

package/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/next.config.mjs

@@ -0,0 +1,7 @@
+const nextConfig = {
+  reactStrictMode: true,
+  serverExternalPackages: ['better-sqlite3'],
+  allowedDevOrigins: ['187.77.156.41', '127.0.0.1', 'localhost', 'rev4a.srv1490011.hstgr.cloud'],
+};
+
+export default nextConfig;

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@flame0510/project-aether",
+  "version": "1.1.9",
+  "description": "Rev4a \u2014 Revolution for Agents. OpenClaw agent fleet orchestrator.",
+  "keywords": [
+    "openclaw",
+    "rev4a",
+    "dashboard",
+    "monitoring",
+    "ai",
+    "agents"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Flame0510/rev4a.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Flame0510/rev4a/issues"
+  },
+  "homepage": "https://github.com/Flame0510/rev4a#readme",
+  "bin": {
+    "rev4a": "bin/rev4a.js"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "bin/",
+    "app/",
+    "lib/",
+    "public/",
+    "scripts/",
+    "docs/",
+    "agent-templates/",
+    "rev4a-rules/",
+    "daemon.js",
+    "lineage.js",
+    "terminal-ws-server.js",
+    "package.json",
+    "next.config.mjs",
+    "tsconfig.json",
+    "next-env.d.ts",
+    "*.css",
+    "*.png",
+    "model-pricing.json",
+    "models.config.json"
+  ],
+  "scripts": {
+    "dev": "next dev -p 3720",
+    "build": "next build",
+    "start": "rev4a serve",
+    "start:all": "rev4a serve",
+    "smoke:db-bootstrap": "node scripts/smoke-db-bootstrap.mjs",
+    "postinstall": "node bin/postinstall.js"
+  },
+  "dependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "better-sqlite3": "^13.0.2",
+    "cron-parser": "^5.5.0",
+    "d3": "^7.9.0",
+    "highlight.js": "^11.11.1",
+    "html-to-image": "^1.11.13",
+    "html2canvas": "^1.4.1",
+    "jose": "^6.2.3",
+    "marked": "^18.0.5",
+    "next": "^16.0.1",
+    "node-pty": "^1.1.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "ws": "^8.21.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.61.1",
+    "@types/d3": "^7.4.3",
+    "@types/node": "25.9.5",
+    "@types/react": "19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "@types/ws": "^8.18.1",
+    "typescript": "6.0.3"
+  }
+}

package/public/favicon.svg

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg
+ xmlns="http://www.w3.org/2000/svg"
+ viewBox="0 0 1254 1254"
+ role="img"
+ aria-labelledby="title desc"
+ shape-rendering="geometricPrecision"
+>
+ <title id="title">REV4A glyph</title>
+ <desc id="desc">The fused geometric 4A monogram used by REV4A.</desc>
+
+ <defs>
+ <linearGradient
+ id="rev4a-violet"
+ x1="249"
+ y1="250"
+ x2="1012"
+ y2="1005"
+ gradientUnits="userSpaceOnUse"
+ >
+ <stop offset="0" stop-color="#965FFF" />
+ <stop offset="0.52" stop-color="#925BFC" />
+ <stop offset="1" stop-color="#8E57FB" />
+ </linearGradient>
+ </defs>
+
+ <path
+ fill="url(#rev4a-violet)"
+ fill-rule="evenodd"
+ clip-rule="evenodd"
+ d="
+ M 1012 1005
+ H 882
+ L 857 961
+ H 733
+ L 732 1005
+ H 613
+ V 416
+ L 418 662
+ L 578 663
+ L 579 803
+ H 249
+ V 664
+ L 416 458
+ L 575 255
+ L 579 250
+ H 736
+ V 541
+ L 1012 1005
+ Z
+
+ M 729 746
+ V 875
+ H 807
+ Z
+ "
+ />
+</svg>

package/public/manifest.json

@@ -0,0 +1,38 @@
+{
+  "id": "/",
+  "name": "REV4A - Agency Monitor",
+  "short_name": "REV4A",
+  "description": "Mobile-ready monitoring dashboard for OpenClaw workspaces.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "orientation": "portrait-primary",
+  "background_color": "#0A0A0B",
+  "theme_color": "#925BFC",
+  "icons": [
+    {
+      "src": "/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icon-192-maskable.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/icon-512-maskable.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ]
+}

