@mmmbuto/nexuscrew 0.2.1 → 0.2.3

package/lib/server/db/drivers/sql-js.js

@@ -1,75 +0,0 @@
-const initSqlJs = require('sql.js');
-const fs = require('fs');
-
-class SqlJsDriver {
-  constructor(dbPath) {
-    this.dbPath = dbPath;
-    this.db = null;
-    this.saveInterval = null;
-  }
-
-  async init() {
-    const SQL = await initSqlJs();
-
-    if (fs.existsSync(this.dbPath)) {
-      const buffer = fs.readFileSync(this.dbPath);
-      this.db = new SQL.Database(buffer);
-    } else {
-      this.db = new SQL.Database();
-    }
-
-    // Auto-save every 5 seconds
-    this.saveInterval = setInterval(() => this.save(), 5000);
-  }
-
-  save() {
-    if (!this.db) return;
-    const data = this.db.export();
-    const buffer = Buffer.from(data);
-    fs.writeFileSync(this.dbPath, buffer);
-  }
-
-  exec(sql) {
-    return this.db.run(sql);
-  }
-
-  prepare(sql) {
-    const stmt = this.db.prepare(sql);
-    return {
-      run: (...params) => {
-        stmt.bind(params);
-        stmt.step();
-        stmt.reset();
-        this.save();
-      },
-      get: (...params) => {
-        stmt.bind(params);
-        const result = stmt.step() ? stmt.getAsObject() : null;
-        stmt.reset();
-        return result;
-      },
-      all: (...params) => {
-        stmt.bind(params);
-        const results = [];
-        while (stmt.step()) {
-          results.push(stmt.getAsObject());
-        }
-        stmt.reset();
-        return results;
-      }
-    };
-  }
-
-  close() {
-    if (this.db) {
-      this.save();
-      this.db.close();
-    }
-    if (this.saveInterval) {
-      clearInterval(this.saveInterval);
-      this.saveInterval = null;
-    }
-  }
-}
-
-module.exports = SqlJsDriver;

