@mmmbuto/nexuscrew 0.1.0-beta.1 → 0.2.1

package/lib/server/routes/auth.js

@@ -0,0 +1,168 @@
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const bcrypt = require('bcryptjs');
+const User = require('../models/User');
+const { generateToken, authMiddleware } = require('../middleware/auth');
+const { getConfig } = require('../../config/manager');
+
+const router = express.Router();
+
+/**
+ * Check config user (admin from init)
+ * Returns user object compatible with DB user structure
+ */
+function findConfigUser(username) {
+  const config = getConfig();
+  if (config.auth && config.auth.user === username && config.auth.pass_hash) {
+    return {
+      id: 'config-admin',
+      username: config.auth.user,
+      password_hash: config.auth.pass_hash,
+      role: 'admin',
+      is_locked: false,
+      failed_attempts: 0,
+      created_at: Date.now()
+    };
+  }
+  return null;
+}
+
+/**
+ * Verify password for config user
+ */
+function verifyConfigPassword(passHash, password) {
+  return bcrypt.compareSync(password, passHash);
+}
+
+// Rate limiter: max 5 login attempts per 15 minutes per IP
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10,
+  message: {
+    error: 'Too many login attempts, please try again later',
+    retry_after: 15 * 60
+  },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+
+// POST /api/v1/auth/login
+router.post('/login', loginLimiter, async (req, res) => {
+  try {
+    const { username, password } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+
+    if (!username || !password) {
+      return res.status(400).json({ error: 'Username and password required' });
+    }
+
+    // Check IP rate limiting (additional layer)
+    const recentAttempts = User.getRecentLoginAttempts(ipAddress);
+    if (recentAttempts > 20) {
+      return res.status(429).json({
+        error: 'Too many failed attempts from this IP',
+        retry_after: 15 * 60
+      });
+    }
+
+    // First check config user (admin from init)
+    let user = findConfigUser(username);
+    let isConfigUser = !!user;
+
+    // If not config user, check database
+    if (!user) {
+      user = User.findByUsername(username);
+    }
+
+    if (!user) {
+      // Log failed attempt even for non-existent user
+      User.logLoginAttempt(ipAddress, username, false);
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+
+    // Check if account is locked (only for DB users)
+    if (!isConfigUser && User.isAccountLocked(user)) {
+      User.logLoginAttempt(ipAddress, username, false);
+      const remainingMs = user.locked_until - Date.now();
+      return res.status(403).json({
+        error: 'Account locked due to failed login attempts',
+        locked_until: user.locked_until,
+        retry_after: Math.ceil(remainingMs / 1000)
+      });
+    }
+
+    // Verify password
+    let isValid;
+    if (isConfigUser) {
+      isValid = verifyConfigPassword(user.password_hash, password);
+    } else {
+      isValid = User.verifyPassword(user, password);
+    }
+
+    if (!isValid) {
+      User.logLoginAttempt(ipAddress, username, false);
+      if (!isConfigUser) {
+        User.incrementFailedAttempts(user.id);
+      }
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+
+    // Success
+    User.logLoginAttempt(ipAddress, username, true);
+    if (!isConfigUser) {
+      User.resetFailedAttempts(user.id);
+      User.updateLastLogin(user.id);
+    }
+
+    const token = generateToken(user);
+
+    res.json({
+      token,
+      user: {
+        id: user.id,
+        username: user.username,
+        role: user.role
+      }
+    });
+  } catch (error) {
+    console.error('Login error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// GET /api/v1/auth/me
+router.get('/me', authMiddleware, (req, res) => {
+  // Config user is already validated by authMiddleware
+  // Just return the user info from req.user
+  if (req.user.id === 'config-admin') {
+    const config = getConfig();
+    return res.json({
+      id: req.user.id,
+      username: req.user.username,
+      role: req.user.role,
+      created_at: Date.now(),
+      last_login: null
+    });
+  }
+
+  const user = User.findById(req.user.id);
+  if (!user) {
+    return res.status(404).json({ error: 'User not found' });
+  }
+
+  res.json({
+    id: user.id,
+    username: user.username,
+    role: user.role,
+    created_at: user.created_at,
+    last_login: user.last_login
+  });
+});
+
+// POST /api/v1/auth/logout
+router.post('/logout', authMiddleware, (req, res) => {
+  // With JWT, logout is handled client-side by removing token
+  res.json({ message: 'Logged out successfully' });
+});
+
+module.exports = router;

package/lib/server/routes/hosts.js

@@ -6,23 +6,9 @@
  */
 
 const { Router } = require('express');
-const fs = require('fs');
-const path = require('path');
+const { readHosts, writeHosts, normalizeHost } = require('../../config/hosts');
 const router = Router();
 