package/public/rev4a-logo.svg

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg
+ xmlns="http://www.w3.org/2000/svg"
+ viewBox="0 0 1254 1254"
+ role="img"
+ aria-labelledby="title desc"
+ shape-rendering="geometricPrecision"
+>
+ <title id="title">REV4A glyph</title>
+ <desc id="desc">The fused geometric 4A monogram used by REV4A.</desc>
+
+ <defs>
+ <linearGradient
+ id="rev4a-violet"
+ x1="249"
+ y1="250"
+ x2="1012"
+ y2="1005"
+ gradientUnits="userSpaceOnUse"
+ >
+ <stop offset="0" stop-color="#965FFF" />
+ <stop offset="0.52" stop-color="#925BFC" />
+ <stop offset="1" stop-color="#8E57FB" />
+ </linearGradient>
+ </defs>
+
+ <path
+ fill="url(#rev4a-violet)"
+ fill-rule="evenodd"
+ clip-rule="evenodd"
+ d="
+ M 1012 1005
+ H 882
+ L 857 961
+ H 733
+ L 732 1005
+ H 613
+ V 416
+ L 418 662
+ L 578 663
+ L 579 803
+ H 249
+ V 664
+ L 416 458
+ L 575 255
+ L 579 250
+ H 736
+ V 541
+ L 1012 1005
+ Z
+
+ M 729 746
+ V 875
+ H 807
+ Z
+ "
+ />
+</svg>

package/rev4a-rules/AGENTS.md

@@ -0,0 +1,37 @@
+# Rev4a System Rules
+
+You are an agent managed by **Rev4a**, the OpenClaw infrastructure dashboard.
+These rules are injected automatically into every session. They are immutable —
+mounted read-only by the container runtime.
+
+## Immutable Boundaries
+
+- **Your workspace is `/root/.openclaw/workspace/`.** This exact path is managed
+  by Rev4a. Do **NOT** rename, move, delete, or symlink it.
+  Create subdirectories inside it if you need project structure
+  (e.g. `workspace/my-project/`).
+- **This file (`.rev4a/AGENTS.md`) is read-only system configuration.**
+  Do not attempt to modify, delete, or move it. The filesystem will reject writes.
+- **Your config (`openclaw.json`), channels, model selection, and provider keys**
+  are managed through the Rev4a dashboard — not by editing config files directly.
+  Rev4a may apply configuration changes at any time.
+- **Rev4a may restart your gateway** for updates or configuration changes.
+  This is normal operation and does not indicate a problem.
+
+## What Rev4a Handles
+
+- Provider API keys and model catalogue
+- Channel connections (Telegram, etc.)
+- Container lifecycle (create, restart, recreate, backup, delete)
+- Workspace file management
+- Updates and migrations
+
+## Rev4a-Aware Behavior
+
+- If you encounter an issue with your configuration, channels, or workspace
+  path, report it to the user — do not attempt to fix it by modifying system
+  files or directories yourself.
+- You may read any file in your workspace. You may write files **inside** the
+  workspace. You may not rename or restructure the workspace root itself.
+- When in doubt about system boundaries, ask the user or check the Rev4a
+  dashboard rather than experimenting with container internals.