package/lib/server/db/migrate.js

@@ -1,174 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const { initDb, getDb, saveDb } = require('./adapter');
-
-const MIGRATIONS_DIR = path.join(__dirname, 'migrations');
-
-/**
- * Get list of migration files in order
- */
-function getMigrationFiles() {
-  const files = fs.readdirSync(MIGRATIONS_DIR)
-    .filter(f => f.endsWith('.sql'))
-    .sort(); // Alphabetical order ensures numeric order (001_, 002_, etc.)
-  return files;
-}
-
-/**
- * Normalize and split SQL into executable statements.
- * Keeps CREATE/INSERT blocks while stripping comment-only lines.
- */
-function parseSqlStatements(sql) {
-  return sql
-    .replace(/\r\n/g, '\n')
-    .split(';')
-    .map(stmt => stmt.trim())
-    .map(stmt => {
-      const lines = stmt
-        .split('\n')
-        .map(line => line.trim())
-        .filter(line => line.length > 0 && !line.startsWith('--'));
-      return lines.join('\n').trim();
-    })
-    .filter(stmt => stmt.length > 0);
-}
-
-/**
- * Get applied migrations from DB
- */
-function getAppliedMigrations(db) {
-  try {
-    // Ensure migrations table exists
-    db.exec(`
-      CREATE TABLE IF NOT EXISTS _migrations (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        name TEXT UNIQUE NOT NULL,
-        applied_at INTEGER NOT NULL
-      )
-    `);
-
-    const stmt = db.prepare('SELECT name FROM _migrations ORDER BY id');
-    return stmt.all().map(row => row.name);
-  } catch (error) {
-    console.error('[Migration] Error getting applied migrations:', error.message);
-    return [];
-  }
-}
-
-/**
- * Mark migration as applied
- */
-function markMigrationApplied(db, name) {
-  const stmt = db.prepare('INSERT INTO _migrations (name, applied_at) VALUES (?, ?)');
-  stmt.run(name, Date.now());
-}
-
-/**
- * Run a single migration file
- */
-function runMigrationFile(db, filename) {
-  const filePath = path.join(MIGRATIONS_DIR, filename);
-  const migrationSql = fs.readFileSync(filePath, 'utf8');
-  const statements = parseSqlStatements(migrationSql);
-
-  console.log(`[Migration] Running ${filename} (${statements.length} statements)`);
-
-  for (let i = 0; i < statements.length; i++) {
-    const stmt = statements[i];
-
-    if (/^SELECT/i.test(stmt)) {
-      // Skip verification SELECT statements
-      continue;
-    }
-
-    try {
-      db.exec(stmt);
-    } catch (error) {
-      // Handle "duplicate column" errors gracefully
-      if (error.message.includes('duplicate column')) {
-        console.log(`[Migration] Column already exists (skipping): ${error.message}`);
-        continue;
-      }
-      console.error(`[Migration] Failed at statement ${i + 1}: ${error.message}`);
-      console.error('Statement preview:', stmt.substring(0, 200));
-      throw error;
-    }
-  }
-
-  markMigrationApplied(db, filename);
-  console.log(`[Migration] ✅ ${filename} applied`);
-}
-
-/**
- * Run database migrations.
- * @param {Object} options
- * @param {boolean} options.skipInit - skip initDb (adapter already initialized)
- */
-async function runMigrations(options = {}) {
-  const { skipInit = false } = options;
-
-  console.log('[Migration] Starting database migration...');
-
-  if (!skipInit && !getDb()) {
-    await initDb({ skipMigrationCheck: true });
-  }
-
-  const db = getDb();
-
-  if (!db) {
-    throw new Error('[Migration] Database instance not initialized');
-  }
-
-  const migrationFiles = getMigrationFiles();
-  const appliedMigrations = getAppliedMigrations(db);
-
-  console.log(`[Migration] Found ${migrationFiles.length} migration files`);
-  console.log(`[Migration] Already applied: ${appliedMigrations.length}`);
-
-  const pendingMigrations = migrationFiles.filter(f => !appliedMigrations.includes(f));
-
-  if (pendingMigrations.length === 0) {
-    console.log('[Migration] No pending migrations');
-    return;
-  }
-
-  console.log(`[Migration] Pending: ${pendingMigrations.join(', ')}`);
-
-  for (const file of pendingMigrations) {
-    runMigrationFile(db, file);
-  }
-
-  saveDb();
-
-  console.log('[Migration] All migrations completed');
-
-  // Verification counts
-  try {
-    const verifyStmt = db.prepare(`
-      SELECT 'conversations' as table_name, COUNT(*) as count FROM conversations
-      UNION ALL
-      SELECT 'messages' as table_name, COUNT(*) as count FROM messages
-    `);
-
-    const counts = verifyStmt.all();
-    console.log('[Migration] Verification:');
-    counts.forEach(row => console.log(`  ${row.table_name}: ${row.count} rows`));
-  } catch (error) {
-    console.error('[Migration] Verification failed:', error.message);
-  }
-}
-
-// Run if called directly
-if (require.main === module) {
-  runMigrations()
-    .then(() => {
-      console.log('[Migration] Complete');
-      process.exit(0);
-    })
-    .catch(error => {
-      console.error('[Migration] Failed:', error);
-      process.exit(1);
-    });
-}
-
-module.exports = { runMigrations };

