@mmmbuto/nexuscrew 0.1.0-beta.1 → 0.2.0

package/lib/server/routes/auth.js

@@ -0,0 +1,168 @@
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const bcrypt = require('bcryptjs');
+const User = require('../models/User');
+const { generateToken, authMiddleware } = require('../middleware/auth');
+const { getConfig } = require('../../config/manager');
+
+const router = express.Router();
+
+/**
+ * Check config user (admin from init)
+ * Returns user object compatible with DB user structure
+ */
+function findConfigUser(username) {
+  const config = getConfig();
+  if (config.auth && config.auth.user === username && config.auth.pass_hash) {
+    return {
+      id: 'config-admin',
+      username: config.auth.user,
+      password_hash: config.auth.pass_hash,
+      role: 'admin',
+      is_locked: false,
+      failed_attempts: 0,
+      created_at: Date.now()
+    };
+  }
+  return null;
+}
+
+/**
+ * Verify password for config user
+ */
+function verifyConfigPassword(passHash, password) {
+  return bcrypt.compareSync(password, passHash);
+}
+
+// Rate limiter: max 5 login attempts per 15 minutes per IP
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10,
+  message: {
+    error: 'Too many login attempts, please try again later',
+    retry_after: 15 * 60
+  },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+
+// POST /api/v1/auth/login
+router.post('/login', loginLimiter, async (req, res) => {
+  try {
+    const { username, password } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+
+    if (!username || !password) {
+      return res.status(400).json({ error: 'Username and password required' });
+    }
+
+    // Check IP rate limiting (additional layer)
+    const recentAttempts = User.getRecentLoginAttempts(ipAddress);
+    if (recentAttempts > 20) {
+      return res.status(429).json({
+        error: 'Too many failed attempts from this IP',
+        retry_after: 15 * 60
+      });
+    }
+
+    // First check config user (admin from init)
+    let user = findConfigUser(username);
+    let isConfigUser = !!user;
+
+    // If not config user, check database
+    if (!user) {
+      user = User.findByUsername(username);
+    }
+
+    if (!user) {
+      // Log failed attempt even for non-existent user
+      User.logLoginAttempt(ipAddress, username, false);
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+
+    // Check if account is locked (only for DB users)
+    if (!isConfigUser && User.isAccountLocked(user)) {
+      User.logLoginAttempt(ipAddress, username, false);
+      const remainingMs = user.locked_until - Date.now();
+      return res.status(403).json({
+        error: 'Account locked due to failed login attempts',
+        locked_until: user.locked_until,
+        retry_after: Math.ceil(remainingMs / 1000)
+      });
+    }
+
+    // Verify password
+    let isValid;
+    if (isConfigUser) {
+      isValid = verifyConfigPassword(user.password_hash, password);
+    } else {
+      isValid = User.verifyPassword(user, password);
+    }
+
+    if (!isValid) {
+      User.logLoginAttempt(ipAddress, username, false);
+      if (!isConfigUser) {
+        User.incrementFailedAttempts(user.id);
+      }
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+
+    // Success
+    User.logLoginAttempt(ipAddress, username, true);
+    if (!isConfigUser) {
+      User.resetFailedAttempts(user.id);
+      User.updateLastLogin(user.id);
+    }
+
+    const token = generateToken(user);
+
+    res.json({
+      token,
+      user: {
+        id: user.id,
+        username: user.username,
+        role: user.role
+      }
+    });
+  } catch (error) {
+    console.error('Login error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// GET /api/v1/auth/me
+router.get('/me', authMiddleware, (req, res) => {
+  // Config user is already validated by authMiddleware
+  // Just return the user info from req.user
+  if (req.user.id === 'config-admin') {
+    const config = getConfig();
+    return res.json({
+      id: req.user.id,
+      username: req.user.username,
+      role: req.user.role,
+      created_at: Date.now(),
+      last_login: null
+    });
+  }
+
+  const user = User.findById(req.user.id);
+  if (!user) {
+    return res.status(404).json({ error: 'User not found' });
+  }
+
+  res.json({
+    id: user.id,
+    username: user.username,
+    role: user.role,
+    created_at: user.created_at,
+    last_login: user.last_login
+  });
+});
+
+// POST /api/v1/auth/logout
+router.post('/logout', authMiddleware, (req, res) => {
+  // With JWT, logout is handled client-side by removing token
+  res.json({ message: 'Logged out successfully' });
+});
+
+module.exports = router;