package/scripts/add-auth.cjs

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * add-auth-to-routes.cjs
+ *
+ * Injects `requireAuthJWT` into every unprotected API route handler.
+ * Strategy:
+ *  1. Insert import line after the last existing import
+ *  2. Add auth check as first statement in every exported HTTP handler
+ *  3. Handle _req/_request/req → rename to request (standardize)
+ *  4. Handle handlers with no request param (add one)
+ *  5. Handle .ts and .js files
+ *
+ * Whitelist (public routes, no auth):
+ *   app/api/auth/*, app/api/setup/*, app/api/wizard/*, app/api/provider/v1/*
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const API_DIR = path.join(ROOT, 'app', 'api');
+
+const WHITELIST = [
+  'app/api/auth/',
+  'app/api/setup/',
+  'app/api/wizard/',
+  'app/api/provider/v1/',
+];
+
+const ALREADY_PROTECTED = new Set([
+  'app/api/cost-override/route.ts',
+  'app/api/skills/promote/route.js',
+  'app/api/skills/save/route.js',
+  'app/api/skills/delete/route.js',
+]);
+
+const IMPORT_LINE = `import { requireAuthJWT } from '@/lib/rev4a-auth';`;
+
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+
+function walk(dir) {
+  const out = [];
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) out.push(...walk(p));
+    else if (e.name === 'route.ts' || e.name === 'route.js') out.push(p);
+  }
+  return out;
+}
+
+/** Check if this path is whitelisted (public) */
+function isWhitelisted(absPath) {
+  const rel = path.relative(ROOT, absPath);
+  return WHITELIST.some(w => rel.startsWith(w));
+}
+
+/** Check if this path already has auth protection */
+function isProtected(absPath) {
+  const rel = path.relative(ROOT, absPath);
+  return ALREADY_PROTECTED.has(rel);
+}
+
+/**
+ * Rewrite a single file to add requireAuthJWT to every exported handler.
+ * Returns { status, reason, modified }.
+ */
+function processFile(filePath) {
+  let src = fs.readFileSync(filePath, 'utf-8');
+  const isJs = filePath.endsWith('.js');
+
+  if (src.includes('requireAuthJWT')) {
+    return { status: 'skip', reason: 'already has requireAuthJWT' };
+  }
+
+  // Check if any HTTP handler exists
+  const hasMethod = METHODS.some(m => new RegExp(
+    `export\\s+(async\\s+)?function\\s+${m}\\s*\\(`
+  ).test(src));
+  if (!hasMethod) {
+    return { status: 'skip', reason: 'no HTTP handler' };
+  }
+
+  let modified = false;
+
+  // ── Step 1: Add import ────────────────────────────────────────
+  if (!src.includes(IMPORT_LINE)) {
+    const lines = src.split('\n');
+    let lastImport = -1;
+    for (let i = 0; i < lines.length; i++) {
+      const t = lines[i].trim();
+      if (t.startsWith('import ') || t === "'use strict';" || t === '"use strict";') {
+        lastImport = i;
+      }
+    }
+    if (lastImport >= 0) {
+      lines.splice(lastImport + 1, 0, IMPORT_LINE);
+    }
+    // else: no imports? prepend after block comment if any
+    src = lines.join('\n');
+    modified = true;
+  }
+
+  // ── Step 2: Standardize handler signatures ───────────────────
+  // Replace _req, _request, req (not "request") with "request" as first param
+  for (const m of METHODS) {
+    // "_req: Type" or "_req)"  →  "request: Type" / "request)"
+    src = src.replace(
+      new RegExp(`(function\\s+${m}\\s*\\()\\s*_req\\b`, 'g'),
+      '$1request'
+    );
+    // "_request: Type" or "_request)"  →  "request: Type" / "request)"
+    src = src.replace(
+      new RegExp(`(function\\s+${m}\\s*\\()\\s*_request\\b`, 'g'),
+      '$1request'
+    );
+    // "req:" (standalone, not part of "request:") → "request:"
+    src = src.replace(
+      new RegExp(`(function\\s+${m}\\s*\\()\\s*req\\b(?!uest)`, 'g'),
+      '$1request'
+    );
+    // "req)" (standalone) → "request)"
+    // (handled by the line below with the function body regex)
+  }
+
+  // Also fix body references: req.url → request.url, req.json → request.json
+  // Only in protected files that had _req or req renamed
+  src = src.replace(/\breq\.url\b/g, 'request.url');
+  src = src.replace(/\breq\.json\b/g, 'request.json');
+
+  // ── Step 3: Ensure every handler has "request" param ─────────
+  for (const m of METHODS) {
+    // Match: export async function METHOD() {  (no params)
+    const noParams = new RegExp(
+      `(export\\s+(async\\s+)?function\\s+${m})\\s*\\(\\s*\\)`,
+      'g'
+    );
+    src = src.replace(noParams, `$1(_req: NextRequest) { const request = _req;`);
+    modified = modified || noParams.test(src);
+  }
+
+  // ── Step 4: Inject auth check ─────────────────────────────────
+  for (const m of METHODS) {
+    // Match handler signature up to the opening brace + newline
+    // Pattern: export async function METHOD(params...) { \n
+    const pat = new RegExp(
+      `(export\\s+(async\\s+)?function\\s+${m}\\s*\\([^)]*\\)[^\{]*\\{)\\n`,
+      'g'
+    );
+    const auth = isJs
+      ? '  const denied = await requireAuthJWT(request); if (denied) return denied;'
+      : '  const denied = await requireAuthJWT(request); if (denied) return denied as any;';
+    src = src.replace(pat, `$1\n${auth}\n`);
+  }
+
+  modified = true; // We injected auth
+  fs.writeFileSync(filePath, src, 'utf-8');
+  return { status: 'ok', reason: 'injected', modified };
+}
+
+// ── Main ────────────────────────────────────────────────────────
+console.log('Step 1: Discover routes\n');
+const all = walk(API_DIR);
+console.log(`Total: ${all.length}\n`);
+
+const targets = [];
+for (const p of all) {
+  const rel = path.relative(ROOT, p);
+  if (isWhitelisted(p)) { console.log(`  [whitelist] ${rel}`); continue; }
+  if (isProtected(p))   { console.log(`  [protected] ${rel}`); continue; }
+  targets.push(p);
+}
+
+console.log(`\nStep 2: Inject auth into ${targets.length} routes\n`);
+
+let ok = 0, skip = 0;
+for (const p of targets) {
+  const rel = path.relative(ROOT, p);
+  const r = processFile(p);
+  if (r.status === 'ok') { console.log(`  ✓ ${rel}`); ok++; }
+  else { console.log(`  - ${rel} (${r.reason})`); skip++; }
+}
+
+console.log(`\nDone: ${ok} modified, ${skip} skipped`);