-const HOSTS_PATH = path.join(process.env.HOME || '', '.nexuscrew', 'hosts.json');
-
-function readHosts() {
-  if (fs.existsSync(HOSTS_PATH)) {
-    return JSON.parse(fs.readFileSync(HOSTS_PATH, 'utf8'));
-  }
-  return [{ name: 'local', type: 'local', default: true }];
-}
-
-function writeHosts(hosts) {
-  fs.writeFileSync(HOSTS_PATH, JSON.stringify(hosts, null, 2));
-}
-
 router.get('/', (req, res) => {
   const { tmux } = req;
   const hosts = readHosts();
@@ -36,22 +22,27 @@ router.get('/', (req, res) => {
 });
 
 router.post('/', (req, res) => {
-  const { name, host, user, port, key } = req.body;
+  const { name, host, user, port, key, default: isDefault } = req.body;
   if (!name || !host) return res.status(400).json({ error: 'name and host required' });
 
-  const hosts = readHosts();
+  let hosts = readHosts();
   if (hosts.find(h => h.name === name)) {
     return res.status(409).json({ error: 'Host already exists' });
   }
 
-  hosts.push({
+  if (isDefault) {
+    hosts = hosts.map((entry) => ({ ...entry, default: false }));
+  }
+
+  hosts.push(normalizeHost({
     name,
     type: 'ssh',
     host,
     user: user || 'dag',
     port: port || '22',
-    key: key || undefined
-  });
+    key: key || undefined,
+    default: Boolean(isDefault)
+  }));
 
   writeHosts(hosts);
   res.json({ success: true, name });

package/lib/server/routes/keys.js

@@ -0,0 +1,28 @@
+const express = require('express');
+const router = express.Router();
+const { getApiKey } = require('../db/adapter');
+
+/**
+ * GET /api/v1/keys/check/:provider
+ * Check if an API key is configured for a provider
+ * Returns: { configured: boolean }
+ */
+router.get('/check/:provider', (req, res) => {
+  if (req.params.provider === 'stt') {
+    const speech = req.speech || req.app?.locals?.speech;
+    if (!speech) {
+      return res.json({ configured: false, provider: 'unknown' });
+    }
+    const status = speech.getStatus();
+    return res.json({
+      configured: Boolean(status.whisper?.configured && status.whisper?.available),
+      provider: status.provider,
+      fallback: status.fallback
+    });
+  }
+
+  const key = getApiKey(req.params.provider);
+  res.json({ configured: !!key });
+});
+
+module.exports = router;

package/lib/server/routes/models.js

@@ -1,14 +1,69 @@
 /**
  * GET /api/v1/models — List available models and engines
+ *
+ * Merges engine-discovery results with runtime-manager status
  */
 
 const { Router } = require('express');
+const RuntimeManager = require('../services/runtime-manager');
 const router = Router();
 
-router.get('/', (req, res) => {
-  const { engines } = req;
-  const data = engines.getForFrontend();
-  res.json(data);
+const runtimeManager = new RuntimeManager();
+
+router.get('/', async (req, res) => {
+  try {
+    // Get engine discovery results
+    const { engines } = req;
+    const discoveryData = engines.getForFrontend();
+
+    // Get runtime-aware inventory
+    const runtimeInventory = await runtimeManager.getRuntimeInventory();
+    const runtimeMap = Object.fromEntries(
+      runtimeInventory.map(r => [r.runtimeId, r])
+    );
+
+    // Merge data
+    const merged = {};
+
+    for (const [engineName, engineData] of Object.entries(discoveryData)) {
+      merged[engineName] = {
+        ...engineData,
+        models: engineData.models.map(model => {
+          const runtimeId = model.lane === 'custom'
+            ? `${engineName}-custom`
+            : `${engineName}-native`;
+
+          const runtime = runtimeMap[runtimeId];
+
+          return {
+            id: model.id,
+            label: model.name,
+            name: model.name,
+            lane: model.lane,
+            available: runtime?.available ?? false,
+            runtimeStatus: runtime?.status ?? 'unknown',
+            runtimeCommand: runtime?.command || null,
+            runtimeSource: runtime?.source || null,
+            providerId: model.providerId || null,
+            ...(model.alias && { alias: model.alias }),
+            ...(model.modelHint && { modelHint: model.modelHint }),
+          };
+        }),
+        aliases: engineData.aliases.map(alias => {
+          const runtime = runtimeMap[`${engineName}-custom`];
+          return {
+            ...alias,
+            available: runtime?.available ?? false,
+          };
+        })
+      };
+    }
+
+    res.json(merged);
+  } catch (error) {
+    console.error('[Models] Error merging discovery and runtime data:', error);
+    res.status(500).json({ error: 'Failed to fetch models' });
+  }
 });
 