package/lib/server/routes/keys.js

@@ -0,0 +1,15 @@
+const express = require('express');
+const router = express.Router();
+const { getApiKey } = require('../db/adapter');
+
+/**
+ * GET /api/v1/keys/check/:provider
+ * Check if an API key is configured for a provider
+ * Returns: { configured: boolean }
+ */
+router.get('/check/:provider', (req, res) => {
+  const key = getApiKey(req.params.provider);
+  res.json({ configured: !!key });
+});
+
+module.exports = router;

package/lib/server/routes/models.js

@@ -1,14 +1,69 @@
 /**
  * GET /api/v1/models — List available models and engines
+ *
+ * Merges engine-discovery results with runtime-manager status
  */
 
 const { Router } = require('express');
+const RuntimeManager = require('../services/runtime-manager');
 const router = Router();
 
-router.get('/', (req, res) => {
-  const { engines } = req;
-  const data = engines.getForFrontend();
-  res.json(data);
+const runtimeManager = new RuntimeManager();
+
+router.get('/', async (req, res) => {
+  try {
+    // Get engine discovery results
+    const { engines } = req;
+    const discoveryData = engines.getForFrontend();
+
+    // Get runtime-aware inventory
+    const runtimeInventory = await runtimeManager.getRuntimeInventory();
+    const runtimeMap = Object.fromEntries(
+      runtimeInventory.map(r => [r.runtimeId, r])
+    );
+
+    // Merge data
+    const merged = {};
+
+    for (const [engineName, engineData] of Object.entries(discoveryData)) {
+      merged[engineName] = {
+        ...engineData,
+        models: engineData.models.map(model => {
+          const runtimeId = model.lane === 'custom'
+            ? `${engineName}-custom`
+            : `${engineName}-native`;
+
+          const runtime = runtimeMap[runtimeId];
+
+          return {
+            id: model.id,
+            label: model.name,
+            name: model.name,
+            lane: model.lane,
+            available: runtime?.available ?? false,
+            runtimeStatus: runtime?.status ?? 'unknown',
+            runtimeCommand: runtime?.command || null,
+            runtimeSource: runtime?.source || null,
+            providerId: model.providerId || null,
+            ...(model.alias && { alias: model.alias }),
+            ...(model.modelHint && { modelHint: model.modelHint }),
+          };
+        }),
+        aliases: engineData.aliases.map(alias => {
+          const runtime = runtimeMap[`${engineName}-custom`];
+          return {
+            ...alias,
+            available: runtime?.available ?? false,
+          };
+        })
+      };
+    }
+
+    res.json(merged);
+  } catch (error) {
+    console.error('[Models] Error merging discovery and runtime data:', error);
+    res.status(500).json({ error: 'Failed to fetch models' });
+  }
 });
 
 module.exports = router;

package/lib/server/routes/runtimes.js

@@ -0,0 +1,34 @@
+const express = require('express');
+const RuntimeManager = require('../services/runtime-manager');
+
+const router = express.Router();
+const runtimeManager = new RuntimeManager();
+
+router.get('/', async (_req, res) => {
+  try {
+    const inventory = await runtimeManager.getRuntimeInventory();
+    res.json({
+      platform: runtimeManager.platformId,
+      runtimes: inventory,
+    });
+  } catch (error) {
+    console.error('[Runtimes] Inventory error:', error);
+    res.status(500).json({ error: 'Failed to fetch runtime inventory' });
+  }
+});
+
+router.post('/check', async (_req, res) => {
+  try {
+    const inventory = await runtimeManager.getRuntimeInventory();
+    res.json({
+      platform: runtimeManager.platformId,
+      runtimes: inventory,
+      checkedAt: new Date().toISOString(),
+    });
+  } catch (error) {
+    console.error('[Runtimes] Check error:', error);
+    res.status(500).json({ error: 'Failed to check runtimes' });
+  }
+});
+
+module.exports = router;