package/scripts/backup.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# backup.sh — Backup Rev4a data to a tar.gz archive
+#
+# Usage:
+#   sudo bash scripts/backup.sh                     # backup to ./backups/
+#   sudo bash scripts/backup.sh /path/to/backups    # custom directory
+#
+# What it backs up:
+#   - data/*.db (events, credentials, lineage)
+#   - data/provider-keys.json
+#   - data/agents-token.json
+#   - models.config.json
+#   - .env (credentials and configuration)
+#
+# Does NOT back up:
+#   - node_modules (can be reinstalled)
+#   - .next build cache (can be rebuilt)
+set -euo pipefail
+
+# Resolve script directory
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REV4A_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+BACKUP_DIR="${1:-${REV4A_ROOT}/backups}"
+
+mkdir -p "$BACKUP_DIR"
+
+TS=$(date -u +%Y%m%d-%H%M%S)
+ARCHIVE="${BACKUP_DIR}/rev4a-backup-${TS}.tar.gz"
+
+echo "Backing up Rev4a data..."
+echo "  Source: ${REV4A_ROOT}"
+echo "  Target: ${ARCHIVE}"
+
+cd "$REV4A_ROOT"
+
+# Restrict permissions during archive creation
+umask 077
+
+# Create tar with only the files we care about
+tar -czf "$ARCHIVE" \
+  --exclude='node_modules' \
+  --exclude='.next' \
+  --exclude='.git' \
+  --exclude='backups' \
+  data/*.db \
+  data/*.db-shm \
+  data/*.db-wal \
+  data/provider-keys.json 2>/dev/null || true \
+  data/agents-token.json 2>/dev/null || true \
+  models.config.json 2>/dev/null || true \
+  .env 2>/dev/null || true
+
+echo ""
+echo "=============================================="
+echo "  Backup complete!"
+echo "=============================================="
+echo ""
+echo "  Archive: ${ARCHIVE}"
+echo "  Size:    $(du -h "$ARCHIVE" | cut -f1)"
+echo ""
+chmod 600 "$ARCHIVE"
+echo "  WARNING: This archive contains plain-text credentials (.env)."
+echo "  Store it securely (encrypted at rest recommended)."
+echo ""
+echo "  To restore: sudo bash scripts/restore.sh ${ARCHIVE}"
+echo "=============================================="