@harbinger-ai/harbinger 0.1.0

package/bin/postinstall.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// postinstall runs from the package dir inside node_modules.
+// The user's project root is two levels up: node_modules/thepopebot/ -> project root
+const projectRoot = path.resolve(__dirname, '..', '..', '..');
+const templatesDir = path.join(__dirname, '..', 'templates');
+
+// Skip if templates dir doesn't exist (shouldn't happen, but be safe)
+if (!fs.existsSync(templatesDir)) process.exit(0);
+
+// Skip if this doesn't look like a user project (no package.json with thepopebot dep)
+const pkgPath = path.join(projectRoot, 'package.json');
+if (!fs.existsSync(pkgPath)) process.exit(0);
+try {
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  if (!deps || !deps.thepopebot) process.exit(0);
+} catch { process.exit(0); }
+
+function walk(dir) {
+  const files = [];
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walk(fullPath));
+    } else {
+      files.push(path.relative(templatesDir, fullPath));
+    }
+  }
+  return files;
+}
+
+const changed = [];
+for (const relPath of walk(templatesDir)) {
+  const src = path.join(templatesDir, relPath);
+  const dest = path.join(projectRoot, relPath);
+  if (fs.existsSync(dest)) {
+    const srcContent = fs.readFileSync(src);
+    const destContent = fs.readFileSync(dest);
+    if (!srcContent.equals(destContent)) {
+      changed.push(relPath);
+    }
+  }
+}
+
+if (changed.length > 0) {
+  console.log('\n  thepopebot: these project files differ from the latest package templates.');
+  console.log('  This is normal if you\'ve customized them. If thepopebot was just');
+  console.log('  updated, new defaults may be available.\n');
+  for (const file of changed) {
+    console.log(`    ${file}`);
+  }
+  console.log('\n  To compare: npx thepopebot diff <file>');
+  console.log('  To restore: npx thepopebot reset <file>\n');
+}

package/config/index.js

@@ -0,0 +1,24 @@
+/**
+ * Next.js config wrapper for thepopebot.
+ * Enables instrumentation hook for cron scheduling on server start.
+ *
+ * Usage in user's next.config.mjs:
+ *   import { withThepopebot } from 'thepopebot/config';
+ *   export default withThepopebot({});
+ *
+ * @param {Object} nextConfig - User's Next.js config
+ * @returns {Object} Enhanced Next.js config
+ */
+export const withHarbinger = withThepopebot;
+
+export function withThepopebot(nextConfig = {}) {
+  return {
+    ...nextConfig,
+    distDir: process.env.NEXT_BUILD_DIR || '.next',
+    serverExternalPackages: [
+      ...(nextConfig.serverExternalPackages || []),
+      'better-sqlite3',
+      'drizzle-orm',
+    ],
+  };
+}