 module.exports = router;

package/lib/server/routes/runtimes.js

@@ -0,0 +1,34 @@
+const express = require('express');
+const RuntimeManager = require('../services/runtime-manager');
+
+const router = express.Router();
+const runtimeManager = new RuntimeManager();
+
+router.get('/', async (_req, res) => {
+  try {
+    const inventory = await runtimeManager.getRuntimeInventory();
+    res.json({
+      platform: runtimeManager.platformId,
+      runtimes: inventory,
+    });
+  } catch (error) {
+    console.error('[Runtimes] Inventory error:', error);
+    res.status(500).json({ error: 'Failed to fetch runtime inventory' });
+  }
+});
+
+router.post('/check', async (_req, res) => {
+  try {
+    const inventory = await runtimeManager.getRuntimeInventory();
+    res.json({
+      platform: runtimeManager.platformId,
+      runtimes: inventory,
+      checkedAt: new Date().toISOString(),
+    });
+  } catch (error) {
+    console.error('[Runtimes] Check error:', error);
+    res.status(500).json({ error: 'Failed to check runtimes' });
+  }
+});
+
+module.exports = router;

package/lib/server/routes/send.js

@@ -12,10 +12,11 @@ const path = require('path');
 const router = Router();
 
 router.post('/', async (req, res) => {
-  const { tmux, engines, store, logWatcher, config } = req;
+  const { tmux, engines, store, logWatcher, remotePaneWatcher, attachments: attachmentManager } = req;
   const {
     conversationId,
     message,
+    attachments = [],
     model,
     engine: engineOverride,
     workspace,
@@ -44,7 +45,10 @@ router.post('/', async (req, res) => {
     // Resolve engine and model
     const resolvedEngine = engineOverride || resolveEngine(model, engines);
     const host = hostName || 'local';
-    const hostObj = host !== 'local' ? tmux.getHost(host) : null;
+    const hostObj = tmux.resolveHost(host);
+    if (!hostObj) {
+      throw new Error(`Unknown host "${host}"`);
+    }
 
     // Get or create conversation
     let conversation;
@@ -68,11 +72,41 @@ router.post('/', async (req, res) => {
       });
     }
 
+    let fullMessage = message;
+    if (Array.isArray(attachments) && attachments.length > 0) {
+      const staged = attachments.map((file) =>
+        attachmentManager.stageForConversation(file, conversation.id, hostObj)
+      );
+      const fileLines = staged.map((file) => `- ${file.originalName || file.name} (${file.promptPath})`);
+      fullMessage = `[Attached files:\n${fileLines.join('\n')}\n]\n\n${fullMessage}`;
+      sendSSE('status', { content: `Prepared ${staged.length} attachment(s)` });
+    }
+
+    // Context Bridge: if engine changed, add context to message
+    if (!isNew && conversationId && conversation.engine && conversation.engine !== resolvedEngine) {
+      try {
+        const { default: ContextBridge } = require('../services/context-bridge');
+        const ctx = await ContextBridge.buildContext({
+          conversationId: conversation.id,
+          fromEngine: conversation.engine,
+          toEngine: resolvedEngine,
+          userMessage: message
+        });
+        if (ctx.prompt) {
+          fullMessage = ctx.prompt;
+          console.log(`[send] Applied context bridge: ${conversation.engine} -> ${resolvedEngine} (${ctx.contextTokens} tokens)`);
+        }
+      } catch (err) {
+        console.warn('[send] Context bridge failed, proceeding without context:', err.message);
+        // Continue without context - non-fatal
+      }
+    }
+
     // Save user message
     store.addMessage({
       conversationId: conversation.id,
       role: 'user',
-      content: message,
+      content: fullMessage,
       engine: resolvedEngine,
       model: model
     });
@@ -92,6 +126,7 @@ router.post('/', async (req, res) => {
     } else if (engineInfo?.available) {
       command = buildEngineCommand(resolvedEngine, engineInfo, {
         model,
+        message: fullMessage, // Pass fullMessage for codex exec mode
         resume: resumeSession || (conversation.tmux_window ? conversation.id : null)
       });
     } else {
@@ -102,10 +137,14 @@ router.post('/', async (req, res) => {
 