package/lib/server/routes/send.js

@@ -68,11 +68,32 @@ router.post('/', async (req, res) => {
       });
     }
 
+    // Context Bridge: if engine changed, add context to message
+    let fullMessage = message;
+    if (!isNew && conversationId && conversation.engine && conversation.engine !== resolvedEngine) {
+      try {
+        const { default: ContextBridge } = require('../services/context-bridge');
+        const ctx = await ContextBridge.buildContext({
+          conversationId: conversation.id,
+          fromEngine: conversation.engine,
+          toEngine: resolvedEngine,
+          userMessage: message
+        });
+        if (ctx.prompt) {
+          fullMessage = ctx.prompt;
+          console.log(`[send] Applied context bridge: ${conversation.engine} -> ${resolvedEngine} (${ctx.contextTokens} tokens)`);
+        }
+      } catch (err) {
+        console.warn('[send] Context bridge failed, proceeding without context:', err.message);
+        // Continue without context - non-fatal
+      }
+    }
+
     // Save user message
     store.addMessage({
       conversationId: conversation.id,
       role: 'user',
-      content: message,
+      content: fullMessage,
       engine: resolvedEngine,
       model: model
     });
@@ -92,6 +113,7 @@ router.post('/', async (req, res) => {
     } else if (engineInfo?.available) {
       command = buildEngineCommand(resolvedEngine, engineInfo, {
         model,
+        message: fullMessage, // Pass fullMessage for codex exec mode
         resume: resumeSession || (conversation.tmux_window ? conversation.id : null)
       });
     } else {
@@ -105,7 +127,7 @@ router.post('/', async (req, res) => {
 
     if (conversation.tmux_window && tmux.hasWindow(conversation.tmux_window, hostObj)) {
       // Resume existing window — send message directly
-      tmux.sendKeys(conversation.tmux_window, message, { enter: true, host: hostName });
+      tmux.sendKeys(conversation.tmux_window, fullMessage, { enter: true, host: hostName });
       logPath = conversation.log_path;
     } else {
       // Create new tmux window
@@ -127,7 +149,7 @@ router.post('/', async (req, res) => {
       if (resolvedEngine !== 'codex') {
         // Interactive CLIs need a moment to start
         await new Promise(r => setTimeout(r, 1500));
-        tmux.sendKeys(windowName, message, { enter: true, host: hostName });
+        tmux.sendKeys(windowName, fullMessage, { enter: true, host: hostName });
       }
       // Codex exec mode gets the message via the command itself
     }
@@ -255,7 +277,9 @@ function buildEngineCommand(engine, engineInfo, opts = {}) {
       return `${bin} --output-format json${opts.model ? ` --model ${opts.model}` : ''}`;
 
     case 'codex':
-      return `${bin} exec --json${opts.model ? ` -m ${opts.model}` : ''}${opts.reasoningEffort ? ` --reasoning ${opts.reasoningEffort}` : ''}`;
+      // For codex, message is passed via --prompt flag in exec mode
+      const prompt = opts.message ? ` --prompt "${opts.message.replace(/"/g, '\\"')}"` : '';
+      return `${bin} exec --json${opts.model ? ` -m ${opts.model}` : ''}${opts.reasoningEffort ? ` --reasoning ${opts.reasoningEffort}` : ''}${prompt}`;
 
     case 'gemini':
       if (opts.resume) {

package/lib/server/routes/sessions.js

@@ -1,8 +1,9 @@
 /**
- * GET /api/v1/sessions — List/load sessions
+ * GET /api/v1/sessions — List/load sessions (with tmux_alive status)
  * GET /api/v1/sessions/:id/messages — Get session messages
  * GET /api/v1/sessions/:id/summary — Get session summary
  * POST /api/v1/sessions/:id/rename — Rename session
+ * POST /api/v1/sessions/:id/pin — Pin/unpin session
  * DELETE /api/v1/sessions/:id — Delete session
  */
 