package/lib/server/db/migrations/001_base_schema.sql

@@ -1,70 +0,0 @@
--- NexusCrew Base Schema Migration
--- This migration creates the initial database schema for NexusCrew
-
--- Conversations table (NexusCrew + auth schema)
-CREATE TABLE IF NOT EXISTS conversations (
-  id TEXT PRIMARY KEY,
-  title TEXT DEFAULT 'New Chat',
-  engine TEXT NOT NULL DEFAULT 'claude',
-  model TEXT,
-  tmux_window TEXT,
-  log_path TEXT,
-  workspace TEXT DEFAULT '',
-  host TEXT DEFAULT 'local',
-  status TEXT DEFAULT 'active',
-  pinned INTEGER DEFAULT 0,
-  metadata TEXT,
-  created_at INTEGER DEFAULT (unixepoch()),
-  updated_at INTEGER DEFAULT (unixepoch())
-);
-
--- Messages table
-CREATE TABLE IF NOT EXISTS messages (
-  id TEXT PRIMARY KEY,
-  conversation_id TEXT NOT NULL,
-  role TEXT NOT NULL,
-  content TEXT DEFAULT '',
-  engine TEXT,
-  model TEXT,
-  tokens_in INTEGER DEFAULT 0,
-  tokens_out INTEGER DEFAULT 0,
-  created_at INTEGER DEFAULT (unixepoch()),
-  FOREIGN KEY (conversation_id) REFERENCES conversations(id)
-);
-
--- Users table (auth)
-CREATE TABLE IF NOT EXISTS users (
-  id TEXT PRIMARY KEY,
-  username TEXT UNIQUE NOT NULL,
-  password_hash TEXT NOT NULL,
-  role TEXT NOT NULL DEFAULT 'user',
-  is_locked INTEGER NOT NULL DEFAULT 0,
-  failed_attempts INTEGER NOT NULL DEFAULT 0,
-  last_failed_attempt INTEGER,
-  locked_until INTEGER,
-  created_at INTEGER NOT NULL,
-  last_login INTEGER
-);
-
--- API Keys table
-CREATE TABLE IF NOT EXISTS api_keys (
-  provider TEXT PRIMARY KEY,
-  api_key TEXT NOT NULL,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
-);
-
--- Session summaries table
-CREATE TABLE IF NOT EXISTS session_summaries (
-  conversation_id TEXT PRIMARY KEY,
-  summary_short TEXT,
-  key_decisions TEXT,
-  files_modified TEXT,
-  updated_at INTEGER,
-  FOREIGN KEY (conversation_id) REFERENCES conversations(id)
-);
-
--- Indexes
-CREATE INDEX IF NOT EXISTS idx_messages_conv ON messages(conversation_id, created_at);
-CREATE INDEX IF NOT EXISTS idx_conversations_status ON conversations(status, updated_at);
-CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);