package/config/instrumentation.js

@@ -0,0 +1,93 @@
+/**
+ * Next.js instrumentation hook for thepopebot.
+ * This file is loaded by Next.js on server start when instrumentationHook is enabled.
+ *
+ * Users should create an instrumentation.js in their project root that imports this:
+ *
+ *   export { register } from 'thepopebot/instrumentation';
+ *
+ * Or they can re-export and add their own logic.
+ */
+
+let initialized = false;
+
+export async function register() {
+  // Only run on the server, and only once
+  if (typeof window !== 'undefined' || initialized) return;
+  initialized = true;
+
+  // Skip database init and cron scheduling during `next build` —
+  // these are runtime-only concerns that keep the event loop alive
+  // and can cause build output corruption.
+  if (process.argv.includes('build')) return;
+
+  // Load .env from project root
+  const dotenv = await import('dotenv');
+  dotenv.config();
+
+  // Set AUTH_URL from APP_URL so NextAuth redirects to the correct host (e.g., on sign-out)
+  if (process.env.APP_URL && !process.env.AUTH_URL) {
+    process.env.AUTH_URL = process.env.APP_URL;
+  }
+
+  // Validate AUTH_SECRET is set (required by Auth.js for session encryption)
+  if (!process.env.AUTH_SECRET) {
+    console.error('\n  ERROR: AUTH_SECRET is not set in your .env file.');
+    console.error('  This is required for session encryption.');
+    console.error('  Run "npm run setup" to generate it automatically, or add manually:');
+    console.error('  openssl rand -base64 32\n');
+    throw new Error('AUTH_SECRET environment variable is required');
+  }
+
+  // Initialize auth database
+  const { initDatabase } = await import('../lib/db/index.js');
+  initDatabase();
+
+  // Discover agent profiles
+  const { discoverAgents } = await import('../lib/agents.js');
+  const agents = discoverAgents();
+  if (agents.length > 0) {
+    const names = agents.map(a => a.codename || a.id).join(', ');
+    console.log(`thepopebot: ${agents.length} agent profiles loaded (${names})`);
+    console.log('thepopebot: use @AGENT_NAME in chat to route to a specific agent');
+  }
+
+  // Optionally start autonomous thinking engine
+  if (process.env.AUTONOMOUS_THINKING === 'true') {
+    const { startAutonomousEngine } = await import('../lib/ai/autonomous-engine.js');
+    startAutonomousEngine({
+      agentId: 'thepopebot',
+      agentName: 'THEPOPEBOT',
+      interval: Number(process.env.AUTONOMOUS_INTERVAL) || 60000,
+    });
+    console.log('thepopebot: autonomous thinking engine started');
+  }
+
+  // Start cron scheduler
+  const { loadCrons } = await import('../lib/cron.js');
+  loadCrons();
+
+  // Start built-in crons (version check)
+  const { startBuiltinCrons, setUpdateAvailable } = await import('../lib/cron.js');
+  startBuiltinCrons();
+
+  // Warm in-memory flag from DB (covers the window before the async cron fetch completes)
+  try {
+    const { getAvailableVersion } = await import('../lib/db/update-check.js');
+    const stored = getAvailableVersion();
+    if (stored) setUpdateAvailable(stored);
+  } catch (err) {
+    console.warn('thepopebot: update check warm-up failed:', err.message);
+  }
+
+  // Pre-warm MCP client (load external tools)
+  try {
+    const { loadMcpTools } = await import('../lib/mcp/client.js');
+    const mcpTools = await loadMcpTools();
+    if (mcpTools.length > 0) console.log(`thepopebot: ${mcpTools.length} MCP tools loaded`);
+  } catch (err) {
+    console.warn('thepopebot: MCP tools pre-warm failed:', err.message);
+  }
+
+  console.log('thepopebot initialized');
+}

package/drizzle/0000_initial.sql

@@ -0,0 +1,52 @@
+CREATE TABLE `chats` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`title` text DEFAULT 'New Chat' NOT NULL,
+	`starred` integer DEFAULT 0 NOT NULL,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `messages` (
+	`id` text PRIMARY KEY NOT NULL,
+	`chat_id` text NOT NULL,
+	`role` text NOT NULL,
+	`content` text NOT NULL,
+	`created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `notifications` (
+	`id` text PRIMARY KEY NOT NULL,
+	`notification` text NOT NULL,
+	`payload` text NOT NULL,
+	`read` integer DEFAULT 0 NOT NULL,
+	`created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `settings` (
+	`id` text PRIMARY KEY NOT NULL,
+	`type` text NOT NULL,
+	`key` text NOT NULL,
+	`value` text NOT NULL,
+	`created_by` text,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `subscriptions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`platform` text NOT NULL,
+	`channel_id` text NOT NULL,
+	`created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `users` (
+	`id` text PRIMARY KEY NOT NULL,
+	`email` text NOT NULL,
+	`password_hash` text NOT NULL,
+	`role` text DEFAULT 'admin' NOT NULL,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `users_email_unique` ON `users` (`email`);