@@ -11,15 +12,39 @@ const router = Router();
 
 // List conversations (optionally grouped by date)
 router.get('/', (req, res) => {
-  const { store } = req;
+  const { store, tmux } = req;
   const { workspace, groupBy } = req.query;
 
   if (groupBy === 'date') {
     const grouped = store.listGroupedByDate({ workspace });
+
+    // Enrich with tmux_alive status
+    Object.keys(grouped).forEach(dateGroup => {
+      grouped[dateGroup].forEach(conv => {
+        if (conv.tmux_window) {
+          const host = conv.host !== 'local' ? conv.host : null;
+          conv.tmux_alive = tmux.hasWindow(conv.tmux_window, host);
+        } else {
+          conv.tmux_alive = false;
+        }
+      });
+    });
+
     return res.json(grouped);
   }
 
   const convs = store.listConversations({ workspace });
+
+  // Enrich with tmux_alive status
+  convs.forEach(conv => {
+    if (conv.tmux_window) {
+      const host = conv.host !== 'local' ? conv.host : null;
+      conv.tmux_alive = tmux.hasWindow(conv.tmux_window, host);
+    } else {
+      conv.tmux_alive = false;
+    }
+  });
+
   res.json({ conversations: convs });
 });
 
@@ -79,6 +104,13 @@ router.post('/:id/rename', (req, res) => {
   res.json({ success: true, title });
 });
 
+// Pin/unpin conversation
+router.post('/:id/pin', (req, res) => {
+  const { store } = req;
+  const result = store.pinConversation(req.params.id);
+  res.json({ pinned: result });
+});
+
 // Delete conversation (kills tmux window too)
 router.delete('/:id', (req, res) => {
   const { store, tmux, logWatcher } = req;

package/lib/server/routes/speech.js

@@ -0,0 +1,75 @@
+const express = require('express');
+const router = express.Router();
+const multer = require('multer');
+const { getApiKey } = require('../db/adapter');
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 25 * 1024 * 1024 } // 25MB max (Whisper limit)
+});
+
+/**
+ * POST /api/v1/speech/transcribe
+ * Transcribe audio using OpenAI Whisper API
+ * Body: multipart/form-data with 'audio' file and 'language' (optional)
+ * Returns: { text: string }
+ *
+ * Supported languages (aligned with UI): it, en, es, ja, ru, zh
+ */
+router.post('/transcribe', upload.single('audio'), async (req, res) => {
+  try {
+    const apiKey = getApiKey('openai');
+    if (!apiKey) {
+      return res.status(400).json({ error: 'OpenAI API key not configured' });
+    }
+
+    if (!req.file) {
+      return res.status(400).json({ error: 'No audio file provided' });
+    }
+
+    // Build FormData using native Node.js 22+ FormData and File
+    const formData = new FormData();
+    const audioFile = new File([req.file.buffer], 'audio.webm', {
+      type: req.file.mimetype || 'audio/webm'
+    });
+    formData.append('file', audioFile);
+    formData.append('model', 'whisper-1');
+
+    // Use language from request - extract base language (it-IT -> it)
+    if (req.body.language) {
+      const lang = req.body.language.split('-')[0]; // it-IT -> it
+      formData.append('language', lang);
+    }
+
+    console.log('[Speech] Transcribing audio:', {
+      size: req.file.size,
+      mimetype: req.file.mimetype,
+      language: req.body.language || 'auto-detect'
+    });
+
+    // Use native fetch (Node.js 22+)
+    const response = await fetch('https://api.openai.com/v1/audio/transcriptions', {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${apiKey}`
+      },
+      body: formData
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      console.error('[Speech] OpenAI error:', error);
+      return res.status(response.status).json(error);
+    }
+
+    const data = await response.json();
+    console.log('[Speech] Transcription success:', data.text?.substring(0, 50) + '...');
+    res.json(data);
+
+  } catch (error) {
+    console.error('[Speech] Transcription error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

