@frumu/tandem-panel 0.3.27

package/.env.example

@@ -0,0 +1,42 @@
+# Control panel bind port
+TANDEM_CONTROL_PANEL_PORT=39732
+
+# Tip: run `tandem-control-panel --init` to auto-generate this file and token.
+
+# Full engine URL (preferred)
+TANDEM_ENGINE_URL=http://127.0.0.1:39731
+
+# Optional engine host/port fallback (used when TANDEM_ENGINE_URL is not set)
+TANDEM_ENGINE_HOST=127.0.0.1
+TANDEM_ENGINE_PORT=39731
+
+# Auto-start local engine if not running (1=yes, 0=no)
+TANDEM_CONTROL_PANEL_AUTO_START_ENGINE=1
+
+# Engine API token used when control panel auto-starts a local engine.
+# If unset, the panel generates one at startup and prints it in logs.
+TANDEM_CONTROL_PANEL_ENGINE_TOKEN=tk_change_me
+
+# Disable per-run guard budgets by default (1=yes, 0=no)
+TANDEM_DISABLE_TOOL_GUARD_BUDGETS=1
+TANDEM_TOOL_ROUTER_ENABLED=0
+TANDEM_PROMPT_CONTEXT_HOOK_TIMEOUT_MS=5000
+TANDEM_PROVIDER_STREAM_CONNECT_TIMEOUT_MS=30000
+TANDEM_PROVIDER_STREAM_IDLE_TIMEOUT_MS=90000
+TANDEM_PERMISSION_WAIT_TIMEOUT_MS=15000
+TANDEM_TOOL_EXEC_TIMEOUT_MS=45000
+TANDEM_BASH_TIMEOUT_MS=30000
+
+# Optional caps when guard budgets are enabled
+# TANDEM_TOOL_BUDGET_DEFAULT=10
+# TANDEM_TOOL_BUDGET_BATCH=10
+# TANDEM_TOOL_BUDGET_WEBSEARCH=8
+# TANDEM_TOOL_BUDGET_READ=8
+# TANDEM_TOOL_BUDGET_SEARCH=6
+# TANDEM_TOOL_BUDGET_GLOB=4
+
+# Back-compat alias also respected for auto-started engines.
+# TANDEM_API_TOKEN=tk_change_me
+
+# Session TTL in minutes
+TANDEM_CONTROL_PANEL_SESSION_TTL_MINUTES=1440

package/README.md

@@ -0,0 +1,131 @@
+# Tandem Control Panel
+
+Full web control center for Tandem Engine (non-desktop entry point).
+
+## Install
+
+```bash
+npm i -g @frumu/tandem-panel
+```
+
+## Run
+
+```bash
+tandem-control-panel
+```
+
+Alias also supported:
+
+```bash
+tandem-setup
+```
+
+Bootstrap env/token first (recommended):
+
+```bash
+tandem-control-panel --init
+```
+
+Or:
+
+```bash
+tandem-control-panel-init
+```
+
+Install Linux systemd services (engine + panel):
+
+```bash
+sudo tandem-control-panel --install-services
+```
+
+Options:
+
+- `--service-mode=both|engine|panel` (default `both`)
+- `--service-user=<linux-user>` (default: `SUDO_USER`/current user)
+
+## Features
+
+- Token-gated web portal
+- Dashboard + health overview
+- Chat + session management
+- Routines/automations
+- Channels (Telegram/Discord/Slack)
+- MCP server management
+- Node-based swarm orchestration + live flow visualization
+- Memory browsing/search/delete
+- Agent teams + mission approvals
+- Global live event feed
+- Provider settings
+
+## Environment
+
+Copy and customize if needed:
+
+```bash
+cp .env.example .env
+```
+
+Variables:
+
+- `TANDEM_CONTROL_PANEL_PORT` (default `39732`)
+- `TANDEM_ENGINE_URL` (default `http://127.0.0.1:39731`)
+- `TANDEM_ENGINE_HOST` + `TANDEM_ENGINE_PORT` fallback
+- `TANDEM_CONTROL_PANEL_AUTO_START_ENGINE` (`1`/`0`)
+- `TANDEM_CONTROL_PANEL_ENGINE_TOKEN` (token injected when panel auto-starts engine)
+- `TANDEM_API_TOKEN` (backward-compatible alias for engine token)
+- `TANDEM_CONTROL_PANEL_SESSION_TTL_MINUTES` (default `1440`)
+- `TANDEM_DISABLE_TOOL_GUARD_BUDGETS` (`1` disables per-run guard budgets; default in installer/service env is `1`)
+- `TANDEM_PROMPT_CONTEXT_HOOK_TIMEOUT_MS` (default `5000`)
+- `TANDEM_PROVIDER_STREAM_CONNECT_TIMEOUT_MS` (default `30000`)
+- `TANDEM_PROVIDER_STREAM_IDLE_TIMEOUT_MS` (default `90000`)
+- `TANDEM_BASH_TIMEOUT_MS` (default `30000`)
+- `TANDEM_TOOL_BUDGET_DEFAULT`, `TANDEM_TOOL_BUDGET_BATCH`, `TANDEM_TOOL_BUDGET_WEBSEARCH`,
+  `TANDEM_TOOL_BUDGET_READ`, `TANDEM_TOOL_BUDGET_SEARCH`, `TANDEM_TOOL_BUDGET_GLOB` (used when guards are enabled)
+
+## Token Behavior
+
+- If the panel connects to an already-running engine, use that engine's API token to sign in.
+- If the panel auto-starts an engine, it now always starts with a known token:
+  - `TANDEM_CONTROL_PANEL_ENGINE_TOKEN` (preferred), or
+  - `TANDEM_API_TOKEN` (alias), or
+  - auto-generated at startup (printed in panel logs).
+
+## Tool Guard Budgets
+
+Default installs now set:
+
+```bash
+TANDEM_DISABLE_TOOL_GUARD_BUDGETS=1
+```
+
+To enforce caps instead, set:
+
+```bash
+TANDEM_DISABLE_TOOL_GUARD_BUDGETS=0
+TANDEM_TOOL_BUDGET_DEFAULT=10
+TANDEM_TOOL_BUDGET_BATCH=10
+TANDEM_TOOL_BUDGET_WEBSEARCH=8
+TANDEM_TOOL_BUDGET_READ=8
+TANDEM_TOOL_BUDGET_SEARCH=6
+TANDEM_TOOL_BUDGET_GLOB=4
+```
+
+Notes:
+
+- Unknown tools use `TANDEM_TOOL_BUDGET_DEFAULT`.
+- `0|none|unlimited|infinite|inf` for a budget key means no cap for that key.
+
+## Setup Flow
+
+1. Run `tandem-control-panel --init` to create/update `.env` and generate a token if missing.
+2. Run `tandem-control-panel`.
+3. Sign in with the printed `TANDEM_CONTROL_PANEL_ENGINE_TOKEN`.
+
+## Development
+
+```bash
+cd packages/tandem-control-panel
+npm install
+npm run dev
+npm run build
+```