package/drizzle/0001_bounty_and_registry.sql

@@ -0,0 +1,82 @@
+CREATE TABLE `programs` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`platform` text DEFAULT 'custom' NOT NULL,
+	`url` text,
+	`scope_url` text,
+	`min_bounty` integer,
+	`max_bounty` integer,
+	`status` text DEFAULT 'active' NOT NULL,
+	`notes` text,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `targets` (
+	`id` text PRIMARY KEY NOT NULL,
+	`program_id` text,
+	`type` text DEFAULT 'domain' NOT NULL,
+	`value` text NOT NULL,
+	`status` text DEFAULT 'in_scope' NOT NULL,
+	`technologies` text,
+	`notes` text,
+	`last_scanned_at` integer,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `findings` (
+	`id` text PRIMARY KEY NOT NULL,
+	`target_id` text,
+	`title` text NOT NULL,
+	`severity` text DEFAULT 'info' NOT NULL,
+	`type` text NOT NULL,
+	`status` text DEFAULT 'new' NOT NULL,
+	`description` text,
+	`steps_to_reproduce` text,
+	`impact` text,
+	`evidence` text,
+	`bounty_amount` integer,
+	`report_url` text,
+	`agent_id` text,
+	`tool_id` text,
+	`raw_output` text,
+	`reported_at` integer,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `tools` (
+	`id` text PRIMARY KEY NOT NULL,
+	`catalog_id` text,
+	`name` text NOT NULL,
+	`slug` text NOT NULL,
+	`category` text NOT NULL,
+	`description` text,
+	`docker_image` text,
+	`install_cmd` text,
+	`source_url` text,
+	`version` text,
+	`installed` integer DEFAULT 0 NOT NULL,
+	`enabled` integer DEFAULT 1 NOT NULL,
+	`config` text,
+	`mcp_server_id` text,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `tools_slug_unique` ON `tools` (`slug`);
+--> statement-breakpoint
+CREATE TABLE `docker_containers` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tool_id` text,
+	`container_id` text,
+	`image_name` text NOT NULL,
+	`status` text DEFAULT 'created' NOT NULL,
+	`agent_id` text,
+	`ports` text,
+	`env` text,
+	`logs` text,
+	`created_at` integer NOT NULL,
+	`stopped_at` integer
+);

package/drizzle/0002_sync_columns.sql

@@ -0,0 +1,7 @@
+ALTER TABLE `programs` ADD `sync_handle` text;
+--> statement-breakpoint
+ALTER TABLE `programs` ADD `last_synced_at` integer;
+--> statement-breakpoint
+ALTER TABLE `targets` ADD `sync_source` text;
+--> statement-breakpoint
+ALTER TABLE `targets` ADD `sync_program_handle` text;

package/drizzle/0003_graceful_bloodscream.sql

@@ -0,0 +1,86 @@
+CREATE TABLE `docker_containers` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tool_id` text,
+	`container_id` text,
+	`image_name` text NOT NULL,
+	`status` text DEFAULT 'created' NOT NULL,
+	`agent_id` text,
+	`ports` text,
+	`env` text,
+	`logs` text,
+	`created_at` integer NOT NULL,
+	`stopped_at` integer
+);
+--> statement-breakpoint
+CREATE TABLE `findings` (
+	`id` text PRIMARY KEY NOT NULL,
+	`target_id` text,
+	`title` text NOT NULL,
+	`severity` text DEFAULT 'info' NOT NULL,
+	`type` text NOT NULL,
+	`status` text DEFAULT 'new' NOT NULL,
+	`description` text,
+	`steps_to_reproduce` text,
+	`impact` text,
+	`evidence` text,
+	`bounty_amount` integer,
+	`report_url` text,
+	`agent_id` text,
+	`tool_id` text,
+	`raw_output` text,
+	`reported_at` integer,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `programs` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`platform` text DEFAULT 'custom' NOT NULL,
+	`url` text,
+	`scope_url` text,
+	`min_bounty` integer,
+	`max_bounty` integer,
+	`status` text DEFAULT 'active' NOT NULL,
+	`notes` text,
+	`sync_handle` text,
+	`last_synced_at` integer,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `targets` (
+	`id` text PRIMARY KEY NOT NULL,
+	`program_id` text,
+	`type` text DEFAULT 'domain' NOT NULL,
+	`value` text NOT NULL,
+	`status` text DEFAULT 'in_scope' NOT NULL,
+	`technologies` text,
+	`notes` text,
+	`last_scanned_at` integer,
+	`sync_source` text,
+	`sync_program_handle` text,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `tools` (
+	`id` text PRIMARY KEY NOT NULL,
+	`catalog_id` text,
+	`name` text NOT NULL,
+	`slug` text NOT NULL,
+	`category` text NOT NULL,
+	`description` text,
+	`docker_image` text,
+	`install_cmd` text,
+	`source_url` text,
+	`version` text,
+	`installed` integer DEFAULT 0 NOT NULL,
+	`enabled` integer DEFAULT 1 NOT NULL,
+	`config` text,
+	`mcp_server_id` text,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `tools_slug_unique` ON `tools` (`slug`);