package/lib/server/routes/upload.js

@@ -0,0 +1,134 @@
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs');
+
+const router = express.Router();
+
+// NexusCrew: attachments in ~/.nexuscrew/attachments
+const ATTACHMENTS_DIR = path.join(process.env.HOME, '.nexuscrew', 'attachments');
+
+// Ensure directory exists
+if (!fs.existsSync(ATTACHMENTS_DIR)) {
+  fs.mkdirSync(ATTACHMENTS_DIR, { recursive: true });
+  console.log(`[Upload] Created attachments directory: ${ATTACHMENTS_DIR}`);
+}
+
+// Multer storage config
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => {
+    cb(null, ATTACHMENTS_DIR);
+  },
+  filename: (req, file, cb) => {
+    // Unique filename: timestamp_originalname
+    const timestamp = Date.now();
+    const safeName = file.originalname.replace(/[^a-zA-Z0-9._-]/g, '_');
+    cb(null, `${timestamp}_${safeName}`);
+  }
+});
+
+// File filter - allow images and documents
+const fileFilter = (req, file, cb) => {
+  const allowedMimes = [
+    // Images
+    'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/svg+xml',
+    // Documents
+    'text/plain', 'text/markdown', 'text/csv', 'text/html', 'text/css',
+    'application/json', 'application/xml', 'application/pdf',
+    'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    // Code files (often sent as octet-stream)
+    'application/octet-stream', 'text/x-python', 'text/javascript', 'application/javascript'
+  ];
+
+  // Also allow by extension for code files
+  const allowedExts = ['.js', '.ts', '.py', '.java', '.c', '.cpp', '.h', '.rb', '.php', '.go', '.rs', '.sh', '.bash', '.zsh', '.md', '.txt', '.json', '.yaml', '.yml', '.toml', '.xml', '.html', '.css', '.sql', '.log'];
+  const ext = path.extname(file.originalname).toLowerCase();
+
+  if (allowedMimes.includes(file.mimetype) || allowedExts.includes(ext)) {
+    cb(null, true);
+  } else {
+    cb(new Error(`File type not allowed: ${file.mimetype} (${ext})`), false);
+  }
+};
+
+// Multer config - 50MB limit
+const upload = multer({
+  storage,
+  fileFilter,
+  limits: { fileSize: 50 * 1024 * 1024 }
+});
+
+// POST /api/v1/upload - Single file upload
+router.post('/', upload.single('file'), (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No file uploaded' });
+    }
+
+    const filePath = req.file.path;
+    const fileName = req.file.filename;
+    const originalName = req.file.originalname;
+    const mimeType = req.file.mimetype;
+    const size = req.file.size;
+
+    console.log(`[Upload] File saved: ${filePath} (${size} bytes, ${mimeType})`);
+
+    res.json({
+      success: true,
+      file: {
+        path: filePath,
+        name: fileName,
+        originalName,
+        mimeType,
+        size
+      }
+    });
+  } catch (error) {
+    console.error('[Upload] Error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// POST /api/v1/upload/multiple - Multiple files upload
+router.post('/multiple', upload.array('files', 10), (req, res) => {
+  try {
+    if (!req.files || req.files.length === 0) {
+      return res.status(400).json({ error: 'No files uploaded' });
+    }
+
+    const files = req.files.map(f => ({
+      path: f.path,
+      name: f.filename,
+      originalName: f.originalname,
+      mimeType: f.mimetype,
+      size: f.size
+    }));
+
+    console.log(`[Upload] ${files.length} files saved`);
+
+    res.json({
+      success: true,
+      files
+    });
+  } catch (error) {
+    console.error('[Upload] Error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Error handler for multer
+router.use((error, req, res, next) => {
+  if (error instanceof multer.MulterError) {
+    if (error.code === 'LIMIT_FILE_SIZE') {
+      return res.status(400).json({ error: 'File too large (max 50MB)' });
+    }
+    return res.status(400).json({ error: error.message });
+  }
+  if (error) {
+    return res.status(400).json({ error: error.message });
+  }
+  next();
+});
+
+module.exports = router;