package/bin/init-env.js

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { resolve, join } from "path";
+import { randomBytes } from "crypto";
+
+function parseEnv(content) {
+  const out = {};
+  for (const rawLine of String(content || "").split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const idx = line.indexOf("=");
+    if (idx <= 0) continue;
+    const key = line.slice(0, idx).trim();
+    let value = line.slice(idx + 1).trim();
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+function serializeEnv(entries) {
+  return `${entries.map(([k, v]) => `${k}=${v}`).join("\n")}\n`;
+}
+
+function ensureEnv({ cwd = process.cwd(), overwrite = false } = {}) {
+  const envPath = resolve(cwd, ".env");
+  const existed = existsSync(envPath);
+  const examplePath = resolve(cwd, ".env.example");
+  const localExamplePath = resolve(join(process.cwd(), "packages", "tandem-control-panel", ".env.example"));
+
+  const sourcePath = existsSync(examplePath) ? examplePath : localExamplePath;
+  const defaults = existsSync(sourcePath)
+    ? parseEnv(readFileSync(sourcePath, "utf8"))
+    : {
+        TANDEM_CONTROL_PANEL_PORT: "39732",
+        TANDEM_ENGINE_URL: "http://127.0.0.1:39731",
+        TANDEM_CONTROL_PANEL_AUTO_START_ENGINE: "1",
+      };
+
+  const current = existsSync(envPath) ? parseEnv(readFileSync(envPath, "utf8")) : {};
+  const merged = { ...defaults, ...current };
+
+  if (overwrite || !merged.TANDEM_CONTROL_PANEL_ENGINE_TOKEN || merged.TANDEM_CONTROL_PANEL_ENGINE_TOKEN === "tk_change_me") {
+    merged.TANDEM_CONTROL_PANEL_ENGINE_TOKEN = `tk_${randomBytes(16).toString("hex")}`;
+  }
+
+  const preferredOrder = [
+    "TANDEM_CONTROL_PANEL_PORT",
+    "TANDEM_ENGINE_URL",
+    "TANDEM_ENGINE_HOST",
+    "TANDEM_ENGINE_PORT",
+    "TANDEM_CONTROL_PANEL_AUTO_START_ENGINE",
+    "TANDEM_CONTROL_PANEL_ENGINE_TOKEN",
+    "TANDEM_CONTROL_PANEL_SESSION_TTL_MINUTES",
+  ];
+
+  const ordered = [];
+  for (const key of preferredOrder) {
+    if (merged[key] !== undefined) ordered.push([key, merged[key]]);
+  }
+  for (const [key, value] of Object.entries(merged)) {
+    if (!preferredOrder.includes(key)) ordered.push([key, value]);
+  }
+
+  writeFileSync(envPath, serializeEnv(ordered), "utf8");
+
+  return {
+    envPath,
+    token: merged.TANDEM_CONTROL_PANEL_ENGINE_TOKEN,
+    created: !existed,
+    engineUrl: merged.TANDEM_ENGINE_URL || `http://${merged.TANDEM_ENGINE_HOST || "127.0.0.1"}:${merged.TANDEM_ENGINE_PORT || "39731"}`,
+    panelPort: merged.TANDEM_CONTROL_PANEL_PORT || "39732",
+  };
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const overwrite = process.argv.includes("--reset-token") || process.argv.includes("--overwrite");
+  const result = ensureEnv({ overwrite });
+  console.log("[Tandem Control Panel] Environment initialized.");
+  console.log(`[Tandem Control Panel] .env:      ${result.envPath}`);
+  console.log(`[Tandem Control Panel] Engine URL: ${result.engineUrl}`);
+  console.log(`[Tandem Control Panel] Panel URL:  http://localhost:${result.panelPort}`);
+  console.log(`[Tandem Control Panel] Token:      ${result.token}`);
+}
+
+export { ensureEnv };