package/lib/server/middleware/auth.js

@@ -1,134 +0,0 @@
-const crypto = require('crypto');
-const jwt = require('jsonwebtoken');
-const User = require('../models/User');
-const { getConfig } = require('../../config/manager');
-
-let warnedEphemeralSecret = false;
-
-function getJwtSecret() {
-  if (process.env.JWT_SECRET) {
-    return process.env.JWT_SECRET;
-  }
-
-  const config = getConfig();
-  if (config.auth?.jwt_secret) {
-    return config.auth.jwt_secret;
-  }
-
-  if (!global.__NEXUSCREW_EPHEMERAL_JWT_SECRET__) {
-    global.__NEXUSCREW_EPHEMERAL_JWT_SECRET__ = crypto.randomBytes(48).toString('hex');
-  }
-
-  if (!warnedEphemeralSecret) {
-    warnedEphemeralSecret = true;
-    console.warn('[Auth] JWT secret missing from env and config; using ephemeral in-memory secret for this process');
-  }
-
-  return global.__NEXUSCREW_EPHEMERAL_JWT_SECRET__;
-}
-
-/**
- * Get config user (admin from init) by id
- */
-function findConfigUserById(id) {
-  if (id !== 'config-admin') return null;
-
-  const config = getConfig();
-  if (config.auth && config.auth.user) {
-    return {
-      id: 'config-admin',
-      username: config.auth.user,
-      role: 'admin',
-      is_locked: false,
-      created_at: Date.now()
-    };
-  }
-  return null;
-}
-
-const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || '7d';
-
-function generateToken(user) {
-  return jwt.sign(
-    {
-      id: user.id,
-      username: user.username,
-      role: user.role
-    },
-    getJwtSecret(),
-    { expiresIn: JWT_EXPIRES_IN }
-  );
-}
-
-function verifyToken(token) {
-  try {
-    return jwt.verify(token, getJwtSecret());
-  } catch (err) {
-    return null;
-  }
-}
-
-function authMiddleware(req, res, next) {
-  // BYPASS for localhost
-  const clientIp = req.ip || req.connection.remoteAddress || req.socket.remoteAddress;
-  if (clientIp === '127.0.0.1' || clientIp === '::1' || clientIp === '::ffff:127.0.0.1') {
-    req.user = { id: 'localhost', username: 'local', role: 'admin' };
-    return next();
-  }
-
-  const authHeader = req.headers.authorization;
-
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return res.status(401).json({ error: 'No token provided' });
-  }
-
-  const token = authHeader.substring(7);
-  const decoded = verifyToken(token);
-
-  if (!decoded) {
-    return res.status(401).json({ error: 'Invalid or expired token' });
-  }
-
-  // Verify user still exists - check config user first, then database
-  let user = findConfigUserById(decoded.id);
-  let isConfigUser = !!user;
-
-  if (!user) {
-    user = User.findById(decoded.id);
-  }
-
-  if (!user) {
-    return res.status(401).json({ error: 'User not found' });
-  }
-
-  // Check if account is locked (only for DB users)
-  if (!isConfigUser && User.isAccountLocked(user)) {
-    return res.status(403).json({
-      error: 'Account locked',
-      locked_until: user.locked_until
-    });
-  }
-
-  req.user = {
-    id: user.id,
-    username: user.username,
-    role: user.role
-  };
-
-  next();
-}
-
-function adminOnly(req, res, next) {
-  if (req.user.role !== 'admin') {
-    return res.status(403).json({ error: 'Admin access required' });
-  }
-  next();
-}
-
-module.exports = {
-  generateToken,
-  verifyToken,
-  authMiddleware,
-  adminOnly,
-  getJwtSecret
-};

package/lib/server/middleware/rate-limit.js

@@ -1,63 +0,0 @@
-/**
- * Rate Limiting Middleware for Chat Endpoints
- *
- * Protects AI chat endpoints from abuse by limiting requests per user.
- * Uses express-rate-limit with user-based keying via JWT.
- */
-
-const rateLimit = require('express-rate-limit');
-
-/**
- * Chat endpoints rate limiter
- * - 10 requests per minute per user
- * - Applies to: /api/v1/chat, /api/v1/codex, /api/v1/gemini, /api/v1/qwen
- */
-const chatRateLimiter = rateLimit({
-  windowMs: 60 * 1000, // 1 minute window
-  max: 10, // 10 requests per window
-  standardHeaders: true, // Return rate limit info in headers
-  legacyHeaders: false,
-
-  // Key by user ID from JWT (set by authMiddleware)
-  keyGenerator: (req) => {
-    return req.user?.id || req.ip;
-  },
-
-  // Custom error response
-  handler: (req, res) => {
-    res.status(429).json({
-      error: 'Too many requests',
-      message: 'Rate limit exceeded. Please wait before sending more messages.',
-      retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
-    });
-  },
-
-  // Skip rate limiting for interrupt endpoints
-  skip: (req) => {
-    return req.path.endsWith('/interrupt');
-  }
-});
-
-/**
- * General API rate limiter (for non-chat endpoints)
- * - 60 requests per minute per IP
- */
-const apiRateLimiter = rateLimit({
-  windowMs: 60 * 1000,
-  max: 60,
-  standardHeaders: true,
-  legacyHeaders: false,
-  keyGenerator: (req) => req.user?.id || req.ip,
-  handler: (req, res) => {
-    res.status(429).json({
-      error: 'Too many requests',
-      message: 'API rate limit exceeded.',
-      retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
-    });
-  }
-});
-
-module.exports = {
-  chatRateLimiter,
-  apiRateLimiter
-};