     // Create or reuse tmux window
     let logPath;
+    let remoteInitialSnapshot = '';
 
     if (conversation.tmux_window && tmux.hasWindow(conversation.tmux_window, hostObj)) {
+      if (hostObj.type !== 'local') {
+        remoteInitialSnapshot = tmux.capturePane(conversation.tmux_window, hostObj, 250);
+      }
       // Resume existing window — send message directly
-      tmux.sendKeys(conversation.tmux_window, message, { enter: true, host: hostName });
+      tmux.sendKeys(conversation.tmux_window, fullMessage, { enter: true, host: hostObj });
       logPath = conversation.log_path;
     } else {
       // Create new tmux window
@@ -113,7 +152,7 @@ router.post('/', async (req, res) => {
         windowName,
         command,
         cwd: conversation.workspace || workspace || process.env.HOME,
-        host: hostName
+        host: hostObj
       });
       logPath = result.logPath;
 
@@ -127,13 +166,18 @@ router.post('/', async (req, res) => {
       if (resolvedEngine !== 'codex') {
         // Interactive CLIs need a moment to start
         await new Promise(r => setTimeout(r, 1500));
-        tmux.sendKeys(windowName, message, { enter: true, host: hostName });
+        if (hostObj.type !== 'local') {
+          remoteInitialSnapshot = tmux.capturePane(windowName, hostObj, 250);
+        }
+        tmux.sendKeys(windowName, fullMessage, { enter: true, host: hostObj });
+      } else if (hostObj.type !== 'local') {
+        remoteInitialSnapshot = tmux.capturePane(windowName, hostObj, 250);
       }
       // Codex exec mode gets the message via the command itself
     }
 
     // Start watching the log
-    if (logPath) {
+    if (hostObj.type === 'local' && logPath) {
       logWatcher.watch(logPath, resolvedEngine, conversation.id);
     }
 
@@ -160,6 +204,10 @@ router.post('/', async (req, res) => {
           responseBuffer += data.content;
           sendSSE('chunk', { content: data.content });
           break;
+        case 'raw':
+          responseBuffer += data.content;
+          sendSSE('chunk', { content: data.content });
+          break;
         case 'message_done':
           if (!doneFired) {
             doneFired = true;
@@ -177,10 +225,25 @@ router.post('/', async (req, res) => {
       }
     };
 
-    logWatcher.on('data', onData);
+    const activeWatcher = hostObj.type === 'local' ? logWatcher : remotePaneWatcher;
+    activeWatcher.on('data', onData);
+
+    if (hostObj.type !== 'local') {
+      remotePaneWatcher.watch({
+        conversationId: conversation.id,
+        engine: resolvedEngine,
+        host: hostObj,
+        windowName: conversation.tmux_window || windowName,
+        promptText: fullMessage,
+        initialSnapshot: remoteInitialSnapshot
+      });
+    }
 
     function finishResponse(content, usage) {
-      logWatcher.off('data', onData);
+      activeWatcher.off('data', onData);
+      if (hostObj.type !== 'local') {
+        remotePaneWatcher.unwatchByConversation(conversation.id);
+      }
       clearTimeout(timeout);
 
       // Save assistant message
@@ -228,8 +291,7 @@ router.post('/interrupt', (req, res) => {
     return res.json({ success: false, reason: 'No active tmux window' });
   }
 
-  const host = conversation.host !== 'local' ? conversation.host : null;
-  tmux.interrupt(conversation.tmux_window, host);
+  tmux.interrupt(conversation.tmux_window, conversation.host || 'local');
 
   res.json({ success: true, method: 'tmux interrupt' });
 });
@@ -255,7 +317,9 @@ function buildEngineCommand(engine, engineInfo, opts = {}) {
       return `${bin} --output-format json${opts.model ? ` --model ${opts.model}` : ''}`;
 
     case 'codex':
-      return `${bin} exec --json${opts.model ? ` -m ${opts.model}` : ''}${opts.reasoningEffort ? ` --reasoning ${opts.reasoningEffort}` : ''}`;
+      // For codex, message is passed via --prompt flag in exec mode
+      const prompt = opts.message ? ` --prompt ${JSON.stringify(opts.message)}` : '';
+      return `${bin} exec --json${opts.model ? ` -m ${opts.model}` : ''}${opts.reasoningEffort ? ` --reasoning ${opts.reasoningEffort}` : ''}${prompt}`;
 
     case 'gemini':
       if (opts.resume) {

package/lib/server/routes/sessions.js

@@ -1,8 +1,9 @@
 /**
- * GET /api/v1/sessions — List/load sessions
+ * GET /api/v1/sessions — List/load sessions (with tmux_alive status)
  * GET /api/v1/sessions/:id/messages — Get session messages
  * GET /api/v1/sessions/:id/summary — Get session summary
  * POST /api/v1/sessions/:id/rename — Rename session
+ * POST /api/v1/sessions/:id/pin — Pin/unpin session
  * DELETE /api/v1/sessions/:id — Delete session
  */
 
@@ -11,15 +12,37 @@ const router = Router();
 
 // List conversations (optionally grouped by date)
 router.get('/', (req, res) => {
-  const { store } = req;
-  const { workspace, groupBy } = req.query;
+  const { store, tmux } = req;
+  const { workspace, groupBy, host } = req.query;
 
   if (groupBy === 'date') {
-    const grouped = store.listGroupedByDate({ workspace });
+    const grouped = store.listGroupedByDate({ workspace, host });
+
+    // Enrich with tmux_alive status
+    Object.keys(grouped).forEach(dateGroup => {
+      grouped[dateGroup].forEach(conv => {
+        if (conv.tmux_window) {
+          conv.tmux_alive = tmux.hasWindow(conv.tmux_window, conv.host || 'local');
+        } else {
+          conv.tmux_alive = false;
+        }
+      });
+    });
+
     return res.json(grouped);
   }
 
-  const convs = store.listConversations({ workspace });
+  const convs = store.listConversations({ workspace, host });
+
+  // Enrich with tmux_alive status
+  convs.forEach(conv => {
+    if (conv.tmux_window) {
+      conv.tmux_alive = tmux.hasWindow(conv.tmux_window, conv.host || 'local');
+    } else {
+      conv.tmux_alive = false;
+    }
+  });
+
   res.json({ conversations: convs });
 });
 
@@ -33,8 +56,7 @@ router.get('/:id', (req, res) => {
   }
 
   // Check tmux window status
-  const host = conv.host !== 'local' ? conv.host : null;
-  const alive = conv.tmux_window ? tmux.hasWindow(conv.tmux_window, host) : false;
+  const alive = conv.tmux_window ? tmux.hasWindow(conv.tmux_window, conv.host || 'local') : false;
 
   res.json({
     session: {
@@ -79,23 +101,30 @@ router.post('/:id/rename', (req, res) => {
   res.json({ success: true, title });
 });
 
+// Pin/unpin conversation
+router.post('/:id/pin', (req, res) => {
+  const { store } = req;
+  const result = store.pinConversation(req.params.id);
+  res.json({ pinned: result });
+});
+
 // Delete conversation (kills tmux window too)
 router.delete('/:id', (req, res) => {
-  const { store, tmux, logWatcher } = req;
+  const { store, tmux, logWatcher, remotePaneWatcher } = req;
   const conv = store.getConversation(req.params.id);
 
   if (!conv) return res.status(404).json({ error: 'Not found' });
 
   // Kill tmux window if active
   if (conv.tmux_window) {
-    const host = conv.host !== 'local' ? conv.host : null;
-    tmux.killWindow(conv.tmux_window, host);
+    tmux.killWindow(conv.tmux_window, conv.host || 'local');
   }
 
   // Stop log watcher
   if (conv.log_path) {
     logWatcher.unwatch(conv.log_path);
   }
+  remotePaneWatcher?.unwatchByConversation?.(req.params.id);
 
   store.deleteConversation(req.params.id);
   res.json({ success: true });

package/lib/server/routes/speech.js

@@ -0,0 +1,46 @@
+const express = require('express');
+const router = express.Router();
+const multer = require('multer');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { PATHS } = require('../../utils/paths');
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 25 * 1024 * 1024 }
+});
+
+router.get('/status', (req, res) => {
+  res.json(req.speech.getStatus());
+});
+
+router.post('/transcribe', upload.single('audio'), async (req, res) => {
+  let tempPath = null;
+
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No audio file provided' });
+    }
+
+    fs.mkdirSync(PATHS.DATA_DIR, { recursive: true });
+    tempPath = path.join(PATHS.DATA_DIR, `stt-${Date.now()}-${Math.random().toString(16).slice(2)}.webm`);
+    fs.writeFileSync(tempPath, req.file.buffer);
+
+    const result = await req.speech.transcribe({
+      audioPath: tempPath,
+      language: req.body.language
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('[Speech] Transcription error:', error);
+    res.status(500).json({ error: error.message });
+  } finally {
+    if (tempPath && fs.existsSync(tempPath)) {
+      fs.unlinkSync(tempPath);
+    }
+  }
+});
+
+module.exports = router;