package/lib/server/models/User.js

@@ -1,128 +0,0 @@
-const { prepare, saveDb } = require('../db/adapter');
-const bcrypt = require('bcryptjs');
-const { v4: uuidv4 } = require('uuid');
-
-class User {
-  static create(username, password, role = 'user') {
-    const id = uuidv4();
-    const passwordHash = bcrypt.hashSync(password, 10);
-    const now = Date.now();
-
-    const stmt = prepare(`
-      INSERT INTO users (id, username, password_hash, role, created_at)
-      VALUES (?, ?, ?, ?, ?)
-    `);
-
-    stmt.run(id, username, passwordHash, role, now);
-    saveDb();
-
-    return { id, username, role, created_at: now };
-  }
-
-  static findByUsername(username) {
-    const stmt = prepare('SELECT * FROM users WHERE username = ?');
-    return stmt.get(username);
-  }
-
-  static findById(id) {
-    const stmt = prepare('SELECT * FROM users WHERE id = ?');
-    return stmt.get(id);
-  }
-
-  static count() {
-    const stmt = prepare('SELECT COUNT(*) as count FROM users');
-    const result = stmt.get();
-    return result ? result.count : 0;
-  }
-
-  static verifyPassword(user, password) {
-    return bcrypt.compareSync(password, user.password_hash);
-  }
-
-  static updateLastLogin(userId) {
-    const stmt = prepare('UPDATE users SET last_login = ? WHERE id = ?');
-    stmt.run(Date.now(), userId);
-    saveDb();
-  }
-
-  static incrementFailedAttempts(userId) {
-    const now = Date.now();
-    const stmt = prepare(`
-      UPDATE users
-      SET failed_attempts = failed_attempts + 1,
-          last_failed_attempt = ?
-      WHERE id = ?
-    `);
-    stmt.run(now, userId);
-    saveDb();
-
-    // Lock account after 5 failed attempts for 15 minutes
-    const user = this.findById(userId);
-    if (user.failed_attempts >= 5) {
-      const lockUntil = now + (15 * 60 * 1000); // 15 minutes
-      const lockStmt = prepare(`
-        UPDATE users
-        SET is_locked = 1, locked_until = ?
-        WHERE id = ?
-      `);
-      lockStmt.run(lockUntil, userId);
-      saveDb();
-    }
-  }
-
-  static resetFailedAttempts(userId) {
-    const stmt = prepare(`
-      UPDATE users
-      SET failed_attempts = 0,
-          is_locked = 0,
-          locked_until = NULL
-      WHERE id = ?
-    `);
-    stmt.run(userId);
-    saveDb();
-  }
-
-  static isAccountLocked(user) {
-    if (!user.is_locked) return false;
-    if (!user.locked_until) return true;
-
-    const now = Date.now();
-    if (now < user.locked_until) {
-      return true;
-    }
-
-    // Unlock account if lock period expired
-    this.resetFailedAttempts(user.id);
-    return false;
-  }
-
-  static logLoginAttempt(ipAddress, username, success) {
-    const stmt = prepare(`
-      INSERT INTO login_attempts (ip_address, username, success, timestamp)
-      VALUES (?, ?, ?, ?)
-    `);
-    stmt.run(ipAddress, username, success ? 1 : 0, Date.now());
-    saveDb();
-  }
-
-  static getRecentLoginAttempts(ipAddress, windowMs = 15 * 60 * 1000) {
-    const since = Date.now() - windowMs;
-    const stmt = prepare(`
-      SELECT COUNT(*) as count
-      FROM login_attempts
-      WHERE ip_address = ? AND timestamp > ?
-    `);
-    const result = stmt.get(ipAddress, since);
-    return result ? result.count : 0;
-  }
-
-  static cleanupOldLoginAttempts(daysToKeep = 7) {
-    const cutoff = Date.now() - (daysToKeep * 24 * 60 * 60 * 1000);
-    const stmt = prepare('DELETE FROM login_attempts WHERE timestamp < ?');
-    stmt.run(cutoff);
-    saveDb();
-    return 0; // sql.js doesn't return changes count easily
-  }
-}
-
-module.exports = User;